diff --git a/.env.example b/.env.example
index 64107dbc..598e59a3 100644
--- a/.env.example
+++ b/.env.example
@@ -60,13 +60,6 @@ TINYCOMPUTER_LAB_SELF_EMAIL=
 # TINYCOMPUTER_BROWSER_ENDPOINT=http://127.0.0.1:9222
 # The travel fixture's address for browser_fixture.
 # TINYCOMPUTER_FIXTURE_URL=http://127.0.0.1:8000
-# The attested module the bus runners (scripts/lab, task_live, task_fixture)
-# load; scripts/build-module builds it and prints this path.
-# TINYCOMPUTER_MODULE=target/lab/libtinycomputer.dylib
-# Where scripts/build-module installs it instead of <target>/lab: the loader
-# refuses a module under a directory another user can write, so the Docker
-# runners use $HOME/.local/lib/tinycomputer.
-# TINYCOMPUTER_MODULE_DIR=
 # The planner model task_live asks for.
 # TINYCOMPUTER_PLANNER_MODEL=
 # The reasoning model task_live rescues a failed step with (default
diff --git a/crates/tinycomputer-browser/src/error/error_tests.rs b/crates/tinycomputer-browser/src/error/error_tests.rs
index 26e68e7c..520ef5b9 100644
--- a/crates/tinycomputer-browser/src/error/error_tests.rs
+++ b/crates/tinycomputer-browser/src/error/error_tests.rs
@@ -149,6 +149,8 @@ fn a_stale_ref_envelope_matches_the_desktop_recovery() {
             .suggestion
             .is_some_and(|s| s.contains("BrowserSnapshot"))
     );
+    // agent-browser could not resolve the ref, so nothing reached the page:
+    // retrying with a fresh ref cannot repeat an effect.
     assert_eq!(envelope.disposition.retry, RetryDisposition::Safe);
 }
 
@@ -158,6 +160,10 @@ fn a_timeout_may_have_reached_the_page() {
     assert_eq!(envelope.code, "TIMEOUT");
     assert_eq!(envelope.disposition.delivery, DeliveryDisposition::Unknown);
     assert!(envelope.suggestion.is_none());
+    // A click may already have landed: inspect before repeating it.
+    let hint = envelope.recovery.expect("a timeout has a way out");
+    assert_eq!(hint.strategy, "inspect_state_then_retry_original");
+    assert!(hint.requires_fresh_snapshot);
 }
 
 #[test]
@@ -173,12 +179,36 @@ fn a_refused_navigation_says_not_to_retry() {
             .suggestion
             .is_some_and(|s| s.starts_with("do not retry"))
     );
+    // The domain filter refuses before any navigation reaches the page.
     assert_eq!(
         envelope.disposition.delivery,
         DeliveryDisposition::NotDelivered
     );
 }
 
+#[test]
+fn only_failures_decided_before_the_page_claim_nothing_was_delivered() {
+    let before_the_page = |error: &Error| {
+        matches!(
+            error,
+            Error::NoSuchSession { .. }
+                | Error::NoSuchOutput { .. }
+                | Error::StaleRef { .. }
+                | Error::BlockedByPolicy { .. }
+        )
+    };
+    for error in every_variant() {
+        let expected = before_the_page(&error);
+        let name = error.to_string();
+        let delivery = error.envelope().disposition.delivery;
+        assert_eq!(
+            delivery == DeliveryDisposition::NotDelivered,
+            expected,
+            "{name}"
+        );
+    }
+}
+
 #[test]
 fn a_lost_connection_suggests_a_new_session() {
     let envelope = Error::connection_lost("closed").envelope();
diff --git a/crates/tinycomputer-browser/src/error/mod.rs b/crates/tinycomputer-browser/src/error/mod.rs
index 0f4c7bd8..8f57d105 100644
--- a/crates/tinycomputer-browser/src/error/mod.rs
+++ b/crates/tinycomputer-browser/src/error/mod.rs
@@ -160,9 +160,12 @@ impl Error {
     /// The code is [`errors::code`] of the wire name — the desktop's spelling
     /// where the meaning is shared — the recovery hint is
     /// [`errors::recovery`]'s, and the full wire name rides in
-    /// `details.name` for a host that matches on it. A failure refused before
-    /// the browser was asked anything is marked not delivered, so a caller
-    /// knows retrying it cannot repeat an effect.
+    /// `details.name` for a host that matches on it. Only a failure decided
+    /// before anything reaches the page is marked not delivered, so a caller
+    /// knows retrying it cannot repeat an effect: an unknown session or
+    /// output (local lookups), an unresolvable ref, or a refused origin
+    /// (rejected inside agent-browser before any input is sent). Every other
+    /// failure's delivery stays unknown.
     ///
     /// # Examples
     ///
@@ -218,17 +221,21 @@ impl Error {
         }
     }
 
-    /// Whether this failure was decided before any command reached the
-    /// browser.
+    /// Whether this failure is always decided before anything reaches the
+    /// page, so repeating the call cannot repeat an effect: a session or an
+    /// output looked up locally and not found, a ref agent-browser could not
+    /// resolve, and a destination its domain filter refused — both of those
+    /// are rejected inside agent-browser before any input is sent to the page.
+    ///
+    /// Invalid input and a limit can also come back after work was done — a
+    /// capture that turned out too large — so their delivery stays unknown.
     fn refused_before_delivery(&self) -> bool {
         matches!(
             self,
-            Self::InvalidInput { .. }
-                | Self::NoSuchSession { .. }
+            Self::NoSuchSession { .. }
+                | Self::NoSuchOutput { .. }
                 | Self::StaleRef { .. }
                 | Self::BlockedByPolicy { .. }
-                | Self::NoSuchOutput { .. }
-                | Self::LimitExceeded { .. }
         )
     }
 
diff --git a/crates/tinycomputer-browser/src/reply/mod.rs b/crates/tinycomputer-browser/src/reply/mod.rs
index efa6334a..f423325c 100644
--- a/crates/tinycomputer-browser/src/reply/mod.rs
+++ b/crates/tinycomputer-browser/src/reply/mod.rs
@@ -82,7 +82,12 @@ pub(crate) fn classify(message: &str) -> Error {
     {
         return Error::invalid_input(message);
     }
-    if lower.starts_with("evaluation error") || lower.contains("dialog is blocking the page") {
+    // A dialog in front of the page passes once someone answers it, so the
+    // command is not wrong — the page is not ready for it yet.
+    if lower.contains("dialog is blocking the page") {
+        return Error::not_actionable(message);
+    }
+    if lower.starts_with("evaluation error") {
         return Error::page(message);
     }
     Error::failed(message)
diff --git a/crates/tinycomputer-browser/src/reply/reply_tests.rs b/crates/tinycomputer-browser/src/reply/reply_tests.rs
index 968fe15c..104bc229 100644
--- a/crates/tinycomputer-browser/src/reply/reply_tests.rs
+++ b/crates/tinycomputer-browser/src/reply/reply_tests.rs
@@ -91,7 +91,7 @@ fn engine_messages_map_to_what_the_caller_should_do() {
         }),
         (
             "A JavaScript confirm dialog is blocking the page: \"Leave?\"",
-            |e| matches!(e, Error::PageError { .. }),
+            |e| matches!(e, Error::NotActionable { .. }),
         ),
         ("something unexpected", |e| {
             matches!(e, Error::ModuleFailed { .. })
diff --git a/crates/tinycomputer-browser/src/sessions/mod.rs b/crates/tinycomputer-browser/src/sessions/mod.rs
index f70f6711..9aba478e 100644
--- a/crates/tinycomputer-browser/src/sessions/mod.rs
+++ b/crates/tinycomputer-browser/src/sessions/mod.rs
@@ -6,7 +6,7 @@
 
 use std::collections::HashMap;
 use std::path::PathBuf;
-use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 
 use serde_json::{Value, json};
@@ -32,6 +32,20 @@ pub struct Browser {
     outputs: Mutex<OutputStore>,
     scratch: PathBuf,
     counter: AtomicU64,
+    /// Sessions being launched: they count against [`MAX_SESSIONS`] from
+    /// the moment the limit is checked, so two concurrent opens cannot both
+    /// see room for the last slot.
+    opening: AtomicUsize,
+}
+
+/// One reserved launch slot, given back when the launch ends — inserted,
+/// failed, or dropped mid-launch by a cancelled caller.
+struct Reservation<'a>(&'a AtomicUsize);
+
+impl Drop for Reservation<'_> {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Ordering::SeqCst);
+    }
 }
 
 struct Session {
@@ -102,6 +116,7 @@ impl Browser {
             outputs: Mutex::new(OutputStore::default()),
             scratch,
             counter: AtomicU64::new(0),
+            opening: AtomicUsize::new(0),
         }
     }
 
@@ -112,11 +127,18 @@ impl Browser {
     /// [`Error::LimitExceeded`] when [`MAX_SESSIONS`] are open, and whatever
     /// the engine reports when the browser cannot be launched or reached.
     pub async fn open_session(&self, options: SessionOptions) -> Result<SessionInfo> {
-        if self.lock_sessions()?.len() >= MAX_SESSIONS {
-            return Err(Error::LimitExceeded {
-                message: format!("at most {MAX_SESSIONS} browser sessions may be open"),
-            });
-        }
+        // Checked and reserved under the table's lock, so the check and the
+        // claim are one step for every concurrent caller.
+        let reservation = {
+            let sessions = self.lock_sessions()?;
+            if sessions.len() + self.opening.load(Ordering::SeqCst) >= MAX_SESSIONS {
+                return Err(Error::LimitExceeded {
+                    message: format!("at most {MAX_SESSIONS} browser sessions may be open"),
+                });
+            }
+            self.opening.fetch_add(1, Ordering::SeqCst);
+            Reservation(&self.opening)
+        };
         let id = SessionId::new(format!("s-{}", self.next()));
         let mut session = Session {
             engine: self.launcher.open(id.as_str()),
@@ -140,8 +162,12 @@ impl Browser {
         session.info.url = page.url;
         session.info.title = page.title;
         let info = session.info.clone();
-        self.lock_sessions()?
-            .insert(id, Arc::new(tokio::sync::Mutex::new(session)));
+        // The slot moves from the reservation to the table in one step under
+        // the lock, so no concurrent check ever counts this launch twice.
+        let mut sessions = self.lock_sessions()?;
+        sessions.insert(id, Arc::new(tokio::sync::Mutex::new(session)));
+        drop(reservation);
+        drop(sessions);
         Ok(info)
     }
 
