diff --git a/.changeset/bidi-inspector-dispatch.md b/.changeset/bidi-inspector-dispatch.md
new file mode 100644
index 00000000..4f2a35d0
--- /dev/null
+++ b/.changeset/bidi-inspector-dispatch.md
@@ -0,0 +1,6 @@
+---
+'@wdio/selenium-devtools': patch
+'@wdio/nightwatch-devtools': patch
+---
+
+Selenium and Nightwatch traces on Chrome listed every BiDi request twice, a pending row beside the completed one, because selenium-webdriver's network inspector delivers every network event to every subscriber. Each request is now one row, a redirect continues that row rather than adding one, and a request the browser gives up on is closed as a failure instead of staying pending.
diff --git a/.changeset/network-resource-timing.md b/.changeset/network-resource-timing.md
new file mode 100644
index 00000000..fff97312
--- /dev/null
+++ b/.changeset/network-resource-timing.md
@@ -0,0 +1,12 @@
+---
+'@wdio/devtools-script': minor
+'@wdio/devtools-service': minor
+'@wdio/selenium-devtools': minor
+'@wdio/nightwatch-devtools': minor
+'@wdio/devtools-backend': patch
+'@wdio/devtools-app': patch
+---
+
+Capture network requests on browsers without WebDriver BiDi: Safari, and every session Appium serves. Network capture rode on BiDi (or, in Nightwatch, Chrome's performance log), so those sessions showed an empty Network tab. The injected page collector now also reads the document's Resource Timing buffer, which every browser keeps: the document, scripts, styles, images and fonts, each with its timing phases and size, and on Chromium its status. It reads the buffer at install, so loads made before the collector existed are included, then observes. The collector's existing `fetch`/`XMLHttpRequest` patch keeps supplying headers, status and bodies for the calls the page makes, and a request both saw is listed once.
+
+What Resource Timing cannot see is stated rather than left blank: the detail card of such a request names that this browser exposes no headers or body for it (and on Safari no status), a request with no status is coloured as unknown rather than as still in flight, the method column is a dash where the browser names none, and the trace's `trace.network` entry carries `_source: "resource-timing"` and the captured `_resourceType` so a reopened trace renders the same row rather than a failed request. When BiDi is serving a session, the Resource Timing rows are dropped at ingest, so Chrome sessions are unchanged. Serving means delivering, not subscribed: against Appium 3.7's XCUITest driver the BiDi inspectors attach and then send no event, so each adapter now counts BiDi as a source only once a network event has arrived (the Selenium adapter applies the same rule to its console gate). Nightwatch's performance log, which is read after the page is drained, now upgrades the page's row for each load in place with the headers and status it has, so a Chrome session lists each request once and a Safari or Appium session whose capabilities still name a performance log is not left with an empty tab. A native app session has no document and still has no network capture, because the driver exposes none. A mobile Chrome session, which opens on the browser's own new-tab page before the first navigation, no longer lists that page, and a second injection of the collector into a document keeps the first one instead of replacing it and dropping what it had buffered. A `driver.wait()` in a Selenium test now shows as the one command the test made rather than a row per poll. Safari delivers synthesized clicks only to its frontmost window and reports success either way, so once the live dashboard took the front every click reached nothing. The Selenium adapter now brings the session's own window forward before each element click, key input, clear or submit on Safari, and opens its dashboard behind it; the WDIO service, Nightwatch and Python bring Safari forward once after the session starts. The collector injected into a loaded page no longer waits for an animation frame before it starts listening, which on Safari under automation could be never, so a live run on Safari no longer replays an unchanging page with empty fields. On a browser without document-start injection (Safari, Appium), the Selenium adapter's navigation now resolves only once the collector is in the destination, so typing that follows a navigation is captured instead of racing the injection, and the collector's DOM anchor carries each form control's current value and checked state, so a form typed into before the collector arrived no longer replays empty.
diff --git a/CLAUDE.md b/CLAUDE.md
index ca16c55b..3b18691d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -197,6 +197,8 @@ For UI or runtime changes, `examples/<framework>/` is the verification harness.
 
 When CI can't run an example (no real browser), the PR description says so explicitly.
 
+The venv's editable install of `selenium_devtools` points at the primary checkout, so in a worktree every Python example, and the backend and page collector it resolves through `_find_monorepo_backend`, come from `main` unless `PYTHONPATH=packages/selenium-devtools-py/src` is exported first. A Python run that reports the old behaviour from a worktree is usually this, not the change.
+
 ### Skipping tests that depend on workspace-internal build artifacts
 
 A handful of tests need `@wdio/devtools-script` to be built first (the browser-injected bundle). CI test jobs sometimes run before that build step; those tests gate on `it.skipIf` after probing `createRequire(import.meta.url).resolve('@wdio/devtools-script')`. Locally they run normally.
@@ -269,6 +271,10 @@ Documented divergences from the conventions above. They exist today as debt to b
 - `replaceCommand` has two semantics — Selenium mutates in place (preserves `_id`/`id` for chained calls); Nightwatch splices and reissues. Both call the same `core/suite-helpers` factories; the storage strategy stays adapter-specific because runner integrations differ. Could be unified by parameterizing the policy if the divergence ever causes a real problem.
 - `patchNodeAssert` (via `core/assert-patcher`) is now wired in all three adapters, default-on behind each adapter's `captureAssertions` option (opt out with `captureAssertions: false`). Framework matcher libraries differ: Service taps expect-webdriverio's `beforeAssertion`/`afterAssertion` hooks so passing+failing matchers render as `expect.*` actions (mechanism in the assert-capture entry below); Nightwatch native `assert`/`verify` and Selenium's `node:assert` also surface passing+failing rows via their reconcile/patch paths. The remaining gap is Selenium's jest-style `expect()` (and chai): jest/vitest expose no pass+fail assertion hook, so only failing matchers surface there.
 - BiDi is auto-attached in Service and Selenium; Nightwatch is opt-in via `bidi: true` and requires `webSocketUrl: true` in capabilities.
+- **Network has three sources, and the page's Resource Timing is the floor.** BiDi (all four adapters) and Nightwatch's Chrome performance log are driver-side and carry headers and status. The page collector carries two: its patched `fetch`/`XMLHttpRequest` (the only source with bodies) and the document's Resource Timing buffer (`script/src/collectors/resourceTiming.ts`): every load with timing phases and size, a status on Chromium only, never headers. Resource Timing is the only network source a browser without BiDi has, which is Safari and every Appium session (Appium's BiDi reference lists `session.*` alone). The collector reads the buffer at construction, which is what covers loads made before a `<script>`-injected collector existed, then observes; a second evaluation of the bundle in the same document keeps the first collector (next entry), so the buffer is read once per document. Its two page sources are deduplicated inside the collector: the patch *claims* each call (absolute URL without fragment, which is the form the buffer names, plus start time), a `fetch`/`xmlhttprequest` entry within 1 s of a claim is taken so the row with headers and body is the one kept, and because the entry can arrive before the call has answered, a taken entry is *held* until the patch records the call (the entry is then its second listing and dropped) or drops it (no content-type, a rejected fetch, an XHR `error`/`abort`/`timeout`: the held entry becomes the request's only record). Recording a failed call as a failed row instead was tried and reverted: the service and Nightwatch keep the page's patched rows beside BiDi's, so on Chrome every blocked beacon was listed twice (Nightwatch example 35 → 67 failure rows); without BiDi a failed call therefore reads as unknown rather than failed, which is the entry's own account of it. Against a driver-side source the gate is `processTracePayload`'s `skipResourceTimingRequests`, which drops only the Resource Timing rows and leaves the patched rows their bodies, and **the gate is evidence, not a subscription**: measured on Appium 3.7's XCUITest driver, selenium-webdriver's BiDi inspectors attach cleanly and then deliver nothing, so gating on `bidiActive` (or on `browser.isBidi`) withheld the page's rows and the trace had zero network rows. Each adapter therefore latches on the first BiDi network event it receives (service `#bidiNetworkObserved`, set in `handleNetworkRequestStarted`; Selenium and Nightwatch `bidiNetworkObserved`, set in their `buildBidiSinks`; Python `stats["observed"]`, read by `bidi.network_serving`) and gates on that. Nightwatch's performance log is deliberately **not** a gate either: a capability can name a log the driver never serves (XCUITest), and the log is read after the drain in any case, so `perfLogs.ts` `upgradeResourceTimingRows` pairs each log entry with the page's row for the same load (URL, nearest `timestamp`, the log's being dated from CDP's `wallTime` because the monotonic clock only diffs within a session) and lays the log's method, headers, status and size over that row, keeping the row's id, clock and measured phases, and re-sends it under the id, which the dashboard replaces in place. The reverse order is covered too: a load that completes between the drain and the log read reaches the session as the log's row first, so the session keeps it in `loadsListedByLog` until the next drain, where `withoutLoadsTheLogListed` spends it on the page's one row for it (same URL, nearest `timestamp` within 2 s). A ledger spent per load, not a scan of the rows the session holds: the scan read the collector's own patched fetch row, or a row the log had already upgraded, as the listing of a *second* request to that URL inside the window and dropped that request outright (a fetch answered with a content-type-less 204 after one answered with JSON lost its only row). Spent at the next drain that reaches the driver, a collector-less document included, and forgotten at a session replacement (`armReplacedSession`), because the page observed the load before the log could list it: a row absent from that drain is never coming, and a load kept longer would take the row of the next request to the same URL. Residual, Chrome only (Safari and Appium serve no log, so the ledger stays empty there): the log also lists the collector's own patched fetch/XHR calls, whose row is not a Resource Timing row, so `upgradeResourceTimingRows` appends the log's row beside the patched one (main ingested both too) and the ledger can spend it on the row of a different request to that URL inside the window, as it can on the next document's load of a shared asset; the request then survives as its own log row, without the page's phases, so the cost is a row's shape rather than a request. Python withholds the whole page batch once BiDi is serving, as selenium-devtools does (whose console gate, `bidiConsoleObserved`, is evidence-based for the same reason); both lose the patched rows' bodies there rather than list each fetch twice beside its BiDi row, which is what the service's keep does. Residuals: a drain that lands before the first BiDi event of a page is delivered can pass that page's rows once, and Nightwatch clears both flags at a session rotation, so loads in the window before BiDi re-attaches can be listed by both.
+  - **A second evaluation of the collector bundle in one document keeps the first collector.** Every adapter probes for the collector before injecting, but two callers can pass the probe before either injection has run (Nightwatch's navigation proxy and its drain's recovery, Selenium's navigation hook and its recovery), and the second evaluation used to replace `window.wdioTraceCollector` and drop everything the first had buffered. Measured on Android Chrome through Appium, where there is no BiDi and the `<script>` path is the only one: Nightwatch injected twice 11 ms apart and the trace had **0 network rows** for a run that loaded two pages, because the replacement also could not re-read the Resource Timing buffer without listing the first collector's loads again. `collector.ts` now exports `alreadyInstalled` and keeps the instance it finds, and `index.ts` skips its bootstrap on that flag, so the second script is a no-op rather than a second observer feeding the same collector; the adapters' probes only save the round trips. The `chrome-native:` new-tab document a mobile Chrome session opens on is ignored with the rest of the browser's own schemes, since a session starts there before its first navigation; that list is `shared/browser-schemes.ts`, read by core's injection gate and the collector's request filter alike, so the two cannot drift again.
+  - **selenium-webdriver's `NetworkInspector` hands every network event to every subscriber's callback** (`_on` adds one unfiltered socket listener per subscription), so `core/bidi.ts` `handleBidiRequestSent` also receives response events and `handleBidiResponseCompleted` request events. Unguarded, the request handler pushed a second, never-completed row per request and the response handler finalized rows on request events: measured, every request in a Selenium Chrome trace listed twice (a status-0 row beside the completed one) and 57 of 135 rows in a Nightwatch one. Each handler now ignores the other's event by shape (`response` present or absent). Two more shapes the inspector does not model: a redirect hop re-sends the request under the same id, so rows are kept by id for the session (bounded at 5000, oldest out) and a request for a known id reopens its row under the first hop's clock rather than pushing one; and a failed fetch, which core closes as a failure (status 0, the browser's `errorText`, as the WDIO service's `handleNetworkFetchError` already did) through the inspector's `fetchError` hook, reading `network.fetchError` off the inspector's own connection only for an inspector without one; that handler ignores the request and response events the same dispatch hands it, by `errorText`. Without that, every blocked analytics beacon sat in the Network tab as pending for the life of the session; a browser that refuses the subscription keeps the inspector and only that gap.
+  - A Resource Timing row states `source: 'resource-timing'`, the list colours it `unknown` rather than `pending` when it has no status, the detail card names what it could not see, and the HAR writer adds `_source` and `_resourceType`: HAR's required `status` is written as 0 for it, which read back as-is is a transport failure, and an empty `content.mimeType` cannot restore the type. The method is `''` for a navigation, fetch or beacon (Resource Timing names none) and `GET` only for a parser-initiated load. A native app session has no document and therefore no network capture; only a device- or proxy-level capture outside the adapters sees that traffic.
 - Retry-aware trace policies share one mechanism: adapters feed a per-attempt **outcome ledger** (`core/attempt-tracker.ts` `TestAttemptTracker.recordStart(uid, specFile)` + `recordOutcome(uid, state, attempt)`) keyed by the **retry-stable** uid, and the finalizer reads the scoped views (`all`/`forSpec`/`forTest`) so `trace-retention.ts` evaluates **group-by-test** — `retain-on-failure` keys on each test's *final* attempt (no over-retaining a fail-then-pass), `retain-on-first-failure` on *attempt 0*. `recordStart` on a second attempt stamps the prior attempt `failed` (a retry only follows a failure), which corrects runners that swallow the intermediate failure — e.g. Mocha via a `--require` plugin never surfaces the retried attempt's failure, so the ledger would otherwise see `[passed, passed]`. An empty scoped view falls back to `testMetadata` (never fail-open-retains).
   - **WDIO + Selenium: verified end-to-end** (manual fail-then-pass runs: retained under `retain-on-first-failure`, dropped under `retain-on-failure`).
   - **Nightwatch: `retain-on-failure` works; the other retry-aware policies degrade.** Its `--retries` re-runs the testcase *internally* without re-firing the plugin's per-test hooks, and the per-testcase results carry no attempt/retry field (retries live only in undocumented, version-varying Nightwatch internals — `suiteRetries.testRetriesCount` / `reporter.testResults.retryTest`), so the ledger sees only the final attempt for the `describe/it` and exports-object interfaces. Cucumber scenarios expose per-scenario hooks, so the feed captures their attempts. Not cleanly fixable without depending on those internals.
@@ -286,6 +292,8 @@ Documented divergences from the conventions above. They exist today as debt to b
   - **Two unrelated events share the `clearExecutionData` scope, and the receiver cannot tell them apart from the uid.** A run STARTING (`backend/src/index.ts` `handleTestRun`, one per `POST /api/tests/run`) and ONE ENTRY resetting inside a run already in flight (`nightwatch-devtools/src/cucumber-lifecycle.ts`, which re-emits a scenario suite and must not wipe its siblings) arrive under the same scope with the same shape. The app inferred the difference by comparing the uid against `rerunState.activeRerunSuiteUid` — a latch that outlived its rerun, so the *next* run start at a different scope read as a child clear of the last one and **skipped its wipe entirely**: rerun a suite, then the file or Tests, and the Actions/Console/Network tabs kept the previous run's rows and grew with each rerun. `ClearExecutionDataWsPayload.runStart` now states it on the wire (it has to be on the wire, not local to the clicking window — popouts see only WS events), and the app clears both latches when it is set. A backend test asserts the flag actually ships: the app-side fix reads it, so dropping it would restore the bug with every app test still green.
     - Still open, same class: `app/src/components/browser/snapshot.ts` `#videos` is only ever pushed to, so the screencast "Recording N" dropdown accumulates every session of every run for the life of the page (observed at 17). That component listens only to the `screencast-ready` window event and never learns a run started.
   - **A rerun's process collects a SUBSET, so anything it derives from "this collection" is wrong for the tree it merges into.** Three bugs of that one shape, all found by rerunning a single pytest test. The third is the one that shows the rule has a limit: (c) the **launch command** — what Run-all spawns — was built from the child's own invocation, which the backend had narrowed to a single nodeid, so one targeted rerun rescoped Run-all to that test permanently and the tree kept showing only what that child collected. Unlike (a) and (b) this is not recoverable inside the child: its arguments no longer mention what it was narrowed from. The original travels down instead, as `REUSE_ENV.LAUNCH_COMMAND` beside the rest of the reuse handshake; the *rerun template* stays locally derived, since only this process can say how its own interpreter selects a test. **Fixed in the Python adapter only** — `selenium-devtools/src/rerunManager.ts` still derives its launch command from `captureLaunchCommand()`, i.e. from the child's own argv, so a mocha/jest rerun carrying an inherited `--grep` republishes that as Run-all. It already strips those filters out of the *template* for this reason; the getter is what is left. A second consumer makes the inherit-or-derive resolution itself core's, with `captureLaunchCommand` staying adapter-local. The other two: (a) `SuiteStats.order` — which `test-entry-state.ts` `orderedChildren` sorts a suite's tests and child suites by — was pytest's `enumerate(session.items)` index, so a rerun restamped its one test as position 0 and the row jumped above the class it was written below. It is now the item's **source line**, a property of the test rather than of the collection; within a module pytest collects in definition order, so the two agree wherever both are meaningful (a plugin that reorders collection is the exception, and there the line is the more stable answer anyway). (b) `suite-merge.ts` `resetStaleChildrenOnRerun` flipped every settled child *suite* to `pending` whenever an incoming suite arrived `pending` — but a single-test rerun re-emits the parent as `pending` carrying only the one test it collected, so a sibling class suite was set spinning and never reported again, keeping the spinner for the rest of the session with all of its own tests still green. `mergeTests` already froze sibling *tests* on `activeRerunTestUid`; that guard now covers child suites too. A suite on the path to the target is unaffected either way — it re-reports its own state.
+- **A `wait()` poll is the user's one call, not a row per tick.** selenium-webdriver's `driver.wait(until.…)` runs its first poll inside the call, with the spec line on the stack, and every later one from a timer with no user frame; the retry fold keyed on command, args and call source, so the first poll stood alone and the rest folded beside it, and because the driver patcher does not await `onCommand`, a poll could also arrive before the previous one had its id and start a third row. `captureOrReplaceCommand` now runs one capture at a time per capturer, and `RetryTracker.isRetryIgnoringSource` folds a source-less repeat into the sourced row only when it is one of a wait's own polls: the patched `wait()` runs its condition inside an `AsyncLocalStorage` (`driverPatcher.ts` `waitPoll`), which marks `CapturedCommand.duringWait` for exactly those commands, per driver and per async chain. A source-less call outside a wait (a node_modules helper) stays its own row, and so does a later call from the user's own code. Accepted cost: a library that polls from its own timer rather than through `driver.wait()` shows a row per poll.
+- **Safari delivers a synthesized mouse click only to its frontmost window, and a live run opens the dashboard in another browser.** safaridriver's `performInteractionSequence` answers success either way, so a click issued while the Safari window is not frontmost reaches nothing: measured on desktop Safari 26.5 with no DevTools involved at all, the page reported `document.hasFocus() === false` (once `visibilityState: hidden`), no pointer event fired, and the submit never happened in 3 of 3 attempts, while after activating Safari every click landed; the user's own manual click in that window logged in. Live mode is where it shows, because the dashboard window and the wait for it to connect are what move focus; trace mode mostly escapes it and Chrome never has it. This was earlier recorded as "the Python adapter's login flow on desktop Safari is flaky" with the per-command work as the suspect; that work only widens the window. The Selenium adapter switches to the session's own window handle before every element click, sendKeys, clear and submit on a Safari session (`DriverPatcherHooks.beforeInput`, the plugin's `focusForInput`): a WebDriver window switch brings exactly that window forward, one round trip, and holds whatever took the front in between, measured 3 of 3 live logins against 0 of 2 before. `open -a Safari` was tried first and is not enough, since it activates Safari's most recent window, which can be the user's own (`visibilityState: hidden` in the automation window afterwards). The WDIO service, Nightwatch and Python still use `core/browser-focus.ts` `restoreBrowserFocus` (`open -a Safari`) once after session bring-up in live mode, with that weakness; a per-input switch there is the next step. The Selenium dashboard also opens behind the current window on macOS for a Safari session (`dashboardLaunchCommand`, `open -n -g`). The Nightwatch BDD example's assertions are separately not Safari-proof (4 of 7 fail on Safari).
 - **A trace archive is a full recording of the page, and there is no redaction policy anywhere in capture.** Whatever the run put on screen or typed is in the zip, usually several times over: measured on the Python login example, its demo credential appears ~103 times across six places — the page's own displayed text (90x, the-internet prints it), the DOM mutation stream, the `Element.fill` command args, the transcript, the captured test source, and `*-elements.json`. `shared/element-scripts.ts` blanks an `<input type="password">` value, which is worth having because nothing downstream reads that field, but it removes **2 of those ~103** and closes nothing on its own. `buildElementScripts` now projects a captured record down to what is actually read (`selector` + `boundingBox` + context), so `value` and `href` leave the archive entirely — justified as dead data, **not** as a redaction: the same archive still carries 15 hrefs in `trace.mutations` independent of `elements.json`, and 29 `value` attribute mutations recording a typed string keystroke by keystroke (`t`, `to`, `tom`, ...). `@wdio/elements` keeps returning the full `BrowserElementInfo` from its own live call, which is its documented API. A real policy has to act at the collector and the command-arg serializer — a masking-selector or `maskInputs` option — not at one resource. Until then, treat a trace zip as sensitive as the run that produced it.
 - **An `ActionSnapshot` carries no session identity, in any adapter.** `shared`'s type has never had one and `core/action-snapshot.ts` records none, so per-action captures from two concurrently-driven sessions land in one list and are resolved purely by the command's completion timestamp. `claimAfter` is an exact keyed lookup, so the window is narrow — two commands completing in the **same millisecond**, where `trace-frame-snapshots.ts` breaks the tie by "keep the richest capture" (largest screenshot), which is session-blind — plus the documented `latestAtOrBefore` fallback for a command that took no capture of its own. Python is not worse than the JS adapters here and leans on that fallback less, since it stamps each snapshot with its own command's `row["timestamp"]`; reaching the failure at all needs threaded drivers in one process (pytest's function-scoped fixtures are sequential, and `-n` is multi-process). Fixing it is a shared-contract change: `sessionId` on the snapshot, and an index keyed by the pair.
 - **Chrome discards all WebDriver-synthesized input to a tab after a breached credential is submitted.** The first time a test types a `(username, password)` pair that Chrome's password-leak check finds in a breach corpus into an `<input type="password">` and submits a form whose destination no longer shows that login form, Chrome queries `passwordsleakcheck-pa.googleapis.com` and ~0.3-0.9 s later stops delivering **all** synthesized input — mouse *and* keyboard — to that tab. chromedriver returns HTTP 200 for every subsequent Element Click / Send Keys; nothing reaches the page. Untrusted JS (`element.click()`) still works and direct CDP `Input.dispatchMouseEvent`/`dispatchKeyEvent` are equally dead, so this is Chrome, not chromedriver and not our capture. `tomsmith` / `SuperSecretPassword!` — the-internet's demo credential — triggers it; changing only the *username* does not, nor does a random password.
@@ -316,6 +324,8 @@ Documented divergences from the conventions above. They exist today as debt to b
   - **The perf-log fallback only runs when the session asked for a perf log** (`SessionCapturer.perfLogsRequested`, set from `goog:loggingPrefs.performance` at session init — the same reading that already warns "Network tab will be empty"). Without the capability the log cannot exist, so every per-command fetch is a round trip that can only fail, and Nightwatch's transport prints each failure: measured on an iOS Safari session, 21 error blocks in a two-test run that passed, 257 log lines and 12.3 s against 66 and 5.9 s once gated. A runtime latch cannot do this job — `await browser.getLog(...)` yields `undefined` in this Nightwatch version rather than the 500's body, so the refusal is invisible to the caller (the same quirk as `browser.elements()`). XCUITest is why it has to be the capability and not a "is this Chrome" test: it lists `performance` among its supported types and then serves none of it.
   - Deliberately **not** gated on Nightwatch's `bidi` option. That option exists to avoid double-reporting console/network against the perf-log path; preload registration needs nothing but a session created with `webSocketUrl: true`, and gating DOM capture on an unrelated opt-in that defaults to `false` would leave the race in place for nearly every user. `ScriptManager.init` throws without that capability, so the helper self-degrades to the `<script>` path and returns false.
   - The fallback path is kept and still works, but is strictly lower fidelity: measured with `bidi:false`, 0 rows without DOM but the per-action field-state mutations don't survive and a navigating click keeps the ~5 ms residual. Prefer `webSocketUrl: true`.
+  - **The collector's bootstrap must not wait for an animation frame when the body already exists.** `utils.ts` `waitForBody` always waited for a `requestAnimationFrame` (or `DOMContentLoaded`), which a document-start preload needs but a `<script>` appended to a loaded document does not: Safari's automation window paints only when something forces it, so on desktop Safari the injected collector sat in the page with no anchor, no MutationObserver and no `input` listener until a screenshot happened to force a frame, and a live run replayed the bare anchor on every row with empty fields. Measured with the adapter in trace mode, 8 keystrokes typed after injection reached the document's own listeners every time and the collector 0 of them with per-command screenshots off, 8 with them on. The body is now checked synchronously first.
+  - **On the fallback path a navigation resolves to the test only once the collector is in the destination, and the anchor carries live field state.** Selenium's injection used to run from the fire-and-forget `onCommand` after `get` returned, racing the test's next commands: on desktop Safari (no preload at all) the user's typing into both login fields finished before the collector landed, so the replay showed every row with empty fields and the username appeared only at the password row, carried by the `change` event the username field fired when focus left it. `driverPatcher.ts` `gateNavigation` now awaits `DriverPatcherHooks.afterNavigation` (the plugin's `instrumentNavigationTarget`, which injects only when `preloadRegistered` is false) before a navigation command's promise resolves; the row keeps its own completion time, and under the preload the hook returns at once. Independently, `script/src/utils.ts` `recordFieldState` writes each form control's live `value` and `checked` state into the anchor (`parseNode` reads attributes, which never hold typed text), so a collector that arrives after typing still anchors the form as it is. Residual: that anchor is stamped at document birth, so rows before the injection replay the state at injection rather than empty fields; the same imprecision the anchor has always had for DOM the page's own scripts changed before injection.
 - **One `SessionCapturer` per RUN, not per WebDriver session (Nightwatch).** A replaced session used to tear the capturer down and rebuild it, discarding every command, console line, network entry and mutation accumulated so far — so `traceGranularity:'session'` on a **cucumber** run (Nightwatch quits the browser per scenario) wrote one zip holding only the LAST scenario: measured 8 action rows and 1 scenario group where the run had 17 and 2. Nothing forced the rebuild — the browser object is the capturer's only session-bound field (`session.ts` `setBrowser`, mirroring selenium's `setDriver`), and everything else is a run-long accumulator. A replacement is now a re-target plus the per-session bringup that already existed: metadata, `armReplacedSession`, `rotateScreencastForSession`. Measured after: **17 rows** (9+8), 3 groups nested feature→scenario, 4 DOM anchors, 0 of 17 rows replaying another document, 94 network entries (47+47); reproduced 2/2 runs.
   - **Both halves are the same guarded helpers the command hook uses**, because a session replacement now has two detectors: the hook (`armedSessionId`) and `ensureSessionInitialized` (`lastSessionId`). `armReplacedSession` is gated on `needsCaptureRearm` and `rotateScreencastForSession` on the `screencastRotation` latch, so whichever detector arrives first latches the other out; `rearmCaptureForSession` is just the fire-and-forget wrapper for the hook. Hand-rolling either body at the second call site re-armed a session the hook had already armed — dropping the live claims back to the `<script>` fallback mid-flight — and ran a second, unlatched screencast rotation.
   - Per-test slices are unaffected and now index into the run's arrays for a reason rather than by accident: the eager flush at each scenario's pre-quit hook is open-ended (no `nextRange`) but runs **before** the next boundary is recorded, and `buildSpecCapturer` slices synchronously from that call. Measured unchanged at 9 and 8 rows per scenario zip.
diff --git a/README.md b/README.md
index 198bfd86..73eb5083 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ Want a portable artifact instead of a live UI (CI / agent diffing)? Switch to **
 - **Screenshot Capture**: Automatic screenshots after each command for visual debugging
 - **Source Code Mapping**: View the exact line of code that triggered each command
 - **Console Logs**: Capture and display application console output with timestamps and log levels
-- **Network Logs**: Monitor and inspect HTTP requests/responses including headers, payloads, timing, and status codes
+- **Network Logs**: Monitor and inspect HTTP requests/responses including headers, payloads, timing, and status codes. Where the driver exposes no BiDi (Safari, Appium), the page's own Resource Timing still lists every request with its timing and size
 - **Error Tracking**: Full error messages and stack traces for failed tests
 
 ### 🎮 Execution Controls
@@ -91,6 +91,8 @@ Real-time capture of browser-side events through the WebDriver BiDi protocol —
 
 When BiDi is active in Selenium or Nightwatch, the per-command Chrome performance-log network-capture path is gated off so requests don't appear twice in the dashboard. The attach + sink logic lives in `@wdio/devtools-core`'s `bidi.ts` — same module both adapters consume.
 
+**Without BiDi: Safari, and every session Appium serves.** Neither driver exposes BiDi, so there the Network tab is filled by the page itself, through the same injected collector that records the DOM. It patches `fetch` / `XMLHttpRequest` (method, headers, status and body of each call the page makes) and reads the document's **Resource Timing** buffer: every load the browser made (the document, scripts, styles, images, fonts) with its timing phases and size, plus a status on Chromium. What Resource Timing cannot see are headers and bodies, and on Safari the status; each such row says so in its detail card, and its `trace.network` entry carries `_source: "resource-timing"`. When BiDi is serving the session, meaning it has delivered a network event and not merely accepted a subscription (Appium's BiDi shim accepts one and sends nothing), the Resource Timing rows are dropped at ingest so a request is listed once; Nightwatch's performance log, read after the page is drained, upgrades those rows in place with the headers and status it has. A native app session has no document, so it has no network capture at all. Only a device- or proxy-level capture outside the adapters can see that traffic.
+
 ### 📦 Trace mode (trace.zip)
 
 The dashboard runs in one of **two modes**, set per adapter via the shared `mode` option:
@@ -206,7 +208,7 @@ Appium sessions are captured in both live and trace mode. What gets captured dep
 
 | Session | Has a document | What is captured |
 |---|---|---|
-| **Mobile browser** (Chrome on Android, Safari on iOS) | always | the same as a desktop run — DOM, console, network, replay |
+| **Mobile browser** (Chrome on Android, Safari on iOS) | always | DOM, console and replay as on desktop; network from the page's own record, since Appium serves no BiDi (see [BiDi capture](#-bidi-capture-browser-console--js-exceptions--network)) |
 | **Native app** | never | commands, screenshots and element data from the platform's XML tree; no DOM |
 | **Hybrid app** | only while in a webview context | native halves as an app, webview halves as a page |
 
@@ -218,7 +220,7 @@ A hybrid app is the case capabilities alone cannot answer, because the answer ch
 
 **In the dashboard**, a phone capture is framed as the device — a full-height device column with the action list and dock beside it — in both live mode and the trace player. The trace's `context-options` records the platform, model and OS version, read back so the player labels frames without guessing.
 
-**What a mobile trace does not contain.** Per-action snapshots are issued from inside the command hook, and Appium serialises a probe behind the command it is observing — so where a session has a document to probe, the per-action snapshot is skipped. In practice that means **a hybrid app's webview actions carry no per-action element data, accessibility tree or settle screenshot**. Native sessions, mobile browsers and every desktop session are unaffected. Command rows and their screenshots, console, network and the archive itself are always captured. These absences are by design; they are not a capture failure.
+**What a mobile trace does not contain.** Per-action snapshots are issued from inside the command hook, and Appium serialises a probe behind the command it is observing — so where a session has a document to probe, the per-action snapshot is skipped. In practice that means **a hybrid app's webview actions carry no per-action element data, accessibility tree or settle screenshot**. Native sessions, mobile browsers and every desktop session are unaffected. Command rows and their screenshots, console and the archive itself are always captured; a mobile browser's network comes from the page's Resource Timing and fetch/XHR patch rather than from BiDi, and a native session has no network capture, because the driver exposes none. These absences are by design; they are not a capture failure.
 
 On a native session, element data and the A11y panel come from the platform's XML tree rather than the DOM, so locators read as `android=new UiSelector()…` / `-ios predicate string:…` rather than CSS or XPath over HTML.
 
diff --git a/examples/MOBILE.md b/examples/MOBILE.md
index 6c2423f7..ccbcb0d1 100644
--- a/examples/MOBILE.md
+++ b/examples/MOBILE.md
@@ -318,11 +318,19 @@ instrumentation process is not running`, so the trace ends up with fewer
 
 Not failures, and not worth chasing:
 
-- **Selenium logs three BiDi warnings per run** (`BiDi LogInspector attach
-failed`, `BiDi preload unavailable`, `BiDi NetworkInspector attach failed`).
-  The adapter requests `webSocketUrl` unconditionally and Appium serves no
-  BiDi, so the attach fails and capture falls back to per-document injection —
-  which is the correct path for a native session anyway.
+- **Selenium logs BiDi lines that describe nothing real.** The adapter
+  requests `webSocketUrl` unconditionally. Against UiAutomator2 the attach
+  fails and logs three warnings (`BiDi LogInspector attach failed`, `BiDi
+  preload unavailable`, `BiDi NetworkInspector attach failed`); against
+  Appium 3.7's XCUITest driver the inspectors report `attached` and then
+  deliver no event at all, which is why the adapter counts BiDi as a source
+  only once an event has arrived. Either way capture runs on per-document
+  injection, which is the correct path for a native session anyway. On the
+  `web` target that injected collector is also what fills the Network tab,
+  from two sources of the page's own: a `fetch` / `XMLHttpRequest` call goes
+  through its patch and carries headers, status and body, and every other
+  load comes from the page's Resource Timing buffer with its timing and size,
+  no headers or bodies, and on Safari no status.
 - **An inherited `DEVTOOLS_MODE=live` changes what a run produces** — a
   dashboard window and no zip, instead of a zip and no window. That is correct
   behaviour for live mode and surprising when the variable is left over from an
diff --git a/examples/wdio/mocha/wdio.conf.ts b/examples/wdio/mocha/wdio.conf.ts
index ee1214e7..e7e49dbe 100644
--- a/examples/wdio/mocha/wdio.conf.ts
+++ b/examples/wdio/mocha/wdio.conf.ts
@@ -27,7 +27,9 @@ export const config: WebdriverIO.Config = {
           '--headless',
           '--disable-gpu',
           '--remote-allow-origins=*',
-          '--window-size=1600,900'
+          '--window-size=1600,900',
+          // Chrome's password-leak check drops all WebDriver input after the demo credential is submitted; see CLAUDE.md.
+          '--host-resolver-rules=MAP passwordsleakcheck-pa.googleapis.com 127.0.0.1'
         ]
       }
     }
diff --git a/packages/app/src/components/workbench/network.ts b/packages/app/src/components/workbench/network.ts
index e0d52f1f..14425201 100644
--- a/packages/app/src/components/workbench/network.ts
+++ b/packages/app/src/components/workbench/network.ts
@@ -7,13 +7,13 @@ import { consume } from '@lit/context'
 import { networkRequestContext } from '../../controller/context.js'
 import {
   FAILED_STATUS_LABEL,
+  NO_VALUE,
   RESOURCE_TYPES,
   TYPE_DOT_CLASS,
   type ResourceFilter
 } from '../../utils/network-constants.js'
 import {
   formatTime,
-  statusKind,
   getResourceType,
   getFileName,
   contentType
@@ -27,7 +27,8 @@ import {
 import {
   formatTransferSize,
   renderNetworkRequestDetail,
-  requestFailed
+  requestFailed,
+  requestStatusKind
 } from './network/request-detail.js'
 
 import '../placeholder.js'
@@ -143,7 +144,7 @@ export class DevtoolsNetwork extends Element {
   }
 
   #renderRequestRow(request: NetworkRequest, range: WaterfallScale) {
-    const kind = statusKind(request.status, requestFailed(request))
+    const kind = requestStatusKind(request)
     const dotClass = TYPE_DOT_CLASS[getResourceType(request)]
     // A zero duration is a measurement (a cached or same-tick response), so the
     // cell reports it; only the bar is held back, because a zero-width bar draws
@@ -155,7 +156,8 @@ export class DevtoolsNetwork extends Element {
     // as ERR so a dead request is never mistaken for one still in flight, which
     // is what the dash means.
     const statusLabel =
-      request.status || (requestFailed(request) ? FAILED_STATUS_LABEL : '—')
+      request.status ||
+      (requestFailed(request) ? FAILED_STATUS_LABEL : NO_VALUE)
     return html`
       <div
         class="grid request-row ${
@@ -169,7 +171,7 @@ export class DevtoolsNetwork extends Element {
             >${getFileName(request.url)}</span
           >
         </span>
-        <span class="req-method">${request.method}</span>
+        <span class="req-method">${request.method || NO_VALUE}</span>
         <span class="req-status kind-${kind}">
           <i class="status-dot"></i>
           ${statusLabel}
@@ -190,7 +192,7 @@ export class DevtoolsNetwork extends Element {
           </span>
         </span>
         <span class="req-dur ${duration === undefined ? 'req-dur-empty' : ''}"
-          >${duration === undefined ? '—' : formatTime(duration)}</span
+          >${duration === undefined ? NO_VALUE : formatTime(duration)}</span
         >
         <span class="req-size">${formatTransferSize(request.size)}</span>
       </div>
diff --git a/packages/app/src/components/workbench/network/request-detail.ts b/packages/app/src/components/workbench/network/request-detail.ts
index 579c0b47..2669f16e 100644
--- a/packages/app/src/components/workbench/network/request-detail.ts
+++ b/packages/app/src/components/workbench/network/request-detail.ts
@@ -3,7 +3,10 @@
 // network drawer (TraceTimeline). The returned markup relies on `networkStyles`
 // being present in the host component's shadow root.
 
