Test pages for browser automation challenges. Each page demonstrates different web features that can be tricky to automate.
Simple login form with username and password fields
Targets for INPUT_TEXT {{key}} tokens (Tab, arrows, Space, Escape, Ctrl+A/C/V) with a keydown log for assertions
Multi-line textarea target for the INPUT_TEXT Paste (clipboard + Ctrl+V) toggle; echoes value plus char/line counts for assertions
Login backed by a real Set-Cookie session; page auto-redirects to the dashboard when the cookie is present. For testing session-persistence/browser-state behavior.
Three tabbed portals with identical flow but different fields — for testing parameterized components
Run the admin fingerprint collector from the demo site without logging in
Patient ID lookup form that rejects invalid IDs (for testing input_required recovery)
Missing expected element / precondition scenarios (no-result, conditional action, stalled post-state) that classify as UPSTREAM_ERROR / PREREQUISITE_NOT_MET — for the Fix-with-Builder-Agent button
Package tracking form with conditional popup for certain inputs
Drag-and-drop file uploader with metadata display
Controllable upload target for network-signal classification (?mode=sync|commit|async, ?status=, ?delay=, ?commitStatus=, ?verdict=). Issues a real browser POST so the network listener captures server-side upload failures (5xx/4xx/slow, upload-ok-but-commit-failed, async accept/reject).
Basic select dropdowns including one inside an iframe
Various select types: native, custom, searchable, multi-select, radio listbox, datalist
Password change forms (?variant=kinnser|availity|ecw|onehealthcare|reject-first|alphanumeric)
Standalone 2FA setup screens (?variant=dismissable|method-selection|authenticator|authenticator-qr-only|sms-verify|email-verify)
Stateful login → TFA setup → code entry → dashboard. After setup, subsequent logins ask for code only. Add ?reset=true to clear state (?variant=dismissable|authenticator|authenticator-qr-only)
Form with breakable selectors for XPath recovery propagation testing (?broken=true swaps selectors)
Healthcare prior-auth portal simulating framework migration drift. Full self-healing cycle: Stage 0 LLM static attempt → COMPUTER_USE fallback → pre-click capture → crystallize → verify → promote. (?drift=false|true|hard ?delay=<ms>)
Button with drifting id (changes every page load) for testing the full healing promotion pipeline: AI_FALLBACK → XPath capture → writeback → static graduation
Button + input with per-variant attributes for XPath cascade tier testing (?variant=default|data-testid|id-attr|aria|placeholder|role|text-content|class-only|broken|heavy-dom|multi-action|shifted-attrs|table|delayed-render)
Full CRM dashboard: login (admin/password), cookie banner, sidebar nav, 15-row data table, modal contact form with 3-tab wizard, toast notifications, 1000+ DOM elements (?variant=default|logged-out|modal-open|cookie-banner|slow-load|404|duplicate-contacts, ?reset=true)
Healthcare claims portal: login (provider/claims123), patient search with shuffled columns, 4-step claim wizard, accordion sidebar, CAPTCHA overlay, version drift, session expiry (?variant=default|expired-session|captcha|maintenance|rate-limit|slow-results|deleted-patient|password-expired|force-logout, ?version=1|2, ?reset=true)
Full flow: login → password expired → dashboard with claim form. Tests end-to-end password update recovery.
Dense insurance claims form for enrichment testing
Two identical Submit buttons; an XPath selector matches both, triggering the deterministic multiple-matching classification under INCORRECT_FORM_INPUTS
Repro of CareTend's cascading Workflows hover menu (Workflows → Infusion/SPRx Workflow → ePrescription Manager). Tests whether teleport-style clicks keep the cascade open or whether the pointer must dwell/hover along the trajectory. ?mode=hover|hover-strict|click|sticky, ?openDelay=ms (submenu render delay), ?grace=ms. Live HUD shows open levels + last-opened leaf; stable data-testids on every menu node.