diff --git a/crates/tinycomputer-browser/src/sessions/sessions_tests/lifecycle_tests.rs b/crates/tinycomputer-browser/src/sessions/sessions_tests/lifecycle_tests.rs
index 759c56ec..b81ddbbc 100644
--- a/crates/tinycomputer-browser/src/sessions/sessions_tests/lifecycle_tests.rs
+++ b/crates/tinycomputer-browser/src/sessions/sessions_tests/lifecycle_tests.rs
@@ -81,3 +81,64 @@ fn the_default_scratch_space_is_private_to_the_process() {
     let browser = Browser::new(Arc::new(Fake::new()));
     assert!(format!("{browser:?}").contains(&std::process::id().to_string()));
 }
+
+/// An engine that yields before every reply, so concurrent launches
+/// interleave the way real ones do.
+#[derive(Debug)]
+struct Slow;
+
+impl crate::engine::Engine for Slow {
+    fn execute(&mut self, command: serde_json::Value) -> crate::engine::Reply<'_> {
+        Box::pin(async move {
+            tokio::task::yield_now().await;
+            crate::fake::default_reply(&command)
+        })
+    }
+}
+
+impl crate::engine::Launcher for Slow {
+    fn open(&self, _session: &str) -> Box<dyn crate::engine::Engine> {
+        Box::new(Slow)
+    }
+}
+
+#[tokio::test]
+async fn concurrent_opens_never_exceed_the_cap() {
+    let browser = Arc::new(Browser::with_scratch(Arc::new(Slow), scratch("race")));
+    let mut opens = tokio::task::JoinSet::new();
+    for _ in 0..MAX_SESSIONS + 4 {
+        let browser = browser.clone();
+        opens.spawn(async move {
+            browser
+                .open_session(SessionOptions {
+                    endpoint: Some("ws://127.0.0.1:9222".to_owned()),
+                    ..SessionOptions::default()
+                })
+                .await
+        });
+    }
+    let mut refused = 0;
+    while let Some(opened) = opens.join_next().await {
+        if matches!(opened.unwrap(), Err(Error::LimitExceeded { .. })) {
+            refused += 1;
+        }
+    }
+    assert_eq!(refused, 4);
+    assert_eq!(browser.list_sessions().await.unwrap().len(), MAX_SESSIONS);
+}
+
+#[tokio::test]
+async fn a_failed_launch_gives_its_slot_back() {
+    let fake =
+        Fake::scripted(|command| (command["action"] == "launch").then(|| failure("Chrome exited")));
+    let browser = Browser::with_scratch(Arc::new(fake), scratch("slot"));
+    // Every launch fails; none may be refused for want of a slot, which is
+    // what leaked reservations would cause after MAX_SESSIONS attempts.
+    for _ in 0..MAX_SESSIONS + 2 {
+        let error = browser
+            .open_session(SessionOptions::default())
+            .await
+            .unwrap_err();
+        assert!(!matches!(error, Error::LimitExceeded { .. }), "{error:?}");
+    }
+}
diff --git a/crates/tinycomputer-bus/src/browser/errors/errors_tests.rs b/crates/tinycomputer-bus/src/browser/errors/errors_tests.rs
index 8c268a6d..894eb8cd 100644
--- a/crates/tinycomputer-bus/src/browser/errors/errors_tests.rs
+++ b/crates/tinycomputer-bus/src/browser/errors/errors_tests.rs
@@ -129,3 +129,29 @@ fn a_refused_navigation_offers_no_way_out() {
     }
     assert!(recovery(NO_SUCH_SESSION).is_some_and(|hint| !hint.retryable));
 }
+
+#[test]
+fn a_timeout_says_inspect_before_retrying() {
+    let hint = recovery(TIMEOUT).expect("a timeout has a way out");
+    assert_eq!(hint.strategy, "inspect_state_then_retry_original");
+    assert!(hint.retryable && hint.requires_fresh_snapshot);
+}
+
+#[test]
+fn a_page_error_says_change_the_request_not_repeat_it() {
+    let hint = recovery(PAGE_ERROR).expect("a page error has a way out");
+    assert_eq!(hint.strategy, "inspect_state_then_revise_request");
+    assert!(!hint.retryable && hint.requires_fresh_snapshot);
+}
+
+#[test]
+fn every_recoverable_name_has_a_recovery_hint() {
+    for name in NAMES {
+        if is_agent_recoverable(name) {
+            assert!(
+                recovery(name).is_some(),
+                "{name} is recoverable without a hint"
+            );
+        }
+    }
+}
diff --git a/crates/tinycomputer-bus/src/browser/errors/mod.rs b/crates/tinycomputer-bus/src/browser/errors/mod.rs
index ba840236..2787cb14 100644
--- a/crates/tinycomputer-bus/src/browser/errors/mod.rs
+++ b/crates/tinycomputer-bus/src/browser/errors/mod.rs
@@ -157,6 +157,13 @@ pub fn code(name: &str) -> &'static str {
 /// (`refresh_snapshot_then_retry_original`), so an agent recovering from a
 /// stale ref does not care which surface it was on.
 ///
+/// A timeout, which may have come after the action reached the page, is
+/// `inspect_state_then_retry_original`, never a blind retry: a click or a
+/// form submission may already have happened, and repeating it could
+/// duplicate the effect. A page error — a thrown script, a rejected command —
+/// is `inspect_state_then_revise_request` and not retryable: the same request
+/// fails the same way again.
+///
 /// # Examples
 ///
 /// ```
@@ -176,8 +183,10 @@ pub fn recovery(name: &str) -> Option<crate::RecoveryHint> {
     match name {
         STALE_REF => Some(hint("refresh_snapshot_then_retry_original", true, true)),
         NO_SUCH_ELEMENT => Some(hint("refresh_snapshot_then_choose_again", true, true)),
-        NOT_ACTIONABLE => Some(hint("inspect_state_then_retry_original", true, true)),
-        TIMEOUT => Some(hint("retry_original", true, false)),
+        NOT_ACTIONABLE | TIMEOUT => Some(hint("inspect_state_then_retry_original", true, true)),
+        // A thrown script or a rejected command fails the same way again:
+        // look at the page and change the request rather than repeat it.
+        PAGE_ERROR => Some(hint("inspect_state_then_revise_request", false, true)),
         INVALID_INPUT => Some(hint("fix_request_then_retry", false, false)),
         NO_SUCH_SESSION => Some(hint("open_session_then_retry_original", false, false)),
         NO_SUCH_OUTPUT => Some(hint("capture_again_then_read", false, false)),
diff --git a/crates/tinycomputer-bus/src/browser/names/mod.rs b/crates/tinycomputer-bus/src/browser/names/mod.rs
index e60c47e6..b24a4658 100644
--- a/crates/tinycomputer-bus/src/browser/names/mod.rs
+++ b/crates/tinycomputer-bus/src/browser/names/mod.rs
@@ -92,7 +92,8 @@ pub mod methods {
     pub const SCREENSHOT: &str = "BrowserScreenshot";
 
     /// Reads one chunk of a held output: a screenshot this interface took,
-    /// or one a task view or report names.
+    /// or one a task's `TaskReport.artifacts` names (task views never carry
+    /// one).
     ///
     /// Takes a [`crate::browser::ReadOutputRequest`]; its `data` is an
     /// [`crate::browser::OutputChunk`].
diff --git a/crates/tinycomputer-bus/src/browser/names/names_tests.rs b/crates/tinycomputer-bus/src/browser/names/names_tests.rs
index 6706b190..bd372c3e 100644
--- a/crates/tinycomputer-bus/src/browser/names/names_tests.rs
+++ b/crates/tinycomputer-bus/src/browser/names/names_tests.rs
@@ -10,8 +10,10 @@ use super::{INTERFACE, METHODS, OBJECT_PATH, methods};
 
 #[test]
 fn browser_members_share_the_module_interface() {
-    assert_eq!(INTERFACE, crate::names::INTERFACE);
-    assert_eq!(OBJECT_PATH, crate::names::OBJECT_PATH);
+    // Literals, not the aliases they are defined from: a change to the
+    // published identity must be made here on purpose.
+    assert_eq!(INTERFACE, "ai.tinyhumans.tinycomputer.Desktop");
+    assert_eq!(OBJECT_PATH, "/ai/tinyhumans/tinycomputer/Desktop");
 }
 
 #[test]
diff --git a/crates/tinycomputer-bus/src/catalogue/catalogue_tests.rs b/crates/tinycomputer-bus/src/catalogue/catalogue_tests.rs
index b0e0dcbb..253ced91 100644
--- a/crates/tinycomputer-bus/src/catalogue/catalogue_tests.rs
+++ b/crates/tinycomputer-bus/src/catalogue/catalogue_tests.rs
@@ -36,6 +36,49 @@ fn every_browser_member_is_in_the_browser_family_and_nothing_else_is() {
     }
 }
 
+#[test]
+fn every_task_and_browser_name_has_a_catalogue_entry() {
+    for name in crate::agent::names::METHODS {
+        assert_eq!(
+            member(name).map(|entry| entry.family),
+            Some(Family::Task),
+            "{name}"
+        );
+    }
+    for name in crate::browser::names::METHODS {
+        assert_eq!(
+            member(name).map(|entry| entry.family),
+            Some(Family::Browser),
+            "{name}"
+        );
+    }
+}
+
+#[test]
+fn the_flow_family_is_exactly_the_flow_members() {
+    use crate::names::methods;
+    let flow = [
+        methods::RESOLVE_INTENT,
+        methods::RUN_GOAL,
+        methods::RUN_FLOW,
+        methods::VALIDATE_FLOW,
+        methods::FLOW_GUIDE,
+    ];
+    for name in flow {
+        assert_eq!(
+            member(name).map(|entry| entry.family),
+            Some(Family::Flow),
+            "{name}"
+        );
+    }
+    let catalogued = MEMBERS
+        .iter()
+        .filter(|entry| entry.family == Family::Flow)
+        .map(|entry| entry.name)
+        .collect::<Vec<_>>();
+    assert_eq!(catalogued, flow);
+}
+
 #[test]
 fn task_confidentiality_agrees_with_the_task_names() {
     for entry in MEMBERS.iter().filter(|entry| entry.family == Family::Task) {
@@ -53,6 +96,12 @@ fn every_summary_is_one_sentence() {
     for entry in MEMBERS {
         assert!(entry.summary.ends_with('.'), "{} summary", entry.name);
         assert!(entry.summary.len() < 120, "{} summary is long", entry.name);
+        let body = &entry.summary[..entry.summary.len() - 1];
+        assert!(
+            !body.contains(". ") && !body.contains("? ") && !body.contains("! "),
+            "{} summary is more than one sentence",
+            entry.name
+        );
     }
 }
 
diff --git a/crates/tinycomputer-engine/Cargo.toml b/crates/tinycomputer-engine/Cargo.toml
index bb062b84..d6863d0e 100644
--- a/crates/tinycomputer-engine/Cargo.toml
+++ b/crates/tinycomputer-engine/Cargo.toml
@@ -40,7 +40,9 @@ default = []
 planner = ["dep:tinyinference-llm"]
 
 [dev-dependencies]
-tokio = { workspace = true }
+# `test-util` for paused time: task tests step past the controller's
+# capture and await timeouts without waiting for them in real time.
+tokio = { workspace = true, features = ["test-util"] }
 
 [lints]
 workspace = true
diff --git a/crates/tinycomputer-engine/src/lib.rs b/crates/tinycomputer-engine/src/lib.rs
index 4ab4c30d..48b57f79 100644
--- a/crates/tinycomputer-engine/src/lib.rs
+++ b/crates/tinycomputer-engine/src/lib.rs
@@ -49,7 +49,9 @@ pub use planner::{
 };
 pub use rescue::{Briefing, Guidance, MAX_RESCUE_STEPS, MAX_RESCUES, Rescuer, SCREEN_CHARS};
 pub use shape::{Harvest, RECORDS_CHARS, Shaper};
-pub use task::{FlowFuture, FlowRunner, MAX_AWAIT_MS, MAX_TASKS, Tasks, TextFuture, capabilities};
+pub use task::{
+    CaptureFuture, FlowFuture, FlowRunner, MAX_AWAIT_MS, MAX_TASKS, Tasks, TextFuture, capabilities,
+};
 pub use tinycomputer_bus::DesktopResponse;
 use tinycomputer_desktop::Desktop;
 pub use workspace::{BROWSER, Workspace};
diff --git a/crates/tinycomputer-engine/src/task/artifact.rs b/crates/tinycomputer-engine/src/task/artifact.rs
new file mode 100644
index 00000000..d7808467
--- /dev/null
+++ b/crates/tinycomputer-engine/src/task/artifact.rs
@@ -0,0 +1,54 @@
+//! The screenshot a stopped run leaves: taken before the task's surfaces are
+//! released, and kept in `TaskReport.artifacts` only.
+//!
+//! It never goes on a status. A `TaskView` also travels through `AwaitTask`
+//! and `ListTasks`, which are not confidential, and an output handle is a
+//! bearer token for `BrowserReadOutput`: a screenshot of a filled traveller
+//! or payment form must only be reachable through the confidential report.
+
+use std::time::Duration;
+
+use tinycomputer_bus::agent::TaskStatus;
+
+use super::FlowRunner;
+use super::store::Cell;
+
+/// How long a capture may take before the task goes on without it: a
+/// screenshot is evidence, never a reason to hold a task's final state back.
+pub(super) const CAPTURE_TIMEOUT: Duration = Duration::from_secs(10);
+
+/// `status`, unchanged, after keeping a screenshot of the task's surface for
+/// `TaskReport.artifacts` — when the status is one a caller acts on (a
+/// checkpoint, an approval, a person's turn, or the end) and the runner can
+/// take one. `needs_input` and `needs_plan` take none: both are decided
+/// before a run starts, so nothing on screen is the task's doing yet.
+pub(super) async fn captured(
+    cell: &Cell,
+    runner: &dyn FlowRunner,
+    status: TaskStatus,
+) -> TaskStatus {
+    if !matches!(
+        status,
+        TaskStatus::Running | TaskStatus::NeedsInput { .. } | TaskStatus::NeedsPlan { .. }
+    ) {
+        let _kept = capture(cell, runner).await;
+    }
+    status
+}
+
+/// Takes a screenshot of the task's surface, keeps it for the report, and
+/// returns it; `None` when the runner has none to give in time.
+pub(super) async fn capture(
+    cell: &Cell,
+    runner: &dyn FlowRunner,
+) -> Option<tinycomputer_bus::browser::OutputRef> {
+    let id = cell.view.borrow().id.clone();
+    let shot = tokio::time::timeout(CAPTURE_TIMEOUT, runner.capture(&id))
+        .await
+        .ok()
+        .flatten()?;
+    if let Ok(mut state) = cell.state.lock() {
+        state.artifacts.push(shot.clone());
+    }
+    Some(shot)
+}
diff --git a/crates/tinycomputer-engine/src/task/budget.rs b/crates/tinycomputer-engine/src/task/budget.rs
index 38e302df..cdb6039c 100644
--- a/crates/tinycomputer-engine/src/task/budget.rs
+++ b/crates/tinycomputer-engine/src/task/budget.rs
@@ -6,6 +6,7 @@ use std::collections::BTreeMap;
 use tinycomputer_bus::RunFlowRequest;
 use tinycomputer_bus::agent::{TaskConstraints, TaskStatus};
 