-import type { NetworkRequest } from '@wdio/devtools-shared'
+import {
+  NETWORK_CAPTURE_SOURCE,
+  type NetworkRequest
+} from '@wdio/devtools-shared'
 import { html, nothing, type TemplateResult } from 'lit'
 import {
   formatBytes,
@@ -11,15 +14,16 @@ import {
   statusKind,
   contentType
 } from '../../../utils/network-helpers.js'
-import { FAILED_STATUS_LABEL } from '../../../utils/network-constants.js'
+import {
+  FAILED_STATUS_LABEL,
+  NO_VALUE
+} from '../../../utils/network-constants.js'
 
 // The capture side reports a transport failure as status 0 carrying the failure
 // text in `statusText` (service's `handleNetworkFetchError`), so 0 is a failure
 // that happened — never a status still on its way.
 const TRANSPORT_FAILURE_STATUS = 0
 
-const NO_VALUE = '—'
-
 const ZERO_BYTES = '0B'
 
 /** Whether a request failed rather than completing — a producer-reported error,
@@ -28,6 +32,11 @@ export function requestFailed(req: NetworkRequest): boolean {
   return Boolean(req.error) || req.status === TRANSPORT_FAILURE_STATUS
 }
 
+/** The status bucket the list and the card colour a request by. */
+export function requestStatusKind(req: NetworkRequest) {
+  return statusKind(req.status, requestFailed(req), req.source)
+}
+
 /** Bytes a request transferred. A captured 0 (a 204, a HEAD, a body the
  *  collector could not read) is a measured size, where `formatBytes` renders it
  *  as the same dash it gives a size that was never captured at all. */
@@ -44,6 +53,17 @@ function statusCode(req: NetworkRequest): string {
   return requestFailed(req) ? FAILED_STATUS_LABEL : NO_VALUE
 }
 
+/** What a Resource Timing capture could not see, so an empty headers section
+ *  and a dash for the status read as the browser's limit rather than ours. */
+function captureLimit(req: NetworkRequest): string | undefined {
+  if (req.source !== NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING) {
+    return undefined
+  }
+  return req.status
+    ? 'Resource Timing: this browser exposes no headers or body for the request'
+    : 'Resource Timing: this browser exposes no status, headers or body for the request'
+}
+
 function formatBody(body: string): string {
   try {
     return JSON.stringify(JSON.parse(body), null, 2)
@@ -95,18 +115,20 @@ function bodySection(title: string, body: string | undefined) {
 }
 
 function generalSection(req: NetworkRequest) {
-  const kind = statusKind(req.status, requestFailed(req))
+  const kind = requestStatusKind(req)
+  const limit = captureLimit(req)
   return html`
     <div class="detail-section">
       <div class="detail-title">General</div>
       <div class="kv-card">
-        ${kv('Request URL', req.url)} ${kv('Method', req.method)}
+        ${kv('Request URL', req.url)} ${kv('Method', req.method || NO_VALUE)}
         ${kv(
           'Status',
           html`${statusCode(req)} ${req.statusText || ''}`,
           `kind-${kind}`
         )}
         ${kv('Type', contentType(req))}
+        ${limit ? kv('Captured from', limit) : nothing}
         ${
           typeof req.time === 'number'
             ? kv('Time', formatTime(req.time))
diff --git a/packages/app/src/components/workbench/network/styles.ts b/packages/app/src/components/workbench/network/styles.ts
index 6786c2c6..0ce086e7 100644
--- a/packages/app/src/components/workbench/network/styles.ts
+++ b/packages/app/src/components/workbench/network/styles.ts
@@ -201,6 +201,9 @@ export const networkStyles = css`
   .kind-pending {
     color: var(--vscode-descriptionForeground);
   }
+  .kind-unknown {
+    color: var(--vscode-disabledForeground);
+  }
 
   .req-type,
   .req-dur,
diff --git a/packages/app/src/utils/network-constants.ts b/packages/app/src/utils/network-constants.ts
index e5af6957..9a3868b8 100644
--- a/packages/app/src/utils/network-constants.ts
+++ b/packages/app/src/utils/network-constants.ts
@@ -94,12 +94,18 @@ export const HTTP_STATUS = {
  *  flight shows. */
 export const FAILED_STATUS_LABEL = 'ERR'
 
-/** Coarse status buckets used to colour the status dot/number in the list. */
+/** The list's and the detail card's glyph for a value the capture never had. */
+export const NO_VALUE = '—'
+
+/** Coarse status buckets used to colour the status dot/number in the list.
+ *  `unknown` is a request that completed on a source that exposes no status
+ *  (Resource Timing outside Chromium); `pending` is one still in flight. */
 export const STATUS_KIND = {
   OK: 'ok',
   REDIRECT: 'redirect',
   ERROR: 'error',
-  PENDING: 'pending'
+  PENDING: 'pending',
+  UNKNOWN: 'unknown'
 } as const
 
 export type StatusKind = (typeof STATUS_KIND)[keyof typeof STATUS_KIND]
diff --git a/packages/app/src/utils/network-helpers.ts b/packages/app/src/utils/network-helpers.ts
index bd2114b3..9d7db572 100644
--- a/packages/app/src/utils/network-helpers.ts
+++ b/packages/app/src/utils/network-helpers.ts
@@ -1,4 +1,9 @@
-import { isRequestType, type NetworkRequest } from '@wdio/devtools-shared'
+import {
+  isRequestType,
+  NETWORK_CAPTURE_SOURCE,
+  type NetworkCaptureSource,
+  type NetworkRequest
+} from '@wdio/devtools-shared'
 import {
   RESOURCE_TYPE_BY_REQUEST_TYPE,
   RESOURCE_TYPE_PATTERNS,
@@ -44,14 +49,21 @@ export function formatTime(ms?: number): string {
 /**
  * Bucket an HTTP status into a coarse {@link StatusKind}. The single source of
  * truth for status ranges — both the dot colour and the text colour derive
- * from it.
+ * from it. A request with no status is in flight, unless its source is one
+ * that never exposes a status: that request completed, and reads as unknown.
  */
-export function statusKind(status?: number, hasError?: boolean): StatusKind {
+export function statusKind(
+  status?: number,
+  hasError?: boolean,
+  source?: NetworkCaptureSource
+): StatusKind {
   if (hasError) {
     return STATUS_KIND.ERROR
   }
   if (typeof status !== 'number') {
-    return STATUS_KIND.PENDING
+    return source === NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+      ? STATUS_KIND.UNKNOWN
+      : STATUS_KIND.PENDING
   }
   if (status >= HTTP_STATUS.SUCCESS_MIN && status < HTTP_STATUS.REDIRECT_MIN) {
     return STATUS_KIND.OK
@@ -72,7 +84,8 @@ const STATUS_TEXT_CLASS: Record<StatusKind, string> = {
   [STATUS_KIND.OK]: 'text-green-500',
   [STATUS_KIND.REDIRECT]: 'text-yellow-500',
   [STATUS_KIND.ERROR]: 'text-red-500',
-  [STATUS_KIND.PENDING]: 'text-gray-500'
+  [STATUS_KIND.PENDING]: 'text-gray-500',
+  [STATUS_KIND.UNKNOWN]: 'text-gray-500'
 }
 
 /**
@@ -110,8 +123,9 @@ export function getResourceType(request: NetworkRequest): ResourceType {
   if (sniffed) {
     return sniffed
   }
-  // Still unknown, but a body-carrying method is a data request either way.
-  if (request.method !== 'GET') {
+  // Still unknown, but a body-carrying method is a data request either way. An
+  // empty method is a source that names none, which is no evidence at all.
+  if (request.method && request.method !== 'GET') {
     return 'Fetch'
   }
   return OTHER_RESOURCE_TYPE
diff --git a/packages/app/test-ui/workbench/panels/network.test.ts b/packages/app/test-ui/workbench/panels/network.test.ts
index 766805c6..a629d244 100644
--- a/packages/app/test-ui/workbench/panels/network.test.ts
+++ b/packages/app/test-ui/workbench/panels/network.test.ts
@@ -79,7 +79,8 @@ const expectedSizes = (requests: NetworkRequest[]) =>
 
 const expectedKindClasses = (requests: NetworkRequest[]) =>
   requests.map(
-    (request) => `kind-${statusKind(request.status, Boolean(request.error))}`
+    (request) =>
+      `kind-${statusKind(request.status, Boolean(request.error), request.source)}`
   )
 
 /** A captured body as the detail panel re-indents it, then whitespace-collapsed
@@ -638,6 +639,73 @@ describe('wdio-devtools-network', () => {
       ])
     })
 
+    // A Safari or Appium session has no BiDi, so its network rows come from
+    // the page's Resource Timing: no headers, no body, and outside Chromium no
+    // status. The card has to say that is the browser's limit, or a dashed
+    // status beside an empty headers list reads as a capture that failed.
+    it('names the limit of a Resource Timing capture in the detail panel', async () => {
+      const fromResourceTiming = networkRequest({
+        id: 'req-rt',
+        url: 'https://the-internet.herokuapp.com/login',
+        method: '',
+        status: undefined,
+        type: 'document',
+        time: 40,
+        size: 1200,
+        source: 'resource-timing'
+      })
+      const panel = await mountNetwork([fromResourceTiming])
+
+      expect(text(shadow(panel, METHOD))).toBe(NO_VALUE)
+      expect(text(shadow(panel, STATUS))).toBe(NO_VALUE)
+      // Completed, on a browser that reports no status: not the pending colour
+      // an in-flight request wears for as long as it is in flight.
+      expect(kindClassOf(shadowAll(panel, STATUS)[0])).toBe('kind-unknown')
+
+      await clickRow(panel, 0)
+      const sections = detailSections(panel)
+      expect(sections.map((section) => section.title)).toEqual(['General'])
+      const [general] = sections
+      expect(general.keys).toEqual([
+        'Request URL',
+        'Method',
+        'Status',
+        'Type',
+        'Captured from',
+        'Time',
+        'Size'
+      ])
+      expect(general.values).toEqual([
+        fromResourceTiming.url,
+        NO_VALUE,
+        NO_VALUE,
+        'document',
+        'Resource Timing: this browser exposes no status, headers or body for the request',
+        '40ms',
+        '1.2KB'
+      ])
+    })
+
+    it('narrows the Resource Timing note to headers and body when a status was reported', async () => {
+      // Chromium reports `responseStatus`, so there the status column is real.
+      const panel = await mountNetwork([
+        networkRequest({
+          id: 'req-rt-chromium',
+          method: 'GET',
+          status: 200,
+          type: 'script',
+          source: 'resource-timing'
+        })
+      ])
+      await clickRow(panel, 0)
+
+      const [general] = detailSections(panel)
+      expect(general.values[general.keys.indexOf('Status')]).toBe('200')
+      expect(general.values[general.keys.indexOf('Captured from')]).toBe(
+        'Resource Timing: this browser exposes no headers or body for the request'
+      )
+    })
+
     it('closes the detail panel when the selected row is clicked again', async () => {
       const panel = await mountNetwork(loginNetwork.requests)
       await clickRow(panel, 2)
diff --git a/packages/app/tests/network-helpers.test.ts b/packages/app/tests/network-helpers.test.ts
index 27f8493d..69a60acc 100644
--- a/packages/app/tests/network-helpers.test.ts
+++ b/packages/app/tests/network-helpers.test.ts
@@ -1,4 +1,5 @@
 import {
+  NETWORK_CAPTURE_SOURCE,
   REQUEST_TYPES,
   type NetworkRequest,
   type RequestType
@@ -29,6 +30,21 @@ function request(overrides: Partial<NetworkRequest> = {}): NetworkRequest {
   }
 }
 
+describe('getResourceType: a source that names no method', () => {
+  it('does not read an empty method as a data request', () => {
+    // Resource Timing knows no method for a navigation or a beacon; only a
+    // real non-GET method is evidence of a body-carrying request.
+    expect(
+      getResourceType(request({ type: 'other', method: '', url: 'https://x/' }))
+    ).toBe('Other')
+    expect(
+      getResourceType(
+        request({ type: 'other', method: 'POST', url: 'https://x/' })
+      )
+    ).toBe('Fetch')
+  })
+})
+
 /** A `type` outside the union — an older trace, or a producer the vocabulary
  *  hasn't caught up with. The cast is the subject under test: the static type
  *  can't express this, and the helper still has to cope at runtime. */
@@ -59,6 +75,17 @@ describe('statusKind', () => {
     expect(statusKind(undefined)).toBe(STATUS_KIND.PENDING)
   })
 
+  it('treats a missing status from a source that never exposes one as unknown', () => {
+    // A Resource Timing row completed; outside Chromium the browser simply
+    // reports no status, which is not the same as one still on its way.
+    expect(
+      statusKind(undefined, false, NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING)
+    ).toBe(STATUS_KIND.UNKNOWN)
+    expect(statusKind(200, false, NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING)).toBe(
+      STATUS_KIND.OK
+    )
+  })
+
   it('treats an error flag as error regardless of status', () => {
     expect(statusKind(200, true)).toBe(STATUS_KIND.ERROR)
     expect(statusKind(undefined, true)).toBe(STATUS_KIND.ERROR)
diff --git a/packages/backend/src/trace-reader-types.ts b/packages/backend/src/trace-reader-types.ts
index e6d700e3..f4b85a3c 100644
--- a/packages/backend/src/trace-reader-types.ts
+++ b/packages/backend/src/trace-reader-types.ts
@@ -2,6 +2,8 @@
 // snapshot shape from `trace.network`. Mirrors what core/trace-exporter.ts
 // writes; consumed by the reader to reconstruct a player payload.
 
+import type { HarTimings } from '@wdio/devtools-trace/trace-har'
+
 export interface BeforeEvent {
   type: 'before'
   callId: string
@@ -108,6 +110,12 @@ export interface HarSnapshot {
     headers?: { name: string; value: string }[]
     content?: HarContent
   }
+  /** Phase durations; `-1` is HAR's "not applicable". Only a writer that
+   *  measured phases carries the `dns`/`connect` keys. */
+  timings?: Partial<HarTimings>
+  /** Our writer's extension fields; a foreign zip carries neither. */
+  _resourceType?: string
+  _source?: string
 }
 
 /** One stream's trace events grouped by kind for the reconstruction pipeline. */
diff --git a/packages/backend/src/trace-reader-utils.ts b/packages/backend/src/trace-reader-utils.ts
index 7e23b1ed..fdc3a366 100644
--- a/packages/backend/src/trace-reader-utils.ts
+++ b/packages/backend/src/trace-reader-utils.ts
@@ -5,12 +5,16 @@ import { strFromU8 } from 'fflate'
 import { sourceResourceName } from '@wdio/devtools-trace/trace-sources'
 import {
   isDeviceInfo,
+  isRequestType,
   isTestRunnerId,
+  NETWORK_CAPTURE_SOURCE,
+  NETWORK_TIMING_PHASES,
   TraceType,
   type ConsoleLog,
   type LogLevel,
   type Metadata,
   type NetworkRequest,
+  type NetworkTimings,
   type RequestType,
   type TracePlayerFrame,
   type Viewport
@@ -142,6 +146,30 @@ function restoreResponseBody(
   return data ? strFromU8(data) : undefined
 }
 
+/** HAR marks a phase that does not apply as `-1`; the wire type omits it. */
+function harPhase(value: number | undefined): number | undefined {
+  return typeof value === 'number' && value >= 0 ? value : undefined
+}
+
+/** The measured phases, when the writer measured any. The writer's fallback
+ *  for an unmeasured entry carries only `send`/`wait`/`receive`, with the
+ *  whole duration as `wait`: not a measurement, so not restored. */
+function restoreTimings(
+  timings: HarSnapshot['timings']
+): NetworkTimings | undefined {
+  if (!timings || !('dns' in timings)) {
+    return undefined
+  }
+  const restored: NetworkTimings = {}
+  for (const phase of NETWORK_TIMING_PHASES) {
+    const value = harPhase(timings[phase])
+    if (value !== undefined) {
+      restored[phase] = value
+    }
+  }
+  return restored
+}
+
 export function harToNetworkRequest(
   snapshot: HarSnapshot,
   index: number,
@@ -153,19 +181,37 @@ export function harToNetworkRequest(
   // a pending or failed request with no response or content; default those.
   const response = snapshot.response
   const content = response?.content
-  const responseHeaders = headerArrayToRecord(response?.headers)
-  const responseBody = restoreResponseBody(content, files)
-  return {
+  const status = response?.status ?? 0
+  const timings = restoreTimings(snapshot.timings)
+  const base = {
     id: String(index),
     url: snapshot.request.url,
     method: snapshot.request.method,
-    status: response?.status ?? 0,
-    statusText: response?.statusText ?? '',
     timestamp: startTime,
     startTime,
     endTime: startTime + snapshot.time,
     time: snapshot.time,
-    type: mimeToType(content?.mimeType ?? ''),
+    type: isRequestType(snapshot._resourceType)
+      ? snapshot._resourceType
+      : mimeToType(content?.mimeType ?? ''),
+    ...(timings ? { timings } : {})
+  }
+  // A Resource Timing entry saw no response: HAR's required `status` was
+  // written as 0, which read back as-is would render as a transport failure.
+  if (snapshot._source === NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING) {
+    return {
+      ...base,
+      ...(status > 0 ? { status } : {}),
+      ...(content?.size ? { size: content.size } : {}),
+      source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+    }
+  }
+  const responseHeaders = headerArrayToRecord(response?.headers)
+  const responseBody = restoreResponseBody(content, files)
+  return {
+    ...base,
+    status,
+    statusText: response?.statusText ?? '',
     requestHeaders: headerArrayToRecord(snapshot.request.headers),
     responseHeaders,
     size: content?.size ?? 0,
@@ -174,7 +220,7 @@ export function harToNetworkRequest(
       fromCache: false,
       headers: responseHeaders,
       mimeType: content?.mimeType ?? '',
-      status: response?.status ?? 0
+      status
     }
   }
 }
diff --git a/packages/backend/tests/trace-reader-resource-timing.test.ts b/packages/backend/tests/trace-reader-resource-timing.test.ts
new file mode 100644
index 00000000..7c70c5c3
--- /dev/null
+++ b/packages/backend/tests/trace-reader-resource-timing.test.ts
@@ -0,0 +1,126 @@
+import { describe, it, expect } from 'vitest'
+import { harToNetworkRequest } from '../src/trace-reader-utils.js'
+import type { HarSnapshot } from '../src/trace-reader-types.js'
+
+const STARTED = '2026-10-14T10:00:00.000Z'
+
+/** What the writer emits for a page's Resource Timing entry: a status it had
+ *  to write as 0, no headers, the measured phases, and the two markers. */
+function resourceTimingSnapshot(
+  overrides: Partial<HarSnapshot> = {}
+): HarSnapshot {
+  return {
+    startedDateTime: STARTED,
+    time: 40,
+    request: { method: '', url: 'https://app.test/login', headers: [] },
+    response: {
+      status: 0,
+      statusText: '',
+      headers: [],
+      content: { size: 1200, mimeType: '' }
+    },
+    timings: {
+      blocked: 1,
+      dns: 2,
+      connect: 3,
+      ssl: -1,
+      send: 0,
+      wait: 30,
+      receive: 4
+    },
+    _resourceType: 'document',
+    _source: 'resource-timing',
+    ...overrides
+  }
+}
+
+describe('harToNetworkRequest: a Resource Timing entry', () => {
+  it('reads the written 0 as no status, not as a transport failure', () => {
+    const request = harToNetworkRequest(resourceTimingSnapshot(), 0)
+    expect(request.status).toBeUndefined()
+    expect('status' in request).toBe(false)
+    expect(request.statusText).toBeUndefined()
+    expect(request.response).toBeUndefined()
+    expect(request.source).toBe('resource-timing')
+  })
+
+  it('keeps a status Chromium did report', () => {
+    const request = harToNetworkRequest(
+      resourceTimingSnapshot({
+        response: {
+          status: 304,
+          statusText: '',
+          content: { size: 0, mimeType: '' }
+        }
+      }),
+      0
+    )
+    expect(request.status).toBe(304)
+  })
+
+  it('takes its type from the capture, which an empty mime cannot name', () => {
+    const request = harToNetworkRequest(resourceTimingSnapshot(), 0)
+    expect(request.type).toBe('document')
+    expect(request.method).toBe('')
+  })
+
+  it('restores the measured phases and drops the ones marked -1', () => {
+    const request = harToNetworkRequest(resourceTimingSnapshot(), 0)
+    expect(request.timings).toEqual({
+      blocked: 1,
+      dns: 2,
+      connect: 3,
+      send: 0,
+      wait: 30,
+      receive: 4
+    })
+  })
+
+  it('carries a size only when one was captured', () => {
+    expect(harToNetworkRequest(resourceTimingSnapshot(), 0).size).toBe(1200)
+    expect(
+      harToNetworkRequest(
+        resourceTimingSnapshot({
+          response: {
+            status: 0,
+            statusText: '',
+            content: { size: 0, mimeType: '' }
+          }
+        }),
+        0
+      ).size
+    ).toBeUndefined()
+  })
+})
+
+describe('harToNetworkRequest: every other entry', () => {
+  const driverSeen: HarSnapshot = {
+    startedDateTime: STARTED,
+    time: 20,
+    request: { method: 'GET', url: 'https://app.test/app.js', headers: [] },
+    response: {
+      status: 200,
+      statusText: 'OK',
+      headers: [{ name: 'content-type', value: 'text/javascript' }],
+      content: { size: 900, mimeType: 'text/javascript' }
+    },
+    timings: { send: 0, wait: 20, receive: 0 }
+  }
+
+  it('prefers the written type over the mime it would otherwise sniff', () => {
+    expect(
+      harToNetworkRequest({ ...driverSeen, _resourceType: 'fetch' }, 0).type
+    ).toBe('fetch')
+  })
+
+  it('still sniffs the mime for a zip written before the type was stated', () => {
+    expect(harToNetworkRequest(driverSeen, 0).type).toBe('script')
+  })
+
+  it('does not restore the writer’s one-phase fallback as a measurement', () => {
+    const request = harToNetworkRequest(driverSeen, 0)
+    expect(request.timings).toBeUndefined()
+    expect(request.status).toBe(200)
+    expect(request.response?.status).toBe(200)
+  })
+})
diff --git a/packages/core/src/bidi.ts b/packages/core/src/bidi.ts
index 831449f2..b3f84dea 100644
--- a/packages/core/src/bidi.ts
+++ b/packages/core/src/bidi.ts
@@ -57,6 +57,14 @@ interface LogInspector {
 interface NetworkInspector {
   beforeRequestSent: (cb: (e: unknown) => void) => Promise<void>
   responseCompleted: (cb: (e: unknown) => void) => Promise<void>
+  fetchError?: (cb: (e: unknown) => void) => Promise<void>
+  /** The connection the inspector subscribed on, for one without the hook. */
+  bidi?: {
+    subscribe: (events: string | string[]) => Promise<unknown>
+    socket?: {
+      on: (event: 'message', listener: (raw: unknown) => void) => void
+    }
+  }
 }
 
 export function handleBidiConsoleEntry(
@@ -188,29 +196,63 @@ function bidiResponseTiming(
   return { endTime, time: Math.max(0, endTime - startTime) }
 }
 
+/** Rows a session has seen, by request id: a later event for the same request
+ *  (a redirect hop, a late failure) continues the row rather than adding one. */
+const MAX_TRACKED_REQUESTS = 5000
+
+function remember(
+  rows: Map<string, NetworkRequest>,
+  id: string,
+  entry: NetworkRequest
+): void {
+  rows.set(id, entry)
+  if (rows.size <= MAX_TRACKED_REQUESTS) {
+    return
+  }
+  // A row still open keeps its place: its answer has somewhere to land.
+  for (const [key, row] of rows) {
+    if (row.status !== undefined) {
+      rows.delete(key)
+      return
+    }
+  }
+  rows.delete(rows.keys().next().value as string)
+}
+
 export function handleBidiRequestSent(
   rawEvent: unknown,
-  pending: Map<string, NetworkRequest>,
+  rows: Map<string, NetworkRequest>,
   sinks: BidiHandlerSinks,
   log: BidiLogger
 ): void {
   const event = rawEvent as BeforeRequestSentEvent
   try {
     const requestId = String(event?.request?.request ?? event?.id ?? '')
-    if (!requestId) {
+    // selenium-webdriver's NetworkInspector hands every network event to every
+    // subscriber's callback, so response and failure events reach this
+    // handler too; taken as requests they pushed or reopened rows.
+    const shape = rawEvent as { response?: unknown; errorText?: unknown }
+    if (!requestId || shape?.response || shape?.errorText) {
       return
     }
+    const previous = rows.get(requestId)
     const entry: NetworkRequest = {
       id: requestId,
       url: event?.request?.url ?? '',
       method: event?.request?.method ?? 'GET',
       requestHeaders: arrayHeadersToObject(event?.request?.headers),
-      timestamp: Date.now(),
-      startTime: Number(event?.timestamp ?? Date.now()),
+      // A redirect hop re-sends the request under the same id: one row, which
+      // keeps the clock of the hop it follows and reopens for the next answer.
+      timestamp: previous?.timestamp ?? Date.now(),
+      startTime: previous?.startTime ?? Number(event?.timestamp ?? Date.now()),
       type: getRequestType(event?.request?.url ?? '')
     }
-    pending.set(requestId, entry)
-    sinks.pushNetworkRequest(entry)
+    remember(rows, requestId, entry)
+    if (previous) {
+      sinks.replaceNetworkRequest(requestId, entry)
+    } else {
+      sinks.pushNetworkRequest(entry)
+    }
   } catch (err) {
     log('warn', `beforeRequestSent threw: ${errorMessage(err)}`)
   }
@@ -218,15 +260,17 @@ export function handleBidiRequestSent(
 
 export function handleBidiResponseCompleted(
   rawEvent: unknown,
-  pending: Map<string, NetworkRequest>,
+  rows: Map<string, NetworkRequest>,
   sinks: BidiHandlerSinks,
   log: BidiLogger
 ): void {
   const event = rawEvent as ResponseCompletedEvent
   try {
     const requestId = String(event?.request?.request ?? event?.id ?? '')
-    const previous = pending.get(requestId)
-    if (!previous) {
+    const previous = rows.get(requestId)
+    // A request event delivered here (see handleBidiRequestSent) carries no
+    // response; finalizing on it emptied the row.
+    if (!previous || !event?.response) {
       return
     }
     const { endTime, time } = bidiResponseTiming(
@@ -244,14 +288,91 @@ export function handleBidiResponseCompleted(
       time,
       size: Number(event?.response?.bytesReceived) || undefined
     }
-    pending.delete(requestId)
+    remember(rows, requestId, finalized)
     sinks.replaceNetworkRequest(requestId, finalized)
   } catch (err) {
     log('warn', `responseCompleted threw: ${errorMessage(err)}`)
   }
 }
 
-async function attachNetworkInspector(
+interface FetchErrorEvent {
+  request?: { request?: string; timings?: FetchTimings }
+  id?: string
+  timestamp?: number
+  errorText?: string
+}
+
+/** A request the browser gave up on: closed as a failure, as the WDIO service
+ *  closes its own, so it never sits in the Network tab as pending. */
+export function handleBidiFetchError(
+  rawEvent: unknown,
+  rows: Map<string, NetworkRequest>,
+  sinks: BidiHandlerSinks,
+  log: BidiLogger
+): void {
+  const event = rawEvent as FetchErrorEvent
+  try {
+    const requestId = String(event?.request?.request ?? event?.id ?? '')
+    const previous = rows.get(requestId)
+    // The inspector delivers every network event here too; only a failure
+    // carries `errorText`.
+    if (!previous || typeof event?.errorText !== 'string') {
+      return
+    }
+    const { endTime, time } = bidiResponseTiming(
+      event?.request?.timings,
+      previous.startTime,
+      event?.timestamp
+    )
+    const errorText = event?.errorText ?? 'Failed'
+    const finalized: NetworkRequest = {
+      ...previous,
+      status: 0,
+      statusText: errorText,
+      error: errorText,
+      endTime,
+      time
+    }
+    remember(rows, requestId, finalized)
+    sinks.replaceNetworkRequest(requestId, finalized)
+  } catch (err) {
+    log('warn', `fetchError threw: ${errorMessage(err)}`)
+  }
+}
+
+/** A failed fetch closes its row, or it would stay pending forever: through
+ *  the inspector's own hook, or off the socket for an inspector without one. */
+async function subscribeFetchErrors(
+  inspector: NetworkInspector,
+  rows: Map<string, NetworkRequest>,
+  sinks: BidiHandlerSinks,
+  log: BidiLogger
+): Promise<void> {
+  if (typeof inspector.fetchError === 'function') {
+    await inspector.fetchError((e) => handleBidiFetchError(e, rows, sinks, log))
+    return
+  }
+  const bidi = inspector.bidi
+  if (typeof bidi?.subscribe !== 'function' || !bidi.socket?.on) {
+    return
+  }
+  await bidi.subscribe('network.fetchError')
+  bidi.socket.on('message', (raw) => {
+    try {
+      const { method, params } = JSON.parse(String(raw)) as {
+        method?: string
+        params?: unknown
+      }
+      if (method === 'network.fetchError') {
+        handleBidiFetchError(params, rows, sinks, log)
+      }
+    } catch {
+      /* a frame that is not JSON is not an event */
+    }
+  })
+}
+
+export async function attachNetworkInspector(
   driver: unknown,
   factory: InspectorFactory,
   sinks: BidiHandlerSinks,
@@ -259,13 +380,19 @@ async function attachNetworkInspector(
 ): Promise<boolean> {
   try {
     const inspector = (await factory(driver)) as NetworkInspector
-    const pending = new Map<string, NetworkRequest>()
+    const rows = new Map<string, NetworkRequest>()
     await inspector.beforeRequestSent((e) =>
-      handleBidiRequestSent(e, pending, sinks, log)
+      handleBidiRequestSent(e, rows, sinks, log)
     )
     await inspector.responseCompleted((e) =>
-      handleBidiResponseCompleted(e, pending, sinks, log)
+      handleBidiResponseCompleted(e, rows, sinks, log)
     )
+    try {
+      await subscribeFetchErrors(inspector, rows, sinks, log)
+    } catch (err) {
+      // The inspector is attached either way; only failed requests stay pending.
+      log('warn', `BiDi network.fetchError unavailable: ${errorMessage(err)}`)
+    }
     log('info', '✓ BiDi NetworkInspector attached (request + response)')
     return true
   } catch (err) {
diff --git a/packages/core/src/browser-focus.ts b/packages/core/src/browser-focus.ts
new file mode 100644
index 00000000..aff0f5d3
--- /dev/null
+++ b/packages/core/src/browser-focus.ts
@@ -0,0 +1,58 @@
+import { spawn } from 'node:child_process'
+
+type Launch = (
+  command: string,
+  args: string[],
+  options: { detached: boolean; stdio: 'ignore' }
+) => {
+  unref?: () => void
+  on?: (event: 'error', cb: (err: Error) => void) => void
+}
+
+/** The session facts that decide whether the local desktop Safari is the one
+ *  under test: an iOS session or one served from another host is not. */
+export interface FocusTarget {
+  browserName?: string
+  platformName?: string
+  /** The WebDriver endpoint's host; absent or loopback means this machine. */
+  host?: string
+  /** Where a failed `open` is reported; core has no logger of its own. */
+  onError?: (message: string) => void
+}
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]'])
+
+/** Safari delivers synthesized mouse input only to its frontmost window, and
+ *  a live run opens the dashboard in another browser, which takes that place:
+ *  every click after that returned success and reached nothing. Brought back
+ *  with `open -a`, which activates an app without AppleScript permissions. */
+export function restoreBrowserFocus(
+  target: FocusTarget,
+  platform: NodeJS.Platform = process.platform,
+  // node's spawn overloads do not narrow to this one call shape.
+  launch: Launch = spawn as unknown as Launch
+): boolean {
+  const local = !target.host || LOCAL_HOSTS.has(target.host)
+  if (
+    platform !== 'darwin' ||
+    !local ||
+    !/safari/i.test(target.browserName ?? '') ||
+    /ios/i.test(target.platformName ?? '')
+  ) {
+    return false
+  }
+  try {
+    const child = launch('open', ['-a', 'Safari'], {
+      detached: true,
+      stdio: 'ignore'
+    })
+    child.on?.('error', (err) =>
+      target.onError?.(`Could not bring Safari to the front: ${err.message}`)
+    )
+    child.unref?.()
+    return true
+  } catch (err) {
+    target.onError?.(`Could not bring Safari to the front: ${String(err)}`)
+    return false
+  }
+}
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 10bfe00f..7b340587 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -75,6 +75,7 @@ export * from './retry-tracker.js'
 export * from './run-id.js'
 export * from './screencast.js'
 export * from '@wdio/devtools-trace/screencast-trace'
+export * from './browser-focus.js'
 export * from './script-loader.js'
 export * from './session-capturer.js'
 export * from './spec-trace-helpers.js'
diff --git a/packages/core/src/request-type.ts b/packages/core/src/request-type.ts
index fe13869d..6c1eb821 100644
--- a/packages/core/src/request-type.ts
+++ b/packages/core/src/request-type.ts
@@ -1,54 +1,3 @@
-import type { RequestType } from '@wdio/devtools-shared'
-
-/**
- * Classify an HTTP request into a {@link RequestType}, preferring the response
- * `mimeType` and falling back to URL extension heuristics. The categories are
- * enumerated once, in shared's `REQUEST_TYPES`, so this text can't drift from
- * them. A shape it can't place returns `'xhr'` — never the vocabulary's
- * `'other'`, which is reserved for producers that classify nothing at all.
- *
- * A pure leaf module: the capture side's only classifier, importable from any
- * runtime. `net.ts` re-exports it under the same name for existing consumers,
- * but that module pulls in `node:net` and so can't be bundled for the browser.
- */
-export function getRequestType(url: string, mimeType?: string): RequestType {
-  const contentType = mimeType?.toLowerCase() ?? ''
-  const urlLower = url.toLowerCase()
-  if (contentType.includes('text/html')) {
-    return 'document'
-  }
-  if (contentType.includes('text/css')) {
-    return 'stylesheet'
-  }
-  if (
-    contentType.includes('javascript') ||
-    contentType.includes('ecmascript')
-  ) {
-    return 'script'
-  }
-  if (contentType.includes('image/')) {
-    return 'image'
-  }
-  if (contentType.includes('font/') || contentType.includes('woff')) {
-    return 'font'
-  }
-  if (contentType.includes('application/json')) {
-    return 'fetch'
-  }
-  if (urlLower.endsWith('.html') || urlLower.endsWith('.htm')) {
-    return 'document'
-  }
-  if (urlLower.endsWith('.css')) {
-    return 'stylesheet'
-  }
-  if (urlLower.endsWith('.js') || urlLower.endsWith('.mjs')) {
-    return 'script'
-  }
-  if (/\.(png|jpg|jpeg|gif|svg|webp|ico)$/.test(urlLower)) {
-    return 'image'
-  }
-  if (/\.(woff|woff2|ttf|eot|otf)$/.test(urlLower)) {
-    return 'font'
-  }
-  return 'xhr'
-}
+/** The classifier lives in shared so the page collector can share its table;
+ *  re-exported here because `getRequestType` is part of core's public API. */
+export { getRequestType } from '@wdio/devtools-shared'
diff --git a/packages/core/src/retry-tracker.ts b/packages/core/src/retry-tracker.ts
index 332e3cdb..f8756dc6 100644
--- a/packages/core/src/retry-tracker.ts
+++ b/packages/core/src/retry-tracker.ts
@@ -12,6 +12,7 @@
  */
 export class RetryTracker {
   #lastSig: string | null = null
+  #lastBareSig: string | null = null
   #lastId: number | null = null
 
   /** Build the canonical signature used for retry-equality checks. */
@@ -23,12 +24,23 @@ export class RetryTracker {
     return JSON.stringify({ command, args, src: callSource ?? null })
   }
 
+  /** The signature without the call site: a framework's own repeat of a call
+   *  (a `wait()` poll from a timer) has no user frame on its stack. */
+  static bareSignature(command: string, args: unknown): string {
+    return JSON.stringify({ command, args })
+  }
+
   /** True when the incoming signature matches the last captured one AND we
    *  have an id to replace (otherwise there's nothing to replace yet). */
   isRetry(sig: string): boolean {
     return sig === this.#lastSig && this.#lastId !== null
   }
 
+  /** As `isRetry`, for a repeat that carries no call site of its own. */
+  isRetryIgnoringSource(bareSig: string): boolean {
+    return bareSig === this.#lastBareSig && this.#lastId !== null
+  }
+
   /** The id of the last captured command, if any (for the replace-in-place
    *  flow). */
   get lastId(): number | null {
@@ -38,9 +50,22 @@ export class RetryTracker {
   /** Record a fresh capture — sets both sig and id together. */
   recordCapture(sig: string, id: number | null): void {
     this.#lastSig = sig
+    this.#lastBareSig = RetryTracker.bareOf(sig)
     this.#lastId = id
   }
 
+  static bareOf(sig: string): string | null {
+    try {
+      const { command, args } = JSON.parse(sig) as {
+        command: string
+        args: unknown
+      }
+      return RetryTracker.bareSignature(command, args)
+    } catch {
+      return null
+    }
+  }
+
   /** Record only the id (used by adapters that compute the sig but defer the
    *  id assignment to after an async capture call). */
   setLastId(id: number | null): void {
@@ -52,11 +77,13 @@ export class RetryTracker {
    *  commands). Pair with {@link setLastId} once the capture resolves. */
   setLastSig(sig: string): void {
     this.#lastSig = sig
+    this.#lastBareSig = RetryTracker.bareOf(sig)
   }
 
   /** Reset at test/scenario boundaries so the next capture is "fresh". */
   reset(): void {
     this.#lastSig = null
+    this.#lastBareSig = null
     this.#lastId = null
   }
 }
diff --git a/packages/core/src/script-loader.ts b/packages/core/src/script-loader.ts
index fb3156bf..6958c743 100644
--- a/packages/core/src/script-loader.ts
+++ b/packages/core/src/script-loader.ts
@@ -2,6 +2,8 @@ import fs from 'node:fs/promises'
 import path from 'node:path'
 import { createRequire } from 'node:module'
 
+import { isBrowserInternalUrl, schemeOf } from '@wdio/devtools-shared'
+
 import { errorMessage } from './error.js'
 
 const require = createRequire(import.meta.url)
@@ -84,23 +86,11 @@ export async function loadInjectableScript(): Promise<string> {
   return `(async function() { ${await loadCollectorSource()} })()`
 }
 
-/** Schemes that carry no test-relevant DOM — the browser's own start page,
- *  inline documents, and driver error pages. */
-const NON_INSTRUMENTABLE_SCHEMES = [
-  'about:',
-  'data:',
-  'chrome:',
-  'chrome-error:',
-  'edge:',
-  'moz-extension:',
-  'chrome-extension:'
-]
-
+/** The browser's own pages and inline documents carry no test-relevant DOM. */
 function isInstrumentableDocument(url: string | undefined): boolean {
-  if (!url) {
-    return false
-  }
-  return !NON_INSTRUMENTABLE_SCHEMES.some((scheme) => url.startsWith(scheme))
+  return (
+    Boolean(url) && !isBrowserInternalUrl(url!) && schemeOf(url!) !== 'data'
+  )
 }
 
 /**
@@ -165,10 +155,14 @@ export async function drainCollectorWithRecovery<T>(opts: {
  */
 export async function pollUntilReady(
   check: () => Promise<boolean>,
-  opts: { attempts?: number; intervalMs?: number } = {}
+  opts: { attempts?: number; intervalMs?: number; checkFirst?: boolean } = {}
 ): Promise<boolean> {
   const attempts = opts.attempts ?? 5
   const intervalMs = opts.intervalMs ?? 200
+  // An appended script runs synchronously; sleeping first cost each navigation 200 ms.
+  if (opts.checkFirst && (await check())) {
+    return true
+  }
   for (let i = 0; i < attempts; i++) {
     await new Promise((resolve) => setTimeout(resolve, intervalMs))
     if (await check()) {
diff --git a/packages/core/src/session-capturer.ts b/packages/core/src/session-capturer.ts
index e7f66b3a..5110c442 100644
--- a/packages/core/src/session-capturer.ts
+++ b/packages/core/src/session-capturer.ts
@@ -10,7 +10,12 @@ import type {
   SerializedError,
   TraceMutation
 } from '@wdio/devtools-shared'
-import { WORKER_WS_QUERY, WS_PATHS, WS_SCOPE } from '@wdio/devtools-shared'
+import {
+  NETWORK_CAPTURE_SOURCE,
+  WORKER_WS_QUERY,
+  WS_PATHS,
+  WS_SCOPE
+} from '@wdio/devtools-shared'
 import {
   isNativeAppSession,
   mapCommandToAction,
@@ -449,7 +454,10 @@ export abstract class SessionCapturerBase {
    *
    * `skipConsoleLogs` / `skipNetworkRequests` opt out when an out-of-band
    * channel (BiDi) is already delivering those streams — without the gate
-   * the dashboard would see each entry twice.
+   * the dashboard would see each entry twice. `skipResourceTimingRequests`
+   * drops only the page's Resource Timing entries: a driver-side source
+   * reports the same loads with their headers, while the collector's patched
+   * fetch/XHR rows still carry the bodies nothing else captures.
    */
   protected processTracePayload(
     payload: {
@@ -462,6 +470,7 @@ export abstract class SessionCapturerBase {
     opts: {
       skipConsoleLogs?: boolean
       skipNetworkRequests?: boolean
+      skipResourceTimingRequests?: boolean
       /** The command this batch's anchors were CAUSED by, when the caller
        *  observed the document being replaced right after it. Causal knowledge,
        *  so it overrides the timestamp inference below. */
@@ -478,26 +487,27 @@ export abstract class SessionCapturerBase {
       this.mergeMetadata(metadata as Partial<Metadata>)
     }
 
-    if (
-      !opts.skipConsoleLogs &&
-      Array.isArray(consoleLogs) &&
-      consoleLogs.length > 0
-    ) {
-      const tagged = (consoleLogs as ConsoleLog[]).map((entry) => ({
-        ...entry,
-        source: LOG_SOURCES.BROWSER as LogSource
-      }))
+    const tagged = opts.skipConsoleLogs
+      ? []
+      : this.#tagBrowserConsoleLogs(consoleLogs)
+    if (tagged.length > 0) {
       this.consoleLogs.push(...tagged)
       this.sendUpstream('consoleLogs', tagged)
     }
 