Repro of the crowded ePrescription Manager grid: dense filter row, crammed column funnel icons, and a vertically + horizontally scrollable ~105-row table. Working Type filter (funnel → 'Is equal to' → type 'New Rx' → Count updates) plus a Filter Search box; rows carry <No Matching Patient>/<Multiple Matches> sentinels. All synthetic data (no PHI). ?rows=N, ?type=New+Rx. Live scrollTop/scrollLeft + count readouts.
Deterministic surface for validating LOOP-based positional grid harvesting. Fixed 19-row viewport with dedicated scroll-up/down buttons (data-testid scroll-up-row / scroll-down-row) that advance the grid by exactly one row per click, plus fully-identical adjacent New Rx rows so positional capture can be tested against content-dedup. All synthetic data (no PHI). ?rows=N (capped 2000), ?type=New+Rx.
Deterministic surface for BOOL_CONDITION[LLM_VISION] model bake-offs. Ten ?variant= states reproducing the cases where cheap bool models actually disagree: a spinner fully visible vs partially hidden behind a dialog vs mid-fade, a static refresh icon that is not a spinner, height/weight populated with '0' vs real values vs empty, and a selected row vs a hover-tinted one. Ground truth for each check is on data-expected (invisible to vision) so a workflow can assert without leaking the answer into the screenshot. All synthetic data (no PHI). ?variant=clean|spinner-full|spinner-occluded|spinner-faded|refresh-icon|fields-zero|fields-values|row-selected|row-hover|popup.
DISMISSIBLE popup that auto-dismisses on a timer before the injected close-recovery click executes. Exercises the popup-gone no-op path: recovery should take no action and resume to the Continue button. ?dismiss_after=0 keeps it visible (recovery must actively close it); ?dismiss_after=<ms> tunes the timing.
Test opening popup windows and handling multiple windows
Simple popup window with close button
Success popup - target window in multi-window test
Trap popup - decoy window in multi-window test
15 scenarios for unexpected UI state: 1–4 DISMISSIBLE (cookie banner, newsletter, promo, survey), 5–12 DECISION_REQUIRED generic (duplicate record, destructive confirm, stale record, scheduling conflict, outstanding balance, coverage warning, duplicate submission, threshold exceeded), 13–15 DECISION_REQUIRED 1:1 prod reproductions (ECW code-already-exists Yes/No, Noridian Consent to Monitoring Accept/Reject, ECW Duplicate Patient Warning Proceed/Cancel)
Fully-fledged multi-PAGE EHR portal — real route navigation (login → dashboard → patients → chart → coding → review → done) with clickable sidebar nav, a patient results table with selectable rows, and chart tabs. ?seed=N carries across pages and deterministically scatters DISMISSIBLE / DECISION_REQUIRED popups at varied timings (on entry, after a delay, after the step's action). Knobs: ?density, ?only=decision|dismissible, ?popups=N. Login is never interrupted; every seed exercises ≥1 decision modal
1:1 ecwcloud.com — multi-step modal chain: duplicate-patient warning → code-already-exists; tests counter reset on verified dismissal between modals
1:1 essentials.availity.com — bottom-rectangle consent banner spanning full width with 4 buttons (Accept All / Reject All / Customize / ×); tests non-centered modal placement
1:1 eprg.wellmed.net — full-screen overlay with scrollable legal text and a single 'I Acknowledge' CTA disabled until scroll-to-end; tests scroll-required single-CTA case
1:1 app.azaleahealth.com — bottom-right corner toast (not overlay) with 3 buttons (Yes / Maybe Later / Don't ask again); tests non-overlay corner placement
1:1 thespot.fcso.com — single-CTA modal whose click causes navigation to a /login flow; tests identifyRecoveryNode smart-resume after state-loss
1:1 app.propertymeld.com — wrong-modal (Edit Meld Residents) appears unexpectedly on Save Note; only × close button, no labeled CTAs; tests close-only dismissal path
1:1 www.portal.jnjwithme.com — single-CTA acknowledge modal whose action terminates the workflow as failed (patient already enrolled, no recovery path)
1:1 ecw.cmc-pa.com — information-dense modal with embedded error list inside the body, OK / Cancel buttons; tests information-rich modal extraction
1:1 app.weinfuse.com — feature-prompt modal triggered after file upload with 3 buttons (Scan Now / Maybe Later / Don't Show Again) and illustration; tests feature-prompt 3-option dismissal
1:1 familycarecenter.insynchcs.com — wrong-context modal (Zip Search) appearing when opening a gender dropdown; modal has a text-input field plus 2 buttons (V2 gap: modal_action MVP supports buttons only, this exposes the input-inside-modal limit)
Multiple levels of nested iframes with different sandbox attributes
Form elements inside iframe with security context display
Single-row table extraction inside an iframe. Use //tr[@data-row-id='row-2'] as the container XPath and short child XPaths like /td[@class='typeDesc'].