+use super::artifact::captured;
 use super::brief::brief;
 use super::names::fact_names;
 use super::publish::{publish, stopped_summary};
@@ -74,7 +75,9 @@ pub(super) fn run_request(
 /// Ends a task outright with `status`, without a flow run to interpret: its
 /// time budget ran out before a run of it could even start, or a run of it
 /// had to be cut off mid-flight to keep from spending past what remains.
-pub(super) fn stop_task(cell: &Cell, runner: &dyn FlowRunner, status: TaskStatus) {
+pub(super) async fn stop_task(cell: &Cell, runner: &dyn FlowRunner, status: TaskStatus) {
+    // A task cut off by its time budget still leaves its last screen.
+    let status = captured(cell, runner, status).await;
     let summary = stopped_summary(&status);
     publish(cell, status, &summary);
     runner.release(&cell.view.borrow().id);
diff --git a/crates/tinycomputer-engine/src/task/controller.rs b/crates/tinycomputer-engine/src/task/controller.rs
index 7c54a9de..f9ed1381 100644
--- a/crates/tinycomputer-engine/src/task/controller.rs
+++ b/crates/tinycomputer-engine/src/task/controller.rs
@@ -315,7 +315,7 @@ impl Tasks {
             flow: Some(state.flow.clone()),
             steps: state.steps.clone(),
             records: records(&state.reads),
-            artifacts: Vec::new(),
+            artifacts: state.artifacts.clone(),
             learned: state.learned.clone(),
             trace: state.exchanges.clone(),
             rescues: state.rescues.clone(),
diff --git a/crates/tinycomputer-engine/src/task/describe.rs b/crates/tinycomputer-engine/src/task/describe.rs
index 0936e55c..31673942 100644
--- a/crates/tinycomputer-engine/src/task/describe.rs
+++ b/crates/tinycomputer-engine/src/task/describe.rs
@@ -193,11 +193,10 @@ fn members() -> Vec<MemberDoc> {
                     "id": {"type": "string"},
                     "trace": {
                         "type": "boolean",
-                        "default": true,
-                        "description": "include every Jev exchange StartTask.trace recorded; false keeps the report small"
+                        "description": "include every Jev exchange StartTask.trace recorded; false keeps the report small. Required: a confidential body of only {\"id\"} is refused by the TinyBus client as a stream handle"
                     }
                 }),
-                &["id"],
+                &["id", "trace"],
             ),
             "TaskReport",
         ),
diff --git a/crates/tinycomputer-engine/src/task/drive.rs b/crates/tinycomputer-engine/src/task/drive.rs
index cbbb8d2c..e2220654 100644
--- a/crates/tinycomputer-engine/src/task/drive.rs
+++ b/crates/tinycomputer-engine/src/task/drive.rs
@@ -7,6 +7,7 @@ use std::time::{Duration, Instant};
 
 use tinycomputer_bus::agent::TaskStatus;
 
+use super::artifact::{capture, captured};
 use super::budget::{elapsed_budget_failed, run_request, stop_task};
 use super::human::human_wall;
 use super::interpret::{Next, finished, run_outcome};
@@ -96,7 +97,7 @@ pub(super) async fn drive(cell: Arc<Cell>, runner: Arc<dyn FlowRunner>, runs: Ve
             return;
         };
         if time_left == Some(0) {
-            stop_task(&cell, runner.as_ref(), elapsed_budget_failed());
+            stop_task(&cell, runner.as_ref(), elapsed_budget_failed()).await;
             return;
         }
         let id = cell.view.borrow().id.clone();
@@ -104,7 +105,7 @@ pub(super) async fn drive(cell: Arc<Cell>, runner: Arc<dyn FlowRunner>, runs: Ve
         let run_call = runner.run(&id, &constraints, request);
         let reply = if let Some(ms) = time_left {
             let Ok(reply) = tokio::time::timeout(Duration::from_millis(ms), run_call).await else {
-                stop_task(&cell, runner.as_ref(), elapsed_budget_failed());
+                stop_task(&cell, runner.as_ref(), elapsed_budget_failed()).await;
                 return;
             };
             reply
@@ -152,6 +153,7 @@ pub(super) async fn drive(cell: Arc<Cell>, runner: Arc<dyn FlowRunner>, runs: Ve
                     continue;
                 }
             };
+            let status = captured(&cell, runner.as_ref(), status).await;
             let summary = redacted.redact(&stopped_summary(&status));
             let ended = matches!(
                 status,
@@ -170,6 +172,8 @@ pub(super) async fn drive(cell: Arc<Cell>, runner: Arc<dyn FlowRunner>, runs: Ve
 /// Every run finished: the task is done, with what it read, shaped as its
 /// `output` asks when it asks.
 pub(super) async fn finish(cell: &Cell, runner: &dyn FlowRunner) {
+    // The last look at the surface, before shaping and before release.
+    let _ = capture(cell, runner).await;
     let (answer, records, harvest) = {
         let Ok(state) = cell.state.lock() else {
             return;
diff --git a/crates/tinycomputer-engine/src/task/mod.rs b/crates/tinycomputer-engine/src/task/mod.rs
index 0b257f00..fe15bdae 100644
--- a/crates/tinycomputer-engine/src/task/mod.rs
+++ b/crates/tinycomputer-engine/src/task/mod.rs
@@ -33,8 +33,10 @@
 //! `store`; the background run in `drive`, capped by `budget` and briefed by
 //! `brief`; answering a paused task in `resume`; rescuing a failed step in
 //! `recovery`; spotting a wall only a person can pass in `human`; and what
-//! the caller sees in `publish`.
+//! the caller sees in `publish`; the screenshots a stopped run leaves in
+//! `artifact`.
 
+mod artifact;
 mod brief;
 mod budget;
 mod controller;
@@ -53,6 +55,7 @@ use std::future::Future;
 use std::pin::Pin;
 
 use tinycomputer_bus::agent::{TaskConstraints, TaskId};
+use tinycomputer_bus::browser::OutputRef;
 use tinycomputer_bus::{DesktopResponse, RunFlowRequest};
 
 pub use controller::Tasks;
@@ -65,6 +68,10 @@ pub type FlowFuture = Pin<Box<dyn Future<Output = DesktopResponse> + Send>>;
 /// The future [`FlowRunner::visible_text`] returns.
 pub type TextFuture = Pin<Box<dyn Future<Output = Vec<String>> + Send>>;
 
+/// The future [`FlowRunner::capture`] returns: a held screenshot, if the
+/// task's surface could take one.
+pub type CaptureFuture = Pin<Box<dyn Future<Output = Option<OutputRef>> + Send>>;
+
 /// Runs a task's flows, on surfaces that live as long as the task.
 pub trait FlowRunner: Send + Sync + 'static {
     /// Runs `request` for `task` within `constraints`, returning `RunFlow`'s
@@ -83,6 +90,20 @@ pub trait FlowRunner: Send + Sync + 'static {
         Box::pin(async { Vec::new() })
     }
 
+    /// A screenshot of the task's surface as it stands, held for the caller
+    /// to read. Taken whenever a run stops on its own — at a checkpoint,
+    /// before an approval, at a person's turn, finished, failed, or cut off
+    /// by its time budget — before the task's surfaces are released, so a
+    /// finished or failed task still leaves one. Not for `needs_input` or
+    /// `needs_plan`: those are decided before a run starts, with nothing on
+    /// screen yet that the task did.
+    /// `CancelTask` releases at once without one: the caller chose to stop,
+    /// and can take its own with `BrowserScreenshot` first. `None` by
+    /// default, and whenever the surface cannot take one.
+    fn capture(&self, _task: &TaskId) -> CaptureFuture {
+        Box::pin(async { None })
+    }
+
     /// Lets go of whatever the task held, once it has ended.
     fn release(&self, _task: &TaskId) {}
 }
diff --git a/crates/tinycomputer-engine/src/task/store.rs b/crates/tinycomputer-engine/src/task/store.rs
index db082f36..458cadfa 100644
--- a/crates/tinycomputer-engine/src/task/store.rs
+++ b/crates/tinycomputer-engine/src/task/store.rs
@@ -9,6 +9,7 @@ use tinycomputer_bus::agent::{
     AgentResponse, Rescue, StartTaskRequest, TaskBudget, TaskConstraints, TaskId, TaskOutput,
     TaskStatus, TaskView,
 };
+use tinycomputer_bus::browser::OutputRef;
 use tinycomputer_bus::{FLOW_GUIDE, Flow, GroundingHint, JevExchange, StepReport};
 use tinycomputer_core::Facts;
 use tokio::sync::watch;
@@ -56,6 +57,8 @@ pub(super) struct State {
     pub(super) rescues: Vec<Rescue>,
     /// The shape the caller wants the answer in, if any.
     pub(super) output: Option<TaskOutput>,
+    /// Screenshots taken each time a run stopped, oldest first.
+    pub(super) artifacts: Vec<OutputRef>,
 }
 
 /// A task's cumulative spend against its [`TaskBudget`], across every run.
@@ -111,6 +114,7 @@ impl Tasks {
                 spent: Spent::default(),
                 rescues: Vec::new(),
                 output: request.output.clone(),
+                artifacts: Vec::new(),
             }),
             worker: Mutex::new(None),
             rescuer: self.rescuer.clone(),
diff --git a/crates/tinycomputer-engine/src/task/task_tests.rs b/crates/tinycomputer-engine/src/task/task_tests.rs
index b3024d30..6800b48d 100644
--- a/crates/tinycomputer-engine/src/task/task_tests.rs
+++ b/crates/tinycomputer-engine/src/task/task_tests.rs
@@ -8,6 +8,7 @@
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
 mod approval_tests;
+mod artifact_tests;
 mod describe_tests;
 mod errors_tests;
 mod human_tests;
@@ -45,6 +46,12 @@ struct Script {
     screen: Mutex<Vec<String>>,
     /// Tasks let go of, in order.
     released: Mutex<Vec<TaskId>>,
+    /// The screenshot `capture` hands back, if any.
+    shot: Mutex<Option<tinycomputer_bus::browser::OutputRef>>,
+    /// A capture that never answers, like a hung surface.
+    stuck: std::sync::atomic::AtomicBool,
+    /// `capture` and `release` calls, in the order they arrived.
+    events: Mutex<Vec<&'static str>>,
 }
 
 impl FlowRunner for Script {
@@ -69,7 +76,17 @@ impl FlowRunner for Script {
         Box::pin(async move { texts })
     }
 