-    if (
-      !opts.skipNetworkRequests &&
-      Array.isArray(networkRequests) &&
-      networkRequests.length > 0
-    ) {
-      const reqs = networkRequests as NetworkRequest[]
-      this.networkRequests.push(...reqs)
+    const reqs = this.#acceptedNetworkRequests(networkRequests, opts)
+    if (reqs.length > 0) {
+      // A re-sent id replaces its row, as the dashboard does.
+      for (const req of reqs) {
+        const at = req.id
+          ? this.networkRequests.findIndex((r) => r.id === req.id)
+          : -1
+        if (at === -1) {
+          this.networkRequests.push(req)
+        } else {
+          this.networkRequests[at] = req
+        }
+      }
       this.sendUpstream('networkRequests', reqs)
     }
 
@@ -520,6 +530,33 @@ export abstract class SessionCapturerBase {
     }
   }
 
+  #tagBrowserConsoleLogs(consoleLogs: unknown): ConsoleLog[] {
+    if (!Array.isArray(consoleLogs)) {
+      return []
+    }
+    return (consoleLogs as ConsoleLog[]).map((entry) => ({
+      ...entry,
+      source: LOG_SOURCES.BROWSER as LogSource
+    }))
+  }
+
+  #acceptedNetworkRequests(
+    networkRequests: unknown,
+    opts: {
+      skipNetworkRequests?: boolean
+      skipResourceTimingRequests?: boolean
+    }
+  ): NetworkRequest[] {
+    if (opts.skipNetworkRequests || !Array.isArray(networkRequests)) {
+      return []
+    }
+    return (networkRequests as NetworkRequest[]).filter(
+      (req) =>
+        !opts.skipResourceTimingRequests ||
+        req.source !== NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+    )
+  }
+
   /**
    * Resolve when the WS reaches OPEN state, or `false` on timeout / error.
    * Returns immediately if already open. Used by adapters that need a
diff --git a/packages/core/tests/bidi.test.ts b/packages/core/tests/bidi.test.ts
index cf17e4c2..3716c8ae 100644
--- a/packages/core/tests/bidi.test.ts
+++ b/packages/core/tests/bidi.test.ts
@@ -5,6 +5,8 @@ import {
   loadSeleniumSubmodule,
   handleBidiConsoleEntry,
   handleBidiJsException,
+  attachNetworkInspector,
+  handleBidiFetchError,
   handleBidiRequestSent,
   handleBidiResponseCompleted,
   type BidiHandlerSinks
@@ -242,7 +244,8 @@ describe('handleBidiResponseCompleted', () => {
     expect(replacements[0].entry.statusText).toBe('Created')
     expect(replacements[0].entry.size).toBe(1024)
     // pending entry is consumed
-    expect(pending.has('req-2')).toBe(false)
+    // Kept: a redirect hop or a late failure for this id continues the row.
+    expect(pending.has('req-2')).toBe(true)
     // pushNetworkRequest fired during requestSent, replaceNetworkRequest on completion
     expect(networkRequests).toHaveLength(1)
   })
@@ -296,6 +299,270 @@ describe('handleBidiResponseCompleted', () => {
   })
 })
 
+describe('handleBidi* under selenium-webdriver dispatch', () => {
+  // selenium-webdriver's NetworkInspector hands every network event to every
+  // subscriber's callback, so each handler also receives the other's events.
+  const requestEvent = {
+    request: { request: 'R1', url: 'https://x/', method: 'GET', headers: [] },
+    timestamp: 1,
+    initiator: { type: 'other' }
+  }
+  const responseEvent = {
+    request: { request: 'R1', url: 'https://x/', method: 'GET', headers: [] },
+    timestamp: 2,
+    response: {
+      status: 200,
+      headers: [{ name: 'content-type', value: 'text/html' }]
+    }
+  }
+
+  it('ignores a response event delivered to the request handler', () => {
+    const { sinks, networkRequests } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(responseEvent, pending, sinks, silentLog)
+    expect(networkRequests).toEqual([])
+    expect(pending.size).toBe(0)
+  })
+
+  it('ignores a request event delivered to the response handler', () => {
+    const { sinks, replacements } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(requestEvent, pending, sinks, silentLog)
+    handleBidiResponseCompleted(requestEvent, pending, sinks, silentLog)
+    expect(replacements).toEqual([])
+    expect(pending.has('R1')).toBe(true)
+  })
+
+  it('leaves one row per request when both handlers see both events', () => {
+    // The sequence as the inspector delivers it: every event to every handler.
+    const { sinks, networkRequests, replacements } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    for (const event of [requestEvent, responseEvent]) {
+      handleBidiRequestSent(event, pending, sinks, silentLog)
+      handleBidiResponseCompleted(event, pending, sinks, silentLog)
+    }
+    expect(networkRequests).toHaveLength(1)
+    expect(replacements).toHaveLength(1)
+    expect(replacements[0]).toMatchObject({
+      id: 'R1',
+      entry: { id: 'R1', status: 200 }
+    })
+    expect(pending.size).toBe(1)
+  })
+
+  it('ignores a failure event delivered to the request handler', () => {
+    const { sinks, networkRequests, replacements } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(requestEvent, pending, sinks, silentLog)
+    handleBidiRequestSent(
+      {
+        request: { request: 'R1' },
+        timestamp: 3,
+        errorText: 'net::ERR_BLOCKED'
+      },
+      pending,
+      sinks,
+      silentLog
+    )
+    expect(networkRequests).toHaveLength(1)
+    expect(replacements).toEqual([])
+  })
+
+  it('moves a redirected request’s row instead of adding one', () => {
+    const { sinks, networkRequests, replacements } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(requestEvent, pending, sinks, silentLog)
+    handleBidiRequestSent(
+      {
+        ...requestEvent,
+        request: { ...requestEvent.request, url: 'https://x/moved' },
+        redirectCount: 1
+      },
+      pending,
+      sinks,
+      silentLog
+    )
+    expect(networkRequests).toHaveLength(1)
+    expect(replacements).toEqual([
+      { id: 'R1', entry: expect.objectContaining({ url: 'https://x/moved' }) }
+    ])
+  })
+
+  it('moves a redirect hop onto the row its completed hop left', () => {
+    // Chrome completes the 302 before re-sending the request under the same
+    // id; the row left `pending` with it, and a fresh push listed the hop
+    // twice: once finalized, once pending for the rest of the session.
+    const { sinks, networkRequests, replacements } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(requestEvent, pending, sinks, silentLog)
+    handleBidiResponseCompleted(
+      { ...responseEvent, response: { status: 302, headers: [] } },
+      pending,
+      sinks,
+      silentLog
+    )
+    handleBidiRequestSent(
+      {
+        ...requestEvent,
+        request: { ...requestEvent.request, url: 'https://x/secure' },
+        redirectCount: 1
+      },
+      pending,
+      sinks,
+      silentLog
+    )
+    handleBidiResponseCompleted(responseEvent, pending, sinks, silentLog)
+    expect(networkRequests).toHaveLength(1)
+    // The row ends on the url the chain landed on, with the final status.
+    expect(replacements.map((r) => r.entry.url)).toEqual([
+      'https://x/',
+      'https://x/secure',
+      'https://x/secure'
+    ])
+    expect(replacements.at(-1)?.entry.status).toBe(200)
+    // The chain's clock is the first hop's, so its duration spans the chain.
+    expect(replacements.at(-1)?.entry.startTime).toBe(1)
+    expect(pending.size).toBe(1)
+  })
+
+  it('closes a request the browser gave up on as a failure, not a pending row', () => {
+    const { sinks, replacements } = makeSinks()
+    const pending = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(requestEvent, pending, sinks, silentLog)
+    handleBidiFetchError(
+      {
+        request: { request: 'R1' },
+        timestamp: 3,
+        errorText: 'net::ERR_BLOCKED'
+      },
+      pending,
+      sinks,
+      silentLog
+    )
+    expect(replacements).toHaveLength(1)
+    expect(replacements[0].entry).toMatchObject({
+      id: 'R1',
+      status: 0,
+      statusText: 'net::ERR_BLOCKED',
+      error: 'net::ERR_BLOCKED'
+    })
+    expect(pending.size).toBe(1)
+  })
+
+  it('ignores a failure for a request it never saw', () => {
+    const { sinks, replacements } = makeSinks()
+    handleBidiFetchError(
+      { request: { request: 'R9' }, errorText: 'net::ERR_BLOCKED' },
+      new Map(),
+      sinks,
+      silentLog
+    )
+    expect(replacements).toEqual([])
+  })
+})
+
+describe('attachNetworkInspector and the socket it reads failures from', () => {
+  /** A selenium-webdriver inspector: callbacks per event, and the BiDi
+   *  connection it subscribed on, whose socket carries every frame. */
+  function fakeInspector({ refuse = false } = {}) {
+    const callbacks: Record<string, (e: unknown) => void> = {}
+    const listeners: ((raw: unknown) => void)[] = []
+    const subscribed: string[] = []
+    const inspector = {
+      beforeRequestSent: async (cb: (e: unknown) => void) => {
+        callbacks.request = cb
+      },
+      responseCompleted: async (cb: (e: unknown) => void) => {
+        callbacks.response = cb
+      },
+      bidi: {
+        subscribe: async (events: string | string[]) => {
+          if (refuse) {
+            throw new Error('unknown event')
+          }
+          subscribed.push(...(Array.isArray(events) ? events : [events]))
+        },
+        socket: {
+          on: (_event: 'message', listener: (raw: unknown) => void) => {
+            listeners.push(listener)
+          }
+        }
+      }
+    }
+    const raw = (text: string) =>
+      listeners.forEach((listener) => listener(Buffer.from(text)))
+    const frame = (method: string, params: unknown) =>
+      raw(JSON.stringify({ method, params }))
+    return { inspector, callbacks, subscribed, frame, raw }
+  }
+
+  it('closes a request the browser gave up on through the socket', async () => {
+    const { sinks, replacements } = makeSinks()
+    const { inspector, callbacks, subscribed, frame } = fakeInspector()
+    const attached = await attachNetworkInspector(
+      {},
+      async () => inspector,
+      sinks,
+      silentLog
+    )
+    expect(attached).toBe(true)
+    expect(subscribed).toEqual(['network.fetchError'])
+    callbacks.request({
+      request: { request: 'R1', url: 'https://x/beacon', method: 'GET' },
+      timestamp: 1,
+      initiator: { type: 'other' }
+    })
+    frame('network.fetchError', {
+      request: { request: 'R1' },
+      timestamp: 2,
+      errorText: 'net::ERR_BLOCKED_BY_CLIENT'
+    })
+    expect(replacements).toHaveLength(1)
+    expect(replacements[0].entry).toMatchObject({
+      status: 0,
+      error: 'net::ERR_BLOCKED_BY_CLIENT'
+    })
+  })
+
+  it('reads only failure frames off the socket, and only JSON ones', async () => {
+    const { sinks, networkRequests, replacements } = makeSinks()
+    const { inspector, callbacks, frame, raw } = fakeInspector()
+    await attachNetworkInspector({}, async () => inspector, sinks, silentLog)
+    callbacks.request({
+      request: { request: 'R1', url: 'https://x/', method: 'GET' },
+      timestamp: 1,
+      initiator: { type: 'other' }
+    })
+    frame('network.responseCompleted', {
+      request: { request: 'R1' },
+      response: { status: 200, headers: [] }
+    })
+    expect(() => raw('not json')).not.toThrow()
+    expect(replacements).toEqual([])
+    expect(networkRequests).toHaveLength(1)
+  })
+
+  it('stays attached when the browser refuses the failure subscription', async () => {
+    const warnings: string[] = []
+    const { sinks, networkRequests } = makeSinks()
+    const { inspector, callbacks } = fakeInspector({ refuse: true })
+    const attached = await attachNetworkInspector(
+      {},
+      async () => inspector,
+      sinks,
+      (level, message) => level === 'warn' && warnings.push(message)
+    )
+    expect(attached).toBe(true)
+    expect(warnings.join('\n')).toContain('network.fetchError unavailable')
+    callbacks.request({
+      request: { request: 'R1', url: 'https://x/', method: 'GET' },
+      timestamp: 1,
+      initiator: { type: 'other' }
+    })
+    expect(networkRequests).toHaveLength(1)
+  })
+})
+
 describe('attachBidiHandlers — graceful degradation', () => {
   // Two real-world failure modes the function must handle without crashing:
   //   (a) submodules unresolvable → "not available" notice, returns false
@@ -323,3 +590,83 @@ describe('attachBidiHandlers — graceful degradation', () => {
     expect(noticed).toBe(true)
   })
 })
+
+describe('attachNetworkInspector with an inspector that has a fetchError hook', () => {
+  const requestEventFor = (id: string) => ({
+    request: { request: id, url: `https://x/${id}`, method: 'GET' },
+    timestamp: 1,
+    initiator: { type: 'other' }
+  })
+
+  it('subscribes through the hook and reads nothing off the socket', async () => {
+    const { sinks, replacements } = makeSinks()
+    const callbacks: Record<string, (e: unknown) => void> = {}
+    const subscribed: string[] = []
+    const inspector = {
+      beforeRequestSent: async (cb: (e: unknown) => void) => {
+        callbacks.request = cb
+      },
+      responseCompleted: async (cb: (e: unknown) => void) => {
+        callbacks.response = cb
+      },
+      fetchError: async (cb: (e: unknown) => void) => {
+        callbacks.failure = cb
+      },
+      bidi: {
+        subscribe: async (events: string | string[]) => {
+          subscribed.push(...(Array.isArray(events) ? events : [events]))
+        },
+        socket: { on: () => {} }
+      }
+    }
+    await attachNetworkInspector({}, async () => inspector, sinks, silentLog)
+    expect(subscribed).toEqual([])
+    callbacks.request(requestEventFor('R1'))
+    // selenium-webdriver hands every network event to every hook's callback.
+    callbacks.failure(requestEventFor('R1'))
+    expect(replacements).toEqual([])
+    callbacks.failure({
+      request: { request: 'R1' },
+      timestamp: 2,
+      errorText: 'net::ERR_FAILED'
+    })
+    expect(replacements).toHaveLength(1)
+    expect(replacements[0].entry).toMatchObject({
+      status: 0,
+      error: 'net::ERR_FAILED'
+    })
+  })
+
+  it('keeps a row still open when the session outgrows the tracked set', () => {
+    const { sinks, replacements } = makeSinks()
+    const rows = new Map<string, NetworkRequest>()
+    handleBidiRequestSent(requestEventFor('open'), rows, sinks, silentLog)
+    for (let i = 0; i < 5000; i++) {
+      const id = `done-${i}`
+      handleBidiRequestSent(requestEventFor(id), rows, sinks, silentLog)
+      handleBidiResponseCompleted(
+        {
+          request: { request: id },
+          timestamp: 2,
+          response: { status: 200, headers: [] }
+        },
+        rows,
+        sinks,
+        silentLog
+      )
+    }
+    expect(rows.size).toBe(5000)
+    expect(rows.has('open')).toBe(true)
+    handleBidiFetchError(
+      {
+        request: { request: 'open' },
+        timestamp: 3,
+        errorText: 'net::ERR_ABORTED'
+      },
+      rows,
+      sinks,
+      silentLog
+    )
+    expect(replacements.at(-1)?.entry).toMatchObject({ id: 'open', status: 0 })
+  })
+})
diff --git a/packages/core/tests/browser-focus.test.ts b/packages/core/tests/browser-focus.test.ts
new file mode 100644
index 00000000..5c9ed295
--- /dev/null
+++ b/packages/core/tests/browser-focus.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it, vi } from 'vitest'
+
+import { restoreBrowserFocus } from '../src/browser-focus.js'
+
+describe('restoreBrowserFocus', () => {
+  const launch = () => {
+    const calls: unknown[][] = []
+    const fn = vi.fn((...args: unknown[]) => {
+      calls.push(args)
+      return { unref: vi.fn(), on: vi.fn() }
+    })
+    return { fn, calls }
+  }
+
+  it('activates Safari on macOS for a Safari session', () => {
+    const { fn, calls } = launch()
+    expect(restoreBrowserFocus({ browserName: 'Safari' }, 'darwin', fn)).toBe(
+      true
+    )
+    expect(
+      restoreBrowserFocus(
+        { browserName: 'safari', host: '127.0.0.1' },
+        'darwin',
+        fn
+      )
+    ).toBe(true)
+    expect(calls).toHaveLength(2)
+    expect(calls[0]).toEqual([
+      'open',
+      ['-a', 'Safari'],
+      { detached: true, stdio: 'ignore' }
+    ])
+  })
+
+  it('does nothing for another browser, another platform, or no name', () => {
+    const { fn } = launch()
+    expect(restoreBrowserFocus({ browserName: 'chrome' }, 'darwin', fn)).toBe(
+      false
+    )
+    expect(restoreBrowserFocus({ browserName: 'safari' }, 'linux', fn)).toBe(
+      false
+    )
+    expect(restoreBrowserFocus({}, 'darwin', fn)).toBe(false)
+    // iOS Safari through Appium, and a Safari served from a grid, are not this Mac's.
+    expect(
+      restoreBrowserFocus(
+        { browserName: 'Safari', platformName: 'iOS' },
+        'darwin',
+        fn
+      )
+    ).toBe(false)
+    expect(
+      restoreBrowserFocus(
+        { browserName: 'safari', host: 'hub.example.com' },
+        'darwin',
+        fn
+      )
+    ).toBe(false)
+    expect(fn).not.toHaveBeenCalled()
+  })
+
+  it('reports a launcher that throws rather than throwing', () => {
+    expect(
+      restoreBrowserFocus({ browserName: 'safari' }, 'darwin', () => {
+        throw new Error('no open')
+      })
+    ).toBe(false)
+  })
+})
diff --git a/packages/core/tests/request-type.test.ts b/packages/core/tests/request-type.test.ts
index f88ac465..81e284d9 100644
--- a/packages/core/tests/request-type.test.ts
+++ b/packages/core/tests/request-type.test.ts
@@ -1,93 +1,14 @@
-import { REQUEST_TYPES, isRequestType } from '@wdio/devtools-shared'
+import { getRequestType } from '@wdio/devtools-shared'
 import { describe, it, expect } from 'vitest'
 
-import { getRequestType } from '../src/request-type.js'
+import { getRequestType as getRequestTypeViaCore } from '../src/request-type.js'
 import { getRequestType as getRequestTypeViaNet } from '../src/net.js'
 
-describe('getRequestType', () => {
-  it('classifies from the response mime type', () => {
-    expect(getRequestType('/x', 'text/html; charset=utf-8')).toBe('document')
-    expect(getRequestType('/x', 'text/css')).toBe('stylesheet')
-    expect(getRequestType('/x', 'application/javascript')).toBe('script')
-    expect(getRequestType('/x', 'text/ecmascript')).toBe('script')
-    expect(getRequestType('/x', 'image/png')).toBe('image')
-    expect(getRequestType('/x', 'font/woff2')).toBe('font')
-    expect(getRequestType('/x', 'application/font-woff')).toBe('font')
-    expect(getRequestType('/x', 'application/json')).toBe('fetch')
-  })
-
-  it('reads the mime type case-insensitively', () => {
-    expect(getRequestType('/x', 'TEXT/HTML')).toBe('document')
-    expect(getRequestType('/x', 'Application/JSON')).toBe('fetch')
-  })
-
-  it('falls back to the URL extension when no mime type was observed', () => {
-    expect(getRequestType('/a.html')).toBe('document')
-    expect(getRequestType('/a.htm')).toBe('document')
-    expect(getRequestType('/a.css')).toBe('stylesheet')
-    expect(getRequestType('/a.js')).toBe('script')
-    expect(getRequestType('/a.mjs')).toBe('script')
-    expect(getRequestType('/a.PNG')).toBe('image')
-    expect(getRequestType('/a.svg')).toBe('image')
-    expect(getRequestType('/a.woff2')).toBe('font')
-    expect(getRequestType('/a.ttf')).toBe('font')
-  })
-
-  it('prefers the mime type over a contradicting extension', () => {
-    // A JSON API served from a `.html` path is a data request, not a document.
-    expect(getRequestType('/a.html', 'application/json')).toBe('fetch')
-  })
-
-  it('returns the xhr fallback for a shape it cannot classify', () => {
-    expect(getRequestType('/api/data')).toBe('xhr')
-    expect(getRequestType('/api/data', 'application/octet-stream')).toBe('xhr')
-    expect(getRequestType('')).toBe('xhr')
-  })
-
-  it('ignores a query string that looks like an extension', () => {
-    // The extension test is anchored to the end of the URL, so a `?v=` cache
-    // buster leaves the request unclassifiable rather than mis-bucketed.
-    expect(getRequestType('/app.js?v=2')).toBe('xhr')
-  })
-
-  it('only ever returns a word from the shared vocabulary', () => {
-    const urls = [
-      '/x',
-      '/a.html',
-      '/a.css',
-      '/a.js',
-      '/a.png',
-      '/a.woff',
-      '/api/data'
-    ]
-    const mimes = [undefined, 'text/html', 'image/gif', 'application/json', '?']
-    for (const url of urls) {
-      for (const mime of mimes) {
-        expect(isRequestType(getRequestType(url, mime))).toBe(true)
-      }
-    }
-  })
-
-  it('stays reachable under its pre-split import path', () => {
-    // `net.js` re-exports it so importers predating the leaf-module split keep
-    // working; the two names must be the same function, not two copies.
+describe('getRequestType re-exports', () => {
+  it('stay the one function shared defines, under both of core’s paths', () => {
+    // Core's public API kept the name when the classifier moved to shared, and
+    // `net.js` kept it from before the leaf-module split; neither is a copy.
+    expect(getRequestTypeViaCore).toBe(getRequestType)
     expect(getRequestTypeViaNet).toBe(getRequestType)
   })
 })
-
-describe('isRequestType', () => {
-  it('accepts every word in the vocabulary', () => {
-    for (const type of REQUEST_TYPES) {
-      expect(isRequestType(type)).toBe(true)
-    }
-  })
-
-  it('rejects anything else', () => {
-    expect(isRequestType('websocket')).toBe(false)
-    expect(isRequestType('Document')).toBe(false)
-    expect(isRequestType('')).toBe(false)
-    expect(isRequestType(undefined)).toBe(false)
-    expect(isRequestType(null)).toBe(false)
-    expect(isRequestType(7)).toBe(false)
-  })
-})
diff --git a/packages/core/tests/retry-tracker.test.ts b/packages/core/tests/retry-tracker.test.ts
index bd0aaaf9..1bf5d111 100644
--- a/packages/core/tests/retry-tracker.test.ts
+++ b/packages/core/tests/retry-tracker.test.ts
@@ -89,3 +89,35 @@ describe('staged-then-resolved flow (nightwatch pattern)', () => {
     expect(t.lastId).toBe(7)
   })
 })
+
+describe('RetryTracker.isRetryIgnoringSource', () => {
+  it('folds a repeat without a call site into the last call with one', () => {
+    // selenium's `wait()` runs its first poll inside the call, with the spec
+    // line on the stack, and the rest from a timer with no user frame.
+    const tracker = new RetryTracker()
+    tracker.recordCapture(
+      RetryTracker.signature('getCurrentUrl', [], '/spec.js:22'),
+      7
+    )
+    expect(
+      tracker.isRetryIgnoringSource(
+        RetryTracker.bareSignature('getCurrentUrl', [])
+      )
+    ).toBe(true)
+    expect(
+      tracker.isRetryIgnoringSource(RetryTracker.bareSignature('getTitle', []))
+    ).toBe(false)
+  })
+
+  it('needs an id to replace, like isRetry', () => {
+    const tracker = new RetryTracker()
+    tracker.setLastSig(
+      RetryTracker.signature('getCurrentUrl', [], '/spec.js:22')
+    )
+    expect(
+      tracker.isRetryIgnoringSource(
+        RetryTracker.bareSignature('getCurrentUrl', [])
+      )
+    ).toBe(false)
+  })
+})
diff --git a/packages/core/tests/script-loader.test.ts b/packages/core/tests/script-loader.test.ts
index e7d842b8..72c4e53f 100644
--- a/packages/core/tests/script-loader.test.ts
+++ b/packages/core/tests/script-loader.test.ts
@@ -146,6 +146,16 @@ describe('pollUntilReady', () => {
     expect(calls).toBe(2)
   })
 
+  it('with checkFirst, returns without sleeping when already ready', async () => {
+    const check = vi.fn(async () => true)
+    const start = Date.now()
+    expect(
+      await pollUntilReady(check, { intervalMs: 500, checkFirst: true })
+    ).toBe(true)
+    expect(Date.now() - start).toBeLessThan(100)
+    expect(check).toHaveBeenCalledTimes(1)
+  })
+
   it('returns false when no attempt succeeds', async () => {
     const check = vi.fn(async () => false)
     const ok = await pollUntilReady(check, { attempts: 3, intervalMs: 1 })
diff --git a/packages/core/tests/session-capturer-base.test.ts b/packages/core/tests/session-capturer-base.test.ts
index e83d9225..7f55db31 100644
--- a/packages/core/tests/session-capturer-base.test.ts
+++ b/packages/core/tests/session-capturer-base.test.ts
@@ -1,3 +1,4 @@
+import { NETWORK_CAPTURE_SOURCE } from '@wdio/devtools-shared'
 import { describe, it, expect, beforeEach } from 'vitest'
 import { SessionCapturerBase } from '../src/session-capturer.js'
 
@@ -25,12 +26,37 @@ class TestSessionCapturer extends SessionCapturerBase {
       networkRequests?: unknown
       metadata?: unknown
     },
-    opts?: { skipConsoleLogs?: boolean; skipNetworkRequests?: boolean }
+    opts?: {
+      skipConsoleLogs?: boolean
+      skipNetworkRequests?: boolean
+      skipResourceTimingRequests?: boolean
+    }
   ) {
     return this.processTracePayload(payload, opts)
   }
 }
 
+/** The two network rows a drain carries: the patched fetch, which holds the
+ *  body nothing else captures, and a Resource Timing row for a script load. */
+const patchedFetch = {
+  id: 'r1',
+  url: 'https://x/api',
+  method: 'POST',
+  timestamp: 1,
+  startTime: 0,
+  type: 'fetch',
+  responseBody: '{"ok":true}'
+}
+const resourceTimingRow = {
+  id: 'rt-1-0',
+  url: 'https://x/app.js',
+  method: 'GET',
+  timestamp: 2,
+  startTime: 1,
+  type: 'script',
+  source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+}
+
 let cap: TestSessionCapturer
 beforeEach(() => {
   cap = new TestSessionCapturer()
@@ -130,6 +156,36 @@ describe('processTracePayload — BiDi gating (the duplicate-suppression contrac
     expect(cap.consoleLogs[0].source).toBe('browser') // overridden
     expect(cap.upstream.find((u) => u.scope === 'consoleLogs')).toBeDefined()
   })
+
+  it('drops only the Resource Timing rows under skipResourceTimingRequests', () => {
+    // A driver-side source reports the script load with its headers; the
+    // patched fetch is the one row still carrying a body.
+    cap.process(
+      { networkRequests: [patchedFetch, resourceTimingRow] },
+      { skipResourceTimingRequests: true }
+    )
+    expect(cap.networkRequests).toEqual([patchedFetch])
+    expect(
+      cap.upstream.find((u) => u.scope === 'networkRequests')?.data
+    ).toEqual([patchedFetch])
+  })
+
+  it('sends nothing when the gate leaves no row', () => {
+    cap.process(
+      { networkRequests: [resourceTimingRow] },
+      { skipResourceTimingRequests: true }
+    )
+    expect(cap.networkRequests).toEqual([])
+    expect(
+      cap.upstream.find((u) => u.scope === 'networkRequests')
+    ).toBeUndefined()
+  })
+
+  it('keeps the Resource Timing rows when nothing else serves the session', () => {
+    // Safari and Appium: the page is the only network source there is.
+    cap.process({ networkRequests: [patchedFetch, resourceTimingRow] })
+    expect(cap.networkRequests).toEqual([patchedFetch, resourceTimingRow])
+  })
 })
 
