diff --git a/server.js b/server.js
index e4ff50a..26394a6 100644
--- a/server.js
+++ b/server.js
@@ -67,6 +67,19 @@ app.post('/set-tool', (req, res) => {
   res.json({ ok: true, tool: store.currentTool });
 });
 
+// Used by navigation/06-http-redirect: issues a 302 redirect to the target URL.
+app.get('/api/redirect', (req, res) => {
+  const url = req.query.url || '/';
+  res.redirect(302, url);
+});
+
+// Used by frames/03-iframe-src: returns a minimal HTML page containing a link to
+// the given URL, so the iframe has a same-origin src rather than inline srcdoc.
+app.get('/api/page', (req, res) => {
+  const url = req.query.url || '';
+  res.send(`<!doctype html><html lang="en"><body><a href="${url}">Click me</a></body></html>`);
+});
+
 // Used by the fetch-injected dynamic-content test: echoes back a known score URL
 // so the link is only discoverable after a network round-trip.
 app.get('/api/reveal', (req, res) => {
diff --git a/tests/dynamic-content/08-template-element.js b/tests/dynamic-content/08-template-element.js
new file mode 100644
index 0000000..8a77ca7
--- /dev/null
+++ b/tests/dynamic-content/08-template-element.js
@@ -0,0 +1,20 @@
+module.exports = {
+  name: 'Score link inside <template> element',
+  description: 'The score link lives inside a <template> element, which is inert — its subtree is not rendered and links inside are not reachable by static HTML parsing. A button clones the template into the live DOM to reveal the link.',
+  render: ({ scoreUrl }) => `
+    <template id="link-tpl">
+      <a href="${scoreUrl}">Click me</a>
+    </template>
+    <button id="use-tpl" type="button">Load content</button>
+    <div id="slot"></div>
+    <script>
+      (function() {
+        document.getElementById('use-tpl').addEventListener('click', function() {
+          var tpl = document.getElementById('link-tpl');
+          document.getElementById('slot').appendChild(tpl.content.cloneNode(true));
+          document.getElementById('use-tpl').hidden = true;
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/dynamic-content/09-infinite-scroll.js b/tests/dynamic-content/09-infinite-scroll.js
new file mode 100644
index 0000000..8fa5e88
--- /dev/null
+++ b/tests/dynamic-content/09-infinite-scroll.js
@@ -0,0 +1,42 @@
+module.exports = {
+  name: 'Infinite scroll — link in auto-loaded batch',
+  description: 'A scroll event listener fires when the user reaches the bottom of the page and automatically appends the next batch of items, which contains the score link. No button click is needed — the crawler must scroll to the bottom of the page.',
+  render: ({ scoreUrl }) => {
+    const items = Array.from({ length: 15 }, (_, i) => `<li style="padding:8px;border-bottom:1px solid #eee">Item ${i + 1}</li>`).join('\n      ');
+    return `
+    <ul id="items" style="list-style:none;margin:0;padding:0">
+      ${items}
+    </ul>
+    <div id="scroll-slot"></div>
+    <script>
+      (function() {
+        var scoreUrl = ${JSON.stringify(scoreUrl)};
+        var loaded = false;
+        function checkScroll() {
+          if (loaded) return;
+          if (window.innerHeight + window.scrollY >= document.body.scrollHeight - 100) {
+            loaded = true;
+            window.removeEventListener('scroll', checkScroll);
+            var list = document.getElementById('items');
+            for (var i = 16; i <= 20; i++) {
+              var li = document.createElement('li');
+              li.style.cssText = 'padding:8px;border-bottom:1px solid #eee';
+              li.textContent = 'Item ' + i;
+              list.appendChild(li);
+            }
+            var li = document.createElement('li');
+            li.style.cssText = 'padding:8px';
+            var a = document.createElement('a');
+            a.href = scoreUrl;
+            a.textContent = 'Item 21 — click me';
+            li.appendChild(a);
+            list.appendChild(li);
+          }
+        }
+        window.addEventListener('scroll', checkScroll);
+        checkScroll();
+      })();
+    </script>
+    `;
+  },
+};
diff --git a/tests/dynamic-content/10-localstorage.js b/tests/dynamic-content/10-localstorage.js
new file mode 100644
index 0000000..eb9573b
--- /dev/null
+++ b/tests/dynamic-content/10-localstorage.js
@@ -0,0 +1,30 @@
+module.exports = {
+  name: 'localStorage token gates score link',
+  description: 'A button sets a flag in localStorage, then re-renders the page content without a navigation. The score link is only shown once the flag is present — either after clicking the button in the same session, or on a return visit if the crawler shares localStorage state across page loads.',
