// call.mjs — a real call, in a real browser.
//
// Driven by TestCallInARealBrowser, which starts the app on a real
// port, signs the two members in through the magic-link flow, creates
// the meeting, and hands this script the origin, the meeting id and the
// scenario to run.
//
//   node test/browser/call.mjs <origin> <sqid> <scenario>
//
// The secrets do not travel on argv, where every process on the box can
// read them off /proc: the session cookies and the meeting's join-link
// token arrive in the environment, as CALLS_COOKIE_NAME, CALLS_COOKIE_A,
// CALLS_COOKIE_B and CALLS_JOIN_TOKEN.
//
// One scenario per process. Every assertion prints one line; the exit
// code is the gate.
//
// Two things this script cannot do for itself, and asks Go for over its
// own stdin and stdout: read the mail recorder (a guest signs itself in
// from the browser, and only Go can see the link that was mailed), and
// restart the app. Both go out as a line beginning "CONTROL " and come
// back as one line.
//
// Chromium's flags are not decoration. --use-fake-device-for-media-stream
// gives every context a camera and a microphone that always work;
// --use-fake-ui-for-media-stream answers the permission prompt;
// --autoplay-policy=no-user-gesture-required lets a remote <video> play
// without a click; --disable-features=WebRtcHideLocalIpsWithMdns
// turns off mDNS candidate obfuscation, which in a container resolves to
// nothing at all — with no ICE servers in this slice (spec §5.5), host
// candidates are the only ones there are, and an obfuscated one connects
// to nobody; and --auto-accept-this-tab-capture answers getDisplayMedia
// with no picker, which the fake-ui flag does not cover (§5.4).
import { syntheticMedia } from './synthetic-media.mjs';
import { writeSync, mkdirSync, writeFileSync } from 'node:fs';
import { inflateSync } from 'node:zlib';
import { createInterface } from 'node:readline';
import { chromium } from 'playwright';

const [origin, sqid, scenario] = process.argv.slice(2);
const cookieName = process.env.CALLS_COOKIE_NAME;
const cookieA = process.env.CALLS_COOKIE_A;
const cookieB = process.env.CALLS_COOKIE_B;
const token = process.env.CALLS_JOIN_TOKEN;

if (!origin || !sqid || !scenario || !cookieName || !cookieA || !cookieB) {
  console.error('usage: call.mjs <origin> <sqid> <scenario>');
  console.error('  with CALLS_COOKIE_NAME, CALLS_COOKIE_A, CALLS_COOKIE_B and CALLS_JOIN_TOKEN in the environment');
  process.exit(2);
}

const GUEST = 'guest@example.com';
// A second outsider, whose only job is to be knocking while somebody
// else is let in: the guest-isolation filters (§4.3, ruling 9) leak
// nothing when the guest under test is the only guest in the room, so
// whole-branch review W-1 found this scenario passing with the filter
// deleted. Same link, so it costs one of the five sign-ins that link
// allows in fifteen minutes.
const WAITER = 'waiter@example.com';

// The Go driver gives up at three minutes. This gives up first, so a
// stuck scenario prints why instead of being killed silently. unref'd:
// it must not be the reason the process stays alive.
const HARNESS_DEADLINE = 165000;

const LAUNCH_ARGS = [
  '--use-fake-device-for-media-stream',
  '--use-fake-ui-for-media-stream',
  '--autoplay-policy=no-user-gesture-required',
  '--disable-features=WebRtcHideLocalIpsWithMdns',
  // §5.4's half of the permission story. --use-fake-ui-for-media-stream
  // answers getUserMedia and nothing else; getDisplayMedia has its own
  // picker, and in headless Chromium this is what accepts it without
  // one. It picks a fake 1280x720 monitor that really produces frames —
  // watched here at ~20/s over a loopback peer connection — so the
  // share scenario asserts on pixels and not only on a message. The
  // older --auto-select-desktop-capture-source needs a real display and
  // is not reached for.
  '--auto-accept-this-tab-capture',
  // The relay host in the ICE scenarios' contract does not exist, and
  // this is what makes it not exist *here*, rather than out on the
  // internet: the name never leaves the machine, and Chromium fails it
  // at once instead of waiting on a resolver. Both halves matter. §13's
  // last sentence says no test touches a relay, and a DNS lookup of the
  // platform's own relay host is touching one; and a resolution that
  // hangs takes Chromium's network thread with it — two runs of the ICE
  // scenario were watched failing exactly that way, with an answer that
  // was posted and 200'd never applied by the browser that had offered.
  // Every other scenario runs with no ICE servers at all, so this maps
  // a name none of them ever look up.
  '--host-resolver-rules=MAP relay.eu-west-1.oncarlos.com ~NOTFOUND',
];

// ── the scoreboard ───────────────────────────────────────────────────

const failures = [];

function line(s) {
  // Written synchronously to fd 1: an assertion is evidence, and
  // evidence that is still in a pipe buffer when the process ends is
  // evidence nobody has. Never a line Go would read as a control
  // request, and never a newline inside one.
  writeSync(1, String(s).replace(/\r?\n/g, ' | ') + '\n');
}

function check(cond, what) {
  if (cond) {
    line('ok   ' + what);
    return true;
  }
  failures.push(what);
  line('FAIL ' + what);
  return false;
}

// where names a page without quoting a secret. A join link and a magic
// link both live in a URL, and these lines are written to a log that
// outlives the run: only the first path segment goes in.
function where(page) {
  try {
    return '/' + (new URL(page.url()).pathname.split('/')[1] || '');
  } catch {
    return '(no url)';
  }
}

// ── the control channel back to Go ───────────────────────────────────

let rl = null;
const inbox = [];
const waiters = [];

function control(verb) {
  if (!rl) {
    rl = createInterface({ input: process.stdin });
    rl.on('line', (l) => {
      const w = waiters.shift();
      if (w) w(l);
      else inbox.push(l);
    });
  }
  line('CONTROL ' + verb);
  return new Promise((resolve) => {
    if (inbox.length) resolve(inbox.shift());
    else waiters.push(resolve);
  });
}

// ── waiting ──────────────────────────────────────────────────────────

const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

// until polls rather than reading once: every state this gate asserts on
// arrives over a network and a peer connection, and a single read is a
// race dressed up as an assertion.
async function until(fn, ms) {
  const deadline = Date.now() + ms;
  for (;;) {
    try {
      const got = await fn();
      if (got) return got;
    } catch {
      // A page mid-navigation: try again until the deadline.
    }
    if (Date.now() > deadline) return null;
    await sleep(250);
  }
}

// stayed is until's opposite, for the assertions that are about nothing
// happening: it polls for the whole window and returns null if the
// predicate held throughout, or the first state that broke it. A single
// read cannot tell "did not happen" from "has not happened yet".
async function stayed(page, ms, pred) {
  const deadline = Date.now() + ms;
  for (;;) {
    const s = await state(page);
    if (!pred(s)) return s;
    if (Date.now() > deadline) return null;
    await sleep(250);
  }
}

// bothStable is `stayed` for a pair of connections rather than one
// page's state: it watches both for the whole window and returns the
// first side that was not settled, or null if neither ever wobbled. A
// renegotiation still in flight leaves signalingState somewhere other
// than `stable`, and the shape worth catching is a rollback that never
// comes back — which a single read taken too early and one taken too
// late would both miss, in opposite directions.
async function bothStable(watch, ms) {
  const deadline = Date.now() + ms;
  for (;;) {
    for (const w of watch) {
      const s = await state(w.page);
      if (s.signaling[w.other] !== 'stable') {
        return { label: w.label, signaling: s.signaling, connection: s.connection };
      }
    }
    if (Date.now() > deadline) return null;
    await sleep(250);
  }
}

// frameGrowth is the only honest way to ask "is this media arriving
// *now*" (Codex S4-6). It reads the counter, and only then starts
// waiting for it to rise, so nothing delivered before the question was
// asked can answer it.
//
// Two ways the gate got this wrong. `frames[key] > 0` reads a counter
// `dropShare` deliberately leaves behind, so a second round of sharing
// could pass on the first round's frames with no media at all. And a
// baseline taken *before* a gesture is answered by the frames that
// arrived between the snapshot and the stall the gesture caused —
// which is exactly the shape of the camera failure this slice spent two
// fix rounds on.
//
// The answer carries both numbers, because a failure message that says
// only "no frames" cannot tell a stall from a screen that never
// started.
async function frameGrowth(page, key, ms) {
  const base = (await state(page)).frames[key] || 0;
  const grown = await until(async () => {
    const now = (await state(page)).frames[key] || 0;
    return now > base ? now : false;
  }, ms);
  return { ok: grown !== null, base, now: grown === null ? (await state(page)).frames[key] || 0 : grown };
}

// growth is frameGrowth's answer as a sentence, for the check that
// reads it.
function growth(g) {
  return g.base + ' -> ' + g.now;
}

// MEDIA_WINDOWS and MEDIA_WINDOW_MS are the shape of an observation:
// three subwindows of a second and a half, and growth required in every
// one of them. Four and a half seconds of watching, not four and a half
// seconds of deadline.
const MEDIA_WINDOWS = 3;
const MEDIA_WINDOW_MS = 1500;

// observe watches a set of counters over a fixed duration and requires
// each of them to move in *every* subwindow (Codex S4-14).
//
// The helper it replaces was two early-return waits in a row, which is
// a deadline and not an observation: counters reading 0, 1, 2, 3 and
// then frozen for ever satisfied it, because it stopped looking the
// moment it saw an increase. The failure this whole slice is about is a
// tile that runs for a moment after a renegotiation and then stops, so
// "it moved once" is precisely the answer that must not count.
//
// `read` returns every counter at once, so streams and peers are
// watched together rather than one after another — a check that walks
// them in turn gives each one a different window, and the last one gets
// its window after the others have had theirs. Lifted by name in
// test/browser/media.test.mjs, with a burst-then-freeze control.
async function observe(read, keys, opts) {
  const o = opts || {};
  const windows = o.windows === undefined ? MEDIA_WINDOWS : o.windows;
  const windowMs = o.windowMs === undefined ? MEDIA_WINDOW_MS : o.windowMs;
  const wait = o.sleep || sleep;
  if (!keys.length) return { ok: false, stalled: [['(nothing was expected)', 0]], series: [] };
  const seen = [await read()];
  const stalled = new Map();
  for (let w = 1; w <= windows; w++) {
    await wait(windowMs);
    const now = await read();
    const before = seen[seen.length - 1];
    for (const key of keys) {
      if ((now[key] || 0) > (before[key] || 0)) continue;
      if (!stalled.has(key)) stalled.set(key, w);
    }
    seen.push(now);
  }
  return {
    ok: stalled.size === 0,
    stalled: Array.from(stalled.entries()),
    series: keys.map((k) => k + ' ' + seen.map((s) => s[k] || 0).join('->')),
  };
}

// watchMedia is `observe` over what a set of sides should be receiving,
// named explicitly by the caller rather than read back off the page:
// a check that asks the page which screens it is showing and then
// requires those to move cannot fail for a screen that never arrived.
//
// Each side is {page, label, keys} — every frame key that side should
// be receiving, the other peer's camera included.
async function watchMedia(sides, at, opts) {
  for (const side of sides) {
    const correct = await side.page.evaluate(() => [...document.querySelectorAll('.calls-tile')].every(tile => {
      const video = tile.querySelector('video');
      if (!video) return true;
      const transform = new DOMMatrix(getComputedStyle(video).transform);
      const expected = tile.classList.contains('calls-tile-self') && !tile.classList.contains('calls-tile-share') ? -1 : 1;
      return transform.a === expected;
    }));
    check(correct, side.label + ': only the local camera display is mirrored');
  }
  const keys = [];
  for (const side of sides) {
    for (const key of side.keys) keys.push(side.label + ' | ' + key);
  }
  const read = async () => {
    const snaps = await Promise.all(sides.map((side) => state(side.page)));
    const out = {};
    sides.forEach((side, i) => {
      for (const key of side.keys) out[side.label + ' | ' + key] = snaps[i].frames[key] || 0;
    });
    return out;
  };
  const seen = await observe(read, keys, opts);
  const ok = check(seen.ok, at + 'every stream kept arriving through ' +
    ((opts && opts.windows) || MEDIA_WINDOWS) + ' windows of ' +
    (((opts && opts.windowMs) || MEDIA_WINDOW_MS) / 1000) + ' s (' + seen.series.join('; ') + ')');
  if (!ok) {
    for (const [key, window] of seen.stalled) line('   ' + key + ' stopped in window ' + window);
    for (const side of sides) line('   ' + (await diagnose(side.page, side.label)));
  }
  return ok;
}

// ── the browser ──────────────────────────────────────────────────────

const browser = await chromium.launch({ args: LAUNCH_ARGS });

const consoleErrors = new Map(); // label -> string[]
// Every Content-Security-Policy refusal any page reported, in any
// context. The rig serves the app through rastrillo's production stack
// (calls.ServeOptions), so this is the policy a deployed instance sends,
// and a style attribute or script it blocks is a failure of the scenario
// even when the check that would have noticed the damage is not written.
const cspViolations = [];
// Every console line, not only the errors: §5.2 promises that nothing
// about the servers is logged, and a promise about logging cannot be
// measured against the error channel alone.
const consoleLines = new Map(); // label -> string[]

// `via` is the browser to open the context in, for the one scenario
// (autoplay) that needs a Chromium launched under a different policy.
async function newContext(label, { cookie = null, javaScriptEnabled = true, via = browser, options = {} } = {}) {
  const ctx = await via.newContext({ javaScriptEnabled, ...options });
  if (cookie) {
    await ctx.addCookies([{ name: cookieName, value: cookie, url: origin }]);
  }
  consoleErrors.set(label, []);
  consoleLines.set(label, []);
  ctx.on('page', (p) => watch(p, label));
  // Diagnostic only, and on every context rather than the one scenario
  // that walks getStats by hand: when a pair does not come up, what the
  // browser thinks of its own connections is the evidence, and it
  // cannot be collected after the fact. The trap only records what is
  // constructed — no page behaviour changes, and nothing reads it
  // except diagnose() and the renewal scenario's own ufrag walk.
  if (javaScriptEnabled) await ctx.addInitScript(pcTap);
  if (javaScriptEnabled && process.env.CALLS_SYNTHETIC_MEDIA) await ctx.addInitScript(syntheticMedia);
  return ctx;
}


function watch(page, label) {
  const errs = consoleErrors.get(label);
  const all = consoleLines.get(label);
  page.on('console', (m) => {
    const text = m.text();
    all.push(m.type() + ': ' + text);
    if (/Content Security Policy/i.test(text)) cspViolations.push(label + ': ' + text);
    if (m.type() === 'error') errs.push(text);
  });
  page.on('pageerror', (e) => {
    const text = String(e && e.message ? e.message : e);
    all.push('pageerror: ' + text);
    errs.push(text);
  });
}

function errorsFor(label) {
  return (consoleErrors.get(label) || []).join('; ');
}

function linesFor(label) {
  return (consoleLines.get(label) || []).join('\n');
}

// state reads window.meet.state(). frames, signaling and connection are
// Maps in the page, so they are flattened here rather than trusting a
// serializer to carry them.
function state(page) {
  return page.evaluate(() => {
    const s = window.meet.state();
    return {
      peer: s.peer,
      boot: s.boot,
      admitted: s.admitted,
      terminal: s.terminal,
      rosters: s.rosters,
      stale: s.stale,
      peers: s.peers,
      frames: Object.fromEntries(s.frames),
      signaling: Object.fromEntries(s.signaling),
      connection: Object.fromEntries(s.connection),
      candidates: s.candidates,
      // §5.2 and §5.3. Both are plain objects in the page — `ice`
      // carries counts and three clocks in milliseconds since the
      // epoch, `renewals` is keyed by peer id — so they survive
      // page.evaluate as they are and are handed straight out.
      ice: s.ice,
      renewals: s.renewals,
      // §6 and §5.4. `chat` is two counts, `shares` a list of peer ids
      // and `sharing` a boolean, so all three survive page.evaluate as
      // they are. `frames` above is keyed by TILE rather than by peer
      // now, so a peer sharing a screen has a second entry under
      // `<peer>#share`.
      chat: s.chat,
      sharing: s.sharing,
      shares: s.shares,
      // §15.20. `hearing` is keyed by tile ('self' for this tab's own):
      // what each tile says about its audio, its levels between 0 and
      // 1, its lit bars and any notice. All plain values.
      hearing: s.hearing,
      audioBlocked: s.audioBlocked,
      soundBanner: s.soundBanner,
      noSoundFrom: s.noSoundFrom,
      remoteMedia: s.remoteMedia,
      // Speaker view: who has the floor, by peer id ('' before anyone).
      speaker: s.speaker,
      // §15.24: who this tab says it hears, and per peer whether they
      // are still in their first moments and the words are showing.
      hearingList: s.hearingList,
      connecting: s.connecting,
    };
  });
}

function statusText(page) {
  return page.evaluate(() => (document.getElementById('status') || {}).textContent || '');
}

// diagnose is what a failure prints. It is deliberately more than the
// assertion needed: this output is a fix round's evidence, and the
// difference between "frames stayed 0" and "frames stayed 0 while the
// connection said connected, the video element had a stream, 640px of
// width and was not paused" is the whole diagnosis. Only the first path
// segment of the URL goes in — see where().
async function diagnose(page, label) {
  try {
    const d = await page.evaluate(async () => {
      const s = window.meet ? window.meet.state() : null;
      const tiles = Array.from(document.querySelectorAll('#tiles figure')).map((f) => {
        const v = f.querySelector('video');
        return {
          name: (f.querySelector('figcaption span') || {}).textContent || '',
          note: (f.querySelector('.calls-tile-note') || {}).textContent || '',
          // §5.4: a screen and a face are the same <figure> with
          // different content, and only the class says which.
          share: f.classList.contains('calls-tile-share'),
          hasStream: !!(v && v.srcObject),
          readyState: v ? v.readyState : null,
          videoWidth: v ? v.videoWidth : null,
          paused: v ? v.paused : null,
          currentTime: v ? Number(v.currentTime.toFixed(2)) : null,
        };
      });
      // Every connection this page still holds, as the browser sees it
      // rather than as room.js reports it. `local` is the decisive one
      // when a pair does not come up: a null localDescription with a
      // signalingState of `stable` means this connection never
      // negotiated at all — nothing was offered, so nothing gathered —
      // which is a different fault from one that negotiated and could
      // not find a pair. The rest says whether there was anything to
      // offer: a transceiver per direction and kind, and the state of
      // the tracks behind them.
      //
      // And, under each connection, what the receiver actually got. A
      // connected transport carrying no pixels is the failure this gate
      // meets most often, and `frames: {}` alone cannot tell its three
      // causes apart: framesReceived at zero means nothing arrived;
      // framesReceived climbing while framesDecoded stays flat means the
      // decoder is the problem; freezeCount and pliCount rising mean the
      // pixels arrived and then stopped. The receiving track's own
      // `muted` sits beside them because a muted track decodes nothing
      // and looks, from the tile, exactly like a dead one.
      const pcState = [];
      for (const pc of window.__pcs || []) {
        try {
          if (pc.connectionState === 'closed') continue;
          const muted = new Map();
          for (const r of pc.getReceivers()) {
            if (r.track) muted.set(r.track.id, r.track.muted);
          }
          const inbound = [];
          const outbound = [];
          try {
            const report = await pc.getStats();
            report.forEach((v) => {
              if (v.kind !== 'video') return;
              if (v.type === 'inbound-rtp') {
                inbound.push({
                  ssrc: v.ssrc,
                  framesReceived: v.framesReceived,
                  framesDecoded: v.framesDecoded,
                  framesDropped: v.framesDropped,
                  pliCount: v.pliCount,
                  freezeCount: v.freezeCount,
                  muted: muted.has(v.trackIdentifier) ? muted.get(v.trackIdentifier) : null,
                });
              } else if (v.type === 'outbound-rtp') {
                // The other half of the same question. Inbound alone
                // cannot tell "this browser stopped sending" from "this
                // browser stopped receiving", and with two video streams
                // per connection that is the first thing to know.
                outbound.push({
                  ssrc: v.ssrc,
                  framesSent: v.framesSent,
                  framesEncoded: v.framesEncoded,
                  active: v.active,
                  limited: v.qualityLimitationReason,
                });
              }
            });
          } catch {
            // getStats on a connection that is closing: nothing to add.
          }
          pcState.push({
            signaling: pc.signalingState,
            connection: pc.connectionState,
            ice: pc.iceConnectionState,
            gathering: pc.iceGatheringState,
            local: pc.localDescription && pc.localDescription.type,
            remote: pc.remoteDescription && pc.remoteDescription.type,
            senders: pc.getSenders().length,
            // mid/wanted/negotiated:kind. `currentDirection` is the
            // one that decides whether media flows — `direction` is
            // only what this side asked for — and the mid says which
            // m-line each transceiver ended up on, which is the whole
            // question when two peers renegotiate at once.
            transceivers: pc.getTransceivers().map((t) => (t.mid == null ? '-' : t.mid) + ' ' +
              t.direction + '/' + (t.currentDirection || '-') + ':' +
              ((t.receiver && t.receiver.track && t.receiver.track.kind) ||
                (t.sender && t.sender.track && t.sender.track.kind) || '?')),
            tracks: pc.getSenders().filter((sn) => sn.track)
              .map((sn) => sn.track.kind + ':' + sn.track.readyState),
            inbound,
            outbound,
          });
        } catch {
          // A connection that went away under the walk.
        }
      }

      // §5.4: what this tab is capturing, when it is capturing at all.
      // Read off the sender that carries it, because room.js does not
      // put its capture on `window` and should not; `displaySurface` is
      // the one settings key only getDisplayMedia produces, so it is
      // also how a display track is told from a camera. Null on every
      // page that is not sharing.
      let displaySurface = null;
      for (const pc of window.__pcs || []) {
        try {
          if (pc.connectionState === 'closed') continue;
          for (const sn of pc.getSenders()) {
            if (!sn.track || sn.track.kind !== 'video' || !sn.track.getSettings) continue;
            const settings = sn.track.getSettings();
            if (settings && settings.displaySurface) displaySurface = settings.displaySurface;
          }
        } catch {
          // Same connection, same reason.
        }
      }

      return {
        at: '/' + (location.pathname.split('/')[1] || ''),
        status: (document.getElementById('status') || {}).textContent || '',
        roomHidden: (document.getElementById('room') || {}).hidden,
        displaySurface,
        pcState,
        state: s
          ? {
            peer: s.peer,
            admitted: s.admitted,
            terminal: s.terminal,
            peers: s.peers,
            stale: s.stale,
            rosters: s.rosters,
            frames: Object.fromEntries(s.frames),
            signaling: Object.fromEntries(s.signaling),
            connection: Object.fromEntries(s.connection),
            ice: s.ice,
            renewals: s.renewals,
            // Where ICE got to, per peer. The pcState above says
            // negotiation finished; these say whether anything was
            // ever gathered, delivered to the hub, received or added
            // afterwards, which is the next question and the one
            // nothing else answers.
            candidates: s.candidates,
            // §6 and §5.4: lines in and out, and whose screens this
            // page is showing. A share tile that never arrived and one
            // that arrived and stopped read the same in `tiles` below;
            // these two say which it was.
            chat: s.chat,
            sharing: s.sharing,
            shares: s.shares,
          }
          : null,
        tiles,
        queue: Array.from(document.querySelectorAll('#knocks li')).map((li) => li.textContent),
      };
    });
    return label + ' ' + JSON.stringify(d) + ' console=[' + errorsFor(label) + ']';
  } catch (e) {
    return label + ' could not be diagnosed: ' + e.message + ' console=[' + errorsFor(label) + ']';
  }
}

// ── the room ─────────────────────────────────────────────────────────

async function openRoom(ctx) {
  const page = await ctx.newPage();
  await page.goto(origin + '/m/' + sqid, { waitUntil: 'domcontentloaded' });
  // window.meet exists only once #room is in the document and the
  // script has run to its end.
  await page.waitForFunction(() => !!window.meet, null, { timeout: 20000 });
  return page;
}

// connected is admitted, with at least one live peer connection. It is
// never asserted tighter than a couple of seconds: a pair negotiates,
// and glare runs on nearly every one of them.
async function waitConnected(page, ms = 25000) {
  return until(async () => {
    const s = await state(page);
    return s.admitted && s.peers.length >= 1 ? s : false;
  }, ms);
}

async function waitFrames(page, peer, ms = 25000) {
  return until(async () => {
    const s = await state(page);
    return (s.frames[peer] || 0) > 0 ? s : false;
  }, ms);
}

async function waitStatus(page, text, ms = 20000) {
  return until(async () => ((await statusText(page)).includes(text) ? true : false), ms);
}

// A pair is asserted from both ends: a call where only one side sees
// video is not a call.
async function assertPair(pageA, pageB, labelA, labelB, ms = 25000) {
  const a = await waitConnected(pageA, ms);
  if (!check(a, labelA + ' is admitted and has a peer connection — ' + (await diagnose(pageA, labelA)))) return null;
  const b = await waitConnected(pageB, ms);
  if (!check(b, labelB + ' is admitted and has a peer connection — ' + (await diagnose(pageB, labelB)))) return null;

  check(a.peers.includes(b.peer), labelA + ' knows ' + labelB + "'s peer id (" + a.peers + ' vs ' + b.peer + ')');
  check(b.peers.includes(a.peer), labelB + ' knows ' + labelA + "'s peer id (" + b.peers + ' vs ' + a.peer + ')');

  // Negotiation settled and the transport came up, read straight off the
  // RTCPeerConnection. Glare runs on nearly every pair here, so a
  // signalingState still at have-local-offer is the shape a collision
  // that never resolved would leave behind.
  for (const [page, label, other, otherLabel] of [
    [pageA, labelA, b.peer, labelB],
    [pageB, labelB, a.peer, labelA],
  ]) {
    const settled = await until(async () => {
      const s = await state(page);
      return s.signaling[other] === 'stable' && s.connection[other] === 'connected' ? s : false;
    }, ms);
    check(settled, label + ' settled negotiation and connected to ' + otherLabel +
      ' — ' + (await diagnose(page, label)));
  }

  const fa = await waitFrames(pageA, b.peer, ms);
  check(fa, labelA + ' decoded a video frame from ' + labelB + ' — ' + (await diagnose(pageA, labelA)));
  const fb = await waitFrames(pageB, a.peer, ms);
  check(fb, labelB + ' decoded a video frame from ' + labelA + ' — ' + (await diagnose(pageB, labelB)));

  return { a, b };
}

// leave is preferred over closing the context: `leave` is posted with
// keepalive on pagehide, and a closing context may never flush it —
// which would leave this session's one peer slot held into whatever runs
// next.
async function leaveRoom(page) {
  try {
    await page.click('#leave', { timeout: 5000 });
    await page.waitForURL('**/m/' + sqid + '/join', { timeout: 10000 });
  } catch {
    // A terminal page has its controls disabled; there is nothing to
    // leave, and the participation is already gone.
  }
}

// The call window (2026-09-28) keeps chat, the layout and the devices
// behind the bar's buttons, so a scenario opens them the way a person
// does. chatMounted is whether room.js has made the panel usable — the
// hidden attribute it owns — which is not whether the sidebar is open.
function chatMounted(page) {
  return page.evaluate(() => {
    const c = document.getElementById('chat');
    return !!c && !c.hidden;
  });
}

async function openChat(page) {
  await until(() => chatMounted(page), 10000);
  if ((await page.locator('#toggle-chat').getAttribute('aria-expanded')) !== 'true') {
    await page.locator('#toggle-chat').click();
  }
  await page.locator('#chat-text').waitFor({ state: 'visible', timeout: 5000 });
}

// openTileMenu opens a tile's ⋯ menu (2026-09-29): Pin, the moves and,
// for a member, Remove live there rather than on the tile.
async function openTileMenu(page, key) {
  const more = page.locator('#tiles > figure[data-tile="' + key + '"] .calls-tool-more');
  if ((await more.getAttribute('aria-expanded')) !== 'true') {
    await page.locator('#tiles > figure[data-tile="' + key + '"]').hover();
    await more.click();
  }
  await page.locator('#tile-menu').waitFor({ state: 'visible', timeout: 3000 });
}

// chooseLayout picks Speaker or Grid from the bar's layout popover, and
// closes it again.
async function chooseLayout(page, mode) {
  // On a phone the layout button is in the controls sheet.
  if (!(await page.locator('#layout-toggle').isVisible()) && await page.locator('#more-controls').isVisible()) {
    await page.locator('#more-controls').click();
  }
  if (await page.locator('#layout-panel').isHidden()) await page.locator('#layout-toggle').click();
  await page.locator('#layout-' + mode).click();
  if (!(await page.locator('#layout-panel').isHidden())) await page.keyboard.press('Escape');
}

// cuttableStream is the instrument the three resume gates share: A's
// *attaching* stream GET is aborted while `cut.on` is true, and only
// that one. The probe forms go through untouched, because the whole
// ladder §4.5 asks the client to walk — probe, read the status, then
// attach — depends on the probe still answering; abort that too and the
// scenario would be testing a dead network rather than a dead stream.
//
// The TTL header rides along for the same reason the renewal scenario
// sends it: a stream that has already attached is not routed again, so
// without a short life a cut would take effect five minutes from now.
// Two seconds here rather than the renewal scenario's production-shaped
// six, because these scenarios cut and restore within a few seconds and
// want the cut to bite promptly.
async function cuttableStream(ctx, ttl = '2s') {
  const cut = { on: false, aborted: 0, attaches: 0, probeFail: false, probesFailed: 0 };
  await ctx.route('**/stream*', async (route) => {
    if (route.request().url().includes('probe=1')) {
      // probeFail is the other half of the instrument: a probe that
      // answers 503 proves nothing about anybody's participation, and a
      // client must not act on it (§4.5's ladder, Codex S2-12).
      if (cut.probeFail) {
        cut.probesFailed += 1;
        await route.fulfill({ status: 503, contentType: 'application/json', body: '{"error":"full"}' });
        return;
      }
      await route.continue();
      return;
    }
    if (cut.on) {
      cut.aborted += 1;
      await route.abort();
      return;
    }
    cut.attaches += 1;
    await route.continue({ headers: { ...route.request().headers(), 'x-calls-test-ttl': ttl } });
  });
  return cut;
}

// biteCut waits until the cut has actually taken an attaching GET away.
// Setting the flag is not the cut: the stream that is already open runs
// to its own TTL first.
async function biteCut(cut, ms = 20000) {
  return until(() => (cut.aborted > 0 ? cut.aborted : false), ms);
}

// ── the relay list (spec §5.2, §5.3) ─────────────────────────────────

// The two sentences §5.3 puts on a screen, quoted whole rather than
// matched loosely: a gate that grepped for "relay" would pass on either
// of them, and they mean different things — one says this browser cannot
// reach the relay at all, the other that one connection's credential ran
// out before a new one landed.
const ICE_WARNING = 'Calls could not reach the relay. Calls may not connect until it can.';
const ICE_EXPIRED = 'The relay credential expired for this connection.';
const ICE_STUCK = 'Could not renew this connection through the relay.';

// iceRoute is the instrument the three ICE scenarios share. Every
// GET /m/{sqid}/ice from this context goes through it, which buys three
// things the page cannot give: the response body (the credential never
// reaches state(), and rightly), the header that shortens the server's
// schedule from hours to seconds, and the ability to take the relay away
// from the second fetch on.
//
// The header is added to the request rather than faked into a response,
// because /ice rides room.js's own plain `probe` fetch and what these
// scenarios assert on is the list the real endpoint minted. Nothing here
// bursts /ice: it spends /signal's per-session, per-room bucket, and a
// gate that hammered it would be measuring the rate limiter.
//
// The TTL is always a multiple of six seconds. The server names
// `renewAt` at five sixths of the life and `expiresAt` at the whole of
// it, both truncated to whole seconds, and the client schedules from the
// difference — so a life that is not a multiple of six loses the margin
// to the truncation.
async function iceRoute(ctx, { ttl = null, failFrom = 0 } = {}) {
  const seen = { requests: 0, served: 0, refused: 0, servers: [], turn: [], credentials: [] };
  await ctx.route('**/ice*', async (route) => {
    seen.requests += 1;
    if (failFrom && seen.requests >= failFrom) {
      seen.refused += 1;
      await route.fulfill({ status: 503, contentType: 'application/json', body: '{"error":"relay"}' });
      return;
    }
    const headers = { ...route.request().headers() };
    if (ttl) headers['x-calls-test-ice-ttl'] = ttl;
    let res;
    try {
      res = await route.fetch({ headers });
    } catch {
      // The context closing under a fetch in flight: aborting is the
      // truthful answer, and `served` shows it never landed.
      try { await route.abort(); } catch { /* already gone */ }
      return;
    }
    const body = await res.text();
    try {
      const list = JSON.parse(body).iceServers || [];
      seen.served += 1;
      seen.servers.push(list.length);
      for (const s of list) {
        if (s.username) seen.turn.push(s.username);
        if (s.credential) seen.credentials.push(s.credential);
      }
    } catch {
      // Not JSON at all: `served` stays where it is, and the assertions
      // that count it say so.
    }
    await route.fulfill({ response: res, body });
  });
  return seen;
}

// pcTap keeps a reference to every RTCPeerConnection the page builds, so
// the gate can walk getStats itself rather than taking room.js's word
// for the generation it is on. room.js exposes state() and not
// connections, and rightly — a peer connection handed out on `window` is
// one anything can close. A construct trap rather than a wrapper
// function, so the prototype and every static stay the browser's own.
const pcTap = () => {
  const Real = window.RTCPeerConnection;
  if (!Real) return;
  // Idempotent: it is installed on every context for diagnose()'s sake,
  // and once more by hand where a scenario walks the connections itself.
  // Wrapping the proxy in another proxy would work and reads like a bug.
  if (window.__pcs) return;
  window.__pcs = [];
  // And every ICE configuration the page actually installs, which is a
  // different fact from the list room.js says it holds: state().ice
  // would read the same if the constructor were handed an empty array
  // and setConfiguration were deleted (Codex S3-5). Recorded by shape
  // and by digest — a 32-bit FNV-1a of the usernames and credentials —
  // so the gate can say "a different credential is installed" without
  // anything anywhere printing one.
  window.__iceConfigs = [];
  const digest = (servers) => {
    const text = servers.map((v) => (v.username || '') + '|' + (v.credential || '')).join('\n');
    let h = 2166136261;
    for (let i = 0; i < text.length; i++) {
      h ^= text.charCodeAt(i);
      h = Math.imul(h, 16777619);
    }
    return (h >>> 0).toString(16);
  };
  // `pc` is the connection's index in __pcs, so a configuration can be
  // attributed to the connection that took it: without that, repeated
  // updates to one connection could stand in for another left on the
  // empty list (Codex S3-10).
  const note = (at, pc, config) => {
    const servers = (config && config.iceServers) || [];
    window.__iceConfigs.push({
      at,
      pc,
      servers: servers.length,
      credentialed: servers.filter((v) => v.credential).length,
      digest: digest(servers),
    });
  };
  window.RTCPeerConnection = new Proxy(Real, {
    construct(target, args) {
      const pc = Reflect.construct(target, args);
      const index = window.__pcs.length;
      window.__pcs.push(pc);
      note('construct', index, args[0]);
      const real = pc.setConfiguration && pc.setConfiguration.bind(pc);
      if (real) {
        pc.setConfiguration = (config) => {
          // After the real call returns, never before: a
          // setConfiguration that throws installs nothing, and
          // recording it first counted an attempt as an installation.
          const out = real(config);
          note('setConfiguration', index, config);
          return out;
        };
      }
      // Every remote description this connection applies, and the
      // state it was in when it applied it. That is what a rollback
      // looks like from outside: perfect negotiation's polite side
      // applies a remote *offer* while it is in `have-local-offer`, and
      // setRemoteDescription rolls its own offer back to do it. Nothing
      // in room.js records that, and a scenario about a late collision
      // has to be able to prove the collision happened rather than
      // assume a delay caused one (Codex round 2).
      window.__rollbacks = window.__rollbacks || [];
      const setRemote = pc.setRemoteDescription && pc.setRemoteDescription.bind(pc);
      if (setRemote) {
        pc.setRemoteDescription = (desc) => {
          const before = pc.signalingState;
          const out = setRemote(desc);
          const type = (desc && desc.type) || '';
          if (type === 'offer' && before === 'have-local-offer') {
            window.__rollbacks.push({ pc: index, at: Date.now() });
          }
          return out;
        };
      }
      return pc;
    },
  });
};