 describe('processTracePayload — mutations + traceLogs', () => {
@@ -350,3 +406,33 @@ describe('SessionCapturerBase.isNativeAppSession', () => {
     expect(capturer.isNativeAppSession).toBe(true)
   })
 })
+
+describe('processTracePayload network ids', () => {
+  it('replaces a row re-sent under the same id instead of listing it twice', () => {
+    class Capturer extends SessionCapturerBase {
+      ingest(payload: unknown) {
+        this.processTracePayload(payload as never)
+      }
+    }
+    const capturer = new Capturer({})
+    const row = (id: string, status?: number) => ({
+      id,
+      url: 'https://x/a',
+      method: 'GET',
+      type: 'fetch' as const,
+      timestamp: 1,
+      startTime: 1,
+      ...(status ? { status } : {})
+    })
+    try {
+      capturer.ingest({ networkRequests: [row('r1')] })
+      capturer.ingest({ networkRequests: [row('r1', 200), row('r2')] })
+      expect(capturer.networkRequests.map((r) => [r.id, r.status])).toEqual([
+        ['r1', 200],
+        ['r2', undefined]
+      ])
+    } finally {
+      capturer.cleanup()
+    }
+  })
+})
diff --git a/packages/nightwatch-devtools/README.md b/packages/nightwatch-devtools/README.md
index 4ed40ddc..34c4f31f 100644
--- a/packages/nightwatch-devtools/README.md
+++ b/packages/nightwatch-devtools/README.md
@@ -193,7 +193,7 @@ desiredCapabilities: {
 }
 ```
 
-When attached, the per-command Chrome performance-log network capture path is gated off so requests don't appear twice in the dashboard. If `webSocketUrl` is missing or the chromedriver version doesn't expose BiDi, the attach logs a warning and the perf-log fallback continues to work.
+When attached, the per-command Chrome performance-log network capture path is gated off so requests don't appear twice in the dashboard. If `webSocketUrl` is missing or the chromedriver version doesn't expose BiDi, the attach logs a warning and the perf-log fallback continues to work. The injected collector lists every request as well, from two sources of the page's own: a `fetch` / `XMLHttpRequest` call goes through its patch and carries method, headers, status and body, and every other load comes from the page's Resource Timing buffer with its timing and size. On Chrome the performance log then upgrades those Resource Timing rows in place with headers and status; on Safari, or any session Appium serves, they stay as the page saw them, without headers or bodies, and on Safari without a status.
 
 **Set `webSocketUrl: true` even without `bidi: true`.** With it, the plugin registers its page collector at document start on every page, so DOM time-travel stays accurate across navigations. Without it, the collector is injected after each navigation instead, which can miss the first moments of a new page.
 
diff --git a/packages/nightwatch-devtools/src/bidi.ts b/packages/nightwatch-devtools/src/bidi.ts
index 7c7ecdd6..687d2115 100644
--- a/packages/nightwatch-devtools/src/bidi.ts
+++ b/packages/nightwatch-devtools/src/bidi.ts
@@ -38,10 +38,12 @@ export function buildBidiSinks(capturer: SessionCapturer): BidiHandlerSinks {
       capturer.sendUpstream('consoleLogs', [entry])
     },
     pushNetworkRequest: (entry) => {
+      capturer.bidiNetworkObserved = true
       capturer.networkRequests.push(entry)
       capturer.sendUpstream('networkRequests', [entry])
     },
     replaceNetworkRequest: (id, entry) => {
+      capturer.bidiNetworkObserved = true
       const idx = capturer.networkRequests.findIndex(
         (r: { id?: string }) => r.id === id
       )
diff --git a/packages/nightwatch-devtools/src/helpers/perfLogs.ts b/packages/nightwatch-devtools/src/helpers/perfLogs.ts
index 3055bba3..769c911f 100644
--- a/packages/nightwatch-devtools/src/helpers/perfLogs.ts
+++ b/packages/nightwatch-devtools/src/helpers/perfLogs.ts
@@ -1,7 +1,15 @@
-import type { RequestType } from '@wdio/devtools-shared'
+import {
+  NETWORK_CAPTURE_SOURCE,
+  type NetworkRequest,
+  type RequestType
+} from '@wdio/devtools-shared'
 
 import { getRequestType } from './utils.js'
 
+/** How far apart the log's and the page's clocks for one load may be and
+ *  still describe the same request. */
+const RESOURCE_TIMING_MATCH_MS = 2000
+
 /**
  * Pure parsers for Chrome's `performance` log (the format `browser.getLog('performance')`
  * returns). Separated from the SessionCapturer so they're testable and the
@@ -58,6 +66,7 @@ interface CdpEventParams {
   request?: CdpRequest
   response?: CdpResponse
   timestamp?: number
+  wallTime?: number
   encodedDataLength?: number
   errorText?: string
 }
@@ -99,7 +108,12 @@ function startPendingRequest(
     url: req.url,
     method: req.method,
     requestHeaders: req.headers ?? {},
-    timestamp: startTime,
+    // Epoch, from the event's own wall clock: every consumer dates a row by
+    // `timestamp`, and the monotonic `startTime` only diffs within a session.
+    timestamp:
+      typeof params.wallTime === 'number'
+        ? Math.round(params.wallTime * 1000)
+        : entry.timestamp,
     startTime
   })
 }
@@ -169,6 +183,142 @@ export function parseNetworkFromPerfLogs(logs: PerfLogEntry[]): NetworkEntry[] {
   return completed
 }
 
+export interface ResourceTimingUpgrade {
+  index: number
+  request: NetworkRequest
+}
+
+/** The Resource Timing rows under each url, by index: the rows a load another
+ *  source reported can be paired with. */
+function resourceTimingRowsByUrl(
+  rows: NetworkRequest[]
+): Map<string, number[]> {
+  const byUrl = new Map<string, number[]>()
+  rows.forEach((row, index) => {
+    if (row.source !== NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING) {
+      return
+    }
+    const indexes = byUrl.get(row.url)
+    if (indexes) {
+      indexes.push(index)
+    } else {
+      byUrl.set(row.url, [index])
+    }
+  })
+  return byUrl
+}
+
+/** The unmatched Resource Timing row for this url nearest `at`, spent once
+ *  taken so each load pairs with one row. */
+function takeNearestResourceTimingRow(
+  indexes: number[],
+  rows: NetworkRequest[],
+  at: number
+): number | undefined {
+  let best: number | undefined
+  let bestDelta = RESOURCE_TIMING_MATCH_MS
+  for (const index of indexes) {
+    const delta = Math.abs(rows[index].timestamp - at)
+    if (delta <= bestDelta) {
+      best = index
+      bestDelta = delta
+    }
+  }
+  if (best !== undefined) {
+    indexes.splice(indexes.indexOf(best), 1)
+  }
+  return best
+}
+
+/** What the log saw that the page could not, laid over the page's row: its
+ *  clock, its measured phases and its id stay the row's. */
+function overlay(row: NetworkRequest, entry: NetworkEntry): NetworkRequest {
+  const merged: NetworkRequest = {
+    ...row,
+    method: entry.method,
+    requestHeaders: entry.requestHeaders,
+    type: entry.type ?? row.type,
+    ...(entry.status !== undefined ? { status: entry.status } : {}),
+    ...(entry.statusText !== undefined ? { statusText: entry.statusText } : {}),
+    ...(entry.responseHeaders
+      ? { responseHeaders: entry.responseHeaders }
+      : {}),
+    ...(entry.size !== undefined ? { size: entry.size } : {}),
+    ...(entry.error !== undefined ? { error: entry.error } : {})
+  }
+  delete merged.source
+  return merged
+}
+
+/** A load the log listed before the page could: the log is read after the
+ *  drain, so the page's row for it arrives a drain later. */
+export interface LoadListedByLog {
+  url: string
+  timestamp: number
+}
+
+/** A drained payload without the page's row for each load the log listed
+ *  first. A load takes one row, the nearest under its url, so a second request
+ *  to that url inside the window keeps its own. */
+export function withoutLoadsTheLogListed(
+  payload: Record<string, unknown>,
+  listed: LoadListedByLog[]
+): Record<string, unknown> {
+  const requests = payload.networkRequests
+  if (!Array.isArray(requests) || listed.length === 0) {
+    return payload
+  }
+  const rows = requests as NetworkRequest[]
+  const rowsByUrl = resourceTimingRowsByUrl(rows)
+  const taken = new Set<number>()
+  for (const load of listed) {
+    const index = takeNearestResourceTimingRow(
+      rowsByUrl.get(load.url) ?? [],
+      rows,
+      load.timestamp
+    )
+    if (index !== undefined) {
+      taken.add(index)
+    }
+  }
+  if (taken.size === 0) {
+    return payload
+  }
+  return {
+    ...payload,
+    networkRequests: rows.filter((_, index) => !taken.has(index))
+  }
+}
+
+/**
+ * Pair performance-log entries with the Resource Timing rows the session
+ * already holds for the same loads. The page's drain runs before the log is
+ * read, so its rows arrive first; a pair takes the row's id and replaces it in
+ * place with the headers and status the page could not see, which is what the
+ * dashboard does with a re-sent id. The rest are new to the session.
+ */
+export function upgradeResourceTimingRows(
+  incoming: NetworkEntry[],
+  existing: NetworkRequest[]
+): { upgrades: ResourceTimingUpgrade[]; fresh: NetworkEntry[] } {
+  const rowsByUrl = resourceTimingRowsByUrl(existing)
+  const upgrades: ResourceTimingUpgrade[] = []
+  const fresh: NetworkEntry[] = []
+  for (const entry of incoming) {
+    const index = takeNearestResourceTimingRow(
+      rowsByUrl.get(entry.url) ?? [],
+      existing,
+      entry.timestamp
+    )
+    if (index === undefined) {
+      fresh.push(entry)
+      continue
+    }
+    upgrades.push({ index, request: overlay(existing[index], entry) })
+  }
+  return { upgrades, fresh }
+}
+
 /**
  * Dedupe incoming network entries against ones the session already holds.
  * Successful requests dedupe by (method, url, timestamp). Failed requests
diff --git a/packages/nightwatch-devtools/src/session-init.ts b/packages/nightwatch-devtools/src/session-init.ts
index d9a81c30..5b4d6a43 100644
--- a/packages/nightwatch-devtools/src/session-init.ts
+++ b/packages/nightwatch-devtools/src/session-init.ts
@@ -15,8 +15,12 @@
  */
 
 import logger from '@wdio/logger'
-import { resolveViewport } from '@wdio/devtools-core'
-import { webdriverExecute, webdriverGet } from './helpers/webdriverHttp.js'
+import { resolveViewport, restoreBrowserFocus } from '@wdio/devtools-core'
+import {
+  resolveWebDriverAddress,
+  webdriverExecute,
+  webdriverGet
+} from './helpers/webdriverHttp.js'
 import {
   errorMessage,
   finalizeScreencast,
@@ -180,6 +184,22 @@ async function broadcastSessionMetadata(
   log.info(
     `✓ Browser: ${browserName}${browserVersion ? ' ' + browserVersion : ''} (session: ${sessionId})`
   )
+  // The dashboard window took the front; Safari clicks reach nothing there.
+  if (
+    ctx.mode === 'live' &&
+    restoreBrowserFocus({
+      browserName: String(browserName),
+      platformName: String(
+        capabilities.platformName || desiredCapabilities.platformName || ''
+      ),
+      host: resolveWebDriverAddress(browser).driverHost,
+      onError: (message) => log.warn(message)
+    })
+  ) {
+    log.info(
+      '✓ Safari brought back to the front (it delivers clicks only there)'
+    )
+  }
 
   const wantsPerfLog = wantsPerformanceLog(
     capabilities as Record<string, unknown>,
@@ -191,7 +211,7 @@ async function broadcastSessionMetadata(
   ctx.sessionCapturer.perfLogsRequested = wantsPerfLog
   if (!wantsPerfLog && !ctx.bidiEnabled) {
     log.warn(
-      "⚠  Network tab will be empty — add 'goog:loggingPrefs': { performance: 'ALL' } to your capabilities (or enable bidi:true)"
+      "⚠  Network tab will carry the page's own Resource Timing only (no headers, no bodies). Add 'goog:loggingPrefs': { performance: 'ALL' } to your capabilities (or enable bidi:true) for full requests"
     )
   }
 }
@@ -319,6 +339,8 @@ async function armReplacedSession(
   // inspectors that no longer receive anything.
   ctx.sessionCapturer.preloadRegistered = false
   ctx.sessionCapturer.bidiActive = false
+  ctx.sessionCapturer.bidiNetworkObserved = false
+  ctx.sessionCapturer.loadsListedByLog = []
   log.info(`Session replaced — re-arming capture for ${sessionId}`)
   await armCaptureForSession(ctx, browser)
 }
diff --git a/packages/nightwatch-devtools/src/session.ts b/packages/nightwatch-devtools/src/session.ts
index e53ad503..ea5a488b 100644
--- a/packages/nightwatch-devtools/src/session.ts
+++ b/packages/nightwatch-devtools/src/session.ts
@@ -22,6 +22,9 @@ import { NAVIGATION_COMMANDS } from './constants.js'
 import {
   parseNetworkFromPerfLogs,
   dedupeNetworkRequests,
+  upgradeResourceTimingRows,
+  withoutLoadsTheLogListed,
+  type LoadListedByLog,
   type NetworkEntry,
   type PerfLogEntry
 } from './helpers/perfLogs.js'
@@ -55,6 +58,9 @@ export class SessionCapturer extends SessionCapturerBase {
   // True once BiDi inspectors are attached — the per-command perf-log network
   // capture path skips when set, so we don't double-emit network requests.
   bidiActive = false
+  /** Whether BiDi has delivered at least one network event; a subscription
+   *  that delivers nothing is not a source. */
+  bidiNetworkObserved = false
 
   /** Whether the session was created with `goog:loggingPrefs.performance`, set
    *  from the capabilities at session init. A perf log exists only because a
@@ -65,6 +71,11 @@ export class SessionCapturer extends SessionCapturerBase {
    *  supported types and then serves none of it. */
   perfLogsRequested = false
 
+  /** Loads the performance log listed before the page's drain could, spent
+   *  at the next drain that reaches the driver, whatever it finds, and
+   *  emptied with the session that listed them. */
+  loadsListedByLog: LoadListedByLog[] = []
+
   /** True once the collector is registered to run at document-start. Every
    *  document then instruments and anchors itself, so the paths that exist to
    *  notice a navigation after the fact — re-injection and the settle poll — have
@@ -392,10 +403,9 @@ export class SessionCapturer extends SessionCapturerBase {
       return
     }
     try {
-      // Injecting over a live collector replaces `window.wdioTraceCollector`
-      // with a fresh instance and DISCARDS whatever it had buffered — including
-      // the destination's full-DOM anchor. Several paths can reach the same
-      // document (navigation proxy, drain recovery), so guard here once.
+      // Several paths reach the same document (navigation proxy, drain
+      // recovery); a bundle that finds a collector keeps it, so this probe
+      // only saves the injection's round trips.
       const alreadyPresent = await webdriverExecute<boolean>(
         browser,
         `return ${COLLECTOR_READY_EXPRESSION};`
@@ -411,17 +421,21 @@ export class SessionCapturer extends SessionCapturerBase {
         const script = document.createElement('script');
         script.textContent = ${JSON.stringify(scriptContent)};
         document.head.appendChild(script);
-        return true;
+        return ${COLLECTOR_READY_EXPRESSION};
       `
-      await webdriverExecute(browser, injectionScript)
-
-      const hasCollector = await pollUntilReady(
-        async () =>
-          (await webdriverExecute<boolean>(
-            browser,
-            `return ${COLLECTOR_READY_EXPRESSION};`
-          )) === true
-      )
+      // The appended script runs synchronously, so this usually answers ready.
+      const injected = await webdriverExecute<boolean>(browser, injectionScript)
+
+      const hasCollector =
+        injected === true ||
+        (await pollUntilReady(
+          async () =>
+            (await webdriverExecute<boolean>(
+              browser,
+              `return ${COLLECTOR_READY_EXPRESSION};`
+            )) === true,
+          { checkFirst: true }
+        ))
 
       if (hasCollector) {
         log.info('✓ Script injected and collector ready')
@@ -480,23 +494,8 @@ export class SessionCapturer extends SessionCapturerBase {
       }
 
       const networkEntries = parseNetworkFromPerfLogs(logs)
-      if (networkEntries.length === 0) {
-        return
-      }
-
-      const deduped = dedupeNetworkRequests(
-        networkEntries,
-        this.networkRequests as NetworkEntry[]
-      )
-      if (deduped.length > 0) {
-        // A perf-log entry that never saw its response event carries no type;
-        // default it to the vocabulary's residual at this framework boundary.
-        const normalized = deduped.map((d) => ({
-          ...d,
-          type: d.type ?? 'other'
-        }))
-        this.networkRequests.push(...normalized)
-        this.sendUpstream('networkRequests', normalized)
+      if (networkEntries.length > 0) {
+        this.#ingestPerfLogEntries(networkEntries)
       }
     } catch (err) {
       const msg = errorMessage(err) ?? ''
@@ -507,6 +506,33 @@ export class SessionCapturer extends SessionCapturerBase {
     }
   }
 
+  /** A log entry for a load the page already reported replaces that row in
+   *  place, under the row's own id; the rest are appended once. */
+  #ingestPerfLogEntries(entries: NetworkEntry[]): void {
+    const { upgrades, fresh } = upgradeResourceTimingRows(
+      entries,
+      this.networkRequests
+    )
+    for (const { index, request } of upgrades) {
+      this.networkRequests[index] = request
+    }
+    const deduped = dedupeNetworkRequests(
+      fresh,
+      this.networkRequests as NetworkEntry[]
+    )
+    // A perf-log entry that never saw its response event carries no type;
+    // default it to the vocabulary's residual at this framework boundary.
+    const appended = deduped.map((d) => ({ ...d, type: d.type ?? 'other' }))
+    this.networkRequests.push(...appended)
+    this.loadsListedByLog.push(
+      ...appended.map(({ url, timestamp }) => ({ url, timestamp }))
+    )
+    const sent = [...upgrades.map((upgrade) => upgrade.request), ...appended]
+    if (sent.length > 0) {
+      this.sendUpstream('networkRequests', sent)
+    }
+  }
+
   /** `forceAnchor` forces a full-DOM anchor of the current document before
    *  draining, so a freshly injected collector's async anchor isn't lost.
    *  `anchorTimestamp` is the command this drain's anchors were CAUSED by — pass
@@ -553,11 +579,25 @@ export class SessionCapturer extends SessionCapturerBase {
         log: (level, message) => log[level](message)
       })
 
+      // Spent whatever the drain found: the page observed a load before the
+      // log listed it, so a row not in this drain is never coming, and a
+      // document with no collector is one it died with.
+      const listedByLog = this.loadsListedByLog
+      this.loadsListedByLog = []
       if (!traceData) {
         return
       }
 
-      this.processTracePayload(traceData, { anchorTimestamp })
+      // Gated on delivered BiDi events, never on a subscription (Appium's shim
+      // accepts one and sends nothing) nor on the performance log, which is
+      // read after this drain and upgrades the page's rows in place instead.
+      this.processTracePayload(
+        withoutLoadsTheLogListed(traceData, listedByLog),
+        {
+          anchorTimestamp,
+          skipResourceTimingRequests: this.bidiNetworkObserved
+        }
+      )
       const mutationCount = Array.isArray(
         (traceData as { mutations?: unknown }).mutations
       )
diff --git a/packages/nightwatch-devtools/tests/perfLogs.test.ts b/packages/nightwatch-devtools/tests/perfLogs.test.ts
index e6c5f1a4..581f065b 100644
--- a/packages/nightwatch-devtools/tests/perfLogs.test.ts
+++ b/packages/nightwatch-devtools/tests/perfLogs.test.ts
@@ -1,9 +1,226 @@
+import {
+  NETWORK_CAPTURE_SOURCE,
+  type NetworkRequest
+} from '@wdio/devtools-shared'
 import { describe, expect, it } from 'vitest'
 import {
   parseNetworkFromPerfLogs,
+  upgradeResourceTimingRows,
+  withoutLoadsTheLogListed,
+  type LoadListedByLog,
+  type NetworkEntry,
   type PerfLogEntry
 } from '../src/helpers/perfLogs.js'
 
+/** A row the page's Resource Timing reported before the log was read. */
+function resourceTimingRow(
+  overrides: Partial<NetworkRequest> = {}
+): NetworkRequest {
+  return {
+    id: 'rt-1760000000500-abc',
+    url: 'https://x/a.js',
+    method: '',
+    type: 'script',
+    timestamp: 1_760_000_000_500,
+    startTime: 500,
+    endTime: 540,
+    time: 40,
+    timings: { blocked: 1, dns: 2, connect: 3, send: 0, wait: 20, receive: 4 },
+    source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING,
+    ...overrides
+  }
+}
+
+/** A perf-log entry for the same load, carrying what the page could not see. */
+function logEntry(overrides: Partial<NetworkEntry> = {}): NetworkEntry {
+  return {
+    id: '1000-R1',
+    url: 'https://x/a.js',
+    method: 'GET',
+    requestHeaders: { accept: '*/*' },
+    timestamp: 1_760_000_000_520,
+    startTime: 2000,
+    status: 200,
+    statusText: 'OK',
+    responseHeaders: { 'content-type': 'text/javascript' },
+    type: 'script',
+    size: 900,
+    ...overrides
+  }
+}
+
+describe('upgradeResourceTimingRows', () => {
+  it('pairs a log entry with the page row for the same load, under the row id', () => {
+    const existing = [resourceTimingRow()]
+    const { upgrades, fresh } = upgradeResourceTimingRows(
+      [logEntry()],
+      existing
+    )
+    expect(fresh).toEqual([])
+    expect(upgrades).toHaveLength(1)
+    expect(upgrades[0].index).toBe(0)
+    expect(upgrades[0].request).toMatchObject({
+      id: 'rt-1760000000500-abc',
+      method: 'GET',
+      status: 200,
+      statusText: 'OK',
+      requestHeaders: { accept: '*/*' },
+      responseHeaders: { 'content-type': 'text/javascript' },
+      size: 900
+    })
+    expect(upgrades[0].request.source).toBeUndefined()
+  })
+
+  it('keeps the page’s clock and measured phases under the log’s detail', () => {
+    // The page's row is on the document's clock, the log's on the driver's;
+    // mixing the two gives a row whose start and end are not comparable.
+    const { upgrades } = upgradeResourceTimingRows(
+      [logEntry({ startTime: 9000, endTime: 9050, time: 50 })],
+      [resourceTimingRow()]
+    )
+    expect(upgrades[0].request).toMatchObject({
+      timestamp: 1_760_000_000_500,
+      startTime: 500,
+      endTime: 540,
+      time: 40,
+      timings: { wait: 20 }
+    })
+  })
+
+  it('matches by time, nearest first, and spends each row once', () => {
+    const early = resourceTimingRow({
+      id: 'rt-early',
+      timestamp: 1_760_000_000_000
+    })
+    const late = resourceTimingRow({
+      id: 'rt-late',
+      timestamp: 1_760_000_003_000
+    })
+    const { upgrades } = upgradeResourceTimingRows(
+      [
+        logEntry({ id: 'L1', timestamp: 1_760_000_003_100 }),
+        logEntry({ id: 'L2', timestamp: 1_760_000_000_050 }),
+        logEntry({ id: 'L3', timestamp: 1_760_000_000_060 })
+      ],
+      [early, late]
+    )
+    expect(upgrades.map((u) => [u.request.id, u.index])).toEqual([
+      ['rt-late', 1],
+      ['rt-early', 0]
+    ])
+  })
+
+  it('leaves an entry fresh when no page row is within tolerance', () => {
+    const { upgrades, fresh } = upgradeResourceTimingRows(
+      [logEntry({ timestamp: 1_760_000_009_000 })],
+      [resourceTimingRow()]
+    )
+    expect(upgrades).toEqual([])
+    expect(fresh).toHaveLength(1)
+  })
+
+  it('never pairs with a row another source reported', () => {
+    const { upgrades, fresh } = upgradeResourceTimingRows(
+      [logEntry()],
+      [resourceTimingRow({ source: undefined })]
+    )
+    expect(upgrades).toEqual([])
+    expect(fresh).toHaveLength(1)
+  })
+
+  it('keeps the page’s type where the log never resolved one', () => {
+    const { upgrades } = upgradeResourceTimingRows(
+      [logEntry({ type: undefined })],
+      [resourceTimingRow()]
+    )
+    expect(upgrades[0].request.type).toBe('script')
+  })
+})
+
+describe('withoutLoadsTheLogListed', () => {
+  /** A load the log listed before the drain, dated from the driver's clock. */
+  const listed = (
+    overrides: Partial<LoadListedByLog> = {}
+  ): LoadListedByLog => ({
+    url: 'https://x/a.js',
+    timestamp: 1_760_000_000_520,
+    ...overrides
+  })
+
+  it('drops the page’s row for the load the log listed, and nothing else', () => {
+    const fresh = resourceTimingRow({ id: 'rt-2', url: 'https://x/b.js' })
+    const payload = withoutLoadsTheLogListed(
+      { mutations: [], networkRequests: [resourceTimingRow(), fresh] },
+      [listed()]
+    )
+    expect(payload.networkRequests).toEqual([fresh])
+    expect(payload.mutations).toEqual([])
+  })
+
+  it('keeps the row when the url or the clock differs', () => {
+    const rows = [resourceTimingRow()]
+    expect(
+      withoutLoadsTheLogListed({ networkRequests: rows }, [
+        listed({ url: 'https://x/b.js' })
+      ]).networkRequests
+    ).toEqual(rows)
+    expect(
+      withoutLoadsTheLogListed({ networkRequests: rows }, [
+        listed({ timestamp: 1_760_000_003_000 })
+      ]).networkRequests
+    ).toEqual(rows)
+  })
+
+  it('spends a listed load on one row, so a repeated request keeps its own', () => {
+    // Two requests to one url inside the window, the first listed by the log
+    // before the drain: the second is a request of its own, not the first's
+    // second listing.
+    const first = resourceTimingRow({ id: 'rt-first' })
+    const second = resourceTimingRow({
+      id: 'rt-second',
+      timestamp: 1_760_000_001_000
+    })
+    const payload = withoutLoadsTheLogListed(
+      { networkRequests: [first, second] },
+      [listed()]
+    )
+    expect(payload.networkRequests).toEqual([second])
+  })
+
+  it('takes the row nearest the listed load in time', () => {
+    const early = resourceTimingRow({
+      id: 'rt-early',
+      timestamp: 1_760_000_000_000
+    })
+    const late = resourceTimingRow({
+      id: 'rt-late',
+      timestamp: 1_760_000_001_000
+    })
+    const payload = withoutLoadsTheLogListed(
+      { networkRequests: [early, late] },
+      [listed({ timestamp: 1_760_000_000_900 })]
+    )
+    expect(payload.networkRequests).toEqual([early])
+  })
+
+  it('never takes a row another source reported', () => {
+    // The patch's own fetch row shares the url; it is a request of its own
+    // and carries the body nothing else captured.
+    const patched = resourceTimingRow({ id: 'fetch-1', source: undefined })
+    const payload = withoutLoadsTheLogListed({ networkRequests: [patched] }, [
+      listed()
+    ])
+    expect(payload.networkRequests).toEqual([patched])
+  })
+
+  it('returns a payload without requests, or with nothing listed, as it is', () => {
+    const noRequests = { mutations: [] }
+    expect(withoutLoadsTheLogListed(noRequests, [listed()])).toBe(noRequests)
+    const nothingListed = { networkRequests: [resourceTimingRow()] }
+    expect(withoutLoadsTheLogListed(nothingListed, [])).toBe(nothingListed)
+  })
+})
+
 /** Build a perf-log entry. `wrapperTs` is the WebDriver batch timestamp (often
  *  identical across a batch); the CDP monotonic time (seconds) lives in
  *  `params.timestamp`. */
@@ -57,6 +274,73 @@ describe('parseNetworkFromPerfLogs timing', () => {
     expect(req.size).toBe(512)
   })
 
+  it('dates the request by its wall clock beside the monotonic span', () => {
+    // Every consumer dates a row by `timestamp`, and the page's own row for
+    // the same load is on epoch time; the monotonic clock only diffs within
+    // a session.
+    const logs = [
+      entry(
+        'Network.requestWillBeSent',
+        {
+          requestId: '1',
+          request: { url: 'https://x/a', method: 'GET' },
+          timestamp: 2.0,
+          wallTime: 1760000000.5
+        },
+        1000
+      ),
+      entry(
+        'Network.responseReceived',
+        {
+          requestId: '1',
+          response: { status: 200, headers: {} },
+          timestamp: 2.1
+        },
+        1000
+      ),
+      entry(
+        'Network.loadingFinished',
+        { requestId: '1', timestamp: 2.15 },
+        1000
+      )
+    ]
+    expect(parseNetworkFromPerfLogs(logs)[0]).toMatchObject({
+      timestamp: 1_760_000_000_500,
+      startTime: 2000,
+      endTime: 2150,
+      time: 150
+    })
+  })
+
+  it('dates the request by the log batch when the event carries no wall clock', () => {
+    const logs = [
+      entry(
+        'Network.requestWillBeSent',
+        {
+          requestId: '1',
+          request: { url: 'https://x/a', method: 'GET' },
+          timestamp: 2.0
+        },
+        1000
+      ),
+      entry(
+        'Network.responseReceived',
+        {
+          requestId: '1',
+          response: { status: 200, headers: {} },
+          timestamp: 2.1
+        },
+        1000
+      ),
+      entry(
+        'Network.loadingFinished',
+        { requestId: '1', timestamp: 2.15 },
+        1000
+      )
+    ]
+    expect(parseNetworkFromPerfLogs(logs)[0].timestamp).toBe(1000)
+  })
+
   it('never produces a negative duration', () => {
     const logs = [
       entry(
diff --git a/packages/nightwatch-devtools/tests/session.test.ts b/packages/nightwatch-devtools/tests/session.test.ts
index 085c4404..5d211514 100644
--- a/packages/nightwatch-devtools/tests/session.test.ts
+++ b/packages/nightwatch-devtools/tests/session.test.ts
@@ -425,6 +425,236 @@ describe('SessionCapturer.captureTrace', () => {
   })
 })
 
+/** One request as Chrome's performance log reports it, with its wall clock. */
+const perfLog = (url: string, wallTime: number) =>
+  [
+    [
+      'Network.requestWillBeSent',
+      {
+        requestId: 'R1',
+        request: { url, method: 'GET', headers: { accept: '*/*' } },
+        timestamp: 2.0,
+        wallTime
+      }
+    ],
+    [
+      'Network.responseReceived',
+      {
+        requestId: 'R1',
+        response: {
+          status: 200,
+          statusText: 'OK',
+          headers: { 'content-type': 'text/javascript' },
+          mimeType: 'text/javascript'
+        },
+        timestamp: 2.1
+      }
+    ],
+    ['Network.loadingFinished', { requestId: 'R1', timestamp: 2.15 }]
+  ].map(([method, params]) => ({
+    level: 'INFO',
+    timestamp: 1000,
+    message: JSON.stringify({ message: { method, params } })
+  }))
+
+/**
+ * BiDi counts as the network source only once it has delivered an event:
+ * against Appium 3.7's XCUITest driver the inspectors attach and then send
+ * nothing, and gating on the attach alone withheld the page's only rows.
+ */
+describe('SessionCapturer.captureTrace and BiDi evidence', () => {
+  const resourceTimingRow = {
+    id: 'rt-1',
+    url: 'https://x/app.js',
+    method: 'GET',
+    type: 'script',
+    timestamp: 2,
+    startTime: 1,
+    source: 'resource-timing'
+  }
+
+  /** A driver whose drains answer `batches` in turn, the last one repeated;
+   *  `null` is a document with no collector, and the url read that recovery
+   *  then makes finds no document either. */
+  async function drainingServer(
+    batches: (unknown[] | null)[] = [[resourceTimingRow]],
+    getLog = vi.fn(async () => [])
+  ) {
+    const http = await import('node:http')
+    let drains = 0
+    const server = http.createServer((req, res) => {
+      let raw = ''
+      req.on('data', (c) => {
+        raw += c
+      })
+      req.on('end', () => {
+        const batch = raw.includes('location.href')
+          ? null
+          : batches[Math.min(drains++, batches.length - 1)]
+        res.setHeader('content-type', 'application/json')
+        res.end(
+          JSON.stringify({
+            value: batch && { mutations: [], networkRequests: batch }
+          })
+        )
+      })
+    })
+    await new Promise<void>((r) => server.listen(0, '127.0.0.1', () => r()))
+    const port = (server.address() as { port: number }).port
+    const browser = makeMockBrowser({
+      getLog,
+      sessionId: 'sess-bidi',
+      transport: { settings: { webdriver: { host: '127.0.0.1', port } } }
+    })
+    return {
+      browser,
+      close: () => new Promise<void>((r) => server.close(() => r()))
+    }
+  }
+
+  it('keeps the page’s rows while an attached BiDi has delivered nothing', async () => {
+    const { browser, close } = await drainingServer()
+    const cap = makeCapturer(browser)
+    cap.bidiActive = true
+    try {
+      await cap.captureTrace(browser)
+      expect(cap.networkRequests.map((r) => r.id)).toEqual(['rt-1'])
+    } finally {
+      await close()
+    }
+  })
+
+  /** The page's row for the load the log lists, and a second request to the
+   *  same url inside the window. */
+  const pageRow = { ...resourceTimingRow, timestamp: 1_760_000_000_500 }
+  const laterSameUrl = {
+    ...resourceTimingRow,
+    id: 'rt-2',
+    timestamp: 1_760_000_001_000
+  }
+  /** A log that lists the load once, at its first read. */
+  const logListingOnce = () =>
+    vi
+      .fn()
+      .mockResolvedValueOnce(perfLog('https://x/app.js', 1760000000.52))
+      .mockResolvedValue([])
+
+  it('drops the page’s row for a load the log listed first, and only that row', async () => {
+    // The log is read after the drain, so a load completing between the two
+    // reaches the session as the log's row first and the page's a drain
+    // later. A second request to the same url inside the window is a request
+    // of its own: it keeps its row rather than being read as the first's
+    // second listing, which a scan of every row the session held did.
+    const { browser, close } = await drainingServer(
+      [[], [pageRow], [laterSameUrl]],
+      logListingOnce()
+    )
+    const cap = makeCapturer(browser)
+    cap.perfLogsRequested = true
+    try {
+      await cap.captureTrace(browser)
+      expect(cap.networkRequests.map((r) => r.id)).toEqual(['1000-R1'])
+      await cap.captureTrace(browser)
+      expect(cap.networkRequests.map((r) => r.id)).toEqual(['1000-R1'])
+      await cap.captureTrace(browser)
+      expect(cap.networkRequests.map((r) => r.id)).toEqual(['1000-R1', 'rt-2'])
+    } finally {
+      await close()
+    }
+  })
+
+  it('spends what the log listed on a drain that found no collector', async () => {
+    // The drain reached the driver and the document the load belonged to is
+    // gone, so its row is never coming; kept, the load would take the next
+    // document's row for the same url.
+    const { browser, close } = await drainingServer(
+      [[], null, [laterSameUrl]],
+      logListingOnce()
+    )
+    const cap = makeCapturer(browser)
+    cap.perfLogsRequested = true
+    try {
+      await cap.captureTrace(browser)
+      await cap.captureTrace(browser)
+      await cap.captureTrace(browser)
+      expect(cap.networkRequests.map((r) => r.id)).toEqual(['1000-R1', 'rt-2'])
+    } finally {
+      await close()
+    }
+  })
+
+  it('drops them once the BiDi sink has received a request', async () => {
+    const { buildBidiSinks } = await import('../src/bidi.js')
+    const { browser, close } = await drainingServer()
+    const cap = makeCapturer(browser)
+    cap.bidiActive = true
+    buildBidiSinks(cap).pushNetworkRequest({
+      id: 'bidi-1',
+      url: 'https://x/',
+      method: 'GET',
+      type: 'document',
+      timestamp: 1,
+      startTime: 0
+    })
+    try {
+      await cap.captureTrace(browser)
+      expect(cap.networkRequests.map((r) => r.id)).toEqual(['bidi-1'])
+    } finally {
+      await close()
+    }
+  })
+})
+
+describe('SessionCapturer.captureNetworkFromPerformanceLogs upgrades', () => {
+  it('upgrades the page’s Resource Timing row in place with what the log saw', async () => {
+    // The drain runs before the log is read, so the page's row for a load is
+    // already in the session; the log's headers and status replace it under
+    // the same id rather than listing the load twice.
+    const browser = makeMockBrowser({
+      getLog: vi.fn(async () => perfLog('https://x/app.js', 1760000000.52))
+    })
+    const cap = makeCapturer(browser)
+    cap.perfLogsRequested = true
+    cap.networkRequests.push({
+      id: 'rt-1',
+      url: 'https://x/app.js',
+      method: 'GET',
+      type: 'script',
+      timestamp: 1_760_000_000_500,
+      startTime: 500,
+      source: 'resource-timing'
+    })
+    const upstream = vi.spyOn(cap, 'sendUpstream')
+
+    await cap.captureNetworkFromPerformanceLogs(browser)
+
+    expect(cap.networkRequests).toHaveLength(1)
+    expect(cap.networkRequests[0]).toMatchObject({
+      id: 'rt-1',
+      status: 200,
+      responseHeaders: { 'content-type': 'text/javascript' }
+    })
+    expect(cap.networkRequests[0].source).toBeUndefined()
+    expect(upstream).toHaveBeenCalledWith('networkRequests', [
+      expect.objectContaining({ id: 'rt-1', status: 200 })
+    ])
+  })
+
+  it('still appends a load the page never reported', async () => {
+    const browser = makeMockBrowser({
+      getLog: vi.fn(async () => perfLog('https://x/other.js', 1760000000.52))
+    })
+    const cap = makeCapturer(browser)
+    cap.perfLogsRequested = true
+
+    await cap.captureNetworkFromPerformanceLogs(browser)
+
+    expect(cap.networkRequests.map((r) => r.url)).toEqual([
+      'https://x/other.js'
+    ])
+  })
+})
+
 describe('SessionCapturer.anchorAfterNavigation', () => {
   /** A driver whose `performance.timeOrigin` reads follow `origins`, and whose
    *  drain answers an anchored payload. Every request is one JSON response, so
diff --git a/packages/nightwatch-devtools/tests/sessionRearm.test.ts b/packages/nightwatch-devtools/tests/sessionRearm.test.ts
index 3530c033..493304f7 100644
--- a/packages/nightwatch-devtools/tests/sessionRearm.test.ts
+++ b/packages/nightwatch-devtools/tests/sessionRearm.test.ts
@@ -40,6 +40,7 @@ type RearmCtx = Pick<
 interface FakeCapturer {
   preloadRegistered: boolean
   bidiActive: boolean
+  loadsListedByLog: unknown[]
   commandsLog: unknown[]
   consoleLogs: unknown[]
   networkRequests: unknown[]
@@ -51,6 +52,7 @@ function makeCtx(
   const capturer: FakeCapturer = {
     preloadRegistered: true,
     bidiActive: true,
+    loadsListedByLog: ['load-1'],
     commandsLog: ['cmd-1', 'cmd-2'],
     consoleLogs: ['log-1'],
     networkRequests: ['req-1']
@@ -187,13 +189,16 @@ describe('rearmCaptureForSession', () => {
   it('drops the dead session claims at detection, before the new ones land', () => {
     // The `<script>` fallback re-injects only where no preload is claimed, and
     // captureNetworkFromPerformanceLogs stands down when BiDi is active —
-    // between sessions neither claim is true any more.
+    // between sessions neither claim is true any more. A load the dead
+    // session's log listed went with its document, and kept it would take the
+    // new session's row for the same url.
     const { ctx, capturer } = makeCtx()
 
     rearm(ctx, fakeBrowser('session-2'))
 
     expect(capturer.preloadRegistered).toBe(false)
     expect(capturer.bidiActive).toBe(false)
+    expect(capturer.loadsListedByLog).toEqual([])
   })
 
   it('leaves the perf-log network path open when BiDi cannot be re-attached', async () => {
diff --git a/packages/script/src/collector.ts b/packages/script/src/collector.ts
index fab4ea82..a760abc8 100644
--- a/packages/script/src/collector.ts
+++ b/packages/script/src/collector.ts
@@ -1,6 +1,7 @@
 import { getLogs, clearLogs } from './logger.js'
 import { ConsoleLogCollector } from './collectors/consoleLogs.js'
 import { NetworkRequestCollector } from './collectors/networkRequests.js'
+import { ResourceTimingCollector } from './collectors/resourceTiming.js'
 import { assignRef, hasRef, parseDocument } from './utils.js'
 
 /**
@@ -44,6 +45,12 @@ export class DataCollector {
   #anchored = false
   #consoleLogs = new ConsoleLogCollector()
   #networkRequests = new NetworkRequestCollector()
+  /** The document's own record of every load, which is the only network
+   *  source a browser without BiDi has. Given the patch's claims so a fetch
+   *  both of them saw is reported once, with the patch's headers and body. */
+  #resourceTiming = new ResourceTimingCollector((url, startTime, entry) =>
+    this.#networkRequests.consumeClaim(url, startTime, entry)
+  )
 
   captureError(err: Error) {
     const error = err.stack || err.message
@@ -92,6 +99,7 @@ export class DataCollector {
     // re-emit the whole document.
     this.#consoleLogs.clear()
     this.#networkRequests.clear()
+    this.#resourceTiming.clear()
     clearLogs()
   }
 
@@ -104,7 +112,10 @@ export class DataCollector {
       errors: this.#errors,
       mutations: this.#mutations,
       consoleLogs: this.#consoleLogs.getArtifacts(),
-      networkRequests: this.#networkRequests.getArtifacts(),
+      networkRequests: [
+        ...this.#networkRequests.getArtifacts(),
+        ...this.#resourceTiming.getArtifacts()
+      ].sort((a, b) => a.startTime - b.startTime),
       traceLogs: getLogs(),
       metadata: this.getMetadata()
     } as const
@@ -114,4 +125,9 @@ export class DataCollector {
 }
 
 export type DataCollectorType = DataCollector
-export const collector = (window.wdioTraceCollector = new DataCollector())
+
+const installed = window.wdioTraceCollector
+// Two injections racing past one presence probe must not replace the collector.
+export const alreadyInstalled = installed !== undefined
+export const collector =
+  installed ?? (window.wdioTraceCollector = new DataCollector())
diff --git a/packages/script/src/collectors/network-helpers.ts b/packages/script/src/collectors/network-helpers.ts
new file mode 100644
index 00000000..c5ca12ef
--- /dev/null
+++ b/packages/script/src/collectors/network-helpers.ts
@@ -0,0 +1,48 @@
+import { isBrowserInternalUrl, schemeOf } from '@wdio/devtools-shared'
+
+/** Inline documents and sockets: no request a server answers either. */
+const INLINE_OR_SOCKET_SCHEMES = new Set(['data', 'blob', 'ws', 'wss'])
+
+function hasInternalScheme(url: string): boolean {
+  const scheme = schemeOf(url)
+  return (
+    scheme !== undefined &&
+    (INLINE_OR_SOCKET_SCHEMES.has(scheme) || isBrowserInternalUrl(url))
+  )
+}
+
+/** Internal URLs, non-HTTP schemes and browser housekeeping requests, which
+ *  neither the patched calls nor the Resource Timing entries report. */
+export function shouldIgnoreRequest(url: string): boolean {
+  if (!url) {
+    return true
+  }
+
+  const urlLower = url.toLowerCase()
+
+  if (hasInternalScheme(url)) {
+    return true
+  }
+
+  if (urlLower.includes('/.well-known/')) {
+    return true
+  }
+  if (urlLower.includes('/favicon.ico')) {
+    return true
+  }
+
+  return false
+}
+
+/** The form Resource Timing reports a URL in: absolute, resolved against the
+ *  document, and without the fragment. A patched call may have been made with