+    fn capture(&self, _task: &TaskId) -> super::CaptureFuture {
+        self.events.lock().unwrap().push("capture");
+        let shot = self.shot.lock().unwrap().clone();
+        if self.stuck.load(std::sync::atomic::Ordering::SeqCst) {
+            return Box::pin(std::future::pending());
+        }
+        Box::pin(async move { shot })
+    }
+
     fn release(&self, task: &TaskId) {
+        self.events.lock().unwrap().push("release");
         self.released.lock().unwrap().push(task.clone());
     }
 }
diff --git a/crates/tinycomputer-engine/src/task/task_tests/artifact_tests.rs b/crates/tinycomputer-engine/src/task/task_tests/artifact_tests.rs
new file mode 100644
index 00000000..63d688f5
--- /dev/null
+++ b/crates/tinycomputer-engine/src/task/task_tests/artifact_tests.rs
@@ -0,0 +1,202 @@
+//! Tests for the screenshot a stopped run leaves: on the status that has room
+//! for one, and in the report, taken before the task's surfaces are released.
+
+use super::*;
+
+use tinycomputer_bus::browser::{OutputId, OutputRef};
+
+fn shot() -> OutputRef {
+    OutputRef {
+        id: OutputId::new("o-1"),
+        total_bytes: 3,
+        sha256: "abc".to_owned(),
+        media_type: "image/png".to_owned(),
+        width: 1,
+        height: 1,
+    }
+}
+
+fn with_shot(replies: Vec<DesktopResponse>) -> (Tasks, Arc<Script>) {
+    let (tasks, script) = controller(replies);
+    *script.shot.lock().unwrap() = Some(shot());
+    (tasks, script)
+}
+
+fn paying() -> DesktopResponse {
+    finished_run(
+        FlowStopReason::StoppedBeforeDestructive,
+        vec![step(
+            "1",
+            "stop_before",
+            "paying for the booking",
+            StepOutcome::Gated,
+            "found it",
+        )],
+        &[],
+        Some("Pay ₹6,840"),
+    )
+}
+
+fn one_step() -> serde_json::Value {
+    json!({"app": "browser", "steps": [{"stop_before": "paying for the booking"}]})
+}
+
+#[tokio::test]
+async fn a_payment_checkpoint_keeps_its_screen_in_the_report_only() {
+    let (tasks, _) = with_shot(vec![paying()]);
+    let view = start(&tasks, one_step(), &[]);
+    let stopped = settle(&tasks, &view.id).await;
+    let TaskStatus::Checkpoint { screenshot, .. } = &stopped.status else {
+        panic!("{:?}", stopped.status);
+    };
+    // A view also travels through the non-confidential AwaitTask and
+    // ListTasks, so the handle stays out of it.
+    assert!(screenshot.is_none());
+    let listed = tasks.list().data.unwrap();
+    assert!(
+        serde_json::to_string(&listed)
+            .unwrap()
+            .find("o-1")
+            .is_none()
+    );
+    assert_eq!(tasks.report(&view.id).data.unwrap().artifacts, [shot()]);
+}
+
+#[tokio::test]
+async fn a_finished_task_keeps_its_last_screen_after_release() {
+    let (tasks, script) = with_shot(vec![finished_run(
+        FlowStopReason::Completed,
+        vec![step("1", "do", "search for flights", StepOutcome::Done, "")],
+        &[],
+        None,
+    )]);
+    let view = start(
+        &tasks,
+        json!({"app": "browser", "steps": ["search for flights"]}),
+        &[],
+    );
+    let done = settle(&tasks, &view.id).await;
+    assert!(
+        matches!(done.status, TaskStatus::Done { .. }),
+        "{:?}",
+        done.status
+    );
+    assert_eq!(
+        *script.released.lock().unwrap(),
+        std::slice::from_ref(&view.id)
+    );
+    assert_eq!(tasks.report(&view.id).data.unwrap().artifacts, [shot()]);
+    // The screenshot is taken while the surface is still held.
+    assert_eq!(*script.events.lock().unwrap(), ["capture", "release"]);
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_capture_that_never_answers_does_not_hold_the_task_back() {
+    let (tasks, script) = with_shot(vec![finished_run(
+        FlowStopReason::Completed,
+        vec![step("1", "do", "search for flights", StepOutcome::Done, "")],
+        &[],
+        None,
+    )]);
+    script
+        .stuck
+        .store(true, std::sync::atomic::Ordering::SeqCst);
+    let view = start(
+        &tasks,
+        json!({"app": "browser", "steps": ["search for flights"]}),
+        &[],
+    );
+    // Paused time jumps each wait, so the capture's timeout passes at once.
+    let mut current = view.clone();
+    for _ in 0..10 {
+        if current.status.is_final() {
+            break;
+        }
+        current = settle(&tasks, &view.id).await;
+    }
+    assert!(
+        matches!(current.status, TaskStatus::Done { .. }),
+        "{:?}",
+        current.status
+    );
+    assert_eq!(
+        *script.released.lock().unwrap(),
+        std::slice::from_ref(&view.id)
+    );
+    assert!(tasks.report(&view.id).data.unwrap().artifacts.is_empty());
+}
+
+#[tokio::test(start_paused = true)]
+async fn a_task_cut_off_by_its_time_budget_keeps_its_last_screen() {
+    let (tasks, script) = with_shot(Vec::new());
+    let reply = tasks.start(&StartTaskRequest {
+        flow: Some(flow(
+            json!({"app": "browser", "steps": ["search for flights"]}),
+        )),
+        budget: tinycomputer_bus::agent::TaskBudget {
+            max_elapsed_ms: Some(1),
+            ..tinycomputer_bus::agent::TaskBudget::default()
+        },
+        ..StartTaskRequest::default()
+    });
+    let view = reply.data.unwrap();
+    let mut current = view.clone();
+    for _ in 0..10 {
+        if current.status.is_final() {
+            break;
+        }
+        current = settle(&tasks, &view.id).await;
+    }
+    assert!(
+        matches!(current.status, TaskStatus::Failed { .. }),
+        "{:?}",
+        current.status
+    );
+    assert_eq!(tasks.report(&view.id).data.unwrap().artifacts, [shot()]);
+    assert_eq!(*script.events.lock().unwrap(), ["capture", "release"]);
+}
+
+#[tokio::test]
+async fn a_failed_task_keeps_its_last_screen() {
+    let (tasks, _) = with_shot(vec![failed_at_step_two()]);
+    let view = start(
+        &tasks,
+        json!({"app": "browser", "steps": [{"browse": "https://flights.test"}, "search for flights"]}),
+        &[],
+    );
+    let failed = settle(&tasks, &view.id).await;
+    assert!(
+        matches!(failed.status, TaskStatus::Failed { .. }),
+        "{:?}",
+        failed.status
+    );
+    assert_eq!(tasks.report(&view.id).data.unwrap().artifacts, [shot()]);
+}
+
+#[tokio::test]
+async fn a_surface_that_cannot_capture_leaves_no_screenshot() {
+    let (tasks, _) = controller(vec![paying()]);
+    let view = start(&tasks, one_step(), &[]);
+    let stopped = settle(&tasks, &view.id).await;
+    let TaskStatus::Checkpoint { screenshot, .. } = &stopped.status else {
+        panic!("{:?}", stopped.status);
+    };
+    assert!(screenshot.is_none());
+    assert!(tasks.report(&view.id).data.unwrap().artifacts.is_empty());
+}
+
+#[tokio::test]
+async fn a_task_waiting_for_input_takes_no_screenshot() {
+    let (tasks, _) = with_shot(Vec::new());
+    let view = start(
+        &tasks,
+        json!({"app": "browser", "steps": [{"enter": {"phone": "${phone}"}}]}),
+        &[],
+    );
+    assert!(
+        matches!(view.status, TaskStatus::NeedsInput { .. }),
+        "{:?}",
+        view.status
+    );
+    assert!(tasks.report(&view.id).data.unwrap().artifacts.is_empty());
+}
diff --git a/crates/tinycomputer-engine/src/task/task_tests/describe_tests.rs b/crates/tinycomputer-engine/src/task/task_tests/describe_tests.rs
index 972fb9da..a153d14c 100644
--- a/crates/tinycomputer-engine/src/task/task_tests/describe_tests.rs
+++ b/crates/tinycomputer-engine/src/task/task_tests/describe_tests.rs
@@ -213,10 +213,66 @@ async fn describe_schemas_name_every_request_field() {
 
     let plan = serde_json::to_value(tinycomputer_bus::agent::PlanTaskRequest::default()).unwrap();
     assert_eq!(documented(&schema("PlanTask")), fields(&plan));
+
+    let id = tinycomputer_bus::agent::TaskId::new("t-1");
+    let others = [
+        (
+            "AwaitTask",
+            serde_json::to_value(tinycomputer_bus::agent::AwaitTaskRequest {
+                id: id.clone(),
+                timeout_ms: 1,
+            }),
+        ),
+        (
+            "ContinueTask",
+            serde_json::to_value(tinycomputer_bus::agent::ContinueTaskRequest {
+                id: id.clone(),
+                approve: Some(true),
+                answer: Some(String::new()),
+                ..tinycomputer_bus::agent::ContinueTaskRequest::default()
+            }),
+        ),
+        (
+            "CancelTask",
+            serde_json::to_value(tinycomputer_bus::agent::TaskRef { id: id.clone() }),
+        ),
+        (
+            "TaskReport",
+            serde_json::to_value(tinycomputer_bus::agent::TaskReportRequest::new(id)),
+        ),
+    ];
+    for (member, request) in others {
+        assert_eq!(
+            documented(&schema(member)),
+            fields(&request.unwrap()),
+            "{member}"
+        );
+    }
+    // Every member with a request object is compared above; the rest take
+    // no argument.
+    for member in &described.members {
+        if member.input["type"] != "object" {
+            assert_eq!(member.input["type"], "null", "{}", member.name);
+        }
+    }
+}
+
+#[tokio::test]
+async fn the_task_report_schema_requires_the_trace_flag() {
+    // A schema-driven caller sends only what is required; a body of only
+    // `{"id"}` would be refused client-side as a stream handle.
+    let (tasks, _) = controller(Vec::new());
+    let described = capabilities(Vec::new(), Some(&jev()), &tasks);
+    let report = described
+        .members
+        .iter()
+        .find(|member| member.name == "TaskReport")
+        .unwrap();
+    assert_eq!(report.input["required"], json!(["id", "trace"]));
 }
 
 #[tokio::test]
-async fn describe_browser_examples_decode_as_their_members_requests() {
+async fn every_describe_example_decodes_as_its_members_request() {
     use tinycomputer_bus::browser::{
         Action, NavigateRequest, ReadOutputRequest, SessionOptions, SessionRequest, names,
     };
@@ -239,10 +295,15 @@ async fn describe_browser_examples_decode_as_their_members_requests() {
                 serde_json::from_value::<ReadOutputRequest>(request).is_ok()
             }
             "StartTask" => serde_json::from_value::<StartTaskRequest>(request).is_ok(),
-            _ => continue,
+            "AwaitTask" => serde_json::from_value::<AwaitTaskRequest>(request).is_ok(),
+            "ContinueTask" => {
+                serde_json::from_value::<tinycomputer_bus::agent::ContinueTaskRequest>(request)
+                    .is_ok()
+            }
+            other => panic!("the {other} example has no decoder here; add one"),
         };
         assert!(decoded, "the {} example does not decode", example.title);
         seen += 1;
     }
-    assert!(seen >= 6, "the browser and output examples are checked");
+    assert_eq!(seen, described.examples.len());
 }
diff --git a/crates/tinycomputer-engine/src/task/task_tests/runner_tests.rs b/crates/tinycomputer-engine/src/task/task_tests/runner_tests.rs
index 3fe992b2..a50511b1 100644
--- a/crates/tinycomputer-engine/src/task/task_tests/runner_tests.rs
+++ b/crates/tinycomputer-engine/src/task/task_tests/runner_tests.rs
@@ -20,6 +20,7 @@ impl FlowRunner for RunsOnly {
 async fn a_runner_that_only_runs_flows_reads_nothing_and_holds_nothing() {
     let task = TaskId::new("t-1");
     assert!(RunsOnly.visible_text(&task).await.is_empty());
+    assert!(RunsOnly.capture(&task).await.is_none());
     // Releasing a task the runner never held is a no-op, not a failure.
     RunsOnly.release(&task);
     assert!(RunsOnly.visible_text(&task).await.is_empty());
diff --git a/crates/tinycomputer-engine/src/workspace/mod.rs b/crates/tinycomputer-engine/src/workspace/mod.rs
index 6ad9822f..f2ca9bbc 100644
--- a/crates/tinycomputer-engine/src/workspace/mod.rs
+++ b/crates/tinycomputer-engine/src/workspace/mod.rs
@@ -141,6 +141,13 @@ impl<D: Surface, W: Surface> Workspace<D, W> {
         self.active.lock().map_or(Side::Desktop, |active| *active)
     }
 
+    /// Whether the browser is the side in use now: the surface a screenshot
+    /// of the task's current screen should come from.
+    #[must_use]
+    pub fn browser_active(&self) -> bool {
+        self.active_browser().is_some()
+    }
+
     /// The browser, when it is the side in use. The browser only becomes
     /// active after a call on it succeeds, so it is never active when absent.
     fn active_browser(&self) -> Option<&W> {
diff --git a/crates/tinycomputer-engine/src/workspace/workspace_tests.rs b/crates/tinycomputer-engine/src/workspace/workspace_tests.rs
index 382e0370..345c1601 100644
--- a/crates/tinycomputer-engine/src/workspace/workspace_tests.rs
+++ b/crates/tinycomputer-engine/src/workspace/workspace_tests.rs
@@ -163,12 +163,15 @@ fn unnamed_calls_follow_the_side_last_observed_or_opened() {
     let node = Candidate::default();
     workspace.execute(JevOperation::Click, None, None);
     assert_eq!(workspace.read_value(&node).as_deref(), Some("desktop"));
+    assert!(!workspace.browser_active());
     workspace.settle();
     workspace.navigate("https://flights.test");
+    assert!(workspace.browser_active());
     workspace.execute(JevOperation::Click, Some(node.clone()), None);
     assert_eq!(workspace.read_value(&node).as_deref(), Some("browser"));
     workspace.settle();
     workspace.launch("Mail");
+    assert!(!workspace.browser_active(), "the task moved to the desktop");
     workspace.execute(JevOperation::Click, None, None);
     assert_eq!(
         drain(&calls),
diff --git a/crates/tinycomputer-examples/src/bin/task_fixture.rs b/crates/tinycomputer-examples/src/bin/task_fixture.rs
index a1b696eb..d16fc4ee 100644
--- a/crates/tinycomputer-examples/src/bin/task_fixture.rs
+++ b/crates/tinycomputer-examples/src/bin/task_fixture.rs
@@ -40,10 +40,11 @@ async fn main() -> Result<(), LabError> {
     });
     let host = Host::load(&module_path(), config).await?;
 
+    let before = host.browser_sessions().await?;
     let view = host.start_task(&request(&base)?).await?;
     let answers = BTreeMap::from([("phone".to_owned(), "+91 98765 43210".to_owned())]);
     let view = follow(&host, view, &answers, Duration::from_secs(20 * 60)).await?;
-    conclude(&host, &view, &PathBuf::from("target/task-fixture")).await?;
+    conclude(&host, &view, &before, &PathBuf::from("target/task-fixture")).await?;
     host.shutdown();
     if matches!(view.status, TaskStatus::Checkpoint { ref reason, .. } if reason.contains("payment"))
     {
diff --git a/crates/tinycomputer-examples/src/bin/task_live/main.rs b/crates/tinycomputer-examples/src/bin/task_live/main.rs
index 1800c0f1..a28f9967 100644
--- a/crates/tinycomputer-examples/src/bin/task_live/main.rs
+++ b/crates/tinycomputer-examples/src/bin/task_live/main.rs
@@ -87,6 +87,9 @@ async fn main() -> Result<(), LabError> {
         Err(_) => plan(&host, &task, &facts, &secret_facts, kind, &out).await?,
     };
     // The task travels with the flow, so every Jev question is briefed on it.
+    // Sessions open before the task are not its own, and `conclude` leaves
+    // them alone.
+    let before = host.browser_sessions().await?;
     let view = host
         .start_task(&StartTaskRequest {
             task: Some(task.clone()),
@@ -120,7 +123,7 @@ async fn main() -> Result<(), LabError> {
             .unwrap_or(20),
     );
     let view = follow(&host, view, &BTreeMap::new(), limit).await?;
-    conclude(&host, &view, &out).await?;
+    conclude(&host, &view, &before, &out).await?;
     host.shutdown();
     if passed(&view.status) {
         println!(
diff --git a/crates/tinycomputer-examples/src/host/mod.rs b/crates/tinycomputer-examples/src/host/mod.rs
index f3bf05e5..ec600fc4 100644
--- a/crates/tinycomputer-examples/src/host/mod.rs
+++ b/crates/tinycomputer-examples/src/host/mod.rs
@@ -48,6 +48,49 @@ impl std::fmt::Debug for Host {
     }
 }
 