// rollbacks is what that trap saw: one entry per remote offer applied
// over this side's own outstanding offer.
function rollbacks(page) {
  return page.evaluate(() => (window.__rollbacks || []).length);
}

// mediaIdentity is room.js's own answer to "what is this tile bound
// to": the track each tile holds, the tracks its element is holding,
// and what the connection's receivers say. The comparison is made in
// the page, because object identity does not survive an evaluate().
function mediaIdentity(page) {
  return page.evaluate(() => (window.meet && window.meet.media && window.meet.media()) || {});
}

// installedPerConnection folds the trap's log into "what each live
// connection is actually configured with": the last configuration it
// took, keyed by the connection's own index.
function installedPerConnection(configs, live) {
  const out = new Map();
  for (const c of configs) {
    if (live && !live.includes(c.pc)) continue;
    out.set(c.pc, c);
  }
  return Array.from(out.entries()).map(([pc, c]) => ({ pc, ...c }));
}

// iceConfigs is what the trap recorded: one entry per configuration the
// page installed, in order, with a digest standing in for the
// credentials it carried.
function iceConfigs(page) {
  return page.evaluate(() => window.__iceConfigs || []);
}

// livePcs is the indices of the connections the page still holds open,
// so a configuration belonging to one that has since been closed and
// rebuilt is not read as the current state of anything.
function livePcs(page) {
  return page.evaluate(() => (window.__pcs || [])
    .map((pc, i) => (pc.connectionState === 'closed' ? -1 : i))
    .filter((i) => i >= 0));
}

// selectedUfrags is §5.3 step 2's reading taken independently of the
// client's: the transport names the selected pair, the pair names its
// local candidate, and the candidate carries the ICE generation's
// username fragment. A generation name, not a credential — and the same
// walk room.js's own proof does, so the two can be compared.
function selectedUfrags(page) {
  return page.evaluate(async () => {
    const out = [];
    for (const pc of window.__pcs || []) {
      if (pc.connectionState === 'closed') continue;
      let report = null;
      try {
        report = await pc.getStats();
      } catch {
        continue;
      }
      let pairId = null;
      report.forEach((r) => {
        if (r.type === 'transport' && r.selectedCandidatePairId) pairId = r.selectedCandidatePairId;
      });
      if (!pairId) continue;
      const pair = report.get(pairId);
      if (!pair || pair.state !== 'succeeded') continue;
      const local = report.get(pair.localCandidateId);
      out.push((local && local.usernameFragment) || '');
    }
    return out;
  });
}

// warningRegion is §5.3 step 1's live region: whether it is there, what
// it says, and whether a reader would be told at all — a <p> that is
// hidden says nothing however much text is in it.
function warningRegion(page) {
  return page.evaluate(() => {
    const el = document.getElementById('ice-warning');
    if (!el) return null;
    return { text: (el.textContent || '').trim(), hidden: !!el.hidden, role: el.getAttribute('role') };
  });
}

// tileNotes is every sentence currently under a tile. There are only
// four it can ever be — the expired credential, the renewal that would
// not land, and the two failure sentences — so the whole list goes into
// the assertion's message.
function tileNotes(page) {
  return page.evaluate(() =>
    Array.from(document.querySelectorAll('#tiles figure .calls-tile-note'))
      .map((n) => (n.textContent || '').trim())
      .filter(Boolean));
}

// leakedCredential answers which minted credential, if any, turned up in
// a console line — by index, never by value: a gate that printed the
// credential it caught would be the leak it was written to catch.
function leakedCredential(credentials, lines) {
  for (let i = 0; i < credentials.length; i++) {
    if (credentials[i] && lines.includes(credentials[i])) return i;
  }
  return -1;
}

// ── the guest ────────────────────────────────────────────────────────

// signInAsGuest is the whole outsider path from spec §3.2, driven in the
// browser: follow the emailed link signed out, ask for a sign-in link,
// and click the one that was actually mailed.
async function signInAsGuest(ctx, address = GUEST) {
  const member = await newContext('configure waiting room', { cookie: cookieA });
  await member.request.post(origin + '/meetings/' + sqid + '/settings', {
    headers: { Origin: origin }, form: { waiting_room: 'on' },
  });
  await member.close();
  const page = await ctx.newPage();
  await page.goto(origin + '/j/' + token, { waitUntil: 'domcontentloaded' });
  // The invitation page's way to sign in is the bar's corner (shared
  // chrome R2: guests get the same "Sign in" as anyone signed out).
  if (page.url().includes('/j/')) await page.locator('[estilo-bar-signin]').click();
  check(page.url().startsWith(origin + '/signin'),
    'the link sends a signed-out outsider to sign in (at ' + where(page) + ')');

  await page.fill('input[name="address"]', address);
  await Promise.all([
    page.waitForURL('**/signin?sent=1', { timeout: 15000 }),
    page.click('form[rst-form] button[type="submit"]'),
  ]);
  check(page.url() === origin + '/signin?sent=1',
    'asking for a sign-in link gives the same answer every time (at ' + where(page) + ')');

  const link = await control('guest-link ' + address);
  // The emailed link opens the confirm door, which spends nothing (a
  // mail scanner's fetch must not); its one Sign in button POSTs the
  // link back, and that is what signs in.
  await page.goto(link, { waitUntil: 'domcontentloaded' });
  check(await page.locator('input[name="address"]').count() === 0 &&
    await page.locator('form[action="/auth/verify"] button[type="submit"]').count() === 1,
    'the emailed link opens the confirm door: one Sign in button, no address field (at ' + where(page) + ')');
  await Promise.all([
    page.waitForURL((u) => !u.pathname.startsWith('/auth/verify'), { timeout: 15000, waitUntil: 'domcontentloaded' }),
    page.click('form[action="/auth/verify"] button[type="submit"]'),
  ]);
  check(page.url() === origin + '/m/' + sqid + '/join',
    'the emailed link lands the guest on this meeting (at ' + where(page) + ')');
  await page.close();
}

// admitKnock clicks the Admit button on the queue entry with this
// display name. The queue holds more than one entry in the guest
// scenario, and clicking the first one would admit whoever happened to
// knock first.
async function admitKnock(page, name) {
  const lis = page.locator('#knocks li');
  const n = await lis.count();
  for (let i = 0; i < n; i++) {
    const who = ((await lis.nth(i).locator('span').first().textContent()) || '').trim();
    if (who === name) {
      await lis.nth(i).locator('button').click();
      return true;
    }
  }
  return false;
}

// previewState is the holding screen's own <video>: whether it has a
// stream, and whether that stream is actually being decoded and played.
function previewState(page) {
  return page.evaluate(() => {
    const v = document.getElementById('preview');
    if (!v) return null;
    return { hasStream: !!v.srcObject, width: v.videoWidth, time: v.currentTime, paused: v.paused };
  });
}

// remoteTile reads the first remote tile's <video> the same way, for the
// scenarios about a tile that is playing or not.
function remoteTile(page) {
  return page.evaluate(() => {
    const v = document.querySelector('#tiles figure:not(.calls-tile-self) video');
    if (!v) return null;
    return { hasStream: !!v.srcObject, width: v.videoWidth, time: v.currentTime, paused: v.paused };
  });
}

// queueNames is the admission queue as this page has it, which is
// exactly what the server decided this page may know: room.js fills it
// from knock, knock-gone and roster.waiting and from nothing else.
async function queueNames(page) {
  return page.evaluate(() =>
    Array.from(document.querySelectorAll('#knocks li span')).map((s) => s.textContent.trim()));
}

// ── the chat panel and the share tile ────────────────────────────────

// chatLog is the panel's log as a reader has it: who each line is from,
// what it says, and whether the panel drew it as this tab's own. Read
// through the class names chat.js builds rather than through the ids, so
// the panel keeps the freedom its own report claims — a host may rename
// every `chat-*` id, and the classes are what the stylesheet and this
// gate both hang on.
function chatLog(page) {
  return page.evaluate(() =>
    Array.from(document.querySelectorAll('[data-chat-log] li')).map((li) => ({
      name: ((li.querySelector('.chat-name') || {}).textContent || '').trim(),
      text: ((li.querySelector('.chat-text') || {}).textContent || '').trim(),
      self: li.classList.contains('chat-line-self'),
    })));
}

// selfName is the server's word for the person in this tab, read off
// the room element the page was rendered with. Not off their own tile:
// that caption is this name with " (you)" appended, and what the other
// contexts see — the name on an arriving chat line, the name in
// "<name>’s screen" — is the name without it. Reading the dataset is
// reading exactly what room.js reads.
function selfName(page) {
  return page.evaluate(() => {
    const root = document.getElementById('room');
    return root ? (root.dataset.selfName || '') : '';
  });
}

// shareTiles is every screen currently on this page: its caption and
// whether the <video> under it has anything to play. A tile with a
// caption and no stream is exactly what `share {on:true}` draws before
// the media arrives, so the two are read together and never conflated.
function shareTiles(page) {
  return page.evaluate(() =>
    Array.from(document.querySelectorAll('#tiles figure.calls-tile-share')).map((f) => {
      const v = f.querySelector('video');
      return {
        name: ((f.querySelector('figcaption span') || {}).textContent || '').trim(),
        hasStream: !!(v && v.srcObject),
        width: v ? v.videoWidth : null,
        paused: v ? v.paused : null,
      };
    }));
}

// capturedSurface is what this tab is actually sending as a screen:
// `displaySurface` off the settings of a video track it has out, which
// is the one key only getDisplayMedia produces. A tab sharing its
// camera down the share m-line would answer null here, and every other
// assertion about sharing would still hold — which is what makes this
// worth reading. Null on a page that is not sharing.
function capturedSurface(page) {
  return page.evaluate(() => {
    for (const pc of window.__pcs || []) {
      try {
        if (pc.connectionState === 'closed') continue;
        for (const sn of pc.getSenders()) {
          if (!sn.track || sn.track.kind !== 'video' || !sn.track.getSettings) continue;
          const settings = sn.track.getSettings();
          if (settings && settings.displaySurface) return settings.displaySurface;
        }
      } catch {
        // A connection that went away under the walk.
      }
    }
    return null;
  });
}

// shareControl is the Share button's three cues at once. Colour is not
// one of them (AGENTS.md), so what is read here is the word and the
// attribute a screen reader announces — never the outline.
function shareControl(page) {
  return page.evaluate(() => {
    const b = document.getElementById('share');
    if (!b) return null;
    const s = document.getElementById('share-state');
    return {
      pressed: b.getAttribute('aria-pressed'),
      state: s ? (s.textContent || '').trim() : null,
      disabled: !!b.disabled,
    };
  });
}

// tileMarks is what spec §15.19 draws on one peer's tile, read the way a
// person reads it: whether the muted badge and the camera-off cover are
// showing, and the words each carries — the words, not the colour or
// the icon, being the part AGENTS.md makes the contract.
function tileMarks(page, key) {
  return page.evaluate((k) => {
    const f = document.querySelector('#tiles figure[data-tile="' + k + '"]');
    if (!f) return null;
    const muted = f.querySelector('.calls-tile-muted');
    const off = f.querySelector('.calls-tile-off');
    const shown = (el) => !!(el && !el.hidden && el.getClientRects().length);
    return {
      muted: shown(muted),
      mutedText: muted ? (muted.textContent || '').trim() : '',
      cameraOff: shown(off),
      offText: off ? (off.textContent || '').trim() : '',
      caption: ((f.querySelector('figcaption') || {}).textContent || '').trim(),
    };
  }, key);
}

// refuseFirstPlay is an init script: the first unmuted play() on the
// page is refused the way a blocking autoplay policy refuses it, and the
// element held paused until a later play() — which only a gesture
// should be asking for.
const refuseFirstPlay = () => {
  const real = HTMLMediaElement.prototype.play;
  let refused = 0;
  let blocked = null;
  // A rejected promise on its own is not what a blocking autoplay
  // policy does: the element also stays paused. Rejecting and
  // letting the element play anyway (its own `autoplay` attribute
  // does that, and the launch flag permits it) left every "the
  // gesture started the video" assertion true before the gesture
  // as well, which is the hole Codex S2-9 is about. So the refusal
  // pauses the element and keeps it paused until the gesture.
  const holdPaused = (e) => {
    if (blocked === e.target) e.target.pause();
  };
  HTMLMediaElement.prototype.play = function play() {
    if (!this.muted && refused < 1) {
      refused += 1;
      blocked = this;
      this.autoplay = false;
      this.pause();
      this.addEventListener('play', holdPaused);
      return Promise.reject(new DOMException('autoplay refused', 'NotAllowedError'));
    }
    if (blocked === this) {
      blocked = null;
      this.removeEventListener('play', holdPaused);
    }
    return real.apply(this, arguments);
  };
};

// glowOf is the warm rim on a tile's name label as it is drawn (0.4.3):
// whether it is lit, its --lvl and --on, the shadow the browser computed
// for the label's ::after from them, and the most opaque of that shadow's
// layers — plus whether anything of the ring or the meter it replaced is
// left on the tile.
function glowOf(page, key) {
  return page.evaluate((k) => {
    const figure = document.querySelector('#tiles figure[data-tile="' + k + '"]');
    const label = figure && figure.querySelector('.calls-tile-name');
    if (!label) return null;
    const style = getComputedStyle(label);
    const shadow = getComputedStyle(label, '::after').boxShadow;
    let alpha = 0;
    for (const m of shadow.matchAll(/rgba?\(([^)]*)\)/g)) {
      const parts = m[1].split(',').map(Number);
      alpha = Math.max(alpha, parts.length === 4 ? parts[3] : 1);
    }
    return {
      lit: label.dataset.glow === 'on',
      glow: Number(style.getPropertyValue('--lvl')) || 0,
      on: Number(style.getPropertyValue('--on')) || 0,
      shadow,
      alpha,
      // The old ring was an inset shadow on the figure (a floating self
      // view's own drop shadow is not one).
      ring: figure.classList.contains('calls-tile-speaking') || /inset/.test(getComputedStyle(figure).boxShadow),
      meter: !!figure.querySelector('.calls-meter'),
    };
  }, key);
}

// speakInto replaces a page's microphone on every connection with a
// steady tone, loud enough to be speech to the glow's gate. Chromium's
// fake microphone only beeps, and a beep is exactly the brief noise the
// glow is built to ignore. stopSpeaking puts the microphone back.
function speakInto(page) {
  return page.evaluate(async () => {
    const ctx = new AudioContext();
    const osc = ctx.createOscillator();
    const gain = ctx.createGain();
    gain.gain.value = 0.3;
    osc.frequency.value = 220;
    const dest = ctx.createMediaStreamDestination();
    osc.connect(gain).connect(dest);
    osc.start();
    await ctx.resume();
    const tone = dest.stream.getAudioTracks()[0];
    window.__toneRestore = [];
    for (const pc of window.__pcs || []) {
      for (const sn of pc.getSenders()) {
        if (sn.track && sn.track.kind === 'audio') {
          window.__toneRestore.push([sn, sn.track]);
          await sn.replaceTrack(tone);
        }
      }
    }
    window.__toneCtx = ctx;
    return window.__toneRestore.length;
  });
}
function stopSpeaking(page) {
  return page.evaluate(async () => {
    for (const [sn, track] of window.__toneRestore || []) await sn.replaceTrack(track);
    if (window.__toneCtx) await window.__toneCtx.close();
    window.__toneRestore = [];
  });
}

function mediaLive(page) {
  return page.evaluate(() => ((document.getElementById('media-live') || {}).textContent || '').trim());
}

// ── ink ───────────────────────────────────────────────────────────────
//
// Where a glyph's ink is, read off a screenshot the way Paul read the
// Mac bar's (0.4.1): the centroid of the pixels brighter than the pane
// under them, weighted by how much brighter. The PNG is Chromium's own
// (8-bit, RGB or RGBA, not interlaced), so a decoder this small reads it.

function decodePNG(buf) {
  let at = 8;
  let width = 0, height = 0, type = 0;
  const idat = [];
  while (at < buf.length) {
    const len = buf.readUInt32BE(at);
    const kind = buf.toString('latin1', at + 4, at + 8);
    const body = buf.subarray(at + 8, at + 8 + len);
    if (kind === 'IHDR') {
      width = body.readUInt32BE(0);
      height = body.readUInt32BE(4);
      if (body[8] !== 8 || body[12] !== 0) throw new Error('decodePNG: not 8-bit non-interlaced');
      type = body[9];
    } else if (kind === 'IDAT') idat.push(body);
    at += 12 + len;
  }
  const bpp = type === 6 ? 4 : type === 2 ? 3 : 0;
  if (!bpp) throw new Error('decodePNG: colour type ' + type);
  const raw = inflateSync(Buffer.concat(idat));
  const stride = width * bpp;
  const px = Buffer.alloc(height * stride);
  for (let y = 0; y < height; y++) {
    const f = raw[y * (stride + 1)];
    const row = raw.subarray(y * (stride + 1) + 1, (y + 1) * (stride + 1));
    for (let x = 0; x < stride; x++) {
      const a = x >= bpp ? px[y * stride + x - bpp] : 0;
      const b = y > 0 ? px[(y - 1) * stride + x] : 0;
      const c = x >= bpp && y > 0 ? px[(y - 1) * stride + x - bpp] : 0;
      let v = row[x];
      if (f === 1) v += a;
      else if (f === 2) v += b;
      else if (f === 3) v += (a + b) >> 1;
      else if (f === 4) {
        const p = a + b - c, pa = Math.abs(p - a), pb = Math.abs(p - b), pc = Math.abs(p - c);
        v += pa <= pb && pa <= pc ? a : pb <= pc ? b : c;
      }
      px[y * stride + x] = v & 255;
    }
  }
  const lum = (x, y) => {
    const i = y * stride + x * bpp;
    return 0.2126 * px[i] + 0.7152 * px[i + 1] + 0.0722 * px[i + 2];
  };
  const rgb = (x, y) => {
    const i = y * stride + x * bpp;
    return [px[i], px[i + 1], px[i + 2]];
  };
  return { width, height, lum, rgb };
}

// contrastOnWhite is WCAG's contrast ratio of white text on a colour.
function contrastOnWhite([r, g, b]) {
  const lin = (c) => {
    const v = c / 255;
    return v <= 0.04045 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4;
  };
  const L = 0.2126 * lin(r) + 0.7152 * lin(g) + 0.0722 * lin(b);
  return 1.05 / (L + 0.05);
}

// sampleColour is the average colour of a small square of the page as
// drawn, in page CSS pixels.
async function sampleColour(page, x, y, size = 4) {
  const img = decodePNG(await page.screenshot({ clip: { x: x - size / 2, y: y - size / 2, width: size, height: size } }));
  const sum = [0, 0, 0];
  for (let j = 0; j < img.height; j++) {
    for (let i = 0; i < img.width; i++) {
      const c = img.rgb(i, j);
      sum[0] += c[0]; sum[1] += c[1]; sum[2] += c[2];
    }
  }
  const n = img.width * img.height;
  return sum.map((v) => Math.round(v / n));
}

// inkCentroid screenshots `box` (page CSS pixels, at the page's own
// device scale) and returns the ink's vertical centroid in page CSS
// pixels, or null if there was no ink.
async function inkCentroid(page, box, scale = 1) {
  const pad = 2;
  const clip = { x: box.x - pad, y: box.y - pad, width: box.width + 2 * pad, height: box.height + 2 * pad };
  const img = decodePNG(await page.screenshot({ clip }));
  let floor = 255;
  for (let y = 0; y < img.height; y++) for (let x = 0; x < img.width; x++) floor = Math.min(floor, img.lum(x, y));
  let total = 0, moment = 0;
  for (let y = 0; y < img.height; y++) {
    for (let x = 0; x < img.width; x++) {
      const w = Math.max(0, img.lum(x, y) - floor - 8);
      total += w;
      moment += w * (y + 0.5);
    }
  }
  if (!total) return null;
  return clip.y + moment / total / scale;
}

// ── the scenarios ────────────────────────────────────────────────────

const run = {
  async guestdirect() {
    const member = await newContext('settings owner', { cookie: cookieA, javaScriptEnabled: false });
    const settings = await member.newPage();
    await settings.goto(origin + '/settings');
    check(!(await settings.getByLabel('Require sign-in to join').isChecked()), 'new meeting defaults permit guests');
    check(!(await settings.getByLabel('Enable waiting room').isChecked()), 'waiting room defaults off');
    await settings.screenshot({ path: '/tmp/calls-settings.png', fullPage: true });
    await member.close();
    const guest = await newContext('anonymous guest');
    const page = await guest.newPage();
    await page.goto(origin + '/j/' + token);
    check((await page.getByRole('link', { name: 'Join in the app' }).getAttribute('href')).startsWith('oficina-calls://join?'), 'invitation offers the native app');
    await page.getByLabel('Your name').fill('Visitor');
    await Promise.all([
      page.waitForURL('**/m/' + sqid + '/join'),
      page.getByRole('button', { name: 'Continue in browser' }).click(),
    ]);
    check(await page.getByRole('link', { name: 'Join in the app' }).count() === 1, 'holding screen offers the native app');
    await page.locator('#join').click();
    check(await until(async () => (await state(page)).admitted, 20000), 'anonymous guest joins directly without sign-in or admission');
    await guest.close();
  },
  // The holding screen reaches real hardware: it enumerates devices,
  // previews one, and lets the person in.
  async devices() {
    const ctx = await newContext('member A', { cookie: cookieA });
    const page = await ctx.newPage();
    await page.goto(origin + '/m/' + sqid + '/join', { waitUntil: 'domcontentloaded' });

    const revealed = await until(async () => !(await page.locator('#devices').isHidden()), 10000);
    check(revealed, 'the holding screen reveals its devices block');

    const options = await until(async () => {
      const n = await page.locator('#pick-camera option').count();
      return n > 0 ? n : false;
    }, 10000);
    check(options, 'the camera picker lists at least one camera (got ' + options + ')');

    const enabled = await until(async () => await page.locator('#join').isEnabled(), 10000);
    check(enabled, 'the Join button is enabled within ten seconds — status: ' + (await page.locator('#status').textContent()));

    // A truthy srcObject was all this used to ask (Codex S2-9), and a
    // preview that never decoded a pixel satisfies that. Real dimensions
    // and a clock that moves are what "previewing" means.
    const preview = await until(async () => {
      const p = await previewState(page);
      return p && p.hasStream && p.width > 0 ? p : false;
    }, 15000);
    check(preview, 'the preview is decoding real frames (' + JSON.stringify(preview || (await previewState(page))) + ')');
    check(await page.locator('#preview').evaluate(video => new DOMMatrix(getComputedStyle(video).transform).a === -1), 'the holding camera preview is mirrored');
    if (preview) {
      const rising = await until(async () => {
        const p = await previewState(page);
        return p && p.time > preview.time ? p : false;
      }, 10000);
      check(rising, 'the preview is playing rather than holding one frame (' +
        JSON.stringify(rising || (await previewState(page))) + ')');
    }

    check(errorsFor('member A') === '', 'no console errors on the holding screen (' + errorsFor('member A') + ')');
    await ctx.close();
  },

  // Spec §15.20: the holding screen's audio test. The fake microphone
  // beeps, so the microphone test says it works; the test sound plays;
  // and the playback test records, plays back and throws the recording
  // away — with no request leaving the page while it does, which is the
  // promise the section makes in words.
  async audiotest() {
    const ctx = await newContext('member A', { cookie: cookieA });
    const page = await ctx.newPage();
    const requests = [];
    page.on('request', (r) => {
      const body = r.postDataBuffer();
      requests.push({ method: r.method(), path: where({ url: () => r.url() }), body: body ? body.length : 0 });
    });
    await page.goto(origin + '/m/' + sqid + '/join', { waitUntil: 'domcontentloaded' });
    const ready = await until(async () => await page.locator('#join').isEnabled(), 15000);
    check(ready, 'the holding screen is ready — status: ' + (await page.locator('#status').textContent()));
    check(await page.locator('#audio-test').isVisible(), 'the audio test is offered');
    await page.click('#audio-test summary');
    const test = () => page.evaluate(() => window.meetDevices.audioTest());
    const sent = requests.length;

    await page.click('#test-mic');
    const working = await until(async () => {
      const t = await test();
      return t.mic.verdict === 'working' ? t : false;
    }, 10000);
    check(working, 'the microphone test hears the microphone (' + JSON.stringify(working || (await test())) + ')');
    const micText = ((await page.locator('#mic-result').textContent()) || '').trim();
    check(micText === 'Your microphone is working.', 'and says so in words (' + micText + ')');
    const micMeter = await until(async () => {
      const v = await page.locator('#mic-level').evaluate((m) => m.value);
      return v > 0 ? v : false;
    }, 5000);
    check(micMeter, 'its meter moves (' + micMeter + ')');

    await page.click('#test-speaker');
    const played = await until(async () => {
      const t = await test();
      return t.speaker.played && t.speaker.peak > 0 ? t : false;
    }, 10000);
    check(played, 'the test sound plays, and its meter moves (' + JSON.stringify(played || (await test())) + ')');
    const speakerText = await until(async () => {
      const t = ((await page.locator('#speaker-result').textContent()) || '').trim();
      return t.startsWith('Played a test sound through') ? t : false;
    }, 5000);
    check(speakerText, 'and says where it played (' + speakerText + ')');
    check(await test().then((t) => t.running === '' && t.mic.verdict === 'working'),
      'starting one test stopped the other');

    await page.click('#test-loopback');
    const recording = await until(async () => ((await test()).loopback.phase === 'recording' ? true : false), 5000);
    check(recording, 'the playback test records');
    const back = await until(async () => {
      const t = await test();
      return t.loopback.phase === 'played' || t.loopback.phase === 'failed' ? t : false;
    }, 20000);
    check(back && back.loopback.phase === 'played' && back.loopback.bytes > 0 && back.loopback.peak > 0,
      'records, and plays it back (' + JSON.stringify(back || (await test())) + ')');
    const loopText = ((await page.locator('#loopback-result').textContent()) || '').trim();
    check(loopText === 'That is how you sound to the others. The recording has been thrown away.',
      'and says so (' + loopText + ')');
    const released = await page.evaluate(() => {
      const a = document.getElementById('test-audio');
      return !a.srcObject;
    });
    check(released, 'the player lets go of the recording');

    const during = requests.slice(sent);
    const carried = during.filter((r) => r.method !== 'GET' || r.body > 0);
    check(carried.length === 0, 'nothing left the page while the tests ran (' + JSON.stringify(carried) + ')');

    // And Join still works afterwards.
    await page.click('#join');
    const joined = await until(async () => page.url().endsWith('/m/' + sqid), 10000);
    check(joined, 'Join still goes to the room (' + where(page) + ')');
    await page.waitForFunction(() => !!window.meet, null, { timeout: 20000 }).catch(() => {});
    await leaveRoom(page);

    check(errorsFor('member A') === '', 'no console errors (' + errorsFor('member A') + ')');
    await ctx.close();
  },

  // The whole media path in one assertion each way: getUserMedia, join,
  // roster, perfect negotiation, trickle ICE, a decoded frame.
  async call() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    await assertPair(pageA, pageB, 'member A', 'member B');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Spec §15.19: one peer mutes and turns the camera off, and the other
  // sees both on that peer's tile — in words, not only an icon — and
  // hears about it through the polite live region. Then the watcher
  // leaves and comes back, and the state is on the tile from the roster
  // alone, with no event to carry it: that is the late-joiner and resume
  // path, which is the reason the state lives in the roster at all.
  async mute() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    let pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) return;
    const a = pair.a.peer;
    const nameA = await selfName(pageA);

    // Both report on admission, so each knows the other is on — known,
    // not merely unknown — before anybody touches anything.
    const known = await until(async () => {
      const s = await pageB.evaluate(() => window.meet.state().remoteMedia);
      return s[a] && s[a].muted === false && s[a].cameraOff === false ? s : false;
    }, 10000);
    check(known, 'B has A’s first report: on, not unknown (' + JSON.stringify(known) + ')');
    const before = await tileMarks(pageB, a);
    check(before && !before.muted && !before.cameraOff, 'A’s tile starts with neither mark (' + JSON.stringify(before) + ')');

    await pageA.click('#mute');
    const muted = await until(async () => {
      const m = await tileMarks(pageB, a);
      return m && m.muted ? m : false;
    }, 10000);
    check(muted, 'B sees A’s muted badge after A mutes (' + JSON.stringify(muted || (await tileMarks(pageB, a))) + ')');
    check(muted && /muted/i.test(muted.mutedText), 'the badge says Muted in words (' + (muted && muted.mutedText) + ')');
    check(muted && !muted.cameraOff, 'muting alone does not cover the video');
    const said = await until(async () => {
      const t = await mediaLive(pageB);
      return t.includes('muted their microphone') ? t : false;
    }, 5000);
    check(said && said.startsWith(nameA), 'B’s live region says so, politely, by name (' + (said || (await mediaLive(pageB))) + ')');
    const selfMark = await tileMarks(pageA, 'self');
    check(selfMark && selfMark.muted, 'A’s own tile carries the badge too (' + JSON.stringify(selfMark) + ')');

    await pageA.click('#camera');
    const off = await until(async () => {
      const m = await tileMarks(pageB, a);
      return m && m.cameraOff ? m : false;
    }, 10000);
    check(off, 'B sees A’s camera-off cover (' + JSON.stringify(off || (await tileMarks(pageB, a))) + ')');
    check(off && off.offText === 'Camera off', 'the cover says Camera off in words (' + (off && off.offText) + ')');
    check(off && off.muted, 'and A is still muted');
    // For a person to look at, as guestdirect keeps the settings page.
    await pageB.screenshot({ path: '/tmp/calls-mute.png', fullPage: true });

    // The watcher comes back: the roster alone must carry both.
    await leaveRoom(pageB);
    await pageB.close();
    pageB = await openRoom(ctxB);
    const again = await until(async () => {
      const s = await state(pageB);
      if (!s.admitted || !s.peers.includes(a)) return false;
      const m = await tileMarks(pageB, a);
      return m && m.muted && m.cameraOff ? m : false;
    }, 25000);
    check(again, 'B, rejoining, reads both marks from the roster (' + JSON.stringify(again || (await tileMarks(pageB, a))) + ')');
    check((await mediaLive(pageB)) === '', 'a state learned from the roster is not announced as news');

    // And back on: both marks go.
    await pageA.click('#mute');
    await pageA.click('#camera');
    const clear = await until(async () => {
      const m = await tileMarks(pageB, a);
      return m && !m.muted && !m.cameraOff ? m : false;
    }, 10000);
    check(clear, 'unmuting and turning the camera on clears both marks (' + JSON.stringify(clear || (await tileMarks(pageB, a))) + ')');
    const fb = await waitFrames(pageB, a);
    check(fb, 'B is still decoding A’s video afterwards');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Spec §15.20: the meters and the five-second rule, in a real call.
  // Chromium's fake microphone beeps about once a second, so a working
  // call is one where every meter moves and nobody is ever called
  // silent. Then the far side mutes, which is the Muted badge and not a
  // silence; and then it goes silent *without* muting — its microphone
  // track disabled under it, the shape of a microphone that hears
  // nothing — which is "No sound from …" here and "… isn't getting any
  // sound from you" there, over the report.
  async meters() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) return;
    const a = pair.a.peer;
    const b = pair.b.peer;
    const nameA = await selfName(pageA);
    const nameB = await selfName(pageB);
    const hearingOf = async (page, key) => ((await state(page)).hearing || {})[key] || null;

    const heard = await until(async () => {
      const h = await hearingOf(pageB, a);
      return h && h.peak > 0 && h.shown === 'meter' ? h : false;
    }, 15000);
    check(heard, 'B reads a level above zero for A (' + JSON.stringify(heard || (await hearingOf(pageB, a))) + ')');
    // The glow replaced the ring and the meter (0.3.7): neither is drawn.
    const plain = await glowOf(pageB, a);
    check(plain && !plain.ring && !plain.meter,
      'no ring round A’s tile and no meter beside the name on B (' + JSON.stringify(plain) + ')');
    const self = await until(async () => {
      const h = await hearingOf(pageA, 'self');
      return h && h.peak > 0 ? h : false;
    }, 15000);
    check(self, 'A’s own tile reads its microphone (' + JSON.stringify(self || (await hearingOf(pageA, 'self'))) + ')');
    // A speaks — a steady tone rather than the fake microphone's beep —
    // and A's name glows on B, and on A's own tile.
    const toned = await speakInto(pageA);
    check(toned > 0, 'A’s microphone is replaced by a tone (' + toned + ' senders)');
    const lit = await until(async () => {
      const g = await glowOf(pageB, a);
      const h = await hearingOf(pageB, a);
      return g && g.lit && g.glow > 0 && g.on === 1 && g.alpha > 0.1 && h && h.speaking && h.glow > 0 ? { g, h } : false;
    }, 10000);
    check(lit, 'A’s name glows on B while A speaks (' + JSON.stringify(lit || (await glowOf(pageB, a))) + ')');
    const selfLit = await until(async () => {
      const g = await glowOf(pageA, 'self');
      return g && g.lit && g.glow > 0 ? g : false;
    }, 10000);
    check(selfLit, 'and on A’s own tile (' + JSON.stringify(selfLit || (await glowOf(pageA, 'self'))) + ')');
    // For a look at it: CALLS_GLOW_SNAPSHOTS=<dir> keeps B's room, glowing.
    if (process.env.CALLS_GLOW_SNAPSHOTS) {
      await pageB.screenshot({ path: process.env.CALLS_GLOW_SNAPSHOTS + '/web-room-glowing.png', fullPage: true });
    }
    const ringless = await glowOf(pageB, a);
    check(ringless && !ringless.ring, 'speaking draws no ring round the tile (' + JSON.stringify(ringless) + ')');
    // Silence — the track disabled, so packets carry nothing — puts it
    // out, over the release rather than at once: --on waits for --lvl to
    // fall, then every layer of the rim is transparent. (The fake
    // microphone's beep, back, would light it again: Chromium's audioLevel
    // lingers.)
    await pageA.evaluate(() => {
      for (const [sn] of window.__toneRestore || []) if (sn.track) sn.track.enabled = false;
    });
    const out = await until(async () => {
      const g = await glowOf(pageB, a);
      return g && !g.lit && g.glow === 0 && g.on === 0 && g.shadow !== 'none' && g.alpha === 0 ? g : false;
    }, 10000);
    await stopSpeaking(pageA);
    check(out, 'and it goes out when A stops (' + JSON.stringify(out || (await glowOf(pageB, a))) + ')');