+ *  a relative one, or one carrying a `#`. */
+export function resourceTimingUrl(url: string): string {
+  try {
+    const resolved = new URL(url, document.baseURI)
+    resolved.hash = ''
+    return resolved.href
+  } catch {
+    return url
+  }
+}
diff --git a/packages/script/src/collectors/networkRequests.ts b/packages/script/src/collectors/networkRequests.ts
index 191ec3fd..cfbb3b30 100644
--- a/packages/script/src/collectors/networkRequests.ts
+++ b/packages/script/src/collectors/networkRequests.ts
@@ -1,10 +1,36 @@
 import type { Collector } from './collector.js'
 import type { NetworkRequest } from '../../types.js'
+import { resourceTimingUrl, shouldIgnoreRequest } from './network-helpers.js'
+
+/** A Resource Timing entry under a claimed URL that started within this many
+ *  ms of the claim is the same request, seen from the other side. */
+const CLAIM_TOLERANCE_MS = 1000
+
+/** Claims a long-polling page could accumulate between two drains; the oldest
+ *  are the ones whose entries have long since arrived. */
+const MAX_CLAIMS = 500
+
+interface Claim {
+  url: string
+  startTime: number
+  /** The patch recorded the call; the entry still to arrive is a second listing. */
+  recorded?: boolean
+  /** The entry arrived first and waits for the patch to record or drop the call. */
+  held?: NetworkRequest
+  /** The held entry, listed early; the call's own row replaces it if recorded. */
+  surfaced?: NetworkRequest
+}
 
 export class NetworkRequestCollector implements Collector<NetworkRequest> {
   #requests: NetworkRequest[] = []
   #pendingRequests = new Map<string, Partial<NetworkRequest>>()
   #pendingXHRRequests = new WeakMap<XMLHttpRequest, Partial<NetworkRequest>>()
+  /** Every fetch/XHR this patch has seen start, so the Resource Timing
+   *  collector can tell its own entry for the same request apart from a load
+   *  nobody else recorded. Survives `clear()`: the entry can arrive after the
+   *  drain that took the patched record. A call this patch drops gives the
+   *  entry it held back, so the request keeps its one record. */
+  #claims: Claim[] = []
   #originalFetch?: typeof fetch
   #originalXhrOpen?: typeof XMLHttpRequest.prototype.open
   #originalXhrSend?: typeof XMLHttpRequest.prototype.send
@@ -23,49 +49,88 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
     this.#pendingRequests.clear()
   }
 
-  #generateId(): string {
-    return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`
+  /** Whether this patch saw a request for `url` start within tolerance of
+   *  `startTime`. The entry is taken: either the call is already recorded and
+   *  the entry would be its second listing, or the entry is held until the
+   *  patch records or drops the call. A page polling one URL matches each
+   *  entry to one call. */
+  consumeClaim(url: string, startTime: number, entry: NetworkRequest): boolean {
+    const claim = this.#nearestClaim(url, startTime)
+    if (!claim) {
+      return false
+    }
+    if (claim.recorded) {
+      this.#dropClaim(claim)
+    } else {
+      claim.held = entry
+    }
+    return true
   }
 
-  #shouldIgnoreRequest(url: string): boolean {
-    // Filter out internal URLs, data URLs, blob URLs, chrome extensions, etc.
-    if (!url) {
-      return true
+  #nearestClaim(url: string, startTime: number): Claim | undefined {
+    let best: Claim | undefined
+    let bestDelta = CLAIM_TOLERANCE_MS
+    for (const claim of this.#claims) {
+      const delta = Math.abs(claim.startTime - startTime)
+      if (claim.url === url && !claim.held && delta <= bestDelta) {
+        best = claim
+        bestDelta = delta
+      }
     }
+    return best
+  }
 
-    const urlLower = url.toLowerCase()
-
-    // Ignore non-HTTP protocols
-    if (urlLower.startsWith('data:')) {
-      return true
-    }
-    if (urlLower.startsWith('blob:')) {
-      return true
-    }
-    if (urlLower.startsWith('chrome:')) {
-      return true
+  #claim(url: string, startTime: number): Claim {
+    const claim = { url: resourceTimingUrl(url), startTime }
+    this.#claims.push(claim)
+    if (this.#claims.length > MAX_CLAIMS) {
+      const dropped = this.#claims.shift()
+      if (dropped?.held) {
+        this.#requests.push(dropped.held)
+        dropped.surfaced = dropped.held
+        dropped.held = undefined
+      }
     }
-    if (urlLower.startsWith('chrome-extension:')) {
-      return true
+    return claim
+  }
+
+  /** The call was recorded: an entry already held is its second listing. */
+  #settleClaim(claim: Claim, recorded?: NetworkRequest): void {
+    if (claim.surfaced) {
+      const index = this.#requests.indexOf(claim.surfaced)
+      if (index !== -1) {
+        this.#requests.splice(index, 1)
+      } else if (recorded) {
+        // Already drained: the same id makes the dashboard replace that row.
+        recorded.id = claim.surfaced.id
+      }
+      this.#dropClaim(claim)
+      return
     }
-    if (urlLower.startsWith('about:')) {
-      return true
+    if (claim.held) {
+      this.#dropClaim(claim)
+    } else {
+      claim.recorded = true
     }
+  }
 
-    // Ignore WebSocket connections
-    if (urlLower.startsWith('ws:') || urlLower.startsWith('wss:')) {
-      return true
+  /** The call was dropped: an entry already held becomes the request's record. */
+  #releaseClaim(claim: Claim): void {
+    if (claim.held) {
+      this.#requests.push(claim.held)
     }
+    this.#dropClaim(claim)
+  }
 
-    // Ignore browser internal requests
-    if (urlLower.includes('/.well-known/')) {
-      return true
-    }
-    if (urlLower.includes('/favicon.ico')) {
-      return true
+  #dropClaim(claim: Claim): void {
+    const index = this.#claims.indexOf(claim)
+    if (index !== -1) {
+      this.#claims.splice(index, 1)
     }
+  }
 
-    return false
+  #generateId(): string {
+    return `${Date.now()}-${Math.random().toString(36).substr(2, 9)}`
   }
 
   #extractFetchUrl(input: RequestInfo | URL): string {
@@ -92,21 +157,23 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
     return undefined
   }
 
+  /** Whether the response is one this patch records: a content-type-less
+   *  response (a 204, a redirect target) is left to Resource Timing. */
   async #recordFetchResponse(
     id: string,
     request: Partial<NetworkRequest>,
     response: Response,
     startTime: number
-  ): Promise<void> {
+  ): Promise<NetworkRequest | undefined> {
     const endTime = performance.now()
     const responseHeaders = this.#extractHeaders(response.headers)
     const contentType = responseHeaders['content-type']?.trim()
     if (!contentType || contentType === '-') {
       this.#pendingRequests.delete(id)
-      return
+      return undefined
     }
     const responseBody = await this.#readResponseBody(response, contentType)
-    this.#requests.push({
+    const row: NetworkRequest = {
       id,
       url: request.url!,
       method: request.method!,
@@ -122,8 +189,10 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
       requestBody: request.requestBody,
       responseBody,
       size: this.#estimateSize(responseBody)
-    })
+    }
+    this.#requests.push(row)
     this.#pendingRequests.delete(id)
+    return row
   }
 
   #patchFetch() {
@@ -137,11 +206,12 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
       init?: RequestInit
     ): Promise<Response> {
       const url = self.#extractFetchUrl(input)
-      if (self.#shouldIgnoreRequest(url)) {
+      if (shouldIgnoreRequest(url)) {
         return self.#originalFetch!.apply(this, [input, init])
       }
       const id = self.#generateId()
       const startTime = performance.now()
+      const claim = self.#claim(url, startTime)
       const request: Partial<NetworkRequest> = {
         id,
         url,
@@ -155,10 +225,21 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
       self.#pendingRequests.set(id, request)
       try {
         const response = await self.#originalFetch!.apply(this, [input, init])
-        await self.#recordFetchResponse(id, request, response, startTime)
+        const recorded = await self.#recordFetchResponse(
+          id,
+          request,
+          response,
+          startTime
+        )
+        if (recorded) {
+          self.#settleClaim(claim, recorded)
+        } else {
+          self.#releaseClaim(claim)
+        }
         return response
       } catch (error) {
         self.#pendingRequests.delete(id)
+        self.#releaseClaim(claim)
         throw error
       }
     }
@@ -168,12 +249,12 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
     xhr: XMLHttpRequest,
     requestData: Partial<NetworkRequest>,
     startTime: number
-  ): void {
+  ): NetworkRequest | undefined {
     const endTime = performance.now()
     const responseHeaders = this.#extractXHRHeaders(xhr)
     const contentType = responseHeaders['content-type']?.trim()
     if (!contentType || contentType === '-') {
-      return
+      return undefined
     }
     let responseBody: string | undefined
     try {
@@ -186,7 +267,7 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
     } catch {
       /* ignore body read errors */
     }
-    this.#requests.push({
+    const row: NetworkRequest = {
       id: requestData.id!,
       url: requestData.url!,
       method: requestData.method!,
@@ -202,7 +283,9 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
       requestBody: requestData.requestBody,
       responseBody,
       size: this.#estimateSize(responseBody)
-    })
+    }
+    this.#requests.push(row)
+    return row
   }
 
   #patchXHROpen(self: this): void {
@@ -214,7 +297,7 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
       password?: string | null
     ) {
       const urlString = typeof url === 'string' ? url : url.href
-      if (!self.#shouldIgnoreRequest(urlString)) {
+      if (!shouldIgnoreRequest(urlString)) {
         self.#pendingXHRRequests.set(this, {
           id: self.#generateId(),
           url: urlString,
@@ -248,9 +331,36 @@ export class NetworkRequestCollector implements Collector<NetworkRequest> {
         requestData.requestBody = String(body)
       }
       const startTime = requestData.startTime || performance.now()
-      this.addEventListener('load', function (this: XMLHttpRequest) {
-        self.#recordXHRResponse(this, requestData, startTime)
-      })
+      // Claimed at send, not open: Resource Timing clocks the request from
+      // the send, and a page may open an XHR long before it sends it.
+      const claim = self.#claim(requestData.url!, performance.now())
+      const xhr = this
+      const listeners: Record<string, () => void> = {}
+      // One send's listeners must not outlive it: a page that reuses the
+      // object would otherwise record every earlier send on the next load.
+      const detach = () => {
+        for (const [type, fn] of Object.entries(listeners)) {
+          xhr.removeEventListener(type, fn)
+        }
+      }
+      listeners.load = () => {
+        detach()
+        const row = self.#recordXHRResponse(xhr, requestData, startTime)
+        if (row) {
+          self.#settleClaim(claim, row)
+        } else {
+          self.#releaseClaim(claim)
+        }
+      }
+      for (const reason of ['error', 'abort', 'timeout']) {
+        listeners[reason] = () => {
+          detach()
+          self.#releaseClaim(claim)
+        }
+      }
+      for (const [type, fn] of Object.entries(listeners)) {
+        xhr.addEventListener(type, fn)
+      }
       return self.#originalXhrSend!.call(this, body)
     }
   }
diff --git a/packages/script/src/collectors/resourceTiming.ts b/packages/script/src/collectors/resourceTiming.ts
new file mode 100644
index 00000000..953019fe
--- /dev/null
+++ b/packages/script/src/collectors/resourceTiming.ts
@@ -0,0 +1,216 @@
+import {
+  getRequestType,
+  NETWORK_CAPTURE_SOURCE,
+  type NetworkTimings,
+  type RequestType
+} from '@wdio/devtools-shared'
+import type { Collector } from './collector.js'
+import type { NetworkRequest } from '../../types.js'
+import { log } from '../logger.js'
+import { shouldIgnoreRequest } from './network-helpers.js'
+
+/** `responseStatus` is Resource Timing Level 2 (Chromium 109+); the lib types
+ *  lag the spec, and Safari reports nothing here at all. */
+type ResourceEntry = PerformanceResourceTiming & { responseStatus?: number }
+
+/** Initiators whose load the parser issues itself, so the method is known.
+ *  Anything else (a navigation, a fetch, a beacon) can carry a body, and
+ *  Resource Timing does not say which method it used. */
+const PARSER_INITIATORS = new Set([
+  'img',
+  'image',
+  'input',
+  'script',
+  'css',
+  'link',
+  'video',
+  'audio',
+  'track',
+  'use',
+  'object',
+  'embed',
+  'icon'
+])
+
+const GET = 'GET'
+const UNKNOWN_METHOD = ''
+
+/** Whether the patched fetch/XHR collector holds this request; given the entry
+ *  so it can hand it back if it drops the call. */
+export type ClaimConsumer = (
+  url: string,
+  startTime: number,
+  entry: NetworkRequest
+) => boolean
+
+function round(ms: number): number {
+  return Math.max(0, Math.round(ms * 10) / 10)
+}
+
+/** The phases, when the response exposed them: a cross-origin resource without
+ *  `Timing-Allow-Origin` reports every phase as zero, and zeros would read as
+ *  an instantaneous handshake rather than as withheld. */
+function timingsOf(entry: ResourceEntry): NetworkTimings | undefined {
+  if (!(entry.requestStart > 0)) {
+    return undefined
+  }
+  const lookupStart = entry.domainLookupStart || entry.fetchStart
+  const timings: NetworkTimings = {
+    blocked: round(lookupStart - entry.startTime),
+    dns: round(entry.domainLookupEnd - entry.domainLookupStart),
+    connect: round(entry.connectEnd - entry.connectStart),
+    send: 0,
+    wait: round(entry.responseStart - entry.requestStart),
+    receive: round(entry.responseEnd - entry.responseStart)
+  }
+  if (entry.secureConnectionStart > 0) {
+    timings.ssl = round(entry.connectEnd - entry.secureConnectionStart)
+  }
+  return timings
+}
+
+function classify(entry: ResourceEntry, isNavigation: boolean): RequestType {
+  if (isNavigation) {
+    return 'document'
+  }
+  switch (entry.initiatorType) {
+    case 'navigation':
+    case 'iframe':
+    case 'frame':
+      return 'document'
+    case 'script':
+      return 'script'
+    case 'img':
+    case 'image':
+    case 'input':
+      return 'image'
+    case 'fetch':
+    case 'beacon':
+      return 'fetch'
+    case 'xmlhttprequest':
+      return 'xhr'
+    default: {
+      // A stylesheet's own loads (fonts, background images) and `<link>`s carry
+      // no initiator worth a type; the extension says what they were. The
+      // classifier's residual is `xhr`, which here would be a guess.
+      const byUrl = getRequestType(entry.name)
+      return byUrl === 'xhr' ? 'other' : byUrl
+    }
+  }
+}
+
+/**
+ * Network capture from the document's own Resource Timing buffer: every load
+ * the document made, on every browser, with or without WebDriver BiDi. It
+ * holds what the patched `fetch`/`XMLHttpRequest` collector cannot see
+ * (parser-initiated loads, and requests made before that collector existed)
+ * and lacks what the patch has: headers, bodies, and outside Chromium the
+ * status. Each row says so with `source`.
+ */
+export class ResourceTimingCollector implements Collector<NetworkRequest> {
+  #requests: NetworkRequest[] = []
+  #navigationRecorded = false
+  readonly #consumeClaim: ClaimConsumer
+
+  constructor(consumeClaim: ClaimConsumer) {
+    this.#consumeClaim = consumeClaim
+    this.#seed()
+    this.#observe()
+  }
+
+  getArtifacts(): NetworkRequest[] {
+    return this.#requests
+  }
+
+  clear(): void {
+    this.#requests = []
+  }
+
+  /** What the buffer already holds: the loads before this collector existed.
+   *  Read before observing, synchronously, so no entry falls between the two. */
+  #seed(): void {
+    if (typeof performance?.getEntriesByType !== 'function') {
+      return
+    }
+    for (const entry of performance.getEntriesByType('navigation')) {
+      this.#record(entry as ResourceEntry, true)
+    }
+    for (const entry of performance.getEntriesByType('resource')) {
+      this.#record(entry as ResourceEntry, false)
+    }
+  }
+
+  #observe(): void {
+    if (typeof PerformanceObserver === 'undefined') {
+      return
+    }
+    try {
+      const observer = new PerformanceObserver((list) => {
+        for (const entry of list.getEntries()) {
+          this.#record(entry as ResourceEntry, entry.entryType === 'navigation')
+        }
+      })
+      observer.observe({ entryTypes: ['resource', 'navigation'] })
+    } catch (err) {
+      log('Resource Timing observer refused; the buffer alone is captured', err)
+    }
+  }
+
+  #record(entry: ResourceEntry, isNavigation: boolean): void {
+    // A document has one navigation entry, complete only once it has loaded;
+    // the observer delivers it then, and the seed may have read it earlier.
+    if (isNavigation) {
+      if (!(entry.responseEnd > 0) || this.#navigationRecorded) {
+        return
+      }
+      this.#navigationRecorded = true
+    }
+    if (shouldIgnoreRequest(entry.name)) {
+      return
+    }
+    const request = this.#toRequest(entry, isNavigation)
+    // The patch saw this fetch/XHR with its method, headers and body; this
+    // entry is the same request with none of them.
+    if (
+      (entry.initiatorType === 'fetch' ||
+        entry.initiatorType === 'xmlhttprequest') &&
+      this.#consumeClaim(entry.name, entry.startTime, request)
+    ) {
+      return
+    }
+    this.#requests.push(request)
+  }
+
+  #toRequest(entry: ResourceEntry, isNavigation: boolean): NetworkRequest {
+    const timeOrigin =
+      typeof performance.timeOrigin === 'number' && performance.timeOrigin > 0
+        ? performance.timeOrigin
+        : Date.now() - performance.now()
+    const timestamp = Math.round(timeOrigin + entry.startTime)
+    const status =
+      typeof entry.responseStatus === 'number' && entry.responseStatus > 0
+        ? entry.responseStatus
+        : undefined
+    // `transferSize` is zero for a cached response and for a cross-origin one
+    // without `Timing-Allow-Origin`; the body sizes survive the first case.
+    const size =
+      entry.transferSize || entry.encodedBodySize || entry.decodedBodySize || 0
+    const timings = timingsOf(entry)
+    return {
+      id: `rt-${timestamp}-${Math.random().toString(36).slice(2, 9)}`,
+      url: entry.name,
+      method: PARSER_INITIATORS.has(entry.initiatorType) ? GET : UNKNOWN_METHOD,
+      ...(status !== undefined ? { status } : {}),
+      type: classify(entry, isNavigation),
+      timestamp,
+      startTime: entry.startTime,
+      endTime: entry.responseEnd,
+      // Not `duration`: a navigation entry's runs to the load event, which is
+      // the page's work rather than the response's.
+      time: Math.max(0, entry.responseEnd - entry.startTime),
+      ...(size > 0 ? { size } : {}),
+      ...(timings ? { timings } : {}),
+      source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+    }
+  }
+}
diff --git a/packages/script/src/index.ts b/packages/script/src/index.ts
index b9d5016d..9a4ce0a1 100644
--- a/packages/script/src/index.ts
+++ b/packages/script/src/index.ts
@@ -7,68 +7,75 @@ import {
   shouldCapture
 } from './mutations.js'
 import { log } from './logger.js'
-import { collector } from './collector.js'
+import { alreadyInstalled, collector } from './collector.js'
 
-try {
-  log('waiting for body to render')
-  await waitForBody()
-  log('body rendered')
+// A second evaluation keeps the first collector and adds nothing: not even a
+// log line, since only the first evaluation's logger is ever drained.
+if (!alreadyInstalled) {
+  try {
+    log('waiting for body to render')
+    await waitForBody()
+    log('body rendered')
 
-  collector.captureCurrentDom()
-  log('added initial page structure')
+    collector.captureCurrentDom()
+    log('added initial page structure')
 
-  const observer = new MutationObserver((ml) => {
-    const timestamp = Date.now()
-    const mutationList = dropCoveredRecords(ml).filter(shouldCapture)
-    log(`observed ${mutationList.length} mutations`)
-    try {
-      collector.captureMutation(
-        mutationList.map((m) => serializeMutation(m, timestamp))
-      )
-    } catch (err) {
-      collector.captureError(err as Error)
-    }
-  })
-  observer.observe(observedRoot(), MUTATION_OBSERVER_CONFIG)
+    const observer = new MutationObserver((ml) => {
+      const timestamp = Date.now()
+      const mutationList = dropCoveredRecords(ml).filter(shouldCapture)
+      log(`observed ${mutationList.length} mutations`)
+      try {
+        collector.captureMutation(
+          mutationList.map((m) => serializeMutation(m, timestamp))
+        )
+      } catch (err) {
+        collector.captureError(err as Error)
+      }
+    })
+    observer.observe(observedRoot(), MUTATION_OBSERVER_CONFIG)
 
-  // Form-field state (value / checked) lives on element PROPERTIES, which the
-  // MutationObserver never reports — so a replayed page shows empty inputs even
-  // after a fill. Capture input/change and emit a synthetic attribute mutation
-  // carrying the live value so the replay shows what was typed or selected.
-  const captureFieldState = (target: EventTarget | null) => {
-    if (!(target instanceof Element)) {
-      return
-    }
-    const tag = target.tagName
-    if (tag !== 'INPUT' && tag !== 'TEXTAREA' && tag !== 'SELECT') {
-      return
+    // Form-field state (value / checked) lives on element PROPERTIES, which the
+    // MutationObserver never reports — so a replayed page shows empty inputs even
+    // after a fill. Capture input/change and emit a synthetic attribute mutation
+    // carrying the live value so the replay shows what was typed or selected.
+    const captureFieldState = (target: EventTarget | null) => {
+      if (!(target instanceof Element)) {
+        return
+      }
+      const tag = target.tagName
+      if (tag !== 'INPUT' && tag !== 'TEXTAREA' && tag !== 'SELECT') {
+        return
+      }
+      const ref = getRef(target)
+      if (!ref) {
+        return
+      }
+      const el = target as HTMLInputElement
+      const checkable =
+        tag === 'INPUT' && (el.type === 'checkbox' || el.type === 'radio')
+      collector.captureMutation([
+        {
+          type: 'attributes',
+          target: ref,
+          attributeName: checkable ? 'checked' : 'value',
+          // `String` never yields the ambiguous shape a boolean attribute reader
+          // has to guess at: `checked` is always an explicit "true"/"false", and
+          // `value` is not a boolean attribute, so its `''` is a real empty value.
+          attributeValue: checkable ? String(el.checked) : String(el.value),
+          addedNodes: [],
+          removedNodes: [],
+          timestamp: Date.now()
+        } as TraceMutation
+      ])
     }
-    const ref = getRef(target)
-    if (!ref) {
-      return
-    }
-    const el = target as HTMLInputElement
-    const checkable =
-      tag === 'INPUT' && (el.type === 'checkbox' || el.type === 'radio')
-    collector.captureMutation([
-      {
-        type: 'attributes',
-        target: ref,
-        attributeName: checkable ? 'checked' : 'value',
-        // `String` never yields the ambiguous shape a boolean attribute reader
-        // has to guess at: `checked` is always an explicit "true"/"false", and
-        // `value` is not a boolean attribute, so its `''` is a real empty value.
-        attributeValue: checkable ? String(el.checked) : String(el.value),
-        addedNodes: [],
-        removedNodes: [],
-        timestamp: Date.now()
-      } as TraceMutation
-    ])
+    document.addEventListener('input', (e) => captureFieldState(e.target), true)
+    document.addEventListener(
+      'change',
+      (e) => captureFieldState(e.target),
+      true
+    )
+  } catch (err) {
+    collector.captureError(err as Error)
   }
-  document.addEventListener('input', (e) => captureFieldState(e.target), true)
-  document.addEventListener('change', (e) => captureFieldState(e.target), true)
-} catch (err) {
-  collector.captureError(err as Error)
+  log('Finished program')
 }
-
-log('Finished program')
diff --git a/packages/script/src/utils.ts b/packages/script/src/utils.ts
index edd81a0b..07181fa8 100644
--- a/packages/script/src/utils.ts
+++ b/packages/script/src/utils.ts
@@ -40,6 +40,38 @@ const errorNode = (className: string, err: unknown) =>
  *  than what a second parser makes of its markup: `localName` keeps the case
  *  foreign elements need (`linearGradient`), and attribute names arrive already
  *  adjusted (`viewBox`), both of which parse5 had to special-case. */
+/** Field state lives on properties the attributes never see. A collector that
+ *  arrives after the typing (no document-start injection: Safari, Appium) would
+ *  otherwise anchor a form that replays empty. Mirrors `captureFieldState`. */
+function recordFieldState(
+  element: Element,
+  props: Record<string, unknown>
+): void {
+  const tag = element.tagName
+  if (tag !== 'INPUT' && tag !== 'TEXTAREA' && tag !== 'SELECT') {
+    return
+  }
+  const field = element as HTMLInputElement
+  if (
+    tag === 'INPUT' &&
+    (field.type === 'checkbox' || field.type === 'radio')
+  ) {
+    if (field.checked) {
+      props.checked = ''
+    } else {
+      delete props.checked
+    }
+    return
+  }
+  // A password's value stays out of the archive, as element-scripts keeps it.
+  if (tag === 'INPUT' && field.type === 'password') {
+    return
+  }
+  if (field.value !== (props.value ?? '')) {
+    props.value = field.value
+  }
+}
+
 export function parseNode(node: Node): SimplifiedVNode | string {
   if (node.nodeType === Node.COMMENT_NODE) {
     // Drop comment content — returning its data rendered the comment as visible
@@ -57,6 +89,7 @@ export function parseNode(node: Node): SimplifiedVNode | string {
     for (const attr of Array.from(element.attributes ?? [])) {
       props[attr.name] = attr.value
     }
+    recordFieldState(element, props)
     const children = Array.from(node.childNodes).map((child) =>
       parseNode(child)
     )
@@ -100,6 +133,13 @@ export const SLOW_BODY_NOTICE_MS = 10_000
  *  A body that is late is reported instead, so a page that never gets one is
  *  visible in the collector's logs rather than silently uncaptured. */
 export async function waitForBody() {
+  // Injected into a loaded document, the body is already there, and a frame is
+  // not: Safari's automation window paints only when something, such as a
+  // screenshot, makes it, so a wait on one left the collector without its
+  // listeners for the whole test. Only a document-start preload has to wait.
+  if (document.body) {
+    return
+  }
   let raf = 0
   let resolve: () => void
   const waitForPromise = new Promise<void>((res) => {
diff --git a/packages/script/tests/collector.test.ts b/packages/script/tests/collector.test.ts
index b6125daa..e97a2b7b 100644
--- a/packages/script/tests/collector.test.ts
+++ b/packages/script/tests/collector.test.ts
@@ -1,5 +1,5 @@
 /** @vitest-environment happy-dom */
-import { describe, it, expect, beforeEach } from 'vitest'
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
 import { DataCollector } from '../src/collector.js'
 
 const REF_ATTR = 'data-wdio-ref'
@@ -70,3 +70,83 @@ describe('captureCurrentDom', () => {
     expect(after).toEqual(before)
   })
 })
+
+describe('getTraceData network', () => {
+  /** Plays Resource Timing entries into whichever collector is observing. */
+  class FakeObserver {
+    static callbacks: ((list: { getEntries: () => unknown[] }) => void)[] = []
+    constructor(callback: (list: { getEntries: () => unknown[] }) => void) {
+      FakeObserver.callbacks.push(callback)
+    }
+    observe() {}
+    static deliver(...entries: unknown[]) {
+      for (const callback of FakeObserver.callbacks) {
+        callback({ getEntries: () => entries })
+      }
+    }
+  }
+  const realObserver = globalThis.PerformanceObserver
+
+  beforeEach(() => {
+    FakeObserver.callbacks = []
+    ;(globalThis as { PerformanceObserver: unknown }).PerformanceObserver =
+      FakeObserver
+  })
+
+  afterEach(() => {
+    ;(globalThis as { PerformanceObserver: unknown }).PerformanceObserver =
+      realObserver
+  })
+
+  it('lists the patched calls and the Resource Timing rows together, by start', async () => {
+    const realFetch = window.fetch
+    window.fetch = (() =>
+      Promise.resolve(
+        new Response('{}', {
+          status: 200,
+          headers: { 'content-type': 'application/json' }
+        })
+      )) as typeof fetch
+    try {
+      const c = new DataCollector()
+      await window.fetch('https://app.test/api/me')
+      FakeObserver.deliver({
+        name: 'https://app.test/app.js',
+        entryType: 'resource',
+        initiatorType: 'script',
+        startTime: 1,
+        responseEnd: 20,
+        requestStart: 0,
+        transferSize: 100
+      })
+
+      const { networkRequests } = c.getTraceData()
+      expect(networkRequests.map((r) => [r.url, r.source])).toEqual([
+        ['https://app.test/app.js', 'resource-timing'],
+        ['https://app.test/api/me', undefined]
+      ])
+      // A drain takes both halves; the next one starts empty.
+      expect(c.getTraceData().networkRequests).toEqual([])
+    } finally {
+      window.fetch = realFetch
+    }
+  })
+})
+
+describe('bundle installation', () => {
+  it('keeps the collector a previous evaluation installed', async () => {
+    // Two injections racing past one presence probe evaluate the bundle twice
+    // in one document; the second replacing the first dropped its buffers.
+    delete window.wdioTraceCollector
+    vi.resetModules()
+    const first = await import('../src/collector.js')
+    expect(first.alreadyInstalled).toBe(false)
+    expect(window.wdioTraceCollector).toBe(first.collector)
+
+    vi.resetModules()
+    const second = await import('../src/collector.js')
+    expect(second.alreadyInstalled).toBe(true)
+    expect(second.collector).toBe(first.collector)
+    delete window.wdioTraceCollector
+  })
+})
diff --git a/packages/script/tests/networkRequests.test.ts b/packages/script/tests/networkRequests.test.ts
index b610d7a6..2a0972ef 100644
--- a/packages/script/tests/networkRequests.test.ts
+++ b/packages/script/tests/networkRequests.test.ts
@@ -1,6 +1,8 @@
 /** @vitest-environment happy-dom */
+import { NETWORK_CAPTURE_SOURCE } from '@wdio/devtools-shared'
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
 import { NetworkRequestCollector } from '../src/collectors/networkRequests.js'
+import type { NetworkRequest } from '../types.js'
 
 // happy-dom doesn't ship a Blob with reliable .size in some versions —
 // fall back to a stub that returns the byte length so #estimateSize works
@@ -82,21 +84,37 @@ describe('NetworkRequestCollector — fetch capture', () => {
   })
 
   it('skips internal protocols (data:, blob:, chrome:, about:, ws:)', async () => {
-    for (const url of [
+    const internal = [
       'data:text/plain,hello',
       'blob:https://example.com/abc',
       'chrome://settings',
       'chrome-extension://abc/page',
+      'chrome-native://newtab/',
+      'chrome-untrusted://new-tab-page/',
+      'devtools://devtools/bundled/inspector.html',
       'about:blank',
       'ws://example.com',
       'wss://example.com'
-    ]) {
+    ]
+    for (const url of internal) {
       fetchMock.mockResolvedValueOnce(new Response(''))
       await window.fetch(url)
     }
     // Every call passed through to the original mock but NONE got captured
     expect(collector.getArtifacts()).toEqual([])
-    expect(fetchMock).toHaveBeenCalledTimes(7)
+    expect(fetchMock).toHaveBeenCalledTimes(internal.length)
+  })
+
+  it('keeps a relative path that merely begins like a scheme name', async () => {
+    fetchMock.mockResolvedValueOnce(
+      new Response('{}', { headers: { 'content-type': 'application/json' } })
+    )
+    await window.fetch('chrome-stuff/data.json')
+    fetchMock.mockResolvedValueOnce(
+      new Response('{}', { headers: { 'content-type': 'application/json' } })
+    )
+    await window.fetch('chrome-dashboard/export?from=10:00')
+    expect(collector.getArtifacts()).toHaveLength(2)
   })
 
   it('skips noise URLs (/favicon.ico, /.well-known/...)', async () => {
@@ -142,6 +160,28 @@ describe('NetworkRequestCollector — fetch capture', () => {
     expect(collector.getArtifacts()).toEqual([])
   })
 
+  it('records each send of a reused XMLHttpRequest once', () => {
+    const xhr = new XMLHttpRequest()
+    Object.defineProperty(xhr, 'status', { value: 200, configurable: true })
+    Object.defineProperty(xhr, 'getAllResponseHeaders', {
+      value: () => 'content-type: text/plain\r\n',
+      configurable: true
+    })
+    Object.defineProperty(xhr, 'responseText', {
+      value: 'ok',
+      configurable: true
+    })
+    for (const path of ['/first', '/second']) {
+      xhr.open('GET', `https://api.example.com${path}`)
+      xhr.send()
+      xhr.dispatchEvent(new Event('load'))
+    }
+    expect(collector.getArtifacts().map((r) => r.url)).toEqual([
+      'https://api.example.com/first',
+      'https://api.example.com/second'
+    ])
+  })
+
   it('extracts headers from all three accepted shapes (Headers, Array, plain object) and lowercases keys', async () => {
     // Headers instance
     fetchMock.mockResolvedValueOnce(
@@ -257,3 +297,208 @@ describe('NetworkRequestCollector — XHR capture', () => {
     expect(req.responseHeaders).toHaveProperty('content-type', 'text/plain')
   })
 })
+
+/** The Resource Timing collector asks about each fetch/XHR entry it sees; a
+ *  claim is what lets it tell the patch's own request from one nobody else
+ *  recorded. Resource Timing clocks from `performance.now()` too. */
+describe('NetworkRequestCollector: claims for the Resource Timing collector', () => {
+  const jsonResponse = () =>
+    new Response('{}', {
+      status: 200,
+      headers: { 'content-type': 'application/json' }
+    })
+
+  /** The buffer's own row for a load, as the Resource Timing collector offers it. */
+  const entryFor = (url: string, startTime: number): NetworkRequest => ({
+    id: `rt-${url}`,
+    url,
+    method: '',
+    type: 'fetch',
+    timestamp: Date.now(),
+    startTime,
+    source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+  })
+  const consume = (url: string, startTime: number) =>
+    collector.consumeClaim(url, startTime, entryFor(url, startTime))
+
+  it('claims a fetch at its start, under the absolute URL the buffer names', async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse())
+    const before = performance.now()
+    await window.fetch('/api/me#section')
+
+    const expected = new URL('/api/me', document.baseURI).href
+    expect(consume(expected, before)).toBe(true)
+  })
+
+  it('spends a claim once, so a polled URL matches one entry per call', async () => {
+    fetchMock.mockResolvedValue(jsonResponse())
+    await window.fetch('https://api.example.com/poll')
+    await window.fetch('https://api.example.com/poll')
+
+    const now = performance.now()
+    expect(consume('https://api.example.com/poll', now)).toBe(true)
+    expect(consume('https://api.example.com/poll', now)).toBe(true)
+    expect(consume('https://api.example.com/poll', now)).toBe(false)
+  })
+
+  it('does not match an entry outside the tolerance or under another URL', async () => {
+    fetchMock.mockResolvedValueOnce(jsonResponse())
+    await window.fetch('https://api.example.com/a')
+
+    const now = performance.now()
+    expect(consume('https://api.example.com/b', now)).toBe(false)
+    expect(consume('https://api.example.com/a', now + 5000)).toBe(false)
+    expect(consume('https://api.example.com/a', now)).toBe(true)
+  })
+
+  it('releases the claim of a fetch it does not record, so the entry stays', async () => {
+    // A 204 carries no content-type, and the patch records nothing for it;
+    // the buffer's entry is then the request's only record.
+    fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }))
+    await window.fetch('https://api.example.com/save')
+
+    expect(collector.getArtifacts()).toEqual([])
+    expect(consume('https://api.example.com/save', performance.now())).toBe(
+      false
+    )
+  })
+
+  it('releases the claim of a fetch that rejected', async () => {
+    fetchMock.mockRejectedValueOnce(new TypeError('Failed to fetch'))
+    await expect(window.fetch('https://api.example.com/down')).rejects.toThrow()
+
+    expect(consume('https://api.example.com/down', performance.now())).toBe(
+      false
+    )
+  })
+
+  it('lists a request once when its call finishes after its claim left the window', async () => {
+    let answer!: (response: Response) => void
+    fetchMock.mockReturnValueOnce(new Promise<Response>((r) => (answer = r)))
+    const call = window.fetch('https://api.example.com/oldest')
+    expect(consume('https://api.example.com/oldest', performance.now())).toBe(
+      true
+    )
+    fetchMock.mockReturnValue(new Promise<Response>(() => {}))
+    for (let i = 0; i < 500; i++) {
+      void window.fetch(`https://api.example.com/poll-${i}`)
+    }
+    expect(collector.getArtifacts()).toHaveLength(1)
+    answer(jsonResponse())
+    await call
+    expect(collector.getArtifacts().map((r) => [r.url, r.source])).toEqual([
+      ['https://api.example.com/oldest', undefined]
+    ])
+  })
+
+  it('reuses the surfaced row id when that row was already drained', async () => {
+    let answer!: (response: Response) => void
+    fetchMock.mockReturnValueOnce(new Promise<Response>((r) => (answer = r)))
+    const call = window.fetch('https://api.example.com/oldest')
+    consume('https://api.example.com/oldest', performance.now())
+    fetchMock.mockReturnValue(new Promise<Response>(() => {}))
+    for (let i = 0; i < 500; i++) {
+      void window.fetch(`https://api.example.com/poll-${i}`)
+    }
+    const surfacedId = collector.getArtifacts()[0].id
+    collector.clear()
+    answer(jsonResponse())
+    await call
+    expect(collector.getArtifacts().map((r) => r.id)).toEqual([surfacedId])
+  })
+
+  it('surfaces the entry a claim holds when the claim is pushed out of the window', async () => {
+    fetchMock.mockReturnValue(new Promise<Response>(() => {}))
+    void window.fetch('https://api.example.com/oldest')
+    expect(consume('https://api.example.com/oldest', performance.now())).toBe(
+      true
+    )
+    for (let i = 0; i < 500; i++) {
+      void window.fetch(`https://api.example.com/poll-${i}`)
+    }
+    expect(collector.getArtifacts()).toEqual([
+      expect.objectContaining({
+        url: 'https://api.example.com/oldest',
+        source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+      })
+    ])
+  })
+
+  it('claims an XHR when it is sent, and releases it on error', () => {
+    const xhr = new XMLHttpRequest()
+    xhr.open('GET', 'https://api.example.com/xhr')
+    expect(consume('https://api.example.com/xhr', performance.now())).toBe(
+      false
+    )
+
+    xhr.send()
+    const failing = new XMLHttpRequest()
+    failing.open('GET', 'https://api.example.com/xhr-down')
+    failing.send()
+    failing.dispatchEvent(new Event('error'))
+
+    const now = performance.now()
+    expect(consume('https://api.example.com/xhr', now)).toBe(true)
+    expect(consume('https://api.example.com/xhr-down', now)).toBe(false)
+  })
+
+  it('keeps its claims across a drain', async () => {
+    // The entry can arrive after the drain that took the patched record.
+    fetchMock.mockResolvedValueOnce(jsonResponse())
+    await window.fetch('https://api.example.com/late')
+    collector.clear()
+
+    expect(consume('https://api.example.com/late', performance.now())).toBe(
+      true
+    )
+  })
+
+  it('hands a held entry back when the call it waited for is dropped', async () => {
+    // The buffer can report a load before the patch has the response; the
+    // entry is held, and a call the patch then drops leaves it as the record.
+    let answer!: (response: Response) => void
+    fetchMock.mockReturnValueOnce(new Promise<Response>((r) => (answer = r)))
+    const call = window.fetch('https://api.example.com/save')
+    expect(consume('https://api.example.com/save', performance.now())).toBe(
+      true
+    )
+    expect(collector.getArtifacts()).toEqual([])
+
+    answer(new Response(null, { status: 204 }))
+    await call
+    expect(collector.getArtifacts()).toEqual([
+      expect.objectContaining({
+        url: 'https://api.example.com/save',
+        source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+      })
+    ])
+  })
+
+  it('drops a held entry once the call it waited for is recorded', async () => {
+    let answer!: (response: Response) => void
+    fetchMock.mockReturnValueOnce(new Promise<Response>((r) => (answer = r)))
+    const call = window.fetch('https://api.example.com/me')
+    expect(consume('https://api.example.com/me', performance.now())).toBe(true)
+
+    answer(jsonResponse())
+    await call
+    expect(collector.getArtifacts().map((r) => r.source)).toEqual([undefined])
+    expect(consume('https://api.example.com/me', performance.now())).toBe(false)
+  })
+
+  it('holds one entry per call, so a second entry finds the next call', async () => {
+    let answer!: (response: Response) => void
+    fetchMock.mockReturnValueOnce(new Promise<Response>((r) => (answer = r)))
+    fetchMock.mockResolvedValueOnce(jsonResponse())
+    const first = window.fetch('https://api.example.com/poll')
+    await window.fetch('https://api.example.com/poll')
+
+    const now = performance.now()
+    expect(consume('https://api.example.com/poll', now)).toBe(true)
+    expect(consume('https://api.example.com/poll', now)).toBe(true)
+    expect(consume('https://api.example.com/poll', now)).toBe(false)
+    answer(jsonResponse())
+    await first
+    expect(collector.getArtifacts()).toHaveLength(2)
+  })
+})
diff --git a/packages/script/tests/resourceTiming.test.ts b/packages/script/tests/resourceTiming.test.ts
new file mode 100644
index 00000000..872f14e7
--- /dev/null
+++ b/packages/script/tests/resourceTiming.test.ts
@@ -0,0 +1,372 @@
+/** @vitest-environment happy-dom */
+import { NETWORK_CAPTURE_SOURCE } from '@wdio/devtools-shared'