W3Schools-style result frame: createElement('iframe') + appendChild (about:blank) + document.write, recreated on each Run. Add ?delay=2000 to reproduce the slow-render injection race.
Frame served with script-src 'none' so the main-world inject is blocked; target is streamed in after ?delay ms. Realistic trigger for the isolated-world XPath fallback's early-bail.
Sandboxed iframe without allow-same-origin → opaque origin, so the parent can't read contentDocument (same as cross-origin). Forces the iframe relay path; regression guard for cross-origin find/click on a single host.
Embeds https://example.com — a real cross-origin frame that allows framing. contentDocument is null to the parent, so only the iframe relay reaches it. Regression guard for the relay path; target the 'Example Domain' heading.
Iframes mounted inside open and closed shadow roots — querySelectorAll('iframe') and a document-scoped MutationObserver don't cross shadow boundaries, so the frame may never be injected.
3+ levels of same-origin nesting with a click/type target in the deepest frame. Native (coordinate) actions must compose the frame offset across every level. ?level=N, ?delay=ms.
Full-viewport same-origin iframe with 20 scrollable sections. Tests full-page scroll+stitch during error screenshots. 'Simulate navigation gap' button blanks the iframe src for 400ms to reproduce the relay-disconnect window (iframeInject port disconnects on navigation, connectedIframes goes empty). Before fix: screenshot = single viewport. After fix: full 20-section scroll via direct DOM fallback.
Scaled (transform: scale) and scrolled-container iframes — native click coordinates must account for the shifted real position of the frame.
Frame src holds the HTTP response for ?delay ms (default 3s), so the frame sits at about:blank through a real network wait before any content exists.
loading='lazy' iframe far below the fold — contentWindow stays about:blank until scrolled into view, so injection must handle a frame that exists long before it loads.
The same iframe element is renavigated/reloaded to a new document after injection; the extension must re-establish frameId and listeners on a frame it has already seen.
Click/type target inside a srcdoc frame (document URL is about:srcdoc, not about:blank) to exercise the marker/injection logic on that path.
Same form at top level, same-origin iframe, and cross-origin iframe. Isolates whether pointer-action (click/input) pre-action screenshots get dropped on the iframe relay path vs the top-level path.
Origin chain parent → cross-origin → back to parent's origin; the postMessage relay must hop across a cross-origin boundary and back to reach the innermost target.
Injects many iframes in one synchronous burst to stress the MutationObserver's 100ms debounce — checks none are dropped. ?count=N.
Removes the iframe and appends a fresh one reusing the same id (SPA route churn) — tests that stale frameId references and listeners are not reused.
Simulates chart notes structure with nested PDF viewer
Clinical notes form with embedded PDF iframe
Full-viewport iframe with 20 tall sections. ?sandboxed=1 loads the iframe with sandbox='allow-same-origin' (scripts disabled → iframeInject can never run → relay always disconnected, but contentDocument accessible). Cleanly isolates the direct DOM fallback fix in getScrollInfo: WITHOUT fix = single viewport screenshot; WITH fix = full 20-section scroll.
