diff --git a/server/lib/cdpmonitor/cdp_test.go b/server/lib/cdpmonitor/cdp_test.go
new file mode 100644
index 00000000..905b652a
--- /dev/null
+++ b/server/lib/cdpmonitor/cdp_test.go
@@ -0,0 +1,367 @@
+package cdpmonitor
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"image"
+	"image/color"
+	"image/png"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/coder/websocket/wsjson"
+	"github.com/onkernel/kernel-images/server/lib/events"
+	"github.com/stretchr/testify/require"
+)
+
+// minimalPNG is a valid 1x1 PNG used as a test fixture for screenshot tests.
+var minimalPNG = func() []byte {
+	img := image.NewRGBA(image.Rect(0, 0, 1, 1))
+	img.Set(0, 0, color.RGBA{R: 255, G: 0, B: 0, A: 255})
+	var buf bytes.Buffer
+	_ = png.Encode(&buf, img)
+	return buf.Bytes()
+}()
+
+// testServer is a minimal WebSocket server that accepts connections and
+// lets the test drive scripted message sequences.
+type testServer struct {
+	srv    *httptest.Server
+	conn   *websocket.Conn
+	connMu sync.Mutex
+	connCh chan struct{} // closed when the first connection is accepted
+	msgCh  chan []byte   // inbound messages from Monitor
+}
+
+func newTestServer(t *testing.T) *testServer {
+	t.Helper()
+	s := &testServer{
+		msgCh:  make(chan []byte, 128),
+		connCh: make(chan struct{}),
+	}
+	var connOnce sync.Once
+	s.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c, err := websocket.Accept(w, r, &websocket.AcceptOptions{InsecureSkipVerify: true})
+		if err != nil {
+			return
+		}
+		s.connMu.Lock()
+		s.conn = c
+		s.connMu.Unlock()
+		connOnce.Do(func() { close(s.connCh) })
+		go func() {
+			for {
+				_, b, err := c.Read(context.Background())
+				if err != nil {
+					return
+				}
+				s.msgCh <- b
+			}
+		}()
+	}))
+	return s
+}
+
+func (s *testServer) wsURL() string {
+	return "ws" + strings.TrimPrefix(s.srv.URL, "http")
+}
+
+func (s *testServer) sendToMonitor(t *testing.T, msg any) {
+	t.Helper()
+	s.connMu.Lock()
+	c := s.conn
+	s.connMu.Unlock()
+	require.NotNil(t, c, "no active connection")
+	require.NoError(t, wsjson.Write(context.Background(), c, msg))
+}
+
+func (s *testServer) readFromMonitor(t *testing.T, timeout time.Duration) cdpMessage {
+	t.Helper()
+	select {
+	case b := <-s.msgCh:
+		var msg cdpMessage
+		require.NoError(t, json.Unmarshal(b, &msg))
+		return msg
+	case <-time.After(timeout):
+		t.Fatal("timeout waiting for message from Monitor")
+		return cdpMessage{}
+	}
+}
+
+func (s *testServer) close() {
+	s.connMu.Lock()
+	if s.conn != nil {
+		_ = s.conn.Close(websocket.StatusNormalClosure, "done")
+	}
+	s.connMu.Unlock()
+	s.srv.Close()
+}
+
+// testUpstream implements UpstreamProvider for tests.
+type testUpstream struct {
+	mu      sync.Mutex
+	current string
+	subs    []chan string
+}
+
+func newTestUpstream(url string) *testUpstream {
+	return &testUpstream{current: url}
+}
+
+func (u *testUpstream) Current() string {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.current
+}
+
+func (u *testUpstream) Subscribe() (<-chan string, func()) {
+	ch := make(chan string, 1)
+	u.mu.Lock()
+	u.subs = append(u.subs, ch)
+	u.mu.Unlock()
+	cancel := func() {
+		u.mu.Lock()
+		for i, s := range u.subs {
+			if s == ch {
+				u.subs = append(u.subs[:i], u.subs[i+1:]...)
+				break
+			}
+		}
+		u.mu.Unlock()
+		close(ch)
+	}
+	return ch, cancel
+}
+
+func (u *testUpstream) notifyRestart(newURL string) {
+	u.mu.Lock()
+	u.current = newURL
+	subs := make([]chan string, len(u.subs))
+	copy(subs, u.subs)
+	u.mu.Unlock()
+	for _, ch := range subs {
+		select {
+		case ch <- newURL:
+		default:
+		}
+	}
+}
+
+// eventCollector captures published events with channel-based notification.
+type eventCollector struct {
+	mu     sync.Mutex
+	events []events.Event
+	notify chan struct{} // signaled on every publish
+}
+
+func newEventCollector() *eventCollector {
+	return &eventCollector{notify: make(chan struct{}, 256)}
+}
+
+func (c *eventCollector) publishFn() PublishFunc {
+	return func(ev events.Event) {
+		c.mu.Lock()
+		c.events = append(c.events, ev)
+		c.mu.Unlock()
+		select {
+		case c.notify <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// waitFor blocks until an event of the given type is published, or fails.
+func (c *eventCollector) waitFor(t *testing.T, eventType string, timeout time.Duration) events.Event {
+	t.Helper()
+	deadline := time.After(timeout)
+	for {
+		c.mu.Lock()
+		for _, ev := range c.events {
+			if ev.Type == eventType {
+				c.mu.Unlock()
+				return ev
+			}
+		}
+		c.mu.Unlock()
+		select {
+		case <-c.notify:
+		case <-deadline:
+			t.Fatalf("timeout waiting for event type=%q", eventType)
+			return events.Event{}
+		}
+	}
+}
+
+// waitForNew blocks until a NEW event of the given type is published after this
+// call, ignoring any events already in the collector.
+func (c *eventCollector) waitForNew(t *testing.T, eventType string, timeout time.Duration) events.Event {
+	t.Helper()
+	c.mu.Lock()
+	skip := len(c.events)
+	c.mu.Unlock()
+
+	deadline := time.After(timeout)
+	for {
+		c.mu.Lock()
+		for i := skip; i < len(c.events); i++ {
+			if c.events[i].Type == eventType {
+				ev := c.events[i]
+				c.mu.Unlock()
+				return ev
+			}
+		}
+		c.mu.Unlock()
+		select {
+		case <-c.notify:
+		case <-deadline:
+			t.Fatalf("timeout waiting for new event type=%q", eventType)
+			return events.Event{}
+		}
+	}
+}
+
+// assertNone verifies that no event of the given type arrives within d.
+func (c *eventCollector) assertNone(t *testing.T, eventType string, d time.Duration) {
+	t.Helper()
+	deadline := time.After(d)
+	for {
+		select {
+		case <-c.notify:
+			c.mu.Lock()
+			for _, ev := range c.events {
+				if ev.Type == eventType {
+					c.mu.Unlock()
+					t.Fatalf("unexpected event %q published", eventType)
+					return
+				}
+			}
+			c.mu.Unlock()
+		case <-deadline:
+			return
+		}
+	}
+}
+
+// ResponderFunc is called for each CDP command the Monitor sends.
+// Return nil to use the default empty result.