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { ResourceTimingCollector } from '../src/collectors/resourceTiming.js'
+
+type Entry = Record<string, unknown> & { name: string; entryType: string }
+
+/** A resource entry as Chromium reports one that allowed timing: every phase
+ *  set, a status, and a transfer size. Overrides shape the edge cases. */
+function resource(overrides: Partial<Entry> = {}): Entry {
+  return {
+    name: 'https://app.test/static/app.js',
+    entryType: 'resource',
+    initiatorType: 'script',
+    startTime: 100,
+    duration: 50,
+    fetchStart: 100,
+    domainLookupStart: 102,
+    domainLookupEnd: 104,
+    connectStart: 104,
+    secureConnectionStart: 106,
+    connectEnd: 110,
+    requestStart: 111,
+    responseStart: 140,
+    responseEnd: 150,
+    transferSize: 1200,
+    encodedBodySize: 900,
+    decodedBodySize: 2400,
+    responseStatus: 200,
+    ...overrides
+  }
+}
+
+/** A navigation entry: the document itself, whose `duration` runs on to the
+ *  load event rather than ending with the response. */
+function navigation(overrides: Partial<Entry> = {}): Entry {
+  return resource({
+    name: 'https://app.test/login',
+    entryType: 'navigation',
+    initiatorType: 'navigation',
+    startTime: 0,
+    fetchStart: 1,
+    domainLookupStart: 2,
+    domainLookupEnd: 3,
+    connectStart: 3,
+    secureConnectionStart: 0,
+    connectEnd: 5,
+    requestStart: 6,
+    responseStart: 30,
+    responseEnd: 40,
+    duration: 400,
+    ...overrides
+  })
+}
+
+/** Stands in for the browser's observer: construction records the callback,
+ *  `deliver` plays entries into it the way a browser would. */
+class FakeObserver {
+  static callbacks: ((list: { getEntries: () => Entry[] }) => void)[] = []
+  static observed: unknown[] = []
+
+  constructor(callback: (list: { getEntries: () => Entry[] }) => void) {
+    FakeObserver.callbacks.push(callback)
+  }
+
+  observe(options: unknown) {
+    FakeObserver.observed.push(options)
+  }
+
+  static deliver(...entries: Entry[]) {
+    for (const callback of FakeObserver.callbacks) {
+      callback({ getEntries: () => entries })
+    }
+  }
+
+  static reset() {
+    FakeObserver.callbacks = []
+    FakeObserver.observed = []
+  }
+}
+
+const realObserver = globalThis.PerformanceObserver
+let buffer: Record<string, Entry[]>
+
+beforeEach(() => {
+  FakeObserver.reset()
+  buffer = { navigation: [], resource: [] }
+  ;(globalThis as { PerformanceObserver: unknown }).PerformanceObserver =
+    FakeObserver
+  vi.spyOn(performance, 'getEntriesByType').mockImplementation(
+    (type: string) => (buffer[type] ?? []) as unknown as PerformanceEntry[]
+  )
+})
+
+afterEach(() => {
+  ;(globalThis as { PerformanceObserver: unknown }).PerformanceObserver =
+    realObserver
+  vi.restoreAllMocks()
+})
+
+const neverClaimed = () => false
+
+describe('ResourceTimingCollector: the buffer at construction', () => {
+  it('reports what loaded before the collector existed', () => {
+    // The whole point over the fetch/XHR patch: a `<script>`-injected
+    // collector arrives after the document and its first resources loaded,
+    // and the buffer still holds them.
+    buffer.navigation = [navigation()]
+    buffer.resource = [
+      resource(),
+      resource({
+        name: 'https://app.test/static/logo.png',
+        initiatorType: 'img'
+      })
+    ]
+
+    const requests = new ResourceTimingCollector(neverClaimed).getArtifacts()
+
+    expect(requests.map((r) => [r.url, r.type])).toEqual([
+      ['https://app.test/login', 'document'],
+      ['https://app.test/static/app.js', 'script'],
+      ['https://app.test/static/logo.png', 'image']
+    ])
+    expect(
+      requests.every((r) => r.source === NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING)
+    ).toBe(true)
+  })
+
+  it('reads the buffer before it observes, so no entry falls between', () => {
+    buffer.resource = [resource()]
+    const collector = new ResourceTimingCollector(neverClaimed)
+    expect(collector.getArtifacts()).toHaveLength(1)
+    expect(FakeObserver.observed).toEqual([
+      { entryTypes: ['resource', 'navigation'] }
+    ])
+  })
+
+  it('captures from the buffer alone where no observer exists', () => {
+    ;(globalThis as { PerformanceObserver: unknown }).PerformanceObserver =
+      undefined
+    buffer.resource = [resource()]
+    expect(
+      new ResourceTimingCollector(neverClaimed).getArtifacts()
+    ).toHaveLength(1)
+  })
+})
+
+describe('ResourceTimingCollector: observed entries', () => {
+  it('appends entries the browser delivers after construction', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(resource(), navigation())
+    expect(collector.getArtifacts().map((r) => r.type)).toEqual([
+      'script',
+      'document'
+    ])
+  })
+
+  it('records the navigation once, whichever path delivers it first', () => {
+    // The seed may read the navigation entry and the observer deliver it again
+    // once the load event completes it.
+    buffer.navigation = [navigation()]
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(navigation())
+    expect(collector.getArtifacts()).toHaveLength(1)
+  })
+
+  it('waits for a navigation whose response has not ended', () => {
+    // A streaming document is still downloading when a `<script>` in it runs;
+    // the observer delivers the completed entry later.
+    buffer.navigation = [navigation({ responseEnd: 0 })]
+    const collector = new ResourceTimingCollector(neverClaimed)
+    expect(collector.getArtifacts()).toHaveLength(0)
+    FakeObserver.deliver(navigation())
+    expect(collector.getArtifacts()).toHaveLength(1)
+  })
+
+  it('clear() empties the drained rows and keeps observing', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(resource())
+    collector.clear()
+    expect(collector.getArtifacts()).toEqual([])
+    FakeObserver.deliver(resource())
+    expect(collector.getArtifacts()).toHaveLength(1)
+  })
+})
+
+describe('ResourceTimingCollector: what the fetch/XHR patch already holds', () => {
+  it('skips a fetch or XHR the patch claimed, consulting it with the entry', () => {
+    const consume = vi.fn(() => true)
+    const collector = new ResourceTimingCollector(consume)
+    FakeObserver.deliver(
+      resource({ name: 'https://app.test/api/me', initiatorType: 'fetch' }),
+      resource({
+        name: 'https://app.test/api/list',
+        initiatorType: 'xmlhttprequest'
+      })
+    )
+    expect(collector.getArtifacts()).toEqual([])
+    expect(consume).toHaveBeenCalledWith(
+      'https://app.test/api/me',
+      100,
+      expect.objectContaining({
+        url: 'https://app.test/api/me',
+        type: 'fetch',
+        source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+      })
+    )
+  })
+
+  it('keeps a fetch the patch never saw, with the method it cannot know', () => {
+    // A fetch made before the collector was installed: the buffer is the only
+    // record of it, and Resource Timing names no method.
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource({ name: 'https://app.test/api/me', initiatorType: 'fetch' })
+    )
+    expect(collector.getArtifacts()[0]).toMatchObject({
+      type: 'fetch',
+      method: ''
+    })
+  })
+
+  it('never asks the patch about a parser-initiated load', () => {
+    const consume = vi.fn(() => true)
+    new ResourceTimingCollector(consume)
+    FakeObserver.deliver(resource({ initiatorType: 'img' }))
+    expect(consume).not.toHaveBeenCalled()
+  })
+})
+
+describe('ResourceTimingCollector: the row it builds', () => {
+  it('stamps epoch time from the document origin and the response span, not duration', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(navigation())
+    const [row] = collector.getArtifacts()
+    expect(row.timestamp).toBe(Math.round(performance.timeOrigin + 0))
+    expect(row.startTime).toBe(0)
+    expect(row.endTime).toBe(40)
+    expect(row.time).toBe(40)
+  })
+
+  it('gives every row an id of its own, across collector instances', () => {
+    // Two collectors on one document (a re-injection) must not hand the
+    // dashboard rows that replace each other.
+    const first = new ResourceTimingCollector(neverClaimed)
+    const second = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(resource())
+    const ids = [...first.getArtifacts(), ...second.getArtifacts()].map(
+      (r) => r.id
+    )
+    expect(ids).toHaveLength(2)
+    expect(new Set(ids).size).toBe(2)
+    expect(ids[0]).toMatch(/^rt-\d+-[a-z0-9]+$/)
+  })
+
+  it('names GET only for loads the parser issues itself', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource({ initiatorType: 'script' }),
+      resource({ initiatorType: 'css', name: 'https://app.test/a.woff2' }),
+      navigation(),
+      resource({ initiatorType: 'beacon', name: 'https://app.test/beat' })
+    )
+    expect(collector.getArtifacts().map((r) => r.method)).toEqual([
+      'GET',
+      'GET',
+      '',
+      ''
+    ])
+  })
+
+  it('classifies by initiator, then by extension, and never guesses', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource({ initiatorType: 'css', name: 'https://app.test/a.woff2' }),
+      resource({ initiatorType: 'link', name: 'https://app.test/a.css' }),
+      resource({ initiatorType: 'iframe', name: 'https://app.test/frame' }),
+      resource({ initiatorType: 'beacon', name: 'https://app.test/beat' }),
+      resource({ initiatorType: 'other', name: 'https://app.test/blob' })
+    )
+    expect(collector.getArtifacts().map((r) => r.type)).toEqual([
+      'font',
+      'stylesheet',
+      'document',
+      'fetch',
+      'other'
+    ])
+  })
+
+  it('carries a status only where the browser reports one', () => {
+    // Chromium reports `responseStatus`; Safari reports nothing, and 0 is what
+    // a transport failure means elsewhere, so it must not be stamped.
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource({ responseStatus: 304 }),
+      resource({ responseStatus: 0 }),
+      resource({ responseStatus: undefined })
+    )
+    expect(collector.getArtifacts().map((r) => r.status)).toEqual([
+      304,
+      undefined,
+      undefined
+    ])
+    expect('status' in collector.getArtifacts()[1]).toBe(false)
+  })
+
+  it('sizes by transfer, then by body, and omits a size it never saw', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource(),
+      resource({ transferSize: 0, encodedBodySize: 900 }),
+      resource({ transferSize: 0, encodedBodySize: 0, decodedBodySize: 0 })
+    )
+    expect(collector.getArtifacts().map((r) => r.size)).toEqual([
+      1200,
+      900,
+      undefined
+    ])
+  })
+
+  it('measures the phases a response exposed, and none it withheld', () => {
+    // Cross-origin without Timing-Allow-Origin zeroes every phase; zeros would
+    // read as an instant handshake rather than as withheld.
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource(),
+      navigation(),
+      resource({
+        requestStart: 0,
+        responseStart: 0,
+        domainLookupStart: 0,
+        domainLookupEnd: 0,
+        connectStart: 0,
+        connectEnd: 0
+      })
+    )
+    const [tls, plain, withheld] = collector.getArtifacts()
+    expect(tls.timings).toEqual({
+      blocked: 2,
+      dns: 2,
+      connect: 6,
+      ssl: 4,
+      send: 0,
+      wait: 29,
+      receive: 10
+    })
+    expect(plain.timings).toEqual({
+      blocked: 2,
+      dns: 1,
+      connect: 2,
+      send: 0,
+      wait: 24,
+      receive: 10
+    })
+    expect(withheld.timings).toBeUndefined()
+  })
+
+  it('ignores the URLs the fetch/XHR patch ignores', () => {
+    const collector = new ResourceTimingCollector(neverClaimed)
+    FakeObserver.deliver(
+      resource({ name: 'data:image/png;base64,AAAA', initiatorType: 'img' }),
+      resource({ name: 'blob:https://app.test/1234', initiatorType: 'img' }),
+      resource({
+        name: 'https://app.test/favicon.ico',
+        initiatorType: 'other'
+      }),
+      // The new tab Chrome on Android opens a session on, before any navigation.
+      navigation({ name: 'chrome-native://newtab/' })
+    )
+    expect(collector.getArtifacts()).toEqual([])
+  })
+})
diff --git a/packages/script/tests/utils.test.ts b/packages/script/tests/utils.test.ts
index 37f45503..1f098e33 100644
--- a/packages/script/tests/utils.test.ts
+++ b/packages/script/tests/utils.test.ts
@@ -15,6 +15,13 @@ import { clearLogs, getLogs } from '../src/logger.js'
 const slowBodyNotices = () =>
   getLogs().filter((line) => line.includes('no <body> after'))
 
+/** The serialized children of a vnode, as `{ props }` records. */
+const childProps = (tree: unknown): Record<string, unknown>[] =>
+  (
+    (tree as { props: { children: { props: Record<string, unknown> }[] } })
+      .props.children ?? []
+  ).map((child) => child.props)
+
 describe('DOM mutation capture utilities', () => {
   beforeEach(() => {
     clearLogs()
@@ -29,6 +36,24 @@ describe('DOM mutation capture utilities', () => {
     await expect(waitForBody()).resolves.toBeUndefined()
   })
 
+  it('resolves at once for a body that already exists, without a frame', async () => {
+    // A `<script>`-injected collector lands in a loaded document whose window
+    // may never paint (Safari under automation); its listeners cannot wait.
+    const raf = vi
+      .spyOn(window, 'requestAnimationFrame')
+      .mockImplementation(() => 0)
+    try {
+      const settled = await Promise.race([
+        waitForBody().then(() => 'resolved'),
+        new Promise<string>((r) => setTimeout(() => r('timed out'), 200))
+      ])
+      expect(settled).toBe('resolved')
+      expect(raf).not.toHaveBeenCalled()
+    } finally {
+      raf.mockRestore()
+    }
+  })
+
   it('resolves for a body parsed after the first animation frame', async () => {
     // A document-start preload runs before <body> exists, and a slow <head>
     // lets the browser paint frames before the parser reaches it.
@@ -142,6 +167,33 @@ describe('DOM mutation capture utilities', () => {
     expect(JSON.stringify(vnode)).toBeTruthy()
   })
 
+  it('carries a field’s typed value and checked state, which no attribute holds', () => {
+    // A collector that arrives after the typing anchors the form as it is now;
+    // without this the replay of a page typed into before injection is empty.
+    const form = document.createElement('form')
+    form.innerHTML =
+      '<input id="u" value="initial"><textarea id="t"></textarea>' +
+      '<input id="c" type="checkbox"><input id="d" type="checkbox" checked>'
+    ;(form.querySelector('#u') as HTMLInputElement).value = 'tomsmith'
+    ;(form.querySelector('#t') as HTMLTextAreaElement).value = 'notes'
+    ;(form.querySelector('#c') as HTMLInputElement).checked = true
+    ;(form.querySelector('#d') as HTMLInputElement).checked = false
+
+    const props = childProps(parseDocument(form as unknown as HTMLElement))
+    expect(props[0]).toMatchObject({ id: 'u', value: 'tomsmith' })
+    expect(props[1]).toMatchObject({ id: 't', value: 'notes' })
+    expect(props[2]).toMatchObject({ id: 'c', checked: '' })
+    expect(props[3]).not.toHaveProperty('checked')
+  })
+
+  it('leaves an untouched field’s attributes as they are', () => {
+    const div = document.createElement('div')
+    div.innerHTML = '<input id="u" value="initial"><input id="e">'
+    const props = childProps(parseDocument(div as unknown as HTMLElement))
+    expect(props[0]).toMatchObject({ value: 'initial' })
+    expect(props[1]).not.toHaveProperty('value')
+  })
+
   it('should serialize complete document hierarchy for initial capture', () => {
     const div = document.createElement('div')
     div.innerHTML = '<header><h1>App</h1></header><main><p>Content</p></main>'
diff --git a/packages/script/types.d.ts b/packages/script/types.d.ts
index 4a54a141..398cc3fd 100644
--- a/packages/script/types.d.ts
+++ b/packages/script/types.d.ts
@@ -27,7 +27,8 @@ declare global {
   }
 
   interface Window {
-    wdioTraceCollector: DataCollectorType
+    /** Absent until the collector bundle has run in this document. */
+    wdioTraceCollector?: DataCollectorType
   }
 
   interface TraceMutation {
diff --git a/packages/selenium-devtools-py/README.md b/packages/selenium-devtools-py/README.md
index 29a4cd55..f3c1f715 100644
--- a/packages/selenium-devtools-py/README.md
+++ b/packages/selenium-devtools-py/README.md
@@ -48,7 +48,12 @@ use a backend you are already running — in CI, or one started by hand — set
 the public BiDi event API that selenium regenerated in 4.44 — before that the
 only way to observe requests without pausing them was a private connection,
 which the same release removed. 4.44 requires Python 3.10, which sets the
-Python floor too.
+Python floor too. Where the driver exposes no BiDi at all (Safari, and every
+session Appium serves) the injected page collector fills the Network tab
+instead, from two sources of the page's own. A `fetch` / `XMLHttpRequest` call
+goes through its patch and carries method, headers, status and body. Every
+other load comes from the document's Resource Timing buffer with its timing
+and size, but no headers or body, and on Safari no status.
 
 Both floors are declared in `pyproject.toml` (`requires-python` and
 `dependencies`), so pip enforces them at install time rather than leaving you to
@@ -225,7 +230,7 @@ is on `PATH`; otherwise keep it current (`brew upgrade chromedriver`).
 | Session metadata | read `session_id` + `caps` on the first ready command | `metadata` | both |
 | Test / suite tree | pytest plugin (`pytest_runtest_logreport` / `sessionfinish`) | `suites` | both |
 | Browser console + JS errors | Selenium **BiDi** (`driver.script` handlers) | `consoleLogs` | both |
-| Network requests | Selenium **BiDi** (`Network.add_event_handler`, observe-only — never an intercept, which would pause every request) | `networkRequests` | both |
+| Network requests | Selenium **BiDi** (`Network.add_event_handler`, observe-only, never an intercept, which would pause every request); without BiDi, the page collector's `fetch` / `XMLHttpRequest` patch and Resource Timing buffer, drained beside the mutations | `networkRequests` | both |
 | Assertions | pytest hooks under pytest; line tracing for a plain script | `commands` | both |
 | DOM snapshot / time-travel | register `packages/script` as a BiDi document-start preload, drain mutations with a forced document anchor (per-document `<script>` injection when BiDi is absent) | `mutations` | both |
 | Navigation + resource timing | read from the page after a navigation, then the command row is re-sent with it | `commands` | both |
diff --git a/packages/selenium-devtools-py/changes/network-without-bidi.md b/packages/selenium-devtools-py/changes/network-without-bidi.md
new file mode 100644
index 00000000..ee1e4c5b
--- /dev/null
+++ b/packages/selenium-devtools-py/changes/network-without-bidi.md
@@ -0,0 +1,9 @@
+---
+minor
+---
+
+Capture network requests on sessions without WebDriver BiDi: Safari, and every session Appium serves. Network capture subscribed through BiDi alone, so those sessions showed an empty Network tab. The page collector the adapter already injects for DOM replay now supplies the tab instead: its `fetch` / `XMLHttpRequest` patch, with headers, status and bodies for the calls the page makes, and the document's Resource Timing buffer, with every load the browser made and its timing and size. Resource Timing exposes no headers or bodies, and on Safari no status; the dashboard names that limit on each such request rather than showing it as failed. When BiDi is serving the session, the page's entries are withheld so each request is listed once. Serving means delivering: Appium's BiDi shim accepts the subscription and then sends no event, so the page's entries are withheld only once a BiDi request event has actually arrived.
+
+A request the browser gives up on (a blocked beacon, a refused connection) is closed as a failure with the browser's own reason, where it used to stay pending for the rest of the session.
+
+A session whose `webSocketUrl` capability is not a socket address (safaridriver echoes the requested `true` back) is no longer treated as BiDi-capable; previously selenium's own connection thread crashed on it.
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/_wire_types.py b/packages/selenium-devtools-py/src/selenium_devtools/_wire_types.py
index 437a393e..a008db4b 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/_wire_types.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/_wire_types.py
@@ -4,7 +4,7 @@
 
 from typing import Any, Dict, List, Literal, Optional, TypedDict, Union
 
-__all__ = ['AccessibilityNode', 'ActionSnapshot', 'BaselineClearedWsPayload', 'BaselineSavedWsPayload', 'ClearExecutionDataWsPayload', 'CommandLog', 'CommandLogPoint', 'ConsoleLog', 'DeviceInfo', 'DocumentInfo', 'DocumentInfoDocumentInfo', 'DocumentInfoHeaders', 'ElementScriptsResponse', 'Metadata', 'NetworkRequest', 'NetworkRequestResponse', 'PerformanceData', 'PerformanceDataNavigation', 'PerformanceDataNavigationTiming', 'PerformanceDataResources', 'PreservedAttempt', 'PreservedAttemptTest', 'PreservedAttemptWindow', 'PreservedStep', 'ReplaceCommandWsPayload', 'ScreencastFrame', 'ScreencastInfo', 'SerializedError', 'SuiteStats', 'TestError', 'TestErrorMatcherResult', 'TestStats', 'TraceExportRequest', 'TraceExportResult', 'TraceMutation', 'Viewport']
+__all__ = ['AccessibilityNode', 'ActionSnapshot', 'BaselineClearedWsPayload', 'BaselineSavedWsPayload', 'ClearExecutionDataWsPayload', 'CommandLog', 'CommandLogPoint', 'ConsoleLog', 'DeviceInfo', 'DocumentInfo', 'DocumentInfoDocumentInfo', 'DocumentInfoHeaders', 'ElementScriptsResponse', 'Metadata', 'NetworkRequest', 'NetworkRequestResponse', 'NetworkTimings', 'PerformanceData', 'PerformanceDataNavigation', 'PerformanceDataNavigationTiming', 'PerformanceDataResources', 'PreservedAttempt', 'PreservedAttemptTest', 'PreservedAttemptWindow', 'PreservedStep', 'ReplaceCommandWsPayload', 'ScreencastFrame', 'ScreencastInfo', 'SerializedError', 'SuiteStats', 'TestError', 'TestErrorMatcherResult', 'TestStats', 'TraceExportRequest', 'TraceExportResult', 'TraceMutation', 'Viewport']
 
 
 class _AccessibilityNodeRequired(TypedDict):
@@ -174,6 +174,8 @@ class NetworkRequest(_NetworkRequestRequired, total=False):
     requestBody: str
     responseBody: str
     size: float
+    timings: NetworkTimings
+    source: Literal['resource-timing']
 
 
 class NetworkRequestResponse(TypedDict):
@@ -183,6 +185,16 @@ class NetworkRequestResponse(TypedDict):
     status: float
 
 
+class NetworkTimings(TypedDict, total=False):
+    blocked: float
+    dns: float
+    connect: float
+    ssl: float
+    send: float
+    wait: float
+    receive: float
+
+
 class PerformanceData(TypedDict, total=False):
     navigation: PerformanceDataNavigation
     resources: List[PerformanceDataResources]
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/bidi.py b/packages/selenium-devtools-py/src/selenium_devtools/bidi.py
index f934ebd0..a694e28f 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/bidi.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/bidi.py
@@ -45,6 +45,7 @@
     BIDI_CAPABILITY,
     BIDI_LEVEL_MAP,
     BIDI_NET_BEFORE_REQUEST,
+    BIDI_NET_FETCH_ERROR,
     BIDI_NET_RESPONSE_COMPLETED,
     LOGGER_NAME,
     PYTHON_MINIMUM_VERSION,
@@ -234,6 +235,38 @@ def response_completed_kwargs(
     return merged
 
 
+def fetch_error_kwargs(
+    params: Dict[str, Any], pending: Dict[str, Dict[str, Any]]
+) -> Optional[Dict[str, Any]]:
+    """kwargs closing a pending request the browser gave up on, as the JS
+    adapters close theirs: status 0 and the browser's own reason as the error,
+    so a blocked beacon reads as failed rather than sitting pending for the
+    rest of the session.
+
+    Returns None when the matching request wasn't seen.
+    """
+    request = params.get("request") or {}
+    request_id = str(request.get("request") or params.get("id") or "")
+    prev = pending.get(request_id)
+    if prev is None:
+        return None
+    start_time = int(prev.get("start_time") or now_ms())
+    end_time, time = _response_timing(
+        request.get("timings"), start_time, params.get("timestamp")
+    )
+    reason = str(params.get("errorText") or "Failed")
+    merged = dict(prev)
+    merged.update(
+        status=0,
+        status_text=reason,
+        error=reason,
+        timestamp=now_ms(),
+        end_time=end_time,
+        time=time,
+    )
+    return merged
+
+
 def request_type_for(url: str, mime_type: Optional[str] = None) -> str:
     """Classify a request into the dashboard's Network-tab categories.
 
@@ -327,9 +360,15 @@ def _response_timing(
 # ── selenium wiring (defensive) ───────────────────────────────────────────────
 
 
-def _bidi_enabled(driver: Any) -> bool:
+def bidi_enabled(driver: Any) -> bool:
+    """Whether the session has a BiDi socket to attach to. The one reading of
+    the capability, shared with the preload: a socket address, not merely a
+    truthy value, because safaridriver echoes the requested ``True`` back as
+    the capability and selenium's own connection thread then dies calling
+    ``startswith`` on a bool."""
     caps = getattr(driver, "caps", None)
-    return bool(isinstance(caps, dict) and caps.get(BIDI_CAPABILITY))
+    url = caps.get(BIDI_CAPABILITY) if isinstance(caps, dict) else None
+    return isinstance(url, str) and url.startswith("ws")
 
 
 def _attach_console(driver: Any, capturer: SessionCapturer) -> bool:
@@ -568,6 +607,7 @@ def on_request_sent(event: Any) -> None:
                 return
             kwargs = request_sent_kwargs(params)
             if kwargs is not None:
+                stats["observed"] = True
                 pending[kwargs["request_id"]] = kwargs
                 capturer.capture_network(**kwargs)
         except Exception as exc:  # noqa: BLE001
@@ -588,7 +628,26 @@ def on_response_completed(event: Any) -> None:
         except Exception as exc:  # noqa: BLE001
             _warn(f"responseCompleted handler threw: {exc}")
 
-    return _subscribe_via_event_manager(
+    # Subscribed on its own, after the pair: a driver that refuses this one
+    # event should lose only the failure rows, not every network event.
+    failures = {"ok": False}
+
+    def on_fetch_error(event: Any) -> None:
+        if not (active["ok"] and failures["ok"]):
+            return
+        try:
+            params = event_params(event)
+            if _incomplete_event(params, BIDI_NET_FETCH_ERROR):
+                return
+            kwargs = fetch_error_kwargs(params, pending)
+            if kwargs is not None:
+                pending.pop(kwargs["request_id"], None)
+                capturer.capture_network(**kwargs)
+                stats["captured"] += 1
+        except Exception as exc:  # noqa: BLE001
+            _warn(f"fetchError handler threw: {exc}")
+
+    attached = _subscribe_via_event_manager(
         driver,
         {
             BIDI_NET_BEFORE_REQUEST: on_request_sent,
@@ -596,10 +655,28 @@ def on_response_completed(event: Any) -> None:
         },
         active,
     )
+    stats["attached"] = attached
+    if attached and not _subscribe_via_event_manager(
+        driver, {BIDI_NET_FETCH_ERROR: on_fetch_error}, failures, optional=True
+    ):
+        _warn(f"{BIDI_NET_FETCH_ERROR} unavailable; a request the browser gives up on stays pending")
+    return attached
+
+
+def network_serving(stats: Optional[Dict[str, Any]]) -> bool:
+    """Whether BiDi is serving the session's requests: subscribed AND at least
+    one request event has arrived. A subscription alone is not evidence, since
+    Appium's BiDi shim accepts the subscription and then delivers nothing; read
+    by the drain to decide whether the page's own network entries are the
+    session's capture or a second listing of what BiDi already reported."""
+    return bool(stats and stats.get("attached") and stats.get("observed"))
 
 
 def _subscribe_via_event_manager(
-    driver: Any, handlers: Dict[str, Any], active: Dict[str, bool]
+    driver: Any,
+    handlers: Dict[str, Any],
+    active: Dict[str, bool],
+    optional: bool = False,
 ) -> bool:
     """selenium 4.44+: subscribe each handler to its BiDi event.
 
@@ -631,7 +708,8 @@ def _subscribe_via_event_manager(
         for bidi_event, callback in handlers.items():
             _add_raw_event_handler(network, bidi_event, callback, registered)
     except Exception as exc:  # noqa: BLE001
-        _warn(f"network subscribe failed, no network events captured: {exc}")
+        if not optional:
+            _warn(f"network subscribe failed, no network events captured: {exc}")
         for bidi_event, wrapper, callback_id in registered:
             _undo_registration(manager, bidi_event, wrapper, callback_id)
         return False
@@ -673,7 +751,7 @@ def attach(
     ``stats`` is an optional bag the caller keeps, to be passed to
     ``network_summary`` when the session ends.
     """
-    if not _bidi_enabled(driver):
+    if not bidi_enabled(driver):
         _warn(
             f"{BIDI_CAPABILITY} not set on the session — enable BiDi with "
             "options.web_socket_url = True to capture console/network"
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/bidi_preload.py b/packages/selenium-devtools-py/src/selenium_devtools/bidi_preload.py
index 6e2e40be..0baa99b7 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/bidi_preload.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/bidi_preload.py
@@ -20,6 +20,7 @@
 import logging
 from typing import Any
 
+from .bidi import bidi_enabled
 from .constants import BIDI_CAPABILITY, LOGGER_NAME
 
 _log = logging.getLogger(f"{LOGGER_NAME}.preload")
@@ -44,8 +45,7 @@ def register_collector_preload(driver: Any, source: str) -> bool:
     "current browsing context", but it forwards no `contexts` argument, and BiDi
     treats that as every context. That reliance is pinned by a test.
     """
-    caps = getattr(driver, "caps", None)
-    if not (isinstance(caps, dict) and caps.get(BIDI_CAPABILITY)):
+    if not bidi_enabled(driver):
         # Not a warning: the caller already reports the missing capability once,
         # and the `<script>` path still captures DOM — just with the races this
         # module exists to remove.
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/capturer.py b/packages/selenium-devtools-py/src/selenium_devtools/capturer.py
index 4fe0d9d8..27e6952a 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/capturer.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/capturer.py
@@ -178,6 +178,13 @@ def send_mutations(self, mutations: List[Any]) -> None:
         if mutations:
             self._tx.send_json(SCOPE_MUTATIONS, mutations)
 
+    def send_network_requests(self, requests: List[Any]) -> None:
+        """Forward network entries the injected browser script captured (its
+        patched fetch/XHR calls and the document's Resource Timing), already in
+        the wire shape, so they go as built rather than through `frames`."""
+        if requests:
+            self._tx.send_json(SCOPE_NETWORK_REQUESTS, requests)
+
     # ── suites ───────────────────────────────────────────────────────────────────
 
     def send_suites(self, suites: List[SuiteStats]) -> None:
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/constants.py b/packages/selenium-devtools-py/src/selenium_devtools/constants.py
index a6eca91a..53012f4f 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/constants.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/constants.py
@@ -195,6 +195,7 @@
 # would stall the user's page loads if a callback failed to continue them).
 BIDI_NET_BEFORE_REQUEST = "network.beforeRequestSent"
 BIDI_NET_RESPONSE_COMPLETED = "network.responseCompleted"
+BIDI_NET_FETCH_ERROR = "network.fetchError"
 # The adapter targets the regenerated BiDi layer, which selenium 4.44 shipped —
 # it is what ``Network.add_event_handler`` and ``EVENT_CONFIGS`` arrived in, and
 # the pre-4.44 internals network capture used instead were removed in the same
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/device.py b/packages/selenium-devtools-py/src/selenium_devtools/device.py
index 3b2453ab..38ea6dd0 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/device.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/device.py
@@ -8,7 +8,10 @@
 
 from __future__ import annotations
 
-from typing import Any, Dict, Optional
+import subprocess
+import sys
+
+from typing import Any, Dict, Optional, Callable, List
 
 from ._contract import NATIVE_PLATFORMS
 
@@ -82,3 +85,33 @@ def driver_is_native_app(driver: Any) -> bool:
     """`is_native_app_session` for a live driver, whose capabilities selenium
     exposes as a plain dict."""
     return is_native_app_session(getattr(driver, "capabilities", None))
+
+
+def restore_browser_focus(
+    capabilities: Any,
+    *,
+    host: Optional[str] = None,
+    platform: str = sys.platform,
+    launch: Callable[[List[str]], Any] = lambda argv: subprocess.Popen(
+        argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+    ),
+) -> bool:
+    """Bring Safari back to the front on macOS. Safari delivers a synthesized
+    click only to its frontmost window and reports success either way, and a
+    live run has just opened the dashboard in another browser."""
+    caps = capabilities if isinstance(capabilities, dict) else {}
+    name = _deep_cap_string(caps, "browserName") or ""
+    target_platform = _deep_cap_string(caps, "platformName") or ""
+    local = host in (None, "", "localhost", "127.0.0.1", "::1")
+    if (
+        platform != "darwin"
+        or not local
+        or "safari" not in name.lower()
+        or "ios" in target_platform.lower()
+    ):
+        return False
+    try:
+        launch(["open", "-a", "Safari"])
+        return True
+    except Exception:  # noqa: BLE001 - a missing `open` must not break the test
+        return False
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/frames.py b/packages/selenium-devtools-py/src/selenium_devtools/frames.py
index aa6716b1..c8ea8a07 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/frames.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/frames.py
@@ -120,6 +120,7 @@ def network_request(
     size: Optional[int] = None,
     request_headers: Optional[dict] = None,
     response_headers: Optional[dict] = None,
+    error: Optional[str] = None,
 ) -> NetworkRequest:
     entry: NetworkRequest = {
         "id": request_id,
@@ -145,6 +146,8 @@ def network_request(
         entry["requestHeaders"] = request_headers
     if response_headers is not None:
         entry["responseHeaders"] = response_headers
+    if error is not None:
+        entry["error"] = error
     return entry
 
 
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/instrumentation.py b/packages/selenium-devtools-py/src/selenium_devtools/instrumentation.py
index 27926813..5c4bf049 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/instrumentation.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/instrumentation.py
@@ -24,7 +24,7 @@
 from .capturer import SessionCapturer
 from .cdp_screencast import start_push_screencast
 from .collector_source import reset_cache as reset_collector_cache
-from .device import driver_is_native_app
+from .device import driver_is_native_app, restore_browser_focus
 from .element_scripts import reset_cache as reset_element_scripts_cache
 from .constants import (
     BIDI_CAPABILITY,
@@ -499,27 +499,35 @@ def _refresh_snapshot(capturer: SessionCapturer, entry: dict) -> None:
         snapshot.inject()  # no-op if already present; re-installs after navigation
     except Exception as exc:  # noqa: BLE001 — never break the test
         _log.warning("snapshot re-inject threw: %s", exc)
-    _flush_mutations(capturer, entry)
-
-
-def _flush_mutations(capturer: SessionCapturer, entry: dict) -> None:
-    """Drain the page-side mutation buffer and forward it — no-op if the
-    collector was never injected. Defensive: never breaks the user's test."""
+    _flush_page_collector(capturer, entry)
+
+
+def _flush_page_collector(capturer: SessionCapturer, entry: dict) -> None:
+    """Drain the page-side buffer and forward it; a no-op if the collector was
+    never injected, and never breaks the user's test. The network half goes
+    only while BiDi is not serving the session: BiDi lists every request with
+    its headers, and the page's view of the same requests would list each
+    twice (as the selenium-devtools adapter also withholds it). Serving means
+    delivering, not subscribed: Appium's shim accepts the subscription and
+    sends nothing, and there, as on Safari, the page's view is the only
+    network capture there is."""
     snapshot: SnapshotCapturer | None = entry.get("snapshot")
     if snapshot is None:
         return
     try:
-        mutations = snapshot.pull_mutations()
+        payload = snapshot.pull_trace()
     except Exception as exc:  # noqa: BLE001 — capture must never break the test
         _log.warning("mutation flush threw: %s", exc)
         return
-    if mutations:
-        capturer.send_mutations(mutations)
+    if payload.mutations:
+        capturer.send_mutations(payload.mutations)
         # Debug, not info: this fires after every command. It is the only signal
         # that DOM replay is actually receiving anything — the panel being empty
         # otherwise looks the same whether the collector never loaded or the
         # page simply did not change.
-        _log.debug("captured %d DOM mutation(s)", len(mutations))
+        _log.debug("captured %d DOM mutation(s)", len(payload.mutations))
+    if payload.network_requests and not bidi.network_serving(entry.get("network")):
+        capturer.send_network_requests(payload.network_requests)
 
 
 def _enable_bidi_capability(params: Any) -> None:
@@ -548,7 +556,7 @@ def _close_entry(capturer: SessionCapturer, entry: dict) -> None:
     # Before the encode: a frame still arriving would land after the buffer was
     # read, and the browser keeps sending until it is told to stop.
     _stop_push_screencast(entry)
-    _flush_mutations(capturer, entry)
+    _flush_page_collector(capturer, entry)
     entry["snapshot"] = None
     _finalize_screencast(capturer, entry["session_id"], entry)
     summary = bidi.network_summary(entry.get("network"))
@@ -702,6 +710,10 @@ def _ensure_session_setup(driver: Any, capturer: SessionCapturer) -> Optional[di
         session_id, getattr(driver, "caps", None), None, viewport=_viewport(driver)
     )
     _log.info("session %s started", session_id)
+    if not _state["trace"] and restore_browser_focus(
+        getattr(driver, "caps", None), host=_executor_host(driver)
+    ):
+        _log.info("Safari brought back to the front (it delivers clicks only there)")
     _send_default_suite(capturer, "running")  # tree entry for plain-script runs
     try:
         # Filled in as events arrive; reported once by _on_quit, because the
@@ -1018,6 +1030,20 @@ def patched_execute(self, driver_command: str, params: Any = None):  # noqa: ANN
     )
 
 
+def _executor_host(driver: Any) -> Optional[str]:
+    """The WebDriver endpoint's host, or None when it cannot be read."""
+    try:
+        from urllib.parse import urlparse
+
+        executor = getattr(driver, "command_executor", None)
+        url = getattr(executor, "_url", None) or getattr(
+            getattr(executor, "_client_config", None), "remote_server_addr", None
+        )
+        return urlparse(str(url)).hostname if url else None
+    except Exception:  # noqa: BLE001 - unknown means "assume this machine"
+        return None
+
+
 def uninstall() -> None:
     # Tracing goes first: leaving a trace function installed past teardown slows
     # every line the process runs afterwards, for nothing.
diff --git a/packages/selenium-devtools-py/src/selenium_devtools/snapshot.py b/packages/selenium-devtools-py/src/selenium_devtools/snapshot.py
index 46de9242..70b6970e 100644
--- a/packages/selenium-devtools-py/src/selenium_devtools/snapshot.py
+++ b/packages/selenium-devtools-py/src/selenium_devtools/snapshot.py
@@ -21,7 +21,7 @@
 
 import logging
 import os
-from typing import Any, Callable, List, Optional
+from typing import Any, Callable, Dict, List, NamedTuple, Optional
 
 from .collector_source import fetch_collector_source
 from .constants import LOGGER_NAME
@@ -176,6 +176,31 @@ def normalize_mutations(trace_data: Any) -> List[Any]:
     return mutations if isinstance(mutations, list) else []
 
 
+def normalize_network_requests(trace_data: Any) -> List[Dict[str, Any]]:
+    """Extract the ``networkRequests`` list from a ``getTraceData()`` payload.
+
+    The collector's patched ``fetch``/``XMLHttpRequest`` calls plus the
+    document's own Resource Timing entries: every network source a session
+    without BiDi has, which is every Safari and every Appium session. Entries
+    are forwarded as the collector built them (the same shape the JS adapters
+    send), so only the list and its dict rows are checked here.
+    """
+    if not isinstance(trace_data, dict):
+        return []
+    requests = trace_data.get("networkRequests")
+    if not isinstance(requests, list):
+        return []
+    return [entry for entry in requests if isinstance(entry, dict)]
+
+
+class TracePayload(NamedTuple):
+    """One drain of the page-side collector, split into what each consumer
+    forwards."""
+
+    mutations: List[Any]
+    network_requests: List[Dict[str, Any]]
+
+
 class SnapshotCapturer:
     """Injects the page-side collector and pulls buffered DOM mutations.
 
@@ -214,7 +239,7 @@ def inject(self) -> bool:
         no-ops. A no-op when a document-start preload is registered: the
         collector is present in every document before any of its script runs,
         which is the whole point of the preload. A document where the preload
-        nonetheless did not take is recovered by `pull_mutations`, whose own null
+        nonetheless did not take is recovered by `pull_trace`, whose own null
         is the only signal that says so."""
         if self._preloaded:
             return True
@@ -258,10 +283,10 @@ def _drain(self) -> Any:
                 _warn(f"trace read failed: {exc}")
             return _UNREADABLE
 
-    def pull_mutations(self) -> List[Any]:
-        """Anchor the current document and drain the buffered mutations
-        (``getTraceData()`` resets the page-side buffer). Returns [] on any
-        failure or when nothing's buffered.