    // A beeping microphone is not a silent one, on either side, for
    // longer than the rule's five seconds.
    const falseAlarm = await stayed(pageB, 7000, (s) =>
      s.hearing[a] && s.hearing[a].shown === 'meter' && !s.noSoundFrom.length && !s.hearing.self.text);
    check(!falseAlarm, 'a working microphone is never called silent (' +
      JSON.stringify(falseAlarm && { hearing: falseAlarm.hearing, noSoundFrom: falseAlarm.noSoundFrom }) + ')');

    // Muted is the badge, not a meter and not a silence.
    await pageA.click('#mute');
    const muted = await until(async () => {
      const h = await hearingOf(pageB, a);
      const m = await tileMarks(pageB, a);
      return h && h.shown === 'muted' && m && m.muted ? { h, m } : false;
    }, 10000);
    check(muted, 'B shows A as Muted once A mutes (' + JSON.stringify(muted || (await hearingOf(pageB, a))) + ')');
    const glowGone = await until(async () => {
      const g = await glowOf(pageB, a);
      return g && !g.lit && g.glow === 0 ? g : false;
    }, 3000);
    check(glowGone, 'muted, nothing glows (' + JSON.stringify(glowGone || (await glowOf(pageB, a))) + ')');
    const mutedQuiet = await stayed(pageB, 6500, (s) =>
      s.hearing[a] && s.hearing[a].shown === 'muted' && s.hearing[a].text === '' && !s.noSoundFrom.length);
    check(!mutedQuiet, 'a muted peer is never "No sound from" (' + JSON.stringify(mutedQuiet && mutedQuiet.hearing[a]) + ')');
    const selfMuted = await hearingOf(pageA, 'self');
    check(selfMuted && selfMuted.shown === 'muted' && selfMuted.text === '',
      'and muted, A’s own tile warns of nothing (' + JSON.stringify(selfMuted) + ')');
    await pageA.click('#mute');
    const back = await until(async () => {
      const h = await hearingOf(pageB, a);
      return h && h.shown === 'meter' ? h : false;
    }, 10000);
    check(back, 'unmuting brings live sound back (' + JSON.stringify(back || (await hearingOf(pageB, a))) + ')');

    // Silence without muting: the microphone track is disabled under the
    // call, so packets keep flowing and carry nothing, and A's report
    // still says unmuted — which is exactly a microphone that hears
    // nothing, as far as anybody listening can tell.
    await pageA.evaluate(() => {
      for (const pc of window.__pcs || []) {
        for (const sn of pc.getSenders()) if (sn.track && sn.track.kind === 'audio') sn.track.enabled = false;
      }
    });
    const silent = await until(async () => {
      const s = await state(pageB);
      const h = s.hearing[a];
      return h && h.shown === 'silent' && s.noSoundFrom.includes(a) ? { h, noSoundFrom: s.noSoundFrom } : false;
    }, 15000);
    check(silent, 'B calls A silent after five flat seconds (' + JSON.stringify(silent || (await hearingOf(pageB, a))) + ')');
    check(silent && silent.h.text === 'No sound from ' + nameA,
      'in words, by name (' + (silent && silent.h.text) + ')');
    const told = await until(async () => {
      const h = await hearingOf(pageA, b);
      return h && /isn.t getting any sound from you\./.test(h.notice) ? h : false;
    }, 10000);
    check(told, 'A’s tile for B says B is getting no sound from A (' + JSON.stringify(told || (await hearingOf(pageA, b))) + ')');
    check(told && told.notice === nameB + ' isn\u2019t getting any sound from you.',
      'naming B (' + (told && told.notice) + ')');
    const saidA = await mediaLive(pageA);
    check(/isn.t getting any sound from you/.test(saidA), 'and A’s live region says so once (' + saidA + ')');

    // Sound again ends it on both sides.
    await pageA.evaluate(() => {
      for (const pc of window.__pcs || []) {
        for (const sn of pc.getSenders()) if (sn.track && sn.track.kind === 'audio') sn.track.enabled = true;
      }
    });
    const cleared = await until(async () => {
      const s = await state(pageB);
      return s.hearing[a] && s.hearing[a].shown === 'meter' && !s.noSoundFrom.length ? s.hearing[a] : false;
    }, 10000);
    check(cleared, 'sound again clears "No sound" on B (' + JSON.stringify(cleared || (await hearingOf(pageB, a))) + ')');
    const untold = await until(async () => {
      const h = await hearingOf(pageA, b);
      return h && h.notice === '' ? h : false;
    }, 10000);
    check(untold, 'and the notice on A (' + JSON.stringify(untold || (await hearingOf(pageA, b))) + ')');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Space toggles mute (the keyboard path to the same toggle as the
  // button, so the peer's badge follows over the same `media` report).
  // Held Space is one toggle, not a flicker; Space on the focused Mute
  // button is the button's own press, once; and Space in the chat
  // composer is a space in the message, with the microphone left alone.
  async spacemute() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) return;
    const a = pair.a.peer;
    const pressed = () => pageA.evaluate(() => document.getElementById('mute').getAttribute('aria-pressed'));
    const known = await until(async () => {
      const s = await pageB.evaluate(() => window.meet.state().remoteMedia);
      return s[a] && s[a].muted === false ? s : false;
    }, 10000);
    check(known, 'B has A’s first report, unmuted (' + JSON.stringify(known) + ')');
    // Whether the page kept the key: read after room.js's own listener.
    await pageA.evaluate(() => {
      window.__spacePrevented = [];
      window.addEventListener('keydown', (ev) => {
        if (ev.key === ' ') window.__spacePrevented.push(ev.defaultPrevented);
      });
    });

    await pageA.evaluate(() => document.activeElement && document.activeElement.blur());
    await pageA.keyboard.press('Space');
    const muted = await until(async () => {
      const m = await tileMarks(pageB, a);
      return m && m.muted ? m : false;
    }, 10000);
    check(muted, 'Space mutes A, and B sees the badge (' + JSON.stringify(muted || (await tileMarks(pageB, a))) + ')');
    check((await pressed()) === 'true', 'A’s Mute button says pressed');
    const said = await until(async () => {
      const t = await mediaLive(pageA);
      return t === 'Microphone muted.' ? t : false;
    }, 5000);
    check(said, 'A’s live region says so (' + (await mediaLive(pageA)) + ')');
    check((await pageA.evaluate(() => window.__spacePrevented.slice(-1)[0])) === true,
      'a handled Space is prevented, so the page does not scroll');

    // Held: the first press toggles, the repeat is swallowed.
    await pageA.keyboard.down('Space');
    await pageA.keyboard.down('Space');
    await pageA.keyboard.up('Space');
    check((await pressed()) === 'false', 'a held Space unmutes once and does not flicker back');
    const unmuted = await until(async () => {
      const m = await tileMarks(pageB, a);
      return m && !m.muted ? m : false;
    }, 10000);
    check(unmuted, 'B sees A unmuted (' + JSON.stringify(unmuted || (await tileMarks(pageB, a))) + ')');

    // Space on the focused button: the button's own press, exactly once.
    await pageA.focus('#mute');
    await pageA.keyboard.press('Space');
    check(await until(async () => (await pressed()) === 'true', 3000),
      'Space on the focused Mute button presses it once — twice would leave it unmuted');

    // Space in the chat composer is typing.
    check(await until(() => chatMounted(pageA), 10000), 'A’s chat panel is up');
    await openChat(pageA);
    await pageA.click('#chat-text');
    await pageA.keyboard.type('two words');
    const typed = await pageA.inputValue('#chat-text');
    check(typed === 'two words', 'Space in the chat box types a space (' + JSON.stringify(typed) + ')');
    check((await pressed()) === 'true', 'and leaves the microphone as it was');
    check((await pageA.evaluate(() => window.__spacePrevented.slice(-1)[0])) === false,
      'a Space that is typing is not prevented');
    const stillMuted = await tileMarks(pageB, a);
    check(stillMuted && stillMuted.muted, 'B still sees A muted');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Changing a device without leaving the call. The panel opens, the
  // microphone and then the camera are chosen again from the list, and
  // the far side's media is watched across both.
  //
  // Picking the same device again is the point rather than a weakness
  // of the test. What is under test is the swap — getUserMedia, a
  // replaceTrack on every connection's sender, the local stream rebuilt
  // under the self tile — and none of that cares whether the id it is
  // handed differs from the one already in use. Chromium's fake capture
  // offers one camera and one microphone, so a "different" device here
  // would be a second fake and not a second assertion.
  //
  // The assertion that matters is the negative one: a swap must not
  // cost the call anything. replaceTrack does not renegotiate, so a
  // regression that reached for addTrack, or that stopped the old track
  // before the new one was on the senders, shows up here as the far
  // side's frames stopping.
  async switching() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    // room.js reveals the button only where there is an enumeration
    // behind it, so its being visible is itself the feature detection
    // working.
    const shown = await until(async () => await pageA.locator('#devices-toggle').isVisible(), 10000);
    check(shown, 'the Devices button is revealed in the room');
    await pageA.click('#devices-toggle');
    check(await pageA.locator('#room-devices').isVisible(), 'the device panel opens');
    check(await pageA.locator('#devices-toggle').getAttribute('aria-expanded') === 'true',
      'the Devices button reports itself expanded');

    const mics = await until(async () => {
      const n = await pageA.locator('#pick-mic option').count();
      return n > 0 ? n : false;
    }, 10000);
    check(mics, 'the room lists at least one microphone (got ' + mics + ')');
    const cameras = await pageA.locator('#pick-camera option').count();
    check(cameras > 0, 'the room lists at least one camera (got ' + cameras + ')');

    const sides = [
      { page: pageB, label: 'member B', keys: [pair.a.peer] },
      { page: pageA, label: 'member A', keys: [pair.b.peer] },
    ];
    for (const [selector, what] of [['#pick-mic', 'microphone'], ['#pick-camera', 'camera']]) {
      const value = await pageA.locator(selector + ' option').first().getAttribute('value');
      await pageA.selectOption(selector, value);
      // The swap is asynchronous behind the change event: one
      // getUserMedia and a replaceTrack per connection. Nothing in the
      // page announces it finishing, so what is waited for is the thing
      // that must be true afterwards — a live local track of that kind
      // — and then the media is watched over a duration.
      const live = await until(async () => await pageA.evaluate((kind) => {
        const tracks = (window.meet && window.meet.local && window.meet.local()) || [];
        const of = tracks.filter((t) => t.kind === kind);
        return of.length === 1 && of[0].state === 'live' && of[0].chosen;
      }, what === 'microphone' ? 'audio' : 'video'), 15000);
      check(live, 'member A holds exactly one live ' + what + ' track after the switch');

      check((await pageA.locator('#device-note').textContent() || '').trim() === '',
        'switching the ' + what + ' reported no trouble (' +
        (await pageA.locator('#device-note').textContent()) + ')');

      await watchMedia(sides, 'after the ' + what + ' was switched: ');
    }

    // Three changes with nothing awaited between them, which is one
    // person clicking through a list rather than choosing from it. Each
    // is a getUserMedia and a replaceTrack across the mesh, and run at
    // once they would be two loops writing to the same senders — what
    // every peer then receives decided by whichever device opened
    // fastest. Serialised, the last click wins and the media never
    // stops; the failure this catches is the middle run stopping a
    // track the senders were still holding, which reads at the far end
    // as the call simply ending.
    const camera = await pageA.locator('#pick-camera option').first().getAttribute('value');
    await Promise.all([
      pageA.selectOption('#pick-camera', camera),
      pageA.selectOption('#pick-camera', camera),
      pageA.selectOption('#pick-camera', camera),
    ]);
    const settled = await until(async () => await pageA.evaluate(() => {
      const tracks = (window.meet && window.meet.local && window.meet.local()) || [];
      const video = tracks.filter((t) => t.kind === 'video');
      return video.length === 1 && video[0].state === 'live';
    }), 20000);
    check(settled, 'member A holds exactly one live camera after three switches at once — ' +
      JSON.stringify(await pageA.evaluate(() => window.meet.local())));
    await watchMedia(sides, 'after three switches at once: ');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §5.4 and §13's slice-4 sentence: "the higher-id context shares its
  // screen and the lower receives a second video track, then stops, the
  // received track ends, the share tile is removed and the camera track
  // keeps flowing."
  //
  // Every clause of that is an assertion here, and the camera is watched
  // across both halves rather than only at the end: a share that
  // renegotiated the call into silence and then gave it back would pass
  // a check made once, at rest.
  async share() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    // §5.1's own tie-break, read the same way room.js reads it. §13
    // names the higher id as the one that shares, and it is the
    // interesting half: the higher id is the impolite peer, so the
    // offer its new transceiver causes is the one that does not roll
    // back on a collision.
    const aHigher = String(pair.a.peer) > String(pair.b.peer);
    const sharer = aHigher
      ? { page: pageA, label: 'member A', peer: pair.a.peer }
      : { page: pageB, label: 'member B', peer: pair.b.peer };
    const viewer = aHigher
      ? { page: pageB, label: 'member B', peer: pair.b.peer }
      : { page: pageA, label: 'member A', peer: pair.a.peer };
    line('the higher-id context is ' + sharer.label);

    // The caption is built from the roster's name and the typographic
    // apostrophe room.js writes, not from a name typed here: the whole
    // point of the `share` message is that no label crosses the wire.
    const name = await selfName(sharer.page);
    check(name !== '', 'the sharer has a name for its screen to be captioned with (' + name + ')');
    const caption = name + '’s screen';
    const key = sharer.peer + '#share';

    const resting = await shareControl(sharer.page);
    check(resting && resting.pressed === 'false' && resting.state === 'Off' && !resting.disabled,
      'the Share button rests off, in a word and in aria-pressed (' + JSON.stringify(resting) + ')');
    check((await shareTiles(viewer.page)).length === 0,
      'nobody is showing a screen before anybody shares one');

    await sharer.page.click('#share');

    // The message first: `shares` follows the tile, and the tile follows
    // the `share {on:true}` — which is what lets a name appear before
    // the media and is why these are three assertions and not one.
    const announced = await until(async () => {
      const s = await state(viewer.page);
      return s.shares.includes(sharer.peer) ? s : false;
    }, 5000);
    check(announced, 'the other context is told whose screen is coming within five seconds — ' +
      (await diagnose(viewer.page, viewer.label)));

    const captioned = await until(async () => {
      const tiles = await shareTiles(viewer.page);
      return tiles.length === 1 && tiles[0].name === caption ? tiles : false;
    }, 5000);
    check(captioned, 'a second tile says whose screen it is (' +
      JSON.stringify(await shareTiles(viewer.page)) + ', want ' + JSON.stringify(caption) + ')');

    const pixels = await frameGrowth(viewer.page, key, 10000);
    check(pixels.ok, 'the screen is decoding real frames and not only labelled (' +
      growth(pixels) + ') — ' + (await diagnose(viewer.page, viewer.label)));

    // From a baseline taken now that the transition has settled, not
    // from one taken before the gesture: frames delivered between a
    // pre-gesture snapshot and a rollback stall would satisfy a
    // pre-gesture baseline while the camera was already dead (Codex
    // S4-6).
    const cameraOn = await frameGrowth(viewer.page, sharer.peer, 10000);
    check(cameraOn.ok, 'the camera kept flowing across the renegotiation (' +
      growth(cameraOn) + ')');

    // And still flowing through a window rather than at an instant, in
    // both directions: the failure this slice is about is a tile that
    // runs for a moment after a renegotiation and then stops, which a
    // check that returns on the first new frame cannot tell from
    // health (Codex's S4-6 gap). Both sides, because the sharer's own
    // view of the viewer's camera is renegotiated just as hard and was
    // never looked at.
    await watchMedia([
      { page: viewer.page, label: viewer.label, keys: [sharer.peer, key] },
      { page: sharer.page, label: sharer.label, keys: [viewer.peer] },
    ], 'after the share started: ');

    const pressed = await shareControl(sharer.page);
    check(pressed && pressed.pressed === 'true' && pressed.state === 'On',
      'the Share button says it is on, in both cues (' + JSON.stringify(pressed) + ')');
    check((await state(sharer.page)).sharing === true, 'the sharing tab says it is sharing');
    check((await shareTiles(sharer.page)).length === 0,
      'the sharer is not shown its own screen back (' + JSON.stringify(await shareTiles(sharer.page)) + ')');

    // The received track's own ending, armed before anything stops.
    // `ended` fires once and never again, so a listener installed after
    // the click would be an assertion about a moment already gone — and
    // the track object is kept on the page too, because the tile that
    // was holding it is about to be removed and the failure message
    // wants its readyState.
    const armed = await viewer.page.evaluate(() => {
      const v = document.querySelector('#tiles figure.calls-tile-share video');
      const track = v && v.srcObject ? v.srcObject.getVideoTracks()[0] : null;
      if (!track) return null;
      window.__shareEnded = [];
      window.__shareTrack = track;
      track.addEventListener('ended', () => window.__shareEnded.push(track.id));
      return { id: track.id, readyState: track.readyState };
    });
    check(armed && armed.readyState === 'live',
      'the received screen track is live, and watched for its ending (' + JSON.stringify(armed) + ')');

    // Paul, 2026-09-28: the sharing notice carries its own Stop
    // sharing button, named for a screen reader, reachable from the
    // keyboard — and this stop goes through it, so the button is
    // proved to do exactly what the bar's toggle does.
    const notice = await sharer.page.evaluate(() => {
      const n = document.getElementById('share-notice');
      const b = document.getElementById('share-stop');
      return n && b ? {
        shown: !n.hidden && n.getClientRects().length > 0,
        text: (n.querySelector('.calls-share-notice-row span') || {}).textContent || '',
        label: b.getAttribute('aria-label'),
        words: (b.textContent || '').trim(),
        focusable: b.tabIndex >= 0 && !b.disabled,
      } : null;
    });
    check(notice && notice.shown && notice.text === 'You are sharing your screen' &&
      notice.label === 'Stop sharing your screen' && notice.words === 'Stop sharing' && notice.focusable,
      'the sharing notice shows, with its own Stop sharing button (' + JSON.stringify(notice) + ')');
    await sharer.page.focus('#share-stop');
    await sharer.page.keyboard.press('Enter');

    const removed = await until(async () => {
      const s = await state(viewer.page);
      if (s.shares.length !== 0) return false;
      return (await shareTiles(viewer.page)).length === 0 ? s : false;
    }, 5000);
    check(removed, 'the screen tile and the shared state are gone within five seconds — ' +
      (await diagnose(viewer.page, viewer.label)));

    const ended = await until(() =>
      viewer.page.evaluate(() => ((window.__shareEnded || []).length > 0)), 5000);
    check(ended, 'the received track ended rather than merely stopping being drawn (readyState ' +
      (await viewer.page.evaluate(() => (window.__shareTrack || {}).readyState || '(no track)')) + ')');

    // Again from a fresh baseline, taken now that the stop has settled,
    // and again across a window rather than at an instant.
    // The screen is gone by now and is not expected; the two cameras
    // are, and they are the half a stopped share can take with it.
    await watchMedia([
      { page: viewer.page, label: viewer.label, keys: [sharer.peer] },
      { page: sharer.page, label: sharer.label, keys: [viewer.peer] },
    ], 'after the share stopped: ');

    const off = await until(async () => {
      const b = await shareControl(sharer.page);
      return b && b.pressed === 'false' && b.state === 'Off' ? b : false;
    }, 5000);
    check(off, 'the Share button is back off, in both cues (' +
      JSON.stringify(await shareControl(sharer.page)) + ')');
    check((await state(sharer.page)).sharing === false, 'the sharing tab says it has stopped');
    check(await sharer.page.evaluate(() => document.getElementById('share-notice').hidden),
      'the sharing notice goes with the share');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Both of them at once, three times over. §5.4 gives each connection
  // one sendonly transceiver for a screen, and a simultaneous share is
  // where that goes wrong: two peers renegotiating the same connection
  // in the same moment, the polite one rolling its own offer back — and
  // taking its share m-line with it. Either each screen ends up on its
  // own m-line, or one of them silently takes the other's and the
  // second screen arrives on a transceiver nothing is sending down.
  //
  // Nothing is staggered on purpose, because the stagger is the bug's
  // hiding place. Both clicks go out together, both directions are
  // asserted separately, and the frames half of each is what catches an
  // inactive m-line: `shares` and the caption move on the `share`
  // message alone, so a screen that was announced and never arrived
  // looks exactly like one that works until the pixels are counted.
  //
  // Three rounds, because a rollback that is recovered from once may
  // not be recovered from twice: the transceiver a round leaves behind
  // is the one the next round has to reuse or replace.
  async mutualshare() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    const nameA = await selfName(pageA);
    const nameB = await selfName(pageB);
    check(nameA !== '' && nameB !== '' && nameA !== nameB,
      'the two contexts have different names, so a caption can name the wrong one (' +
      JSON.stringify([nameA, nameB]) + ')');

    // `other` is the peer id on the far side of this page's one
    // connection, so every assertion below reads as "this page, about
    // the other one" and the two directions never get crossed.
    const sides = [
      { page: pageA, label: 'member A', other: pair.b.peer, otherName: nameB },
      { page: pageB, label: 'member B', other: pair.a.peer, otherName: nameA },
    ];

    // Both buttons hovered first, so Playwright's actionability checks
    // are already satisfied and the two clicks are two CDP messages and
    // nothing else. Trusted input rather than a scripted
    // element.click(): getDisplayMedia needs transient activation and a
    // synthesised click does not grant it. This is as near the same tick
    // as two browser contexts get.
    const bothClick = async () => {
      await Promise.all([pageA.hover('#share'), pageB.hover('#share')]);
      await Promise.all([pageA.click('#share'), pageB.click('#share')]);
    };

    for (let round = 1; round <= 3; round++) {
      const at = 'round ' + round + ': ';
      await bothClick();

      for (const side of sides) {
        const key = side.other + '#share';

        const announced = await until(async () => {
          const s = await state(side.page);
          return s.shares.includes(side.other) ? s : false;
        }, 10000);
        check(announced, at + side.label + " was told about the other's screen — " +
          (await diagnose(side.page, side.label)));

        const tiles = await shareTiles(side.page);
        check(tiles.length === 1 && tiles[0].name === side.otherName + '’s screen',
          at + side.label + ' shows one screen, captioned with the other name (' +
          JSON.stringify(tiles) + ', want ' + JSON.stringify(side.otherName + '’s screen') + ')');

        // The half a message cannot fake. A share m-line the far side
        // took for its own, or one left inactive by a rollback, is
        // announced exactly like a working one and carries nothing.
        //
        // From a baseline taken now, in every round: `frames[key] > 0`
        // reads a counter `dropShare` deliberately leaves behind, so
        // rounds two and three used to pass on round one's frames even
        // if the new screen delivered none at all (Codex S4-6).
        const pixels = await frameGrowth(side.page, key, 15000);
        check(pixels.ok, at + side.label + ' is decoding the other screen, not just showing its name (' +
          growth(pixels) + ') — ' + (await diagnose(side.page, side.label)));

        // The camera, from a baseline taken after this round's
        // transition settled rather than before the gesture that caused
        // it: frames delivered between a pre-gesture snapshot and a
        // rollback stall satisfy a pre-gesture baseline while the camera
        // is already dead, which is the exact failure this scenario was
        // written to catch.
        const camera = await frameGrowth(side.page, side.other, 15000);
        check(camera.ok, at + side.label + " is still receiving the other's camera (" +
          growth(camera) + ') — ' + (await diagnose(side.page, side.label)));
      }

      check((await state(pageA)).sharing === true && (await state(pageB)).sharing === true,
        at + 'both tabs say they are sharing');

      // Five seconds of not wobbling. Glare's worst outcome is not a
      // screen that never arrives but a connection left mid-offer: it
      // goes on carrying the media it already had, so every count above
      // keeps rising while nothing further can ever be negotiated.
      const wobbled = await bothStable(sides, 5000);
      check(wobbled === null, at + 'negotiation settled and stayed settled — ' + JSON.stringify(wobbled));

      // And the media through that same window. The five seconds above
      // watch signalling, which a connection whose camera has stopped
      // encoding passes perfectly: `connected`, `stable`, sendrecv, a
      // live track, and nothing coming out (Codex S4-6). Two successive
      // intervals per stream, both screens and both cameras, so a
      // stream that delivers a frame and stops cannot answer for one
      // that is running.
      // Both cameras and both screens, named rather than read back off
      // the page, and all four watched through the same windows.
      await watchMedia(sides.map((side) => ({
        page: side.page,
        label: side.label,
        keys: [side.other, side.other + '#share'],
      })), at + 'after the wait: ');

      if (round === 1) {
        for (const side of sides) {
          const surface = await capturedSurface(side.page);
          check(surface !== null,
            side.label + ' is sending a display capture and not a second camera (displaySurface ' +
            JSON.stringify(surface) + ')');
        }
      }

      if (round === 3) break;

      await bothClick();
      for (const side of sides) {
        const gone = await until(async () => {
          const s = await state(side.page);
          if (s.shares.length !== 0) return false;
          return (await shareTiles(side.page)).length === 0 ? s : false;
        }, 10000);
        check(gone, at + side.label + ' lost the screen tile before the next round — ' +
          (await diagnose(side.page, side.label)));
      }
      check((await state(pageA)).sharing === false && (await state(pageB)).sharing === false,
        at + 'both tabs say they have stopped');

      // The stop is a renegotiation too, and the round that follows
      // would happily start on a camera this one had already killed.
      await watchMedia(sides.map((side) => ({
        page: side.page,
        label: side.label,
        keys: [side.other],
      })), at + 'after both stopped: ');
    }

    // And the asymmetric ending, which is the one a symmetrical
    // scenario would never reach: one of them stops and the other does
    // not. The m-line that goes has to be the one that was stopped.
    const [stopper, keeper] = sides;
    const keptKey = stopper.other + '#share';

    await stopper.page.click('#share');

    const dropped = await until(async () => {
      const s = await state(keeper.page);
      if (s.shares.length !== 0) return false;
      return (await shareTiles(keeper.page)).length === 0 ? s : false;
    }, 10000);
    check(dropped, keeper.label + ' lost only the screen that stopped — ' +
      (await diagnose(keeper.page, keeper.label)));

    // Fresh baselines again, taken after the one-sided stop settled:
    // the screen that was kept, and both cameras.
    check((await state(stopper.page)).shares.includes(stopper.other),
      stopper.label + ' still holds the other screen through its own stop');
    const kept = await frameGrowth(stopper.page, keptKey, 10000);
    check(kept.ok, stopper.label + ' still has the other screen, and it is still arriving (' +
      growth(kept) + ') — ' + (await diagnose(stopper.page, stopper.label)));

    const stillCamera = await frameGrowth(keeper.page, keeper.other, 10000);
    check(stillCamera.ok, keeper.label + ' still has the camera through the one-sided stop (' +
      growth(stillCamera) + ') — ' + (await diagnose(keeper.page, keeper.label)));
    const stopperCamera = await frameGrowth(stopper.page, stopper.other, 10000);
    check(stopperCamera.ok, stopper.label + ' still has the camera through its own stop (' +
      growth(stopperCamera) + ') — ' + (await diagnose(stopper.page, stopper.label)));

    check((await state(stopper.page)).sharing === false,
      stopper.label + ' says it has stopped');
    check((await state(keeper.page)).sharing === true,
      keeper.label + ' says it is still sharing');

    const settledAfter = await bothStable(sides, 5000);
    check(settledAfter === null,
      'the one-sided stop left both connections settled — ' + JSON.stringify(settledAfter));

    // Last of all, and after that wait rather than before it: the media
    // checks above all ran before those five seconds, so a camera that
    // froze during them left every one of them green (Codex's S4-6
    // gap). Both sides, and the screen that is still being shared.
    // The stopper still holds the keeper's screen; the keeper holds
    // none. Both cameras, either way.
    await watchMedia([
      { page: stopper.page, label: stopper.label, keys: [stopper.other, keptKey] },
      { page: keeper.page, label: keeper.label, keys: [keeper.other] },
    ], 'after the one-sided stop settled: ');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await keeper.page.click('#share');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // The residual spec §15.16 names, forced rather than waited for.
  //
  // POLITE_YIELD is 300 ms, and a pair whose signalling round trip
  // exceeds it still collides: the polite side gives way, offers
  // anyway, and the remote offer lands afterwards — so it rolls back,
  // and Chromium rebuilds every send stream on the connection. The
  // camera's comes back having encoded nothing and never encodes again,
  // on an m-line that goes on reading sendrecv with a live track. A
  // slow network is only one way to get there: a 429 retry and a slow
  // offer arrive just as late.
  //
  // The lateness here is real rather than simulated. One context's own
  // `offer` POSTs are held for four times the yield before they reach
  // the hub, so the other side's offer really does arrive after the
  // yield has ended, on a connection that has already offered.
  //
  // What this asserts is the recovery, not the failure: a Chromium that
  // no longer rebuilds the streams passes it exactly as a repaired one
  // does, which is the right way round for a gate — the assertion is
  // "the camera is encoding again", never "the camera broke first".
  // Whether it stalled on the way is recorded as a line rather than a
  // check, because that half is the browser's behaviour and not this
  // app's promise.
  async laterolls() {
    const HOLD = 1200; // four times POLITE_YIELD
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    // §5.1's tie-break, read the way room.js reads it: the lower id is
    // the polite one, and the polite one is the side that rolls back.
    const aPolite = String(pair.a.peer) < String(pair.b.peer);
    const polite = aPolite
      ? { page: pageA, ctx: ctxA, label: 'member A', peer: pair.a.peer, other: pair.b.peer }
      : { page: pageB, ctx: ctxB, label: 'member B', peer: pair.b.peer, other: pair.a.peer };
    const impolite = aPolite
      ? { page: pageB, ctx: ctxB, label: 'member B', peer: pair.b.peer, other: pair.a.peer }
      : { page: pageA, ctx: ctxA, label: 'member A', peer: pair.a.peer, other: pair.b.peer };
    line('the polite side is ' + polite.label + ', and its offers are the ones that roll back');

    // Only the impolite side's offers, and only the offers: everything
    // else — candidates, the share announcement, the leave — goes at
    // its own speed, so what is delayed is exactly the thing that makes
    // the collision late.
    const held = [];
    await impolite.ctx.route('**/signal', async (route) => {
      const body = route.request().postData() || '';
      if (body.includes('"type":"offer"')) {
        held.push(Date.now());
        await sleep(HOLD);
      }
      await route.continue();
    });

    await Promise.all([polite.page.hover('#share'), impolite.page.hover('#share')]);
    await Promise.all([polite.page.click('#share'), impolite.page.click('#share')]);

    check(await until(() => held.length > 0, 15000) !== null,
      'the impolite side had an offer to hold back (' + held.length + ' held)');

    for (const side of [polite, impolite]) {
      const announced = await until(async () => {
        const s = await state(side.page);
        return s.shares.includes(side.other) ? s : false;
      }, 20000);
      check(announced, side.label + " was told about the other's screen through the delay — " +
        (await diagnose(side.page, side.label)));
    }

    // The collision, asserted rather than assumed. Holding an offer
    // back is a delay; what this scenario is about is what the delay
    // causes, and that is a remote offer arriving over this side's own
    // outstanding one — which is precisely when perfect negotiation
    // rolls the polite side back. The trap counts exactly that.
    const rolled = await until(async () => (await rollbacks(polite.page)) > 0, 15000);
    check(rolled, 'the delay produced a rollback on the polite side (' +
      (await rollbacks(polite.page)) + ' seen; without one this scenario proves nothing)');

    // The stall itself, watched but not required, and watched as a
    // series rather than as two numbers five seconds apart: a total
    // that grew across the window cannot tell a steady stream from one
    // that ran for a moment and stopped.
    const series = [];
    for (let i = 0; i < 6; i++) {
      series.push((await state(impolite.page)).frames[polite.peer] || 0);
      await sleep(500);
    }
    const moving = series[series.length - 1] > series[series.length - 2];
    line('the polite side\'s camera, rendered frames every 500 ms: ' + JSON.stringify(series) +
      (moving ? ' — still moving' : ' — stopped'));

    // And what the tiles are actually bound to, on both sides, whatever
    // happens next: three answers that ought to be one object.
    for (const side of [polite, impolite]) {
      line(side.label + ' identity: ' + JSON.stringify(await mediaIdentity(side.page)));
    }

    // The recovery, which is the promise: whatever the rollback did,
    // both cameras and both screens are delivering frames across two
    // successive intervals inside the repair budget — two polls to
    // notice, a replaceTrack cycle, two more polls, and a reset behind
    // that.
    // Recovery has to *arrive* before it can be required to last, and
    // arriving takes real time: three polls for the watch to notice,
    // two replays, and behind those a reset that rebuilds the pair. So
    // a deadline for the arrival — growth from a baseline taken now,
    // never "the counter is above zero", which a counter left over from
    // before the collision answers on its own — and then, separately,
    // an observation for the lasting.
    for (const side of [polite, impolite]) {
      for (const key of [side.other, side.other + '#share']) {
        const back = await frameGrowth(side.page, key, 40000);
        if (!check(back.ok, side.label + ' has ' + key + ' arriving again after the collision (' +
          growth(back) + ')')) {
          line('   ' + (await diagnose(side.page, side.label)));
          line('   identity: ' + JSON.stringify(await mediaIdentity(side.page)));
        }
      }
    }

    // Settled *after* the recovery, because a reset is one of the ways
    // this scenario is allowed to recover and a pair mid-rebuild is not
    // a pair that failed to settle.
    const settled = await bothStable(
      [{ page: polite.page, label: polite.label, other: polite.other },
        { page: impolite.page, label: impolite.label, other: impolite.other }], 15000);
    check(settled === null, 'the late collision left both connections settled — ' + JSON.stringify(settled));