+type ResponderFunc func(msg cdpMessage) any
+
+// listenAndRespond drains srv.msgCh, calls fn for each command, and sends the
+// response. If fn is nil or returns nil, sends {"id": msg.ID, "result": {}}.
+func listenAndRespond(srv *testServer, stopCh <-chan struct{}, fn ResponderFunc) {
+	for {
+		select {
+		case b := <-srv.msgCh:
+			var msg cdpMessage
+			if json.Unmarshal(b, &msg) != nil || msg.ID == nil {
+				continue
+			}
+			srv.connMu.Lock()
+			c := srv.conn
+			srv.connMu.Unlock()
+			if c == nil {
+				continue
+			}
+			var resp any
+			if fn != nil {
+				resp = fn(msg)
+			}
+			if resp == nil {
+				resp = map[string]any{"id": msg.ID, "result": map[string]any{}}
+			}
+			_ = wsjson.Write(context.Background(), c, resp)
+		case <-stopCh:
+			return
+		}
+	}
+}
+
+// startMonitor creates a Monitor against srv, starts it, waits for the
+// connection, and launches a responder goroutine. Returns cleanup func.
+func startMonitor(t *testing.T, srv *testServer, fn ResponderFunc) (*Monitor, *eventCollector, func()) {
+	t.Helper()
+	ec := newEventCollector()
+	upstream := newTestUpstream(srv.wsURL())
+	m := New(upstream, ec.publishFn(), 99)
+	require.NoError(t, m.Start(context.Background()))
+
+	stopResponder := make(chan struct{})
+	go listenAndRespond(srv, stopResponder, fn)
+
+	// Wait for the websocket connection to be established.
+	select {
+	case <-srv.connCh:
+	case <-time.After(3 * time.Second):
+		t.Fatal("fake server never received a connection")
+	}
+	// Wait for the init sequence (setAutoAttach + domain enables + script injection
+	// + getTargets) to complete. The responder goroutine handles all responses;
+	// we just need to wait for the burst to finish.
+	waitForInitDone(t)
+
+	cleanup := func() {
+		close(stopResponder)
+		m.Stop()
+	}
+	return m, ec, cleanup
+}
+
+// waitForInitDone waits for the Monitor's init sequence to complete by
+// detecting a 100ms gap in activity on the message channel. The responder
+// goroutine handles responses; this just waits for the burst to end.
+func waitForInitDone(t *testing.T) {
+	t.Helper()
+	// The init sequence sends ~8 commands. Wait until the responder has
+	// processed them all by checking for a quiet period.
+	deadline := time.After(5 * time.Second)
+	for {
+		select {
+		case <-time.After(100 * time.Millisecond):
+			return
+		case <-deadline:
+			t.Fatal("init sequence did not complete")
+		}
+	}
+}
+
+// newComputedMonitor creates an unconnected Monitor for testing computed state
+// (network_idle, layout_settled, navigation_settled) without a real websocket.
+func newComputedMonitor(t *testing.T) (*Monitor, *eventCollector) {
+	t.Helper()
+	ec := newEventCollector()
+	upstream := newTestUpstream("ws://127.0.0.1:0")
+	m := New(upstream, ec.publishFn(), 0)
+	return m, ec
+}
+
+// navigateMonitor sends a Page.frameNavigated to reset computed state.
+func navigateMonitor(m *Monitor, url string) {
+	p, _ := json.Marshal(map[string]any{
+		"frame": map[string]any{"id": "f1", "url": url},
+	})
+	m.handleFrameNavigated(p, "s1")
+}
+
+// simulateRequest sends a Network.requestWillBeSent through the handler.
+func simulateRequest(m *Monitor, id string) {
+	p, _ := json.Marshal(map[string]any{
+		"requestId": id, "resourceType": "Document",
+		"request": map[string]any{"method": "GET", "url": "https://example.com/" + id},
+	})
+	m.handleNetworkRequest(p, "s1")
+}
+
+// simulateFinished stores minimal state and sends Network.loadingFinished.
+func simulateFinished(m *Monitor, id string) {
+	m.pendReqMu.Lock()
+	m.pendingRequests[id] = networkReqState{method: "GET", url: "https://example.com/" + id}
+	m.pendReqMu.Unlock()
+	p, _ := json.Marshal(map[string]any{"requestId": id})
+	m.handleLoadingFinished(p, "s1")
+}
diff --git a/server/lib/cdpmonitor/computed.go b/server/lib/cdpmonitor/computed.go
new file mode 100644
index 00000000..576a28c6
--- /dev/null
+++ b/server/lib/cdpmonitor/computed.go
@@ -0,0 +1,196 @@
+package cdpmonitor
+
+import (
+	"encoding/json"
+	"sync"
+	"time"
+
+	"github.com/onkernel/kernel-images/server/lib/events"
+)
+const (
+	networkIdleDebounce  = 500 * time.Millisecond
+	layoutSettledDebounce = 1 * time.Second
+)
+
+// computedState holds the mutable state for all computed meta-events.
+type computedState struct {
+	mu      sync.Mutex
+	publish PublishFunc
+
+	// navSeq is incremented on every resetOnNavigation. AfterFunc callbacks
+	// capture their navSeq at creation and bail if it has changed, preventing
+	// stale timers from publishing events for a previous navigation.
+	navSeq int
+
+	// network_idle: 500 ms debounce after all pending requests finish.
+	netPending int
+	netTimer   *time.Timer
+	netFired   bool
+
+	// layout_settled: 1s after page_load with no intervening layout shifts.
+	layoutTimer  *time.Timer
+	layoutFired  bool
+	pageLoadSeen bool
+
+	// navigation_settled: fires once dom_content_loaded, network_idle, and
+	// layout_settled have all fired after the same Page.frameNavigated.
+	navDOMLoaded     bool
+	navNetIdle       bool
+	navLayoutSettled bool
+	navFired         bool
+}
+
+// newComputedState creates a fresh computedState backed by the given publish func.
+func newComputedState(publish PublishFunc) *computedState {
+	return &computedState{publish: publish}
+}
+
+func stopTimer(t *time.Timer) {
+	if t == nil {
+		return
+	}
+	if !t.Stop() {
+		select {
+		case <-t.C:
+		default:
+		}
+	}
+}
+
+// resetOnNavigation resets all state machines. Called on Page.frameNavigated.
+// Increments navSeq so any AfterFunc callbacks already running will discard their results.
+func (s *computedState) resetOnNavigation() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.navSeq++
+
+	stopTimer(s.netTimer)
+	s.netTimer = nil
+	s.netPending = 0
+	s.netFired = false
+
+	stopTimer(s.layoutTimer)
+	s.layoutTimer = nil
+	s.layoutFired = false
+	s.pageLoadSeen = false
+
+	s.navDOMLoaded = false
+	s.navNetIdle = false
+	s.navLayoutSettled = false
+	s.navFired = false
+}
+
+func (s *computedState) onRequest() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.netPending++
+	// A new request invalidates any pending network_idle timer
+	stopTimer(s.netTimer)
+	s.netTimer = nil
+}
+
+// onLoadingFinished is called on Network.loadingFinished or Network.loadingFailed.