+    def pull_trace(self) -> TracePayload:
+        """Anchor the current document and drain the buffered trace payload
+        (``getTraceData()`` resets the page-side buffer). Returns empty lists
+        on any failure or when nothing's buffered.
 
         A null payload means the collector is not in THIS document, and that is
         the only signal which says so — a preload can still miss one (its script
@@ -276,12 +301,14 @@ def pull_mutations(self) -> List[Any]:
         would never be anchored at all."""
         data = self._drain()
         if data is _UNREADABLE:
-            return []
+            return TracePayload([], [])
         if data is None and self._install_now():
             data = self._drain()
             if data is _UNREADABLE:
-                return []
-        return normalize_mutations(data)
+                return TracePayload([], [])
+        return TracePayload(
+            normalize_mutations(data), normalize_network_requests(data)
+        )
 
 
 def start_snapshot_capture(
diff --git a/packages/selenium-devtools-py/tests/test_bidi.py b/packages/selenium-devtools-py/tests/test_bidi.py
index 1729f0dc..8411a6e5 100644
--- a/packages/selenium-devtools-py/tests/test_bidi.py
+++ b/packages/selenium-devtools-py/tests/test_bidi.py
@@ -213,6 +213,29 @@ def test_response_completed_merges_over_pending(self):
         self.assertEqual(resp["time"], 250)  # from timings, not timestamp delta
         self.assertEqual(resp["end_time"], 1000 + 250)
 
+    def test_fetch_error_closes_the_pending_request_as_failed(self):
+        pending = {}
+        req = bidi.request_sent_kwargs(
+            {"request": {"request": "req-4", "url": "https://x/beacon",
+                         "method": "POST"}, "timestamp": 1000}
+        )
+        pending[req["request_id"]] = req
+        failed = bidi.fetch_error_kwargs(
+            {"request": {"request": "req-4"}, "timestamp": 1250,
+             "errorText": "net::ERR_BLOCKED_BY_CLIENT"},
+            pending,
+        )
+        self.assertEqual(failed["status"], 0)
+        self.assertEqual(failed["error"], "net::ERR_BLOCKED_BY_CLIENT")
+        self.assertEqual(failed["status_text"], "net::ERR_BLOCKED_BY_CLIENT")
+        self.assertEqual(failed["time"], 250)
+        self.assertEqual(failed["url"], "https://x/beacon")
+
+    def test_fetch_error_none_when_unmatched(self):
+        self.assertIsNone(
+            bidi.fetch_error_kwargs({"request": {"request": "ghost"}}, {})
+        )
+
     def test_response_completed_none_when_unmatched(self):
         self.assertIsNone(
             bidi.response_completed_kwargs({"request": {"request": "ghost"}}, {})
@@ -258,6 +281,18 @@ class Driver:
             caps = {"browserName": "chrome"}  # no webSocketUrl
         self.assertFalse(bidi.attach(Driver(), self._capturer()))
 
+    def test_attach_skips_a_capability_that_is_not_a_socket_address(self):
+        # safaridriver echoes the requested `True` back instead of a ws:// URL;
+        # selenium's connection thread crashes on it, so it is not BiDi.
+        class Driver:
+            caps = {"browserName": "Safari", "webSocketUrl": True}
+
+            @property
+            def script(self):
+                raise AssertionError("must not be touched")
+
+        self.assertFalse(bidi.attach(Driver(), self._capturer()))
+
     def test_attach_survives_channel_errors(self):
         class Driver:
             caps = {"webSocketUrl": "ws://x"}
@@ -273,6 +308,34 @@ def network(self):
         # Both channels raise; attach returns False without propagating.
         self.assertFalse(bidi.attach(Driver(), self._capturer()))
 
+    def test_a_failed_network_attach_is_recorded_as_not_attached(self):
+        # The drain reads this to decide whether the page's own network
+        # entries are the session's capture or a duplicate of BiDi's.
+        class Driver:
+            caps = {"webSocketUrl": "ws://x"}
+
+            @property
+            def script(self):
+                raise RuntimeError("no bidi here")
+
+            @property
+            def network(self):
+                raise RuntimeError("no bidi here")
+
+        stats = {}
+        bidi.attach(Driver(), self._capturer(), stats)
+        self.assertFalse(bidi.network_serving(stats))
+
+    def test_network_serving_needs_a_subscription_that_delivered(self):
+        # Appium's BiDi shim accepts the subscription and then sends nothing,
+        # so "attached" alone would withhold the only network capture there is.
+        self.assertFalse(bidi.network_serving(None))
+        self.assertFalse(bidi.network_serving({}))
+        self.assertFalse(bidi.network_serving({"attached": False}))
+        self.assertFalse(bidi.network_serving({"attached": True}))
+        self.assertFalse(bidi.network_serving({"attached": False, "observed": True}))
+        self.assertTrue(bidi.network_serving({"attached": True, "observed": True}))
+
     def test_console_handler_pushes_to_capturer(self):
         """End-to-end: a fake script channel drives capture_console."""
         cap = self._capturer()
@@ -544,6 +607,95 @@ def test_raw_params_reach_the_handlers_and_are_captured(self):
         self.assertEqual(frames[0]["url"], "https://x/a.js")
         self.assertEqual(frames[1]["status"], 200)  # correlated with the request
 
+    def test_a_request_the_browser_gave_up_on_is_closed_as_failed(self):
+        """A blocked beacon never completes; without fetchError it sat in the
+        Network tab as pending for the rest of the session."""
+        module = fake_network_module()
+        network = module.Network()
+        capturer = SessionCapturer(RecordingTransport())
+        stats = {}
+
+        with mock.patch.dict(
+            sys.modules, {"selenium.webdriver.common.bidi.network": module}
+        ):
+            bidi._attach_network(NewSeleniumDriver(network, []), capturer, stats)
+
+        self._dispatch(network, "network.beforeRequestSent", {
+            "request": {"request": "R9", "url": "https://x/beacon", "method": "POST"},
+            "timestamp": 1000,
+        })
+        self._dispatch(network, "network.fetchError", {
+            "request": {"request": "R9"}, "timestamp": 1100,
+            "errorText": "net::ERR_BLOCKED_BY_CLIENT",
+        })
+
+        frames = [
+            batch[0] for scope, batch in capturer._tx.sent
+            if scope == "networkRequests"
+        ]
+        self.assertEqual(len(frames), 2)
+        self.assertEqual(frames[1]["status"], 0)
+        self.assertEqual(frames[1]["error"], "net::ERR_BLOCKED_BY_CLIENT")
+        self.assertEqual(stats["pending"], {})
+
+    def test_a_refused_fetch_error_subscription_keeps_the_pair(self):
+        """Older endpoints know the pair and not the failure event; losing
+        every network row over the one it lacks would be the worse trade."""
+        module = fake_network_module()
+        network = module.Network()
+        capturer = SessionCapturer(RecordingTransport())
+        manager = network._event_manager
+        real_subscribe = manager.subscribe_to_event
+
+        def failing_subscribe(bidi_event, contexts=None):
+            if bidi_event == "network.fetchError":
+                raise RuntimeError("unknown event")
+            return real_subscribe(bidi_event, contexts)
+
+        manager.subscribe_to_event = failing_subscribe
+
+        with mock.patch.dict(
+            sys.modules, {"selenium.webdriver.common.bidi.network": module}
+        ):
+            with self.assertLogs("selenium_devtools.bidi", level="WARNING") as logs:
+                attached = bidi._attach_network(
+                    NewSeleniumDriver(network, []), capturer
+                )
+
+        self.assertTrue(attached)
+        self.assertEqual(
+            sorted(manager.subscribed),
+            ["network.beforeRequestSent", "network.responseCompleted"],
+        )
+        self.assertTrue(any("fetchError" in line for line in logs.output))
+        self._dispatch(network, "network.beforeRequestSent", {
+            "request": {"request": "R1", "url": "https://x/a", "method": "GET"},
+            "timestamp": 1000,
+        })
+        self.assertEqual(
+            len([b for s, b in capturer._tx.sent if s == "networkRequests"]), 1
+        )
+
+    def test_a_subscription_serves_the_session_once_a_request_arrives(self):
+        module = fake_network_module()
+        network = module.Network()
+        stats = {}
+
+        with mock.patch.dict(
+            sys.modules, {"selenium.webdriver.common.bidi.network": module}
+        ):
+            bidi._attach_network(
+                NewSeleniumDriver(network, []), SessionCapturer(RecordingTransport()), stats
+            )
+
+        # Subscribed, nothing delivered yet: the page's rows are still the capture.
+        self.assertFalse(bidi.network_serving(stats))
+        self._dispatch(network, "network.beforeRequestSent", {
+            "request": {"request": "R1", "url": "https://x/a.js", "method": "GET"},
+            "timestamp": 1000,
+        })
+        self.assertTrue(bidi.network_serving(stats))
+
     def test_both_events_are_subscribed_and_counted(self):
         # Registering on the connection directly bypasses selenium's own
         # bookkeeping, so the subscribe and the callback count are done
@@ -560,14 +712,13 @@ def test_both_events_are_subscribed_and_counted(self):
             )
 
         manager = network._event_manager
-        self.assertEqual(
-            sorted(manager.subscribed),
-            ["network.beforeRequestSent", "network.responseCompleted"],
-        )
-        self.assertEqual(
-            sorted(event for event, _ in manager.tracked),
-            ["network.beforeRequestSent", "network.responseCompleted"],
-        )
+        expected = [
+            "network.beforeRequestSent",
+            "network.fetchError",
+            "network.responseCompleted",
+        ]
+        self.assertEqual(sorted(manager.subscribed), expected)
+        self.assertEqual(sorted(event for event, _ in manager.tracked), expected)
 
     def test_nothing_another_subscriber_reads_is_written(self):
         """The adapter's deserializer must never be visible to anyone else.
diff --git a/packages/selenium-devtools-py/tests/test_bidi_preload.py b/packages/selenium-devtools-py/tests/test_bidi_preload.py
index a35a90a3..53b5e9ad 100644
--- a/packages/selenium-devtools-py/tests/test_bidi_preload.py
+++ b/packages/selenium-devtools-py/tests/test_bidi_preload.py
@@ -55,6 +55,16 @@ def test_a_session_without_the_bidi_capability_falls_back(self):
             bidi_preload.register_collector_preload(driver, "COLLECTOR")
         )
 
+    def test_a_capability_that_is_not_a_socket_address_falls_back(self):
+        # safaridriver echoes the requested `True` back; opening driver.script
+        # on it crashes selenium's socket thread, so it is not a BiDi session.
+        driver = FakeDriver(caps={"webSocketUrl": True})
+
+        self.assertFalse(
+            bidi_preload.register_collector_preload(driver, "COLLECTOR")
+        )
+        self.assertEqual(driver.script.pinned, [])
+
     def test_a_selenium_failure_falls_back_with_a_reason(self):
         driver = FakeDriver(script=FakeScript(raises=RuntimeError("no bidi")))
 
@@ -122,7 +132,7 @@ def execute(script, *_args):
         with mock.patch(
             "selenium_devtools.snapshot.load_injectable_script", return_value="SRC"
         ):
-            mutations = capturer.pull_mutations()
+            mutations = capturer.pull_trace().mutations
 
         self.assertEqual(len(mutations), 1)  # recovered rather than silently empty
         self.assertTrue(any("createElement" in s for s in seen))
@@ -137,7 +147,7 @@ def execute(script, *_args):
             return {"mutations": []}
 
         capturer = SnapshotCapturer(execute, preloaded=True)
-        capturer.pull_mutations()
+        capturer.pull_trace().mutations
 
         self.assertEqual([s for s in seen if "createElement" in s], [])
 
diff --git a/packages/selenium-devtools-py/tests/test_capturer.py b/packages/selenium-devtools-py/tests/test_capturer.py
index a9636bf7..19248dd6 100644
--- a/packages/selenium-devtools-py/tests/test_capturer.py
+++ b/packages/selenium-devtools-py/tests/test_capturer.py
@@ -38,6 +38,21 @@ def test_capture_command_records_error(self):
         cmd = [d for s, d in self.tx.sent if s == "commands"][0][0]
         self.assertEqual(cmd["error"]["name"], "RuntimeError")
 
+    def test_page_network_entries_are_forwarded_as_built(self):
+        # The collector's rows already have the wire shape; the transport's
+        # contract check is what proves that, so this goes through it.
+        row = {
+            "id": "rt-1-0", "url": "https://x/", "method": "", "type": "document",
+            "timestamp": 1, "startTime": 0, "source": "resource-timing",
+            "timings": {"dns": 1, "connect": 2, "send": 0, "wait": 3, "receive": 4},
+        }
+        self.cap.send_network_requests([row])
+        self.assertIn(("networkRequests", [row]), self.tx.sent)
+
+    def test_an_empty_page_network_batch_sends_nothing(self):
+        self.cap.send_network_requests([])
+        self.assertEqual([s for s, _ in self.tx.sent if s == "networkRequests"], [])
+
     def test_suites_sent_as_uid_keyed_records(self):
         # UI expects Record<uid, SuiteStats>[], not a plain array of suites.
         suite = frames.suite_stats(uid="suite-1", title="S", file="s.py", start_ms=0, tests=[])
diff --git a/packages/selenium-devtools-py/tests/test_device.py b/packages/selenium-devtools-py/tests/test_device.py
index a75c9b97..e3851390 100644
--- a/packages/selenium-devtools-py/tests/test_device.py
+++ b/packages/selenium-devtools-py/tests/test_device.py
@@ -7,6 +7,8 @@
 
 import unittest
 
+from selenium_devtools import device
+
 from selenium_devtools.device import (
     driver_is_native_app,
     is_native_app_session,
@@ -108,3 +110,48 @@ def test_a_driver_exposing_nothing_is_not_native(self):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class TestRestoreBrowserFocus(unittest.TestCase):
+    """Safari delivers a synthesized click only to its frontmost window, and a
+    live run has just opened the dashboard in another browser."""
+
+    def test_activates_safari_on_macos(self):
+        launched = []
+        self.assertTrue(
+            device.restore_browser_focus(
+                {"browserName": "Safari"}, platform="darwin", launch=launched.append
+            )
+        )
+        self.assertEqual(launched, [["open", "-a", "Safari"]])
+
+    def test_leaves_other_browsers_and_platforms_alone(self):
+        launched = []
+        for caps, platform in (
+            ({"browserName": "chrome"}, "darwin"),
+            ({"browserName": "safari"}, "linux"),
+            (None, "darwin"),
+            ({"browserName": "Safari", "platformName": "iOS"}, "darwin"),
+        ):
+            self.assertFalse(
+                device.restore_browser_focus(caps, platform=platform, launch=launched.append)
+            )
+        self.assertEqual(launched, [])
+
+    def test_a_launcher_that_fails_is_reported_not_raised(self):
+        def boom(argv):
+            raise OSError("no open")
+
+        self.assertFalse(
+            device.restore_browser_focus({"browserName": "safari"}, platform="darwin", launch=boom)
+        )
+
+    def test_leaves_a_remote_safari_alone(self):
+        launched = []
+        self.assertFalse(
+            device.restore_browser_focus(
+                {"browserName": "safari"}, host="hub.example.com",
+                platform="darwin", launch=launched.append,
+            )
+        )
+        self.assertEqual(launched, [])
diff --git a/packages/selenium-devtools-py/tests/test_instrumentation.py b/packages/selenium-devtools-py/tests/test_instrumentation.py
index 8a7eb884..7917262e 100644
--- a/packages/selenium-devtools-py/tests/test_instrumentation.py
+++ b/packages/selenium-devtools-py/tests/test_instrumentation.py
@@ -229,6 +229,71 @@ def test_every_command_refreshes_snapshot(self):
         self.assertEqual(len(self._mutations()), 1)
 
 
+class FakeSnapshot:
+    """A capturer whose one drain answers a fixed payload."""
+
+    def __init__(self, payload):
+        self._payload = payload
+
+    def pull_trace(self):
+        return self._payload
+
+
+class TestFlushForwardsTheNetworkHalf(unittest.TestCase):
+    """The drain carries the page's own network entries beside the mutations.
+    Without BiDi they are the session's only network capture; with it they
+    would list every request a second time."""
+
+    ROW = {
+        "id": "rt-1-0", "url": "https://x/a.js", "method": "GET", "type": "script",
+        "timestamp": 1, "startTime": 0, "source": "resource-timing",
+    }
+    MUTATION = {"type": "childList", "target": "1", "addedNodes": [],
+                "removedNodes": [], "timestamp": 1}
+
+    def setUp(self):
+        self.tx = RecordingTransport()
+        self.cap = SessionCapturer(self.tx)
+
+    def _sent(self, scope):
+        return [d for s, d in self.tx.sent if s == scope]
+
+    def _flush(self, network_stats):
+        entry = {"snapshot": FakeSnapshot(snapshot.TracePayload([self.MUTATION], [self.ROW]))}
+        if network_stats is not None:
+            entry["network"] = network_stats
+        instrumentation._flush_page_collector(self.cap, entry)
+
+    def test_without_bidi_the_page_entries_are_the_network_capture(self):
+        self._flush(network_stats=None)
+        self.assertEqual(self._sent("mutations"), [[self.MUTATION]])
+        self.assertEqual(self._sent("networkRequests"), [[self.ROW]])
+
+    def test_a_bidi_attach_that_did_not_take_still_forwards_them(self):
+        # Safari: `attach` ran, subscribed nothing.
+        self._flush(network_stats={"captured": 0, "pending": {}, "attached": False})
+        self.assertEqual(self._sent("networkRequests"), [[self.ROW]])
+
+    def test_a_subscription_that_delivered_nothing_still_forwards_them(self):
+        # Appium's BiDi shim: subscribed, and not one request event arrives.
+        self._flush(network_stats={"captured": 0, "pending": {}, "attached": True})
+        self.assertEqual(self._sent("networkRequests"), [[self.ROW]])
+
+    def test_with_bidi_serving_the_session_they_are_withheld(self):
+        self._flush(network_stats={"captured": 1, "pending": {}, "attached": True,
+                                   "observed": True})
+        self.assertEqual(self._sent("mutations"), [[self.MUTATION]])
+        self.assertEqual(self._sent("networkRequests"), [])
+
+    def test_a_drain_that_throws_forwards_nothing_and_does_not_raise(self):
+        class Boom:
+            def pull_trace(self):
+                raise RuntimeError("gone")
+
+        instrumentation._flush_page_collector(self.cap, {"snapshot": Boom()})
+        self.assertEqual(self.tx.sent, [])
+
+
 class TestSkipFrames(unittest.TestCase):
     def test_user_file_under_selenium_path_is_not_skipped(self):
         # A user's test file living under .../examples/selenium/... must NOT be
diff --git a/packages/selenium-devtools-py/tests/test_snapshot.py b/packages/selenium-devtools-py/tests/test_snapshot.py
index cd27b70f..9fd4b87c 100644
--- a/packages/selenium-devtools-py/tests/test_snapshot.py
+++ b/packages/selenium-devtools-py/tests/test_snapshot.py
@@ -6,8 +6,10 @@
 from selenium_devtools import snapshot
 from selenium_devtools.snapshot import (
     SnapshotCapturer,
+    TracePayload,
     load_injectable_script,
     normalize_mutations,
+    normalize_network_requests,
     resolve_script_path,
     start_snapshot_capture,
     wrap_injectable,
@@ -138,25 +140,59 @@ def boom(script, *args):
         self.assertFalse(cap.injected)
 
 
+class TestNormalizeNetworkRequests(unittest.TestCase):
+    def test_extracts_the_dict_rows(self):
+        row = {"id": "rt-1-0", "url": "https://x/", "method": "", "type": "document"}
+        self.assertEqual(normalize_network_requests({"networkRequests": [row]}), [row])
+
+    def test_drops_a_row_that_is_not_a_dict(self):
+        payload = {"networkRequests": [{"id": "a"}, "junk", None]}
+        self.assertEqual(normalize_network_requests(payload), [{"id": "a"}])
+
+    def test_anything_else_is_empty(self):
+        self.assertEqual(normalize_network_requests(None), [])
+        self.assertEqual(normalize_network_requests({"mutations": []}), [])
+        self.assertEqual(normalize_network_requests({"networkRequests": "no"}), [])
+
+
 class TestSnapshotCapturerPull(unittest.TestCase):
     def test_pull_returns_normalized_mutations(self):
         trace = {"mutations": [{"type": "attributes", "target": "9"}]}
         exec_fn = FakeExec(trace)
         cap = SnapshotCapturer(exec_fn)
-        self.assertEqual(cap.pull_mutations(), [{"type": "attributes", "target": "9"}])
+        self.assertEqual(cap.pull_trace().mutations, [{"type": "attributes", "target": "9"}])
         # The read uses the atomic getTraceData expression.
         self.assertIn("getTraceData", exec_fn.calls[0][0])
 
+    def test_pull_trace_carries_both_halves_of_one_drain(self):
+        # One read serves both consumers: `getTraceData()` resets the page-side
+        # buffer, so a second read for the network entries would find nothing.
+        row = {"id": "rt-1-0", "url": "https://x/a.js", "method": "GET", "type": "script"}
+        trace = {"mutations": [{"type": "attributes", "target": "9"}], "networkRequests": [row]}
+        exec_fn = FakeExec(trace)
+        cap = SnapshotCapturer(exec_fn)
+        self.assertEqual(
+            cap.pull_trace(),
+            TracePayload([{"type": "attributes", "target": "9"}], [row]),
+        )
+        self.assertEqual(len(exec_fn.calls), 1)
+
+    def test_pull_trace_is_empty_on_an_unreadable_collector(self):
+        def boom(script, *args):
+            raise RuntimeError("boom")
+
+        self.assertEqual(SnapshotCapturer(boom).pull_trace(), TracePayload([], []))
+
     def test_pull_null_trace_returns_empty(self):
         cap = SnapshotCapturer(FakeExec(None))
-        self.assertEqual(cap.pull_mutations(), [])
+        self.assertEqual(cap.pull_trace().mutations, [])
 
     def test_pull_swallows_execute_errors(self):
         def boom(script, *args):
             raise RuntimeError("boom")
 
         cap = SnapshotCapturer(boom)
-        self.assertEqual(cap.pull_mutations(), [])  # no raise
+        self.assertEqual(cap.pull_trace().mutations, [])  # no raise
 
 
 class FakeCollector:
@@ -208,7 +244,7 @@ def test_a_document_that_has_not_self_anchored_is_anchored_by_the_drain(self):
         collector = FakeCollector()
         cap = SnapshotCapturer(collector)
 
-        mutations = cap.pull_mutations()
+        mutations = cap.pull_trace().mutations
 
         self.assertEqual(len(mutations), 1)
         self.assertEqual(mutations[0]["url"], "https://x/secure")
@@ -220,8 +256,8 @@ def test_anchoring_is_forced_on_every_drain_but_emits_the_document_once(self):
         collector = FakeCollector()
         cap = SnapshotCapturer(collector)
 
-        first = cap.pull_mutations()
-        second = cap.pull_mutations()
+        first = cap.pull_trace().mutations
+        second = cap.pull_trace().mutations
 
         self.assertEqual(len(first), 1)
         self.assertEqual(second, [])
@@ -242,7 +278,7 @@ def test_the_guard_runs_before_the_collector_is_touched(self):
     def test_an_absent_collector_still_answers_empty(self):
         cap = SnapshotCapturer(FakeCollector(present=False))
 
-        self.assertEqual(cap.pull_mutations(), [])
+        self.assertEqual(cap.pull_trace().mutations, [])
 
     def test_a_recovered_collector_is_anchored_by_the_retry(self):
         # The collector was missing, an injection installed it, and the retry is
@@ -255,7 +291,7 @@ def install() -> bool:
             return True
 
         with mock.patch.object(cap, "_install_now", side_effect=install):
-            mutations = cap.pull_mutations()
+            mutations = cap.pull_trace().mutations
 
         self.assertEqual(len(mutations), 1)
         self.assertEqual(collector.anchor_calls, 1)
diff --git a/packages/selenium-devtools/README.md b/packages/selenium-devtools/README.md
index d86487f0..404420a1 100644
--- a/packages/selenium-devtools/README.md
+++ b/packages/selenium-devtools/README.md
@@ -471,7 +471,7 @@ The plugin patches `selenium-webdriver`'s `Builder`, `WebDriver`, and `WebElemen
 - **Every public `WebDriver` / `WebElement` method** → wrapped with command capture (args + result + screenshot + call source).
 - **`WebDriver.quit()`** → awaited cleanup hook flushes screencast encoding, WebSocket buffer, and final metadata before the original quit runs.
 
-When BiDi is available (Chrome ≥114), console logs, JavaScript exceptions, and network events stream directly via the Selenium BiDi handlers. Otherwise the plugin falls back to an injected browser-side collector script.
+When BiDi is available (Chrome ≥114), console logs, JavaScript exceptions, and network events stream directly via the Selenium BiDi handlers. Otherwise the plugin falls back to an injected browser-side collector script, so a Safari or Appium session still lists every request, from two sources of the page's own. A `fetch` / `XMLHttpRequest` call goes through the collector's patch and carries its method, headers, status and body. Every other load (the document, scripts, styles, images, fonts) comes from the page's Resource Timing buffer with its timing and size, but no headers or body, and on Safari no status; the Network tab says so on each such row.
 
 The same injected collector also records the page's **DOM mutation stream** and a per-command element / accessibility snapshot, so a trace carries enough to rebuild the live DOM at each step (per-navigation mapping) — that's what powers the player's DOM time-travel and A11y tab rather than a screenshot-only replay.
 
@@ -487,6 +487,8 @@ Same script and post-processing (`applyPerformanceData`) used by `@wdio/devtools
 
 ## Limitations
 
+- **Safari in live mode must stay the frontmost window.** Safari delivers synthesized mouse input only to its frontmost window and still reports the click as successful, so a click issued while the dashboard or any other window is in front reaches nothing. The plugin brings Safari back to the front after the session starts (`open -a Safari`, macOS only); clicking the dashboard while the test is running hands focus away again and the clicks that follow are lost until Safari is in front once more. Trace mode opens no window and is not affected.
+
 | Limitation | Detail |
 |-----------|--------|
 | Cucumber leaf-step rerun | Cucumber's `--name` filter targets scenarios, not individual Gherkin steps. The dashboard's per-step rerun is disabled under Cucumber. |
diff --git a/packages/selenium-devtools/src/bidi.ts b/packages/selenium-devtools/src/bidi.ts
index a4a62149..fc823415 100644
--- a/packages/selenium-devtools/src/bidi.ts
+++ b/packages/selenium-devtools/src/bidi.ts
@@ -116,14 +116,17 @@ export async function attachBidiHandlers(
 export function buildBidiSinks(capturer: SessionCapturer): BidiHandlerSinks {
   return {
     pushConsoleLog: (entry) => {
+      capturer.bidiConsoleObserved = true
       capturer.consoleLogs.push(entry)
       capturer.sendUpstream('consoleLogs', [entry])
     },
     pushNetworkRequest: (entry) => {
+      capturer.bidiNetworkObserved = true
       capturer.networkRequests.push(entry)
       capturer.sendUpstream('networkRequests', [entry])
     },
     replaceNetworkRequest: (id, entry) => {
+      capturer.bidiNetworkObserved = true
       const idx = capturer.networkRequests.findIndex(
         (r: NetworkRequestWithId) => r.id === id
       )
diff --git a/packages/selenium-devtools/src/driverPatcher.ts b/packages/selenium-devtools/src/driverPatcher.ts
index f1ff9cd9..c48c6ca3 100644
--- a/packages/selenium-devtools/src/driverPatcher.ts
+++ b/packages/selenium-devtools/src/driverPatcher.ts
@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import { createRequire } from 'node:module'
 import logger from '@wdio/logger'
 import {
@@ -9,7 +10,8 @@ import {
   ELEMENT_LOCATOR_METHODS,
   INTERNAL_DRIVER_METHODS,
   PATCHED_SYMBOL,
-  TRACKED_ELEMENT_METHODS
+  TRACKED_ELEMENT_METHODS,
+  NAVIGATION_COMMANDS
 } from './constants.js'
 import {
   rememberElementLocator,
@@ -128,6 +130,51 @@ function emitCommand(hooks: DriverPatcherHooks, cmd: CapturedCommand): void {
   }
 }
 
+/** Set while a `driver.wait()` evaluates its condition: the polls it issues. */
+const waitPoll = new AsyncLocalStorage<true>()
+
+/** Runs a wait's condition inside `waitPoll`, so only its own polls are marked. */
+function trackWaits(proto: Patchable): void {
+  const original = proto.wait
+  if (typeof original !== 'function' || proto[WAIT_TRACKED_SYMBOL]) {
+    return
+  }
+  proto[WAIT_TRACKED_SYMBOL] = true
+  proto.wait = function (
+    this: unknown,
+    condition: unknown,
+    ...rest: unknown[]
+  ) {
+    return (original as (...a: unknown[]) => unknown).apply(this, [
+      asWaitPoll(condition),
+      ...rest
+    ])
+  }
+}
+
+/** A function condition, or a selenium `Condition` (its `fn`); a promise as is. */
+function asWaitPoll(condition: unknown): unknown {
+  const inPoll =
+    (fn: (...a: unknown[]) => unknown) =>
+    (...a: unknown[]) =>
+      waitPoll.run(true, () => fn(...a))
+  if (typeof condition === 'function') {
+    return inPoll(condition as (...a: unknown[]) => unknown)
+  }
+  const fn = (condition as { fn?: unknown } | null)?.fn
+  if (typeof fn === 'function') {
+    return Object.assign(Object.create(condition as object), {
+      fn: inPoll(fn as (...a: unknown[]) => unknown)
+    })
+  }
+  return condition
+}
+
+const WAIT_TRACKED_SYMBOL = Symbol.for('@wdio/selenium-devtools/wait-tracked')
+
+/** Element commands that dispatch input to the page. */
+const INPUT_ELEMENT_METHODS = new Set(['click', 'sendKeys', 'clear', 'submit'])
+
 /** Reports the command once it settles — see `CapturedCommand.timestamp` for why
  *  the row is stamped at completion rather than at invocation. */
 function makeSettle(
@@ -177,6 +224,7 @@ function makeWrappedMethod(
         command: methodName,
         args: args.map(safeSerialize),
         callSource: getCallSourceFromStack().callSource,
+        duringWait: waitPoll.getStore() === true,
         startTime,
         fromElement,
         // `this` is the only trace of which element the command targets — the
@@ -188,7 +236,15 @@ function makeWrappedMethod(
 
     let result: unknown
     try {
-      result = original.apply(this, args)
+      const { beforeInput } = hooks
+      result =
+        fromElement && beforeInput && INPUT_ELEMENT_METHODS.has(methodName)
+          ? beforeInput()
+              .catch((err: unknown) =>
+                log.warn(`beforeInput hook threw: ${errorMessage(err)}`)
+              )
+              .then(() => original.apply(this, args))
+          : original.apply(this, args)
     } catch (err) {
       settle(undefined, err as Error)
       throw err
@@ -213,13 +269,45 @@ function makeWrappedMethod(
         },
         (err: unknown) => settle(undefined, err as Error)
       )
-      return result
+      return gateNavigation(result, methodName, fromElement, hooks)
     }
     settle(result, undefined)
     return result
   }
 }
 
+/** A navigation resolves to the test only once the destination is
+ *  instrumented. Without the document-start preload the collector is appended
+ *  after the navigation, and left to race the test's next command it lost the
+ *  keystrokes typed before it landed. A navigation resolves to a plain
+ *  Promise, so the derived one breaks no chaining; the row keeps its own
+ *  completion time. */
+function gateNavigation(
+  result: unknown,
+  methodName: string,
+  fromElement: boolean,
+  hooks: DriverPatcherHooks
+): unknown {
+  const { afterNavigation } = hooks
+  if (
+    fromElement ||
+    !afterNavigation ||
+    !(NAVIGATION_COMMANDS as readonly string[]).includes(methodName)
+  ) {
+    return result
+  }
+  return (result as Promise<unknown>).then(async (value) => {
+    try {
+      await afterNavigation(methodName)
+    } catch (err) {
+      log.warn(
+        `afterNavigation hook threw for ${methodName}: ${errorMessage(err)}`
+      )
+    }
+    return value
+  })
+}
+
 function wrapPrototype(
   proto: object,
   methodNames: Iterable<string>,
@@ -284,6 +372,11 @@ function stashDriverOriginals(driverProto: Patchable): void {
     const orig = title as (this: unknown) => unknown
     originals.getTitle = (driver) => orig.call(driver) as Promise<string>
   }
+  const handle = driverProto.getWindowHandle
+  if (typeof handle === 'function') {
+    const orig = handle as (this: unknown) => unknown
+    originals.getWindowHandle = (driver) => orig.call(driver) as Promise<string>
+  }
 }
 
 // Lets onBeforeQuit flush async cleanup before runners that `process.exit()`
@@ -438,6 +531,7 @@ export function patchSelenium(hooks: DriverPatcherHooks): boolean {
 
   // Stash unwrapped originals before any patching.
   stashDriverOriginals(WebDriver.prototype as Patchable)
+  trackWaits(WebDriver.prototype as Patchable)
 
   const tracked = collectMethodNames(WebDriver.prototype).filter(
     (m) => !(INTERNAL_DRIVER_METHODS as readonly string[]).includes(m)
diff --git a/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts b/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts
index 21bff705..0b4ec2ff 100644
--- a/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts
+++ b/packages/selenium-devtools/src/helpers/captureOrReplaceCommand.ts
@@ -22,7 +22,27 @@ function applyCapturedFields(entry: CommandLog, cmd: CapturedCommand): void {
  * branching was the densest section of that 73-line method and is pure logic
  * given a capturer + retry tracker + test handle.
  */
-export async function captureOrReplaceCommand(opts: {
+export function captureOrReplaceCommand(opts: {
+  capturer: SessionCapturer
+  retryTracker: RetryTracker
+  test: TestStats
+  cmd: CapturedCommand
+}): Promise<CommandLog & { _id?: number }> {
+  // One capture at a time per capturer. The driver patcher does not await
+  // `onCommand`, so a `wait()` poll arrives while the previous poll's capture
+  // is still awaiting its id, reads the tracker with no id to replace, and
+  // lands as a second row instead of folding into the first.
+  const previous = queues.get(opts.capturer) ?? Promise.resolve()
+  const next = previous
+    .catch(() => undefined)
+    .then(() => captureOrReplaceSerially(opts))
+  queues.set(opts.capturer, next)
+  return next
+}
+
+const queues = new WeakMap<SessionCapturer, Promise<unknown>>()
+
+async function captureOrReplaceSerially(opts: {
   capturer: SessionCapturer
   retryTracker: RetryTracker
   test: TestStats
@@ -31,8 +51,20 @@ export async function captureOrReplaceCommand(opts: {
   const { capturer, retryTracker, test, cmd } = opts
   const error = cmd.error ? toError(cmd.error) : undefined
   const cmdSig = RetryTracker.signature(cmd.command, cmd.args, cmd.callSource)
+  // A framework's own repeat of the user's call (selenium's `wait()` polls from
+  // a timer) has no call site; it folds into the row the user's line produced.
+  const sourceless =
+    cmd.duringWait === true &&
+    cmd.callSource === undefined &&
+    retryTracker.isRetryIgnoringSource(
+      RetryTracker.bareSignature(cmd.command, cmd.args)
+    )
 
-  if (retryTracker.isRetry(cmdSig)) {
+  if (retryTracker.isRetry(cmdSig) || sourceless) {
+    const previous = capturer.commandsLog.find(
+      (row) =>
+        (row as CommandLog & { _id?: number })._id === retryTracker.lastId
+    )
     const replaced = capturer.replaceCommand(
       retryTracker.lastId!,
       cmd.command,
@@ -40,7 +72,7 @@ export async function captureOrReplaceCommand(opts: {
       error ? undefined : cmd.result,
       error,
       test.uid,
-      cmd.callSource,
+      cmd.callSource ?? previous?.callSource,
       cmd.timestamp
     )
     const entry = replaced.entry as CommandLog & { _id?: number }
diff --git a/packages/selenium-devtools/src/helpers/dashboardLauncher.ts b/packages/selenium-devtools/src/helpers/dashboardLauncher.ts
index aa6b09d8..80942412 100644
--- a/packages/selenium-devtools/src/helpers/dashboardLauncher.ts
+++ b/packages/selenium-devtools/src/helpers/dashboardLauncher.ts
@@ -16,7 +16,37 @@ const log = logger('@wdio/selenium-devtools:dashboardLauncher')
  * --forceExit, mocha SIGINT). The unique user-data-dir is also used by
  * gracefulShutdown's pkill to target only THIS run's window.
  */
-export function openDashboard(host: string, port: number): boolean {
+export interface OpenDashboardOptions {
+  /** Open the window behind the current one. Safari delivers synthesized
+   *  clicks only to its frontmost window, so a Safari session must keep it. */
+  keepFocus?: boolean
+}
+
+/** The process to spawn for the dashboard window. On macOS a window that must
+ *  not take the front goes through `open -g`, with `-n` so the isolated
+ *  `--user-data-dir` still gets its own Chrome rather than merging into one
+ *  already running; everywhere else the binary is invoked directly. */
+export function dashboardLaunchCommand(
+  chromeBin: string,
+  chromeArgs: string[],
+  keepFocus: boolean,
+  platform: NodeJS.Platform = process.platform
+): { command: string; args: string[] } {
+  const app = chromeBin.match(/^(.*\.app)\/Contents\/MacOS\//)?.[1]
+  if (keepFocus && platform === 'darwin' && app) {
+    return {
+      command: 'open',
+      args: ['-n', '-g', '-a', app, '--args', ...chromeArgs]
+    }
+  }
+  return { command: chromeBin, args: chromeArgs }
+}
+
+export function openDashboard(
+  host: string,
+  port: number,
+  options: OpenDashboardOptions = {}
+): boolean {
   const url = `http://${host}:${port}`
   const chromeBin = findChromeBinary()
   if (!chromeBin) {
@@ -39,10 +69,15 @@ export function openDashboard(host: string, port: number): boolean {
     '--new-window',
     url
   ]
+  const launch = dashboardLaunchCommand(
+    chromeBin,
+    chromeArgs,
+    options.keepFocus === true
+  )
   try {
     const code =
       'require("child_process")' +
-      `.spawn(${JSON.stringify(chromeBin)}, ${JSON.stringify(chromeArgs)}, { detached: true, stdio: "ignore" }).unref()`
+      `.spawn(${JSON.stringify(launch.command)}, ${JSON.stringify(launch.args)}, { detached: true, stdio: "ignore" }).unref()`
     const intermediate = spawn(process.execPath, ['-e', code], {
       detached: true,
       stdio: 'ignore'
diff --git a/packages/selenium-devtools/src/index.ts b/packages/selenium-devtools/src/index.ts
index f2a071dd..25ce477a 100644
--- a/packages/selenium-devtools/src/index.ts
+++ b/packages/selenium-devtools/src/index.ts
@@ -5,6 +5,7 @@ import './setupConsole.js'
 import logger from '@wdio/logger'
 import { startDetachedBackend } from './helpers/detachedBackend.js'
 import { openDashboard } from './helpers/dashboardLauncher.js'
+import { getDriverOriginals } from './driverPatcher.js'
 import { handleOnCommand } from './helpers/commandPostActions.js'
 import { logConfigSummary } from './helpers/configSummary.js'
 import { registerProcessHooks } from './helpers/processHooks.js'
@@ -534,12 +535,66 @@ class SeleniumDevToolsPlugin {
     await handleOnCommand(this.#getInternals(), cmd)
   }
 
+  /** Fallback path only: under the preload the destination instrumented itself. */
+  async instrumentNavigationTarget() {
+    const capturer = this.#sessionCapturer
+    if (!capturer || capturer.preloadRegistered) {
+      return
+    }
+    await capturer.injectScript()
+  }
+
   #openUiWindow() {
     if (this.#uiUrlOpened) {
       return
     }
     this.#uiUrlOpened = true
-    openDashboard(this.#options.hostname, this.#options.port)
+    openDashboard(this.#options.hostname, this.#options.port, {
+      keepFocus: /safari/i.test(this.#pendingBrowserName ?? '')
+    })
+  }
+
+  /** Safari delivers synthesized input only to its frontmost window and
+   *  reports success either way; the dashboard, or anything else, can take the
+   *  front mid-test. Switching to the session's own window handle brings that
+   *  window forward, and only that one. */
+  async focusForInput() {
+    const internals = this.#getInternals()
+    const driver = internals.driver as
+      | (SeleniumDriverLike & {
+          switchTo?: () => { window: (handle: string) => Promise<void> }
+        })
+      | undefined
+    const caps = internals.sessionCapturer?.metadata?.capabilities as
+      { browserName?: string } | undefined
+    const { getWindowHandle, executeScript } = getDriverOriginals()
+    if (
+      !driver?.switchTo ||
+      !getWindowHandle ||
+      !executeScript ||
+      !/safari/i.test(caps?.browserName ?? '')
+    ) {
+      return
+    }
+    // A window switch resets the context to the top level, so a test inside a
+    // frame is left alone; and a focused window needs no switch at all.
+    const unfocused = await executeScript(
+      driver,
+      'return window === window.top && !document.hasFocus()'
+    )
+    if (unfocused === true) {
+      await driver.switchTo().window(await getWindowHandle(driver))
+    }
+  }
+
+  /** The browser the next `build()` asks for, read before the dashboard opens. */
+  #pendingBrowserName: string | undefined
+  noteBuilder(builder: unknown) {
+    const caps = (
+      builder as { getCapabilities?: () => { get?: (k: string) => unknown } }
+    ).getCapabilities?.()
+    const name = caps?.get?.('browserName')
+    this.#pendingBrowserName = typeof name === 'string' ? name : undefined
   }
 
   #finalized = false
@@ -606,6 +661,7 @@ const plugin = new SeleniumDevToolsPlugin()
 
 const patched = patchSelenium({
   onBeforeBuild: (builder) => {
+    plugin.noteBuilder(builder)
     ensureBidiCapability(builder)
     if (plugin.options.headless) {
       ensureHeadlessChrome(builder)
@@ -613,6 +669,8 @@ const patched = patchSelenium({
   },
   onDriverCreated: (driver) => plugin.onDriverCreated(driver),
   onCommand: (cmd) => plugin.onCommand(cmd),
+  afterNavigation: () => plugin.instrumentNavigationTarget(),
+  beforeInput: () => plugin.focusForInput(),
   // Per-scenario cleanup ONLY here (finalizes that driver's screencast,
   // clears per-driver state). The session-wide teardown — set-finalized,
   // session summary, capturer cleanup, interactive shutdown — lives in
diff --git a/packages/selenium-devtools/src/session-lifecycle.ts b/packages/selenium-devtools/src/session-lifecycle.ts