Scroll to elements below the fold on a long page
Scrollable containers: log viewer, chat history, horizontal carousel
Terms and Conditions modal with scroll-to-bottom to enable OK button
Nested scrollable containers: sidebar + main content with inner scrollable areas
Content that loads on scroll (pagination trigger, lazy loading)
Scrollable iframes, sticky headers, and CSS scroll-snap
Scrollable dropdown option lists: custom ARIA, native select, hidden JCF-style
Collapsible sections that push content below the fold when expanded
Windowed list (only visible rows in DOM) and overflow:hidden clipped content
Scrollable containers inside shadow DOM and floating popover/tooltip
Smooth scroll, bidirectional grid, CSS transform positioning, keyboard tab focus
Wide strip requiring horizontal scroll to reveal off-screen columns (?layout=page|container). Live window.scrollX readout for verifying left/right scroll.
Target off-screen both down AND right — exercises to-element 2D auto-reveal (scrolls both axes). Live scrollX/scrollY readout.
Like the 2D page but the whole canvas is tiled edge-to-edge with visually-distinct cells (coordinate + token + hue), so every scroll step registers pixel change — no blank stretch that defeats the no-DOM pixel-shift detector. Target is the far bottom-right cell (down AND right). Live scrollX/scrollY readout.
Bordered container scrollable in both axes with a far-right target inside — exercises region find-element / full-container horizontal. Live container.scrollLeft readout.
Target near the top edge that can't be centered (page won't scroll above 0); loads scrolled to the bottom. Verifies scroll-to-element succeeds when the target is revealed but un-centerable at the start boundary.
Wide horizontal grid with a smaller vertical-only notes pane overlapping its center. A horizontal scroll must pick the grid, not the vertical decoy — verifies the builder's axis-filtered container selection. Live grid.scrollLeft + decoyPane.scrollTop readouts.
Numbered rows under a fixed header that appears only after scrolling off the exact top — full-page screenshot stitching must keep rows contiguous with no header duplication mid-page. layout-shift mode swaps in a color bar that's removed on scroll plus a nav header that goes position:fixed (?mode=appear|always|none|layout-shift, ?rows=N, ?headerHeight=N)
Live read of wheel/scroll event ratio, inter-event CV, burst structure, and wheel-to-click gap. Mirrors the admin /admin/fingerprint scoring for localhost iteration.
Measures where native CLICK and INPUT_TEXT actions actually land versus the element center. Y-ladder separates a constant offset from a y-proportional scale error; height-ladder finds the box height at which clicks start missing. Also flags Ctrl+A selections that escape the input.
Progressive loading with overlay, skeletons, lazy content, and delayed dropdowns (?delay=X&stealth=true hides indicators)
VDD divergence trigger: ?state=golden = green ready page with button, ?state=fail = red maintenance screen with no button.
Button appears after configurable delay (?delay=X seconds)
Whole page stays in a loading state for 20 seconds before rendering content
Rich prior-auth list (200+ DOM nodes). Click '+ Create New Request' — form appears after 60s delay. Tests PSL classification and stale cursor fix.
Shows a 503 Service Unavailable page on first paint, then swaps to a normal dashboard after ?dwell seconds — for testing that a stale outage frame in S1 history is not mis-classified as SERVICE_UNAVAILABLE (?dwell=, ?status=)
UHC-style portal: click Create New Request during table load → Information Loading modal → silent fail. Tests PSL prior-frame classification. (?loadDelay=N seconds, default 6)
Form submit → server-side 302 redirect — instant full page navigation kills CS mid-execution
Noridian pattern: processing overlay → massive DOM rewrite (200+ nodes) triggers Plasmo CS teardown/remount
Configurable redirect loop with various redirect methods
Hover dropdowns, hover cards, and scroll-to-agree modal
Test downloading a dynamically generated PDF file
Main-frame navigations to PDF URLs (link, location.href, redirect, form submit) with inline/none/attachment dispositions
PDF opened via target=_blank, window.open, and popup windows with inline/none/attachment dispositions
PDFs as iframe src (sub_frame) with inline/none/attachment dispositions, plus JS-set src
PDFs via embed and object tags with inline/none/attachment dispositions
Client-side generated blob: and data: PDFs — navigation, new tab, iframe, embed, anchor download
Network-fetched PDF wrapped in a blob (configurable MIME) shown in a 'Progress Note Preview' modal iframe — mirrors Aarista/charta. Tests blob capture and new-tab auto-download vs. the dead download stub
Three distinct PDFs as iframes on one page — tests multi-file capture (upload all)
Single-use-token PDF (proves token-safe tshark capture) and a ~15MB PDF (large reassembly)
Configurable large file download (up to 500MB) for testing file handling
Tests 10 different download methods with a known binary file to diagnose corruption
Controllable download target for network-signal classification (?mode=sync|async, ?status=, ?delay=, ?drip=1&dripMs=, ?size=, ?redirect=). Triggers a real browser download so the network listener captures server-side download failures (404/500/503, slow/drip timeout, redirect-to-login, async export).