+func (s *computedState) onLoadingFinished() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.netPending--
+	if s.netPending < 0 {
+		s.netPending = 0
+	}
+	if s.netPending > 0 || s.netFired {
+		return
+	}
+	// All requests done and not yet fired: start 500ms debounce timer.
+	stopTimer(s.netTimer)
+	navSeq := s.navSeq
+	s.netTimer = time.AfterFunc(networkIdleDebounce, func() {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		if s.navSeq != navSeq || s.netFired || s.netPending > 0 {
+			return
+		}
+		s.netFired = true
+		s.navNetIdle = true
+		s.publish(events.Event{
+			Ts:          time.Now().UnixMilli(),
+			Type:        EventNetworkIdle,
+			Category:    events.CategoryNetwork,
+			Source:      events.Source{Kind: events.KindCDP},
+			DetailLevel: events.DetailStandard,
+			Data:        json.RawMessage(`{}`),
+		})
+		s.checkNavigationSettled()
+	})
+}
+
+// onPageLoad is called on Page.loadEventFired.
+func (s *computedState) onPageLoad() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.pageLoadSeen = true
+	if s.layoutFired {
+		return
+	}
+	// Start the 1s layout_settled timer.
+	stopTimer(s.layoutTimer)
+	navSeq := s.navSeq
+	s.layoutTimer = time.AfterFunc(layoutSettledDebounce, func() { s.emitLayoutSettled(navSeq) })
+}
+
+// onLayoutShift is called when a layout_shift sentinel arrives from injected JS.
+func (s *computedState) onLayoutShift() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.layoutFired || !s.pageLoadSeen {
+		return
+	}
+	// Reset the timer to 1s from now.
+	stopTimer(s.layoutTimer)
+	navSeq := s.navSeq
+	s.layoutTimer = time.AfterFunc(layoutSettledDebounce, func() { s.emitLayoutSettled(navSeq) })
+}
+
+// emitLayoutSettled is called from the layout timer's AfterFunc goroutine.
+func (s *computedState) emitLayoutSettled(navSeq int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.navSeq != navSeq || s.layoutFired || !s.pageLoadSeen {
+		return
+	}
+	s.layoutFired = true
+	s.navLayoutSettled = true
+	s.publish(events.Event{
+		Ts:          time.Now().UnixMilli(),
+		Type:        EventLayoutSettled,
+		Category:    events.CategoryPage,
+		Source:      events.Source{Kind: events.KindCDP},
+		DetailLevel: events.DetailStandard,
+		Data:        json.RawMessage(`{}`),
+	})
+	s.checkNavigationSettled()
+}
+
+// onDOMContentLoaded is called on Page.domContentEventFired.
+func (s *computedState) onDOMContentLoaded() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.navDOMLoaded = true
+	s.checkNavigationSettled()
+}
+
+// checkNavigationSettled emits navigation_settled if all three flags are set
+func (s *computedState) checkNavigationSettled() {
+	if s.navDOMLoaded && s.navNetIdle && s.navLayoutSettled && !s.navFired {
+		s.navFired = true
+		s.publish(events.Event{
+			Ts:          time.Now().UnixMilli(),
+			Type:        EventNavigationSettled,
+			Category:    events.CategoryPage,
+			Source:      events.Source{Kind: events.KindCDP},
+			DetailLevel: events.DetailStandard,
+			Data:        json.RawMessage(`{}`),
+		})
+	}
+}
diff --git a/server/lib/cdpmonitor/computed_test.go b/server/lib/cdpmonitor/computed_test.go
new file mode 100644
index 00000000..888b4c80
--- /dev/null
+++ b/server/lib/cdpmonitor/computed_test.go
@@ -0,0 +1,108 @@
+package cdpmonitor
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/onkernel/kernel-images/server/lib/events"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNetworkIdle(t *testing.T) {
+	t.Run("debounce_500ms", func(t *testing.T) {
+		m, ec := newComputedMonitor(t)
+		navigateMonitor(m, "https://example.com")
+
+		simulateRequest(m, "r1")
+		simulateRequest(m, "r2")
+		simulateRequest(m, "r3")
+
+		t0 := time.Now()
+		simulateFinished(m, "r1")
+		simulateFinished(m, "r2")
+		simulateFinished(m, "r3")
+
+		ev := ec.waitFor(t, "network_idle", 2*time.Second)
+		assert.GreaterOrEqual(t, time.Since(t0).Milliseconds(), int64(400), "fired too early")
+		assert.Equal(t, events.CategoryNetwork, ev.Category)
+	})
+
+	t.Run("timer_reset_on_new_request", func(t *testing.T) {
+		m, ec := newComputedMonitor(t)
+		navigateMonitor(m, "https://example.com")
+
+		simulateRequest(m, "a1")
+		simulateFinished(m, "a1")
+		time.Sleep(200 * time.Millisecond)
+
+		simulateRequest(m, "a2")
+		t1 := time.Now()
+		simulateFinished(m, "a2")
+
+		ec.waitFor(t, "network_idle", 2*time.Second)
+		assert.GreaterOrEqual(t, time.Since(t1).Milliseconds(), int64(400), "should reset timer on new request")
+	})
+}
+
+func TestLayoutSettled(t *testing.T) {
+	t.Run("debounce_1s_after_page_load", func(t *testing.T) {
+		m, ec := newComputedMonitor(t)
+		navigateMonitor(m, "https://example.com")
+
+		t0 := time.Now()
+		m.handleLoadEventFired(json.RawMessage(`{}`), "s1")
+
+		ev := ec.waitFor(t, "layout_settled", 3*time.Second)
+		assert.GreaterOrEqual(t, time.Since(t0).Milliseconds(), int64(900), "fired too early")
+		assert.Equal(t, events.CategoryPage, ev.Category)
+	})
+
+	t.Run("layout_shift_resets_timer", func(t *testing.T) {
+		m, ec := newComputedMonitor(t)
+		navigateMonitor(m, "https://example.com")
+		m.handleLoadEventFired(json.RawMessage(`{}`), "s1")
+
+		time.Sleep(600 * time.Millisecond)
+		shiftParams, _ := json.Marshal(map[string]any{
+			"event": map[string]any{"type": "layout-shift"},
+		})
+		m.handleTimelineEvent(shiftParams, "s1")
+		t1 := time.Now()
+
+		ec.waitFor(t, "layout_settled", 3*time.Second)
+		assert.GreaterOrEqual(t, time.Since(t1).Milliseconds(), int64(900), "should reset after layout_shift")
+	})
+}
+
+func TestNavigationSettled(t *testing.T) {
+	t.Run("fires_when_all_three_flags_set", func(t *testing.T) {
+		m, ec := newComputedMonitor(t)
+		navigateMonitor(m, "https://example.com")
+
+		m.handleDOMContentLoaded(json.RawMessage(`{}`), "s1")
+
+		simulateRequest(m, "r1")
+		simulateFinished(m, "r1")
+
+		m.handleLoadEventFired(json.RawMessage(`{}`), "s1")
+
+		ev := ec.waitFor(t, "navigation_settled", 3*time.Second)
+		assert.Equal(t, events.CategoryPage, ev.Category)
+	})
+
+	t.Run("interrupted_by_new_navigation", func(t *testing.T) {
+		m, ec := newComputedMonitor(t)
+		navigateMonitor(m, "https://example.com")
+
+		m.handleDOMContentLoaded(json.RawMessage(`{}`), "s1")
+
+		simulateRequest(m, "r2")
+		simulateFinished(m, "r2")
+
+		// Interrupt before layout_settled fires.