    // And then the windows: every stream, both pages, growth in each
    // one. A recovery that lasts as long as a check and stops
    // afterwards is the shape this scenario exists to refuse.
    await watchMedia([
      { page: polite.page, label: polite.label, keys: [polite.other, polite.other + '#share'] },
      { page: impolite.page, label: impolite.label, keys: [impolite.other, impolite.other + '#share'] },
    ], 'and kept arriving once it had settled: ');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await impolite.ctx.unroute('**/signal');
    await polite.page.click('#share');
    await impolite.page.click('#share');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // A stream lives five minutes and is then renewed by a resume. Six
  // seconds here, through a header only development honours, so the
  // renewal happens several times while the call is watched — and six
  // rather than two because a stream shorter than the client's own
  // "this one was healthy" mark never clears its backoff, so the
  // renewals would slow down and this scenario would be measuring the
  // backoff ladder rather than the renewal. The client's mark stays
  // where it is; the header moves.
  async renewal() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    // Counting the attaching GETs is what stops this scenario passing
    // vacuously: a header the server ignored would leave the call up
    // for the whole watch on one five-minute stream, and every other
    // assertion here would still be true.
    let attaches = 0;
    for (const ctx of [ctxA, ctxB]) {
      await ctx.route('**/stream*', async (route) => {
        const url = route.request().url();
        if (!url.includes('probe=1')) attaches += 1;
        await route.continue({ headers: { ...route.request().headers(), 'x-calls-test-ttl': '6s' } });
      });
    }
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    const before = { a: await state(pageA), b: await state(pageB) };
    // Long enough for at least one renewal each at a six-second life,
    // and in practice two. Watched four times a second the whole way:
    // a renewal is a stream ended on purpose and resumed, and §15.23 says
    // nobody sees it — not "Reconnecting…" over the call, not on a tile,
    // not in the title (Paul, 2026-09-30: "I saw 'Reconnecting' appear
    // occasionally over the video, but only for a second").
    const said = [];
    let streamDowns = 0;
    for (const until = Date.now() + 16000; Date.now() < until;) {
      for (const [page, who] of [[pageA, 'A'], [pageB, 'B']]) {
        const r = await page.evaluate(() => ({
          reconnect: window.meet.state().reconnect,
          status: (document.getElementById('status') || {}).textContent || '',
          title: (document.getElementById('call-top') || {}).textContent || '',
          tiles: Array.from(document.querySelectorAll('.calls-tile-notice, [data-hear-notice]')).map((n) => n.textContent),
        }));
        if (r.reconnect.streamDown) streamDowns += 1;
        const text = [r.status, r.title, ...r.tiles].join(' | ');
        if (r.reconnect.call || r.reconnect.peers.length || /Reconnecting/.test(text)) said.push(who + ': ' + text);
      }
      await sleep(250);
    }
    const after = { a: await state(pageA), b: await state(pageB) };
    check(said.length === 0, 'no renewal was said as "Reconnecting" (' + said.slice(0, 3).join('; ') + ')');
    console.log('renewal: a stream was seen down (between its end and its resume) at ' + streamDowns + ' of the looks');

    check(after.a.peer === before.a.peer,
      'A kept its participation across the renewals (' + before.a.peer + ' -> ' + after.a.peer + ')');
    check(after.b.peer === before.b.peer,
      'B kept its participation across the renewals (' + before.b.peer + ' -> ' + after.b.peer + ')');
    check(after.a.admitted && after.a.peers.includes(before.b.peer),
      'A is still in the call after the renewals — ' + (await diagnose(pageA, 'member A')));
    check(after.b.admitted && after.b.peers.includes(before.a.peer),
      'B is still in the call after the renewals — ' + (await diagnose(pageB, 'member B')));
    check((after.a.frames[before.b.peer] || 0) > (before.a.frames[before.b.peer] || 0),
      'A is still receiving video after the renewals (' +
      (before.a.frames[before.b.peer] || 0) + ' -> ' + (after.a.frames[before.b.peer] || 0) + ')');
    // Two browsers, a six-second life, sixteen seconds of watching: the
    // first two attaches are the two fresh streams, and everything past
    // that is a renewal that actually happened. The floor is four — one
    // renewal each — rather than the number a stopwatch would predict,
    // because what this counts is that the header was honoured at all: a
    // server that ignored it would leave both calls up on one
    // five-minute stream and stop at two.
    check(attaches >= 4, 'the streams really were renewed (' + attaches + ' attaching GETs, want at least 4)');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §5.2 in a real browser: the app has a relay, both members fetch the
  // list before they build anything, and the pair connects anyway — the
  // contract names a host that does not exist, so a call that connects
  // at all connected on host candidates. The credential in that list is
  // the one thing that must never turn up anywhere else.
  async ice() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const iceA = await iceRoute(ctxA);
    const iceB = await iceRoute(ctxB);
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    // assertPair is the assertion that matters most here: signalling
    // settled, the transport up, and a decoded frame each way, with two
    // unreachable servers in every connection's configuration.
    await assertPair(pageA, pageB, 'member A', 'member B');

    for (const [page, label, seen] of [[pageA, 'member A', iceA], [pageB, 'member B', iceB]]) {
      const s = await state(page);
      check(s.ice.servers === 2,
        label + ' holds the two servers /ice minted (servers=' + s.ice.servers + ')');
      // And the connections were actually built with them. The line
      // above is the client's own cached count and would read the same
      // if every RTCPeerConnection were constructed with an empty list;
      // this is what the constructor received (Codex S3-5).
      const configs = await iceConfigs(page);
      const live = await livePcs(page);
      const now = installedPerConnection(configs, live);
      // Per connection, and the *last* configuration each one took: a
      // connection built with the list and one that adopted it at its
      // first quiet moment are both §5.2, and neither may be left on
      // the empty one. Counted globally, one connection's second update
      // could stand in for another's first (Codex S3-10).
      check(now.length > 0 && now.every((c) => c.servers === 2 && c.credentialed === 1),
        label + ' has every live connection configured with the two-entry list, one credentialed (' +
        JSON.stringify(now) + ' of ' + JSON.stringify(configs) + ')');
      check(s.ice.fetches === 1,
        label + ' fetched the list once for the call, not once per connection (fetches=' + s.ice.fetches + ')');
      check(s.ice.expiresAt > Date.now() && s.ice.renewAt > Date.now() && s.ice.renewAt < s.ice.expiresAt,
        label + ' was given a renewal time before an expiry, both ahead of now (' + JSON.stringify(s.ice) + ')');
      check(s.ice.warning === false, label + ' shows no relay warning (' + JSON.stringify(s.ice) + ')');

      const w = await warningRegion(page);
      check(w && w.role === 'status' && w.hidden && w.text === '',
        label + "'s warning region is in the page, empty and hidden (" + JSON.stringify(w) + ')');
      check((await tileNotes(page)).length === 0,
        label + ' has no sentence under any tile (' + JSON.stringify(await tileNotes(page)) + ')');

      check(seen.served >= 1 && seen.servers.every((n) => n === 2),
        label + ' was served a two-entry list every time (' + JSON.stringify(seen.servers) + ')');
      check(seen.turn.length === seen.served,
        label + ' got exactly one credentialed entry per fetch (' + seen.turn.length + ' of ' + seen.served + ')');
      // The five fields are the platform's own username shape: the
      // expiry the credential is minted against, then the account, the
      // app, the incarnation and the key id the suffix names.
      const fields = seen.turn.length ? seen.turn[0].split(':') : [];
      check(fields.length === 5,
        label + "'s turn username has five colon-separated fields (" + fields.length + ')');
      check(fields[1] === 'abc' && fields[2] === 'meet' && fields[3] === '0123456789abcdef' && fields[4] === 'k1',
        label + "'s turn username carries the contract's suffix (" + fields.slice(1).join(':') + ')');
      check(Number(fields[0]) > Math.floor(Date.now() / 1000),
        label + "'s turn username is minted against an expiry in the future (" + fields[0] + ')');
    }

    // §5.2's promise, measured: room.js prints an error object and never
    // a response, so no credential is in any console line — of either
    // browser, since one page's list must not reach the other's log
    // either.
    const creds = [...iceA.credentials, ...iceB.credentials];
    check(creds.length === 2, 'both members were minted a credential (' + creds.length + ')');
    const allLines = linesFor('member A') + '\n' + linesFor('member B');
    const leaked = leakedCredential(creds, allLines);
    check(leaked === -1,
      'no credential reaches the console (credential ' + leaked + ' of ' + creds.length +
      ' was found in ' + allLines.split('\n').filter(Boolean).length + ' console line(s))');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §5.3 steps 2 and 4: the credential's life shortened to eighteen
  // seconds, so the schedule the server named comes round while the call
  // is being watched. A is renewed; B is the control — no header, so its
  // credential lasts the production three hours and it never renews. One
  // browser's ICE restart is what step 2 is about, and two of them at
  // once would be a glare test wearing a renewal's clothes.
  //
  // Eighteen rather than twelve: the server renews at five sixths of the
  // life and expires at the whole of it, so twelve leaves two seconds
  // between the renewal starting and the deadline that prints the
  // expired sentence — and this scenario asserts that sentence stays
  // away. Eighteen leaves three, and still renews inside the window.
  async icerenewal() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    await ctxA.addInitScript(pcTap);
    const iceA = await iceRoute(ctxA, { ttl: '18s' });
    const iceB = await iceRoute(ctxB);
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    const peerA = pair.a.peer;
    const peerB = pair.b.peer;

    const first = await state(pageA);
    check(first.ice.fetches === 1, 'A is on its first list before the renewal (' + first.ice.fetches + ')');
    check(first.ice.expiresAt - first.ice.renewAt === 3000,
      'the shortened life left the three-second margin the schedule is measured from (' +
      (first.ice.expiresAt - first.ice.renewAt) + ' ms)');

    // The generation the call is on now, read the same way room.js's own
    // proof reads it. Without this the "changed" half of the assertion
    // below would have nothing to change from.
    const before = await selectedUfrags(pageA);
    check(before.length === 1 && before[0],
      'A is on a named ICE generation before the renewal (' + JSON.stringify(before) + ')');

    const second = await until(async () => {
      const s = await state(pageA);
      return s.ice.fetches >= 2 ? s : false;
    }, 25000);
    check(second, 'A fetched a second list on the schedule the server named — ' + (await diagnose(pageA, 'member A')));
    if (!second) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    check(second.ice.lastFetchAt > first.ice.lastFetchAt,
      'the second list is a fetch and not a re-read (' + (second.ice.lastFetchAt - first.ice.lastFetchAt) + ' ms later)');
    check(second.ice.renewAt > Date.now(),
      'the second fetch put the next renewal ahead of now (' + (second.ice.renewAt - Date.now()) + ' ms)');
    check(iceA.served >= 2, 'the route saw both of A\'s fetches (' + iceA.served + ')');

    // §5.3 step 2's proof: the exchange completed, the connection is
    // stable, and the selected pair is on a *new* generation.
    const record = await until(async () => {
      const s = await state(pageA);
      const r = s.renewals[peerB];
      return r && r.renewed ? r : false;
    }, 25000);
    check(record, 'A proved the ICE restart landed on the new list — ' + (await diagnose(pageA, 'member A')));
    if (record) {
      check(record.attempts === 1, 'one restart was enough (' + record.attempts + ' of 3)');
      check(record.ufrag && record.ufrag !== before[0],
        'the proof is a new ICE generation (' + before[0] + ' -> ' + record.ufrag + ')');
      const after = await selectedUfrags(pageA);
      check(after.length === 1 && after[0] && after[0] !== before[0],
        "the gate's own walk of the selected pair agrees (" + JSON.stringify(before) + ' -> ' + JSON.stringify(after) + ')');

      // And the renewal installed the *replacement* credential, rather
      // than restarting on the one it already had: a fresh generation
      // and flowing media would look exactly the same if renewal's
      // setConfiguration call were deleted, because host candidates
      // carry this call either way (Codex S3-5). Digests, never
      // credentials.
      const configs = await iceConfigs(pageA);
      const live = await livePcs(pageA);
      const mine = configs.filter((c) => live.includes(c.pc));
      const credentialed = mine.filter((c) => c.servers === 2 && c.credentialed === 1);
      const digests = Array.from(new Set(credentialed.map((c) => c.digest)));
      // Two credentialed configurations with *different* digests: the
      // first list this connection was given, and the replacement the
      // renewal installed. Which of them arrived through the
      // constructor and which through setConfiguration is not the
      // claim — a connection built during the first fetch takes its
      // first list through adopt — and the digests never leave the
      // page as anything but digests.
      check(credentialed.length >= 2 && digests.length >= 2,
        'the renewal installed a credential different from the one this connection had (' +
        JSON.stringify(mine.map((c) => c.at + ':' + c.pc + ':' + c.servers + ':' + c.digest)) + ')');
      const last = installedPerConnection(mine, live);
      check(last.length > 0 && last.every((c) => c.digest === digests[digests.length - 1]),
        'and it is the newer credential each live connection is left on (' +
        JSON.stringify(last) + ')');
    }

    // The call is what matters, not the restart: frames rising on both
    // sides two seconds after the renewal was proven.
    const framesA = (await state(pageA)).frames[peerB] || 0;
    const framesB = (await state(pageB)).frames[peerA] || 0;
    await sleep(2000);
    const risingA = await until(async () => {
      const s = await state(pageA);
      return (s.frames[peerB] || 0) > framesA ? s.frames[peerB] : false;
    }, 15000);
    check(risingA, 'A is still receiving video after the renewal (' + framesA + ' -> ' + risingA + ') — ' +
      (await diagnose(pageA, 'member A')));
    const risingB = await until(async () => {
      const s = await state(pageB);
      return (s.frames[peerA] || 0) > framesB ? s.frames[peerA] : false;
    }, 15000);
    check(risingB, 'B is still receiving video after A renewed (' + framesB + ' -> ' + risingB + ') — ' +
      (await diagnose(pageB, 'member B')));

    // Nothing expired: a renewal that lands inside the old credential's
    // life is the whole point of the schedule, and §5.3 step 3's
    // sentence belongs to the case where it does not.
    const end = await state(pageA);
    check(end.renewals[peerB] && end.renewals[peerB].expired === false,
      'no connection was marked expired (' + JSON.stringify(end.renewals) + ')');
    check(end.ice.warning === false, 'no relay warning was shown (' + JSON.stringify(end.ice) + ')');
    for (const [page, label] of [[pageA, 'member A'], [pageB, 'member B']]) {
      const notes = await tileNotes(page);
      check(!notes.includes(ICE_EXPIRED),
        label + ' shows no tile the credential expired on (' + JSON.stringify(notes) + ')');
      const w = await warningRegion(page);
      check(w && w.hidden && w.text === '', label + "'s warning region stayed empty (" + JSON.stringify(w) + ')');
    }
    check((await state(pageB)).ice.fetches === 1 && iceB.served === 1,
      'B, on the production schedule, never renewed (' + (await state(pageB)).ice.fetches + ' fetch(es))');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §5.3 steps 1 and 3, the unhappy half: the list is fetched once and
  // every fetch after that is refused. A is told, in a sentence, that
  // Calls cannot reach the relay; when the old credential's own deadline
  // passes with nothing renewed, the connection that was built on it
  // says so too — and through all of it the call stays up, because on
  // this network the relay was never load-bearing.
  //
  // Twelve seconds here rather than the renewal scenario's eighteen:
  // this one wants the deadline to arrive, and it arrives two seconds
  // after the warning.
  //
  // What is NOT asserted: the recovery. The client's retry is a fixed
  // minute (§5.3 step 1) and shortening it from the gate would be
  // testing a knob rather than the client, so proving the warning clears
  // would cost this scenario seventy seconds of waiting. The plan's own
  // ruling says the same; the recovery timing stays unproved here.
  // §13's other renewal ending, and the one no scenario reached: the
  // fetch works, the restart does not. room.js must spend all three
  // attempts and then say the connection is stuck — never that the
  // credential expired, which it plainly has not, and which is what the
  // client used to say after one attempt when the old deadline happened
  // to fall inside the window (Codex S3-4, S3-5).
  //
  // The instrument is a page-side stub: A's restartIce does nothing at
  // all. Everything else is real — the fetch is served normally, the
  // list is installed, the exchange is untouched — so what is being
  // tested is the state machine's own verdict on a restart that will
  // not land.
  async icestuck() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    await ctxA.addInitScript(() => {
      const proto = window.RTCPeerConnection && window.RTCPeerConnection.prototype;
      if (proto) proto.restartIce = function noRestart() {};
    });
    const iceA = await iceRoute(ctxA, { ttl: '12s' });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    const peerB = pair.b.peer;
    const framesBefore = (await state(pageA)).frames[peerB] || 0;

    // The renewal itself works: a second list arrives.
    const renewing = await until(async () => {
      const s = await state(pageA);
      return s.ice.fetches >= 2 ? s : false;
    }, 25000);
    check(renewing, 'A fetched a replacement list (' + iceA.served + ' served) — ' +
      (await diagnose(pageA, 'member A')));
    check(!(await state(pageA)).ice.warning,
      'and nothing claims the relay is unreachable: it answered (' +
      JSON.stringify((await state(pageA)).ice) + ')');

    // Three restarts, thirty seconds each, and none of them lands.
    // That is 90 seconds before the verdict, so the wait is generous.
    const verdict = await until(async () => {
      const r = (await state(pageA)).renewals[peerB];
      return r && r.trouble ? r : false;
    }, 120000);
    check(verdict, 'A reached a verdict on the connection it could not renew — ' +
      (await diagnose(pageA, 'member A')));
    if (verdict) {
      check(verdict.trouble === 'stuck',
        'the verdict is that the connection is stuck, not that the credential expired (' +
        JSON.stringify(verdict) + ')');
      check(verdict.expired === false,
        'and it is not marked expired: a replacement credential was in hand throughout (' +
        JSON.stringify(verdict) + ')');
      // The run that reached this verdict, not the connection's whole
      // life: `attempts` keeps counting as later runs take later lists,
      // so it cannot say how many restarts *this* verdict followed
      // (Codex S3-14). `lastRun` is captured with the verdict itself.
      check(verdict.lastRun && verdict.lastRun.attempts === 3 &&
        verdict.lastRun.verdict === 'stuck',
        'the run that gave up spent the whole three-restart budget (' +
        JSON.stringify(verdict.lastRun) + ')');
      check(verdict.attempts >= 3,
        'and the lifetime count is at least that (' + verdict.attempts + ')');
      check(verdict.renewed === false, 'and nothing was proven (' + JSON.stringify(verdict) + ')');
      const notes = await tileNotes(pageA);
      check(notes.includes(ICE_STUCK) && !notes.includes(ICE_EXPIRED),
        "A's tile says it could not renew this connection, and does not say expired (" +
        JSON.stringify(notes) + ')');
    }

    // And the call itself is untouched: a restart that never happened
    // costs nothing on a network where the media was already flowing.
    const rising = await until(async () => {
      const s = await state(pageA);
      return (s.frames[peerB] || 0) > framesBefore && s.connection[peerB] === 'connected' ? s : false;
    }, 15000);
    check(rising, 'the call is still connected and still receiving video (' + framesBefore + ' -> ' +
      (rising ? rising.frames[peerB] : 'stuck') + ') — ' + (await diagnose(pageA, 'member A')));

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  async icefail() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const iceA = await iceRoute(ctxA, { ttl: '12s', failFrom: 2 });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    const peerA = pair.a.peer;
    const peerB = pair.b.peer;

    const first = await state(pageA);
    check(first.ice.fetches === 1 && first.ice.warning === false,
      'A is on a good list with no warning before the relay goes (' + JSON.stringify(first.ice) + ')');
    check(first.ice.expiresAt - first.ice.renewAt === 2000,
      'the shortened life left the two-second margin (' + (first.ice.expiresAt - first.ice.renewAt) + ' ms)');
    const framesBefore = (await state(pageA)).frames[peerB] || 0;

    const warned = await until(async () => {
      const s = await state(pageA);
      return s.ice.warning ? s : false;
    }, 25000);
    check(warned, 'A says it cannot reach the relay — ' + (await diagnose(pageA, 'member A')));
    const warnedAt = Date.now();
    check(warnedAt - first.ice.renewAt < 15000,
      'the sentence arrives within fifteen seconds of the renewal time the server named (' +
      (warnedAt - first.ice.renewAt) + ' ms)');
    check(iceA.refused >= 1, 'the relay really was refused (' + iceA.refused + ' refusal(s))');
    check((await state(pageA)).ice.fetches === 1,
      'a refused fetch is not counted as a list (' + (await state(pageA)).ice.fetches + ')');

    const w = await warningRegion(pageA);
    check(w && w.text === ICE_WARNING && !w.hidden && w.role === 'status',
      'the warning is the sentence itself, in a live region a reader is told about (' + JSON.stringify(w) + ')');

    // §5.3 step 3: the old credential's expiry is the must-succeed-by,
    // and the connection built on it is marked when it passes.
    const expired = await until(async () => {
      const s = await state(pageA);
      const r = s.renewals[peerB];
      return r && r.expired ? s : false;
    }, 25000);
    check(expired, 'the connection that credential was about is marked expired — ' + (await diagnose(pageA, 'member A')));
    if (expired) {
      check(Date.now() >= first.ice.expiresAt,
        'nothing was called expired before the credential it belonged to ran out (' +
        (Date.now() - first.ice.expiresAt) + ' ms after)');
      check(Date.now() >= warnedAt,
        'the warning came first and the sentence second (' + (Date.now() - warnedAt) + ' ms apart)');
      const notes = await tileNotes(pageA);
      check(notes.includes(ICE_EXPIRED), "A's tile says the credential expired (" + JSON.stringify(notes) + ')');
    }

    // And through all of it: a call that never needed the relay.
    const rising = await until(async () => {
      const s = await state(pageA);
      return (s.frames[peerB] || 0) > framesBefore &&
        s.signaling[peerB] === 'stable' && s.connection[peerB] === 'connected' ? s : false;
    }, 15000);
    check(rising, 'the call is still connected and still receiving video (' + framesBefore + ' -> ' +
      (rising ? rising.frames[peerB] : 'stuck') + ') — ' + (await diagnose(pageA, 'member A')));

    // B is the control: nothing was taken away from it, so neither
    // sentence belongs on its screen.
    const b = await state(pageB);
    check(b.ice.warning === false && b.ice.fetches === 1,
      'B, whose relay was never taken away, shows no warning (' + JSON.stringify(b.ice) + ')');
    check(!(await tileNotes(pageB)).includes(ICE_EXPIRED),
      'B shows no expired sentence (' + JSON.stringify(await tileNotes(pageB)) + ')');
    check((b.frames[peerA] || 0) > 0, 'B is still receiving A (' + (b.frames[peerA] || 0) + ' frames)');

    line('note: the one-minute retry recovering is not asserted here — see the comment above icefail');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.3's admission queue: a guest knocks, sees nothing of the room,
  // and is let in by a member.
  //
  // Two guests knock, and only one is admitted. That is what makes the
  // isolation half of this scenario load-bearing (W-1): with a single
  // guest, the queue is empty at the moment it is admitted and no
  // admission ever happens while anyone is waiting, so every one of
  // §4.3's audience filters can be deleted and the scenario still
  // passes. It was, and it did.
  async guest() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxW = await newContext('waiting guest');
    const ctxG = await newContext('guest');
    const pageA = await openRoom(ctxA);
    check(await until(async () => (await state(pageA)).admitted, 20000),
      'the member is in the room — ' + (await diagnose(pageA, 'member A')));

    // The guest that stays in the queue for the whole scenario.
    await signInAsGuest(ctxW, WAITER);
    const pageW = await openRoom(ctxW);
    check(await until(async () => ((await state(pageW)).peer ? true : false), 20000),
      'the first guest knocked — ' + (await diagnose(pageW, 'waiting guest')));
    check(await until(async () => (await pageA.locator('#knocks li').count()) === 1, 20000),
      "the member's queue shows the first knock — " + (await diagnose(pageA, 'member A')));

    await signInAsGuest(ctxG, GUEST);
    const pageG = await openRoom(ctxG);

    const knocked = await until(async () => ((await state(pageG)).peer ? true : false), 20000);
    check(knocked, 'the guest got a peer id and knocked — ' + (await diagnose(pageG, 'guest')));
    check(await waitStatus(pageG, 'Waiting for someone to let you in.', 10000),
      'the guest is told it is waiting — status: ' + (await statusText(pageG)));

    const waitingState = await state(pageG);
    check(waitingState.admitted === false, 'the guest is not admitted before anyone admits it');
    check(waitingState.peers.length === 0,
      'the guest has no peer connections before admission (' + JSON.stringify(waitingState.peers) + ')');
    check((await queueNames(pageG)).length === 0,
      'a guest that has only knocked is told nothing about the queue (' + JSON.stringify(await queueNames(pageG)) + ')');

    const queued = await until(async () => (await pageA.locator('#knocks li').count()) === 2, 20000);
    check(queued, "the member's queue shows both knocks — " + (await diagnose(pageA, 'member A')));
    if (queued) {
      check(await admitKnock(pageA, 'guest'),
        'the queue names the guest to admit (' + JSON.stringify(await queueNames(pageA)) + ')');
    }

    await assertPair(pageA, pageG, 'member A', 'guest');

    // W-1, as a browser can see it. The guest was admitted while
    // somebody else was knocking, so roster.waiting had a name in it to
    // leak, and an admission happened while the other guest waited.
    check((await queueNames(pageG)).length === 0,
      'the admitted guest was never handed the waiting queue (' + JSON.stringify(await queueNames(pageG)) + ')');
    check(await pageG.locator('#queue').isHidden(),
      "the admitted guest's queue stays hidden");
    // `terminal === null` and a peer id are load-bearing, not decoration:
    // a `peer` event sent to a waiting guest makes it open a connection
    // and start signalling, which is refused, which sends it round the
    // fresh-stream ladder into `replaced` — and a terminal page has an
    // empty peer list too. Without these two the assertion would pass on
    // the very leak it is written to catch.
    const stillWaiting = await stayed(pageW, 3000,
      (s) => s.terminal === null && !!s.peer && s.admitted === false && s.peers.length === 0);
    check(stillWaiting === null,
      'the guest still waiting is still just waiting, told nothing of the admission — ' +
      JSON.stringify(stillWaiting));
    check((await queueNames(pageW)).length === 0,
      'the guest still waiting knows nothing of the queue it is in (' + JSON.stringify(await queueNames(pageW)) + ')');

    // The member does see the queue, so the three checks above are an
    // audience and not an empty room.
    check(JSON.stringify(await queueNames(pageA)) === JSON.stringify(['waiter']),
      "the member's queue still holds the guest that was not admitted (" + JSON.stringify(await queueNames(pageA)) + ')');

    // And a knock that arrives *while* the guest is admitted: the same
    // audience rule, and the one slice 4's chat fan-out extends. The
    // waiter leaves and comes back so the knock happens now rather than
    // before the admission.
    await leaveRoom(pageW);
    const pageW2 = await openRoom(ctxW);
    check(await until(async () => ((await state(pageW2)).peer ? true : false), 20000),
      'the guest knocked again — ' + (await diagnose(pageW2, 'waiting guest')));
    check(await until(async () => (await pageA.locator('#knocks li').count()) === 1, 20000),
      "the member is told about the second knock — " + (await diagnose(pageA, 'member A')));
    check((await queueNames(pageG)).length === 0,
      'the admitted guest is not told who is knocking (' + JSON.stringify(await queueNames(pageG)) + ')');

    await leaveRoom(pageG);
    await leaveRoom(pageW2);
    await leaveRoom(pageA);
    await ctxA.close();
    await ctxW.close();
    await ctxG.close();
  },

  // §6 and §13's other slice-4 sentence: "chat arrives at the admitted
  // context and not at a waiting one."
  //
  // The guest is what makes that a claim rather than a description. It
  // is signed in, it has a participation, it is knocking — everything
  // except admitted — so a fan-out that reached everybody with a stream
  // would reach it. The window it is watched for is opened only after
  // the *member* has the line, so "silence" here means a message that
  // demonstrably arrived somewhere and demonstrably did not arrive here.
  // Then it is let in, and the very next line has to reach it.
  async chat() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const ctxG = await newContext('guest');

    // Every chat POST A makes, kept whole. §4.3's wire shape is a
    // negative claim — no `to`, no `seq`, no `gen` — and the body A
    // actually sent is the only place a browser can prove it. The count
    // matters as much as the shape: one line typed is one POST however
    // many people hear it, which is the whole difference between a
    // broadcast and a loop over the roster.
    const chatPosts = [];
    await ctxA.route('**/signal', async (route) => {
      try {
        const msg = JSON.parse(route.request().postData() || '');
        if (msg && msg.type === 'chat') chatPosts.push(msg);
      } catch {
        // No body, or not JSON: not a chat.
      }
      await route.continue();
    });

    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      await ctxG.close();
      return;
    }

    check(await until(() => chatMounted(pageA), 10000),
      "an admitted member's chat panel is on the page — " + (await diagnose(pageA, 'member A')));
    check(await pageA.locator('#chat-overlay').isHidden(), 'and closed until asked for, as on the Mac');
    await openChat(pageA);
    await openChat(pageB);
    check(await pageA.locator('#chat-text').isEditable(), "A's composer is live");
    check(await pageB.locator('#chat-send').isEnabled(), "B's Send button is live");

    // The third context: signed in through the emailed link, knocking,
    // not admitted.
    await signInAsGuest(ctxG);
    const pageG = await openRoom(ctxG);
    check(await until(async () => ((await state(pageG)).peer ? true : false), 20000),
      'the guest got a peer id and knocked — ' + (await diagnose(pageG, 'guest')));
    check(await waitStatus(pageG, 'Waiting for someone to let you in.', 10000),
      'the guest is told it is waiting — status: ' + (await statusText(pageG)));
    check((await state(pageG)).admitted === false, 'the guest is waiting, not admitted');
    check(!(await chatMounted(pageG)) && await pageG.locator('#chat').isHidden(),
      'a guest that has only knocked is shown no chat panel');

    const nameA = await selfName(pageA);
    check(nameA !== '', "A's own tile names it (" + nameA + ')');

    const HELLO = 'hello from A';
    await pageA.fill('#chat-text', HELLO);
    await pageA.press('#chat-text', 'Enter');

    const heard = await until(async () => {
      const log = await chatLog(pageB);
      return log.find((l) => l.text === HELLO) || false;
    }, 2000);
    check(heard, "B's log gained the line within two seconds (" +
      JSON.stringify(await chatLog(pageB)) + ')');
    if (heard) {
      // Not "the envelope's name": what a browser can see is that the
      // line B was given is attributed to A and not to B, and with two
      // distinct local parts on the two addresses (browser_test.go says
      // why) that is a claim this check can fail.
      check(heard.name === nameA,
        "the line B sees is attributed to A, not to B (" + JSON.stringify(heard.name) +
        ' vs ' + JSON.stringify(nameA) + ')');
      check(heard.self === false, "the line B sees is not drawn as B's own");
    }

    // A's echo is appended when A's own POST is answered, and B's line
    // when the hub's broadcast reaches B's stream: two different events
    // with no order between them. Reading A's log the instant B had the
    // line raced that, and lost about one run in six on main f5a1254 as
    // on this branch (#24). The claim is unchanged — A's log shows what A
    // said — and it gets the same two seconds B's does.
    const echo = await until(async () => (await chatLog(pageA)).find((l) => l.text === HELLO) || false, 2000);
    check(echo, "A's own log shows what A said (" + JSON.stringify(await chatLog(pageA)) + ')');
    if (echo) check(echo.self === true, "A's echo is drawn as A's own line");

    // §4.3: the hub never sends a chat back to the tab that sent it, and
    // the line in A's log is the panel's own echo. Those two facts are
    // one line each and they are what stop a double-drawn message
    // passing every check above.
    check((await state(pageA)).chat.received === 0,
      'A was not sent its own line back (' + JSON.stringify((await state(pageA)).chat) + ')');
    check((await chatLog(pageA)).filter((l) => l.text === HELLO).length === 1,
      "A's log holds the line once, not twice (" + JSON.stringify(await chatLog(pageA)) + ')');
    check((await chatLog(pageB)).filter((l) => l.text === HELLO).length === 1,
      "B's log holds the line once, not twice (" + JSON.stringify(await chatLog(pageB)) + ')');

    // The member side is polled first, deliberately: the guest's
    // two-second window has to be a window in which the message
    // demonstrably existed, or it is a test of nothing having happened
    // yet. Every guest check below is guarded on it for the same reason
    // — an unsent message is silent everywhere, and this scenario would
    // be reporting that as a pass.
    const counted = await until(async () => {
      const s = await state(pageB);
      return s.chat.received >= 1 ? s : false;
    }, 5000);
    check(counted, 'B counted the line it put in its log (' +
      JSON.stringify((await state(pageB)).chat) + ')');
    check(counted && counted.chat.received === 1,
      'and counted it once (' + JSON.stringify(counted && counted.chat) + ')');
    check((await state(pageA)).chat.sent === 1,
      'A counted exactly the one line the hub accepted (' +
      JSON.stringify((await state(pageA)).chat) + ')');

    if (counted) {
      const silent = await stayed(pageG, 2000, (s) => s.chat.received === 0 && s.admitted === false);
      check(silent === null,
        'the waiting guest was sent no chat at all — ' + JSON.stringify(silent));
      check(!(await chatMounted(pageG)) && await pageG.locator('#chat').isHidden(),
        "the waiting guest's chat panel is still not there to put anything in");
      check((await chatLog(pageG)).length === 0,
        "the waiting guest's log is empty (" + JSON.stringify(await chatLog(pageG)) + ')');
    } else {
      check(false, 'the guest was not watched for silence: nothing was proven to have been said');
    }

    check(chatPosts.length === 1,
      'one line typed is one POST, however many people hear it (' + chatPosts.length + ')');
    const sent = chatPosts[0] || {};
    check(sent.type === 'chat' && sent.peer === pair.a.peer &&
      sent.payload && sent.payload.text === HELLO,
      'the POST carries this tab\'s own peer and the text (' + JSON.stringify(Object.keys(sent)) + ')');
    check(!('to' in sent) && !('seq' in sent) && !('gen' in sent),
      'a broadcast names no target and no ordering (' + JSON.stringify(Object.keys(sent)) + ')');

    // And now the other half of the sentence.
    const queued = await until(async () => (await pageA.locator('#knocks li').count()) === 1, 20000);
    check(queued, "the member's queue shows the knock — " + (await diagnose(pageA, 'member A')));
    if (queued) {
      check(await admitKnock(pageA, 'guest'),
        'the queue names the guest to admit (' + JSON.stringify(await queueNames(pageA)) + ')');
    }

    const admitted = await until(async () => {
      const s = await state(pageG);
      return s.admitted && s.rosters >= 1 ? s : false;
    }, 25000);
    check(admitted, 'the guest was admitted and has its roster — ' + (await diagnose(pageG, 'guest')));
    check(await until(() => chatMounted(pageG), 10000),
      "the admitted guest's chat panel is on the page — " + (await diagnose(pageG, 'guest')));

    const AGAIN = 'and now the guest is here';
    await pageA.fill('#chat-text', AGAIN);
    await pageA.press('#chat-text', 'Enter');

    const guestHeard = await until(async () => {
      const log = await chatLog(pageG);
      return log.find((l) => l.text === AGAIN) || false;
    }, 5000);
    check(guestHeard, 'the admitted guest receives the next line (' +
      JSON.stringify(await chatLog(pageG)) + ')');
    if (guestHeard) {
      check(guestHeard.name === nameA,
        "the guest's line is attributed to A too (" + JSON.stringify(guestHeard.name) + ')');
    }
    // §6 has no replay and no history: what was said before this guest
    // was let in is not caught up with, and nothing offers to.
    check((await chatLog(pageG)).every((l) => l.text !== HELLO),
      'and is handed nothing that was said before it was let in (' +
      JSON.stringify(await chatLog(pageG)) + ')');
    check(chatPosts.length === 2,
      'the second line is one POST as well (' + chatPosts.length + ')');
    // Exactly two, not at least two: §6 has no replay and no gap, so a
    // count that climbed past what was said would mean something was
    // delivered twice, and a count short of it would mean a line went
    // missing. Both are the same assertion.
    const both = await until(async () => {
      const s = await state(pageB);
      return s.chat.received >= 2 ? s : false;
    }, 5000);
    check(both && both.chat.received === 2,
      'B heard both lines, each once (' + JSON.stringify((await state(pageB)).chat) + ')');
    check((await chatLog(pageB)).filter((l) => l.text === AGAIN).length === 1,
      "and drew the second one once (" + JSON.stringify(await chatLog(pageB)) + ')');
    check((await state(pageA)).chat.received === 0,
      'A was sent neither of its own lines back (' +
      JSON.stringify((await state(pageA)).chat) + ')');

