From 3f70a67312d9c13d18d55da95da1139bec01c468 Mon Sep 17 00:00:00 2001
From: cppla <i@cpp.la>
Date: Tue, 22 Sep 2026 20:04:56 +0800
Subject: [PATCH 1/2] test: isolate browser connection reuse diagnostics

---
 .gitignore                                    |   1 +
 .../DIAGNOSTIC-2026-09-22.md                  |  72 +++++
 scripts/browser-connection-fixture/README.md  |  59 ++++
 scripts/browser-connection-fixture/main.go    | 288 ++++++++++++++++++
 .../browser-connection-fixture/main_test.go   | 253 +++++++++++++++
 scripts/stealth-browser/README.md             |  25 ++
 scripts/stealth-browser/run_cover.py          | 142 ++++++++-
 scripts/stealth-browser/test_run_cover.py     | 198 ++++++++++++
 8 files changed, 1037 insertions(+), 1 deletion(-)
 create mode 100644 scripts/browser-connection-fixture/DIAGNOSTIC-2026-09-22.md
 create mode 100644 scripts/browser-connection-fixture/README.md
 create mode 100644 scripts/browser-connection-fixture/main.go
 create mode 100644 scripts/browser-connection-fixture/main_test.go

diff --git a/.gitignore b/.gitignore
index 383517d..8a1c29d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 /bin/
 /dist/
 /artifacts/
+/output/playwright/
 /testdata/stealth/pcaps/
 /coverage.out
 *.prof
diff --git a/scripts/browser-connection-fixture/DIAGNOSTIC-2026-09-22.md b/scripts/browser-connection-fixture/DIAGNOSTIC-2026-09-22.md
new file mode 100644
index 0000000..5380d16
--- /dev/null
+++ b/scripts/browser-connection-fixture/DIAGNOSTIC-2026-09-22.md
@@ -0,0 +1,72 @@
+# Chrome connection reuse: bounded local diagnostic
+
+## Scope
+
+This is a six-trial, macOS arm64 loopback diagnostic, not a formal corpus,
+packet-fingerprint comparison, production benchmark or proof of
+indistinguishability. No AutoCAR client/proxy traffic was generated. The normal
+WebDriver workload and historical samples were not changed.
+
+Before paired collection, Chrome readiness passed with H3 navigation and fetch.
+Playwright Firefox 156.0 (build 1549) failed two separately recorded readiness
+attempts with `NS_ERROR_CONNECTION_REFUSED`, first at the fixture's explicit
+port and then with a default-port origin. Firefox was excluded **before** the
+paired plan was frozen; it supplies no usable samples or conclusion here. Its
+failure cause remains unresolved.
+
+## Fixed procedure
+
+- Google Chrome **153.0.8010.52**, headless, controlled by Playwright CLI
+  **0.1.21**, with a fresh isolated session for every trial.
+- Same H3-only fixture, certificate, origin (`https://127.0.0.1:53223`) and
+  browser configuration throughout. No TCP/H2 fallback or cookies set.
+- Chrome lab flags: `--enable-quic`, `--origin-to-force-quic-on=127.0.0.1:53223`,
+  the certificate-specific `--ignore-certificate-errors-spki-list`, and
+  `--no-proxy-server`; no global trust-store change.
+- Navigate to `/` and await load, then make one immediate fetch to
+  `/probe?trial=<label>` with `cache: "no-store"`. Only `credentials` changes
+  within each pair. Labels identify trials; they are not random payload seeds.
+- Fixed order: omit/same-origin, same-origin/omit, omit/same-origin. No retries.
+- Accept only HTTP 200 for both requests, browser Resource Timing `h3` for both,
+  and matching server log, response header and JSON connection identifiers.
+- Plan frozen before the first paired navigation; 540-second whole-run limit,
+  40-second trial limit. Six paired trials completed in **26.69 seconds**.
+
+## Observations
+
+IDs are allocated once per admitted physical QUIC connection, not per request.
+All six trials passed the acceptance checks.
+
+| Trial | Fetch credentials | Navigation ID | Fetch ID | Distinct connections |
+| --- | --- | ---: | ---: | ---: |
+| pair1_omit | omit | 1 | 2 | 2 |
+| pair1_same_origin | same-origin | 3 | 3 | 1 |
+| pair2_same_origin | same-origin | 4 | 4 | 1 |
+| pair2_omit | omit | 5 | 6 | 2 |
+| pair3_omit | omit | 7 | 8 | 2 |
+| pair3_same_origin | same-origin | 9 | 9 | 1 |
+
+In this environment, changing fetch credentials mode changed navigation/fetch
+connection reuse in all three pairs. This demonstrates a measurement confound
+worth controlling, not a reason to rewrite a frozen campaign or add dummy
+connections to a proxy. It does not establish behavior in Firefox, historical
+browser versions, remote Linux, or real-world browsing workloads.
+
+## Local provenance
+
+The isolated collection is retained locally under
+`output/playwright/browser-connections-20260922/`, ignored by Git. It contains
+the driver, frozen plan, CLI command outputs, server NDJSON, readiness report,
+configuration and results. Raw local artifacts and lab keys are not published;
+the hashes below identify those retained files, not independently hosted
+evidence. Browser executable/framework and runtime hashes matched before and
+after collection. Result status remains `insufficient_evidence`.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| Frozen plan | `2e2c198009c35ec1572560eb023a5aedbc024b05d8e25b6f280908c1286975de` |
+| Results | `9df847240cc8bfc87a6cb95802f32ad606d14e92c14a622e07a9a549b73a88c0` |
+| Server request log | `20e92e868a5ba526a58234b266b9131fcd0120804f393d3e6ee57169a7114157` |
+| Chrome framework | `f9a7642e684d186ccbce18204594171b4bc548276a7c9e546ef0e7ef97767ab3` |
+
+This diagnostic deliberately does not change release evidence requirements.
diff --git a/scripts/browser-connection-fixture/README.md b/scripts/browser-connection-fixture/README.md
new file mode 100644
index 0000000..ba1fb35
--- /dev/null
+++ b/scripts/browser-connection-fixture/README.md
@@ -0,0 +1,59 @@
+# Loopback HTTP/3 connection diagnostic
+
+This small test origin assigns an ID to each admitted physical QUIC connection.
+It helps inspect whether a browser navigation and subsequent fetch reuse a
+connection. It is not an AutoCAR proxy, a formal corpus generator, or a
+production traffic optimization.
+
+An explicitly limited [Chrome diagnostic](DIAGNOSTIC-2026-09-22.md) records one
+local six-trial run, including readiness failures and evidence boundaries.
+
+## Run the local fixture
+
+Provide an existing certificate whose SAN covers the chosen loopback address,
+and its matching private key with the normal AutoCAR file permissions. The
+fixture never generates or replaces credentials.