+		navigateMonitor(m, "https://example.com/page2")
+
+		ec.assertNone(t, "navigation_settled", 1500*time.Millisecond)
+	})
+}
diff --git a/server/lib/cdpmonitor/domains.go b/server/lib/cdpmonitor/domains.go
new file mode 100644
index 00000000..31315f07
--- /dev/null
+++ b/server/lib/cdpmonitor/domains.go
@@ -0,0 +1,44 @@
+package cdpmonitor
+
+import (
+	"context"
+	_ "embed"
+)
+
+// bindingName is the JS function exposed via Runtime.addBinding.
+// Page JS calls this to fire Runtime.bindingCalled CDP events.
+const bindingName = "__kernelEvent"
+
+// enableDomains enables CDP domains, registers the event binding, and starts
+// layout-shift observation. Failures are non-fatal.
+func (m *Monitor) enableDomains(ctx context.Context, sessionID string) {
+	for _, method := range []string{
+		"Runtime.enable",
+		"Network.enable",
+		"Page.enable",
+	} {
+		_, _ = m.send(ctx, method, nil, sessionID)
+	}
+
+	_, _ = m.send(ctx, "Runtime.addBinding", map[string]any{
+		"name": bindingName,
+	}, sessionID)
+
+	_, _ = m.send(ctx, "PerformanceTimeline.enable", map[string]any{
+		"eventTypes": []string{"layout-shift"},
+	}, sessionID)
+}
+
+// injectedJS tracks clicks, keys, and scrolls via the __kernelEvent binding.
+// Layout shifts are handled natively by PerformanceTimeline.enable.
+//
+//go:embed interaction.js
+var injectedJS string
+
+// injectScript registers the interaction tracking JS for the given session.
+func (m *Monitor) injectScript(ctx context.Context, sessionID string) error {
+	_, err := m.send(ctx, "Page.addScriptToEvaluateOnNewDocument", map[string]any{
+		"source": injectedJS,
+	}, sessionID)
+	return err
+}
diff --git a/server/lib/cdpmonitor/handlers.go b/server/lib/cdpmonitor/handlers.go
new file mode 100644
index 00000000..d9a177e4
--- /dev/null
+++ b/server/lib/cdpmonitor/handlers.go
@@ -0,0 +1,394 @@
+package cdpmonitor
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/onkernel/kernel-images/server/lib/events"
+)
+
+// publishEvent stamps common fields and publishes an event.
+func (m *Monitor) publishEvent(eventType string, detail events.DetailLevel, source events.Source, sourceEvent string, data json.RawMessage, sessionID string) {
+	src := source
+	src.Event = sourceEvent
+	if sessionID != "" {
+		if src.Metadata == nil {
+			src.Metadata = make(map[string]string)
+		}
+		src.Metadata["cdp_session_id"] = sessionID
+	}
+	url, _ := m.currentURL.Load().(string)
+	m.publish(events.Event{
+		Ts:          time.Now().UnixMilli(),
+		Type:        eventType,
+		Category:    events.CategoryFor(eventType),
+		Source:      src,
+		DetailLevel: detail,
+		URL:         url,
+		Data:        data,
+	})
+}
+
+// dispatchEvent routes a CDP event to its handler.
+func (m *Monitor) dispatchEvent(msg cdpMessage) {
+	switch msg.Method {
+	case "Runtime.consoleAPICalled":
+		m.handleConsole(msg.Params, msg.SessionID)
+	case "Runtime.exceptionThrown":
+		m.handleExceptionThrown(msg.Params, msg.SessionID)
+	case "Runtime.bindingCalled":
+		m.handleBindingCalled(msg.Params, msg.SessionID)
+	case "Network.requestWillBeSent":
+		m.handleNetworkRequest(msg.Params, msg.SessionID)
+	case "Network.responseReceived":
+		m.handleResponseReceived(msg.Params, msg.SessionID)
+	case "Network.loadingFinished":
+		m.handleLoadingFinished(msg.Params, msg.SessionID)
+	case "Network.loadingFailed":
+		m.handleLoadingFailed(msg.Params, msg.SessionID)
+	case "Page.frameNavigated":
+		m.handleFrameNavigated(msg.Params, msg.SessionID)
+	case "Page.domContentEventFired":
+		m.handleDOMContentLoaded(msg.Params, msg.SessionID)
+	case "Page.loadEventFired":
+		m.handleLoadEventFired(msg.Params, msg.SessionID)
+	case "PerformanceTimeline.timelineEventAdded":
+		m.handleTimelineEvent(msg.Params, msg.SessionID)
+	case "Target.attachedToTarget":
+		m.handleAttachedToTarget(msg)
+	case "Target.targetCreated":
+		m.handleTargetCreated(msg.Params, msg.SessionID)
+	case "Target.targetDestroyed":
+		m.handleTargetDestroyed(msg.Params, msg.SessionID)
+	}
+}
+
+func (m *Monitor) handleConsole(params json.RawMessage, sessionID string) {
+	var p cdpConsoleParams
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+
+	text := ""
+	if len(p.Args) > 0 {
+		text = consoleArgString(p.Args[0])
+	}
+	argValues := make([]string, 0, len(p.Args))
+	for _, a := range p.Args {
+		argValues = append(argValues, consoleArgString(a))
+	}
+	data, _ := json.Marshal(map[string]any{
+		"level":       p.Type,
+		"text":        text,
+		"args":        argValues,
+		"stack_trace": p.StackTrace,
+	})
+	m.publishEvent(EventConsoleLog, events.DetailStandard, events.Source{Kind: events.KindCDP}, "Runtime.consoleAPICalled", data, sessionID)
+}
+
+func (m *Monitor) handleExceptionThrown(params json.RawMessage, sessionID string) {
+	var p cdpExceptionDetails
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	data, _ := json.Marshal(map[string]any{
+		"text":        p.ExceptionDetails.Text,
+		"line":        p.ExceptionDetails.LineNumber,
+		"column":      p.ExceptionDetails.ColumnNumber,
+		"url":         p.ExceptionDetails.URL,
+		"stack_trace": p.ExceptionDetails.StackTrace,
+	})
+	m.publishEvent(EventConsoleError, events.DetailStandard, events.Source{Kind: events.KindCDP}, "Runtime.exceptionThrown", data, sessionID)
+	go m.tryScreenshot(m.getLifecycleCtx())
+}
+
+// handleBindingCalled processes __kernelEvent binding calls from the page.