    // §6 and §5.2's promise together: what people say is not logged.
    for (const label of ['member A', 'member B', 'guest']) {
      const lines = linesFor(label);
      check(!lines.includes(HELLO) && !lines.includes(AGAIN),
        'nothing anybody typed reached the console on ' + label);
    }
    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');

    await leaveRoom(pageG);
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
    await ctxG.close();
  },

  // §3.5: removal is a member's own confirm page, in its own tab, and
  // the person removed is told so in a sentence.
  async removed() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxG = await newContext('guest');
    const pageA = await openRoom(ctxA);
    await until(async () => (await state(pageA)).admitted, 20000);

    await signInAsGuest(ctxG);
    const pageG = await openRoom(ctxG);

    const queued = await until(async () => (await pageA.locator('#knocks li').count()) === 1, 20000);
    check(queued, 'the guest reached the queue — ' + (await diagnose(pageA, 'member A')));
    if (queued) await pageA.click('#knocks li button');

    const pair = await assertPair(pageA, pageG, 'member A', 'guest');
    if (!pair) {
      await ctxA.close();
      await ctxG.close();
      return;
    }

    check(await pageA.locator('#tiles figcaption .calls-tile-remove, #tiles figcaption a').count() === 0,
      'the name label carries no Remove: it is in the tile menu');
    await openTileMenu(pageA, pair.b.peer);
    const href = await pageA.locator('.calls-tile-remove').first().getAttribute('href');
    check(href === '/m/' + sqid + '/remove/' + pair.b.peer,
      "the Remove control names the guest's peer (" + href + ')');

    // target="_blank": the call is holding this tab, so the confirm page
    // arrives as a second page in the same context.
    const [confirm] = await Promise.all([
      ctxA.waitForEvent('page', { timeout: 15000 }),
      pageA.click('.calls-tile-remove'),
    ]);
    await confirm.waitForLoadState('domcontentloaded');
    const heading = await confirm.locator('h1').first().textContent();
    check(/^Remove .* from the call\?$/.test((heading || '').trim()),
      'the confirm page asks about this person (' + heading + ')');

    await Promise.all([
      confirm.waitForURL('**/m/' + sqid + '/join', { timeout: 15000 }),
      confirm.click('form[rst-form-actions] button[type="submit"]'),
    ]);
    check(confirm.url() === origin + '/m/' + sqid + '/join',
      'the confirmed removal lands on the holding screen, which opens no stream (at ' + where(confirm) + ')');

    check(await waitStatus(pageG, 'Someone removed you from this meeting.', 20000),
      'the guest is told it was removed — status: ' + (await statusText(pageG)));
    const ended = await until(async () => {
      const s = await state(pageG);
      return s.terminal === 'removed' && s.admitted === false && s.peers.length === 0 ? s : false;
    }, 10000);
    check(ended, 'the removed guest is terminal on `removed`, not admitted, and holds no peer connections — ' +
      (await diagnose(pageG, 'guest')));

    await leaveRoom(pageA);
    await ctxA.close();
    await ctxG.close();
  },

  // §2.4 and §13: a member dropped from the team mid-call is dropped on
  // the next tick, and the other context sees them go. Only Go can move
  // the allowlist and run the tick, so the browser asks for both.
  async allowlist() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    const answer = await control('drop-member-b');
    check(answer === 'ok', 'B was taken off the team and the tick was run (' + answer + ')');

    const dropped = await until(async () => {
      const s = await state(pageB);
      return s.terminal === 'standing' && s.admitted === false && s.peers.length === 0 ? s : false;
    }, 25000);
    check(dropped, 'the dropped member is terminal on `standing`, not admitted, and holds no connections — ' +
      (await diagnose(pageB, 'member B')));
    check(await waitStatus(pageB, 'You no longer have access to this meeting.', 10000),
      'the dropped member is told why in plain words — status: ' + (await statusText(pageB)));

    const gone = await until(async () => {
      const s = await state(pageA);
      return !s.peers.includes(pair.b.peer) ? s : false;
    }, 25000);
    check(gone, 'the other context lost the dropped member from its peers — ' + (await diagnose(pageA, 'member A')));
    const tiles = await until(async () => (await pageA.locator('#tiles figure').count()) === 1, 15000);
    check(tiles, "the dropped member's tile is gone — " + (await diagnose(pageA, 'member A')));
    check(!(await state(pageA)).terminal, 'the member still on the team is still in the call');

    await leaveRoom(pageA);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.5 and §13: a context whose stream is cut while a peer leaves
  // resumes, receives the roster, and has closed the connection to the
  // peer that left. The `gone` event never reached it; the roster is
  // what tells it.
  async departure() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const cut = await cuttableStream(ctxA);
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    cut.on = true;
    check(await biteCut(cut), "A's attaching stream is cut (" + cut.aborted + ' aborted)');

    await leaveRoom(pageB);
    cut.on = false;

    const back = await until(async () => {
      const s = await state(pageA);
      return s.peer === pair.a.peer && !s.peers.includes(pair.b.peer) && !s.terminal ? s : false;
    }, 45000);
    check(back, 'A resumed its own participation and closed the connection to the peer that left — ' +
      (await diagnose(pageA, 'member A')));
    const tiles = await until(async () => (await pageA.locator('#tiles figure').count()) === 1, 15000);
    check(tiles, 'A is left with its own tile only — ' + (await diagnose(pageA, 'member A')));

    await leaveRoom(pageA);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.5 and §13: signalling whose SSE delivery is cut after the POST's
  // 2xx is replayed on resume, and the pair connects. B forces an ICE
  // restart while A cannot hear it; the offer sits in A's ring; A's
  // resume replays it. B's own signalingState is the proof — it stays at
  // have-local-offer until A answers, so B returning to `stable` means
  // the replayed offer arrived and was answered.
  async replay() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const cut = await cuttableStream(ctxA);
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    cut.on = true;
    check(await biteCut(cut), "A's attaching stream is cut (" + cut.aborted + ' aborted)');

    // The Retry control on B's tile for A is restartIce. The page only
    // reveals it on a failed connection, so it is dispatched rather than
    // clicked: this scenario is about the signalling, not the control.
    await pageB.locator('#tiles figure:not(.calls-tile-self) figcaption button').first().dispatchEvent('click');

    // Asserted while A is still cut, and this is the assertion that
    // makes the scenario mean anything: B has an offer out that A cannot
    // answer, so its signalingState leaves `stable`. Without this, the
    // ending state below is the starting state — B stable and connected,
    // A's frames still rising because the cut is on the SSE stream and
    // not on the media — and a dispatch that never reached restartIce
    // would pass.
    const offered = await until(async () => {
      const b = await state(pageB);
      return b.signaling[pair.a.peer] === 'have-local-offer' ? b : false;
    }, 5000);
    check(offered, 'B has signalling out that A cannot answer while it is cut — ' +
      (await diagnose(pageB, 'member B')));

    await sleep(5000);
    cut.on = false;

    const settled = await until(async () => {
      const b = await state(pageB);
      const a = await state(pageA);
      return b.signaling[pair.a.peer] === 'stable' && b.connection[pair.a.peer] === 'connected' &&
        a.peer === pair.a.peer && a.connection[pair.b.peer] === 'connected' ? { a, b } : false;
    }, 45000);
    check(settled, 'the offer B sent while A was cut was replayed on A’s resume and answered — ' +
      (await diagnose(pageB, 'member B')) + ' ' + (await diagnose(pageA, 'member A')));

    const before = (await state(pageA)).frames[pair.b.peer] || 0;
    const rising = await until(async () => ((await state(pageA)).frames[pair.b.peer] || 0) > before, 25000);
    check(rising, 'A is decoding video again after the replay (' + before + ' -> ' +
      ((await state(pageA)).frames[pair.b.peer] || 0) + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.5, §4.6 and §13: more targeted messages than the ring holds
  // arrive while A is cut, so the replay cannot fill the hole. The hub
  // answers `gap`, A asks for a reset, the hub bumps the generation and
  // both sides rebuild.
  async gap() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const cut = await cuttableStream(ctxA);
    // A's own POSTs are counted, not touched: a `reset` from A is the
    // observable proof that it received `gap` — nothing else in the room
    // makes A ask for one.
    let resets = 0;
    await ctxA.route('**/signal', async (route) => {
      const body = route.request().postData() || '';
      if (body.includes('"type":"reset"')) resets += 1;
      await route.continue();
    });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    check(resets === 0, 'nothing had reset this pair before the gap (' + resets + ')');

    cut.on = true;
    check(await biteCut(cut), "A's attaching stream is cut (" + cut.aborted + ' aborted)');

    // Forty targeted messages, from B's own page so they carry B's
    // session and peer, aimed at A. The ring holds thirty-two, and `seq`
    // starts far above anything room.js has sent, so every one of them
    // is above the cursor A resumes with and the eviction is a real
    // hole rather than an already-delivered prefix. `gen` is 1 because
    // nothing has reset this pair — the check above is what says so.
    const posted = await pageB.evaluate(async ({ room, to, n }) => {
      const me = window.meet.state().peer;
      let ok = 0;
      for (let i = 0; i < n; i++) {
        const res = await fetch('/m/' + room + '/signal', {
          method: 'POST',
          credentials: 'same-origin',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ peer: me, type: 'candidate', to, seq: 100000 + i, gen: 1, payload: {} }),
        });
        if (res.status === 200) ok += 1;
      }
      return ok;
    }, { room: sqid, to: pair.a.peer, n: 40 });
    check(posted === 40, 'B pushed forty targeted messages past A while it was cut (' + posted + ' accepted)');

    cut.on = false;

    const asked = await until(() => (resets > 0 ? resets : false), 45000);
    check(asked, 'A received `gap` and asked for a reset (' + resets + ' resets posted)');

    const rebuilt = await until(async () => {
      const a = await state(pageA);
      const b = await state(pageB);
      return a.peer === pair.a.peer && !a.terminal &&
        a.peers.includes(pair.b.peer) && b.peers.includes(pair.a.peer) &&
        a.signaling[pair.b.peer] === 'stable' && a.connection[pair.b.peer] === 'connected' &&
        b.signaling[pair.a.peer] === 'stable' && b.connection[pair.a.peer] === 'connected' ? { a, b } : false;
    }, 45000);
    check(rebuilt, 'both sides rebuilt the pair at the new generation and connected — ' +
      (await diagnose(pageA, 'member A')) + ' ' + (await diagnose(pageB, 'member B')));

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // The rest of §13's gap clause: "including when one side's `pair` was
  // cut and it learns the generation from the roster on its own resume".
  //
  // The reset comes from B, and A is cut across the whole of it, so A's
  // `pair` is never delivered. It is not replayed either: a `pair` is
  // only replayed when it carries a generation *above* the roster's, and
  // the roster carries the current one — so the roster is the only place
  // A can learn it (hub/relay.go's own note on that branch). A's
  // reconcile path is what has to notice: `ensurePC` with a generation
  // above the local one rebuilds.
  //
  // That A never asked is the assertion that separates this from the gap
  // scenario: its own `reset` count stays at zero throughout.
  async rosterpair() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const cut = await cuttableStream(ctxA);
    let resets = 0;
    await ctxA.route('**/signal', async (route) => {
      if ((route.request().postData() || '').includes('"type":"reset"')) resets += 1;
      await route.continue();
    });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    cut.on = true;
    check(await biteCut(cut), "A's attaching stream is cut (" + cut.aborted + ' aborted)');

    // B resets the pair from its own page, so the request carries B's
    // session and peer and nothing on A's side is involved.
    const reset = await pageB.evaluate(async ({ room, to }) => {
      const res = await fetch('/m/' + room + '/signal', {
        method: 'POST',
        credentials: 'same-origin',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ peer: window.meet.state().peer, type: 'reset', to }),
      });
      return res.status;
    }, { room: sqid, to: pair.a.peer });
    check(reset === 200, 'B reset the pair while A was cut (' + reset + ')');

    // B rebuilt on its own `pair`, which it did receive: its connection
    // to A leaves `connected` while A knows nothing about it.
    const bRebuilt = await until(async () => {
      const b = await state(pageB);
      return b.connection[pair.a.peer] !== 'connected' || b.signaling[pair.a.peer] !== 'stable' ? b : false;
    }, 15000);
    check(bRebuilt, 'B rebuilt its side at the new generation — ' + (await diagnose(pageB, 'member B')));

    cut.on = false;

    const rebuilt = await until(async () => {
      const a = await state(pageA);
      const b = await state(pageB);
      return a.peer === pair.a.peer && !a.terminal &&
        a.peers.includes(pair.b.peer) && b.peers.includes(pair.a.peer) &&
        a.signaling[pair.b.peer] === 'stable' && a.connection[pair.b.peer] === 'connected' &&
        b.signaling[pair.a.peer] === 'stable' && b.connection[pair.a.peer] === 'connected' ? { a, b } : false;
    }, 45000);
    // Connecting at all is the proof that A converged on B's generation:
    // the hub refuses signalling at any other one with 409, so a side
    // still at the old generation never gets an offer through.
    check(rebuilt, 'A learned the new generation from the roster alone and the pair connected again — ' +
      (await diagnose(pageA, 'member A')) + ' ' + (await diagnose(pageB, 'member B')));
    check(resets === 0, 'A never asked for a reset of its own (' + resets + ')');

    const before = (await state(pageA)).frames[pair.b.peer] || 0;
    const rising = await until(async () => ((await state(pageA)).frames[pair.b.peer] || 0) > before, 25000);
    check(rising, 'A is decoding video over the rebuilt connection (' + before + ' -> ' +
      ((await state(pageA)).frames[pair.b.peer] || 0) + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // A signal 404 that is about the *target*, not about us (Codex S2-3).
  // A's stream is cut, B leaves, and A — which cannot have heard `gone`
  // — sends B an offer. The hub answers 404 because B is not there any
  // more. That says nothing about A's own participation, and A must
  // stay in the call: the old client closed everything, opened a fresh
  // stream, met a 409 from its own still-live participation and put up
  // the takeover screen for a tab that does not exist.
  async staletarget() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const cut = await cuttableStream(ctxA);
    // A's own 404s are counted, to prove the scenario actually produced
    // the answer it is about rather than passing on a quiet call — and
    // so is everything A posts once the roster is known to be stale,
    // because "A is still here" was true of the twelve-round reset cycle
    // Codex S2-11 found as well.
    let notFound = 0;
    let posts = 0;
    let counting = false;
    await ctxA.route('**/signal', async (route) => {
      if (counting) posts += 1;
      const res = await route.fetch();
      if (res.status() === 404) notFound += 1;
      await route.fulfill({ response: res });
    });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    cut.on = true;
    check(await biteCut(cut), "A's attaching stream is cut (" + cut.aborted + ' aborted)');

    await leaveRoom(pageB);
    counting = true;
    // The recovery's own probe is refused 503 to begin with. That says
    // nothing about anyone's participation, and acting on it recreated
    // the very failure this scenario is about (Codex S2-12).
    cut.probeFail = true;

    // The Retry control on A's tile for B is restartIce, which fires
    // negotiationneeded and puts an offer on the wire for a peer that
    // is no longer in the room. Dispatched rather than clicked: the
    // scenario is about the answer, not about the control.
    await pageA.locator('#tiles figure:not(.calls-tile-self) figcaption button').first().dispatchEvent('click');
    const answered = await until(() => (notFound > 0 ? notFound : false), 20000);
    check(answered, 'A was answered 404 for a peer that had left (' + notFound + ')');
    const refusedProbe = await until(() => (cut.probesFailed > 0 ? cut.probesFailed : false), 20000);
    check(refusedProbe, 'a probe was answered 503 while A was diagnosing (' + cut.probesFailed + ')');

    // Nothing about either answer is A's own ending, and A is still cut,
    // so the whole window is asserted rather than read once.
    const broke = await stayed(pageA, 8000, (s) => s.peer === pair.a.peer && !s.terminal);
    check(broke === null, 'A stayed in the call with its own peer id after the 404 and the 503 — ' +
      (broke ? JSON.stringify(broke) : 'held for eight seconds') + ' — ' + (await diagnose(pageA, 'member A')));
    const status = await statusText(pageA);
    check(!status.includes('another tab'), 'A was never shown the takeover screen (status: ' + status + ')');

    // Now the probe answers, A learns its own participation is fine, and
    // whatever it does about the departed peer it does once: the roster
    // is what settles a stale target, not a reset cycle with a fresh
    // budget each round.
    cut.probeFail = false;
    await sleep(5000);
    check(posts <= 3, 'A posted at most three times while its roster was stale (' + posts + ')');

    // What "reconciled" has to mean: not that A's own `pcs` no longer
    // has B — `staleTarget` closes that connection locally, while the
    // stream is still cut, so that was already true — but that A's
    // stream came back and the server told it who is here (Codex
    // S2-16). Both are counted from here.
    const attachesBefore = cut.attaches;
    const rostersBefore = (await state(pageA)).rosters;
    cut.on = false;

    // And the departure reaches A the way §4.5 says it does: from the
    // roster on its own resume, not from the 404.
    const reconciled = await until(async () => {
      const s = await state(pageA);
      return cut.attaches > attachesBefore && s.rosters > rostersBefore &&
        s.peer === pair.a.peer && !s.terminal && !s.peers.includes(pair.b.peer) ? s : false;
    }, 45000);
    check(reconciled, 'A resumed its stream, was sent a fresh roster, and has let the departed peer go — ' +
      'attaches ' + attachesBefore + '→' + cut.attaches + ', rosters ' + rostersBefore + '→' +
      ((await state(pageA)).rosters) + ' — ' + (await diagnose(pageA, 'member A')));
    // Counted across the whole recovery, not only the first five
    // seconds of it: a cycle that started late would still be a cycle.
    // The round-1 client posted four hundred and fifty times here.
    check(posts <= 6, 'the whole recovery cost a handful of requests, not a cycle (' + posts + ')');

    await leaveRoom(pageA);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.6's thirty seconds again, this time over the *diagnosis* rather
  // than the message (Codex S2-15). A signal 404 sends the client to
  // probe its own participation; that probe never settles. Two things
  // have to hold: the probe is aborted rather than awaited for ever, and
  // the clock it is aborted on is the one the message started — the 404
  // here is deliberately answered twenty seconds late, so a recovery
  // that took a fresh thirty seconds would land at fifty and fail the
  // measurement rather than merely being slower.
  async probehang() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    // §15.24: A reports who it hears once the pair is up; let that report
    // go before everything A posts is held, or it is counted below as a
    // second message the recovery sent.
    const settled = await until(async () => ((await state(pageA)).hearingList || []).includes(pair.b.peer), 10000);
    check(settled, 'A reports that it hears B before the cut');
    await sleep(500);

    let firstAt = 0;
    let signals = 0;
    const posted = [];
    let hungProbes = 0;
    // Everything A posts from here is answered 404, twenty seconds
    // after it was sent: "that peer is not here", arriving with a third
    // of the message's budget left.
    await ctxA.route('**/signal', async (route) => {
      if (!firstAt) firstAt = Date.now();
      signals += 1;
      const m = (route.request().postData() || '').match(/"type":"([a-z-]+)"/);
      posted.push(m ? m[1] : '?');
      await sleep(20000);
      await route.fulfill({ status: 404, contentType: 'application/json', body: '{"error":"not-found"}' });
    });
    // And the probe that follows never answers at all. Only the probe
    // forms: A's own stream stays up, so nothing else is being tested.
    await ctxA.route('**/stream*', async (route) => {
      if (!route.request().url().includes('probe=1')) {
        await route.continue();
        return;
      }
      hungProbes += 1;
      await new Promise(() => {});
    });

    await pageA.locator('#tiles figure:not(.calls-tile-self) figcaption button').first().dispatchEvent('click');

    const dropped = await until(async () => {
      const s = await state(pageA);
      return !s.peers.includes(pair.b.peer) ? s : false;
    }, 70000);
    check(dropped, 'A let the target go rather than waiting on a probe that never answers (' + signals +
      ' signals, ' + hungProbes + ' hung probes) — ' + (await diagnose(pageA, 'member A')));
    check(hungProbes > 0, 'the scenario actually hung the probe it meant to (' + hungProbes + ')');
    const took = Date.now() - firstAt;
    check(took >= 25000 && took <= 35000,
      'and it did so on the message’s own clock, not a fresh one (' + took + ' ms; a restarted clock lands near 50000)');

    // Dropping the target on time is not the claim. The claim is that
    // the recovery ended there — and a client that let the queue restart
    // would look identical at this instant while a reset ran on a fresh
    // thirty seconds behind it (Codex S2-17). So: the one message this
    // scenario sent is the only thing A ever posted, and it is still the
    // only thing ten seconds later.
    const atDrop = signals;
    check(atDrop === 1, 'the offer was the only thing A posted (' + atDrop + ': ' + posted.join(', ') + ')');
    check(dropped && dropped.stale && dropped.stale.includes(pair.b.peer),
      'and A holds the target marked stale, waiting for a roster rather than asking again (' +
      JSON.stringify(dropped && dropped.stale) + ')');
    await sleep(10000);
    check(signals === atDrop, 'nothing followed it, ten seconds on (' + atDrop + ' → ' + signals + ')');

    const after = await state(pageA);
    check(after.peer === pair.a.peer && !after.terminal,
      'A is still in the call with its own peer id — ' + (await diagnose(pageA, 'member A')));

    await ctxA.close();
    await ctxB.close();
  },

  // §4.6 and Codex S2-5: a `reset` refused with 429 used to be dropped
  // on the floor, and after an outbound deadline that reset is the only
  // thing left that can rebuild the pair — the queue has been thrown
  // away and the connection closed, the hub's generation has not moved,
  // and no `pair` is coming. So this scenario walks A into exactly that
  // corner: everything it posts is refused until the deadline fires,
  // and then the reset the deadline asks for is refused once more.
  async resetretry() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    let failing = false;
    let resets = 0;
    await ctxA.route('**/signal', async (route) => {
      const isReset = (route.request().postData() || '').includes('"type":"reset"');
      if (isReset) {
        resets += 1;
        // The deadline has done its work; the room is reachable again
        // and only the reset itself is in question.
        failing = false;
        if (resets === 1) {
          await route.fulfill({
            status: 429,
            headers: { 'retry-after': '1' },
            contentType: 'application/json',
            body: '{"error":"rate"}',
          });
          return;
        }
        await route.continue();
        return;
      }
      if (failing) {
        await route.fulfill({ status: 503, contentType: 'application/json', body: '{"error":"full"}' });
        return;
      }
      await route.continue();
    });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    check(resets === 0, 'nothing had reset this pair before this (' + resets + ')');

    failing = true;
    await pageA.locator('#tiles figure:not(.calls-tile-self) figcaption button').first().dispatchEvent('click');

    const asked = await until(() => (resets > 0 ? resets : false), 60000);
    check(asked, 'A hit its outbound deadline and asked for a reset (' + resets + ')');
    const askedTwice = await until(() => (resets > 1 ? resets : false), 30000);
    check(askedTwice, 'A asked again after the 429 rather than losing the reset (' + resets + ' asks)');

    const rebuilt = await until(async () => {
      const a = await state(pageA);
      const b = await state(pageB);
      return a.peer === pair.a.peer && !a.terminal &&
        a.signaling[pair.b.peer] === 'stable' && a.connection[pair.b.peer] === 'connected' &&
        b.signaling[pair.a.peer] === 'stable' && b.connection[pair.a.peer] === 'connected' ? { a, b } : false;
    }, 45000);
    check(rebuilt, 'the pair came back, on a reset that was refused the first time — ' +
      (await diagnose(pageA, 'member A')) + ' ' + (await diagnose(pageB, 'member B')));

    const before = (await state(pageA)).frames[pair.b.peer] || 0;
    const rising = await until(async () => ((await state(pageA)).frames[pair.b.peer] || 0) > before, 25000);
    check(rising, 'A is decoding video over the rebuilt connection (' + before + ' -> ' +
      ((await state(pageA)).frames[pair.b.peer] || 0) + ')');

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.6's thirty seconds, under continuous 429s (Codex S2-6). Every
  // retry used to skip the deadline check, so a rate-limited target was
  // retried for ever and the connection to it was never rebuilt. What
  // is asserted is the verdict — A closes the connection to B — not how
  // long it took to reach it.
  async senddeadline() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    // Only from here: the join and the whole negotiation above went
    // through untouched, so what is being timed is one message.
    let limited = 0;
    let firstAt = 0;
    await ctxA.route('**/signal', async (route) => {
      if (!firstAt) firstAt = Date.now();
      limited += 1;
      await route.fulfill({
        status: 429,
        headers: { 'retry-after': '1' },
        contentType: 'application/json',
        body: '{"error":"rate"}',
      });
    });
    await pageA.locator('#tiles figure:not(.calls-tile-self) figcaption button').first().dispatchEvent('click');

    const gaveUp = await until(async () => {
      const s = await state(pageA);
      return !s.peers.includes(pair.b.peer) ? s : false;
    }, 60000);
    check(gaveUp, 'A gave up on an endlessly rate-limited target (' + limited +
      ' refusals) — ' + (await diagnose(pageA, 'member A')));
    // §4.6's number, not merely "eventually": measured from the first
    // message this route saw, which is the one whose deadline is
    // running. Five seconds of tolerance for the polling and the
    // scheduler at either end (Codex S2-13).
    const took = Date.now() - firstAt;
    check(took >= 25000 && took <= 35000,
      'and it gave up on §4.6’s thirty seconds, not on its own clock (' + took + ' ms)');
    check(limited > 1, 'and it did retry rather than giving up on the first refusal (' + limited + ')');
    check(!(await state(pageA)).terminal, 'giving up on one target is not the end of the call');

    await ctxA.close();
    await ctxB.close();
  },

  // The other half of the same deadline: a request that never settles at
  // all. Without an abort on the fetch the pump simply waits for ever,
  // and the deadline check is never even reached (Codex S2-6).
  async sendhang() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }

    let hung = 0;
    let firstAt = 0;
    // The abort itself, watched from outside the page: a fetch the page
    // gives up on fails, and that is the only direct evidence that the
    // AbortController fired rather than the request having settled some
    // other way (Codex S2-13).
    let cancelled = 0;
    pageA.on('requestfailed', (req) => {
      if (req.url().includes('/signal')) cancelled += 1;
    });
    await ctxA.route('**/signal', async () => {
      if (!firstAt) firstAt = Date.now();
      hung += 1;
      // Never fulfilled, never continued, never aborted: the request
      // stays pending until the page itself gives up on it.
      await new Promise(() => {});
    });
    await pageA.locator('#tiles figure:not(.calls-tile-self) figcaption button').first().dispatchEvent('click');

    const gaveUp = await until(async () => {
      const s = await state(pageA);
      return !s.peers.includes(pair.b.peer) ? s : false;
    }, 60000);
    check(gaveUp, 'A gave up on a target whose requests never settle (' + hung +
      ' hung requests) — ' + (await diagnose(pageA, 'member A')));
    check(hung > 0, 'the scenario actually hung the request it meant to (' + hung + ')');
    check(cancelled > 0, 'and the page aborted it rather than waiting for it (' + cancelled + ' cancelled)');
    const took = Date.now() - firstAt;
    check(took >= 25000 && took <= 35000,
      'the abort came at §4.6’s thirty seconds (' + took + ' ms)');
    check(!(await state(pageA)).terminal, 'a hanging endpoint is not the end of the call either');

    await ctxA.close();
    await ctxB.close();
  },

  // The process goes away and comes back. Both browsers see the stream
  // die, find a boot they do not know, and rejoin (§4.5).
  async restart() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) {
      await ctxA.close();
      await ctxB.close();
      return;
    }
    const bootBefore = (await state(pageA)).boot;
    check(!!bootBefore, 'the browser knows which process it is talking to (boot ' + bootBefore + ')');

    // §13 asks that both contexts have closed their old connections
    // *before* rejoining, and that is a moment rather than a state: the
    // gap between closeAllPCs and the roster of the new participation is
    // one round trip wide. A poll from out here would step over it, so
    // each page watches itself, five milliseconds at a time, from before
    // the restart until after the new peer ids arrive.
    for (const page of [pageA, pageB]) {
      await page.evaluate(() => {
        window.__sawEmpty = false;
        window.__samples = 0;
        window.__watch = setInterval(() => {
          window.__samples += 1;
          if (window.meet.state().peers.length === 0) window.__sawEmpty = true;
        }, 5);
      });
    }

    const answer = await control('restart');
    check(answer === 'ok', 'the app restarted on the same port (' + answer + ')');

    const back = await until(async () => {
      const a = await state(pageA);
      const b = await state(pageB);
      return a.peer && b.peer && a.peer !== pair.a.peer && b.peer !== pair.b.peer ? { a, b } : false;
    }, 60000);
    check(back, 'both browsers took a new participation after the restart — ' +
      (await diagnose(pageA, 'member A')) + ' ' + (await diagnose(pageB, 'member B')));

    // §13: "a different-boot 404 after restart" (W-3). New peer ids are
    // not that: a hub whose boot came from something stable would issue
    // new ids too, and `recoverFromNotFound` would lose the one thing
    // that tells a restart from a lapsed resume window (§4.5).
    const bootAfter = back ? back.a.boot : (await state(pageA)).boot;
    check(!!bootAfter && bootAfter !== bootBefore,
      'the restarted process announced a different boot id (' + bootBefore + ' then ' + bootAfter + ')');

    for (const [page, label] of [[pageA, 'member A'], [pageB, 'member B']]) {
      const watched = await page.evaluate(() => {
        clearInterval(window.__watch);
        return { sawEmpty: window.__sawEmpty, samples: window.__samples };
      });
      check(watched.sawEmpty, label + ' held no peer connections at all between the old participation and the new one (' +
        watched.samples + ' samples)');
    }

    if (back) await assertPair(pageA, pageB, 'member A', 'member B', 40000);

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // §4.2: one peer per session per room, and nothing displaces a tab
  // automatically. The second tab is refused and offers the confirm
  // page; confirming it is what ends the first.
  async takeover() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const first = await openRoom(ctxA);
    check(await until(async () => (await state(first)).peer, 20000),
      'the first tab is in the room — ' + (await diagnose(first, 'member A')));

    const second = await openRoom(ctxA);
    check(await waitStatus(second, 'This meeting is open in another tab.', 20000),
      'the second tab is told the meeting is open elsewhere — status: ' + (await statusText(second)));
    const secondState = await state(second);
    check(secondState.peer === null,
      'the second tab took no participation (' + secondState.peer + ')');

    // Not a single read: "was not displaced" is a claim about a window
    // of time, and the displacement it is denying would arrive over a
    // stream a moment later if it were going to arrive at all.
    await sleep(1000);
    const displaced = await stayed(first, 3000, (s) => s.peer !== null && !s.terminal);
    check(displaced === null,
      'the first tab was not displaced by the second opening (' + JSON.stringify(displaced) + ')');

    // Located by the href, not by "the link in #status": a terminal
    // screen may carry more than one way out, and this scenario is about
    // the one that takes the call over.
    const takeover = second.locator('#status a[href$="/takeover"]');
    const takeoverHref = await takeover.getAttribute('href');
    check(takeoverHref === '/m/' + sqid + '/takeover',
      'the second tab offers the takeover page (' + takeoverHref + ')');

    await Promise.all([
      second.waitForURL('**/m/' + sqid + '/takeover', { timeout: 15000 }),
      takeover.click(),
    ]);
    await Promise.all([
      second.waitForURL(origin + '/m/' + sqid, { timeout: 15000 }),
      second.click('form[rst-form-actions] button[type="submit"]'),
    ]);
    check(second.url() === origin + '/m/' + sqid,
      'the confirmed takeover lands the second tab in the room (at ' + where(second) + ')');

    check(await waitStatus(first, 'This meeting is open in another tab.', 20000),
      'the first tab is told it lost the call — status: ' + (await statusText(first)));
    const lost = await state(first);
    check(lost.terminal === 'replaced' && lost.admitted === false,
      'the displaced tab is terminal on `replaced` and no longer admitted (' + JSON.stringify(lost) + ')');

    // Terminal means terminal: nothing reconnects on its own.
    const reconnected = await stayed(first, 5000, (s) => s.peers.length === 0 && s.terminal === 'replaced');
    check(reconnected === null,
      'the displaced tab did not reconnect (' + JSON.stringify(reconnected) + ')');

    await ctxA.close();
  },

  // A GET from somewhere else on the web ends nothing: the takeover is
  // a POST behind its own confirm page (§4.2), and a top-level
  // navigation does not even reach the stream (ruling 15).
  async crosssite() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const page = await openRoom(ctxA);
    check(await until(async () => (await state(page)).peer, 20000),
      'the call is up before the cross-site visit — ' + (await diagnose(page, 'member A')));
    const before = await state(page);

    await ctxA.route('http://elsewhere.test/**', (route) =>
      route.fulfill({
        status: 200,
        contentType: 'text/html',
        body: '<!doctype html><a id="go" href="' + origin + '/m/' + sqid + '/takeover">go</a>' +
          '<a id="stream" href="' + origin + '/m/' + sqid + '/stream">stream</a>',
      }));

    const other = await ctxA.newPage();
    await other.goto('http://elsewhere.test/', { waitUntil: 'domcontentloaded' });
    check(new URL(other.url()).origin !== origin, 'the other page really is another origin (' + other.url() + ')');

    await Promise.all([
      other.waitForURL('**/m/' + sqid + '/takeover', { timeout: 15000 }),
      other.click('#go'),
    ]);
    check(other.url() === origin + '/m/' + sqid + '/takeover',
      'the cross-site GET reached the takeover URL (at ' + where(other) + ')');

    // And the navigation to the stream itself, which must not take this
    // session's peer slot either.
    await other.goto('http://elsewhere.test/', { waitUntil: 'domcontentloaded' });
    await Promise.all([
      other.waitForURL('**/m/' + sqid + '/stream', { timeout: 15000 }),
      other.click('#stream'),
    ]);
    check(other.url() === origin + '/m/' + sqid + '/stream',
      'the cross-site GET reached the stream URL (at ' + where(other) + ')');
    // Ruling 15, seen from a browser: a top-level navigation asks for
    // HTML, so it is refused before anything is looked up and cannot
    // occupy this session's one peer slot for the resume window. The
    // exact bytes, because the whole point of that refusal is that it
    // is identical for every meeting and every person.
    const refusal = (await other.locator('body').innerText()).trim();
    check(refusal === '{"error":"accept"}',
      'the navigation was refused with exactly the accept error (' + refusal + ')');

    const disturbed = await stayed(page, 3000,
      (s) => s.peer === before.peer && !s.terminal);
    check(disturbed === null,
      'the call kept its participation through the cross-site GETs (' + JSON.stringify(disturbed) + ')');
    check(!(await statusText(page)).includes('This meeting is open in another tab.'),
      'the call was not displaced by a GET — status: ' + (await statusText(page)));

    await leaveRoom(page);
    await ctxA.close();
  },

  // A refusal the probe cannot name: the room is full, which the
  // peerless probe answers 204 to because this session holds no peer
  // here. Without a ceiling the client would retry that for ever behind
  // "Connecting to the call."; with one it stops and says something
  // true, with both ways out.
  async stall() {
    const ctx = await newContext('member A', { cookie: cookieA });
    await ctx.route('**/stream*', async (route) => {
      if (route.request().url().includes('probe=1')) {
        await route.continue();
        return;
      }
      await route.fulfill({ status: 503, contentType: 'application/json', body: '{"error":"full"}' });
    });
    const page = await openRoom(ctx);