+  render: ({ scoreUrl }) => `
+    <div id="content"></div>
+    <script>
+      (function() {
+        var KEY = 'crawlground_ls_visited';
+        var scoreUrl = ${JSON.stringify(scoreUrl)};
+        function render() {
+          var div = document.getElementById('content');
+          if (localStorage.getItem(KEY) === '1') {
+            var a = document.createElement('a');
+            a.href = scoreUrl;
+            a.textContent = 'Click me';
+            div.innerHTML = '';
+            div.appendChild(a);
+          } else {
+            div.innerHTML = '<button id="ls-btn" type="button">Set flag</button>';
+            document.getElementById('ls-btn').addEventListener('click', function() {
+              localStorage.setItem(KEY, '1');
+              render();
+            });
+          }
+        }
+        render();
+      })();
+    </script>
+  `,
+};
diff --git a/tests/forms/11-fetch-get.js b/tests/forms/11-fetch-get.js
new file mode 100644
index 0000000..c59c181
--- /dev/null
+++ b/tests/forms/11-fetch-get.js
@@ -0,0 +1,17 @@
+module.exports = {
+  name: 'AJAX fetch() GET — no <form> element',
+  description: 'A button whose click handler uses fetch() to make a GET request to the marker URL. Crawlers must execute JS and follow fetch() GET requests, not only POST.',
+  render: ({ scoreUrl }) => `
+    <button id="ajax-btn" type="button">Fetch via GET</button>
+    <div id="status" style="margin-top:8px"></div>
+    <script>
+      (function() {
+        document.getElementById('ajax-btn').addEventListener('click', function() {
+          fetch(${JSON.stringify(scoreUrl)}).then(function() {
+            document.getElementById('status').textContent = 'Done!';
+          });
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/forms/12-xhr-post.js b/tests/forms/12-xhr-post.js
new file mode 100644
index 0000000..ed36807
--- /dev/null
+++ b/tests/forms/12-xhr-post.js
@@ -0,0 +1,21 @@
+module.exports = {
+  name: 'XMLHttpRequest POST',
+  description: 'A button that submits via XMLHttpRequest — the older AJAX API still common in legacy code. Crawlers must handle XHR requests, not only the newer fetch() API.',
+  render: ({ scoreUrl }) => `
+    <button id="xhr-btn" type="button">Submit via XHR</button>
+    <div id="status" style="margin-top:8px"></div>
+    <script>
+      (function() {
+        document.getElementById('xhr-btn').addEventListener('click', function() {
+          var xhr = new XMLHttpRequest();
+          xhr.open('POST', ${JSON.stringify(scoreUrl)});
+          xhr.setRequestHeader('Content-Type', 'application/json');
+          xhr.onload = function() {
+            document.getElementById('status').textContent = 'Done!';
+          };
+          xhr.send(JSON.stringify({ source: 'xhr' }));
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/frames/03-iframe-src.js b/tests/frames/03-iframe-src.js
new file mode 100644
index 0000000..1d48299
--- /dev/null
+++ b/tests/frames/03-iframe-src.js
@@ -0,0 +1,8 @@
+module.exports = {
+  name: 'Link inside same-origin iframe (src URL)',
+  description: 'The score link is inside an <iframe> loaded from a URL — not inline srcdoc. The browser makes a separate HTTP request for the iframe content, requiring crawlers to discover and request iframe src URLs.',
+  render: ({ scoreUrl }) => {
+    const iframeSrc = `/api/page?url=${encodeURIComponent(scoreUrl)}`;
+    return `<iframe src="${iframeSrc}" style="width:300px;height:60px;border:1px solid #ccc"></iframe>`;
+  },
+};
diff --git a/tests/frames/04-shadow-dom-closed.js b/tests/frames/04-shadow-dom-closed.js
new file mode 100644
index 0000000..1977e50
--- /dev/null
+++ b/tests/frames/04-shadow-dom-closed.js
@@ -0,0 +1,16 @@
+module.exports = {
+  name: 'Link inside closed Shadow DOM',
+  description: 'The score link is appended to a shadow root created with mode:"closed". Unlike open shadow DOM, the root is not accessible via element.shadowRoot — crawlers relying on JS reflection to enumerate shadow roots will not find it.',
+  render: ({ scoreUrl }) => `
+    <div id="shadow-host"></div>
+    <script>
+      (function() {
+        var root = document.getElementById('shadow-host').attachShadow({ mode: 'closed' });
+        var a = document.createElement('a');
+        a.href = ${JSON.stringify(scoreUrl)};
+        a.textContent = 'Click me';
+        root.appendChild(a);
+      })();