+func (m *Monitor) handleBindingCalled(params json.RawMessage, sessionID string) {
+	var p struct {
+		Name    string `json:"name"`
+		Payload string `json:"payload"`
+	}
+	if err := json.Unmarshal(params, &p); err != nil || p.Name != bindingName {
+		return
+	}
+	payload := json.RawMessage(p.Payload)
+	if !json.Valid(payload) {
+		return
+	}
+	var header struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(payload, &header); err != nil {
+		return
+	}
+	switch header.Type {
+	case EventInteractionClick, EventInteractionKey, EventScrollSettled:
+		m.publishEvent(header.Type, events.DetailStandard, events.Source{Kind: events.KindCDP}, "Runtime.bindingCalled", payload, sessionID)
+	}
+}
+
+// handleTimelineEvent processes PerformanceTimeline layout-shift events.
+func (m *Monitor) handleTimelineEvent(params json.RawMessage, sessionID string) {
+	var p struct {
+		Event struct {
+			Type        string          `json:"type"`
+			LayoutShift json.RawMessage `json:"layoutShiftDetails,omitempty"`
+		} `json:"event"`
+	}
+	if err := json.Unmarshal(params, &p); err != nil || p.Event.Type != "layout-shift" {
+		return
+	}
+	m.publishEvent(EventLayoutShift, events.DetailStandard, events.Source{Kind: events.KindCDP}, "PerformanceTimeline.timelineEventAdded", params, sessionID)
+	m.computed.onLayoutShift()
+}
+
+func (m *Monitor) handleNetworkRequest(params json.RawMessage, sessionID string) {
+	var p cdpNetworkRequestParams
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	// Extract only the initiator type; the stack trace is too verbose and dominates event size.
+	var initiatorType string
+	var raw struct {
+		Type string `json:"type"`
+	}
+	if json.Unmarshal(p.Initiator, &raw) == nil {
+		initiatorType = raw.Type
+	}
+
+	m.pendReqMu.Lock()
+	m.pendingRequests[p.RequestID] = networkReqState{
+		sessionID:    sessionID,
+		method:       p.Request.Method,
+		url:          p.Request.URL,
+		headers:      p.Request.Headers,
+		postData:     p.Request.PostData,
+		resourceType: p.ResourceType,
+	}
+	m.pendReqMu.Unlock()
+	ev := map[string]any{
+		"method":         p.Request.Method,
+		"url":            p.Request.URL,
+		"headers":        p.Request.Headers,
+		"initiator_type": initiatorType,
+	}
+	if p.Request.PostData != "" {
+		ev["post_data"] = p.Request.PostData
+	}
+	if p.ResourceType != "" {
+		ev["resource_type"] = p.ResourceType
+	}
+	data, _ := json.Marshal(ev)
+	m.publishEvent(EventNetworkRequest, events.DetailStandard, events.Source{Kind: events.KindCDP}, "Network.requestWillBeSent", data, sessionID)
+	m.computed.onRequest()
+}
+
+func (m *Monitor) handleResponseReceived(params json.RawMessage, sessionID string) {
+	var p cdpResponseReceivedParams
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	m.pendReqMu.Lock()
+	if state, ok := m.pendingRequests[p.RequestID]; ok {
+		state.status = p.Response.Status
+		state.statusText = p.Response.StatusText
+		state.resHeaders = p.Response.Headers
+		state.mimeType = p.Response.MimeType
+		m.pendingRequests[p.RequestID] = state
+	}
+	m.pendReqMu.Unlock()
+}
+
+func (m *Monitor) handleLoadingFinished(params json.RawMessage, sessionID string) {
+	var p struct {
+		RequestID string `json:"requestId"`
+	}
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	m.pendReqMu.Lock()
+	state, ok := m.pendingRequests[p.RequestID]
+	if ok {
+		delete(m.pendingRequests, p.RequestID)
+	}
+	m.pendReqMu.Unlock()
+	if !ok {
+		return
+	}
+	m.computed.onLoadingFinished()
+	// Fetch response body async to avoid blocking readLoop; binary types are skipped.
+	go func() {
+		body := m.fetchResponseBody(p.RequestID, sessionID, state)
+		ev := map[string]any{
+			"method":  state.method,
+			"url":     state.url,
+			"status":  state.status,
+			"headers": state.resHeaders,
+		}
+		if state.statusText != "" {
+			ev["status_text"] = state.statusText
+		}
+		if state.mimeType != "" {
+			ev["mime_type"] = state.mimeType
+		}
+		if state.resourceType != "" {
+			ev["resource_type"] = state.resourceType
+		}
+		if body != "" {
+			ev["body"] = body
+		}
+		data, _ := json.Marshal(ev)
+		detail := events.DetailStandard
+		if body != "" {
+			detail = events.DetailVerbose
+		}
+		m.publishEvent(EventNetworkResponse, detail, events.Source{Kind: events.KindCDP}, "Network.loadingFinished", data, sessionID)
+	}()
+}
+
+// fetchResponseBody retrieves and truncates the response body for textual resources.
+func (m *Monitor) fetchResponseBody(requestID, sessionID string, state networkReqState) string {
+	if !isTextualResource(state.resourceType, state.mimeType) {
+		return ""
+	}
+	result, err := m.send(m.getLifecycleCtx(), "Network.getResponseBody", map[string]any{
+		"requestId": requestID,
+	}, sessionID)
+	if err != nil {
+		return ""
+	}
+	var resp struct {
+		Body          string `json:"body"`
+		Base64Encoded bool   `json:"base64Encoded"`
+	}
+	if json.Unmarshal(result, &resp) != nil {
+		return ""
+	}
+	return truncateBody(resp.Body, bodyCapFor(state.mimeType))
+}
+
+func (m *Monitor) handleLoadingFailed(params json.RawMessage, sessionID string) {
+	var p struct {
+		RequestID string `json:"requestId"`
+		ErrorText string `json:"errorText"`
+		Canceled  bool   `json:"canceled"`
+	}
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	m.pendReqMu.Lock()
+	state, ok := m.pendingRequests[p.RequestID]
+	if ok {
+		delete(m.pendingRequests, p.RequestID)
+	}
+	m.pendReqMu.Unlock()
+
+	ev := map[string]any{
+		"error_text": p.ErrorText,
+		"canceled":   p.Canceled,
+	}
+	if ok {
+		ev["url"] = state.url
+	}
+	data, _ := json.Marshal(ev)
+	m.publishEvent(EventNetworkLoadingFailed, events.DetailStandard, events.Source{Kind: events.KindCDP}, "Network.loadingFailed", data, sessionID)
+	if ok {
+		m.computed.onLoadingFinished()
+	}
+}
+
+
+func (m *Monitor) handleFrameNavigated(params json.RawMessage, sessionID string) {
+	var p struct {
+		Frame struct {
+			ID       string `json:"id"`
+			ParentID string `json:"parentId"`
+			URL      string `json:"url"`
+		} `json:"frame"`
+	}
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	data, _ := json.Marshal(map[string]any{
+		"url":             p.Frame.URL,
+		"frame_id":        p.Frame.ID,
+		"parent_frame_id": p.Frame.ParentID,
+	})
+	// Only track top-level frame navigations (no parent).