Printable certification page with 15 iframes. Use with trigger_print in a tab-churn loop to measure per-iteration degradation (?patient, ?cert_date, ?office, ?provider, ?delay)
Multi-step form with random popups and conditional fields
OASIS-style clinical assessment across 3 tabs
Display page showing tracking status (reached via /shipping)
Login with 2FA, then paginated claims table with lookup and EOB downloads
Tabbed medical portal (Claims, Eligibility, Auth) for testing enrichment classification
Video→workflow testbed: conditional reveal (radio→wound section), custom non-native dropdown, 0..N add-wound loop, format-sensitive date, validation gating, and destructive buttons. Variants: ?wounds=yes|no, ?date=us|iso, ?pain=short|long, ?strict=1
Stable id/class/position on every load. GREEN path — graduated xpath resolves cleanly.
Rotating button id; role/aria stable. YELLOW path — cascade recovers and fingerprint matches.
?variant=a|b swaps Submit and Cancel at the same position. Tests fingerprint-mismatch immediate revert.
?show=false removes the button entirely. Tests cascade-exhausted AI fallback and hard failure.
Stable input id/name/label for input_text graduation. GREEN path for the input_text action type.
Rotating input id/name, stable label/aria/testid. YELLOW path for input_text cascade recovery.
Five Submit buttons reshuffled on every load. Tests the observing/candidate → disqualified path.
?broken=true rotates a graduated button's id without removing the element. Tests post-graduation silent xpath failure → revert.
?broken=true renames the table id so STATIC extract_datamodel misses. With enable_llm_dom_fallback=true on the node and ENABLE_LLM_DOM_FALLBACK=true on the backend, the run rescues via LLM_DOM.
Patient table inside iframe-within-iframe. STATIC only traverses one iframe level; LLM_DOM with recursive serialization extracts correctly.
Claims data rendered on <canvas> (simulating PDF viewer). Zero DOM text nodes — only LLM_VISION can read the rendered pixels.
Medication table inside shadow root within shadow root. XPath cannot cross shadow boundaries; requires LLM_DOM with shadow serialization or LLM_VISION.
Schedule table renders after JS delay (?delay=5000). With ?randomize=true the container ID changes each load. STATIC fires against empty DOM; LLM_DOM captures the settled state.
Benefits data inside a cross-origin iframe. contentDocument is null; LLM_DOM cannot serialize it. Only LLM_VISION (screenshot compositing) works.
200 claims in a virtual-scrolling list — only ~20 rows exist in the DOM at once. Tests partial extraction and scroll+extract patterns.
Puts a known string on the OS clipboard (Copy button, or select the textarea + Ctrl/Cmd+C) so a STATIC EXTRACT_DATAMODEL node sourced from {{clipboard}} reads it back exactly, for native/no-DOM apps (RDP/DCV) where content isn't in the page DOM. Also has a copy-per-row harvest loop (Copy next row + ?delay= to simulate copy-sync lag) for testing extract inside a LOOP. ?variant=simple|multiline|unicode|xml, ?text=custom. Synthetic data (no PHI).
Fires the same URL (/api/method-echo) with GET/POST/PUT/PATCH/DELETE, each returning a method-tagged payload. Verifies EXTRACT_NETWORK's HTTP-method filter selects the right response when one URL is hit by many methods. ?auto=1 fires all on load; ?methods=GET,POST limits which.