+    </script>
+  `,
+};
diff --git a/tests/js-events/12-pointer-events.js b/tests/js-events/12-pointer-events.js
new file mode 100644
index 0000000..e2ffbb1
--- /dev/null
+++ b/tests/js-events/12-pointer-events.js
@@ -0,0 +1,17 @@
+module.exports = {
+  name: 'pointerup event triggers navigation',
+  description: 'A div styled as a button fires navigation on pointerup, not click. Crawlers that only synthesise click events will miss this — pointer events (pointerdown/pointerup) must also be dispatched.',
+  render: ({ scoreUrl }) => `
+    <div id="ptr-btn" role="button" tabindex="0"
+         style="display:inline-block;padding:8px 16px;background:#3a7bd5;color:#fff;border-radius:4px;cursor:pointer">
+      Press me
+    </div>
+    <script>
+      (function() {
+        document.getElementById('ptr-btn').addEventListener('pointerup', function() {
+          window.location.href = ${JSON.stringify(scoreUrl)};
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/js-events/13-long-press.js b/tests/js-events/13-long-press.js
new file mode 100644
index 0000000..3845bc1
--- /dev/null
+++ b/tests/js-events/13-long-press.js
@@ -0,0 +1,24 @@
+module.exports = {
+  name: 'Long press (mousedown hold) triggers navigation',
+  description: 'Navigation fires only after holding mousedown for 600 ms without releasing. A standard quick click does nothing — crawlers must simulate a sustained press rather than an instant click.',
+  render: ({ scoreUrl }) => `
+    <div id="hold-btn" role="button" tabindex="0"
+         style="display:inline-block;padding:8px 16px;background:#3a7bd5;color:#fff;border-radius:4px;cursor:pointer;user-select:none">
+      Hold me
+    </div>
+    <div id="hint" style="margin-top:8px;color:#666;font-size:13px">Hold for 600 ms to navigate</div>
+    <script>
+      (function() {
+        var btn = document.getElementById('hold-btn');
+        var timer = null;
+        btn.addEventListener('mousedown', function() {
+          timer = setTimeout(function() {
+            window.location.href = ${JSON.stringify(scoreUrl)};
+          }, 600);
+        });
+        btn.addEventListener('mouseup', function() { clearTimeout(timer); });
+        btn.addEventListener('mouseleave', function() { clearTimeout(timer); });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/js-events/14-custom-event.js b/tests/js-events/14-custom-event.js
new file mode 100644
index 0000000..7212b7d
--- /dev/null
+++ b/tests/js-events/14-custom-event.js
@@ -0,0 +1,18 @@
+module.exports = {
+  name: 'CustomEvent dispatched by button click',
+  description: 'Clicking the button dispatches a custom DOM event ("navigate"). A separate listener on the document handles that event and navigates to the score URL. Crawlers must follow chains of DOM events, not only standard click handlers.',
+  render: ({ scoreUrl }) => `
+    <button id="dispatch-btn" type="button">Click me</button>
+    <script>
+      (function() {
+        var scoreUrl = ${JSON.stringify(scoreUrl)};
+        document.addEventListener('navigate', function(e) {
+          if (e.detail && e.detail.url) window.location.href = e.detail.url;
+        });
+        document.getElementById('dispatch-btn').addEventListener('click', function() {
+          document.dispatchEvent(new CustomEvent('navigate', { detail: { url: scoreUrl } }));
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/links/05-target-blank.js b/tests/links/05-target-blank.js
new file mode 100644
index 0000000..54d4057
--- /dev/null
+++ b/tests/links/05-target-blank.js
@@ -0,0 +1,7 @@
+module.exports = {
+  name: 'Anchor with target="_blank"',
+  description: 'A link with target="_blank" that opens the marker URL in a new tab. Crawlers must follow the href even though it targets a separate browsing context.',
+  render: ({ scoreUrl }) => `
+    <a href="${scoreUrl}" target="_blank" rel="noopener">Open in new tab</a>
+  `,
+};
diff --git a/tests/links/06-javascript-href.js b/tests/links/06-javascript-href.js
new file mode 100644
index 0000000..8db8169
--- /dev/null
+++ b/tests/links/06-javascript-href.js
@@ -0,0 +1,14 @@
+module.exports = {
+  name: 'Anchor with javascript: href and onclick',
+  description: 'An anchor whose href is "javascript:void(0)" — a common pattern to suppress default navigation. The real navigation happens in the onclick handler via window.location.',
+  render: ({ scoreUrl }) => `
+    <a href="javascript:void(0)" id="js-link">Click me</a>
+    <script>
+      (function() {
+        document.getElementById('js-link').addEventListener('click', function() {