+
+```sh
+go run ./scripts/browser-connection-fixture \
+  --listen 127.0.0.1:0 \
+  --cert /absolute/path/lab.crt \
+  --key /absolute/path/lab.key \
+  --duration 180s --max-requests 64 --max-connections 32
+```
+
+Only the exact numeric addresses `127.0.0.1` and `[::1]` are allowed. Port zero
+selects a free UDP port; the first JSON stdout record reports that address.
+The server provides HTTPS over HTTP/3 only, with no TCP/H2 listener. Duration
+must be positive and at most 600 seconds; request and lifetime admitted-connection
+budgets are respectively 1–64 and 1–32. Excess requests receive 429 and excess
+connections are closed. Duration expiry or interruption stops the listener.
+
+In a fresh, dedicated browser profile configured for this lab's H3 origin and
+certificate, navigate to `/`, then fetch `/probe?trial=s1-omit` using
+`credentials: "omit"`. Repeat in another fresh profile with
+`credentials: "same-origin"` and a different trial label. Labels accept 1–32
+ASCII letters, digits, underscores or hyphens. Only body-free GET/HEAD requests
+are accepted.
+
+The response header `X-Diagnostic-Connection-ID`, `/probe` JSON and request
+log's `connection_id` identify server-observed connections within this run.
+Request logs contain only fixed fields and validated trial labels, not cookies,
+authorization headers, arbitrary URLs or peer addresses. Do not infer browser
+H3 from an exit code alone: verify navigation and fetch Resource Timing report
+`h3`, and retain browser version, launch settings and server logs. Merely opening
+an HTTPS URL does not configure H3; use browser-version-appropriate lab settings
+and certificate trust or a narrowly scoped lab pin.
+
+## Separate from the WebDriver workload diagnostic
+
+The [existing runner](../stealth-browser/README.md#optional-credentials-diagnostic)
+uses a numeric RFC1918 origin, its fixed bootstrap document and a verified
+`download_1k` payload. It rejects loopback and this fixture does not implement
+that workload contract. Its optional credentials diagnostic has a distinct
+`insufficient_evidence` receipt; the default formal workload and receipt remain
+unchanged.
+
+Keep this `/probe` experiment in its own artifact directory and label it as
+calibration/diagnosis. A local browser/version result neither reproduces an
+older frozen campaign automatically nor establishes passive indistinguishability.
diff --git a/scripts/browser-connection-fixture/main.go b/scripts/browser-connection-fixture/main.go
new file mode 100644
index 0000000..1bbb0c3
--- /dev/null
+++ b/scripts/browser-connection-fixture/main.go
@@ -0,0 +1,288 @@
+// Command browser-connection-fixture is a bounded, loopback-only diagnostic
+// origin for observing physical HTTP/3 connection reuse. It is not a proxy,
+// browser emulator, or formal packet-capture corpus generator.
+package main
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"os"
+	"os/signal"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"time"
+
+	"github.com/cppla/autocar/internal/security"
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+)
+
+const fixtureHTML = "<!doctype html><html><head><meta charset=utf-8><link rel=icon href=\"data:,\"><title>Connection diagnostic</title></head><body>Local HTTP/3 connection diagnostic.</body></html>\n"
+
+type options struct {
+	listen, cert, key           string
+	duration                    time.Duration
+	maxRequests, maxConnections int
+}
+
+func parseOptions(args []string, stderr io.Writer) (options, error) {
+	var opts options
+	fs := flag.NewFlagSet("browser-connection-fixture", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	fs.StringVar(&opts.listen, "listen", "127.0.0.1:0", "127.0.0.1 or [::1] with numeric UDP port; zero selects a free port")
+	fs.StringVar(&opts.cert, "cert", "", "existing certificate PEM (required)")
+	fs.StringVar(&opts.key, "key", "", "existing private key PEM (required)")
+	fs.DurationVar(&opts.duration, "duration", 180*time.Second, "run duration, greater than zero and at most 600s")
+	fs.IntVar(&opts.maxRequests, "max-requests", 64, "maximum handled requests, 1..64")
+	fs.IntVar(&opts.maxConnections, "max-connections", 32, "maximum admitted physical connections over this run, 1..32")
+	if err := fs.Parse(args); err != nil {
+		return opts, err
+	}
+	if fs.NArg() != 0 {
+		return opts, errors.New("positional arguments are not supported")
+	}
+	if err := validateListen(opts.listen); err != nil {
+		return opts, err
+	}
+	if opts.cert == "" || opts.key == "" {
+		return opts, errors.New("--cert and --key are required; this fixture never generates credentials")
+	}
+	if opts.duration <= 0 || opts.duration > 600*time.Second {
+		return opts, errors.New("--duration must be greater than zero and at most 600s")
+	}
+	if opts.maxRequests < 1 || opts.maxRequests > 64 || opts.maxConnections < 1 || opts.maxConnections > 32 {
+		return opts, errors.New("request/connection budgets must be in 1..64 and 1..32 respectively")
+	}
+	return opts, nil
+}
+
+func validateListen(address string) error {
+	host, port, err := net.SplitHostPort(address)
+	if err != nil {
+		return errors.New("--listen must be 127.0.0.1:numeric-port or [::1]:numeric-port")
+	}
+	ip, err := netip.ParseAddr(host)
+	if err != nil || (ip != netip.MustParseAddr("127.0.0.1") && ip != netip.IPv6Loopback()) {
+		return errors.New("--listen permits only the exact numeric addresses 127.0.0.1 and ::1")
+	}
+	if port == "" {
+		return errors.New("--listen requires a numeric port")
+	}
+	for _, digit := range port {
+		if digit < '0' || digit > '9' {
+			return errors.New("--listen requires a numeric port")
+		}
+	}
+	if _, err := strconv.ParseUint(port, 10, 16); err != nil {
+		return errors.New("--listen port must be in 0..65535")
+	}
+	return nil
+}
+
+type jsonLog struct {
+	mu  sync.Mutex
+	out io.Writer
+}
+
+func (log *jsonLog) write(value any) error {
+	log.mu.Lock()
+	defer log.mu.Unlock()
+	return json.NewEncoder(log.out).Encode(value)
+}
+
+type connectionKey struct{}
+
+type requestRecord struct {
+	Kind         string `json:"kind"`
+	ConnectionID uint64 `json:"connection_id"`
+	Path         string `json:"path"`
+	Trial        string `json:"trial"`
+	Protocol     string `json:"protocol"`
+}
+
+type fixture struct {
+	log         *jsonLog
+	maxRequests uint64
+	requests    atomic.Uint64
+	connections atomic.Uint64
+	stop        context.CancelFunc
+}
+
+func validTrial(value string) bool {
+	if len(value) < 1 || len(value) > 32 {
+		return false
+	}
+	for _, c := range value {
+		if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-') {
+			return false
+		}
+	}
+	return true
+}
+
+func (f *fixture) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	defer r.Body.Close()
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	if f.requests.Add(1) > f.maxRequests {
+		http.Error(w, "request budget exhausted", http.StatusTooManyRequests)
+		return
+	}
+	id, _ := r.Context().Value(connectionKey{}).(uint64)
+	path := "<other>"
+	if r.URL.Path == "/" || r.URL.Path == "/probe" {
+		path = r.URL.Path
+	}
+	trial := ""
+	query, queryErr := url.ParseQuery(r.URL.RawQuery)
+	queryValid := queryErr == nil && len(r.URL.RawQuery) <= 128
+	if path == "/probe" {
+		values := query["trial"]
+		queryValid = queryValid && len(query) == 1 && len(values) == 1 && validTrial(values[0])
+		if queryValid {
+			trial = values[0]
+		}
+	} else {
+		queryValid = queryValid && r.URL.RawQuery == ""
+	}
+	// Never log arbitrary URL text, query values, headers, or peer addresses.