+	if p.Frame.ParentID == "" {
+		m.currentURL.Store(p.Frame.URL)
+	}
+	m.publishEvent(EventNavigation, events.DetailStandard, events.Source{Kind: events.KindCDP}, "Page.frameNavigated", data, sessionID)
+
+	// Only reset state for top-level navigations; subframe (iframe) navigations
+	// should not disrupt main-page tracking.
+	if p.Frame.ParentID == "" {
+		m.pendReqMu.Lock()
+		for id, req := range m.pendingRequests {
+			if req.sessionID == sessionID {
+				delete(m.pendingRequests, id)
+			}
+		}
+		m.pendReqMu.Unlock()
+
+		m.computed.resetOnNavigation()
+	}
+}
+
+func (m *Monitor) handleDOMContentLoaded(params json.RawMessage, sessionID string) {
+	m.publishEvent(EventDOMContentLoaded, events.DetailMinimal, events.Source{Kind: events.KindCDP}, "Page.domContentEventFired", params, sessionID)
+	m.computed.onDOMContentLoaded()
+}
+
+func (m *Monitor) handleLoadEventFired(params json.RawMessage, sessionID string) {
+	m.publishEvent(EventPageLoad, events.DetailMinimal, events.Source{Kind: events.KindCDP}, "Page.loadEventFired", params, sessionID)
+	m.computed.onPageLoad()
+	go m.tryScreenshot(m.getLifecycleCtx())
+}
+
+// handleAttachedToTarget stores the new session then enables domains and injects script.
+func (m *Monitor) handleAttachedToTarget(msg cdpMessage) {
+	var params cdpAttachedToTargetParams
+	if err := json.Unmarshal(msg.Params, &params); err != nil {
+		return
+	}
+	m.sessionsMu.Lock()
+	m.sessions[params.SessionID] = targetInfo{
+		targetID:   params.TargetInfo.TargetID,
+		url:        params.TargetInfo.URL,
+		targetType: params.TargetInfo.Type,
+	}
+	m.sessionsMu.Unlock()
+
+	// Async to avoid blocking the readLoop.
+	go func() {
+		m.enableDomains(m.getLifecycleCtx(), params.SessionID)
+		_ = m.injectScript(m.getLifecycleCtx(), params.SessionID)
+	}()
+}
+
+func (m *Monitor) handleTargetCreated(params json.RawMessage, sessionID string) {
+	var p cdpTargetCreatedParams
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	data, _ := json.Marshal(map[string]any{
+		"target_id":   p.TargetInfo.TargetID,
+		"target_type": p.TargetInfo.Type,
+		"url":         p.TargetInfo.URL,
+	})
+	m.publishEvent(EventTargetCreated, events.DetailMinimal, events.Source{Kind: events.KindCDP}, "Target.targetCreated", data, sessionID)
+}
+
+func (m *Monitor) handleTargetDestroyed(params json.RawMessage, sessionID string) {
+	var p struct {
+		TargetID string `json:"targetId"`
+	}
+	if err := json.Unmarshal(params, &p); err != nil {
+		return
+	}
+	data, _ := json.Marshal(map[string]any{
+		"target_id": p.TargetID,
+	})
+	m.publishEvent(EventTargetDestroyed, events.DetailMinimal, events.Source{Kind: events.KindCDP}, "Target.targetDestroyed", data, sessionID)
+}
diff --git a/server/lib/cdpmonitor/handlers_test.go b/server/lib/cdpmonitor/handlers_test.go
new file mode 100644
index 00000000..0626a4e2
--- /dev/null
+++ b/server/lib/cdpmonitor/handlers_test.go
@@ -0,0 +1,328 @@
+package cdpmonitor
+
+import (
+	"encoding/json"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/onkernel/kernel-images/server/lib/events"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConsoleEvents(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	_, ec, cleanup := startMonitor(t, srv, nil)
+	defer cleanup()
+
+	t.Run("console_log", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Runtime.consoleAPICalled",
+			"params": map[string]any{
+				"type": "log",
+				"args": []any{map[string]any{"type": "string", "value": "hello world"}},
+			},
+		})
+		ev := ec.waitFor(t, "console_log", 2*time.Second)
+		assert.Equal(t, events.CategoryConsole, ev.Category)
+		assert.Equal(t, events.KindCDP, ev.Source.Kind)
+		assert.Equal(t, "Runtime.consoleAPICalled", ev.Source.Event)
+		assert.Equal(t, events.DetailStandard, ev.DetailLevel)
+
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.Equal(t, "log", data["level"])
+		assert.Equal(t, "hello world", data["text"])
+	})
+
+	t.Run("exception_thrown", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Runtime.exceptionThrown",
+			"params": map[string]any{
+				"timestamp": 1234.5,
+				"exceptionDetails": map[string]any{
+					"text":         "Uncaught TypeError",
+					"lineNumber":   42,
+					"columnNumber": 7,
+					"url":          "https://example.com/app.js",
+				},
+			},
+		})
+		ev := ec.waitFor(t, "console_error", 2*time.Second)
+		assert.Equal(t, events.CategoryConsole, ev.Category)
+		assert.Equal(t, events.DetailStandard, ev.DetailLevel)
+
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.Equal(t, "Uncaught TypeError", data["text"])
+		assert.Equal(t, float64(42), data["line"])
+	})
+
+	t.Run("non_string_args", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Runtime.consoleAPICalled",
+			"params": map[string]any{
+				"type": "log",
+				"args": []any{
+					map[string]any{"type": "number", "value": 42},
+					map[string]any{"type": "object", "value": map[string]any{"key": "val"}},
+					map[string]any{"type": "undefined"},
+				},
+			},
+		})
+		ev := ec.waitForNew(t, "console_log", 2*time.Second)
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		args := data["args"].([]any)
+		assert.Equal(t, "42", args[0])
+		assert.Contains(t, args[1], "key")
+		assert.Equal(t, "undefined", args[2])
+	})
+}
+
+func TestNetworkEvents(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	var getBodyCalled atomic.Bool
+	responder := func(msg cdpMessage) any {
+		if msg.Method == "Network.getResponseBody" {
+			getBodyCalled.Store(true)
+			return map[string]any{
+				"id":     msg.ID,
+				"result": map[string]any{"body": `{"ok":true}`, "base64Encoded": false},
+			}
+		}
+		return nil
+	}
+	_, ec, cleanup := startMonitor(t, srv, responder)
+	defer cleanup()
+
+	t.Run("request_and_response", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.requestWillBeSent",
+			"params": map[string]any{
+				"requestId":    "req-001",
+				"resourceType": "XHR",
+				"request": map[string]any{
+					"method":  "POST",
+					"url":     "https://api.example.com/data",
+					"headers": map[string]any{"Content-Type": "application/json"},
+				},
+				"initiator": map[string]any{"type": "script"},
+			},
+		})
+		ev := ec.waitFor(t, "network_request", 2*time.Second)
+		assert.Equal(t, events.CategoryNetwork, ev.Category)
+		assert.Equal(t, "Network.requestWillBeSent", ev.Source.Event)
+
