[u7-u7]

Problem

wait-for-element --selector '#mask' --state hidden (and detached) can report success while a visible replacement still matches #mask. A dynamic page may replace the node after DOM.describeNode but before DOM.resolveNode, or after the remote object is resolved but before its visibility probe. Both cases currently turn the retired physical node into an observation that the selector is absent. The wait returns immediately, allowing the caller to advance while the replacement loading mask remains visible.

The earlier lookup-stage retry already handles removal during DOM.describeNode; these later two windows were not covered.

Change

Treat a removed selector target as an incomplete probe and re-query it using the existing bounded polling loop. A fresh unmatched query still satisfies hidden/detached. Preserve physical-node semantics for ref waits, their invalidation errors, cancellation, deadlines, object-group cleanup and last completed evidence. No protocol, permission, dependency, timing-default or action-replay changes.

Validation

Base: b8f2d4f0fa35c8c7c866229e1cf3b3329ae39de5.

• The ten new regression cases exercise the production handleWaitForElement entry point and session/ref handling with controlled CDP replies and fake timers.
• Unchanged production source with the final tests: 10 failed / 60 passed. The four visible-replacement cases incorrectly return satisfied: true at 0 ms instead of continuing to the 100 ms deadline.
• Patched focused suite: 70 passed. Covers both replacement windows, confirmed absence on the next lookup, repeated stale probes bounded by the existing deadline, and retention of prior evidence. Existing ref-removal, real-error, cancellation and deadline tests remain passing.
• Full default extension suite: 3,531 passed / 358 opt-in browser tests skipped, 195 test files passed and 40 skipped (vitest run --maxWorkers=1, 184.30 seconds).
• Extension TypeScript tsc --noEmit, production extension wxt build, Biome on both changed files and git diff --check: passed.

Commands use the repository-locked dependencies. Initial pnpm install --frozen-lockfile needed a writable store/cache; its rerun installed dependencies and successfully ran wxt prepare, but exited with the unapproved optional @parcel/watcher build-script notice. No additional build scripts were approved and no workspace/lockfile changes are included.

No native Chrome fixture, installed extension/daemon end-to-end flow, Rust suite or upstream CI is claimed from these local results.

AI assistance

Investigated, implemented, tested and independently reviewed with OpenAI Codex agents. Draft for maintainer review; no human-review attestation is claimed.