+	if err := f.log.write(requestRecord{"request", id, path, trial, "HTTP/3.0"}); err != nil {
+		f.stop()
+		http.Error(w, "diagnostic output unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	w.Header().Set("X-Diagnostic-Connection-ID", strconv.FormatUint(id, 10))
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		w.Header().Set("Allow", "GET, HEAD")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	// The fixture accepts no request bodies. Closing the stream cancels any
+	// unread body; QUIC receive windows independently bound buffered input.
+	if r.ContentLength > 0 || len(r.TransferEncoding) != 0 {
+		http.Error(w, "request bodies are not accepted", http.StatusBadRequest)
+		return
+	}
+	// HTTP/3 GETs commonly omit content-length and arrive as -1 even with no
+	// body. Read at most one byte with a stream deadline to distinguish EOF
+	// from an actual body without accepting unbounded or stalled input.
+	if r.ContentLength < 0 {
+		if err := http.NewResponseController(w).SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+			http.Error(w, "request stream deadline unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		body, err := io.ReadAll(io.LimitReader(r.Body, 1))
+		if err != nil || len(body) != 0 {
+			http.Error(w, "request bodies are not accepted", http.StatusBadRequest)
+			return
+		}
+	}
+	if path == "<other>" {
+		http.NotFound(w, r)
+		return
+	}
+	if !queryValid {
+		http.Error(w, "invalid diagnostic query", http.StatusBadRequest)
+		return
+	}
+	if path == "/" {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Header().Set("Content-Security-Policy", "default-src 'none'; connect-src 'self'; img-src data:")
+		if r.Method == http.MethodGet {
+			_, _ = io.WriteString(w, fixtureHTML)
+		}
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	if r.Method == http.MethodGet {
+		_ = json.NewEncoder(w).Encode(struct {
+			ConnectionID uint64 `json:"connection_id"`
+			Protocol     string `json:"protocol"`
+		}{id, "HTTP/3.0"})
+	}
+}
+
+func run(ctx context.Context, args []string, stdout, stderr io.Writer) error {
+	opts, err := parseOptions(args, stderr)
+	if err != nil {
+		return err
+	}
+	certificate, err := security.LoadKeyPair(opts.cert, opts.key)
+	if err != nil {
+		return errors.New("could not load the existing certificate/private key")
+	}
+	ctx, cancel := context.WithTimeout(ctx, opts.duration)
+	defer cancel()
+	packet, err := net.ListenPacket("udp", opts.listen)
+	if err != nil {
+		return errors.New("could not bind the loopback UDP listener")
+	}
+	defer packet.Close()
+	f := &fixture{log: &jsonLog{out: stdout}, maxRequests: uint64(opts.maxRequests), stop: cancel}
+	server := &http3.Server{
+		Handler: f, MaxHeaderBytes: 4096, IdleTimeout: 30 * time.Second,
+		TLSConfig: &tls.Config{MinVersion: tls.VersionTLS13, MaxVersion: tls.VersionTLS13,
+			Certificates: []tls.Certificate{certificate}, NextProtos: []string{http3.NextProtoH3}},
+		QUICConfig: &quic.Config{HandshakeIdleTimeout: 5 * time.Second, MaxIdleTimeout: 30 * time.Second,
+			MaxIncomingStreams: 8, MaxIncomingUniStreams: 3,
+			InitialStreamReceiveWindow: 16 << 10, MaxStreamReceiveWindow: 16 << 10,
+			InitialConnectionReceiveWindow: 128 << 10, MaxConnectionReceiveWindow: 128 << 10},
+		Logger: slog.New(slog.NewTextHandler(io.Discard, nil)),
+		ConnContext: func(ctx context.Context, conn *quic.Conn) context.Context {
+			id := f.connections.Add(1)
+			if id > uint64(opts.maxConnections) {
+				_ = conn.CloseWithError(0x100, "connection budget exhausted")
+			}
+			return context.WithValue(ctx, connectionKey{}, id)
+		},
+	}
+	listener, err := quic.Listen(packet, http3.ConfigureTLSConfig(server.TLSConfig), server.QUICConfig)
+	if err != nil {
+		return errors.New("could not initialize the HTTP/3 QUIC listener")
+	}
+	defer listener.Close()
+	defer server.Close()
+	done := make(chan error, 1)
+	go func() { done <- server.ServeListener(listener) }()
+	if err := f.log.write(struct {
+		Kind    string `json:"kind"`
+		Address string `json:"address"`
+	}{"ready", packet.LocalAddr().String()}); err != nil {
+		return errors.New("could not write diagnostic startup record")
+	}
+	select {
+	case err := <-done:
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			return errors.New("HTTP/3 diagnostic listener stopped unexpectedly")
+		}
+	case <-ctx.Done():
+		shutdown, stop := context.WithTimeout(context.Background(), 2*time.Second)
+		_ = server.Shutdown(shutdown)
+		stop()
+		_ = server.Close()
+		_ = packet.Close()
+		<-done
+	}
+	return nil
+}
+
+func main() {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	if err := run(ctx, os.Args[1:], os.Stdout, os.Stderr); err != nil && !errors.Is(err, flag.ErrHelp) {
+		fmt.Fprintln(os.Stderr, "fixture:", err)
+		os.Exit(1)
+	}
+}
diff --git a/scripts/browser-connection-fixture/main_test.go b/scripts/browser-connection-fixture/main_test.go
new file mode 100644
index 0000000..5b65b75
--- /dev/null
+++ b/scripts/browser-connection-fixture/main_test.go
@@ -0,0 +1,253 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cppla/autocar/internal/security"
+	"github.com/quic-go/quic-go/http3"
+)
+
+type collectedLog struct {
+	mu    sync.Mutex
+	data  bytes.Buffer
+	ready chan string
+}
+
+func (log *collectedLog) Write(data []byte) (int, error) {
+	log.mu.Lock()
+	defer log.mu.Unlock()
+	_, _ = log.data.Write(data)
+	var record struct{ Kind, Address string }
+	if json.Unmarshal(data, &record) == nil && record.Kind == "ready" {
+		log.ready <- record.Address
+	}
+	return len(data), nil
+}
+
+func (log *collectedLog) text() string {
+	log.mu.Lock()
+	defer log.mu.Unlock()
+	return log.data.String()
+}
+
+func startFixture(t *testing.T, extra ...string) (string, *x509.CertPool, *collectedLog) {
+	t.Helper()
+	cert, key, err := security.GenerateSelfSignedCertificate(security.CertificateOptions{
+		Hosts: []string{"127.0.0.1", "::1"}, ValidFor: time.Hour,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	certPath, keyPath := filepath.Join(dir, "cert.pem"), filepath.Join(dir, "key.pem")
+	if err := os.WriteFile(certPath, cert, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(keyPath, key, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	roots := x509.NewCertPool()
+	if !roots.AppendCertsFromPEM(cert) {
+		t.Fatal("load test trust anchor")
+	}
+	log := &collectedLog{ready: make(chan string, 1)}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	args := append([]string{"--cert", certPath, "--key", keyPath, "--duration=20s"}, extra...)