    // Deliberately generous: the ceiling is a count of rounds and a
    // stretch of time, and the backoff between rounds is the client's
    // own. What is asserted is where it ends up, never how long it took.
    const ended = await until(async () => ((await state(page)).terminal === 'unreachable' ? true : false), 130000);
    check(ended, 'a refusal the probe cannot name stops rather than retrying for ever — ' +
      (await diagnose(page, 'member A')));
    check(await waitStatus(page, 'Calls cannot reach the call.', 10000),
      'the stalled room says something true — status: ' + (await statusText(page)));
    const hrefs = await page.locator('#status a').evaluateAll((as) => as.map((a) => a.getAttribute('href')));
    check(hrefs.includes('/m/' + sqid) && hrefs.includes('/m/' + sqid + '/join'),
      'the stalled room offers both ways out (' + JSON.stringify(hrefs) + ')');

    await ctx.close();
  },

  // An expired session answers the signal endpoint 403. That is not
  // transient and never becomes true by waiting, so the room says so and
  // offers the one thing that fixes it.
  async signedout() {
    const ctx = await newContext('member A', { cookie: cookieA });
    await ctx.route('**/signal', (route) =>
      route.fulfill({ status: 403, contentType: 'text/plain', body: 'forbidden' }));
    const page = await openRoom(ctx);

    const out = await until(async () => ((await state(page)).terminal === 'signedout' ? true : false), 30000);
    check(out, 'a 403 from the signal endpoint ends the call as signed out — ' + (await diagnose(page, 'member A')));
    check(await waitStatus(page, 'You have been signed out.', 10000),
      'the signed-out room says so — status: ' + (await statusText(page)));
    const href = await page.locator('#status a').first().getAttribute('href');
    // Back in, and back to this meeting's holding screen (spec §9.4).
    check(href === '/signin?return_to=' + encodeURIComponent('/m/' + sqid + '/join'), 'the signed-out room offers the way back in, to this meeting (' + href + ')');

    await ctx.close();

    // The other half of the same rule, and the one the client explicitly
    // implements the compatibility for: a session that has expired can
    // answer a POST with a redirect to sign-in instead of a 403. fetch
    // follows it, so what comes back is a 200 carrying the sign-in page
    // — which read as a status alone is success, and was being taken as
    // success (Codex S2-8). Member B, because A's participation from the
    // phase above is still inside its resume window.
    const ctxB = await newContext('member B', { cookie: cookieB });
    await ctxB.route('**/signal', (route) =>
      route.fulfill({ status: 303, headers: { location: origin + '/signin' } }));
    const pageB = await openRoom(ctxB);

    const redirected = await until(async () => ((await state(pageB)).terminal === 'signedout' ? true : false), 30000);
    check(redirected, 'a POST redirected to sign-in ends the call as signed out, not as a success — ' +
      (await diagnose(pageB, 'member B')));
    check(await waitStatus(pageB, 'You have been signed out.', 10000),
      'the redirected room says the same thing — status: ' + (await statusText(pageB)));

    await ctxB.close();
  },

  // A browser with no WebRTC at all. The room needs another peer before
  // it tries to build a connection, so B is in the call first.
  async nowebrtc() {
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageB = await openRoom(ctxB);
    check(await until(async () => (await state(pageB)).admitted, 20000),
      'the other member is in the room — ' + (await diagnose(pageB, 'member B')));

    const ctxA = await newContext('member A', { cookie: cookieA });
    await ctxA.addInitScript(() => {
      delete window.RTCPeerConnection;
    });
    const pageA = await openRoom(ctxA);

    const ended = await until(async () => ((await state(pageA)).terminal === 'nowebrtc' ? true : false), 30000);
    check(ended, 'a browser that cannot make calls is told so rather than sitting on an empty grid — ' +
      (await diagnose(pageA, 'member A')));
    check(await waitStatus(pageA, 'This browser cannot make calls.', 10000),
      'the sentence says what is wrong — status: ' + (await statusText(pageA)));
    const href = await pageA.locator('#status a').first().getAttribute('href');
    check(href === '/m/' + sqid + '/join', 'even this is not a dead end (' + href + ')');

    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // An autoplay policy that refuses a remote video: the tile offers the
  // gesture rather than leaving a still frame nobody can explain. The
  // refusal is applied to unmuted elements only, which is every remote
  // tile and no local one, and it lasts one call so the control can be
  // seen to work.
  async playfallback() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    await ctxA.addInitScript(refuseFirstPlay);
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);

    const a = await waitConnected(pageA);
    check(a, 'A is in the call with a peer — ' + (await diagnose(pageA, 'member A')));
    const b = await waitConnected(pageB);
    check(b, 'B is in the call with a peer — ' + (await diagnose(pageB, 'member B')));

    // The two buttons in a remote tile's caption are Retry and Play, in
    // that order.
    const play = pageA.locator('#tiles figure:not(.calls-tile-self) figcaption button').nth(1);
    const offered = await until(async () => await play.isVisible(), 25000);
    check(offered, 'the refused remote video offers a Play control — ' + (await diagnose(pageA, 'member A')));
    if (offered) {
      // What the control has to actually do. The click handler hides the
      // button before it attempts playback, so "the button went" was
      // satisfied by a handler that never called play() at all (Codex
      // S2-9): the assertion is frames arriving and the element's own
      // clock moving, both of which stop while it is paused.
      const before = (await state(pageA)).frames[b.peer] || 0;
      const still = await remoteTile(pageA);
      check(still && still.paused, 'the refused video is paused before the gesture (' + JSON.stringify(still) + ')');

      await play.click();
      const taken = await until(async () => !(await play.isVisible()), 20000);
      check(taken, 'the gesture starts the video and the control goes — ' + (await diagnose(pageA, 'member A')));

      const advancing = await until(async () => {
        const s = await state(pageA);
        const t = await remoteTile(pageA);
        return (s.frames[b.peer] || 0) > before && t && !t.paused && t.time > (still ? still.time : 0)
          ? { frames: s.frames[b.peer], tile: t }
          : false;
      }, 25000);
      check(advancing, 'the gesture starts the frames as well as hiding the control (from ' + before +
        ' frames; ' + JSON.stringify(advancing || (await remoteTile(pageA))) + ') — ' +
        (await diagnose(pageA, 'member A')));
    }

    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Spec §15.20, the autoplay half, in a Chromium launched under its
  // real desktop policy rather than the gate's permissive one, and never
  // given a gesture. First what the incident of 2026-09-25 settled:
  // Chromium plays a MediaStream without a gesture whatever its policy,
  // so the call just plays and no banner appears — if that ever changes,
  // this is where it shows. Then a refusal, forced the way playfallback
  // forces one: the banner, the report reaching the other side as a
  // notice on this tab's tile, and a click anywhere putting it all back.
  async autoplay() {
    const strict = await chromium.launch({
      args: LAUNCH_ARGS.filter((a) => !a.startsWith('--autoplay-policy=')).concat(
        '--autoplay-policy=document-user-activation-required'),
    });
    try {
      const ctxA = await newContext('member A', { cookie: cookieA, via: strict });
      const ctxB = await newContext('member B', { cookie: cookieB, via: strict });
      // No evaluate may touch A's page until its remote tile has played:
      // Playwright runs page.evaluate as a user gesture, so the gate's
      // own polling would be the activation this is proving is not
      // needed. So A's page reports for itself, through the console, the
      // moment an unmuted element starts playing and whether it had been
      // activated by then — and A is opened with a bare goto, not
      // openRoom, whose waitForFunction is an evaluate too.
      await ctxA.addInitScript(() => {
        document.addEventListener('playing', (e) => {
          const el = e.target;
          if (!el || el.muted || el.dataset.reported) return;
          el.dataset.reported = '1';
          const active = navigator.userActivation ? navigator.userActivation.hasBeenActive : 'unknown';
          console.log('calls-autoplay: playing active=' + active);
        }, true);
      });
      let pageA = await ctxA.newPage();
      const firstPlay = new Promise((resolve) => {
        pageA.on('console', (m) => {
          if (m.text().startsWith('calls-autoplay:')) resolve(m.text());
        });
      });
      await pageA.goto(origin + '/m/' + sqid, { waitUntil: 'domcontentloaded' });
      const pageB = await openRoom(ctxB);
      const played = await Promise.race([firstPlay, sleep(30000).then(() => null)]);
      check(played, 'with no gesture, A’s remote tile starts playing under the real policy (' + played + ')');
      check(played === 'calls-autoplay: playing active=false',
        'and A’s page had really had no gesture when it did (' + played + ')');
      const pair = await assertPair(pageA, pageB, 'member A', 'member B');
      if (!pair) return;
      const nameA = await selfName(pageA);

      const plays = await until(async () => {
        const t = await remoteTile(pageA);
        return t && t.hasStream && !t.paused && t.time > 0.5 ? t : false;
      }, 15000);
      check(plays, 'and it goes on playing (' + JSON.stringify(plays || (await remoteTile(pageA))) + ')');
      const calm = await stayed(pageA, 3000, (s) => !s.soundBanner && !s.audioBlocked);
      check(!calm, 'no banner and nothing blocked (' + JSON.stringify(calm && { banner: calm.soundBanner, blocked: calm.audioBlocked }) + ')');
      check(!(await pageA.locator('#sound-banner').isVisible()), 'the banner is not on the page');

      // Now a browser that refuses. A comes back in a fresh page whose
      // first unmuted play() is refused.
      await leaveRoom(pageA);
      await pageA.close();
      await ctxA.addInitScript(refuseFirstPlay);
      pageA = await openRoom(ctxA);
      const again = await waitConnected(pageA);
      check(again, 'A is back in the call — ' + (await diagnose(pageA, 'member A')));
      if (!again) return;
      const a = again.peer;
      const b = pair.b.peer;

      const banner = await until(async () => {
        const s = await state(pageA);
        return s.soundBanner && s.audioBlocked ? s : false;
      }, 20000);
      check(banner, 'the refusal puts the banner up and marks A blocked — ' + (await diagnose(pageA, 'member A')));
      const bannerText = ((await pageA.locator('#sound-banner').textContent()) || '').trim();
      check(await pageA.locator('#sound-banner').isVisible() && bannerText.startsWith('Click anywhere to turn on sound'),
        'the banner says what to do, in words (' + bannerText + ')');
      check(await pageA.locator('#sound-banner button').isVisible(), 'with a button a keyboard can reach');
      check(await pageA.evaluate(() => !!document.querySelector('.calls-window #notices > #sound-banner')),
        'in the call window\'s notices, which stay whatever the controls do');
      const winOut = process.env.CALLS_WINDOW_SNAPSHOTS;
      if (winOut) {
        mkdirSync(winOut, { recursive: true });
        await pageA.screenshot({ path: winOut + '/web-autoplay-banner.png' });
      }
      const refusedTile = await until(async () => {
        const s = await state(pageA);
        return s.hearing[b] && s.hearing[b].shown === 'blocked' ? s.hearing[b] : false;
      }, 10000);
      check(refusedTile && refusedTile.text === 'Sound blocked — click to hear',
        'B’s tile on A says the sound is blocked (' + JSON.stringify(refusedTile) + ')');
      const still = await remoteTile(pageA);
      check(still && still.paused, 'and the refused video is paused (' + JSON.stringify(still) + ')');

      const notice = await until(async () => {
        const s = await state(pageB);
        const h = s.hearing[a];
        return h && /blocking sound/.test(h.notice) && s.remoteMedia[a] && s.remoteMedia[a].audioBlocked ? h : false;
      }, 15000);
      check(notice, 'B hears about it: A’s tile on B carries the notice (' +
        JSON.stringify(notice || ((await state(pageB)).hearing || {})[a]) + ')');
      check(notice && notice.notice === nameA + '’s browser is blocking sound — they need to click to hear you.',
        'naming A (' + (notice && notice.notice) + ')');
      // §15.24: A is new to B and cannot hear B yet, but its own report
      // is more specific than "connecting", and replaces it.
      const first = (await state(pageB)).connecting[a];
      check(notice && notice.noticeKind === 'report' && first && first.joining,
        'in place of "' + nameA + ' is connecting and can’t hear you yet" (' + JSON.stringify({ notice, first }) + ')');

      // A click on nothing in particular: the page's own heading.
      const heading = await pageA.locator('h1').first().boundingBox();
      await pageA.mouse.click(heading.x + 4, heading.y + heading.height / 2);
      const resumed = await until(async () => {
        const s = await state(pageA);
        const t = await remoteTile(pageA);
        return !s.soundBanner && !s.audioBlocked && t && !t.paused ? { t, banner: s.soundBanner } : false;
      }, 15000);
      check(resumed, 'a click anywhere plays the tile and takes the banner down — ' + (await diagnose(pageA, 'member A')));
      if (resumed) {
        const moving = await until(async () => {
          const t = await remoteTile(pageA);
          return t && !t.paused && t.time > resumed.t.time ? t : false;
        }, 10000);
        check(moving, 'and the video is really playing (' + JSON.stringify(moving || (await remoteTile(pageA))) + ')');
      }
      const cleared = await until(async () => {
        const s = await state(pageB);
        return s.hearing[a] && s.hearing[a].notice === '' && !(s.remoteMedia[a] || {}).audioBlocked ? s.hearing[a] : false;
      }, 15000);
      check(cleared, 'and B’s notice clears (' + JSON.stringify(cleared || ((await state(pageB)).hearing || {})[a]) + ')');

      check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
      check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');
      await leaveRoom(pageA);
      await leaveRoom(pageB);
      await ctxA.close();
      await ctxB.close();
    } finally {
      await strict.close();
    }
  },

  // Spec §15.24 (2026-10-01): "<name> is connecting and can't hear you
  // yet". A fast join says nothing; a join whose connection is held back
  // says it on the joiner's tile, with dots a screen reader never hears,
  // and clears with "… can hear you now" the moment the joiner's own
  // report lists us in `hearing`; and a joiner that does not send
  // `hearing` (a client from before it, played by stripping the key off
  // its reports) is let go on its first report once the connection is up.
  // CALLS_CONNECTING_SNAPSHOTS=<dir> keeps pictures of the notice.
  async connecting() {
    const out = process.env.CALLS_CONNECTING_SNAPSHOTS;
    if (out) mkdirSync(out, { recursive: true });
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const admitted = await until(async () => ((await state(pageA)).admitted ? true : false), 20000);
    check(admitted, 'A is in the call on its own — ' + (await diagnose(pageA, 'member A')));
    const a = (await state(pageA)).peer;
    // A watches itself, ten times a second, from inside the page: whether
    // the words ever showed for anyone, when each person appeared, and
    // when their first moments ended; and everything its live region said.
    const watchA = () => pageA.evaluate(() => {
      window.__joins = {};
      window.__said = [];
      const live = document.getElementById('media-live');
      if (live) new MutationObserver(() => window.__said.push(live.textContent)).observe(live, { childList: true, characterData: true, subtree: true });
      setInterval(() => {
        const s = window.meet.state();
        for (const [id, c] of Object.entries(s.connecting || {})) {
          const j = window.__joins[id] || (window.__joins[id] = { from: Date.now(), done: 0, shown: false });
          if (c.shown) j.shown = true;
          if (!c.joining && !j.done) j.done = Date.now();
        }
      }, 100);
    });
    await watchA();
    const joins = () => pageA.evaluate(() => window.__joins);
    const said = () => pageA.evaluate(() => window.__said);

    // 1. A fast join says nothing.
    let pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) return;
    let b = pair.b.peer;
    const nameB = await selfName(pageB);
    const heardA = await until(async () => ((await state(pageB)).hearingList || []).includes(a), 15000);
    check(heardA, 'B reports that it hears A (' + JSON.stringify((await state(pageB)).hearingList) + ')');
    const fast = await until(async () => {
      const j = (await joins())[b];
      return j && j.done ? j : false;
    }, 15000);
    check(fast && !fast.shown, 'a fast join never says "can’t hear you yet" (' + JSON.stringify(fast) + ', ' +
      (fast ? fast.done - fast.from : '?') + ' ms from appearing to being heard)');
    check(!(await said()).some((t) => /hear you/.test(t)), 'and nothing about it is announced (' + JSON.stringify(await said()) + ')');
    await leaveRoom(pageB);
    await pageB.close();

    // 2. B again, with everything that would connect it held back for a
    // few seconds: its offers, answers and candidates.
    const HOLD = 6000;
    let releaseAt = 0;
    const holdSignals = async (route) => {
      const body = route.request().postData() || '';
      if (/"type":"(offer|answer|candidate)"/.test(body)) {
        if (!releaseAt) releaseAt = Date.now() + HOLD;
        await sleep(Math.max(0, releaseAt - Date.now()));
      }
      await route.continue();
    };
    await ctxB.route('**/signal', holdSignals);
    await pageA.evaluate(() => { window.__said = []; });
    pageB = await openRoom(ctxB);
    const joined = await until(async () => {
      const s = await state(pageB);
      return s.admitted && s.peer ? s.peer : false;
    }, 20000);
    check(joined, 'B is back, connection held — ' + (await diagnose(pageB, 'member B')));
    b = joined;
    const words = nameB + ' is connecting and can’t hear you yet';
    const showing = await until(async () => {
      const s = await state(pageA);
      const h = s.hearing[b];
      return h && h.noticeKind === 'connecting' ? h : false;
    }, 10000);
    check(showing && showing.notice === words, 'A says it on B’s tile (' + JSON.stringify(showing) + ')');
    const drawn = await pageA.evaluate((id) => {
      const n = document.querySelector('figure[data-tile="' + id + '"] .calls-tile-notice');
      const dots = n && n.querySelector('.calls-ellipsis');
      return n && { visible: !n.hidden && n.offsetWidth > 0, dots: !!dots, hidden: dots && dots.getAttribute('aria-hidden') };
    }, b);
    check(drawn && drawn.visible && drawn.dots && drawn.hidden === 'true',
      'on screen, with the dots hidden from screen readers (' + JSON.stringify(drawn) + ')');
    check((await said()).includes(words), 'and it is announced once, without the dots (' + JSON.stringify(await said()) + ')');
    if (out) await pageA.screenshot({ path: out + '/web-connecting.png' });
    await pageA.emulateMedia({ reducedMotion: 'reduce' });
    const still = await pageA.evaluate((id) => {
      const dot = document.querySelector('figure[data-tile="' + id + '"] .calls-ellipsis > span');
      return dot ? getComputedStyle(dot).animationName : null;
    }, b);
    check(still === 'none', 'under reduced motion the dots keep still (' + still + ')');
    if (out) await pageA.screenshot({ path: out + '/web-connecting-reduced-motion.png' });
    await pageA.emulateMedia({ reducedMotion: 'no-preference' });

    const clear = await until(async () => {
      const s = await state(pageA);
      const h = s.hearing[b];
      return h && h.notice === '' && s.connecting[b] && !s.connecting[b].joining ? s : false;
    }, 30000);
    check(clear, 'once B hears A, the words go — ' + (await diagnose(pageA, 'member A')));
    check(clear && ((clear.remoteMedia[b] || {}).hearing || []).includes(a), 'because B’s own report says so (' +
      JSON.stringify(clear && clear.remoteMedia[b]) + ')');
    check(releaseAt > 0 && Date.now() >= releaseAt, 'and not before the hold let go');
    check((await said()).includes(nameB + ' can hear you now'), 'and A hears that B can hear it now (' + JSON.stringify(await said()) + ')');
    await ctxB.unroute('**/signal', holdSignals);
    await leaveRoom(pageB);
    await pageB.close();

    // 3. B as a client that does not say who it hears: the key stripped
    // off every report, and the connection held back as before.
    releaseAt = 0;
    const oldClient = async (route) => {
      let body = route.request().postData() || '';
      if (body.includes('"type":"media"')) {
        const sig = JSON.parse(body);
        delete sig.payload.hearing;
        body = JSON.stringify(sig);
        return route.continue({ postData: body });
      }
      return holdSignals(route);
    };
    await ctxB.route('**/signal', oldClient);
    pageB = await openRoom(ctxB);
    const back = await until(async () => {
      const s = await state(pageB);
      return s.admitted && s.peer ? s.peer : false;
    }, 20000);
    check(back, 'B is back as an old client — ' + (await diagnose(pageB, 'member B')));
    b = back;
    const oldShowing = await until(async () => {
      const h = (await state(pageA)).hearing[b];
      return h && h.noticeKind === 'connecting' ? h : false;
    }, 10000);
    check(oldShowing, 'the words show for an old client too (' + JSON.stringify(oldShowing) + ')');
    const oldClear = await until(async () => {
      const s = await state(pageA);
      return s.connecting[b] && !s.connecting[b].joining && s.hearing[b] && s.hearing[b].notice === '' ? s : false;
    }, 30000);
    check(oldClear && oldClear.remoteMedia[b] && !('hearing' in oldClear.remoteMedia[b]) &&
      oldClear.connection[b] === 'connected',
      'and go once its connection is up, without any `hearing` from it (' + JSON.stringify(oldClear && oldClear.remoteMedia[b]) + ')');
    check(Date.now() - (releaseAt || Date.now()) < 20000, 'well before the twenty-second cap');
    await ctxB.unroute('**/signal', oldClient);

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    // A signal held back for seconds can land after the pair has moved to
    // a new generation, and the hub refuses it 409 (§15.9) — which is the
    // hold's doing, and what the client recovers from. Nothing else.
    const errorsB = (consoleErrors.get('member B') || []).filter((e) => !/status of 409/.test(e)).join('; ');
    check(errorsB === '', 'no console errors in B but the held signals’ 409s (' + errorsB + ')');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // Speaker view and the viewer's order (0.4.0), in a call of four: two
  // members and two guests. Everyone's microphone is silenced but one,
  // which speaks a tone; the stage goes to that person only once they
  // have held the floor for the dominance delay, and stays put through a
  // short interjection. A pin holds the stage against the speaker; the
  // tile buttons and a mouse drag change the tiles' order in the DOM,
  // and the order survives a reload of the tab (sessionStorage).
  // CALLS_SPEAKER_SNAPSHOTS=<dir> keeps pictures of each state.
  async speaker() {
    const out = process.env.CALLS_SPEAKER_SNAPSHOTS;
    if (out) mkdirSync(out, { recursive: true });
    const shot = async (page, name) => { if (out) await page.screenshot({ path: out + '/web-' + name + '.png' }); };
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const ctxG = await newContext('guest');
    const ctxW = await newContext('waiter');
    const pageA = await openRoom(ctxA);
    await pageA.setViewportSize({ width: 1280, height: 900 });
    await pageA.evaluate(() => { localStorage.removeItem('calls.videoLayout'); });
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) return;
    for (const [ctx, address, name] of [[ctxG, GUEST, 'guest'], [ctxW, WAITER, 'waiter']]) {
      await signInAsGuest(ctx, address);
      await openRoom(ctx);
      check(await until(async () => (await pageA.locator('#knocks li').count()) >= 1 && await admitKnock(pageA, name), 20000),
        'A lets ' + name + ' in (' + JSON.stringify(await queueNames(pageA)) + ')');
    }
    const pageG = ctxG.pages().find((p) => p.url().endsWith('/m/' + sqid));
    const pageW = ctxW.pages().find((p) => p.url().endsWith('/m/' + sqid));
    const four = await until(async () => {
      const s = await state(pageA);
      return s.peers.length === 3 && Object.values(s.frames).filter((n) => n > 0).length >= 3 ? s : false;
    }, 40000);
    check(four, 'A is in a call of four, with video from all three (' + JSON.stringify(await state(pageA).catch(() => null)) + ')');
    if (!four) return;
    const b = pair.b.peer;
    const g = (await state(pageG)).peer;
    const w = (await state(pageW)).peer;
    check(await pageA.locator('#layout-speaker').getAttribute('aria-pressed') === 'true', 'Speaker is the layout by default');

    // Silence: every microphone's track disabled under the call, so the
    // packets carry nothing and nobody is speaking.
    const hush = (page) => page.evaluate(() => {
      for (const pc of window.__pcs || []) {
        for (const sn of pc.getSenders()) if (sn.track && sn.track.kind === 'audio') sn.track.enabled = false;
      }
    });
    for (const page of [pageA, pageB, pageG, pageW]) await hush(page);
    await sleep(2500);
    const layoutOf = (page) => page.evaluate(() => ({
      ...window.callsLayout.state(),
      stage: (document.querySelector('#tiles > [data-stage]') || {}).dataset?.tile || '',
      pinned: (document.querySelector('#tiles > [data-pinned]') || {}).dataset?.tile || '',
      tiles: Array.from(document.querySelectorAll('#tiles > figure')).map((f) => f.dataset.tile),
      strip: Array.from(document.querySelectorAll('#tiles > figure:not([data-stage])')).map((f) => f.dataset.tile),
    }));
    const quiet = await layoutOf(pageA);
    check(quiet.strip.length === 3 && quiet.strip.includes('self'),
      'the filmstrip holds the three not on the stage, A included (' + JSON.stringify(quiet) + ')');

    // Before anyone speaks the stage is the first other person in A's
    // order. G, who is not, speaks: the stage goes to G, and not before
    // G has held the floor for the dominance delay.
    check(quiet.stage !== g, 'G is not on the stage before speaking (' + quiet.stage + ')');
    await speakInto(pageG);
    const started = Date.now();
    const toG = await until(async () => ((await layoutOf(pageA)).stage === g ? Date.now() : false), 15000);
    check(toG, 'the stage goes to G while G speaks (' + JSON.stringify(await layoutOf(pageA)) + ')');
    check(toG && toG - started >= 1200, 'and only after G has held the floor for the delay (' + (toG - started) + ' ms)');
    await shot(pageA, 'speaker-filmstrip');

    // B interjects for about half a second while G carries on: the stage
    // stays with G throughout.
    await speakInto(pageB);
    await sleep(500);
    await stopSpeaking(pageB);
    await hush(pageB);
    const flapped = await stayed(pageA, 4000, (s) => s.speaker === g);
    check(!flapped, 'an interjection does not take the stage (' + JSON.stringify(flapped && flapped.speaker) + ')');
    // G stops; W speaks on. W takes it, and over the next seconds the
    // stage changes exactly once.
    await stopSpeaking(pageG);
    await hush(pageG);
    await speakInto(pageW);
    const seen = [];
    const deadline = Date.now() + 9000;
    while (Date.now() < deadline) {
      const s = await layoutOf(pageA);
      if (seen[seen.length - 1] !== s.stage) seen.push(s.stage);
      await sleep(150);
    }
    check(seen.join(',') === [g, w].join(','), 'the stage moves once, from G to W, and does not flap (' + seen.join(' -> ') + ')');

    // A pin holds the stage against the speaker: B's tile, clicked in the
    // filmstrip.
    await pageA.locator('#tiles > figure[data-tile="' + b + '"]').click({ position: { x: 20, y: 40 } });
    const pinned = await until(async () => {
      const l = await layoutOf(pageA);
      return l.stage === b && l.pinned === b ? l : false;
    }, 3000);
    check(pinned, 'clicking B in the filmstrip pins B to the stage (' + JSON.stringify(await layoutOf(pageA)) + ')');
    check(/Pinned .* to the stage/.test(await pageA.locator('#layout-live').textContent()), 'and says so, politely');
    check(await pageA.locator('#tiles > figure[data-tile="' + b + '"] .calls-tool-pin').isVisible(),
      'a pinned stage shows its pin');
    await sleep(2500);
    check((await layoutOf(pageA)).stage === b, 'W speaking does not take a pinned stage');
    await shot(pageA, 'speaker-pinned');
    await pageA.locator('#tiles > figure[data-tile="' + b + '"] .calls-tool-pin').click();
    check(await until(async () => (await layoutOf(pageA)).stage === w, 3000), 'unpinning gives the stage back to the speaker');
    await stopSpeaking(pageW);

    // The viewer's order: "Move to first" on the last person changes the
    // DOM order, and the keyboard stays on a move button.
    await chooseLayout(pageA, 'grid');
    const before = (await layoutOf(pageA)).tiles;
    const last = before[before.length - 1];
    await openTileMenu(pageA, last);
    const first = pageA.locator('#tile-menu [data-move="first"]');
    await first.focus();
    await pageA.keyboard.press('Enter');
    const moved = await until(async () => {
      const l = await layoutOf(pageA);
      return l.tiles[0] === last ? l : false;
    }, 3000);
    check(moved, 'Move to first puts ' + last + ' first in the DOM (' + JSON.stringify(await layoutOf(pageA)) + ')');
    check(/moved to position 1 of 4/.test(await pageA.locator('#layout-live').textContent()), 'and says where it went');
    check(await pageA.evaluate(() => !!document.activeElement.closest('#tile-menu')), 'the keyboard stays in the tile\'s menu');
    // Move later, by keyboard: one place on.
    const later = pageA.locator('#tile-menu [data-move="later"]');
    await later.focus();
    await pageA.keyboard.press('Enter');
    check(await until(async () => (await layoutOf(pageA)).tiles[1] === last, 3000), 'Move later moves it one place');
    await pageA.keyboard.press('Escape');
    check(await pageA.locator('#tile-menu').isHidden() &&
      await pageA.evaluate(() => document.activeElement && document.activeElement.classList.contains('calls-tool-more')),
      'Escape closes the menu and puts the keyboard back on its ⋯');

    // A mouse drag: the first tile dropped on the third's place.
    const order1 = (await layoutOf(pageA)).tiles;
    const from = await pageA.locator('#tiles > figure[data-tile="' + order1[0] + '"]').boundingBox();
    const to = await pageA.locator('#tiles > figure[data-tile="' + order1[2] + '"]').boundingBox();
    await pageA.mouse.move(from.x + from.width / 2, from.y + from.height / 2);
    await pageA.mouse.down();
    for (let i = 1; i <= 10; i++) {
      await pageA.mouse.move(from.x + from.width / 2 + (to.x - from.x) * i / 10, from.y + from.height / 2 + (to.y - from.y) * i / 10);
      await sleep(30);
    }
    check(await pageA.locator('.calls-tile-lifted').count() === 1, 'the dragged tile is lifted');
    await shot(pageA, 'grid-drag');
    await pageA.mouse.up();
    const dragged = await until(async () => {
      const l = await layoutOf(pageA);
      return l.tiles[2] === order1[0] ? l : false;
    }, 3000);
    check(dragged, 'dragging the first tile onto the third puts it third in the DOM (' +
      JSON.stringify({ before: order1, after: (await layoutOf(pageA)).tiles }) + ')');
    await shot(pageA, 'grid-reordered');
    const kept = (await layoutOf(pageA)).tiles;
    const stored = await pageA.evaluate((k) => sessionStorage.getItem(k), 'calls.order.' + sqid);
    check(stored && JSON.parse(stored).length === 4, 'the order is kept in sessionStorage for the meeting (' + stored + ')');

    // A reload of the tab puts the order back (the peer ids are new).
    await pageA.reload({ waitUntil: 'domcontentloaded' });
    await pageA.waitForFunction(() => !!window.meet, null, { timeout: 20000 });
    const back = await until(async () => {
      const l = await pageA.evaluate(() => Array.from(document.querySelectorAll('#tiles > figure')).map((f) =>
        f.classList.contains('calls-tile-self') ? 'self' : f.dataset.name));
      return l.length === 4 ? l : false;
    }, 40000);
    check(back, 'A is back in the call of four after a reload');
    // Compared with what was kept before the reload, not after it: a
    // leave that wiped the order and a rejoin that rebuilt it in roster
    // order would agree with themselves.
    const want = JSON.parse(stored || '[]');
    check(back && back.map((n) => n === 'self' ? 'self' : 'name:' + n).join(',') === want.join(','),
      'and the tiles come back in the kept order (' + JSON.stringify({ back, want, kept,
        now: await pageA.evaluate(() => window.callsLayout && window.callsLayout.state()) }) + ')');

    for (const label of ['member A', 'member B', 'guest', 'waiter']) {
      check(errorsFor(label) === '', 'no console errors in ' + label + ' (' + errorsFor(label) + ')');
    }
    for (const page of [pageA, pageB, pageG, pageW]) await leaveRoom(page);
    for (const ctx of [ctxA, ctxB, ctxG, ctxW]) await ctx.close();
  },