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.Equal(t, "POST", data["method"])
+		assert.Equal(t, "https://api.example.com/data", data["url"])
+
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.responseReceived",
+			"params": map[string]any{
+				"requestId": "req-001",
+				"response": map[string]any{
+					"status": 200, "statusText": "OK",
+					"headers": map[string]any{"Content-Type": "application/json"}, "mimeType": "application/json",
+				},
+			},
+		})
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.loadingFinished",
+			"params": map[string]any{"requestId": "req-001"},
+		})
+
+		ev2 := ec.waitFor(t, "network_response", 3*time.Second)
+		assert.Equal(t, "Network.loadingFinished", ev2.Source.Event)
+		var data2 map[string]any
+		require.NoError(t, json.Unmarshal(ev2.Data, &data2))
+		assert.Equal(t, float64(200), data2["status"])
+		assert.NotEmpty(t, data2["body"])
+	})
+
+	t.Run("loading_failed", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.requestWillBeSent",
+			"params": map[string]any{
+				"requestId": "req-002",
+				"request":   map[string]any{"method": "GET", "url": "https://fail.example.com/"},
+			},
+		})
+		ec.waitForNew(t, "network_request", 2*time.Second)
+
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.loadingFailed",
+			"params": map[string]any{
+				"requestId": "req-002",
+				"errorText": "net::ERR_CONNECTION_REFUSED",
+				"canceled":  false,
+			},
+		})
+		ev := ec.waitFor(t, "network_loading_failed", 2*time.Second)
+		assert.Equal(t, events.CategoryNetwork, ev.Category)
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.Equal(t, "net::ERR_CONNECTION_REFUSED", data["error_text"])
+	})
+
+	t.Run("binary_resource_skips_body", func(t *testing.T) {
+		getBodyCalled.Store(false)
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.requestWillBeSent",
+			"params": map[string]any{
+				"requestId":    "img-001",
+				"resourceType": "Image",
+				"request":      map[string]any{"method": "GET", "url": "https://example.com/photo.png"},
+			},
+		})
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.responseReceived",
+			"params": map[string]any{
+				"requestId": "img-001",
+				"response":  map[string]any{"status": 200, "statusText": "OK", "headers": map[string]any{}, "mimeType": "image/png"},
+			},
+		})
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Network.loadingFinished",
+			"params": map[string]any{"requestId": "img-001"},
+		})
+
+		ev := ec.waitForNew(t, "network_response", 3*time.Second)
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.Nil(t, data["body"], "binary resource should not have body field")
+		assert.False(t, getBodyCalled.Load(), "should not call getResponseBody for images")
+	})
+}
+
+func TestPageEvents(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	_, ec, cleanup := startMonitor(t, srv, nil)
+	defer cleanup()
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Page.frameNavigated",
+		"params": map[string]any{
+			"frame": map[string]any{"id": "frame-1", "url": "https://example.com/page"},
+		},
+	})
+	ev := ec.waitFor(t, "navigation", 2*time.Second)
+	assert.Equal(t, events.CategoryPage, ev.Category)
+	assert.Equal(t, "Page.frameNavigated", ev.Source.Event)
+	var data map[string]any
+	require.NoError(t, json.Unmarshal(ev.Data, &data))
+	assert.Equal(t, "https://example.com/page", data["url"])
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Page.domContentEventFired",
+		"params": map[string]any{"timestamp": 1000.0},
+	})
+	ev2 := ec.waitFor(t, "dom_content_loaded", 2*time.Second)
+	assert.Equal(t, events.CategoryPage, ev2.Category)
+	assert.Equal(t, events.DetailMinimal, ev2.DetailLevel)
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Page.loadEventFired",
+		"params": map[string]any{"timestamp": 1001.0},
+	})
+	ev3 := ec.waitFor(t, "page_load", 2*time.Second)
+	assert.Equal(t, events.CategoryPage, ev3.Category)
+	assert.Equal(t, events.DetailMinimal, ev3.DetailLevel)
+}
+
+func TestTargetEvents(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	_, ec, cleanup := startMonitor(t, srv, nil)
+	defer cleanup()
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Target.targetCreated",
+		"params": map[string]any{
+			"targetInfo": map[string]any{"targetId": "t-1", "type": "page", "url": "https://new.example.com"},
+		},
+	})
+	ev := ec.waitFor(t, "target_created", 2*time.Second)
+	assert.Equal(t, events.CategoryPage, ev.Category)
+	assert.Equal(t, events.DetailMinimal, ev.DetailLevel)
+	var data map[string]any
+	require.NoError(t, json.Unmarshal(ev.Data, &data))
+	assert.Equal(t, "t-1", data["target_id"])
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Target.targetDestroyed",
+		"params": map[string]any{"targetId": "t-1"},
+	})
+	ev2 := ec.waitFor(t, "target_destroyed", 2*time.Second)
+	assert.Equal(t, events.CategoryPage, ev2.Category)
+	assert.Equal(t, events.DetailMinimal, ev2.DetailLevel)
+}
+
+func TestBindingAndTimeline(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	_, ec, cleanup := startMonitor(t, srv, nil)
+	defer cleanup()
+
+	t.Run("interaction_click", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Runtime.bindingCalled",
+			"params": map[string]any{
+				"name":    "__kernelEvent",
+				"payload": `{"type":"interaction_click","x":10,"y":20,"selector":"button","tag":"BUTTON","text":"OK"}`,
+			},
+		})
+		ev := ec.waitFor(t, "interaction_click", 2*time.Second)
+		assert.Equal(t, events.CategoryInteraction, ev.Category)
+		assert.Equal(t, "Runtime.bindingCalled", ev.Source.Event)
+	})
+
+	t.Run("scroll_settled", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Runtime.bindingCalled",
+			"params": map[string]any{
+				"name":    "__kernelEvent",
+				"payload": `{"type":"scroll_settled","from_x":0,"from_y":0,"to_x":0,"to_y":500,"target_selector":"body"}`,
+			},
+		})
+		ev := ec.waitFor(t, "scroll_settled", 2*time.Second)
+		assert.Equal(t, events.CategoryInteraction, ev.Category)
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.Equal(t, float64(500), data["to_y"])
+	})
+
+	t.Run("layout_shift", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "PerformanceTimeline.timelineEventAdded",
+			"params": map[string]any{
+				"event": map[string]any{"type": "layout-shift"},
+			},
+		})
+		ev := ec.waitFor(t, "layout_shift", 2*time.Second)