+	go func() { done <- run(ctx, args, log, io.Discard) }()
+	t.Cleanup(func() {
+		cancel()
+		select {
+		case err := <-done:
+			if err != nil {
+				t.Errorf("fixture shutdown: %v", err)
+			}
+		case <-time.After(5 * time.Second):
+			t.Error("fixture did not stop")
+		}
+	})
+	select {
+	case address := <-log.ready:
+		return "https://" + address, roots, log
+	case <-time.After(5 * time.Second):
+		t.Fatal("fixture did not become ready")
+	}
+	return "", nil, nil
+}
+
+func h3Client(t *testing.T, roots *x509.CertPool) *http.Client {
+	t.Helper()
+	transport := &http3.Transport{TLSClientConfig: &tls.Config{
+		MinVersion: tls.VersionTLS13, RootCAs: roots,
+	}}
+	t.Cleanup(func() { _ = transport.Close() })
+	return &http.Client{Transport: transport, Timeout: 3 * time.Second}
+}
+
+func get(t *testing.T, client *http.Client, address string) (int, uint64, []byte) {
+	t.Helper()
+	request, err := http.NewRequest(http.MethodGet, address, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request.Header.Set("Cookie", "cookie=PRIVATE_COOKIE")
+	request.Header.Set("Authorization", "Bearer PRIVATE_AUTH")
+	response, err := client.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close()
+	if response.ProtoMajor != 3 {
+		t.Fatalf("protocol = %s", response.Proto)
+	}
+	body, err := io.ReadAll(io.LimitReader(response.Body, 4096))
+	if err != nil {
+		t.Fatal(err)
+	}
+	id, _ := strconv.ParseUint(response.Header.Get("X-Diagnostic-Connection-ID"), 10, 64)
+	return response.StatusCode, id, body
+}
+
+func TestPhysicalConnectionIdentityAndPrivateLogs(t *testing.T) {
+	address, roots, log := startFixture(t)
+	first := h3Client(t, roots)
+	status, rootID, html := get(t, first, address+"/")
+	if status != http.StatusOK || rootID == 0 || !bytes.Contains(html, []byte("data:,")) {
+		t.Fatalf("root response: status=%d id=%d", status, rootID)
+	}
+	for _, trial := range []string{"a_1", "b-2"} {
+		status, id, body := get(t, first, address+"/probe?trial="+trial)
+		var result struct {
+			ConnectionID uint64 `json:"connection_id"`
+			Protocol     string `json:"protocol"`
+		}
+		if err := json.Unmarshal(body, &result); err != nil {
+			t.Fatal(err)
+		}
+		if status != http.StatusOK || id != rootID || result.ConnectionID != rootID || result.Protocol != "HTTP/3.0" {
+			t.Fatalf("same transport did not reuse physical connection: status=%d id=%d result=%+v", status, id, result)
+		}
+	}
+	status, secondID, _ := get(t, h3Client(t, roots), address+"/probe?trial=second")
+	if status != http.StatusOK || secondID <= rootID {
+		t.Fatal("separate transport did not receive a new monotonic connection ID")
+	}
+	status, _, _ = get(t, first, address+"/probe?trial=valid&token=PRIVATE_QUERY")
+	if status != http.StatusBadRequest {
+		t.Fatalf("unexpected query status=%d", status)
+	}
+	status, _, _ = get(t, first, address+"/PRIVATE_PATH?password=PRIVATE_QUERY")
+	if status != http.StatusNotFound {
+		t.Fatalf("unknown path status=%d", status)
+	}
+	output := log.text()
+	for _, forbidden := range []string{"PRIVATE_", "Authorization", "Cookie", "remote", "127.0.0.1"} {
+		// The ready line intentionally contains the numeric listener address;
+		// request records must contain no peer addresses or credentials.
+		requests := output[strings.IndexByte(output, '\n')+1:]
+		if strings.Contains(requests, forbidden) {
+			t.Fatalf("diagnostic log contains forbidden text %q", forbidden)
+		}
+	}
+	for _, line := range strings.Split(strings.TrimSpace(output), "\n")[1:] {
+		var record map[string]any
+		if err := json.Unmarshal([]byte(line), &record); err != nil {
+			t.Fatal(err)
+		}
+		if len(record) != 5 {
+			t.Fatalf("unexpected request log fields: %v", record)
+		}
+	}
+}
+
+func TestOptionsAreLoopbackAndBounded(t *testing.T) {
+	for _, address := range []string{"127.0.0.1:0", "127.0.0.1:65535", "[::1]:0"} {
+		if err := validateListen(address); err != nil {
+			t.Errorf("valid address %s: %v", address, err)
+		}
+	}
+	for _, address := range []string{"localhost:443", ":443", "0.0.0.0:443", "127.0.0.2:443", "[::]:443", "[::ffff:127.0.0.1]:443", "127.0.0.1:http", "127.0.0.1:+1", "127.0.0.1:-1", "127.0.0.1:65536"} {
+		if err := validateListen(address); err == nil {
+			t.Errorf("accepted unsafe address %s", address)
+		}
+	}
+	for _, option := range []string{"--duration=0", "--duration=601s", "--max-requests=0", "--max-requests=65", "--max-connections=0", "--max-connections=33", "positional"} {
+		if _, err := parseOptions([]string{"--cert=cert", "--key=key", option}, io.Discard); err == nil {
+			t.Errorf("accepted invalid option %s", option)
+		}
+	}
+	if _, err := parseOptions(nil, io.Discard); err == nil {
+		t.Fatal("accepted missing credentials")
+	}
+	opts, err := parseOptions([]string{"--cert=cert", "--key=key"}, io.Discard)
+	if err != nil || opts.duration != 180*time.Second || opts.maxRequests != 64 || opts.maxConnections != 32 {
+		t.Fatalf("defaults=%+v error=%v", opts, err)
+	}
+}
+
+func TestHandlerRejectsBodiesMethodsAndInvalidTrials(t *testing.T) {
+	for _, test := range []struct {
+		method, path, body string
+		status             int
+	}{
+		{"HEAD", "/probe?trial=head", "", 200},
+		{"GET", "/probe", "", 400},
+		{"GET", "/probe?trial=a&trial=b", "", 400},
+		{"GET", "/probe?trial=PRIVATE%0AQUERY", "", 400},
+		{"GET", "/probe?trial=%FF", "", 400},
+		{"GET", "/probe?trial=" + strings.Repeat("a", 33), "", 400},
+		{"GET", "/probe?trial=body", "PRIVATE_BODY", 400},