Fires a no-cors fetch to a Cloudflare endpoint that publishes DNS HTTPS records (Chrome reliably picks HTTP/3). Pair with EXTRACT_NETWORK on the same URL to verify whether our tshark-on-cc_tun0 capture stack sees HTTP/3 traffic. The trace response body contains an http= line revealing which protocol Chrome actually used. ?target=<url>, ?iter=N, ?auto=0.
Fires a burst of concurrent requests at an external origin (?origin=, default postman-echo.com — must NOT be *.cloudcruise.com/.app, which cc_tshark_event_mapper.py hard-skips) plus one named marker request, to reproduce the concurrent-HTTP/2-connection shape behind a real EXTRACT_NETWORK decode gap (session 9d72c5f4: 22 TLS handshakes logged, only 4 decoded, none from the busy app domain). ?concurrency=, ?minDelay=/?maxDelay= (client-side stagger), ?bytes=. Also fires a same-origin control burst (?control=0 to skip) that should NEVER be captured, proving the hard-skip filter rather than the decode race. Must be served over TLS/HTTP2 (not the plain-HTTP dev server).
One distinct, fixed-position 'Download Report' button with stable pixels. Click it via LLM_VISION: first run grounds + caches the crop, a repeat run re-locates it with no VLM (DIRECT). ?theme=dark flips colors but keeps structure — Sobel matching should still hit.
Two visually-identical blank input fields. A DIRECT crop cross-matches both, so the password field binds to its 'Password' label anchor + offset and verifies landing before clicking. ?filled=true prefills email to prove the label anchor stays stable.
A row of N identical 'Select' buttons (?count=N, default 5). None is visually unique, so the matcher's top-2 margin is ~0 and it must abstain and defer to the VLM rather than guess (precision over recall).
Same fixed slot, different element by query: ?state=a blue 'Submit' (default), ?state=b green 'Cancel', ?show=false nothing. Cache on a, re-run on b — the cached crop should fail structural match and abstain, not mis-click.
Four-step sequential flow (Start → Add Details → Review → Submit), each step revealing the next distinct LLM_VISION target. Chains four vision clicks into four independent cache entries; a repeat run should produce four consecutive L1 hits.
Eval substrate for the dynamic-intent guard. ?case=<id> renders one realistic widget with a single target (data-testid="target"). 15 dynamic targets that must NOT cache (today's date, latest order, default card, primary contact, recommended plan, cheapest/oldest, next-available slot, selected/unread/new/your-task/pending, top result, highest bid) + 6 fixed controls whose labels merely contain a relative word and MUST stay cacheable (Today button, Sort-Newest toggle, Default-View tab, Primary tab, New button, Featured filter).
Five-step click-through for the prompt-only dynamic classifier + cache persistence: 2 static targets (Open records, Submit) that build then hit, 2 dynamic targets that reshuffle every load (the Globex Inc. account row and the highlighted tile) that must log skip_dynamic and re-ground, plus 1 tricky-static control ('Sort by Newest') that must stay cacheable. A red banner flags a dynamic target that got cached and mis-fired.
Pixel-identical button whose onClick is rewired to a destructive action on run 2 (?variant=build|attack). Cache is purely visual — predicted FALSE HIT (confident wrong click).
Safe button cached at a slot; on run 2 a pixel-identical destructive decoy takes that slot while the real button moves out of search_radius=240 (?variant=build|attack). Predicted FALSE HIT.
Approve $50 → $5000: meaning flips but Sobel structure stays >accept_score=0.85 (?variant=build|attack, ?digits=long stresses the boundary). Predicted FALSE HIT (long → safe abstain).
Featureless field anchored on a distant heading; run 2 inserts an identical field between them so heading+offset drifts onto the twin and loose verify passes (?variant=build|attack). FALSE HIT on the anchored path (Obs 15).
Forces an L1 miss with a transient decoy present so the unconditional build() overwrites the good entry with bad pixels/coords (?variant=build|miss-poison|attack). Predicted durable POISON → FALSE HIT.
DIRECT locate uses scales=[1.0] only; run 2 enlarges the real target out of band and plants a same-1.0x decoy in-window (?variant=build|attack, ?zoom=, ?decoy=off). FALSE HIT (decoy on) / SAFE ABSTAIN (decoy off).