+/// Why a held output could not be read.
+enum Unread {
+    /// The bus call itself failed; trying again may work.
+    Transport(LabError),
+    /// The module answered with an error or with bytes that do not add up;
+    /// trying again would get the same.
+    Invalid(LabError),
+}
+
+impl Unread {
+    fn into_error(self) -> LabError {
+        match self {
+            Self::Transport(error) | Self::Invalid(error) => error,
+        }
+    }
+}
+
+/// Aborts the broker's task if dropped while still armed: a load that fails
+/// part-way must not leave the broker, and the module it loaded, running.
+struct AbortOnDrop {
+    task: tokio::task::AbortHandle,
+    armed: bool,
+}
+
+impl AbortOnDrop {
+    fn new(task: tokio::task::AbortHandle) -> Self {
+        Self { task, armed: true }
+    }
+
+    /// Stops guarding, once the host has loaded and owns the task.
+    fn disarm(mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for AbortOnDrop {
+    fn drop(&mut self) {
+        if self.armed {
+            self.task.abort();
+        }
+    }
+}
+
 /// The private `jev` configuration for `key` on `OpenRouter`: the module's
 /// default endpoint and model unless `model` names one, in which case the
 /// decisions endpoint that serves the aliases is used too.
@@ -90,6 +133,7 @@ impl Host {
         let bus = MemoryBus::new();
         let broker = Broker::new();
         let broker_task = broker.spawn(bus.clone());
+        let guard = AbortOnDrop::new(broker_task.abort_handle());
         let module_host = ModuleHost::new(broker);
         let info = module_host.load_file(module)?;
         if info.name != "tinycomputer" {
@@ -111,6 +155,7 @@ impl Host {
             )
             .into());
         }
+        guard.disarm();
         Ok(Self {
             proxy,
             broker: broker_task,
@@ -317,36 +362,79 @@ impl Host {
     }
 
     /// A screenshot of `session`'s page as image bytes: `BrowserScreenshot`,
-    /// then `BrowserReadOutput` chunk by chunk until the end, then
-    /// `BrowserReleaseOutput` — the handle protocol a host follows.
+    /// then [`Host::read_output`].
     ///
     /// # Errors
     ///
-    /// Fails on a transport error, an error envelope, a chunk that is not
-    /// base64, or an image whose length disagrees with its handle.
+    /// Fails on a transport error, an error envelope, or a bad chunk.
     pub async fn browser_screenshot(&self, session: &SessionId) -> Result<Vec<u8>, LabError> {
         use tinycomputer_bus::browser::names::methods;
         let request = SessionRequest::new(session.clone(), ScreenshotRequest::default());
         let output: OutputRef = data(self.proxy.call(methods::SCREENSHOT, (request,)).await?)?;
+        self.read_output(&output).await
+    }
+
+    /// A held output's bytes — a screenshot this host took, or one a task
+    /// report names: `BrowserReadOutput` chunk by chunk until the end, then
+    /// `BrowserReleaseOutput`, the handle protocol a host follows. After a
+    /// transport failure the output is kept, so a retry can still read it
+    /// before it expires; after any other failure it is released.
+    ///
+    /// # Errors
+    ///
+    /// Fails on a transport error, an error envelope (an expired output is
+    /// `OUTPUT_NOT_FOUND`), a chunk that is not base64, or an image whose
+    /// length disagrees with its handle.
+    pub async fn read_output(&self, output: &OutputRef) -> Result<Vec<u8>, LabError> {
+        let read = self.read_chunks(output).await;
+        // A transport failure may pass, and a task's last screenshot cannot
+        // be taken again once its session is gone, so the output is kept for
+        // a retry until it expires. Anything else — read in full, or data
+        // that is wrong and will stay wrong — is released now.
+        if matches!(read, Err(Unread::Transport(_))) {
+            return read.map_err(Unread::into_error);
+        }
+        let request = OutputRequest {
+            output: output.id.clone(),
+        };
+        let released = self
+            .proxy
+            .call::<DesktopResponse>(
+                tinycomputer_bus::browser::names::methods::RELEASE_OUTPUT,
+                (request,),
+            )
+            .await;
+        let bytes = read.map_err(Unread::into_error)?;
+        let _released: Value = data(released?)?;
+        Ok(bytes)
+    }
+
+    async fn read_chunks(&self, output: &OutputRef) -> Result<Vec<u8>, Unread> {
+        use tinycomputer_bus::browser::names::methods;
         let mut bytes = Vec::new();
         loop {
             let request = ReadOutputRequest {
                 offset: bytes.len() as u64,
                 ..ReadOutputRequest::new(output.id.clone())
             };
-            let chunk: OutputChunk =
-                data(self.proxy.call(methods::READ_OUTPUT, (request,)).await?)?;
-            bytes.extend(base64::engine::general_purpose::STANDARD.decode(&chunk.data)?);
+            let reply = self
+                .proxy
+                .call(methods::READ_OUTPUT, (request,))
+                .await
+                .map_err(|error| Unread::Transport(error.into()))?;
+            let chunk: OutputChunk = data(reply).map_err(Unread::Invalid)?;
+            let decoded = base64::engine::general_purpose::STANDARD
+                .decode(&chunk.data)
+                .map_err(|error| Unread::Invalid(error.into()))?;
+            bytes.extend(decoded);
             if chunk.eof {
                 break;
             }
         }
-        let request = OutputRequest {
-            output: output.id.clone(),
-        };
-        let _released: Value = data(self.proxy.call(methods::RELEASE_OUTPUT, (request,)).await?)?;
         if bytes.len() as u64 != output.total_bytes {
-            return Err(io::Error::other("the screenshot came back short").into());
+            return Err(Unread::Invalid(
+                io::Error::other("the screenshot came back short").into(),
+            ));
         }
         Ok(bytes)
     }
diff --git a/crates/tinycomputer-examples/src/task/mod.rs b/crates/tinycomputer-examples/src/task/mod.rs
index ba17da9c..0e47097e 100644
--- a/crates/tinycomputer-examples/src/task/mod.rs
+++ b/crates/tinycomputer-examples/src/task/mod.rs
@@ -10,7 +10,8 @@ use std::collections::BTreeMap;
 use std::path::Path;
 use std::time::{Duration, Instant};
 
-use tinycomputer_bus::agent::{ContinueTaskRequest, TaskStatus, TaskView};
+use tinycomputer_bus::agent::{ContinueTaskRequest, InputField, TaskStatus, TaskView};
+use tinycomputer_bus::browser::SessionInfo;
 
 use crate::host::{Host, LabError};
 
@@ -19,7 +20,8 @@ pub const AWAIT_SLICE: Duration = Duration::from_secs(30);
 
 /// Follows the task until it stops: prints each new state, answers a
 /// `needs_input` from `answers` when every field it asks for is there, and
-/// cancels the task once `limit` has passed.
+/// cancels the task once `limit` has passed — checked on every state it
+/// reports, so an answerable pause past the limit is cancelled, not answered.
 ///
 /// # Errors
 ///
@@ -39,25 +41,20 @@ pub async fn follow(
             println!("{line}");
             last = line;
         }
+        if view.status.is_final() {
+            return Ok(view);
+        }
+        let Some(wait) = next_wait(started.elapsed(), limit) else {
+            println!("time limit reached; cancelling");
+            return host.cancel_task(&id).await;
+        };
         view = match &view.status {
             TaskStatus::Running => {
-                let Some(wait) = next_wait(started.elapsed(), limit) else {
-                    println!("time limit reached; cancelling");
-                    return host.cancel_task(&id).await;
-                };
                 let timeout_ms = u64::try_from(wait.as_millis()).unwrap_or(u64::MAX);
                 host.await_task(&id, timeout_ms).await?
             }
             TaskStatus::NeedsInput { fields } => {
-                let Some(inputs) = fields
-                    .iter()
-                    .map(|field| {
-                        answers
-                            .get(&field.name)
-                            .map(|value| (field.name.clone(), value.clone()))
-                    })
-                    .collect::<Option<BTreeMap<_, _>>>()
-                else {
+                let Some(inputs) = inputs_for(fields, answers) else {
                     return Ok(view);
                 };
                 println!(
@@ -76,6 +73,48 @@ pub async fn follow(
     }
 }
 
+/// The answers to a `needs_input` pause: one per field it asks for, or
+/// `None` when any is missing — or when it asks for nothing, which no answer
+/// can move past, so the pause is handed back rather than continued empty.
+#[must_use]
+pub fn inputs_for(
+    fields: &[InputField],
+    answers: &BTreeMap<String, String>,
+) -> Option<BTreeMap<String, String>> {
+    if fields.is_empty() {
+        return None;
+    }
+    fields
+        .iter()
+        .map(|field| {
+            answers
+                .get(&field.name)
+                .map(|value| (field.name.clone(), value.clone()))
+        })
+        .collect()
+}
+
+/// `url` reduced to its scheme and host, for a log line: credentials,
+/// paths (password-reset and magic-link tokens ride there), queries, and
+/// fragments are all dropped.
+#[must_use]
+pub fn loggable(url: &str) -> String {
+    match url.split_once("://") {
+        Some((scheme, rest)) => {
+            let authority = rest.split(['/', '?', '#']).next().unwrap_or_default();
+            let host = authority
+                .rsplit_once('@')
+                .map_or(authority, |(_, host)| host);
+            format!("{scheme}://{host}")
+        }
+        // An opaque URL (`data:`, `about:`, a custom scheme) carries its
+        // payload right after the colon, so only the scheme is kept.
+        None => url
+            .split_once(':')
+            .map_or_else(String::new, |(scheme, _)| format!("{scheme}:")),
+    }
+}
+
 /// How long the next `AwaitTask` may block: what is left of the time limit,
 /// at most one slice, so a wait never carries the run past the limit. `None`
 /// once the limit is spent.
@@ -98,14 +137,26 @@ pub fn passed(status: &TaskStatus) -> bool {
 }
 
 /// Collects what a stopped task did into `out`, all over the bus: the
-/// report (`TaskReport`), a screenshot of each browser session still open
-/// (`BrowserScreenshot` and `BrowserReadOutput`) — then closes it — and, for
-/// a finished task, its records and any shaped result.
+/// report (`TaskReport`); when the task managed to take one as it stopped,
+/// `final.png` (`BrowserReadOutput` on the report's last artifact, which
+/// `read_output` releases); otherwise an `open-<n>.png` of each browser
+/// session still open; every open session is then closed; and, for a
+/// finished task, its records and any shaped result.
+///
+/// Only the task's own sessions are touched: those not in `before`, the
+/// sessions [`browser_sessions`](Host::browser_sessions) listed before
+/// `StartTask`. Every screenshot is
+/// best effort: a task can stop without one.
 ///
 /// # Errors
 ///
 /// Fails when a call to the module fails or a file cannot be written.
-pub async fn conclude(host: &Host, view: &TaskView, out: &Path) -> Result<(), LabError> {
+pub async fn conclude(
+    host: &Host,
+    view: &TaskView,
+    before: &[SessionInfo],
+    out: &Path,
+) -> Result<(), LabError> {
     std::fs::create_dir_all(out)?;
     let report = host.task_report(&view.id).await?;
     for step in &report.steps {
@@ -124,25 +175,61 @@ pub async fn conclude(host: &Host, view: &TaskView, out: &Path) -> Result<(), La
         out.join("report.json"),
         serde_json::to_string_pretty(&report)?,
     )?;
-    for (index, session) in host.browser_sessions().await?.iter().enumerate() {
-        let name = if index == 0 {
-            "final.png".to_owned()
-        } else {
-            format!("final-{index}.png")
-        };
+    // The screenshot the task took when it stopped, before its session was
+    // released — the only one left for a task that finished or failed. It
+    // may have expired (held outputs live five minutes), so whether it was
+    // actually written decides whether open sessions are captured instead.
+    let mut captured = false;
+    if let Some(last) = report.artifacts.last() {
+        match host.read_output(last).await {
+            Ok(image) => match std::fs::write(out.join("final.png"), image) {
+                // Written, not merely read: only then is the fallback skipped.
+                Ok(()) => {
+                    captured = true;
+                    println!(
+                        "screenshot: {} (taken as the task stopped)",
+                        out.join("final.png").display()
+                    );
+                }
+                Err(error) => println!("final.png could not be written: {error}"),
+            },
+            Err(error) => println!("the task's screenshot could not be read: {error}"),
+        }
+    }
+    // The task's sessions still open — a task paused at a checkpoint keeps
+    // its own — are captured as they stand now, unless the task's own
+    // screenshot already shows that state, then closed. A session that was
+    // open before the task started is not the task's, and is left alone.
+    let owned = host
+        .browser_sessions()
+        .await?
+        .into_iter()
+        .filter(|session| before.iter().all(|earlier| earlier.id != session.id))
+        .collect::<Vec<_>>();
+    for (index, session) in owned.iter().enumerate() {
+        if captured {
+            host.close_browser_session(&session.id).await?;
+            continue;
+        }
+        let name = format!("open-{index}.png");
+        // A screenshot that cannot be taken or written is reported, never
+        // allowed to skip closing the session below.
         match host.browser_screenshot(&session.id).await {
-            Ok(image) => {
-                std::fs::write(out.join(&name), image)?;
-                println!(
+            Ok(image) => match std::fs::write(out.join(&name), image) {
+                Ok(()) => println!(
                     "screenshot: {} ({})",
                     out.join(&name).display(),
-                    session.url
-                );
-            }
+                    loggable(&session.url)
+                ),
+                Err(error) => println!("{name} could not be written: {error}"),
+            },
             Err(error) => println!("screenshot of {} failed: {error}", session.id),
         }
         host.close_browser_session(&session.id).await?;
     }
+    if !captured && !out.join("open-0.png").exists() {
+        println!("no screenshot: the task's surface could not take one");
+    }
     if let TaskStatus::Done {
         records, result, ..
     } = &view.status
diff --git a/crates/tinycomputer-examples/src/task/task_tests.rs b/crates/tinycomputer-examples/src/task/task_tests.rs
index e93d99f6..6e38a3a7 100644
--- a/crates/tinycomputer-examples/src/task/task_tests.rs
+++ b/crates/tinycomputer-examples/src/task/task_tests.rs
@@ -8,7 +8,8 @@ use std::time::Duration;
 
 use tinycomputer_bus::agent::TaskStatus;
 