+		{"POST", "/probe?trial=method", "PRIVATE_BODY", 405},
+		{"GET", "/unknown", "", 404},
+	} {
+		t.Run(test.method+test.path, func(t *testing.T) {
+			var output bytes.Buffer
+			f := &fixture{log: &jsonLog{out: &output}, maxRequests: 1, stop: func() {}}
+			request := httptest.NewRequest(test.method, test.path, strings.NewReader(test.body))
+			request = request.WithContext(context.WithValue(request.Context(), connectionKey{}, uint64(1)))
+			response := httptest.NewRecorder()
+			f.ServeHTTP(response, request)
+			if response.Code != test.status {
+				t.Fatalf("status=%d want=%d", response.Code, test.status)
+			}
+			if test.method == "HEAD" && response.Body.Len() != 0 {
+				t.Fatal("HEAD returned a body")
+			}
+			if strings.Contains(output.String(), "PRIVATE") {
+				t.Fatal("logged rejected request contents")
+			}
+			exhausted := httptest.NewRecorder()
+			f.ServeHTTP(exhausted, httptest.NewRequest("GET", "/", nil))
+			if exhausted.Code != 429 || strings.Count(output.String(), "\n") != 1 {
+				t.Fatal("request budget did not bound handling/log output")
+			}
+		})
+	}
+}
+
+func TestConnectionBudget(t *testing.T) {
+	address, roots, _ := startFixture(t, "--max-connections=1")
+	status, _, _ := get(t, h3Client(t, roots), address+"/probe?trial=first")
+	if status != 200 {
+		t.Fatal("first connection rejected")
+	}
+	response, err := h3Client(t, roots).Get(address + "/probe?trial=second")
+	if err == nil {
+		response.Body.Close()
+		t.Fatal("accepted a connection beyond the run budget")
+	}
+}
diff --git a/scripts/stealth-browser/README.md b/scripts/stealth-browser/README.md
index 4419a0e..7d2c69c 100644
--- a/scripts/stealth-browser/README.md
+++ b/scripts/stealth-browser/README.md
@@ -85,9 +85,12 @@ docker run --rm --network '<owned-internal-network>' \
   --server 10.203.0.10:8443 \
   --workload download_128k \
   --seed 12345 \
+  --certificate-spki-sha256 '<canonical leaf SPKI SHA-256 in Base64>' \
   --accept-insecure-certs
 ```
 
+Replace the SPKI placeholder with the lab certificate's pin; Chromium H3
+requires it. Do not supply this option to Firefox or an H2 run.
 `--accept-insecure-certs` is an explicit option for an isolated, owned RFC1918
 lab certificate. Omit it when the runner image already trusts the lab CA.
 
@@ -96,6 +99,28 @@ receipt fields. Browser and WebDriver diagnostics never share stdout. Any
 navigation, payload, result-length, Resource Timing, identity, or requested
 protocol mismatch exits nonzero without printing a success receipt.
 
+## Optional credentials diagnostic
+
+For a separate connection-reuse diagnostic, add
+`--diagnostic-fetch-credentials omit` or
+`--diagnostic-fetch-credentials same-origin` to an otherwise working invocation
+with **`--protocol h3 --workload download_1k`**. The runner still verifies the
+bootstrap navigation, response bytes, browser identity and actual H3 protocol;
+only the subsequent fetch's credentials mode changes.
+
+Without the option, the frozen workload, 13-field formal receipt and result
+hash remain unchanged. Explicit `omit` is diagnostic too: both treatments emit
+the distinct `browser-h3-credentials-diagnostic` kind with
+`status: insufficient_evidence` and `execution_status: pass`. The digest binds
+the treatment; these receipts cannot be submitted as formal campaign evidence.
+Keep their outputs in a separate diagnostic artifact directory, without
+rewriting prior captures or preregistrations.
+
+This workflow still requires the RFC1918 fixture contract above. The separate
+[loopback connection fixture](../browser-connection-fixture/README.md) serves
+`/probe` instead and is **not** an interchangeable server for this runner.
+Neither diagnostic is the formal corpus or a production traffic optimization.
+
 Offline checks do not start Docker, a browser, or a network listener:
 
 ```sh
diff --git a/scripts/stealth-browser/run_cover.py b/scripts/stealth-browser/run_cover.py
index 1684f68..7710063 100755
--- a/scripts/stealth-browser/run_cover.py
+++ b/scripts/stealth-browser/run_cover.py
@@ -31,6 +31,8 @@
 
 SCHEMA_VERSION = 1
 KIND = "real-browser-workload"
+DIAGNOSTIC_KIND = "browser-h3-credentials-diagnostic"
+DIAGNOSTIC_FETCH_CREDENTIALS = ("omit", "same-origin")
 RFC1918 = (
     ipaddress.ip_network("10.0.0.0/8"),
     ipaddress.ip_network("172.16.0.0/12"),
@@ -91,6 +93,9 @@
     "response_bytes",
     "result_sha256",
 }
+DIAGNOSTIC_SUCCESS_FIELDS = SUCCESS_FIELDS | {
+    "execution_status", "fetch_credentials", "evidence_scope",
+}
 
 
 BOOTSTRAP_VERIFY_SCRIPT = r"""
@@ -278,6 +283,41 @@ class UsageError(RunnerError):
     pass
 
 
+def validate_diagnostic_credentials(
+    credentials: Optional[str], protocol: str, workload: str
+) -> Optional[str]:
+    if credentials is None:
+        return None
+    if credentials not in DIAGNOSTIC_FETCH_CREDENTIALS:
+        raise UsageError("diagnostic fetch credentials must be omit or same-origin")
+    if protocol != "h3" or workload != "download_1k":
+        raise UsageError("--diagnostic-fetch-credentials requires --protocol h3 --workload download_1k")
+    return credentials
+
+
+def diagnostic_workload_script() -> str:
+    # Preserve the frozen ordinary workload byte-for-byte. The diagnostic
+    # receives its sole treatment through a WebDriver argument, never source
+    # interpolation. Echo it in the result so a stale script cannot be scored
+    # as though it applied the requested treatment.