No per-field labels, so the featureless box is forced to anchor on a distant 'Billing' heading that can't co-move; run 2 inserts an identical box between them so heading+offset drifts onto the twin and loose verify passes (?variant=build|attack). Predicted FALSE HIT — the genuine anchored-drift trigger #4 missed.
Structure-preserving relabel on a fixed-geometry, same-color button: Confirm→Cancel or Pay $50→£50 (?variant=build|attack, ?case=confirm-cancel|currency). Sobel stays >accept_score=0.85 so the cache HITS the meaning-flipped button — the case #3 only abstained on by luck. Predicted FALSE HIT; motivates an OCR/CLIP semantic veto.
Target invoice row sits below the fold → a grounding/CLICK node must scroll the container until it's visible, then act. ?scroll=inner|page, ?count=N (vary target depth between build/replay), ?target=N, ?present=false (remove target → end-of-scroll FAIL). OCR-friendly unique row ids for the cold OCR-gated pass.
Icon-only cold-path weak spot: a distinctive star badge below the fold among repeated low-distinctiveness filler glyphs. No text → cold OCR pre-filter can't help; warm pass relocates the cached glyph. ?scroll=inner|page, ?count=N, ?target=N, ?present=false.
Target lives in a scrollable side panel (not the page), off-center so it doesn't sit under the agent's fixed blind-scroll cursor — tests whether scroll-to-target works for paneled UIs. ?side=left|right, ?count=N, ?target=N, ?present=false.
People names (non-sequential, fixed array) in a small centered overflow-y-auto box — removes the ordinal cue invoice numbers gave the grounder, to test whether it can scroll to a target it can't locate by number. ?count=N, ?target=N, ?present=false.
Names in a WIDE fixed-height scrollable container that spans past both observed scroll aim points (x~495, x~960) so the wheel reliably hits it — isolates the numbers-vs-names scroll-inference question without the small-box physical-miss confound. ?count=N, ?target=N, ?present=false.
NextGen-style modal: form fields + OK/Cancel/Clear/Search and a SMALL scrollable results grid (own scrollbar) in the lower portion, target location row below its fold. Reproduces the customer pattern where the wheel must land inside a small off-center sub-region. ?offset=left|center|right, ?count=N, ?target=N, ?present=false.
Tight desktop-style data grid where every row shares a long common prefix (Capitol Pain Institute-Corporate / -Dixie / -Elizabethtown) and the click target is the NAME cell — probes whether the bbox-from-click template crop bleeds adjacent rows and whether a prefix-dominated crop is distinctive enough to relocate the right row. ?dataset=locations|names, ?target=N, ?count=N, ?gap=N (row padding px).
A deterministic grid of uniquely-labelled tiles (Amber Falcon, Cobalt Otter, ...) for exercising the L1 visual-cache PRELOAD at scale — a workflow clicks N distinct tiles so the run relies on N cache entries. Clicking only adds a 'done' highlight, so the layout never shifts and cached crops keep matching across cold/warm runs. ?count=N (default 30), ?cols=N (default 6).
A CareTend-style 'Select Generic Equivalent' grid whose column headers each carry a tiny, closely-spaced filter-funnel icon (plus a small dropdown ▼ and stacked ▲/▼ number spinners) — the hostile targets for high-precision visual grounding. Every control writes a verifiable data-testid='last-action' readout (and funnels open a labeled data-testid='filter-popup') so a workflow can confirm WHICH element was clicked. ?density=compact|normal, ?cols=5|7|9 (funnel spacing), ?dupes=on|off (repeated row names), ?scale=0.75|1|1.25 (resolution/DPI).
The expected #submit-btn control is absent by default so a workflow selector matches nothing (produces XPATH_INCORRECT). ?present=true renders it (control/success case). Used by the unified-eval e2e harness.
Clear 404 UI, returns HTTP 404 by default; ?soft=true for a soft 404 (HTTP 200 + 404 content). Produces PAGE_NOT_FOUND.