  // The floor: both pages load with JavaScript switched off, say so in
  // plain words, and show nothing that pretends to be a call.
  async layout() {
    const ctxA = await newContext('layout A', {cookie: cookieA});
    const ctxB = await newContext('layout B', {cookie: cookieB});
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'layout A', 'layout B');
    if (!pair) throw new Error('layout call did not connect');
    await openChat(pageA);
    await pageA.locator('#chat-text').fill('Draft kept while chat is closed');
    await pageA.locator('#toggle-chat').click();
    check(await until(() => pageA.locator('#chat').isHidden(), 2000), 'chat collapses');
    await openChat(pageB);
    await pageB.locator('#chat-text').fill('New message while hidden');
    await pageB.locator('#chat-send').click();
    check(await until(async () => (await pageA.locator('#chat-unread').innerText()).includes('1'), 5000),
      'hidden chat reports unread arrivals');
    // The badge above is aria-hidden and the toggle's aria-label does not
    // announce, and collapsing chat display:none's the aria-live log out
    // of the tree entirely — so without this region a screen reader is
    // told nothing at all. It has to be OUTSIDE #chat to survive the
    // collapse, which is what textContent being readable here proves:
    // Playwright reads the DOM, but the assertion below on the live
    // region's ancestry is what pins it out of the collapsed subtree.
    check(await until(async () => (await pageA.locator('#chat-unread-live')
      .textContent()) === '1 new chat message', 5000),
      'collapsed chat announces the unread count to a screen reader (got ' +
      JSON.stringify(await pageA.locator('#chat-unread-live').textContent()) + ')');
    check(await pageA.evaluate(() => {
      const live = document.getElementById('chat-unread-live');
      const chat = document.getElementById('chat');
      return !!live && !!chat && !chat.contains(live);
    }), 'the unread live region is outside the panel that gets collapsed');
    await pageA.locator('#toggle-chat').focus();
    await pageA.keyboard.press('Enter');
    await pageA.keyboard.press('Escape');
    check(await until(() => pageA.locator('#chat-overlay').isHidden(), 2000), 'Escape closes chat');
    check(await pageA.evaluate(() => document.activeElement && document.activeElement.id === 'toggle-chat'),
      'and the keyboard goes back to the Chat button');
    await pageA.keyboard.press('Enter');
    check(await pageA.locator('#chat-text').inputValue() === 'Draft kept while chat is closed',
      'keyboard reopening preserves the draft');
    check(await pageA.locator('#chat-log').innerText().then(x => x.includes('New message while hidden')),
      'reopening preserves messages');
    const out = process.env.CALLS_DESIGN_SCREENSHOTS;
    if (out) mkdirSync(out, {recursive: true});
    for (const width of [1200, 320]) {
      await pageA.setViewportSize({width, height: 900});
      for (const colorScheme of ['light', 'dark']) {
        await pageA.emulateMedia({colorScheme, reducedMotion: 'reduce'});
        for (const mode of ['speaker', 'grid']) {
          await chooseLayout(pageA, mode);
          check(await pageA.locator('#layout-' + mode).getAttribute('aria-pressed') === 'true', mode + ' selection is exposed');
          check(await pageA.evaluate(() => document.documentElement.scrollWidth <= innerWidth),
            `${width}px ${colorScheme} ${mode} has no horizontal page overflow`);
          check(await pageA.locator('#controls button:visible').evaluateAll(buttons => buttons.every(button => {
            const r = button.getBoundingClientRect(); return r.width >= 44 && r.height >= 44;
          })), 'call controls retain 44px targets');
          if (out) await pageA.screenshot({path: `${out}/room-${width}-${colorScheme}-${mode}.png`, fullPage: true});
        }
      }
    }
    await chooseLayout(pageA, 'speaker');
    await pageA.locator('[data-stage] .calls-tile-note').evaluate(note => { note.textContent = 'Connection recovery'; note.hidden = false; });
    check(await until(async () => !await pageA.locator('#tiles').evaluate(el => el.hasAttribute('data-pip')), 2000),
      'recovery captions disable the self overlay');
    await pageA.locator('[data-stage] .calls-tile-note').evaluate(note => { note.textContent = ''; note.hidden = true; });
    await pageB.locator('#share').click();
    await pageA.locator('.calls-tile-share').waitFor({state: 'visible'});
    check(await until(async () => !await pageA.locator('#tiles').evaluate(el => el.hasAttribute('data-pip')), 2000),
      'screen share never gets a self-preview overlay');
    // With the controls hidden. Since 2026-10-05 the stage fills the
    // window and the filmstrip floats over its foot, as FaceTime's does:
    // you are a filmstrip tile there, never a floating self view, and the
    // filmstrip is in the bottom of the window, over the screen's soft
    // surround or its lowest edge (the stage scenario holds the rest).
    await pageA.evaluate(() => window.callsChrome.pin(false));
    await sleep(400);
    const shareBounds = await pageA.locator('.calls-tile-share').boundingBox();
    const selfBounds = await pageA.locator('.calls-tile-self').boundingBox();
    check(!await pageA.locator('.calls-tile-self').evaluate((f) => f.classList.contains('calls-tile-pip')) &&
      selfBounds.y + selfBounds.height >= shareBounds.y + shareBounds.height - 24,
      'self preview is a filmstrip tile at the foot of the shared screen, not floating over its content');
    await pageA.evaluate(() => window.callsChrome.pin(null));
    if (out) await pageA.screenshot({path: out + '/share-320.png', fullPage: true});
    await pageB.locator('#share').click();
    await assertPair(pageA, pageB, 'layout A after changes', 'layout B after changes');
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    const holding = await ctxA.newPage();
    await holding.setViewportSize({width: 320, height: 900});
    await holding.goto(origin + '/m/' + sqid + '/join');
    await holding.locator('#join').waitFor({state: 'visible'});
    check(await holding.evaluate(() => document.documentElement.scrollWidth <= innerWidth), 'joining screen reflows at 320px');
    if (out) await holding.screenshot({path: out + '/join-320.png', fullPage: true});
    await ctxA.close(); await ctxB.close();
    const noMedia = await newContext('layout no media', {cookie: cookieA});
    await noMedia.addInitScript(() => Object.defineProperty(navigator, 'mediaDevices', {value: undefined}));
    const noPreview = await noMedia.newPage();
    await noPreview.goto(origin + '/m/' + sqid + '/join');
    await noPreview.locator('#devices').waitFor({state: 'visible'});
    check(await noPreview.locator('#preview').isHidden(), 'no-media preview stays hidden despite author styles');
    await noMedia.close();
  },

  // The control bar's glyphs and the filmstrip's labels (0.4.1). Paul
  // measured the Mac bar's glyphs and found the share symbol low; the
  // web bar is held to the same rule: every glyph's ink centred on the
  // bar's centre line, within half a pixel. And a filmstrip tile's
  // caption stays inside its tile, its muted mark visible, with the
  // camera-off cover's words never under it, down to a 320 px screen.
  // CALLS_BAR_SNAPSHOTS=<dir> keeps pictures and the measurements.
  async glyphs() {
    const out = process.env.CALLS_BAR_SNAPSHOTS;
    if (out) mkdirSync(out, { recursive: true });
    const report = [];
    const ctxA = await newContext('glyphs A', { cookie: cookieA });
    const ctxB = await newContext('glyphs B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'glyphs A', 'glyphs B');
    if (!pair) throw new Error('glyphs call did not connect');
    const b = pair.b.peer;
    // B mutes and turns the camera off, so B's tile carries both marks.
    await pageB.locator('#mute').click();
    await pageB.locator('#camera').click();
    const tileB = pageA.locator('#tiles > figure[data-tile="' + b + '"]');
    check(await until(async () => await tileB.locator('.calls-tile-muted').isVisible() &&
      await tileB.locator('.calls-tile-off').isVisible(), 10000), 'B shows muted and camera off on A');
    await pageA.emulateMedia({ reducedMotion: 'reduce' });
    await chooseLayout(pageA, 'speaker');
    // Pin yourself, so B is in the filmstrip.
    await openTileMenu(pageA, 'self');
    await pageA.locator('#tile-menu [data-act="pin"]').click();
    check(await until(async () => (await pageA.locator('#tiles > [data-stage]').getAttribute('data-tile')) === 'self', 3000),
      'A pinned to the stage, B in the filmstrip');
    await pageA.mouse.move(1, 1);

    for (const width of [1280, 760]) {
      await pageA.setViewportSize({ width, height: 800 });
      await sleep(300);
      await pageA.locator('#controls').scrollIntoViewIfNeeded();
      const bar = await pageA.locator('#controls').boundingBox();
      // The centre line of the row a button is in: the bar's rows
      // stretch their buttons to one height, so it is the button's own
      // centre (and the bar's, while the bar is one row).
      // The glyph each button is showing: a toggle carries both of its
      // glyphs (the microphone and the slashed one) and shows one.
      const glyphs = await pageA.locator('#controls button:visible svg.icon').evaluateAll((svgs) => svgs
        .filter((svg) => svg.getBoundingClientRect().width > 0).map((svg) => {
        const r = svg.getBoundingClientRect();
        const row = svg.closest('button').getBoundingClientRect();
        return { id: svg.closest('button').id || 'share-link', x: r.x, y: r.y, width: r.width, height: r.height,
          centre: row.y + row.height / 2 };
      }));
      check(glyphs.length >= 5, width + ' px: the bar has its glyphs (' + glyphs.length + ')');
      for (const g of glyphs) {
        const ink = await inkCentroid(pageA, g);
        const centre = g.centre;
        const off = ink === null ? NaN : ink - centre;
        report.push({ width, glyph: g.id, inkCentroid: ink, rowCentre: centre, barCentre: bar.y + bar.height / 2, offset: off });
        check(Math.abs(off) <= 0.5, width + ' px: ' + g.id + "'s ink is on the bar's centre line (" +
          (off >= 0 ? '+' : '') + off.toFixed(2) + ' px)');
      }
      if (out) await pageA.screenshot({ path: out + '/web-bar-' + width + '.png', clip: bar });
    }

    // A name as long as a real one can be, so a narrow tile has to
    // truncate it.
    await tileB.locator('figcaption > span').first().evaluate((n) => { n.textContent = 'Ana García Fernández'; });
    for (const width of [1280, 760, 390, 320]) {
      await pageA.setViewportSize({ width, height: width < 500 ? 844 : 800 });
      await sleep(300);
      const t = await tileB.evaluate((fig) => {
        const box = (el) => { const r = el.getBoundingClientRect(); return { top: r.top, bottom: r.bottom, left: r.left, right: r.right }; };
        const cap = fig.querySelector('figcaption');
        const name = cap.querySelector('span');
        const muted = fig.querySelector('.calls-tile-muted');
        const mark = muted.querySelector('svg');
        const off = fig.querySelector('.calls-tile-off');
        const ink = Array.from(off.children).filter((c) => getComputedStyle(c).display !== 'none' && c.getClientRects().length);
        return {
          tile: box(fig), caption: box(cap), mark: mark ? box(mark) : null,
          markShown: !!mark && getComputedStyle(mark).display !== 'none' && mark.getBoundingClientRect().width > 0,
          nameFits: name.scrollWidth <= name.clientWidth + 1 || getComputedStyle(name).textOverflow === 'ellipsis',
          cover: ink.map(box),
          label: fig.getAttribute('aria-label') || '',
          mutedText: muted.textContent.trim(),
        };
      });
      report.push({ width, filmstripTile: t });
      check(t.caption.right <= t.tile.right + 0.5 && t.caption.left >= t.tile.left - 0.5,
        width + ' px: the caption stays inside the filmstrip tile');
      check(t.markShown && t.mark.right <= t.tile.right, width + ' px: the muted mark is visible');
      check(t.nameFits, width + ' px: the name fits or ends in an ellipsis');
      check(t.cover.every((c) => c.bottom <= t.caption.top), width + " px: the camera-off cover is clear of the caption (" +
        JSON.stringify(t.cover.map((c) => Math.round(c.bottom))) + ' vs ' + Math.round(t.caption.top) + ')');
      check(/muted/i.test(t.mutedText), width + ' px: "Muted" is still in the tile for assistive technology');
      if (out) await pageA.screenshot({ path: out + '/web-filmstrip-' + width + '.png', fullPage: true });
    }
    if (out) writeFileSync(out + '/web-measurements.json', JSON.stringify(report, null, 2));
    await ctxA.close();
    await ctxB.close();
  },

  // The stage (2026-10-05). Paul: "Should the video view stay fullscreen
  // even here? The black line is a bit weird." Speaker view's stage fills
  // the whole window, the filmstrip over its bottom, with no band behind
  // it and the bar; its caption sits just above the filmstrip, at the
  // window's left; a screen on the stage is fitted with its own picture
  // soft and dimmed around it (the backdrop canvas, painted, and what a
  // paint costs); Grid keeps its tiles inside the window. And "Vertical
  // centering here too": every camera-off cover is centred in its whole
  // tile, or, on a tile too short for that, only as high as clears the
  // caption. Controls shown and hidden throughout.
  // CALLS_STAGE_SNAPSHOTS=<dir> keeps pictures and the measurements.
  async stage() {
    const out = process.env.CALLS_STAGE_SNAPSHOTS;
    if (out) mkdirSync(out, { recursive: true });
    const report = [];
    const ctxA = await newContext('stage A', { cookie: cookieA });
    const ctxB = await newContext('stage B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'stage A', 'stage B');
    if (!pair) throw new Error('stage call did not connect');
    const b = pair.b.peer;
    await pageA.emulateMedia({ reducedMotion: 'reduce' });
    await pageA.setViewportSize({ width: 1280, height: 800 });
    await chooseLayout(pageA, 'speaker');
    const geo = () => pageA.evaluate(() => {
      const r = (el) => {
        if (!el || !el.getClientRects().length) return null;
        const x = el.getBoundingClientRect();
        return { top: x.top, bottom: x.bottom, left: x.left, right: x.right, width: x.width, height: x.height };
      };
      const ink = (fig) => {
        const off = fig && fig.querySelector('.calls-tile-off');
        if (!off || off.hidden) return null;
        // What can be seen: not the words a narrow tile keeps only for
        // assistive technology (1 px, clipped).
        const parts = Array.from(off.children).filter((c) => getComputedStyle(c).display !== 'none' && c.getClientRects().length).map(r)
          .filter((q) => q.width > 1 && q.height > 1);
        if (!parts.length) return null;
        return { top: Math.min(...parts.map((q) => q.top)), bottom: Math.max(...parts.map((q) => q.bottom)) };
      };
      const stage = document.querySelector('#tiles > [data-stage]');
      const strip = Array.from(document.querySelectorAll('#tiles > figure:not([data-stage], .calls-tile-pip)')).filter((f) => f.getClientRects().length);
      const backdrop = stage && stage.querySelector('.calls-tile-backdrop');
      return {
        window: r(document.querySelector('.calls-stage')),
        stage: r(stage), stageKey: stage ? stage.dataset.tile : '',
        caption: r(stage && stage.querySelector('figcaption')),
        cover: ink(stage),
        strip: strip.map((f) => ({ key: f.dataset.tile, tile: r(f), caption: r(f.querySelector('figcaption')), cover: ink(f) })),
        backdrop: backdrop ? { shown: getComputedStyle(backdrop).display !== 'none', painted: +(backdrop.dataset.painted || 0), costMs: +(backdrop.dataset.costMs || 0) } : null,
        grid: Array.from(document.querySelectorAll('#tiles[data-layout="grid"] > figure')).map(r),
      };
    });
    // Centred in the tile, or risen only as far as clears its caption.
    const placed = (tile, cover, caption, what) => {
      if (!cover || !caption) return check(false, what + ': has a cover and a caption');
      const mid = (cover.top + cover.bottom) / 2;
      const centre = (tile.top + tile.bottom) / 2;
      check(cover.bottom <= caption.top + 0.5, what + ': the cover is clear of the caption (' + Math.round(cover.bottom) + ' vs ' + Math.round(caption.top) + ')');
      check(Math.abs(mid - centre) <= 1.5 || cover.bottom >= caption.top - 8,
        what + ': the cover is centred in the whole tile (' + mid.toFixed(1) + ' vs ' + centre.toFixed(1) + '), or only as high as clears the caption');
    };
    const both = async (name, fn) => {
      for (const shown of [true, false]) {
        await pageA.evaluate((v) => window.callsChrome.pin(v), shown);
        await sleep(500);
        const g = await geo();
        report.push({ name, shown, ...g });
        await fn(g, name + (shown ? ' (controls shown)' : ' (controls hidden)'), shown);
        if (out) await pageA.screenshot({ path: out + '/web-' + name + '-' + (shown ? 'controls' : 'hidden') + '.png' });
      }
      await pageA.evaluate(() => window.callsChrome.pin(null));
    };
    const fills = (g, what, shown) => {
      check(g.stage && g.window && Math.abs(g.stage.top - g.window.top) <= 1 && Math.abs(g.stage.bottom - g.window.bottom) <= 1 &&
        Math.abs(g.stage.left - g.window.left) <= 1 && Math.abs(g.stage.right - g.window.right) <= 1,
        what + ': the stage fills the window, no band (' + JSON.stringify(g.stage) + ' in ' + JSON.stringify(g.window) + ')');
      // With a filmstrip, the caption rides just above it; without one
      // (a call of two, you floating), it is at the window's foot, above
      // the bar while that shows.
      const top = g.strip.length ? Math.min(...g.strip.map((t) => t.tile.top)) : g.window.bottom - (shown ? 72 : 0);
      check(g.caption && g.caption.bottom <= top - 4 && g.caption.bottom >= top - 24,
        what + ': the stage caption sits just above the ' + (g.strip.length ? 'filmstrip' : 'window\'s foot') +
        ' (' + (g.caption && Math.round(g.caption.bottom)) + ' vs ' + Math.round(top) + ')');
      check(g.caption && g.caption.left - g.window.left <= 16, what + ': and at the window\'s left');
    };

    // A pins herself: her camera on the stage, B in the filmstrip.
    await openTileMenu(pageA, 'self');
    await pageA.locator('#tile-menu [data-act="pin"]').click();
    check(await until(async () => (await pageA.locator('#tiles > [data-stage]').getAttribute('data-tile')) === 'self', 3000),
      'A pinned to the stage, B in the filmstrip');
    await both('stage-camera', async (g, what, shown) => {
      fills(g, what, shown);
      const fit = await pageA.locator('#tiles > [data-stage] video').evaluate((v) => [getComputedStyle(v).objectFit, getComputedStyle(v).objectPosition]);
      check(fit[0] === 'cover' && fit[1] === '50% 35%', what + ': the camera fills, cropped with headroom (' + fit.join(' ') + ')');
    });

    // B's camera off: B's filmstrip tile's cover, centred.
    await pageB.locator('#camera').click();
    const tileB = pageA.locator('#tiles > figure[data-tile="' + b + '"]');
    check(await until(async () => tileB.locator('.calls-tile-off').isVisible(), 10000), 'B shows camera off on A');
    for (const width of [1280, 760, 390]) {
      await pageA.setViewportSize({ width, height: width < 500 ? 844 : 800 });
      await both('filmstrip-camera-off-' + width, async (g, what) => {
        const t = g.strip.find((x) => x.key === b);
        placed(t.tile, t.cover, t.caption, what + ' B\'s filmstrip tile');
      });
    }
    await pageA.setViewportSize({ width: 1280, height: 800 });

    // B, camera off, pinned to the stage.
    await openTileMenu(pageA, b);
    await pageA.locator('#tile-menu [data-act="pin"]').click();
    check(await until(async () => (await pageA.locator('#tiles > [data-stage]').getAttribute('data-tile')) === b, 3000), 'B pinned to the stage');
    await both('stage-camera-off', async (g, what, shown) => {
      fills(g, what, shown);
      placed(g.stage, g.cover, g.caption, what + ' the stage');
    });
    await pageB.locator('#camera').click();

    // B shares: the screen takes the stage, fitted, its backdrop painted.
    await openTileMenu(pageA, b);
    await pageA.locator('#tile-menu [data-act="pin"]').click();
    await pageB.locator('#share').click();
    check(await until(async () => (await pageA.locator('#tiles > [data-stage].calls-tile-share').count()) === 1, 15000), 'B\'s screen is on the stage');
    check(await until(async () => ((await geo()).backdrop || {}).painted > 1, 8000), 'the screen\'s backdrop is painted');
    await both('stage-screen', async (g, what, shown) => {
      fills(g, what, shown);
      const fit = await pageA.locator('#tiles > [data-stage] video').evaluate((v) => getComputedStyle(v).objectFit);
      check(fit === 'contain', what + ': the screen is fitted whole (' + fit + ')');
      check(g.backdrop && g.backdrop.shown, what + ': its soft picture shows around it');
    });
    const cost = ((await geo()).backdrop || { costMs: NaN }).costMs;
    report.push({ backdropWorstPaintMs: cost });
    line('stage: the backdrop\'s slowest paint was ' + cost + ' ms, twice a second');
    check(cost < 8, 'a backdrop paint is cheap (' + cost + ' ms)');

    // Grid: tiles as before, inside the window.
    await chooseLayout(pageA, 'grid');
    await both('grid', async (g, what) => {
      check(g.grid.length >= 2 && g.grid.every((t) => t.top >= g.window.top - 0.5 && t.bottom <= g.window.bottom + 0.5),
        what + ': every tile inside the window');
    });
    await pageB.locator('#share').click();
    if (out) writeFileSync(out + '/web-stage-measurements.json', JSON.stringify(report, null, 2));
    await leaveRoom(pageA);
    await leaveRoom(pageB);
    await ctxA.close();
    await ctxB.close();
  },

  // The call window (2026-09-28). Paul asked for the web call to be
  // more like the Mac's: the whole call in a rounded window inset from
  // the viewport. So: the window is inset with rounded corners on a
  // desktop and edge to edge on a phone; the page does not scroll; the
  // controls come with the pointer, go 3 s after it stops or 1.5 s
  // after it leaves, come back with movement and with Tab, and stay
  // while the keyboard, the pointer on the bar or an open panel holds
  // them; chat is a sidebar over the picture, not a column beside it;
  // the popovers sit over their buttons; the self view floats in a call
  // of two and can be moved to another corner; the sharing notice and
  // its Stop sharing stay with the controls hidden; the glass keeps
  // white at 4.5:1 or better over white, black and busy video, with and
  // without its blur; and with no script the room still reads sensibly
  // inside the window. CALLS_WINDOW_SNAPSHOTS=<dir> keeps pictures.
  // Shared chrome R2 (estilo spec/shared-chrome): the holding screen and
  // the room hold still while they settle, and the room's title menu
  // speaks the account menu's words. The room used to paint a lone self
  // tile at filmstrip size and then fill the stage with it, a layout
  // shift of 0.43–0.80 on some joins, so the room is loaded eight times.
  async chrome() {
    // The audit's own viewport, where both shifts were measured.
    const ctx = await newContext('member A', { cookie: cookieA, options: { viewport: { width: 1440, height: 900 } } });
    await ctx.addInitScript(() => {
      window.__cls = 0;
      window.__shifts = [];
      new PerformanceObserver((l) => {
        for (const e of l.getEntries()) {
          if (e.hadRecentInput) continue;
          window.__cls += e.value;
          window.__shifts.push({ v: +e.value.toFixed(4), t: Math.round(e.startTime), src: (e.sources || []).map((s) => (s.node && (s.node.id || s.node.className)) || '?').join(',') });
        }
      }).observe({ type: 'layout-shift', buffered: true });
    });
    const page = await ctx.newPage();
    const cls = () => page.evaluate(() => ({ cls: window.__cls, shifts: window.__shifts }));

    await page.goto(origin + '/m/' + sqid + '/join');
    const ready = await until(async () => await page.locator('#join').isEnabled(), 15000);
    check(ready, 'the holding screen is ready — status: ' + (await page.locator('#status').textContent()));
    await new Promise((r) => setTimeout(r, 1000));
    const holding = await cls();
    check(holding.cls < 0.01, 'the holding screen holds still while its devices arrive (CLS ' + holding.cls.toFixed(4) + ' ' + JSON.stringify(holding.shifts) + ')');
    check(await page.locator('header[estilo-bar]').count() === 1, 'the holding screen wears the estilo bar');

    // With script, Copy link shows, and Share… only where the browser
    // can share: rst-btn's display used to beat its hidden attribute.
    const [share] = await Promise.all([ctx.waitForEvent('page'), page.click('form[action$="/share"] button')]);
    await share.waitForLoadState('load');
    const canShare = await share.evaluate(() => !!navigator.share);
    check(await share.locator('#copy-invitation').isVisible() && (await share.locator('#share-invitation').isVisible()) === canShare,
      'the Share page shows Copy link, and Share… only where the browser can share (navigator.share ' + canShare + ')');
    await share.close();

    await Promise.all([page.waitForURL('**/m/' + sqid), page.click('#join')]);
    await page.waitForFunction(() => !!window.meet, null, { timeout: 20000 });
    check(await until(async () => (await state(page)).admitted, 20000), 'joined from the holding screen');
    await new Promise((r) => setTimeout(r, 1500));
    const joined = await cls();
    check(joined.cls < 0.01, 'holding screen → room holds still (CLS ' + joined.cls.toFixed(4) + ' ' + JSON.stringify(joined.shifts) + ')');


    // The More menu (2026-10-02): the account menu's order and words,
    // which the title pill's ☰ menu carried until the pill went.
    await page.mouse.move(200, 200);
    await page.click('#call-more-toggle');
    const menu = (await page.locator('#call-more').innerText()).split('\n').map((l) => l.trim()).filter(Boolean);
    const want = ['You’re in this call as paul.', 'Signed in as', 'Meetings', 'Settings', 'Help', 'Open source', 'Sign out', 'End meeting for everyone'];
    const order = want.map((w) => menu.indexOf(w));
    check(order.every((i, n) => i >= 0 && (n === 0 || i > order[n - 1])), 'the More menu reads ' + want.join(' / ') + ' in that order (' + JSON.stringify(menu) + ')');
    check(await page.getByText('Sign out', { exact: true }).count() === 1, 'the room has exactly one Sign out');
    const onTop = await page.evaluate(() => {
      const m = document.getElementById('call-more');
      const r = m.getBoundingClientRect();
      const hit = document.elementFromPoint(r.left + r.width / 2, r.top + 12);
      return !!hit && m.contains(hit);
    });
    check(onTop, 'the open More menu is above everything under it');
    check(await page.locator('#call-nav, #call-state').count() === 0, 'there is no title pill or ☰ menu');
    await page.keyboard.press('Escape');
    await leaveRoom(page);

    // The room loaded straight from the list, eight times: the shift
    // came on some joins and not others.
    let worst = { cls: 0, shifts: [] };
    for (let i = 0; i < 8; i++) {
      await page.goto(origin + '/');
      await page.goto(origin + '/m/' + sqid);
      await page.waitForFunction(() => !!window.meet, null, { timeout: 20000 });
      await until(async () => (await state(page)).admitted, 20000);
      await new Promise((r) => setTimeout(r, 1200));
      const c = await cls();
      if (c.cls >= worst.cls) worst = c;
      await leaveRoom(page);
    }
    check(worst.cls < 0.01, 'the room holds still as its tiles arrive, eight loads from the list (worst CLS ' + worst.cls.toFixed(4) + ' ' + JSON.stringify(worst.shifts) + ')');
    check(errorsFor('member A') === '', 'no console errors (' + errorsFor('member A') + ')');
    await ctx.close();
  },

  async window() {
    const out = process.env.CALLS_WINDOW_SNAPSHOTS;
    if (out) mkdirSync(out, { recursive: true });
    const shot = async (page, name) => {
      if (out) await page.screenshot({ path: out + '/web-' + name + '.png' });
    };
    const geometry = (page) => page.evaluate(() => {
      const w = document.querySelector('.calls-window');
      const r = w.getBoundingClientRect();
      const se = document.scrollingElement;
      return {
        left: r.left, top: r.top, right: innerWidth - r.right, bottom: innerHeight - r.bottom,
        radius: parseFloat(getComputedStyle(w).borderTopLeftRadius),
        scrolls: se.scrollHeight > innerHeight + 1 || se.scrollWidth > innerWidth + 1,
        overflow: getComputedStyle(document.body).overflow,
      };
    });
    const inset = (g, lo, hi) => [g.left, g.top, g.right, g.bottom].every((v) => v >= lo - 0.5 && v <= hi + 0.5);
    const chrome = (page) => page.evaluate(() => window.callsChrome.state());
    const opacity = (page, sel) => page.evaluate((q) => parseFloat(getComputedStyle(document.querySelector(q)).opacity), sel);
    const box = (page, sel) => page.locator(sel).first().boundingBox();

    // ── A no-script browser: the room inside the window ──
    const bare = await newContext('window scriptless', { cookie: cookieA, javaScriptEnabled: false });
    const still = await bare.newPage();
    await still.setViewportSize({ width: 1440, height: 900 });
    await still.goto(origin + '/m/' + sqid, { waitUntil: 'domcontentloaded' });
    const gs = await geometry(still);
    check(inset(gs, 16, 24) && gs.radius >= 16 && !gs.scrolls,
      'no script: the room is still the inset, rounded window, with no page scroll (' + JSON.stringify(gs) + ')');
    const bareText = await still.locator('.calls-window').innerText();
    check(bareText.includes('The call needs JavaScript') && bareText.includes('Back to the holding screen') &&
      bareText.includes('You’re in this call as paul.') && bareText.includes('Board meeting'),
      'no script: the title, the standing, the sentence and the way back are inside the window');
    // The header is a plain block (noscript.css): the title, who you
    // are, the relay notice and the navigation, all visible, no menu to
    // open (2026-10-02: the ☰ menu went with the pill).
    const head = await still.locator('#call-top').innerText();
    check(await still.locator('#call-title').isVisible() && /Meetings/.test(head) && /Settings/.test(head) &&
      /Open source/.test(head) && /Sign out/.test(head) && /You’re in this call as paul\./.test(head),
      'no script: the header shows the title, the standing and Meetings, Settings, Help and Sign out (' + JSON.stringify(head) + ')');
    check(await still.locator('.calls-scriptless a[href$="/end"]').count() === 1 &&
      await still.locator('.calls-scriptless form[action$="/share"]').count() === 1,
      'no script: Share link and End the meeting are reachable');
    check(await still.locator('#room').isHidden(), 'no script: nothing pretends to be a call');
    await shot(still, 'nojs-1440');
    await bare.close();

    const ctxA = await newContext('window A', { cookie: cookieA });
    const ctxB = await newContext('window B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    await pageA.setViewportSize({ width: 1440, height: 900 });
    await pageA.evaluate(() => {
      localStorage.removeItem('calls.videoLayout');
      localStorage.removeItem('calls.selfCorner');
    });
    const pageB = await openRoom(ctxB);
    const pair = await assertPair(pageA, pageB, 'window A', 'window B');
    if (!pair) return;

    // ── The window ──
    const g = await geometry(pageA);
    check(inset(g, 16, 24), '1440 px: the window is inset 16–24 px on every side (' + JSON.stringify(g) + ')');
    check(g.radius >= 16 && g.radius <= 20, '1440 px: with a 16–20 px corner radius (' + g.radius + ')');
    check(!g.scrolls && g.overflow === 'hidden', '1440 px: and the page does not scroll');
    const within = await pageA.evaluate(() => {
      const w = document.querySelector('.calls-window').getBoundingClientRect();
      return ['#call-top', '#controls', '#tiles > [data-stage]', '#tiles > .calls-tile-self'].map((q) => {
        const r = document.querySelector(q).getBoundingClientRect();
        return { q, ok: r.left >= w.left - 0.5 && r.right <= w.right + 0.5 && r.top >= w.top - 0.5 && r.bottom <= w.bottom + 0.5 };
      });
    });
    check(within.every((i) => i.ok), 'the title, the bar, the stage and the self view are inside it (' + JSON.stringify(within) + ')');
    check(await pageA.locator('rst-shell-topbar, [rst-shell-topbar], [rst-shell-bar]').count() === 0,
      'the page shell is gone: its navigation is in the title\'s menu');

    // ── No title pill (2026-10-02): a chosen title is the window's ──
    // "Board meeting" is a title someone chose, so it is shown as a Mac
    // window shows its title: plain text, centred in the strip at the
    // top, with nothing about how the call is going beside it.
    const titled = await pageA.evaluate(() => {
      const w = document.querySelector('.calls-window').getBoundingClientRect();
      const top = document.getElementById('call-top');
      const h1 = document.getElementById('call-title').getBoundingClientRect();
      const st = getComputedStyle(top);
      return {
        text: top.innerText.trim(), named: top.classList.contains('calls-top-named'),
        centre: (h1.left + h1.right) / 2 - (w.left + w.right) / 2, top: h1.top - w.top, height: h1.height,
        background: st.backgroundColor, radius: parseFloat(st.borderTopLeftRadius),
      };
    });
    check(titled.text === 'Board meeting' && titled.named,
      'a named meeting shows its title and only its title (' + JSON.stringify(titled) + ')');
    check(Math.abs(titled.centre) < 2 && titled.top >= 0 && titled.top + titled.height <= 44,
      'centred in the strip across the top of the window (' + JSON.stringify(titled) + ')');
    check(titled.background === 'rgba(0, 0, 0, 0)' && titled.radius === 0, 'with no pill behind it');
    check(await pageA.locator('#call-nav, #call-state').count() === 0, 'and no ☰ menu or state line');
    check(await pageA.title() === 'Board meeting · Calls', 'the document is titled for the meeting');
    await shot(pageA, '1440-named-title');
    const floorText = await pageA.locator('#notices #floor-notice').innerText().catch(() => '');
    check(await pageA.locator('#floor-notice').isVisible() && floorText.includes('Calls outside your network may not connect yet.'),
      'the relay notice is a notice of its own under the title, not in it');
    await shot(pageA, '1440-relay-notice');
    await pageA.locator('#floor-dismiss').click();
    check(await pageA.locator('#floor-notice').isHidden() &&
      await pageA.evaluate(() => sessionStorage.getItem('calls.floorSeen')) === '1',
      'it is dismissed, and not shown again in this session');

    // ── When the controls show ──
    const w = await box(pageA, '.calls-window');
    const cx = w.x + w.width / 2;
    const cy = w.y + w.height / 3;
    await pageA.mouse.move(cx, cy);
    await pageA.mouse.move(cx + 10, cy + 10);
    check((await chrome(pageA)).visible, 'the controls show when the pointer moves');
    await sleep(2000);
    check((await chrome(pageA)).visible, 'and are still up 2 s later');
    const hid = await until(async () => !(await chrome(pageA)).visible, 3000);
    check(hid, 'they hide 3 s after the pointer stops (' + JSON.stringify(await chrome(pageA)) + ')');
    await sleep(500);
    check((await opacity(pageA, '#controls')) < 0.05 && (await opacity(pageA, '#call-top')) < 0.05,
      'the bar and the title fade out completely');
    check((await opacity(pageA, '#tiles > [data-stage] .calls-tool-more')) < 0.05,
      'and the tile\'s ⋯ goes with them');
    check(await pageA.evaluate(() => getComputedStyle(document.getElementById('stage')).cursor === 'none'),
      'and the pointer hides with them over the picture');
    await shot(pageA, '1440-speaker-hidden');
    await pageA.mouse.move(cx + 40, cy);
    check((await chrome(pageA)).visible, 'moving the pointer brings them back');
    await sleep(400);
    check((await opacity(pageA, '#controls')) > 0.95, 'faded all the way in');
    check((await opacity(pageA, '#tiles > [data-stage] .calls-tool-more')) > 0.95 &&
      (await opacity(pageA, '#tiles > .calls-tile-self .calls-tool-more')) < 0.05,
      'a tile shows its ⋯ only under the pointer (the stage here, not the self view)');
    await shot(pageA, '1440-speaker-shown');

    await pageA.mouse.move(Math.max(2, w.x / 2), Math.max(2, w.y / 2));
    const leftAt = Date.now();
    const goneAt = await until(async () => (!(await chrome(pageA)).visible ? Date.now() : false), 3500);
    check(goneAt && goneAt - leftAt >= 1100 && goneAt - leftAt <= 2400,
      'leaving the window hides them 1.5 s later (' + (goneAt && goneAt - leftAt) + ' ms)');

    await pageA.keyboard.press('Tab');
    check((await chrome(pageA)).visible, 'Tab brings them back');
    let reached = false;
    for (let i = 0; i < 16 && !reached; i++) {
      reached = await pageA.evaluate(() => document.activeElement && document.activeElement.id === 'mute');
      if (!reached) await pageA.keyboard.press('Tab');
    }
    check(reached, 'Tab reaches the microphone button');
    await sleep(3600);
    const keyHeld = await chrome(pageA);
    check(keyHeld.visible && keyHeld.holds.includes('keyboardFocus'),
      'keyboard focus in the bar holds them up (' + JSON.stringify(keyHeld) + ')');
    const tip = await pageA.evaluate(() => {
      const st = getComputedStyle(document.getElementById('mute'), '::after');
      return { content: st.content, opacity: parseFloat(st.opacity) };
    });
    check(tip.content === '"Mute microphone"' && tip.opacity > 0.9,
      'the focused button shows its tooltip (' + JSON.stringify(tip) + ')');
    check(await pageA.evaluate(() => ['mute', 'camera', 'share', 'devices-toggle', 'layout-toggle', 'toggle-chat', 'leave'].every((id) => {
      const label = document.querySelector('#' + id + ' .calls-bar-label');
      return !!label && getComputedStyle(label).clipPath !== 'none';
    })), 'the bar is glyphs: the words are for a screen reader');
    await pageA.evaluate(() => document.activeElement.blur());

    const barBox = await box(pageA, '.calls-bar-spacer');
    await pageA.mouse.move(barBox.x + barBox.width / 2, barBox.y + barBox.height / 2);
    await sleep(3600);
    const barHeld = await chrome(pageA);
    check(barHeld.visible && barHeld.holds.includes('pointerOverControls'),
      'the pointer resting on the bar holds them up (' + JSON.stringify(barHeld) + ')');
    await pageA.mouse.move(cx, cy);