index 2f5a53ce..f9ae39e2 100644
--- a/packages/selenium-devtools/src/session-lifecycle.ts
+++ b/packages/selenium-devtools/src/session-lifecycle.ts
@@ -239,7 +239,7 @@ async function attachBidi(
     if (attached) {
       ctx.sessionCapturer!.bidiActive = true
       log.info(
-        '✓ BiDi data flow active — script-injected console/network suppressed'
+        '✓ BiDi subscribed; script-injected console/network suppressed once its events arrive'
       )
     }
   } catch (err) {
diff --git a/packages/selenium-devtools/src/session.ts b/packages/selenium-devtools/src/session.ts
index e8d033aa..99eb4481 100644
--- a/packages/selenium-devtools/src/session.ts
+++ b/packages/selenium-devtools/src/session.ts
@@ -26,6 +26,10 @@ export class SessionCapturer extends SessionCapturerBase {
 
   // True once BiDi inspectors are attached — script-trace path skips streams.
   bidiActive = false
+  /** Whether BiDi has delivered at least one event of each stream. A
+   *  subscription that delivers nothing is not a source. */
+  bidiConsoleObserved = false
+  bidiNetworkObserved = false
 
   /** True once the collector is registered as a document-start BiDi preload.
    *  Every document then instruments itself before any of its own script runs,
@@ -215,11 +219,9 @@ export class SessionCapturer extends SessionCapturerBase {
       return
     }
     try {
-      // Injecting over a live collector replaces `window.wdioTraceCollector`
-      // with a fresh instance and DISCARDS whatever it had buffered — including
-      // the destination's full-DOM anchor. Three call paths can reach the same
-      // document (navigation trace, post-command drain recovery, explicit
-      // re-inject), so the guard lives here rather than in each caller.
+      // Three call paths reach the same document (navigation trace,
+      // post-command drain recovery, explicit re-inject); a bundle that finds
+      // a collector keeps it, so this probe only saves the round trips.
       const present = await exec(
         driver,
         `return ${COLLECTOR_READY_EXPRESSION};`
@@ -228,15 +230,24 @@ export class SessionCapturer extends SessionCapturerBase {
         return
       }
       const scriptContent = await loadInjectableScript()
-      await exec(
+      // The appended script runs synchronously, so this usually answers ready.
+      const injected = await exec(
         driver,
-        "var s=document.createElement('script');s.textContent=arguments[0];document.head.appendChild(s);return true;",
+        `var s=document.createElement('script');s.textContent=arguments[0];document.head.appendChild(s);return ${COLLECTOR_READY_EXPRESSION};`,
         scriptContent
       )
-      const ready = await pollUntilReady(async () => {
-        const r = await exec(driver, `return ${COLLECTOR_READY_EXPRESSION};`)
-        return r === true
-      })
+      const ready =
+        injected === true ||
+        (await pollUntilReady(
+          async () => {
+            const r = await exec(
+              driver,
+              `return ${COLLECTOR_READY_EXPRESSION};`
+            )
+            return r === true
+          },
+          { checkFirst: true }
+        ))
       if (ready) {
         log.info('✓ Script injected and collector ready')
       } else {
@@ -292,9 +303,12 @@ export class SessionCapturer extends SessionCapturerBase {
       log.debug(
         `drain: ${drained.length} mutations (anchor=${forceAnchor} recovered=${recovered})`
       )
+      // Gated on what BiDi has delivered, not on its subscription: Appium's
+      // BiDi shim accepts the subscription and then sends nothing, and there
+      // the page's own streams are the only capture.
       this.processTracePayload(traceData as Record<string, unknown>, {
-        skipConsoleLogs: this.bidiActive,
-        skipNetworkRequests: this.bidiActive
+        skipConsoleLogs: this.bidiConsoleObserved,
+        skipNetworkRequests: this.bidiNetworkObserved
       })
     } catch (err) {
       const msg = errorMessage(err)
diff --git a/packages/selenium-devtools/src/types.ts b/packages/selenium-devtools/src/types.ts
index 09bb33bf..784daa1c 100644
--- a/packages/selenium-devtools/src/types.ts
+++ b/packages/selenium-devtools/src/types.ts
@@ -99,6 +99,8 @@ export interface CapturedCommand {
    *  duration instead of a synthetic 1ms. */
   startTime: number
   fromElement: boolean
+  /** Issued while a `driver.wait()` was in flight: one of its polls. */
+  duringWait?: boolean
   /** Locator that produced the element this command acted on. An element command
    *  carries no locator of its own — the earlier `findElement` consumed it — so
    *  it is recovered from the handle and threaded onto the row here. */
@@ -115,6 +117,11 @@ export interface DriverPatcherHooks {
   onBeforeQuit?: (driver: SeleniumDriverLike) => Promise<void>
   // Gates `await new Builder().build()` on the dashboard being connected.
   waitForReady?: () => Promise<void>
+  // Awaited before a navigation command resolves to the test, so the fallback
+  // collector is in the destination before the test's next command reaches it.
+  afterNavigation?: (command: string) => Promise<void>
+  // Awaited before an element click, sendKeys, clear or submit is sent.
+  beforeInput?: () => Promise<void>
 }
 
 // Unwrapped WebDriver methods used by the plugin's own internal calls
@@ -130,6 +137,7 @@ export interface DriverOriginals {
   manage?: (driver: SeleniumDriverLike) => unknown
   getCurrentUrl?: (driver: SeleniumDriverLike) => Promise<string>
   getTitle?: (driver: SeleniumDriverLike) => Promise<string>
+  getWindowHandle?: (driver: SeleniumDriverLike) => Promise<string>
 }
 
 // Unwrapped WebElement methods for internal enrichment paths.
diff --git a/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts b/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts
index 445fc949..7fefd801 100644
--- a/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts
+++ b/packages/selenium-devtools/tests/captureOrReplaceCommand.test.ts
@@ -79,4 +79,133 @@ describe('captureOrReplaceCommand', () => {
       capturer.cleanup()
     }
   })
+
+  it('folds polls that overlap in flight into one row', async () => {
+    // selenium's `wait()` polls `getCurrentUrl` every 200 ms and the patcher
+    // does not await `onCommand`, so the second poll used to be captured
+    // before the first had its id and the Actions list showed it twice.
+    const capturer = new SessionCapturer({})
+    const retryTracker = new RetryTracker()
+    const poll = (timestamp: number) =>
+      command({
+        command: 'getCurrentUrl',
+        args: [],
+        fromElement: false,
+        callSource: undefined,
+        timestamp,
+        startTime: timestamp - 3
+      })
+    try {
+      await Promise.all([
+        captureOrReplaceCommand({
+          capturer,
+          retryTracker,
+          test,
+          cmd: poll(1_000)
+        }),
+        captureOrReplaceCommand({
+          capturer,
+          retryTracker,
+          test,
+          cmd: poll(1_200)
+        }),
+        captureOrReplaceCommand({
+          capturer,
+          retryTracker,
+          test,
+          cmd: poll(1_400)
+        })
+      ])
+      expect(capturer.commandsLog).toHaveLength(1)
+      expect(capturer.commandsLog[0].timestamp).toBe(1_400)
+    } finally {
+      capturer.cleanup()
+    }
+  })
+
+  it('folds the timer polls of a wait() into the row its first, sourced poll made', async () => {
+    // The first poll runs inside the user's `wait()` call and carries its line;
+    // the rest run from a timer with no user frame on the stack.
+    const capturer = new SessionCapturer({})
+    const retryTracker = new RetryTracker()
+    const poll = (timestamp: number, callSource?: string) =>
+      command({
+        command: 'getCurrentUrl',
+        args: [],
+        fromElement: false,
+        callSource,
+        duringWait: true,
+        timestamp,
+        startTime: timestamp - 3,
+        result: timestamp < 1_400 ? 'https://x/login' : 'https://x/secure'
+      })
+    try {
+      await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: poll(1_000, '/spec.js:22')
+      })
+      await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: poll(1_200)
+      })
+      await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: poll(1_400)
+      })
+      expect(capturer.commandsLog).toHaveLength(1)
+      expect(capturer.commandsLog[0]).toMatchObject({
+        callSource: '/spec.js:22',
+        timestamp: 1_400,
+        result: 'https://x/secure'
+      })
+      // The user's own later call of the same command is a row of its own.
+      await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: poll(1_600, '/spec.js:23')
+      })
+      expect(capturer.commandsLog).toHaveLength(2)
+    } finally {
+      capturer.cleanup()
+    }
+  })
+
+  it('keeps a call with no call site as its own row outside a wait()', async () => {
+    // A node_modules helper has no call site either; only a wait's own poll folds.
+    const capturer = new SessionCapturer({})
+    const retryTracker = new RetryTracker()
+    const read = (timestamp: number, callSource?: string) =>
+      command({
+        command: 'getCurrentUrl',
+        args: [],
+        fromElement: false,
+        callSource,
+        timestamp,
+        startTime: timestamp - 3
+      })
+    try {
+      await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: read(1_000, '/spec.js:22')
+      })
+      await captureOrReplaceCommand({
+        capturer,
+        retryTracker,
+        test,
+        cmd: read(1_010)
+      })
+      expect(capturer.commandsLog).toHaveLength(2)
+    } finally {
+      capturer.cleanup()
+    }
+  })
 })
diff --git a/packages/selenium-devtools/tests/dashboardLauncher.test.ts b/packages/selenium-devtools/tests/dashboardLauncher.test.ts
new file mode 100644
index 00000000..aec5c510
--- /dev/null
+++ b/packages/selenium-devtools/tests/dashboardLauncher.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+
+import { dashboardLaunchCommand } from '../src/helpers/dashboardLauncher.js'
+
+const CHROME = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
+const ARGS = ['--user-data-dir=/tmp/x', 'http://localhost:3000']
+
+describe('dashboardLaunchCommand', () => {
+  it('opens behind the current window on macOS when the browser under test must keep the front', () => {
+    expect(dashboardLaunchCommand(CHROME, ARGS, true, 'darwin')).toEqual({
+      command: 'open',
+      args: [
+        '-n',
+        '-g',
+        '-a',
+        '/Applications/Google Chrome.app',
+        '--args',
+        ...ARGS
+      ]
+    })
+  })
+
+  it('invokes the binary directly otherwise', () => {
+    expect(dashboardLaunchCommand(CHROME, ARGS, false, 'darwin')).toEqual({
+      command: CHROME,
+      args: ARGS
+    })
+    expect(
+      dashboardLaunchCommand('/usr/bin/google-chrome', ARGS, true, 'linux')
+    ).toEqual({
+      command: '/usr/bin/google-chrome',
+      args: ARGS
+    })
+  })
+})
diff --git a/packages/selenium-devtools/tests/index.test.ts b/packages/selenium-devtools/tests/index.test.ts
index 199bbd20..d14ccc14 100644
--- a/packages/selenium-devtools/tests/index.test.ts
+++ b/packages/selenium-devtools/tests/index.test.ts
@@ -514,6 +514,137 @@ describe('driverPatcher', () => {
     }
   })
 
+  // Without the document-start preload the collector is appended after a
+  // navigation; left to race the test's next command it lost the keystrokes
+  // typed before it landed, so the navigation waits for it.
+  it('resolves a navigation to the test only once afterNavigation has run', async () => {
+    const realGet = stash.driverFns.get
+    ;(driverProto as any).get = function () {
+      return Promise.resolve('navigated')
+    }
+    stash.driverFns.get = (driverProto as any).get
+    const chained = Promise.resolve('handle')
+    ;(driverProto as any).testChained = function () {
+      return chained
+    }
+    stash.driverFns.testChained = (driverProto as any).testChained
+    try {
+      let release!: () => void
+      const gate = new Promise<void>((r) => {
+        release = r
+      })
+      const afterNavigation = vi.fn(() => gate)
+      patchSelenium({
+        onDriverCreated: vi.fn(),
+        onCommand: vi.fn(),
+        afterNavigation
+      })
+      const fakeDriver = Object.create(driverProto)
+
+      let resolved = false
+      const navigation = (fakeDriver as any)
+        .get('https://x/')
+        .then((v: unknown) => {
+          resolved = true
+          return v
+        })
+      await new Promise((r) => setImmediate(r))
+      expect(afterNavigation).toHaveBeenCalledWith('get')
+      expect(resolved).toBe(false)
+      release()
+      expect(await navigation).toBe('navigated')
+
+      // Anything else hands back the original thenable, which chaining relies on.
+      expect((fakeDriver as any).testChained()).toBe(chained)
+    } finally {
+      ;(driverProto as any).get = realGet
+      stash.driverFns.get = realGet
+      delete (driverProto as any).testChained
+      delete stash.driverFns.testChained
+    }
+  })
+
+  it('awaits beforeInput before an element input command reaches the driver', async () => {
+    const order: string[] = []
+    const realClick = stash.elementFns.click
+    const realGetText = stash.elementFns.getText
+    ;(elementProto as any).click = function () {
+      order.push('click')
+      return Promise.resolve()
+    }
+    ;(elementProto as any).getText = function () {
+      order.push('getText')
+      return Promise.resolve('t')
+    }
+    stash.elementFns.click = (elementProto as any).click
+    stash.elementFns.getText = (elementProto as any).getText
+    try {
+      const beforeInput = vi.fn(async () => {
+        order.push('focus')
+      })
+      patchSelenium({
+        onDriverCreated: vi.fn(),
+        onCommand: vi.fn(),
+        beforeInput
+      })
+      const el = Object.create(elementProto as object) as any
+      await el.click()
+      await el.getText()
+      expect(order).toEqual(['focus', 'click', 'getText'])
+    } finally {
+      ;(elementProto as any).click = realClick
+      ;(elementProto as any).getText = realGetText
+      stash.elementFns.click = realClick
+      stash.elementFns.getText = realGetText
+    }
+  })
+
+  it('marks only the commands a driver.wait() condition issues', async () => {
+    const realWait = (driverProto as any).wait
+    ;(driverProto as any).wait = async function (condition: any) {
+      const fn = typeof condition === 'function' ? condition : condition.fn
+      await fn(this)
+      await fn(this)
+    }
+    ;(driverProto as any).testRead = function () {
+      return Promise.resolve('url')
+    }
+    stash.driverFns.testRead = (driverProto as any).testRead
+    const onCommand = vi.fn<(cmd: CapturedCommand) => void>()
+    try {
+      delete (driverProto as any)[
+        Symbol.for('@wdio/selenium-devtools/wait-tracked')
+      ]
+      patchSelenium({ onDriverCreated: vi.fn(), onCommand })
+      const fakeDriver = Object.create(driverProto)
+      await (fakeDriver as any).testRead()
+      // A command the test issues while the wait is pending is not one of its polls.
+      const pending = (fakeDriver as any).wait((d: any) => d.testRead())
+      await (fakeDriver as any).testRead()
+      await pending
+      await (fakeDriver as any).wait({
+        fn: (d: any) => d.testRead(),
+        description: () => 'c'
+      })
+      await new Promise((r) => setImmediate(r))
+      expect(onCommand.mock.calls.map(([cmd]) => cmd.duringWait)).toEqual([
+        false,
+        true,
+        false,
+        true,
+        true,
+        true
+      ])
+    } finally {
+      ;(driverProto as any).wait = realWait
+      delete (driverProto as any)[
+        Symbol.for('@wdio/selenium-devtools/wait-tracked')
+      ]
+      delete (driverProto as any).testRead
+      delete stash.driverFns.testRead
+    }
+  })
+
   it('captures sync, async, and throwing wrapper invocations through onCommand', async () => {
     const onCommand = vi.fn<(cmd: CapturedCommand) => void>()
     ;(driverProto as any).testSync = function (n: number) {
diff --git a/packages/selenium-devtools/tests/session.test.ts b/packages/selenium-devtools/tests/session.test.ts
index 7ee09565..35abf1df 100644
--- a/packages/selenium-devtools/tests/session.test.ts
+++ b/packages/selenium-devtools/tests/session.test.ts
@@ -460,3 +460,85 @@ describe('selenium SessionCapturer on a native session', () => {
     expect(scripts.length).toBeGreaterThan(0)
   })
 })
+
+/**
+ * BiDi counts as a source only once it has delivered an event of that stream.
+ * Against Appium 3.7's XCUITest driver the inspectors attach cleanly and then
+ * send nothing; gating on the attach alone left the trace with zero network
+ * rows and no console.
+ */
+describe('selenium SessionCapturer.captureTrace and BiDi evidence', () => {
+  let restoreExec: (() => void) | undefined
+
+  afterEach(() => {
+    restoreExec?.()
+    restoreExec = undefined
+  })
+
+  const payload = {
+    mutations: [],
+    consoleLogs: [{ type: 'log', args: ['from the page'], timestamp: 1 }],
+    networkRequests: [
+      {
+        id: 'rt-1',
+        url: 'https://x/app.js',
+        method: 'GET',
+        type: 'script',
+        timestamp: 2,
+        startTime: 1,
+        source: 'resource-timing'
+      }
+    ]
+  }
+
+  function drainAnswers() {
+    const originals = getDriverOriginals()
+    const prev = originals.executeScript
+    originals.executeScript = (async (_driver: unknown, script: unknown) => {
+      const s = String(script)
+      if (s.includes('getTraceData')) {
+        return payload
+      }
+      if (s.includes('location.href')) {
+        return 'https://x/'
+      }
+      return true
+    }) as (typeof originals)['executeScript']
+    restoreExec = () => {
+      if (prev) {
+        originals.executeScript = prev
+      } else {
+        delete originals.executeScript
+      }
+    }
+  }
+
+  it('keeps the page’s console and network while an attached BiDi has delivered nothing', async () => {
+    drainAnswers()
+    const cap = makeCapturer({ id: 'd' })
+    cap.bidiActive = true
+    await cap.captureTrace()
+    expect(cap.networkRequests.map((r) => r.id)).toEqual(['rt-1'])
+    expect(cap.consoleLogs.map((c) => c.args)).toEqual([['from the page']])
+  })
+
+  it('withholds each stream once its BiDi sink has received an event', async () => {
+    const { buildBidiSinks } = await import('../src/bidi.js')
+    drainAnswers()
+    const cap = makeCapturer({ id: 'd' })
+    cap.bidiActive = true
+    const sinks = buildBidiSinks(cap)
+    sinks.pushNetworkRequest({
+      id: 'bidi-1',
+      url: 'https://x/',
+      method: 'GET',
+      type: 'document',
+      timestamp: 1,
+      startTime: 0
+    })
+    sinks.pushConsoleLog({ type: 'log', args: ['from bidi'], timestamp: 1 })
+    await cap.captureTrace()
+    expect(cap.networkRequests.map((r) => r.id)).toEqual(['bidi-1'])
+    expect(cap.consoleLogs.map((c) => c.args)).toEqual([['from bidi']])
+  })
+})
diff --git a/packages/service/src/index.ts b/packages/service/src/index.ts
index 48c5b7d6..e7f58748 100644
--- a/packages/service/src/index.ts
+++ b/packages/service/src/index.ts
@@ -15,7 +15,8 @@ import {
   tracePolicyModeWarning,
   upsertRichestSnapshot,
   type TraceArtifact,
-  type TraceExportContext
+  type TraceExportContext,
+  restoreBrowserFocus
 } from '@wdio/devtools-core'
 import { getAllureSink } from './allure.js'
 import { wireAssertCapture, type ExpectAssertion } from './assert-capture.js'
@@ -237,6 +238,17 @@ export default class DevToolsHookService implements Services.ServiceInstance {
       wdioCaps['wdio:devtoolsOptions']
     )
     this.#sessionCapturer.traceMode = this.#options.mode ?? 'live'
+    // The dashboard window took the front; Safari clicks reach nothing there.
+    if ((this.#options.mode ?? 'live') === 'live') {
+      const caps = browser.capabilities as
+        { browserName?: string; platformName?: string } | undefined
+      restoreBrowserFocus({
+        browserName: caps?.browserName,
+        platformName: caps?.platformName,
+        host: (browser.options as { hostname?: string } | undefined)?.hostname,
+        onError: (message) => log.warn(message)
+      })
+    }
     stampRunnerMetadata(this.#sessionCapturer, browser, this.captureType)
 
     if (this.#options.captureAssertions !== false) {
diff --git a/packages/service/src/session.ts b/packages/service/src/session.ts
index 5138f0e8..7c5e29f7 100644
--- a/packages/service/src/session.ts
+++ b/packages/service/src/session.ts
@@ -51,6 +51,10 @@ export class SessionCapturer extends SessionCapturerBase {
 
   #isScriptInjected = false
   #replacedDocumentInLastDrain = false
+  /** Whether BiDi has delivered at least one network event. `browser.isBidi`
+   *  says a session advertised BiDi; Appium's shim advertises it and sends
+   *  nothing, so only a delivered event makes BiDi the network source. */
+  #bidiNetworkObserved = false
   /** Session start wall time for trace event timestamps. */
   readonly startWallTime = Date.now()
   /** Last find-element selector — carried forward to the next element command. */
@@ -500,7 +504,9 @@ export class SessionCapturer extends SessionCapturerBase {
       ) {
         this.#replacedDocumentInLastDrain = true
       }
-      this.processTracePayload(payload as Record<string, unknown>)
+      this.processTracePayload(payload as Record<string, unknown>, {
+        skipResourceTimingRequests: this.#bidiNetworkObserved
+      })
     } catch (err) {
       log.error(`Failed to capture trace: ${errorMessage(err)}`)
     }
@@ -576,6 +582,7 @@ export class SessionCapturer extends SessionCapturerBase {
     timestamp: number
   }) {
     try {
+      this.#bidiNetworkObserved = true
       const { request, timestamp } = event
       const requestId = request.request
       const requestHeaders = this.#flattenBidiHeaders(request.headers)
diff --git a/packages/service/tests/session.test.ts b/packages/service/tests/session.test.ts
index 20e52e18..0123a47f 100644
--- a/packages/service/tests/session.test.ts
+++ b/packages/service/tests/session.test.ts
@@ -1127,6 +1127,58 @@ describe('SessionCapturer', () => {
  * Guarded inside `captureTrace` because two of its four call sites asked and
  * two did not — the assumption lives here, so the guard does too.
  */
+/**
+ * BiDi counts as the network source only once it has delivered an event.
+ * `browser.isBidi` says the session advertised BiDi; Appium 3.7's XCUITest
+ * driver advertises it, accepts the subscription and sends nothing, and gating
+ * on the advertisement left such a trace with zero network rows.
+ */
+describe('captureTrace and BiDi evidence', () => {
+  const resourceTimingRow = {
+    id: 'rt-1',
+    url: 'https://example.com/app.js',
+    method: 'GET',
+    type: 'script',
+    timestamp: 2,
+    startTime: 1,
+    source: 'resource-timing'
+  }
+  const patchedRow = {
+    id: 'p-1',
+    url: 'https://example.com/api',
+    method: 'POST',
+    type: 'fetch',
+    timestamp: 3,
+    startTime: 2
+  }
+  /** A session that advertises BiDi and whose drain answers both rows. */
+  const advertisingBrowser = () =>
+    ({
+      isBidi: true,
+      execute: vi.fn().mockResolvedValue({
+        networkRequests: [resourceTimingRow, patchedRow]
+      }),
+      getUrl: vi.fn().mockResolvedValue('https://example.com'),
+      takeScreenshot: vi.fn().mockResolvedValue('screenshot')
+    }) as never
+
+  it('keeps the page’s Resource Timing rows while BiDi has delivered nothing', async () => {
+    const capturer = new SessionCapturer()
+    await capturer.captureTrace(advertisingBrowser())
+    expect(capturer.networkRequests.map((r) => r.id)).toEqual(['rt-1', 'p-1'])
+  })
+
+  it('drops them once a BiDi network event has arrived, keeping the patched row', async () => {
+    const capturer = new SessionCapturer()
+    capturer.handleNetworkRequestStarted({
+      request: { request: 'req-1', url: 'https://example.com/', method: 'GET' },
+      timestamp: 1
+    })
+    await capturer.captureTrace(advertisingBrowser())
+    expect(capturer.networkRequests.map((r) => r.id)).toEqual(['p-1'])
+  })
+})
+
 describe('captureTrace on a native session', () => {
   /** A driver that answers nothing: any page-side call is a failure here. No
    *  `browserName`, which is what makes it an APP session. */
diff --git a/packages/shared/src/browser-schemes.ts b/packages/shared/src/browser-schemes.ts
new file mode 100644
index 00000000..0c039578
--- /dev/null
+++ b/packages/shared/src/browser-schemes.ts
@@ -0,0 +1,30 @@
+/** The browser's own pages, which no server answers for: start, error and
+ *  new-tab pages, extensions, devtools. Chrome's family is matched by prefix. */
+export const BROWSER_INTERNAL_SCHEMES: ReadonlySet<string> = new Set([
+  'about',
+  'chrome',
+  'chrome-error',
+  'chrome-extension',
+  'chrome-native',
+  'chrome-search',
+  'chrome-untrusted',
+  'devtools',
+  'edge',
+  'moz-extension',
+  'safari-web-extension'
+])
+
+const SCHEME = /^([a-z][a-z0-9+.-]*):/
+
+/** The scheme a URL names, lower-cased; a relative URL names none. */
+export function schemeOf(url: string): string | undefined {
+  return SCHEME.exec(url.toLowerCase())?.[1]
+}
+
+export function isBrowserInternalUrl(url: string): boolean {
+  const scheme = schemeOf(url)
+  return (
+    scheme !== undefined &&
+    (BROWSER_INTERNAL_SCHEMES.has(scheme) || scheme.startsWith('chrome-'))
+  )
+}
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index 268d7283..841d024a 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -3,6 +3,7 @@
 
 export * from './action-mapping.js'
 export * from './baseline.js'
+export * from './browser-schemes.js'
 export * from './console.js'
 export * from './device.js'
 export * from './element-scripts.js'
@@ -10,6 +11,7 @@ export * from './collector.js'
 export * from './files.js'
 export * from './image.js'
 export * from './locator-dialect.js'
+export * from './request-type.js'
 export * from './routes.js'
 export * from './runner.js'
 export * from './snapshot-format.js'
diff --git a/packages/shared/src/request-type.ts b/packages/shared/src/request-type.ts
new file mode 100644
index 00000000..d5d18655
--- /dev/null
+++ b/packages/shared/src/request-type.ts
@@ -0,0 +1,54 @@
+import type { RequestType } from './types.js'
+
+/**
+ * Classify an HTTP request into a {@link RequestType}, preferring the response
+ * `mimeType` and falling back to URL extension heuristics. The categories are
+ * enumerated once, in `REQUEST_TYPES`, so this text can't drift from them. A
+ * shape it can't place returns `'xhr'`, never the vocabulary's `'other'`,
+ * which is reserved for producers that classify nothing at all.
+ *
+ * A pure leaf module, importable from any runtime: core's driver-side capture
+ * and the page collector's Resource Timing capture are both classified here,
+ * so a content-type or extension is read by one table rather than two.
+ */
+export function getRequestType(url: string, mimeType?: string): RequestType {
+  const contentType = mimeType?.toLowerCase() ?? ''
+  const urlLower = url.toLowerCase()
+  if (contentType.includes('text/html')) {
+    return 'document'
+  }
+  if (contentType.includes('text/css')) {
+    return 'stylesheet'
+  }
+  if (
+    contentType.includes('javascript') ||
+    contentType.includes('ecmascript')
+  ) {
+    return 'script'
+  }
+  if (contentType.includes('image/')) {
+    return 'image'
+  }
+  if (contentType.includes('font/') || contentType.includes('woff')) {
+    return 'font'
+  }
+  if (contentType.includes('application/json')) {
+    return 'fetch'
+  }
+  if (urlLower.endsWith('.html') || urlLower.endsWith('.htm')) {
+    return 'document'
+  }
+  if (urlLower.endsWith('.css')) {
+    return 'stylesheet'
+  }
+  if (urlLower.endsWith('.js') || urlLower.endsWith('.mjs')) {
+    return 'script'
+  }
+  if (/\.(png|jpg|jpeg|gif|svg|webp|ico)$/.test(urlLower)) {
+    return 'image'
+  }
+  if (/\.(woff|woff2|ttf|eot|otf)$/.test(urlLower)) {
+    return 'font'
+  }
+  return 'xhr'
+}
diff --git a/packages/shared/src/types.ts b/packages/shared/src/types.ts
index b2db8e36..c1e0b582 100644
--- a/packages/shared/src/types.ts
+++ b/packages/shared/src/types.ts
@@ -235,8 +235,9 @@ export interface ConsoleLog {
 
 /**
  * Every word a captured `NetworkRequest.type` can carry. The capture side
- * classifies once — `core`'s `getRequestType` for driver-observed traffic, the
- * page collector for its patched `fetch`/`XMLHttpRequest` — and the app only
+ * classifies once (shared's `getRequestType` for driver-observed traffic and
+ * Resource Timing entries, the page collector for its patched
+ * `fetch`/`XMLHttpRequest`) and the app only
  * translates these words into display buckets. Adding a category here is the
  * compile-time trigger that forces every consumer's mapping to handle it.
  * `other` is the residual for traffic no producer could classify (a failed
@@ -266,9 +267,50 @@ export function isRequestType(value: unknown): value is RequestType {
   )
 }
 
+/**
+ * Stated only by the one network source that carries no headers, no body and
+ * (outside Chromium) no status: the document's Resource Timing buffer, which
+ * is all a browser without BiDi exposes. Every other source carries them and
+ * states nothing; a consumer reads the mark to name the gap rather than render
+ * the request as still in flight or failed.
+ */
+export const NETWORK_CAPTURE_SOURCE = {
+  RESOURCE_TIMING: 'resource-timing'
+} as const
+export type NetworkCaptureSource =
+  (typeof NETWORK_CAPTURE_SOURCE)[keyof typeof NETWORK_CAPTURE_SOURCE]
+
+/** Phase durations in ms, HAR's phases. A phase the browser withheld is
+ *  absent. An interface rather than a mapped type because the wire-schema
+ *  generator reads property declarations. */
+export interface NetworkTimings {
+  blocked?: number
+  dns?: number
+  connect?: number
+  ssl?: number
+  send?: number
+  wait?: number
+  receive?: number
+}
+
+/** The phases, in HAR's order, for a consumer that iterates them. */
+export const NETWORK_TIMING_PHASES = [
+  'blocked',
+  'dns',
+  'connect',
+  'ssl',
+  'send',
+  'wait',
+  'receive'
+] as const satisfies readonly (keyof NetworkTimings)[]
+export type NetworkTimingPhase = (typeof NETWORK_TIMING_PHASES)[number]
+
 export interface NetworkRequest {
   id: string
   url: string
+  /** Empty when the source does not expose it: Resource Timing names no
+   *  method, so only a parser-initiated load (an image, a script) is known to
+   *  be a GET. */
   method: string
   headers?: Record<string, string>
   cookies?: unknown[]
@@ -295,6 +337,8 @@ export interface NetworkRequest {
   requestBody?: string
   responseBody?: string
   size?: number
+  timings?: NetworkTimings
+  source?: NetworkCaptureSource
 }
 
 // ─── Trace and metadata ─────────────────────────────────────────────────────
diff --git a/packages/shared/tests/browser-schemes.test.ts b/packages/shared/tests/browser-schemes.test.ts
new file mode 100644
index 00000000..c4c0d2b1
--- /dev/null
+++ b/packages/shared/tests/browser-schemes.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+
+import { isBrowserInternalUrl, schemeOf } from '../src/browser-schemes.js'
+
+describe('schemeOf', () => {
+  it('reads a scheme case-insensitively and only where one is named', () => {
+    expect(schemeOf('CHROME://settings')).toBe('chrome')
+    expect(schemeOf('https://x/a:b')).toBe('https')
+    expect(schemeOf('/api/me')).toBeUndefined()
+    // A colon later in a relative path is not a scheme separator.
+    expect(schemeOf('chrome-dashboard/export?from=10:00')).toBeUndefined()
+    expect(schemeOf('localhost:8080/x')).toBe('localhost')
+  })
+})
+
+describe('isBrowserInternalUrl', () => {
+  it("names the browser's own pages and nothing a server answers for", () => {
+    for (const url of [
+      'about:blank',
+      'chrome://settings',
+      'chrome-native://newtab/',
+      'chrome-untrusted://new-tab-page/',
+      'chrome-error://chromewebdata/',
+      'chrome-extension://abc/page.html',
+      'devtools://devtools/bundled/inspector.html',
+      'edge://settings',
+      'moz-extension://abc/page.html'
+    ]) {
+      expect(isBrowserInternalUrl(url), url).toBe(true)
+    }
+    for (const url of [
+      'https://app.test/login',
+      'http://localhost:8080/',
+      'data:text/plain,hello',
+      'blob:https://app.test/1234',
+      'chrome-dashboard/export?from=10:00',
+      '/relative/path'
+    ]) {
+      expect(isBrowserInternalUrl(url), url).toBe(false)
+    }
+  })
+})
diff --git a/packages/shared/tests/request-type.test.ts b/packages/shared/tests/request-type.test.ts
new file mode 100644
index 00000000..8d68d33d
--- /dev/null
+++ b/packages/shared/tests/request-type.test.ts
@@ -0,0 +1,86 @@
+import { describe, it, expect } from 'vitest'
+
+import { getRequestType } from '../src/request-type.js'
+import { REQUEST_TYPES, isRequestType } from '../src/types.js'
+
+describe('getRequestType', () => {
+  it('classifies from the response mime type', () => {
+    expect(getRequestType('/x', 'text/html; charset=utf-8')).toBe('document')
+    expect(getRequestType('/x', 'text/css')).toBe('stylesheet')
+    expect(getRequestType('/x', 'application/javascript')).toBe('script')
+    expect(getRequestType('/x', 'text/ecmascript')).toBe('script')
+    expect(getRequestType('/x', 'image/png')).toBe('image')
+    expect(getRequestType('/x', 'font/woff2')).toBe('font')
+    expect(getRequestType('/x', 'application/font-woff')).toBe('font')
+    expect(getRequestType('/x', 'application/json')).toBe('fetch')
+  })
+
+  it('reads the mime type case-insensitively', () => {
+    expect(getRequestType('/x', 'TEXT/HTML')).toBe('document')
+    expect(getRequestType('/x', 'Application/JSON')).toBe('fetch')
+  })
+
+  it('falls back to the URL extension when no mime type was observed', () => {
+    expect(getRequestType('/a.html')).toBe('document')
+    expect(getRequestType('/a.htm')).toBe('document')
+    expect(getRequestType('/a.css')).toBe('stylesheet')
+    expect(getRequestType('/a.js')).toBe('script')
+    expect(getRequestType('/a.mjs')).toBe('script')
+    expect(getRequestType('/a.PNG')).toBe('image')
+    expect(getRequestType('/a.svg')).toBe('image')
+    expect(getRequestType('/a.woff2')).toBe('font')
+    expect(getRequestType('/a.ttf')).toBe('font')
+  })
+
+  it('prefers the mime type over a contradicting extension', () => {
+    // A JSON API served from a `.html` path is a data request, not a document.
+    expect(getRequestType('/a.html', 'application/json')).toBe('fetch')
+  })
+
+  it('returns the xhr fallback for a shape it cannot classify', () => {
+    expect(getRequestType('/api/data')).toBe('xhr')
+    expect(getRequestType('/api/data', 'application/octet-stream')).toBe('xhr')
+    expect(getRequestType('')).toBe('xhr')
+  })
+
+  it('ignores a query string that looks like an extension', () => {
+    // The extension test is anchored to the end of the URL, so a `?v=` cache
+    // buster leaves the request unclassifiable rather than mis-bucketed.
+    expect(getRequestType('/app.js?v=2')).toBe('xhr')
+  })
+
+  it('only ever returns a word from the shared vocabulary', () => {
+    const urls = [
+      '/x',
+      '/a.html',
+      '/a.css',
+      '/a.js',
+      '/a.png',
+      '/a.woff',
+      '/api/data'
+    ]
+    const mimes = [undefined, 'text/html', 'image/gif', 'application/json', '?']
+    for (const url of urls) {
+      for (const mime of mimes) {
+        expect(isRequestType(getRequestType(url, mime))).toBe(true)
+      }
+    }
+  })
+})
+
+describe('isRequestType', () => {
+  it('accepts every word in the vocabulary', () => {
+    for (const type of REQUEST_TYPES) {
+      expect(isRequestType(type)).toBe(true)
+    }
+  })
+
+  it('rejects anything else', () => {
+    expect(isRequestType('websocket')).toBe(false)
+    expect(isRequestType('Document')).toBe(false)
+    expect(isRequestType('')).toBe(false)
+    expect(isRequestType(undefined)).toBe(false)
+    expect(isRequestType(null)).toBe(false)
+    expect(isRequestType(7)).toBe(false)
+  })
+})
diff --git a/packages/shared/wire-schema.json b/packages/shared/wire-schema.json
index 56ad1f80..d418fac7 100644
--- a/packages/shared/wire-schema.json
+++ b/packages/shared/wire-schema.json
@@ -637,6 +637,15 @@
         },
         "size": {
           "type": "number"
+        },
+        "timings": {
+          "$ref": "#/$defs/NetworkTimings"
+        },
+        "source": {
+          "type": "string",
+          "enum": [
+            "resource-timing"
+          ]
         }
       },
       "required": [
@@ -649,6 +658,34 @@
       ],
       "additionalProperties": false
     },
+    "NetworkTimings": {
+      "type": "object",
+      "properties": {
+        "blocked": {
+          "type": "number"
+        },
+        "dns": {
+          "type": "number"
+        },
+        "connect": {
+          "type": "number"
+        },
+        "ssl": {
+          "type": "number"
+        },
+        "send": {
+          "type": "number"
+        },
+        "wait": {
+          "type": "number"
+        },
+        "receive": {
+          "type": "number"
+        }
+      },
+      "required": [],
+      "additionalProperties": false
+    },
     "PerformanceData": {
       "type": "object",
       "properties": {
diff --git a/packages/trace/src/trace-har.ts b/packages/trace/src/trace-har.ts
index e26ddfb9..2526b425 100644
--- a/packages/trace/src/trace-har.ts
+++ b/packages/trace/src/trace-har.ts
@@ -1,11 +1,29 @@
 // Convert the existing NetworkRequest shape into trace format
 // `resource-snapshot` NDJSON entries (HAR-flavoured) for trace.zip.
 
-import type { NetworkRequest } from '@wdio/devtools-shared'
+import type {
+  NetworkCaptureSource,
+  NetworkRequest,
+  NetworkTimings,
+  RequestType
+} from '@wdio/devtools-shared'
 
 /** Bodies below this inline as plain `text`; larger ones rely on `_sha1` only. */
 const INLINE_BODY_TEXT_MAX_BYTES = 8 * 1024
 
+/** HAR's own marker for a phase that does not apply. */
+const HAR_PHASE_NOT_APPLICABLE = -1
+
+export interface HarTimings {
+  blocked?: number
+  dns?: number
+  connect?: number
+  ssl?: number
+  send: number
+  wait: number
+  receive: number
+}
+
 export interface HarResponseContent {
   size: number
   mimeType: string
@@ -42,7 +60,31 @@ export interface ResourceSnapshotEntry {
       bodySize: number
     }
     cache: Record<string, never>
-    timings: { send: number; wait: number; receive: number }
+    timings: HarTimings
+    /** The capture's own classification, which `content.mimeType` cannot
+     *  carry for a source that saw no response headers. */
+    _resourceType: RequestType
+    _source?: NetworkCaptureSource
+  }
+}
+
+/** The phases a capture measured, in HAR's shape; a capture that measured
+ *  none reports the whole duration as `wait`, which is all it knows. */
+function toHarTimings(
+  timings: NetworkTimings | undefined,
+  duration: number
+): HarTimings {
+  if (!timings) {
+    return { send: 0, wait: Math.max(0, duration), receive: 0 }
+  }
+  return {
+    blocked: timings.blocked ?? HAR_PHASE_NOT_APPLICABLE,
+    dns: timings.dns ?? HAR_PHASE_NOT_APPLICABLE,
+    connect: timings.connect ?? HAR_PHASE_NOT_APPLICABLE,
+    ssl: timings.ssl ?? HAR_PHASE_NOT_APPLICABLE,
+    send: timings.send ?? 0,
+    wait: timings.wait ?? 0,
+    receive: timings.receive ?? 0
   }
 }
 
@@ -122,11 +164,9 @@ export function networkRequestToHar(
         bodySize: entry.size ?? -1
       },
       cache: {},
-      timings: {
-        send: 0,
-        wait: Math.max(0, duration),
-        receive: 0
-      }
+      timings: toHarTimings(entry.timings, duration),
+      _resourceType: entry.type,
+      ...(entry.source ? { _source: entry.source } : {})
     }
   }
 }
diff --git a/packages/trace/tests/trace-har.test.ts b/packages/trace/tests/trace-har.test.ts
new file mode 100644
index 00000000..48fd42b7
--- /dev/null
+++ b/packages/trace/tests/trace-har.test.ts
@@ -0,0 +1,72 @@
+import { describe, it, expect } from 'vitest'
+import {
+  NETWORK_CAPTURE_SOURCE,
+  type NetworkRequest
+} from '@wdio/devtools-shared'
+import { networkRequestToHar } from '../src/trace-har.js'
+
+function entry(overrides: Partial<NetworkRequest> = {}): NetworkRequest {
+  return {
+    id: 'r1',
+    url: 'https://app.test/api/items?page=2',
+    method: 'GET',
+    status: 200,
+    statusText: 'OK',
+    timestamp: 1_700_000_000_000,
+    startTime: 10,
+    endTime: 60,
+    time: 50,
+    type: 'fetch',
+    responseHeaders: { 'content-type': 'application/json' },
+    size: 7,
+    ...overrides
+  }
+}
+
+describe('networkRequestToHar: what every entry carries', () => {
+  it('states the capture-side type, which a mime-less entry cannot restore', () => {
+    const { snapshot } = networkRequestToHar(entry({ type: 'script' }))
+    expect(snapshot._resourceType).toBe('script')
+    expect(snapshot._source).toBeUndefined()
+  })
+
+  it('reports an unmeasured entry as one wait phase', () => {
+    const { snapshot } = networkRequestToHar(entry())
+    expect(snapshot.timings).toEqual({ send: 0, wait: 50, receive: 0 })
+  })
+})
+
+describe('networkRequestToHar: a Resource Timing entry', () => {
+  const fromResourceTiming = entry({
+    status: undefined,
+    statusText: undefined,
+    responseHeaders: undefined,
+    method: '',
+    type: 'document',
+    timings: { blocked: 1, dns: 2, connect: 3, send: 0, wait: 40, receive: 4 },
+    source: NETWORK_CAPTURE_SOURCE.RESOURCE_TIMING
+  })
+
+  it('marks its source so the reader can tell a missing status from a failure', () => {
+    const { snapshot } = networkRequestToHar(fromResourceTiming)
+    expect(snapshot._source).toBe('resource-timing')
+    expect(snapshot._resourceType).toBe('document')
+    // HAR requires a numeric status; 0 is the only honest one here.
+    expect(snapshot.response.status).toBe(0)
+    expect(snapshot.response.headers).toEqual([])
+    expect(snapshot.request.method).toBe('')
+  })
+
+  it('carries the measured phases, with HAR’s -1 for one it did not see', () => {
+    const { snapshot } = networkRequestToHar(fromResourceTiming)
+    expect(snapshot.timings).toEqual({
+      blocked: 1,
+      dns: 2,
+      connect: 3,
+      ssl: -1,
+      send: 0,
+      wait: 40,
+      receive: 4
+    })
+  })
+})