+    credentials_literal = 'credentials: "omit",'
+    success_literal = "    ok: true,\n    request_count:"
+    if WORKLOAD_SCRIPT.count(credentials_literal) != 1 or WORKLOAD_SCRIPT.count(success_literal) != 1:
+        raise RunnerError("diagnostic workload anchors differ from the frozen script")
+    script = WORKLOAD_SCRIPT.replace(credentials_literal, "credentials: diagnosticFetchCredentials,")
+    script = script.replace(
+        success_literal,
+        "    ok: true,\n    fetch_credentials: diagnosticFetchCredentials,\n    request_count:",
+    )
+    return (
+        "const diagnosticFetchCredentials = arguments[3];\n"
+        'if (!["omit", "same-origin"].includes(diagnosticFetchCredentials)) {\n'
+        '  arguments[arguments.length - 1]({ok: false, error: "invalid diagnostic fetch credentials"});\n'
+        "  return;\n"
+        "}\n" + script
+    )
+
+
 class StrictArgumentParser(argparse.ArgumentParser):
     def error(self, message: str) -> None:
         raise UsageError(message)
@@ -803,7 +843,61 @@ def workload_receipt(
     return receipt
 
 
+def diagnostic_workload_receipt(
+    identity: BrowserIdentity,
+    protocol: str,
+    workload: str,
+    seed: int,
+    result: Mapping[str, Any],
+    credentials: str,
+) -> Dict[str, Any]:
+    if credentials is None:
+        raise UsageError("a diagnostic receipt requires an explicit fetch credentials mode")
+    validate_diagnostic_credentials(credentials, protocol, workload)
+    # Domain-separate both the receipt and its digest. There is deliberately
+    # no nested ordinary success receipt to extract into a formal campaign.
+    result_document = {
+        "kind": DIAGNOSTIC_KIND,
+        "fetch_credentials": credentials,
+        "evidence_scope": "calibration-only",
+        "protocol": protocol,
+        "workload": workload,
+        "sample_seed": seed,
+        "request_count": result["request_count"],
+        "response_bytes": result["response_bytes"],
+        "upload_bytes": result["upload_bytes"],
+        "resources": [
+            {"request_index": index, "next_hop_protocol": next_hop}
+            for index, next_hop in zip(result["resource_indexes"], result["next_hop_protocols"])
+        ],
+    }
+    receipt = {
+        "schema_version": SCHEMA_VERSION,
+        "status": "insufficient_evidence",
+        "execution_status": "pass",
+        "kind": DIAGNOSTIC_KIND,
+        "evidence_scope": "calibration-only",
+        "fetch_credentials": credentials,
+        "client_implementation": identity.client_implementation,
+        "implementation_version": identity.implementation_version,
+        "browser_binary_sha256": identity.browser_binary_sha256,
+        "protocol": protocol,
+        "workload": workload,
+        "sample_seed": seed,
+        "next_hop_protocols": list(result["next_hop_protocols"]),
+        "request_count": result["request_count"],
+        "response_bytes": result["response_bytes"],
+        "result_sha256": canonical_json_sha256(result_document),
+    }
+    if set(receipt) != DIAGNOSTIC_SUCCESS_FIELDS:
+        raise AssertionError("diagnostic receipt fields changed")
+    return receipt
+
+
 def execute_browser_workload(args: argparse.Namespace) -> Dict[str, Any]:
+    diagnostic_credentials = validate_diagnostic_credentials(
+        getattr(args, "diagnostic_fetch_credentials", None), args.protocol, args.workload
+    )
     server = parse_server(args.server)
     identity = load_browser_identity(Path(args.browser_lock), args.browser)
     profile_root = Path(args.runtime_directory)
@@ -858,12 +952,26 @@ def execute_browser_workload(args: argparse.Namespace) -> Dict[str, Any]:
                 {"script": BOOTSTRAP_VERIFY_SCRIPT, "args": [args.seed]},
             )
             validate_bootstrap_result(bootstrap_result, args.protocol, args.seed)
+            script = WORKLOAD_SCRIPT
+            script_args = [args.workload, args.seed, args.idle_milliseconds]
+            if diagnostic_credentials is not None:
+                script = diagnostic_workload_script()
+                script_args.append(diagnostic_credentials)
             raw_result = client.request(
                 "POST",
                 "/session/%s/execute/async" % session_id,
-                {"script": WORKLOAD_SCRIPT, "args": [args.workload, args.seed, args.idle_milliseconds]},
+                {"script": script, "args": script_args},
             )
+            if diagnostic_credentials is not None and (
+                not isinstance(raw_result, dict)
+                or raw_result.get("fetch_credentials") != diagnostic_credentials
+            ):
+                raise RunnerError("browser diagnostic did not confirm the requested fetch credentials")
             checked = validate_workload_result(raw_result, args.workload, args.protocol)
+            if diagnostic_credentials is not None:
+                return diagnostic_workload_receipt(
+                    identity, args.protocol, args.workload, args.seed, checked, diagnostic_credentials
+                )
             return workload_receipt(identity, args.protocol, args.workload, args.seed, checked)
         finally:
             if session_id is not None:
@@ -881,6 +989,10 @@ def parser() -> StrictArgumentParser:
     result.add_argument("--server", required=True)
     result.add_argument("--workload", required=True, choices=tuple(WORKLOAD_SPECS))
     result.add_argument("--seed", required=True, type=parse_seed)
+    result.add_argument(
+        "--diagnostic-fetch-credentials", choices=DIAGNOSTIC_FETCH_CREDENTIALS,
+        help="diagnostic-only H3 download_1k treatment; emits non-campaign evidence even for omit",
+    )
     result.add_argument(
         "--browser-lock", default=os.environ.get("STEALTH_BROWSER_LOCK", "/campaign/browser-lock.json")
     )
@@ -968,6 +1080,33 @@ def self_test() -> None:
     receipt = workload_receipt(fake, "h2", "browser_h2", 7, checked)
     assert set(receipt) == SUCCESS_FIELDS and receipt["workload"] == "browser_h2"
     assert SHA256_RE.fullmatch(receipt["result_sha256"])
+    diagnostic_result = validate_workload_result({
+        "ok": True, "request_count": 1, "response_bytes": 1024, "upload_bytes": 0,
+        "resources": [{"request_index": 0, "next_hop_protocol": "h3"}],
+    }, "download_1k", "h3")
+    assert validate_diagnostic_credentials(None, "h2", "browser_h2") is None
+    assert "credentials: diagnosticFetchCredentials," in diagnostic_workload_script()
+    diagnostic_hashes = set()
+    for credentials in DIAGNOSTIC_FETCH_CREDENTIALS:
+        diagnostic_receipt = diagnostic_workload_receipt(
+            fake, "h3", "download_1k", 7, diagnostic_result, credentials
+        )
+        assert set(diagnostic_receipt) == DIAGNOSTIC_SUCCESS_FIELDS
+        assert diagnostic_receipt["kind"] == DIAGNOSTIC_KIND
+        assert diagnostic_receipt["status"] == "insufficient_evidence"
+        assert diagnostic_receipt["fetch_credentials"] == credentials
+        diagnostic_hashes.add(diagnostic_receipt["result_sha256"])