    // ── The tile menu: Pin, the moves and Remove, not on the tile ──
    const b = pair.b.peer;
    check(await pageA.locator('#tiles > figure[data-tile="' + b + '"] figcaption a, #tiles > figure[data-tile="' + b + '"] figcaption .calls-tile-remove').count() === 0,
      'the name label is the name, the mic state and the rim: no Remove in it');
    const moreB = pageA.locator('#tiles > figure[data-tile="' + b + '"] .calls-tool-more');
    await moreB.focus();
    await sleep(300);
    check((await moreB.getAttribute('aria-label')) === 'Options for bea' &&
      (await opacity(pageA, '#tiles > figure[data-tile="' + b + '"] .calls-tool-more')) > 0.95,
      'the keyboard reaches the tile\'s ⋯, named for the person, and shows it');
    await pageA.keyboard.press('Enter');
    const items = await pageA.locator('#tile-menu').evaluate((m) => Array.from(m.querySelectorAll('button, a'))
      .filter((el) => !el.hidden).map((el) => el.getAttribute('aria-label') || el.textContent.trim()));
    check(JSON.stringify(items) === JSON.stringify(['Pin bea', 'Move bea to first', 'Move bea earlier', 'Move bea later', 'Remove bea from the call']),
      'the tile menu holds Pin, the three moves and Remove (' + JSON.stringify(items) + ')');
    check(await pageA.evaluate(() => !!document.activeElement.closest('#tile-menu')), 'and the keyboard is in it');
    const rm = pageA.locator('#tile-menu .calls-tile-remove');
    check((await rm.getAttribute('href')) === '/m/' + sqid + '/remove/' + b && (await rm.getAttribute('target')) === '_blank',
      'Remove is a link to its own confirm page, in a new tab');
    const menuBox = await box(pageA, '#tile-menu');
    const moreBox = await moreB.boundingBox();
    check(menuBox && menuBox.y >= moreBox.y + moreBox.height && menuBox.x + menuBox.width <= moreBox.x + moreBox.width + 1,
      'the menu opens under its ⋯');
    await shot(pageA, '1440-tile-menu');
    await pageA.keyboard.press('Escape');
    check(await pageA.locator('#tile-menu').isHidden() &&
      await pageA.evaluate(() => document.activeElement && document.activeElement.classList.contains('calls-tool-more')),
      'Escape closes it and the keyboard goes back to the ⋯');
    await pageA.evaluate(() => document.activeElement.blur());
    await pageA.mouse.move(cx, cy);

    // ── Chat, as a sidebar over the picture ──
    const stageBefore = await box(pageA, '#stage');
    await openChat(pageA);
    await sleep(400);
    const chatBox = await box(pageA, '#chat-overlay');
    const stageAfter = await box(pageA, '#stage');
    check(Math.abs(stageAfter.width - stageBefore.width) < 1 && Math.abs(stageAfter.height - stageBefore.height) < 1,
      'chat leaves the picture its full size (' + JSON.stringify({ stageBefore, stageAfter }) + ')');
    check(chatBox.x > stageAfter.x + stageAfter.width / 2 && chatBox.x + chatBox.width <= stageAfter.x + stageAfter.width &&
      chatBox.y >= stageAfter.y, 'chat opens as a sidebar over the right of the stage (' + JSON.stringify(chatBox) + ')');
    await sleep(3600);
    const chatHeld = await chrome(pageA);
    check(chatHeld.visible && chatHeld.holds.includes('menuOpen'), 'an open chat holds the controls up');
    await shot(pageA, '1440-chat');
    await pageA.locator('#chat-close').click();
    check(await until(() => pageA.locator('#chat-overlay').isHidden(), 2000), 'the sidebar closes');

    // ── The popovers ──
    await pageA.locator('#devices-toggle').click();
    const dev = await box(pageA, '#room-devices');
    const devButton = await box(pageA, '#devices-toggle');
    const bar = await box(pageA, '#controls');
    check(dev && dev.y + dev.height <= bar.y && devButton.x + devButton.width / 2 >= dev.x &&
      devButton.x + devButton.width / 2 <= dev.x + dev.width,
      'Devices opens above its own button, over the picture (' + JSON.stringify({ dev, devButton }) + ')');
    await sleep(300);
    await shot(pageA, '1440-devices');
    await pageA.keyboard.press('Escape');
    check(await pageA.locator('#room-devices').isHidden(), 'Escape closes it');
    await pageA.locator('#layout-toggle').click();
    const lay = await box(pageA, '#layout-panel');
    const layButton = await box(pageA, '#layout-toggle');
    check(lay && lay.y + lay.height <= bar.y && layButton.x + layButton.width / 2 >= lay.x &&
      layButton.x + layButton.width / 2 <= lay.x + lay.width, 'Layout opens above its own button');
    await shot(pageA, '1440-layout');
    await pageA.mouse.click(cx, cy);
    check(await pageA.locator('#layout-panel').isHidden(), 'a click elsewhere closes it');
    await pageA.locator('#call-more-toggle').click();
    const end = pageA.locator('#call-more a.calls-menu-danger');
    check((await end.innerText()).trim() === 'End meeting for everyone' &&
      (await end.getAttribute('href')) === '/meetings/' + sqid + '/end' && (await end.getAttribute('target')) === '_blank',
      'More holds End meeting for everyone, a link to its own confirm page');
    await shot(pageA, '1440-more');
    await pageA.keyboard.press('Escape');

    // ── Speaker and Grid, the controls shown and hidden ──
    for (const [width, height] of [[1440, 900], [1280, 800]]) {
      await pageA.setViewportSize({ width, height });
      const gg = await geometry(pageA);
      check(inset(gg, 16, 24) && !gg.scrolls, width + ' px: inset window, no scroll (' + JSON.stringify(gg) + ')');
      for (const mode of ['speaker', 'grid']) {
        await chooseLayout(pageA, mode);
        await pageA.mouse.move(cx, cy);
        for (const shown of [true, false]) {
          await pageA.evaluate((v) => window.callsChrome.pin(v), shown);
          await sleep(500);
          if (mode === 'grid') {
            const fits = await pageA.evaluate(() => {
              const t = document.getElementById('tiles');
              const st = document.getElementById('stage').getBoundingClientRect();
              return t.scrollHeight <= t.clientHeight + 1 && Array.from(t.children).every((f) => {
                const r = f.getBoundingClientRect();
                return r.left >= st.left && r.right <= st.right && r.top >= st.top && r.bottom <= st.bottom;
              });
            });
            check(fits, width + ' px: Grid fits every tile without scrolling');
          }
          if (width === 1440 && mode === 'speaker') continue;
          await shot(pageA, width + '-' + mode + '-' + (shown ? 'shown' : 'hidden'));
        }
      }
    }
    await pageA.evaluate(() => window.callsChrome.pin(null));
    await pageA.setViewportSize({ width: 1440, height: 900 });
    await chooseLayout(pageA, 'speaker');

    // ── The self view, floating in a call of two ──
    const pip = pageA.locator('#tiles > .calls-tile-self');
    check(await pip.evaluate((f) => f.classList.contains('calls-tile-pip')), 'in a call of two you float in a corner');
    await pageA.mouse.move(cx, cy);
    const p0 = await pip.boundingBox();
    const w0 = await box(pageA, '.calls-window');
    const b0 = await box(pageA, '#controls');
    check(p0.x + p0.width > w0.x + w0.width - 20 && p0.y + p0.height <= b0.y,
      'bottom right by default, clear of the bar while it shows (' + JSON.stringify({ p0, b0 }) + ')');
    await pageA.mouse.move(p0.x + p0.width / 2, p0.y + p0.height / 2);
    await pageA.mouse.down();
    for (let i = 1; i <= 12; i++) {
      await pageA.mouse.move(p0.x + p0.width / 2 - (p0.x - w0.x - 60) * i / 12, p0.y + p0.height / 2 - (p0.y - w0.y - 150) * i / 12);
      await sleep(16);
    }
    await pageA.mouse.up();
    const corner = await until(async () => {
      const c = await pageA.evaluate(() => window.callsLayout.state().corner);
      return c === 'top-left' ? c : false;
    }, 2000);
    check(corner, 'dragged, it settles in the corner it was headed for');
    await sleep(400);
    const p1 = await pip.boundingBox();
    const t1 = await box(pageA, '#call-top');
    check(p1.x < w0.x + 20 && p1.y >= t1.y + t1.height, 'top left, below the title (' + JSON.stringify({ p1, t1 }) + ')');
    await shot(pageA, '1440-selfview-moved');
    await pageA.evaluate(() => localStorage.removeItem('calls.selfCorner'));

    // ── Sharing: the notice and its Stop sharing stay ──
    await pageA.locator('#share').click();
    const sharing = await until(async () => ((await state(pageA)).sharing ? true : false), 10000);
    check(sharing, 'A shares its screen');
    await pageA.evaluate(() => window.callsChrome.pin(false));
    await sleep(600);
    const notice = await pageA.evaluate(() => {
      const n = document.querySelector('#share-notice');
      const r = n.getBoundingClientRect();
      let o = 1;
      for (let el = n; el; el = el.parentElement) o *= parseFloat(getComputedStyle(el).opacity);
      return { shown: !n.hidden && r.height > 0, opacity: o, stop: !!document.getElementById('share-stop') };
    });
    check(notice.shown && notice.opacity > 0.99 && notice.stop,
      'with the controls hidden the sharing notice and its Stop sharing stay (' + JSON.stringify(notice) + ')');
    await shot(pageA, '1440-sharing-hidden');
    await pageA.evaluate(() => window.callsChrome.pin(true));
    await sleep(400);
    await shot(pageA, '1440-sharing-shown');
    await pageA.locator('#share-stop').click();
    check(await until(async () => !(await state(pageA)).sharing, 5000), 'Stop sharing stops it');

    // ── The glass: white on it at least 4.5:1 over anything ──
    await pageA.evaluate(() => window.callsChrome.pin(true));
    const backdrop = (kind) => pageA.evaluate((k) => {
      document.getElementById('gate-backdrop')?.remove();
      if (!k) return;
      const el = document.createElement(k === 'busy' ? 'canvas' : 'div');
      el.id = 'gate-backdrop';
      Object.assign(el.style, { position: 'absolute', inset: '0', zIndex: '3', width: '100%', height: '100%' });
      if (k === 'busy') {
        el.width = 480;
        el.height = 300;
        const c = el.getContext('2d');
        let seed = 7;
        const rnd = () => ((seed = (seed * 16807) % 2147483647) / 2147483647);
        for (let y = 0; y < 300; y += 10) {
          for (let x = 0; x < 480; x += 10) {
            c.fillStyle = 'rgb(' + Math.floor(rnd() * 256) + ',' + Math.floor(rnd() * 256) + ',' + Math.floor(rnd() * 256) + ')';
            c.fillRect(x, y, 10, 10);
          }
        }
      } else el.style.background = k;
      document.querySelector('.calls-window').append(el);
    }, kind);
    const surfaces = [
      ['the bar', async () => { const b = await box(pageA, '.calls-bar-spacer'); return [b.x + b.width / 2, b.y + b.height / 2]; }],
      // The foot of the title strip, beside the words: its scrim.
      ['the title', async () => { const b = await box(pageA, '#call-top'); return [b.x + 19, b.y + b.height - 5]; }],
    ];
    const ratios = {};
    for (const [label, glass] of [['glass', false], ['no blur', true]]) {
      await pageA.evaluate((off) => document.querySelector('.calls-window').toggleAttribute('data-no-glass', off), glass);
      for (const kind of ['white', 'black', 'busy']) {
        await backdrop(kind);
        await sleep(250);
        for (const [what, at] of surfaces) {
          const [x, y] = await at();
          const colour = await sampleColour(pageA, x, y);
          const ratio = contrastOnWhite(colour);
          ratios[label + ' ' + kind + ' ' + what] = Math.round(ratio * 100) / 100;
          check(ratio >= 4.5, label + ', over ' + kind + ': white on ' + what + ' is ' + ratio.toFixed(2) + ':1 (' + colour + ')');
        }
        if (kind === 'white' && !glass) await shot(pageA, '1440-glass-over-white');
      }
    }
    await backdrop('white');
    for (const id of ['leave']) {
      const b = await box(pageA, '#' + id);
      const colour = await sampleColour(pageA, b.x + 7, b.y + b.height / 2, 2);
      const ratio = contrastOnWhite(colour);
      ratios[id] = Math.round(ratio * 100) / 100;
      check(ratio >= 4.5, 'white on ' + id + '\'s capsule is ' + ratio.toFixed(2) + ':1 (' + colour + ')');
    }
    await pageA.locator('#mute').click();
    await sleep(250);
    {
      const b = await box(pageA, '#mute');
      const colour = await sampleColour(pageA, b.x + 5, b.y + b.height / 2, 2);
      const ratio = contrastOnWhite(colour);
      ratios.muted = Math.round(ratio * 100) / 100;
      check(ratio >= 4.5, 'white on the muted capsule is ' + ratio.toFixed(2) + ':1 (' + colour + ')');
    }
    await pageA.locator('#mute').click();
    await backdrop(null);
    await pageA.evaluate(() => document.querySelector('.calls-window').removeAttribute('data-no-glass'));
    if (out) writeFileSync(out + '/web-contrast.json', JSON.stringify(ratios, null, 2));

    // ── Narrower: a laptop's narrow window keeps a smaller margin, and a
    // window too narrow for the bar gets the phone's ──
    await pageA.evaluate(() => window.callsChrome.pin(true));
    await pageA.setViewportSize({ width: 900, height: 700 });
    const gn = await geometry(pageA);
    check(inset(gn, 8, 16) && !gn.scrolls, '900 px: a smaller margin (' + JSON.stringify(gn) + ')');
    await shot(pageA, '900-speaker');
    await pageA.setViewportSize({ width: 560, height: 760 });
    check(await pageA.locator('#more-controls').isVisible() && await pageA.locator('#leave').isVisible() &&
      !(await pageA.locator('#mute').isVisible()), '560 px: the bar is More controls and Leave');
    await shot(pageA, '560-narrow');
    await pageA.evaluate(() => window.callsChrome.pin(null));

    check(errorsFor('window A') === '', 'no console errors in A (' + errorsFor('window A') + ')');
    await leaveRoom(pageA);
    await ctxA.close();

    // ── A phone: edge to edge, More controls and Leave, and the sheet ──
    const phone = await newContext('window phone', {
      cookie: cookieA,
      options: { viewport: { width: 390, height: 844 }, deviceScaleFactor: 3, isMobile: true, hasTouch: true },
    });
    const pageP = await openRoom(phone);
    const phonePair = await assertPair(pageP, pageB, 'phone', 'window B');
    if (phonePair) {
      const gp = await geometry(pageP);
      check(inset(gp, 0, 0) && gp.radius === 0 && !gp.scrolls,
        'phone: the window goes edge to edge, square-cornered (' + JSON.stringify(gp) + ')');
      const phonePill = await box(pageP, '#call-top');
      check(phonePill.height <= 64, 'phone: the title pill is two short lines, not a quarter of the screen (' + phonePill.height + ' px)');
      const more = await box(pageP, '#more-controls');
      const leave = await box(pageP, '#leave');
      check(more && leave && more.x < 60 && leave.x + leave.width > 330 && !(await pageP.locator('#mute').isVisible()),
        'phone: More controls on the left, Leave on the right, nothing else on the bar');
      await pageP.evaluate(() => window.callsChrome.pin(true));
      await shot(pageP, 'phone-portrait');
      await pageP.evaluate(() => window.callsChrome.pin(null));
      await pageP.tap('#more-controls');
      check(await pageP.locator('#call-sheet[data-open]').isVisible() && await pageP.locator('#mute').isVisible(),
        'phone: More controls opens the sheet, with the microphone in it');
      check(/Microphone/.test(await pageP.locator('#mute').innerText()), 'phone: the sheet\'s buttons say what they are');
      await sleep(3600);
      check((await chrome(pageP)).visible, 'phone: an open sheet holds the controls up');
      await shot(pageP, 'phone-sheet');
      await pageP.tap('#mute');
      check((await pageP.locator('#mute').getAttribute('aria-pressed')) === 'true', 'phone: a tap in the sheet mutes');
      await pageP.tap('#mute');
      const s0 = await box(pageP, '#stage');
      await pageP.touchscreen.tap(s0.x + s0.width / 2, s0.y + s0.height / 2);
      check(!(await pageP.locator('#call-sheet[data-open]').count()), 'phone: a tap elsewhere closes the sheet');
      await pageP.touchscreen.tap(s0.x + s0.width / 2, s0.y + s0.height / 2);
      const toggled = (await chrome(pageP)).visible;
      await pageP.touchscreen.tap(s0.x + s0.width / 2, s0.y + s0.height / 2);
      check((await chrome(pageP)).visible !== toggled, 'phone: a tap on the picture toggles the controls');
      await pageP.setViewportSize({ width: 844, height: 390 });
      await sleep(300);
      const gl = await geometry(pageP);
      check(inset(gl, 0, 0) && !gl.scrolls, 'phone on its side: edge to edge (' + JSON.stringify(gl) + ')');
      await pageP.evaluate(() => window.callsChrome.pin(true));
      await sleep(300);
      await shot(pageP, 'phone-landscape');
      await pageP.evaluate(() => window.callsChrome.pin(null));
      check(errorsFor('window phone') === '', 'no console errors on the phone (' + errorsFor('window phone') + ')');
      await leaveRoom(pageP);
    }
    await leaveRoom(pageB);
    await phone.close();
    await ctxB.close();
  },

  // The title (2026-10-02, Paul approved): no pill. A call nobody named
  // ("Call, 2 Oct 15:40", Start a call) shows no title at all, and says
  // how it is going in the notices only; a named one shows its title
  // centred (the window scenario); the pill's ☰ menu is the bar's ⋯ More
  // menu; and with no script the header is a plain block with the title,
  // the standing and the navigation. CALLS_WINDOW_SNAPSHOTS=<dir> keeps
  // pictures of each.
  async title() {
    const out = process.env.CALLS_WINDOW_SNAPSHOTS;
    if (out) mkdirSync(out, { recursive: true });
    const shot = async (page, name) => { if (out) await page.screenshot({ path: out + '/web-title-' + name + '.png' }); };
    const ctx = await newContext('title', { cookie: cookieA });
    const page = await ctx.newPage();
    await page.setViewportSize({ width: 1440, height: 900 });
    await page.goto(origin + '/', { waitUntil: 'domcontentloaded' });
    // Start a call, as the list's button does, with no zone: the title
    // is the instance's time and does not name the instance's zone.
    const started = await page.evaluate(async () => {
      const res = await fetch('/meetings/start', { method: 'POST', body: new URLSearchParams(), credentials: 'same-origin' });
      const html = await res.text();
      const m = html.match(/\/m\/([23456789a-z]{10})\/join/);
      return { status: res.status, sqid: m && m[1] };
    });
    check(started.status === 200 && !!started.sqid, 'Start a call made a meeting (' + JSON.stringify(started) + ')');
    await page.goto(origin + '/m/' + started.sqid, { waitUntil: 'domcontentloaded' });
    await page.waitForFunction(() => !!window.meet, null, { timeout: 20000 });
    await until(async () => (await state(page)).admitted, 20000);
    await page.mouse.move(400, 300);
    const auto = await page.evaluate(() => {
      const top = document.getElementById('call-top');
      const h1 = document.getElementById('call-title');
      const r = h1.getBoundingClientRect();
      return {
        title: h1.textContent, named: top.classList.contains('calls-top-named'),
        width: r.width, height: r.height, headerHeight: top.getBoundingClientRect().height,
        status: document.getElementById('status').textContent, doc: document.title,
      };
    });
    check(/^Call, \d{1,2} [A-Z][a-z]{2} \d{2}:\d{2}$/.test(auto.title),
      'an automatic title reads "Call, <day> <month> <time>", with no zone after it (' + auto.title + ')');
    check(!auto.named && auto.width <= 1 && auto.height <= 1 && auto.headerHeight === 0,
      'and is not shown: no title, no pill, no strip (' + JSON.stringify(auto) + ')');
    check(auto.doc === auto.title + ' · Calls', 'it is still the document\'s title (' + auto.doc + ')');
    check(await page.locator('#call-nav, #call-state').count() === 0, 'there is no pill and no ☰ menu');
    check(auto.status === 'You are the only one here.', 'how the call is going is the notice\'s to say (' + auto.status + ')');
    await shot(page, 'auto-1440');

    // The pill's menu, now More's.
    await page.click('#call-more-toggle');
    const more = (await page.locator('#call-more').innerText()).split('\n').map((l) => l.trim()).filter(Boolean);
    const want = ['You’re in this call as paul.', 'Signed in as', 'Meetings', 'Settings', 'Help', 'Open source', 'Sign out', 'End meeting for everyone'];
    const at = want.map((w) => more.indexOf(w));
    check(at.every((i, n) => i >= 0 && (n === 0 || i > at[n - 1])), 'More reads ' + want.join(' / ') + ' (' + JSON.stringify(more) + ')');
    check(await page.locator('#call-more a[href="/"]').isVisible(), 'and Meetings in it can be followed');
    await shot(page, 'more-1440');
    await page.keyboard.press('Escape');
    check(await page.locator('#call-more').isHidden(), 'Escape closes More');
    await leaveRoom(page);

    // A guest has More too: their standing, Help and Sign out, no
    // member's pages and no End meeting.
    const guestCtx = await newContext('title guest');
    const guest = await guestCtx.newPage();
    await guest.setViewportSize({ width: 1440, height: 900 });
    await guest.goto(origin + '/j/' + token, { waitUntil: 'domcontentloaded' });
    await guest.locator('input[name="name"]').fill('Vicky Walsh');
    await Promise.all([guest.waitForURL('**/m/*/join'), guest.locator('form[action$="/guest"] button[type="submit"]').click()]);
    await guest.goto(origin + '/m/' + sqid, { waitUntil: 'domcontentloaded' });
    await guest.waitForFunction(() => !!window.meet, null, { timeout: 20000 });
    await guest.mouse.move(400, 300);
    await guest.click('#call-more-toggle');
    const guestMore = await guest.locator('#call-more').innerText();
    check(/You’re in this call as Vicky Walsh, a guest\./.test(guestMore) && /Open source/.test(guestMore) &&
      !/Meetings|Settings|End meeting/.test(guestMore),
      'a guest\'s More has their standing and Help, and no member\'s pages (' + JSON.stringify(guestMore) + ')');
    await shot(guest, 'guest-more-1440');
    await guestCtx.close();

    // No script: the header is a plain block with the title, standing
    // and navigation, for a named meeting and an automatic one alike.
    const bare = await newContext('title scriptless', { cookie: cookieA, javaScriptEnabled: false });
    for (const [which, id] of [['named', sqid], ['auto', started.sqid]]) {
      const still = await bare.newPage();
      await still.setViewportSize({ width: 1440, height: 900 });
      await still.goto(origin + '/m/' + id, { waitUntil: 'domcontentloaded' });
      const head = await still.locator('#call-top').innerText();
      const h1 = await still.locator('#call-title').boundingBox();
      check(h1 && h1.width > 40 && head.includes(which === 'named' ? 'Board meeting' : auto.title) &&
        /You’re in this call as paul\./.test(head) && /Meetings/.test(head) && /Settings/.test(head) &&
        /Open source/.test(head) && /Sign out/.test(head),
        'no script, ' + which + ': the title, the standing and the navigation show (' + JSON.stringify(head) + ')');
      await shot(still, 'nojs-' + which + '-1440');
      await still.close();
    }
    await bare.close();
    check(errorsFor('title') === '', 'no console errors (' + errorsFor('title') + ')');
    await ctx.close();
  },

  // Spec §15.26: the anonymous quality reports and "Report a problem".
  // Two members in a call, each sending its report every two seconds
  // (the test hook; thirty in the product): Go reads its own report log
  // and answers whether the lines share one call tag under two peer tags,
  // name each other only by tag, and name nobody — no address, no display
  // name, no meeting, no peer id. Then "Report a problem" the way a
  // person reaches it, from More: the sheet, a note, Send, and the
  // reference it shows is the one in the log. Then the switch in Devices
  // stops the automatic reports. And last, B leaves for the holding
  // screen, which offers the sheet for the call just left, and the report
  // still lands: the token works for ten minutes after the participation.
  async quality() {
    const ctxA = await newContext('member A', { cookie: cookieA });
    const ctxB = await newContext('member B', { cookie: cookieB });
    const pageA = await openRoom(ctxA);
    const pageB = await openRoom(ctxB);
    for (const page of [pageA, pageB]) await page.evaluate(() => window.meet.qualityEveryForTest(2000));
    // What a report looks like on the wire, for the record, and the proof
    // that the browser itself sends no name, address, label or meeting.
    const bodies = [];
    pageA.on('request', (req) => {
      if (req.method() === 'POST' && where({ url: () => req.url() }) === '/m' && req.url().endsWith('/quality')) {
        bodies.push(req.postData() || '');
      }
    });
    const pair = await assertPair(pageA, pageB, 'member A', 'member B');
    if (!pair) return;
    const peers = [pair.a.peer, pair.b.peer];
    const quality = (page) => page.evaluate(() => window.meet.state().quality);

    for (const [page, label] of [[pageA, 'member A'], [pageB, 'member B']]) {
      const q = await until(async () => {
        const x = await quality(page);
        return x.accepted >= 2 ? x : false;
      }, 20000);
      check(q, label + ' has had two quality reports accepted (' + JSON.stringify(q || (await quality(page))) + ')');
    }
    const wire = bodies.find((x) => x.includes('"peers"')) || bodies[0] || '';
    line('a quality report as sent: ' + wire);
    check(wire && !/paul|bea|example\.com|rslw|Board meeting/i.test(wire) && !wire.includes(sqid) &&
      !/"(?:address|ip|port|label|name|url)"/.test(wire) && !/Mozilla|AppleWebKit/.test(wire),
      'the report on the wire carries no name, address, label, meeting or user agent');
    const answer = await control('quality-check ' + peers.join(' '));
    check(answer === 'ok', 'the report log has both browsers’ quality lines under one call tag, and names nobody (' + answer + ')');

    // What "Report a problem" sends: people by short peer id, never by name.
    const anon = await pageA.evaluate(() => window.meet.diagnostics({ anonymous: true }));
    check(anon.includes('peer ' + pair.b.peer.slice(0, 6)) && !/\bbea\b|\bpaul\b/i.test(anon),
      'the anonymous diagnostics name the other person by short peer id and nobody by name');
    const named = await pageA.evaluate(() => window.meet.diagnostics());
    check(/\bbea\b/.test(named), '"Copy call diagnostics" still names people');

    // The sheet, from More.
    await pageA.click('#call-more-toggle');
    await pageA.click('#report-problem-menu');
    const opened = await until(() => pageA.evaluate(() => document.getElementById('report-sheet').open), 5000);
    check(opened, 'Report a problem opens the sheet from More');
    check(await pageA.evaluate(() => document.getElementById('call-more').hidden), 'the More menu closed behind it');
    check(await pageA.evaluate(() => document.activeElement && document.activeElement.id === 'report-note'),
      'the note field has the keyboard');
    const disclosure = await pageA.locator('#report-disclosure').textContent();
    check(disclosure === 'Sends this call’s connection diagnostics to the Calls server log. No audio or video.',
      'the sheet says what it sends (' + disclosure + ')');
    check(await pageA.getByLabel('What went wrong?').count() === 1, 'the note is labelled "What went wrong?"');
    await pageA.fill('#report-note', 'The picture froze for a few seconds.');
    check((await pageA.locator('#report-note-hint').textContent()).includes('964 of 1,000'),
      'the hint counts the characters left (' + (await pageA.locator('#report-note-hint').textContent()) + ')');
    await pageA.click('#report-send');
    const ref = await until(async () => {
      const t = ((await pageA.locator('#report-ref').textContent()) || '').trim();
      return /^[0-9A-Z]{8}$/.test(t) ? t : false;
    }, 10000);
    check(ref, 'the sheet shows a reference once sent (' + ((await pageA.locator('#report-ref').textContent()) || '') +
      ' / ' + ((await pageA.locator('#report-error').textContent()) || '') + ')');
    check((await pageA.locator('#report-done').textContent()).includes('Sent — thank you'), 'the sheet says thank you');
    check(await pageA.evaluate(() => document.activeElement && document.activeElement.id === 'report-done-title'),
      'the thanks and the reference have the keyboard, so they are read');
    if (ref) {
      const got = await control('problem-check ' + ref + ' ' + peers.join(' '));
      check(got.startsWith('ok'), 'the problem report is in the log under the reference shown (' + got + ')');
    }
    await pageA.keyboard.press('Escape');
    check(await until(() => pageA.evaluate(() => !document.getElementById('report-sheet').open), 3000), 'Escape closes the sheet');
    const back = await until(() => pageA.evaluate(() => {
      const a = document.activeElement;
      return a && a.id === 'call-more-toggle' ? a.id : false;
    }), 2000);
    check(back, 'the keyboard is back on More (' + (back || (await pageA.evaluate(() => {
      const a = document.activeElement;
      return a ? a.tagName + '#' + a.id + ' chrome=' + document.querySelector('.calls-window').dataset.chrome : 'none';
    }))) + ')');
    check(!(await state(pageA)).terminal && (await pageA.evaluate(() => window.meet.state().media.muted)) === false,
      'Escape and typing in the sheet touched neither the call nor the microphone');

    // The person's switch: off, and the reports stop.
    await pageA.click('#devices-toggle');
    const toggle = pageA.locator('#quality-row input[type="checkbox"]');
    check(await toggle.isChecked(), '"Send anonymous quality reports" is on by default');
    await pageA.locator('#quality-row label').click();
    check(!(await toggle.isChecked()) && (await pageA.evaluate(() => localStorage.getItem('calls.qualityReports'))) === 'off',
      'turning it off is remembered in this browser');
    const before = (await quality(pageA)).sent;
    await sleep(5000);
    const after = await quality(pageA);
    check(after.sent === before && after.on === false, 'no reports are sent while it is off (' + before + ' -> ' + after.sent + ')');
    await pageA.locator('#quality-row label').click();
    await pageA.click('#devices-toggle');

    // After leaving: the holding screen offers the sheet for that call.
    await leaveRoom(pageB);
    const offered = await until(async () => await pageB.locator('#report-last-open').isVisible(), 5000);
    check(offered, 'the holding screen offers "Report a problem with the last call" after leaving');
    if (offered) {
      await pageB.click('#report-last-open');
      await pageB.fill('#report-note', 'Reported after leaving.');
      await pageB.click('#report-send');
      const after = await until(async () => {
        const t = ((await pageB.locator('#report-ref').textContent()) || '').trim();
        return /^[0-9A-Z]{8}$/.test(t) ? t : false;
      }, 10000);
      check(after, 'a report from the holding screen is accepted (' + ((await pageB.locator('#report-error').textContent()) || '') + ')');
      if (after) {
        const got = await control('problem-check ' + after + ' ' + peers.join(' '));
        check(got.startsWith('ok') && got.includes('live false'),
          'the after-leave report is in the log, marked as from a participation that has ended (' + got + ')');
      }
      await pageB.click('#report-close');
    }
    const final = await control('quality-final');
    check(final === 'ok', 'leaving sent a final quality report (' + final + ')');
    check(await pageB.locator('.calls-quality-note').isVisible(), 'the holding screen discloses the quality reports');

    check(errorsFor('member A') === '', 'no console errors in A (' + errorsFor('member A') + ')');
    check(errorsFor('member B') === '', 'no console errors in B (' + errorsFor('member B') + ')');
    await leaveRoom(pageA);
    await ctxA.close();
    await ctxB.close();
  },

  async scriptless() {
    const ctx = await newContext('scriptless', { cookie: cookieA, javaScriptEnabled: false });
    const sentence = 'The call needs JavaScript to reach your camera and the other participants; everything else on this page works without it.';

    const holding = await ctx.newPage();
    await holding.goto(origin + '/m/' + sqid + '/join', { waitUntil: 'domcontentloaded' });
    check((await holding.locator('body').innerText()).includes(sentence),
      'the holding screen says what a scriptless browser cannot do');
    check(await holding.locator('#devices').isHidden(),
      'the holding screen keeps its device controls hidden with no script');

    // Share link works with no script (a POST into a new tab), and the
    // page it opens shows the link and nothing that needs script: Copy
    // link and Share… are script's, hidden until share-link.js reveals
    // them. A display rule on their row used to beat the hidden
    // attribute, leaving two buttons that did nothing (Astra on #24).
    const [share] = await Promise.all([
      ctx.waitForEvent('page'),
      holding.click('form[action$="/share"] button'),
    ]);
    await share.waitForLoadState('domcontentloaded');
    check(await share.locator('#invitation-link').isVisible(), 'no script: the Share page shows the invitation link (at ' + where(share) + ')');
    check(await share.locator('#share-actions').isHidden() && await share.locator('#copy-invitation').isHidden(),
      'no script: the Share page shows no Copy link or Share… buttons');
    await share.close();

    const room = await ctx.newPage();
    await room.goto(origin + '/m/' + sqid, { waitUntil: 'domcontentloaded' });
    const roomText = await room.locator('body').innerText();
    check(roomText.includes(sentence), 'the room page says the same');
    check(roomText.includes('Back to the holding screen'), 'the room page offers the way back');
    check(await room.locator('#room').isHidden(),
      'the room stays hidden with no script — nothing pretends to be a call');

    await ctx.close();
  },
};

// ── run it ───────────────────────────────────────────────────────────

const watchdog = setTimeout(() => {
  line('FAIL ' + scenario + ' hit the harness deadline of ' + (HARNESS_DEADLINE / 1000) + ' seconds');
  process.exit(1);
}, HARNESS_DEADLINE);
watchdog.unref();

const chosen = run[scenario];
if (!chosen) {
  line('FAIL unknown scenario: ' + scenario);
  process.exitCode = 2;
} else {
  line('scenario: ' + scenario);
  try {
    await chosen();
  } catch (e) {
    failures.push(scenario + ' threw: ' + (e && e.stack ? e.stack : e));
    line('FAIL ' + scenario + ' threw: ' + (e && e.message ? e.message : e));
    if (e && e.stack) line(e.stack);
  }
  check(cspViolations.length === 0,
    'no page reported a Content-Security-Policy violation' + (cspViolations.length ? ' (' + cspViolations.join('; ') + ')' : ''));
  if (failures.length) {
    line(failures.length + ' browser check(s) failed in ' + scenario);
    process.exitCode = 1;
  } else {
    line(scenario + ': all browser checks passed');
    process.exitCode = 0;
  }
}

await browser.close();
clearTimeout(watchdog);
// The exit code is already set; letting node end on its own is what
// guarantees the last line above is on its way out rather than
// discarded mid-flush. stdin is the only thing that would otherwise
// hold the loop open, and only when the control channel was used.
if (rl) {
  rl.close();
  process.stdin.pause();
}