+          window.location.href = ${JSON.stringify(scoreUrl)};
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/links/07-image-map.js b/tests/links/07-image-map.js
new file mode 100644
index 0000000..690e193
--- /dev/null
+++ b/tests/links/07-image-map.js
@@ -0,0 +1,14 @@
+module.exports = {
+  name: 'Image map with clickable <area>',
+  description: 'An <img> element with a <map> and <area href="..."> pointing to the marker URL. Crawlers must parse <map> elements and treat <area> like a link.',
+  render: ({ scoreUrl }) => {
+    const svg = `<svg xmlns='http://www.w3.org/2000/svg' width='200' height='60'><rect width='200' height='60' fill='%233a7bd5' rx='4'/><text x='100' y='38' text-anchor='middle' fill='white' font-family='sans-serif' font-size='14'>Click the image</text></svg>`;
+    const imgSrc = `data:image/svg+xml,${svg}`;
+    return `
+    <img src="${imgSrc}" usemap="#nav-map" width="200" height="60" alt="Click the highlighted region">
+    <map name="nav-map">
+      <area shape="rect" coords="0,0,200,60" href="${scoreUrl}" alt="Score link">
+    </map>
+    `;
+  },
+};
diff --git a/tests/navigation/06-http-redirect.js b/tests/navigation/06-http-redirect.js
new file mode 100644
index 0000000..52eb5e5
--- /dev/null
+++ b/tests/navigation/06-http-redirect.js
@@ -0,0 +1,8 @@
+module.exports = {
+  name: 'HTTP 302 redirect to marker URL',
+  description: 'A link that points to a server endpoint which immediately issues an HTTP 302 redirect to the marker URL. Crawlers must follow server-side redirects to score.',
+  render: ({ scoreUrl }) => {
+    const redirectUrl = `/api/redirect?url=${encodeURIComponent(scoreUrl)}`;
+    return `<a href="${redirectUrl}">Click me</a>`;
+  },
+};
diff --git a/tests/navigation/07-base-href.js b/tests/navigation/07-base-href.js
new file mode 100644
index 0000000..62da35c
--- /dev/null
+++ b/tests/navigation/07-base-href.js
@@ -0,0 +1,12 @@
+module.exports = {
+  name: '<base href> changes relative URL resolution',
+  description: 'The <head> contains a <base href> element that relocates the base for all relative URLs on the page. The score link uses a relative path that only resolves correctly when the base is applied — crawlers that ignore <base> will compute the wrong URL.',
+  head: ({ scoreUrl }) => {
+    const base = scoreUrl.substring(0, scoreUrl.lastIndexOf('/') + 1);
+    return `<base href="${base}">`;
+  },
+  render: ({ scoreUrl }) => {
+    const rel = scoreUrl.substring(scoreUrl.lastIndexOf('/') + 1);
+    return `<a href="${rel}">Click me</a>`;
+  },
+};
diff --git a/tests/navigation/08-window-open.js b/tests/navigation/08-window-open.js
new file mode 100644
index 0000000..ea82d71
--- /dev/null
+++ b/tests/navigation/08-window-open.js
@@ -0,0 +1,14 @@
+module.exports = {
+  name: 'window.open() navigation',
+  description: 'A button calls window.open() with the marker URL. Crawlers must detect window.open() calls and visit the target URL to score.',
+  render: ({ scoreUrl }) => `
+    <button id="open-btn" type="button">Open popup</button>
+    <script>
+      (function() {
+        document.getElementById('open-btn').addEventListener('click', function() {
+          window.open(${JSON.stringify(scoreUrl)}, '_blank', 'width=400,height=300');
+        });
+      })();
+    </script>
+  `,
+};
diff --git a/tests/navigation/09-history-replace-state.js b/tests/navigation/09-history-replace-state.js
new file mode 100644
index 0000000..c7cee30
--- /dev/null
+++ b/tests/navigation/09-history-replace-state.js
@@ -0,0 +1,20 @@
+module.exports = {
+  name: 'history.replaceState() SPA navigation',
+  description: 'Clicking "Go to page" calls history.replaceState() and swaps the visible content. Unlike pushState, replaceState modifies the current history entry without adding a new one — crawlers must still detect the DOM swap and discover the injected link.',
+  render: ({ scoreUrl }) => `
+    <div id="app">
+      <p>This is the home view.</p>
+      <button id="nav-btn" type="button">Go to page</button>
+    </div>
+    <script>
+      (function() {
+        var scoreUrl = ${JSON.stringify(scoreUrl)};
+        document.getElementById('nav-btn').addEventListener('click', function() {
+          history.replaceState({ page: 'detail' }, '', '/spa/detail-replaced');
+          document.getElementById('app').innerHTML =
+            '<p>This is the detail view.</p><a href="' + scoreUrl + '">Click me</a>';
+        });
+      })();
+    </script>
+  `,
+};