-use super::{AWAIT_SLICE, next_wait, passed, state};
+use super::{AWAIT_SLICE, inputs_for, loggable, next_wait, passed, state};
+use tinycomputer_bus::agent::{InputField, InputKind};
 
 const LIMIT: Duration = Duration::from_secs(20 * 60);
 
@@ -53,3 +54,54 @@ fn a_status_is_named_by_its_wire_state() {
     assert_eq!(state(&TaskStatus::Running), "running");
     assert_eq!(state(&TaskStatus::Cancelled), "cancelled");
 }
+
+fn field(name: &str) -> InputField {
+    InputField {
+        name: name.to_owned(),
+        why: String::new(),
+        kind: InputKind::Text,
+        options: Vec::new(),
+    }
+}
+
+#[test]
+fn a_pause_is_answered_only_when_every_field_is_known() {
+    let answers = BTreeMap::from([("phone".to_owned(), "+91".to_owned())]);
+    assert_eq!(
+        inputs_for(&[field("phone")], &answers),
+        Some(answers.clone())
+    );
+    assert_eq!(
+        inputs_for(&[field("phone"), field("email")], &answers),
+        None
+    );
+}
+
+#[test]
+fn a_pause_asking_for_nothing_is_handed_back() {
+    let answers = BTreeMap::from([("phone".to_owned(), "+91".to_owned())]);
+    assert_eq!(inputs_for(&[], &answers), None);
+}
+
+#[test]
+fn a_logged_url_keeps_only_its_scheme_and_host() {
+    assert_eq!(
+        loggable("https://user:secret@pay.test/checkout?token=abc#step"),
+        "https://pay.test"
+    );
+    // A path can carry a token (a magic link), and an `@` in it is not a
+    // credential separator.
+    assert_eq!(
+        loggable("https://example.com/reset/t0k3n"),
+        "https://example.com"
+    );
+    assert_eq!(
+        loggable("https://example.com/@alice?tab=1"),
+        "https://example.com"
+    );
+    assert_eq!(loggable("https://u:p@example.com"), "https://example.com");
+    // An opaque URL keeps only its scheme; its payload can hold anything.
+    assert_eq!(loggable("about:blank"), "about:");
+    assert_eq!(loggable("data:text/html,<p>token=abc</p>"), "data:");
+    assert_eq!(loggable("not a url"), "");
+}
diff --git a/crates/tinycomputer-skills/skills/tinycomputer/SKILL.md b/crates/tinycomputer-skills/skills/tinycomputer/SKILL.md
index 570c2b6c..fec580a5 100644
--- a/crates/tinycomputer-skills/skills/tinycomputer/SKILL.md
+++ b/crates/tinycomputer-skills/skills/tinycomputer/SKILL.md
@@ -46,7 +46,7 @@ Tasks are the way in; the primitives are there when you need to look or act dire
 
 - `BrowserListSessions` shows every open browser session, a running task's included.
 - `BrowserOpenSession`, then `BrowserNavigate` and `BrowserSnapshot` with `{"session": id, …}`; act on a ref with `BrowserPerform`, such as `{"session": "s-1", "action": "click", "target": {"kind": "ref", "value": "e3"}}`.
-- `BrowserScreenshot` returns an output id, not an image: read it with `BrowserReadOutput` from `offset` 0 until `eof`, then `BrowserReleaseOutput`. The same works for a screenshot a task view names.
+- `BrowserScreenshot` returns an output id, not an image: read it with `BrowserReadOutput` from `offset` 0 until `eof`, then `BrowserReleaseOutput`. The same works for a screenshot in `TaskReport.artifacts`: a task keeps one each time it stops, and a task view never carries one.
 - `BrowserCloseSession` when you are done with a session you opened; leave a task's session to the task.
 
 ## Writing flows that work
diff --git a/crates/tinycomputer/src/tinybus_module/README.md b/crates/tinycomputer/src/tinybus_module/README.md
index 9f03553b..78d69ba9 100644
--- a/crates/tinycomputer/src/tinybus_module/README.md
+++ b/crates/tinycomputer/src/tinybus_module/README.md
@@ -39,8 +39,8 @@ The thirteen `Browser…` members await the module's one `Browser` directly —
 its calls are async, and serialized per session inside it — except the two
 held-output calls, which base64-encode up to four mebibytes and so run on the
 blocking pool. The same `Browser` is handed to `WorkspaceRunner`, so a task's
-session appears in `BrowserListSessions` and a screenshot a task view names
-is readable with `BrowserReadOutput`. `browser_reply` wraps each result in
+session appears in `BrowserListSessions` and a screenshot in a task's
+`TaskReport.artifacts` is readable with `BrowserReadOutput`. `browser_reply` wraps each result in
 the `DesktopResponse` envelope, the error converted by
 `tinycomputer_browser::Error::envelope`. `BrowserOpenSession` takes the
 configured `browser` settings (`browser_defaults.rs`) wherever the request
diff --git a/crates/tinycomputer/src/tinybus_module/dispatch/browser.rs b/crates/tinycomputer/src/tinybus_module/dispatch/browser.rs
index 20ba06c8..f693781f 100644
--- a/crates/tinycomputer/src/tinybus_module/dispatch/browser.rs
+++ b/crates/tinycomputer/src/tinybus_module/dispatch/browser.rs
@@ -39,3 +39,26 @@ pub(super) fn browser_reply<T: serde::Serialize>(
         Err(error) => DesktopResponse::err(command, error.envelope()),
     }
 }
+
+/// The reply of a member that changes nothing on the page — opening a
+/// session, a snapshot, a read, a screenshot, waiting for a download. A
+/// timeout there did nothing a retry could repeat, and a snapshot first is
+/// no help (for `BrowserSnapshot` it is the call that just failed; for
+/// `BrowserOpenSession` there is no session yet), so its hint is a plain
+/// retry. Members that act on the page keep the inspect-first hint.
+pub(in crate::tinybus_module) fn observing_reply<T: serde::Serialize>(
+    command: &str,
+    result: tinycomputer_browser::Result<T>,
+) -> DesktopResponse {
+    let timed_out = matches!(result, Err(tinycomputer_browser::Error::Timeout { .. }));
+    let mut reply = browser_reply(command, result);
+    if timed_out && let Some(error) = reply.error.as_mut() {
+        error.recovery = Some(tinycomputer_bus::RecoveryHint {
+            strategy: "retry_original".to_owned(),
+            retryable: true,
+            requires_fresh_snapshot: false,
+            retry_after_ms: None,
+        });
+    }
+    reply
+}
diff --git a/crates/tinycomputer/src/tinybus_module/dispatch/mod.rs b/crates/tinycomputer/src/tinybus_module/dispatch/mod.rs
index 79a784cd..18bbefa7 100644
--- a/crates/tinycomputer/src/tinybus_module/dispatch/mod.rs
+++ b/crates/tinycomputer/src/tinybus_module/dispatch/mod.rs
@@ -19,8 +19,11 @@ mod browser;
 mod service;
 
 use browser::browser_reply;
+pub(super) use browser::observing_reply;
 
 pub(super) use service::desktop_availability;
+#[cfg(test)]
+pub(super) use service::sweep_every;
 
 use tinybus::Result as TinyBusResult;
 use tinycomputer_bus::{
@@ -480,7 +483,7 @@ impl DesktopService {
         &self,
         options: SessionOptions,
     ) -> TinyBusResult<DesktopResponse> {
-        Ok(browser_reply(
+        Ok(observing_reply(
             "browser-open-session",
             self.browser
                 .open_session(self.browser_defaults.apply(options))
@@ -525,7 +528,7 @@ impl DesktopService {
         &self,
         request: SessionRequest<BrowserSnapshotRequest>,
     ) -> TinyBusResult<DesktopResponse> {
-        Ok(browser_reply(
+        Ok(observing_reply(
             "browser-snapshot",
             self.browser
                 .snapshot(&request.session, request.request)
@@ -551,7 +554,7 @@ impl DesktopService {
         &self,
         request: SessionRequest<ReadRequest>,
     ) -> TinyBusResult<DesktopResponse> {
-        Ok(browser_reply(
+        Ok(observing_reply(
             "browser-read-page",
             self.browser
                 .read_page(&request.session, request.request)
@@ -577,7 +580,7 @@ impl DesktopService {
         &self,
         request: SessionRequest<BrowserScreenshotRequest>,
     ) -> TinyBusResult<DesktopResponse> {
-        Ok(browser_reply(
+        Ok(observing_reply(
             "browser-screenshot",
             self.browser
                 .screenshot(&request.session, request.request)
@@ -628,7 +631,7 @@ impl DesktopService {
         &self,
         request: SessionRequest<DownloadWaitRequest>,
     ) -> TinyBusResult<DesktopResponse> {
-        Ok(browser_reply(
+        Ok(observing_reply(
             "browser-wait-download",
             self.browser
                 .wait_download(&request.session, request.request)
diff --git a/crates/tinycomputer/src/tinybus_module/dispatch/service.rs b/crates/tinycomputer/src/tinybus_module/dispatch/service.rs
index 39fcccd5..dd19fc05 100644
--- a/crates/tinycomputer/src/tinybus_module/dispatch/service.rs
+++ b/crates/tinycomputer/src/tinybus_module/dispatch/service.rs
@@ -126,6 +126,39 @@ impl DesktopService {
 
 /// Whether the desktop surface is usable, from a `Permissions` reply: the
 /// accessibility permission must be granted (or not needed on this platform).
+impl DesktopService {
+    /// Starts dropping expired held outputs every [`SWEEP_INTERVAL`], so a
+    /// screenshot a caller never reads or releases is freed after its time
+    /// to live even when no further output call arrives to expire it. The
+    /// sweep ends once the service's browser is gone. Needs a Tokio runtime,
+    /// which `setup` runs on.
+    ///
+    /// [`SWEEP_INTERVAL`]: tinycomputer_browser::SWEEP_INTERVAL
+    pub(crate) fn sweep_outputs(&self) {
+        tokio::spawn(sweep_every(
+            Arc::downgrade(&self.browser),
+            tinycomputer_browser::SWEEP_INTERVAL,
+        ));
+    }
+}
+
+/// Sweeps `browser`'s held outputs every `every`, until it is dropped.
+pub(in crate::tinybus_module) async fn sweep_every(
+    browser: std::sync::Weak<Browser>,
+    every: std::time::Duration,
+) {
+    let mut ticks = tokio::time::interval(every);
+    loop {
+        ticks.tick().await;
+        let Some(browser) = browser.upgrade() else {
+            return;
+        };
+        // A poisoned output store is reported on the next output call;
+        // the sweep has no caller to report it to.
+        let _swept = browser.sweep_outputs();
+    }
+}
+
 pub(in crate::tinybus_module) fn desktop_availability(
     permissions: &DesktopResponse,
 ) -> SurfaceAvailability {
diff --git a/crates/tinycomputer/src/tinybus_module/mod.rs b/crates/tinycomputer/src/tinybus_module/mod.rs
index c2f88178..aa13ffae 100644
--- a/crates/tinycomputer/src/tinybus_module/mod.rs
+++ b/crates/tinycomputer/src/tinybus_module/mod.rs
@@ -38,6 +38,7 @@ pub(crate) use dispatch::DesktopService;
 async fn setup(connection: Connection, config: Value) -> TinyBusResult<()> {
     let service = DesktopService::from_config(&config)
         .map_err(|error| tinybus::Error::failed(error.to_string()))?;
+    service.sweep_outputs();
 
     connection
         .serve_at(names::OBJECT_PATH.try_into()?, service)
diff --git a/crates/tinycomputer/src/tinybus_module/runner.rs b/crates/tinycomputer/src/tinybus_module/runner.rs
index 8c3d5a6e..faba6d68 100644
--- a/crates/tinycomputer/src/tinybus_module/runner.rs
+++ b/crates/tinycomputer/src/tinybus_module/runner.rs
@@ -4,10 +4,14 @@
 use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
 
-use tinycomputer_browser::{Browser, BrowserSurface, ScreenCursor, SessionOptions};
+use tinycomputer_browser::{
+    Browser, BrowserSurface, ScreenCursor, ScreenshotRequest, SessionOptions,
+};
 use tinycomputer_bus::DesktopResponse;
 use tinycomputer_bus::agent::{SurfaceKind, TaskConstraints, TaskId};
-use tinycomputer_engine::{FlowFuture, FlowRunner, JevRuntime, TextFuture, Workspace};
+use tinycomputer_engine::{
+    CaptureFuture, FlowFuture, FlowRunner, JevRuntime, TextFuture, Workspace,
+};
 
 use super::config::BrowserDefaults;
 use crate::Desktop;
@@ -112,6 +116,29 @@ impl FlowRunner for WorkspaceRunner {
         })
     }
 