+    diagnostic_hashes.add(workload_receipt(fake, "h3", "download_1k", 7, diagnostic_result)["result_sha256"])
+    assert len(diagnostic_hashes) == 3
+    for credentials, protocol, workload in (
+        ("include", "h3", "download_1k"), ("omit", "h2", "download_1k"), ("omit", "h3", "idle"),
+    ):
+        try:
+            validate_diagnostic_credentials(credentials, protocol, workload)
+        except UsageError:
+            pass
+        else:
+            raise AssertionError("invalid diagnostic treatment was accepted")
     assert "--disable-quic" in browser_capabilities(
         fake, "h2", parse_server("10.0.0.1:443"), Path("/tmp/profile"), False, None
     )["goog:chromeOptions"]["args"]
@@ -1028,6 +1167,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
             )
             return 0
         args = parser().parse_args(values)
+        validate_diagnostic_credentials(args.diagnostic_fetch_credentials, args.protocol, args.workload)
         validate_certificate_spki_usage(
             args.browser, args.protocol, args.certificate_spki_sha256
         )
diff --git a/scripts/stealth-browser/test_run_cover.py b/scripts/stealth-browser/test_run_cover.py
index de8afba..76e96a3 100755
--- a/scripts/stealth-browser/test_run_cover.py
+++ b/scripts/stealth-browser/test_run_cover.py
@@ -9,6 +9,7 @@
 import io
 import json
 from pathlib import Path
+import runpy
 import stat
 import sys
 import tempfile
@@ -477,5 +478,202 @@ def test_success_stdout_is_exactly_one_compact_receipt_and_failure_is_silent(sel
         self.assertIn("outside RFC1918", stderr.getvalue())
 
 
+class BrowserDiagnosticTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.identity = run_cover.BrowserIdentity(
+            "chromium", "Chromium", "Chromium 151.0.1.2",
+            "/usr/lib/chromium/chromium", "a" * 64,
+            "/usr/bin/chromedriver", "ChromeDriver 151.0.1.2", "b" * 64,
+        )
+        self.raw_workload = {
+            "ok": True,
+            "request_count": 1,
+            "response_bytes": 1024,
+            "upload_bytes": 0,
+            "resources": [{"request_index": 0, "next_hop_protocol": "h3"}],
+        }
+        self.checked = run_cover.validate_workload_result(self.raw_workload, "download_1k", "h3")
+        self.cli = [
+            "--browser", "chromium", "--protocol", "h3", "--server", "10.0.0.2:8443",
+            "--workload", "download_1k", "--seed", "5", "--certificate-spki-sha256", SPKI_PIN,
+        ]
+
+    @contextlib.contextmanager
+    def execution(self, credentials: str | None, raw_workload: dict | None = None):
+        raw = dict(self.raw_workload) if raw_workload is None else dict(raw_workload)
+        if raw_workload is None and credentials is not None:
+            raw["fetch_credentials"] = credentials
+        webdriver = mock.Mock()
+        webdriver.create_session.return_value = (
+            "session-1", {"browserName": "chrome", "browserVersion": "151.0.1.2"}
+        )
+        webdriver.request.side_effect = [
+            None, None, {"ok": True, "sample_seed": 5, "next_hop_protocol": "h3"}, raw, None,
+        ]
+        process = mock.Mock()
+        process.poll.return_value = None
+        args = run_cover.parser().parse_args(self.cli)
+        args.diagnostic_fetch_credentials = credentials
+        with tempfile.TemporaryDirectory() as directory:
+            args.runtime_directory = directory
+            with mock.patch.object(run_cover, "load_browser_identity", return_value=self.identity), \
+                    mock.patch.object(run_cover, "free_loopback_port", return_value=49151), \
+                    mock.patch.object(run_cover.subprocess, "Popen", return_value=process), \
+                    mock.patch.object(run_cover, "WebDriverClient", return_value=webdriver), \
+                    mock.patch.object(run_cover, "stop_process_group") as stop:
+                yield args, webdriver, stop
+
+    def test_default_scripts_and_receipt_contract_are_unchanged(self) -> None:
+        self.assertEqual(
+            hashlib.sha256(run_cover.WORKLOAD_SCRIPT.encode()).hexdigest(),
+            "48d93f56ad103ef7859eb8699d3bbcdb5fce4d787969922dc5bd1fa77c6bdac7",
+        )
+        self.assertEqual(
+            hashlib.sha256(run_cover.BOOTSTRAP_VERIFY_SCRIPT.encode()).hexdigest(),
+            "7d486176be671bcf7080e0d530913484145572e9f8915f08d8974e60653d9235",
+        )
+        self.assertIsNone(run_cover.parser().parse_args(self.cli).diagnostic_fetch_credentials)
+        with self.execution(None) as (args, webdriver, stop):
+            receipt = run_cover.execute_browser_workload(args)
+        payload = webdriver.request.call_args_list[3].args[2]
+        self.assertEqual(payload, {
+            "script": run_cover.WORKLOAD_SCRIPT,
+            "args": ["download_1k", 5, 1200],
+        })
+        self.assertEqual(set(receipt), run_cover.SUCCESS_FIELDS)
+        self.assertEqual(len(receipt), 13)
+        self.assertEqual(receipt["kind"], "real-browser-workload")
+        self.assertEqual(receipt["status"], "pass")
+        self.assertEqual(
+            receipt["result_sha256"],
+            run_cover.canonical_json_sha256({
+                "protocol": "h3", "workload": "download_1k", "sample_seed": 5,
+                "request_count": 1, "response_bytes": 1024, "upload_bytes": 0,
+                "resources": [{"request_index": 0, "next_hop_protocol": "h3"}],
+            }),
+        )
+        stop.assert_called_once()
+
+    def test_both_diagnostic_modes_are_explicitly_marked_and_passed_as_arguments(self) -> None:
+        for credentials in ("omit", "same-origin"):
+            with self.subTest(credentials=credentials):
+                parsed = run_cover.parser().parse_args(self.cli + ["--diagnostic-fetch-credentials", credentials])
+                self.assertEqual(parsed.diagnostic_fetch_credentials, credentials)
+                with self.execution(credentials) as (args, webdriver, stop):
+                    receipt = run_cover.execute_browser_workload(args)
+                payload = webdriver.request.call_args_list[3].args[2]
+                self.assertEqual(payload["script"], run_cover.diagnostic_workload_script())
+                self.assertEqual(payload["args"], ["download_1k", 5, 1200, credentials])
+                self.assertEqual(webdriver.request.call_args_list[1].args[2]["url"],
+                                 "https://10.0.0.2:8443/?autocar_browser_sample=5")
+                self.assertEqual(set(receipt), run_cover.DIAGNOSTIC_SUCCESS_FIELDS)
+                self.assertEqual(receipt["kind"], run_cover.DIAGNOSTIC_KIND)
+                self.assertEqual(receipt["status"], "insufficient_evidence")
+                self.assertEqual(receipt["execution_status"], "pass")
+                self.assertEqual(receipt["fetch_credentials"], credentials)
+                self.assertEqual(receipt["evidence_scope"], "calibration-only")
+                self.assertFalse(any(isinstance(value, dict) for value in receipt.values()))
+                self.assertEqual(webdriver.request.call_args_list[-1].args[0], "DELETE")