Results table is empty by default so a workflow expecting rows sees 'No results' (produces EMPTY_STATE). ?rows=N populates the table.
503 outage page, returns HTTP 503 by default; ?status=200 serves the same content with 200. Produces SERVICE_UNAVAILABLE.
Fifteen-module legacy EHR on WebForms-style postbacks, AngularJS 1.8, Knockout 3.5, Ext-style grids, a real HTML 4 frameset, and jQuery + Bootstrap 3. The launcher lists every module plus 20 recovery scenarios as deterministic ?fault= links.
Five-step WebForms wizard over 37 fields with per-step server validation; partially entered steps persist in ViewState rather than the DOM.
Provider day view of 120 near-identical Available slots, each its own __doPostBack target. Dense ambiguous-target grid for grounding tests.
Expand/collapse result rows with nested analyte tables, H/L/critical flags, select-all, and a critical-value acknowledgement gate.
Debounced medication typeahead rendered outside the input, live sig preview, and a static-backdrop interaction alert requiring a checkbox plus a typed override reason.
Knockout 3.5 observable service lines with computed line and encounter totals. foreach-generated rows carry no stable ids.
Document queue with an inline PDF preview iframe, a real file input, and a scanner simulation driving a multi-step progress modal.
Real HTML 4.01 <frameset>: folders, list, and preview are three sibling documents navigating each other via parent.frames. Not iframes.
ASP.NET WebForms simulation: __VIEWSTATE, __EVENTVALIDATION, ctl00$cphMain$ control names, full-page postbacks. Sign in as clinician / meridian2026.
240-record GridView with __doPostBack sorting and paging; search criteria live in ViewState rather than the URL.
AngularJS 1.8 chart with ng-repeat lists, late ng-if mounting, ng-disabled gating, and a scope-bound modal. ?fault=ghost discards input typed before the model binds.
Ext-style buffered grid in an iframe: only visible rows exist in the DOM, ids regenerate per render pass, and combobox options render in a body-level floating layer.
jQuery 1.9 + Bootstrap 3 note editor with a contenteditable iframe body and a sign-off modal gated on an attestation checkbox.
CMS-1500 style form post with server-side validation, post/redirect/get, and an acknowledgement page. Main target for the mid-form and silent-no-op faults.
Renders success-flag once its own change handler sees the required text in full; ?suppress=flag withholds the flag on a match. Read by e2e/cases/actions/input-text/basic.
Renders success-flag once its own change handler sees the required option committed; ?suppress=flag withholds the flag on a match. Read by e2e/cases/actions/input-select/basic.
Target sits four viewport heights down; success-flag is gated on an IntersectionObserver, not on a scroll event. ?suppress=flag withholds the flag. Read by e2e/cases/actions/scroll/basic.
Reads the bytes it received and renders success-flag only if name and contents match public/e2e/upload-fixture.txt; ?suppress=flag withholds the flag. Read by e2e/cases/actions/file-upload/basic.
Three pages of two fixed rows; Next page wraps back to the first. No success-flag — the verdict is the accumulated dataset. Read by e2e/cases/actions/loop/pagination.
Uncontrolled field and dropdown starting on values the case never uses, so live state differs from the initial markup. No success-flag — reading raw state is the feature under test. Read by e2e/cases/actions/extract-datamodel/raw-state.
Mints a session cookie only for the exact credential the vault provisions; anything else comes back as ?error=invalid with no session. Read by e2e/cases/flows/authenticated-extraction.
Cookie-gated claims table, three server-rendered pages of two fixed rows that wrap, plus a statement download. Redirects to the login when the session is missing, so unauthenticated extraction finds nothing. Read by e2e/cases/flows/authenticated-extraction.
Cookie-gated detail view the case opens in a second tab with TAB_MANAGEMENT. Counts its own acknowledge clicks, so a node that runs twice or runs against the opener's DOM shows up in the extracted data. ?claim=CLM-4104 picks the claim; ?ack_step=2 makes each click count twice, to show the assertion failing. Read by e2e/cases/flows/authenticated-extraction.
Part of the CloudCruise browser automation platform