+    fn capture(&self, task: &TaskId) -> CaptureFuture {
+        let session = self
+            .workspaces
+            .lock()
+            .ok()
+            // Only when the browser is the side the task is on: after a
+            // move to a desktop application its page is stale evidence.
+            .and_then(|workspaces| {
+                workspaces
+                    .get(task)
+                    .filter(|(workspace, _)| workspace.browser_active())
+                    .and_then(|(_, browser)| browser.clone())
+            })
+            .and_then(|browser| browser.session());
+        let browser = self.browser.clone();
+        Box::pin(async move {
+            browser
+                .screenshot(&session?, ScreenshotRequest::default())
+                .await
+                .ok()
+        })
+    }
+
     fn release(&self, task: &TaskId) {
         let released = self
             .workspaces
diff --git a/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/browser_tests.rs b/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/browser_tests.rs
index 3618abd2..6f11ea7e 100644
--- a/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/browser_tests.rs
+++ b/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/browser_tests.rs
@@ -306,3 +306,51 @@ async fn a_malformed_request_is_a_bus_error_not_a_panic() -> tinybus::Result<()>
     assert!(reply.is_err(), "a request with no session does not decode");
     Ok(())
 }
+
+#[tokio::test]
+async fn the_output_sweep_runs_until_the_browser_is_gone() {
+    use crate::tinybus_module::dispatch::sweep_every;
+
+    let scratch = Scratch::new("sweep");
+    let browser = Arc::new(Browser::with_scratch(
+        Arc::new(ScriptedLauncher::default()),
+        scratch.0.clone(),
+    ));
+    let sweep = tokio::spawn(sweep_every(
+        Arc::downgrade(&browser),
+        std::time::Duration::from_millis(1),
+    ));
+    // It sweeps while the browser lives…
+    tokio::time::sleep(std::time::Duration::from_millis(5)).await;
+    assert!(!sweep.is_finished());
+    // …and ends on its own once the browser is dropped.
+    drop(browser);
+    tokio::time::timeout(std::time::Duration::from_secs(1), sweep)
+        .await
+        .expect("the sweep ends once the browser is gone")
+        .expect("the sweep does not panic");
+}
+
+#[test]
+fn a_timed_out_observation_retries_without_a_snapshot() {
+    use crate::tinybus_module::dispatch::observing_reply;
+    // Opening a session or reading the page changed nothing, and a snapshot
+    // first is no help, so the hint is a plain retry.
+    let reply = observing_reply::<()>(
+        "browser-open-session",
+        Err(tinycomputer_browser::Error::timeout("launch", 30_000)),
+    );
+    let error = reply.error.expect("a timeout fails the call");
+    assert_eq!(error.code, "TIMEOUT");
+    let hint = error.recovery.expect("a timeout has a way out");
+    assert_eq!(hint.strategy, "retry_original");
+    assert!(hint.retryable && !hint.requires_fresh_snapshot);
+    // Any other failure keeps its own hint.
+    let other = observing_reply::<()>(
+        "browser-snapshot",
+        Err(tinycomputer_browser::Error::browser_unavailable(
+            "no chrome",
+        )),
+    );
+    assert!(other.error.expect("fails").recovery.is_none());
+}
diff --git a/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/tasks_tests.rs b/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/tasks_tests.rs
index d01dcdeb..ed914ac8 100644
--- a/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/tasks_tests.rs
+++ b/crates/tinycomputer/src/tinybus_module/tinybus_module_tests/tasks_tests.rs
@@ -104,6 +104,10 @@ async fn the_runner_keeps_one_workspace_per_task_until_released() {
     // Nothing observed yet, so there is nothing to read.
     assert!(runner.visible_text(&task).await.is_empty());
     assert_eq!(runner.workspaces.lock().unwrap().len(), 1);
+    // No browser session was ever opened, so there is nothing to capture,
+    // and a task the runner never saw has nothing either.
+    assert!(runner.capture(&task).await.is_none());
+    assert!(runner.capture(&TaskId::new("t-unknown")).await.is_none());
     runner.release(&task);
     assert!(runner.workspaces.lock().unwrap().is_empty());
 }
@@ -133,13 +137,20 @@ async fn a_task_report_request_is_one_a_confidential_call_can_carry() -> tinybus
     assert!(bare.to_string().contains("stream handle"), "{bare}");
 
     // The report's own request always carries `trace`, so it gets past the
-    // client; this unattested test module then fails attestation instead.
+    // client and reaches the broker, which refuses it for exactly one
+    // reason: this in-memory module was never attested.
     let request = TaskReportRequest::new(TaskId::new("t-1"));
-    if let Err(error) = proxy
+    let refused = proxy
         .call_confidential::<serde_json::Value>(names::methods::TASK_REPORT, (request,))
         .await
-    {
-        assert!(!error.to_string().contains("stream handle"), "{error}");
-    }
+        .expect_err("an unattested module cannot take a confidential call");
+    assert!(
+        matches!(
+            &refused,
+            tinybus::Error::MethodFailed { name, .. }
+                if name.as_str() == "ai.tinyhumans.tinybus.Error.NotAttested"
+        ),
+        "{refused:?}"
+    );
     Ok(())
 }
diff --git a/docs/crates/tinycomputer-browser/errors.md b/docs/crates/tinycomputer-browser/errors.md
index 67e05684..2b059e13 100644
--- a/docs/crates/tinycomputer-browser/errors.md
+++ b/docs/crates/tinycomputer-browser/errors.md
@@ -25,16 +25,23 @@ a host is supposed to see and do about it.
 | `NoSuchSession` | `NoSuchSession` | Open a new session; this one is gone. |
 | `NoSuchElement` | `NoSuchElement` | Take a fresh snapshot and choose again. |
 | `StaleRef` | `StaleRef` | Same remedy as above, spelled out explicitly: the ref belonged to an earlier reading of this page. |
-| `NotActionable` | `NotActionable` | The element exists but could not be acted on right now: covered, disabled, or off-document. The message names the obstruction where the browser could identify it. |
-| `Timeout` | `Timeout` | The operation ran out of time; retrying with a longer deadline is reasonable. |
+| `NotActionable` | `NotActionable` | The element exists but could not be acted on right now: covered, disabled, off-document, or behind a JavaScript dialog that has to be answered first. The message names the obstruction where the browser could identify it. |
+| `Timeout` | `Timeout` | The operation ran out of time. A click or a submission may already have landed, so look at the page (take a fresh snapshot) before retrying, perhaps with a longer deadline; never repeat it blind. A timeout on a member that only looks — open a session, snapshot, read, screenshot, wait for a download — changed nothing, so over the bus its hint is a plain retry. |
 | `BlockedByPolicy` | `BlockedByPolicy` | Never retry. The session's `allowed_origins` refused this destination, and the answer will not change. |
 | `BrowserUnavailable` | `BrowserUnavailable` | Not something a caller can fix by choosing differently: this is a host or deployment problem (no browser could be launched or reached). |
-| `PageError` | `PageError` | The page itself raised a JavaScript exception, or the browser rejected a command. |
+| `PageError` | `PageError` | The page itself raised a JavaScript exception, or the browser rejected a command. The same request fails the same way again: inspect the page and revise the request (its hint is `inspect_state_then_revise_request`, not retryable). |
 | `NoSuchOutput` | `NoSuchOutput` | The held screenshot or PDF being asked for is unknown or has expired. |
 | `LimitExceeded` | `LimitExceeded` | A bound was hit: too many sessions, too many held outputs, or an output larger than the module will hold. |
 | `ConnectionLost` | `NoSuchSession` (same wire name as `NoSuchSession`) | Open a new session. Kept as its own Rust variant, rather than folded into `NoSuchSession` at construction time, because it says something more specific ("the transport died") that is useful for the crate's own diagnostics. A caller across the bus is told exactly the same thing either way: don't retry into a socket that will never answer, open a fresh session instead. |
 | `ModuleFailed` | `ModuleFailed` | Anything that does not fit the categories above. |
 
+`Error::envelope` marks a failure `not_delivered` (so retrying is safe) only
+when it is decided before anything reaches the page: `NoSuchSession` and
+`NoSuchOutput`, looked up locally, and `StaleRef` and `BlockedByPolicy`,
+refused inside agent-browser by its ref lookup and domain filter before any
+input is sent. Every other variant can follow work already done, so its
+delivery is left `unknown` rather than claimed.
+
 `errors::is_agent_recoverable` (in the bus crate) is the one further
 decision that gets made on top of this table: whether a model can plausibly
 recover by choosing differently, versus needing a human or an operator.
@@ -78,10 +85,11 @@ through one of the 13 `Browser…` members. `crates/tinycomputer`'s dispatch
 wraps each result with `Error::envelope` (`error/mod.rs`), which builds a
 `DesktopError` the same way: `code` is `errors::code` of the wire name (the
 desktop's own spelling wherever the meaning is shared), the full wire name
-rides in `details.name`, and `recovery` comes from `errors::recovery`. A
-failure the browser was never asked to attempt, a request `classify` rejects
-before it reaches agent-browser, is marked not delivered, so a caller knows
-retrying it cannot repeat an effect. This is a separate code path from
+rides in `details.name`, and `recovery` comes from `errors::recovery`. Only a
+failure decided before anything reaches the page is marked not delivered (see
+above for the four), so a caller knows retrying it cannot repeat an effect;
+`reply::classify` names failures from the engine's replies, and marks none of
+them delivered or not on its own. This is a separate code path from
 `BrowserSurface`'s (a flow or task drives the page through the engine's
 `Surface` trait; a direct `Browser…` call goes straight through the module's
 dispatch), but both end up at the same `DesktopResponse` shape and the same
diff --git a/docs/crates/tinycomputer-browser/outputs-and-downloads.md b/docs/crates/tinycomputer-browser/outputs-and-downloads.md
index 0ed63c9a..e36d6add 100644
--- a/docs/crates/tinycomputer-browser/outputs-and-downloads.md
+++ b/docs/crates/tinycomputer-browser/outputs-and-downloads.md
@@ -62,6 +62,9 @@ and, expected from a host, on a fixed timer via `Browser::sweep_outputs`
 every `SWEEP_INTERVAL`. Without the timer, an output taken and then never
 collected again would sit in memory, in somebody else's process, until the
 next unrelated call happened to trigger a cleanup, which might never come.
+The `tinycomputer` module starts that timer when it is set up
+(`DesktopService::sweep_outputs`), so its held outputs expire on schedule
+whether or not a caller comes back.
 
 ## Reading a held output
 
diff --git a/docs/crates/tinycomputer-bus/agent-and-tasks.md b/docs/crates/tinycomputer-bus/agent-and-tasks.md
index bdac3ead..dfea2a11 100644
--- a/docs/crates/tinycomputer-bus/agent-and-tasks.md
+++ b/docs/crates/tinycomputer-bus/agent-and-tasks.md
@@ -229,13 +229,23 @@ pub struct TaskReport {
     pub flow: Option<Flow>,
     pub steps: Vec<StepReport>,           // see Writing flows
     pub records: BTreeMap<String, Vec<BTreeMap<String, String>>>,
-    pub artifacts: Vec<OutputRef>,        // screenshots at checkpoints, approvals, failures
+    pub artifacts: Vec<OutputRef>,        // best-effort screenshots from stopped runs; read with BrowserReadOutput
     pub learned: Vec<GroundingHint>,      // pass back as StartTask.memory next time
     pub trace: Vec<JevExchange>,          // only when StartTask.trace was set
     pub rescues: Vec<Rescue>,
 }
 ```
 
+When a run stops on its own — at a checkpoint, before an approval, at a
+person's turn, at the end, or cut off by its time budget — the task tries to
+take a screenshot of its surface before letting it go (best effort, within
+ten seconds). `CancelTask` releases at once without one; take a
+`BrowserScreenshot` first if you want the screen. It lands in `artifacts`
+only — never on a status's `screenshot`, because a `TaskView` also travels
+through `AwaitTask` and `ListTasks`, which are not confidential, and a held
+output's id is all `BrowserReadOutput` needs. Read it with
+`BrowserReadOutput` within five minutes, before it expires.
+
 Each `Rescue` records one time a failed step was handed to a reasoning model
 for a second opinion:
 
diff --git a/docs/crates/tinycomputer-bus/browser.md b/docs/crates/tinycomputer-bus/browser.md
index c33d4187..443a3efe 100644
--- a/docs/crates/tinycomputer-bus/browser.md
+++ b/docs/crates/tinycomputer-bus/browser.md
@@ -27,8 +27,10 @@ crate root, and that is deliberate: `SnapshotRequest` and `ScreenshotRequest`
 also exist for the desktop members, with different shapes. Namespacing the
 types means neither side ever shadows the other, and a caller cannot
 accidentally send a desktop `SnapshotRequest` where a browser one belongs,
-they are different Rust types. Every browser member takes one JSON object,
-with the session beside the member's own fields, and replies in the same
+they are different Rust types. A browser member that acts on an open session
+takes one JSON object, with the session beside the member's own fields;
+`BrowserOpenSession` takes the new session's options, `BrowserListSessions`
+nothing, and the output members an `output`. All reply in the same
 `DesktopResponse` envelope the desktop members use.
 
 These types were ported from a now-superseded `tinybrowser-bus` crate; a host
diff --git a/docs/crates/tinycomputer-skills/using-it-as-an-agent.md b/docs/crates/tinycomputer-skills/using-it-as-an-agent.md
index bf9dd371..729d3e56 100644
--- a/docs/crates/tinycomputer-skills/using-it-as-an-agent.md
+++ b/docs/crates/tinycomputer-skills/using-it-as-an-agent.md
@@ -112,8 +112,8 @@ snapshot and choose again.
   `{"session": "s-1", "action": "click", "target": {"kind": "ref", "value": "e3"}}`.
 - `BrowserScreenshot` returns an output id, not an image: read it with
   `BrowserReadOutput` from `offset` 0 until `eof`, then
-  `BrowserReleaseOutput`. The same call works for a screenshot a task view
-  names.
+  `BrowserReleaseOutput`. The same call works for a screenshot in a task's
+  `TaskReport.artifacts`; a task view never carries one.
 - `BrowserCloseSession` when done with a session you opened; leave a task's
   own session to the task.
 
diff --git a/docs/crates/tinycomputer/calling-it.md b/docs/crates/tinycomputer/calling-it.md
index a6c05aa1..80a32be8 100644
--- a/docs/crates/tinycomputer/calling-it.md
+++ b/docs/crates/tinycomputer/calling-it.md
@@ -116,8 +116,9 @@ Without `jev` configured, this comes back immediately as:
 
 ## Calling a browser member
 
-The 13 `Browser…` members take one object, the session beside the member's
-own fields, and answer in the same `DesktopResponse` envelope the desktop
+The 13 `Browser…` members take one object — for a member acting on an open
+session, the session beside the member's own fields; `BrowserListSessions`
+takes nothing — and answer in the same `DesktopResponse` envelope the desktop
 members use. `BrowserOpenSession` first, then act on the session it hands
 back:
 
@@ -233,11 +234,13 @@ in.
 ```
 