+                stop.assert_called_once()
+
+    def test_diagnostic_script_uses_validated_argument_not_interpolation(self) -> None:
+        script = run_cover.diagnostic_workload_script()
+        self.assertIn("const diagnosticFetchCredentials = arguments[3];", script)
+        self.assertIn("credentials: diagnosticFetchCredentials,", script)
+        self.assertIn("fetch_credentials: diagnosticFetchCredentials,", script)
+        self.assertNotIn('credentials: "omit",', script)
+        with mock.patch.object(run_cover, "WORKLOAD_SCRIPT", "different workload"):
+            with self.assertRaisesRegex(run_cover.RunnerError, "anchors differ"):
+                run_cover.diagnostic_workload_script()
+
+    def test_invalid_diagnostic_modes_and_combinations_fail_before_browser_launch(self) -> None:
+        for extra in (
+            ["--diagnostic-fetch-credentials", "include"],
+            ["--diagnostic-fetch-credentials", "omit", "--protocol", "h2"],
+            ["--diagnostic-fetch-credentials", "same-origin", "--workload", "idle"],
+            ["--diagnostic-fetch-credentials", "omit", "--workload", "parallel_20"],
+        ):
+            with self.subTest(extra=extra), mock.patch.object(run_cover, "execute_browser_workload") as execute:
+                output, error = io.StringIO(), io.StringIO()
+                with contextlib.redirect_stdout(output), contextlib.redirect_stderr(error):
+                    code = run_cover.main(self.cli + extra)
+                self.assertEqual(code, 2)
+                self.assertEqual(output.getvalue(), "")
+                self.assertTrue(error.getvalue())
+                execute.assert_not_called()
+        with mock.patch.object(run_cover, "load_browser_identity") as identity:
+            with self.assertRaises(run_cover.UsageError):
+                run_cover.execute_browser_workload(SimpleNamespace(
+                    diagnostic_fetch_credentials="omit", protocol="h2", workload="download_1k"
+                ))
+            identity.assert_not_called()
+
+    def test_missing_or_mismatched_treatment_echo_fails_and_cleans_up(self) -> None:
+        for raw in (
+            self.raw_workload,
+            {**self.raw_workload, "fetch_credentials": "omit"},
+            {"ok": False, "error": "failure"},
+        ):
+            with self.subTest(raw=raw), self.execution("same-origin", raw) as (args, webdriver, stop):
+                with self.assertRaisesRegex(run_cover.RunnerError, "did not confirm"):
+                    run_cover.execute_browser_workload(args)
+                self.assertEqual(webdriver.request.call_args_list[-1].args[0], "DELETE")
+                stop.assert_called_once()
+
+    def test_diagnostic_does_not_relax_protocol_or_payload_verification(self) -> None:
+        for raw in (
+            {**self.raw_workload, "response_bytes": 1023},
+            {**self.raw_workload, "resources": [{"request_index": 0, "next_hop_protocol": "h2"}]},
+        ):
+            raw["fetch_credentials"] = "omit"
+            with self.subTest(raw=raw), self.execution("omit", raw) as (args, webdriver, stop):
+                with self.assertRaises(run_cover.RunnerError):
+                    run_cover.execute_browser_workload(args)
+                self.assertEqual(webdriver.request.call_args_list[-1].args[0], "DELETE")
+                stop.assert_called_once()
+
+    def test_diagnostic_digest_binds_mode_and_cannot_be_stripped_into_formal_receipt(self) -> None:
+        formal = run_cover.workload_receipt(self.identity, "h3", "download_1k", 5, self.checked)
+        omit = run_cover.diagnostic_workload_receipt(self.identity, "h3", "download_1k", 5, self.checked, "omit")
+        same_origin = run_cover.diagnostic_workload_receipt(self.identity, "h3", "download_1k", 5, self.checked, "same-origin")
+        self.assertEqual(len({formal["result_sha256"], omit["result_sha256"], same_origin["result_sha256"]}), 3)
+        self.assertEqual(
+            omit,
+            run_cover.diagnostic_workload_receipt(self.identity, "h3", "download_1k", 5, self.checked, "omit"),
+        )
+        if sys.platform == "win32":
+            self.skipTest("formal capture driver imports Linux/Unix fcntl")
+        campaign = runpy.run_path(str(HERE.parent / "stealth-campaign.py"))
+        sample = SimpleNamespace(wire_profile="h3", workload="download_1k", sample_seed=5)
+        variant = SimpleNamespace(
+            client_implementation=self.identity.client_implementation,
+            implementation_version=self.identity.implementation_version,
+            browser_binary_sha256=self.identity.browser_binary_sha256,
+        )
+        validate = campaign["validate_browser_receipt"]
+        self.assertEqual(validate(formal, sample, variant), formal)
+        for diagnostic in (omit, same_origin):
+            with self.subTest(mode=diagnostic["fetch_credentials"]):
+                with self.assertRaises(campaign["CampaignError"]):
+                    validate(diagnostic, sample, variant)
+                disguised = {key: diagnostic[key] for key in run_cover.SUCCESS_FIELDS}
+                disguised["status"] = "pass"
+                disguised["kind"] = run_cover.KIND
+                with self.assertRaisesRegex(campaign["CampaignError"], "digest does not bind"):
+                    validate(disguised, sample, variant)
+
+    def test_diagnostic_stdout_is_one_marked_receipt(self) -> None:
+        receipt = run_cover.diagnostic_workload_receipt(
+            self.identity, "h3", "download_1k", 5, self.checked, "omit"
+        )
+        output, error = io.StringIO(), io.StringIO()
+        with mock.patch.object(run_cover, "execute_browser_workload", return_value=receipt):
+            with contextlib.redirect_stdout(output), contextlib.redirect_stderr(error):
+                code = run_cover.main(self.cli + ["--diagnostic-fetch-credentials", "omit"])
+        self.assertEqual(code, 0)
+        self.assertEqual(output.getvalue(), run_cover.compact_json(receipt) + "\n")
+        self.assertEqual(error.getvalue(), "")
+
+
 if __name__ == "__main__":
     unittest.main()

From 35e4575a4faa01f88e880630962ff7afb7e94d9c Mon Sep 17 00:00:00 2001
From: cppla <i@cpp.la>
Date: Tue, 22 Sep 2026 20:08:44 +0800
Subject: [PATCH 2/2] ci: run offline browser diagnostic regressions

---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 733c878..4d710c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,6 +44,12 @@ jobs:
       - name: Release contract regression tests
         if: matrix.go == '1.27.x'
         run: make release-recipe-check
+      - name: Browser runner diagnostic regression tests (offline)
+        if: matrix.go == '1.27.x'
+        run: |
+          python3 -m unittest scripts/stealth-browser/test_run_cover.py
+          python3 scripts/stealth-browser/run_cover.py --self-test
+          python3 scripts/stealth-campaign.py --self-test
       - name: Test with coverage
         run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
       - name: Upload coverage