 `TaskReport` (also confidential, since it can carry the full trace) gives you
-the whole history once you are done:
+the whole history once you are done. Always send `trace`: a confidential call
+whose body is only `{"id": …}` is refused by the TinyBus client before it
+leaves, because that is the shape of a stream handle.
 
 ```json
 // TaskReport request
-{ "id": "task-7f2a" }
+{ "id": "task-7f2a", "trace": false }
 ```
 
 ## Discover what you can call before calling it
diff --git a/docs/crates/tinycomputer/members.md b/docs/crates/tinycomputer/members.md
index 66b76c0c..e72d54c1 100644
--- a/docs/crates/tinycomputer/members.md
+++ b/docs/crates/tinycomputer/members.md
@@ -11,8 +11,9 @@ so this list cannot silently drift from the code.
 Every member here except the eight task members (their own section below)
 takes at most one request payload and always answers with a `DesktopResponse`
 whose `ok` flag picks between `data` and a structured `error`. That includes
-the 13 browser members: they take one object, the session beside the member's
-own fields, and answer in the same envelope, reusing a desktop error code
+the 13 browser members: those acting on an open session take one object, the
+session beside the member's own fields (`BrowserListSessions` takes nothing),
+and all answer in the same envelope, reusing a desktop error code
 wherever the meaning is shared. The module never answers with a bare
 `TinyBus` transport error for something the caller did; that is reserved for
 the module failing to even start the command, which is rare enough that you
@@ -185,8 +186,8 @@ early. `BrowserListDownloads` and `BrowserWaitDownload` track files a page
 downloads.
 
 The module holds one `Browser`, shared with the task runner, so a task's own
-browser session shows up in `BrowserListSessions` and a screenshot a task
-view names can be read back with `BrowserReadOutput`, without having to go
+browser session shows up in `BrowserListSessions` and a screenshot in its
+`TaskReport.artifacts` can be read back with `BrowserReadOutput`, without having to go
 through the task API to see it. See
 [docs/crates/tinycomputer-bus/browser.md](../tinycomputer-bus/browser.md) for
 the full payload shapes and error codes, and
diff --git a/docs/how-it-decides.md b/docs/how-it-decides.md
index 69a1661e..669556b0 100644
--- a/docs/how-it-decides.md
+++ b/docs/how-it-decides.md
@@ -170,8 +170,8 @@ Both use the same bars and the same safety rules.
 
 Jev is the default, but the loops only depend on the shape of the questions.
 Levanto Sage answers the same three kinds of question, and an adapter lets it
-stand in for Jev (from code; the module has no Sage setting). Every call
-still goes through the same path, so budgets, masking, voting, and the
+stand in for Jev (the module's `jev.provider = "sage"`; in the examples,
+`TINYCOMPUTER_DECISIONS=sage`). Every call still goes through the same path, so budgets, masking, voting, and the
 journal all apply. On two live bookings it reached the same places as Jev in
 one case, but was several times slower and more expensive. See
 [`technical/evals/2026-09-29-sage.md`](technical/evals/2026-09-29-sage.md).
diff --git a/docs/technical/architecture.md b/docs/technical/architecture.md
index f89c6928..9f53be00 100644
--- a/docs/technical/architecture.md
+++ b/docs/technical/architecture.md
@@ -189,8 +189,10 @@ its family, and one sentence on what it is for.
 The browser primitives are defined in `tinycomputer-bus/src/browser/`,
 implemented by `tinycomputer_browser::Browser`, and served with a `Browser`
 prefix, because several (`Snapshot`, `Screenshot`) would otherwise collide
-with a desktop member of a different shape. Each takes one object with the
-session beside the member's own fields, and replies in the same
+with a desktop member of a different shape. A member that acts on an open
+session takes one object with the session beside the member's own fields
+(`BrowserOpenSession` takes the session's options, `BrowserListSessions`
+nothing, the output members an `output`), and each replies in the same
 `DesktopResponse` envelope as a desktop member; a failure reuses the desktop's
 code where the meaning is shared, so `STALE_REF` means "snapshot again" on
 either surface. The module holds one `Browser`: the task runner opens each
diff --git a/docs/technical/specs/desktop-module-contract.md b/docs/technical/specs/desktop-module-contract.md
index ec4f4c5c..4114c46f 100644
--- a/docs/technical/specs/desktop-module-contract.md
+++ b/docs/technical/specs/desktop-module-contract.md
@@ -46,17 +46,23 @@ engine's argument types, the permission preflight, and the bus surface.
   share this interface because a TinyBus module exports one interface.
 - The thirteen browser members (2.6) close the list, each prefixed `Browser`
   (`tinycomputer_bus::browser::names`): sessions, navigate, snapshot,
-  perform, read, evaluate, screenshot, held outputs, and downloads. Each takes
-  one object — `{"session": …}` beside the member's own fields — and returns a
+  perform, read, evaluate, screenshot, held outputs, and downloads. A member
+  that acts on an open session takes one object, `{"session": …}` beside the
+  member's own fields; `BrowserOpenSession` takes `SessionOptions` (it makes
+  the session), `BrowserListSessions` takes nothing, and `BrowserReadOutput`
+  and `BrowserReleaseOutput` take `{"output": …}`. Every one returns a
   `DesktopResponse`. A failure's `code` is `browser::errors::code` of its
   wire name, which reuses the desktop's code where the meaning is the same
   (`STALE_REF`, `ELEMENT_NOT_FOUND`, `TIMEOUT`, `POLICY_DENIED`,
   `INVALID_ARGS`, `INTERNAL`); the full name is in `details.name`, the
-  recovery hint is `browser::errors::recovery`'s, and a call refused before
-  anything reached the browser is marked `not_delivered`. The members share
+  recovery hint is `browser::errors::recovery`'s — a timeout or page error,
+  which may follow a click that landed, says to inspect the page before
+  retrying — and only a failure decided before anything reaches the page (an
+  unknown session or output, an unresolvable ref, a refused origin) is marked
+  `not_delivered`; every other failure's delivery is `unknown`. The members share
   one `Browser` with the task runner, so `BrowserReadOutput` reads a
-  screenshot a task view names and `BrowserListSessions` shows a task's
-  session. The `ai.tinyhumans.tinycomputer.Browser` interface and its
+  screenshot in a task's `TaskReport.artifacts` (never in a task view) and
+  `BrowserListSessions` shows a task's session. The `ai.tinyhumans.tinycomputer.Browser` interface and its
   unprefixed names, never served by any release, are retired; the error
   names keep that prefix because they are published values, not members.
 - `TaskReport` takes a `TaskReportRequest` (2.7), `{"id", "trace"}` with
diff --git a/docs/technical/specs/unified-agent.md b/docs/technical/specs/unified-agent.md
index 3539769f..c2703bd3 100644
--- a/docs/technical/specs/unified-agent.md
+++ b/docs/technical/specs/unified-agent.md
@@ -77,13 +77,18 @@ desktop member. The table is the logical split, and `Describe` serves it as
 - `status` is one of:
   - `running`;
   - `needs_input{fields}`;
-  - `needs_approval{action, target, screenshot}`;
-  - `checkpoint{reason, url, screenshot, summary}`;
+  - `needs_approval{action, target}`;
+  - `checkpoint{reason, url, summary}`;
   - `needs_human{reason}`;
   - `needs_plan{guide}`;
   - `done{answer, records}`;
   - `failed{step, reason, hint}`;
   - `cancelled`.
+- A status never carries a screenshot, although the wire form has an
+  optional `screenshot` field on approvals, checkpoints, and human turns. A
+  view also travels through `AwaitTask` and `ListTasks`, which are not
+  confidential, and an output id is all `BrowserReadOutput` needs. The
+  screenshot a stopped run takes lives in `TaskReport.artifacts` only.
 - Calls return quickly. A task runs on the module's runtime, and `AwaitTask`
   long-polls it.
 - No refs or selectors at this level. `Describe` serves JSON Schemas and worked
diff --git a/docs/technical/tasks.md b/docs/technical/tasks.md
index 66d35a6d..7d6cf74e 100644
--- a/docs/technical/tasks.md
+++ b/docs/technical/tasks.md
@@ -67,9 +67,12 @@ A booking like the one above usually ends like this:
 ```
 
 The browser session stays open on the payment page so a person can finish.
-`CancelTask` releases it afterwards. `TaskReport` returns every step report,
-the records the task read or extracted, the trace, and the grounding hints it
-learned.
+`CancelTask` releases it afterwards. `TaskReport` (confidential) returns every
+step report, the records the task read or extracted, the trace, the grounding
+hints it learned, and `artifacts`: the best-effort screenshot each stopped run
+took before its surfaces were released, read with `BrowserReadOutput` within
+five minutes. No status carries a screenshot, since views also reach the
+non-confidential `AwaitTask` and `ListTasks`.
 
 ## Statuses
 
diff --git a/scripts/build-module b/scripts/build-module
index 4cc5d0f0..91b00cf3 100755
--- a/scripts/build-module
+++ b/scripts/build-module
@@ -27,7 +27,7 @@ case "$(uname -s)" in
   *) echo "build-module runs on macOS or Linux" >&2; exit 1 ;;
 esac
 
-cargo build --release -p tinycomputer --lib >&2
+cargo build --locked --release -p tinycomputer --lib >&2
 mkdir -p "$dir"
 # The TinyBus loader refuses a module whose directory or file another user
 # could write, so an inherited group- or world-writable mode (the Docker
@@ -37,7 +37,7 @@ install -m 644 "$target/release/${library}" "$dir/${library}"
 if [[ "$(uname -s)" == "Darwin" ]]; then
   # The engine's clipboard (and so the paste fallback for rich-text
   # fields) runs through a helper it only trusts beside the module.
-  cargo build --release -p agent-desktop-macos --bin agent-desktop-macos-helper >&2
+  cargo build --locked --release -p agent-desktop-macos --bin agent-desktop-macos-helper >&2
   install -m 755 "$target/release/agent-desktop-macos-helper" "$dir/agent-desktop-macos-helper"
 fi
 if command -v sha256sum >/dev/null 2>&1; then
@@ -47,4 +47,26 @@ else
 fi
 printf '"%s" = "%s"\n' "$library" "$hash" > "$dir/modules.toml"
 chmod 644 "$dir/modules.toml"
+# The loader checks every directory above the module too, so refuse here —
+# naming the culprit — rather than print a path it will not load from.
+ancestor="$(cd "$dir" && pwd -P)"
+while :; do
+  # GNU `%a` and BSD `%p` both end in the permission bits, sticky included.
+  raw="$(stat -c '%a' "$ancestor" 2>/dev/null || stat -f '%p' "$ancestor")"
+  mode=$(( 8#$raw & 8#7777 ))
+  owner="$(stat -c '%u' "$ancestor" 2>/dev/null || stat -f '%u' "$ancestor")"
+  if (( (mode & 8#022) != 0 && (mode & 8#1000) == 0 )); then
+    echo "build-module: $ancestor is writable by other users, so the loader will refuse" >&2
+    echo "  a module under it; set TINYCOMPUTER_MODULE_DIR to a directory whose every" >&2
+    echo "  parent is writable only by you (for example \$HOME/.local/lib/tinycomputer)" >&2
+    exit 1
+  fi
+  if [[ "$owner" != "$(id -u)" && "$owner" != 0 ]]; then
+    echo "build-module: $ancestor is owned by another user, so the loader will refuse" >&2
+    echo "  a module under it; set TINYCOMPUTER_MODULE_DIR elsewhere" >&2
+    exit 1
+  fi
+  [[ "$ancestor" == / ]] && break
+  ancestor="$(dirname "$ancestor")"
+done
 echo "$dir/${library}"