+		assert.Equal(t, events.KindCDP, ev.Source.Kind)
+		assert.Equal(t, "PerformanceTimeline.timelineEventAdded", ev.Source.Event)
+	})
+
+	t.Run("unknown_binding_ignored", func(t *testing.T) {
+		srv.sendToMonitor(t, map[string]any{
+			"method": "Runtime.bindingCalled",
+			"params": map[string]any{
+				"name":    "someOtherBinding",
+				"payload": `{"type":"interaction_click"}`,
+			},
+		})
+		ec.assertNone(t, "interaction_click", 100*time.Millisecond)
+	})
+}
diff --git a/server/lib/cdpmonitor/interaction.js b/server/lib/cdpmonitor/interaction.js
new file mode 100644
index 00000000..8b107fd9
--- /dev/null
+++ b/server/lib/cdpmonitor/interaction.js
@@ -0,0 +1,50 @@
+(function() {
+  if (window.__kernelEventInjected) return;
+  var send = window.__kernelEvent;
+  if (!send) return;
+  window.__kernelEventInjected = true;
+
+  function sel(el) {
+    return el.id ? '#' + el.id : (el.className ? '.' + String(el.className).split(' ')[0] : '');
+  }
+
+  document.addEventListener('click', function(e) {
+    var t = e.target || {};
+    send(JSON.stringify({
+      type: 'interaction_click',
+      x: e.clientX, y: e.clientY,
+      selector: sel(t), tag: t.tagName || '',
+      text: (t.innerText || '').slice(0, 100)
+    }));
+  }, true);
+
+  document.addEventListener('keydown', function(e) {
+    var t = e.target || {};
+    send(JSON.stringify({
+      type: 'interaction_key',
+      key: e.key,
+      selector: sel(t), tag: t.tagName || ''
+    }));
+  }, true);
+
+  var scrollTimer = null;
+  var scrollStart = {x: window.scrollX, y: window.scrollY};
+  document.addEventListener('scroll', function(e) {
+    var fromX = scrollStart.x, fromY = scrollStart.y;
+    var target = e.target;
+    var s = target === document ? 'document' : sel(target);
+    if (scrollTimer) clearTimeout(scrollTimer);
+    scrollTimer = setTimeout(function() {
+      var toX = window.scrollX, toY = window.scrollY;
+      if (Math.abs(toX - fromX) > 5 || Math.abs(toY - fromY) > 5) {
+        send(JSON.stringify({
+          type: 'scroll_settled',
+          from_x: fromX, from_y: fromY,
+          to_x: toX, to_y: toY,
+          target_selector: s
+        }));
+      }
+      scrollStart = {x: toX, y: toY};
+    }, 300);
+  }, true);
+})();
\ No newline at end of file
diff --git a/server/lib/cdpmonitor/monitor.go b/server/lib/cdpmonitor/monitor.go
index 737f9650..fbedcffb 100644
--- a/server/lib/cdpmonitor/monitor.go
+++ b/server/lib/cdpmonitor/monitor.go
@@ -2,8 +2,13 @@ package cdpmonitor
 
 import (
 	"context"
+	"encoding/json"
+	"fmt"
+	"sync"
 	"sync/atomic"
+	"time"
 
+	"github.com/coder/websocket"
 	"github.com/onkernel/kernel-images/server/lib/events"
 )
 
@@ -16,15 +21,56 @@ type UpstreamProvider interface {
 // PublishFunc publishes an Event to the pipeline.
 type PublishFunc func(ev events.Event)
 
+const wsReadLimit = 8 * 1024 * 1024
+
 // Monitor manages a CDP WebSocket connection with auto-attach session fan-out.
-// Single-use per capture session: call Start to begin, Stop to tear down.
 type Monitor struct {
+	upstreamMgr UpstreamProvider
+	publish     PublishFunc
+	displayNum  int
+
+	// lifeMu serializes Start, Stop, and restartReadLoop to prevent races on
+	// conn, lifecycleCtx, cancel, and done.
+	lifeMu sync.Mutex
+	conn   *websocket.Conn
+
+	nextID  atomic.Int64
+	pendMu  sync.Mutex
+	pending map[int64]chan cdpMessage
+
+	sessionsMu sync.RWMutex
+	sessions   map[string]targetInfo // sessionID → targetInfo
+
+	pendReqMu       sync.Mutex
+	pendingRequests map[string]networkReqState // requestId → networkReqState
+
+	currentURL atomic.Value // last URL from Page.frameNavigated
+
+	computed *computedState
+
+	lastScreenshotAt atomic.Int64 // unix millis of last capture
+	screenshotFn     func(ctx context.Context, displayNum int) ([]byte, error) // nil → real ffmpeg
+
+	lifecycleCtx context.Context    // cancelled on Stop()
+	cancel       context.CancelFunc
+	done         chan struct{}
+
 	running atomic.Bool
 }
 
 // New creates a Monitor. displayNum is the X display for ffmpeg screenshots.
-func New(_ UpstreamProvider, _ PublishFunc, _ int) *Monitor {
-	return &Monitor{}
+func New(upstreamMgr UpstreamProvider, publish PublishFunc, displayNum int) *Monitor {
+	m := &Monitor{
+		upstreamMgr:     upstreamMgr,
+		publish:         publish,
+		displayNum:      displayNum,
+		sessions:        make(map[string]targetInfo),
+		pending:         make(map[int64]chan cdpMessage),
+		pendingRequests: make(map[string]networkReqState),
+	}
+	m.computed = newComputedState(publish)
+	m.lifecycleCtx = context.Background()
+	return m
 }
 
 // IsRunning reports whether the monitor is actively capturing.
@@ -32,10 +78,375 @@ func (m *Monitor) IsRunning() bool {
 	return m.running.Load()
 }
 
+// getLifecycleCtx returns the current lifecycle context under lifeMu.
+func (m *Monitor) getLifecycleCtx() context.Context {
+	m.lifeMu.Lock()
+	ctx := m.lifecycleCtx
+	m.lifeMu.Unlock()
+	return ctx
+}
+
 // Start begins CDP capture. Restarts if already running.
-func (m *Monitor) Start(_ context.Context) error {
+func (m *Monitor) Start(parentCtx context.Context) error {
+	if m.running.Load() {
+		m.Stop()
+	}
+
+	devtoolsURL := m.upstreamMgr.Current()
+	if devtoolsURL == "" {
+		return fmt.Errorf("cdpmonitor: no DevTools URL available")
+	}
+
+	// Use background context so the monitor outlives the caller's request context.
+	ctx, cancel := context.WithCancel(context.Background())
+
+	conn, _, err := websocket.Dial(ctx, devtoolsURL, nil)
+	if err != nil {
+		cancel()
+		return fmt.Errorf("cdpmonitor: dial %s: %w", devtoolsURL, err)
+	}
+	conn.SetReadLimit(wsReadLimit)
+
+	m.lifeMu.Lock()
+	m.conn = conn
+	m.lifecycleCtx = ctx
+	m.cancel = cancel
+	m.done = make(chan struct{})
+	m.lifeMu.Unlock()
+
+	m.running.Store(true)
+
+	go m.readLoop(ctx)
+	go m.subscribeToUpstream(ctx)
+	go m.initSession(ctx) // must run after readLoop starts
+
 	return nil
 }
 
-// Stop tears down the monitor. Safe to call multiple times.
-func (m *Monitor) Stop() {}
+// Stop cancels the context and waits for goroutines to exit.
+func (m *Monitor) Stop() {
+	if !m.running.Swap(false) {
+		return
+	}
+
+	m.lifeMu.Lock()
+	if m.cancel != nil {
+		m.cancel()
+	}
+	done := m.done
+	m.lifeMu.Unlock()
+
+	if done != nil {
+		<-done
+	}
+
+	m.lifeMu.Lock()
+	if m.conn != nil {
+		_ = m.conn.Close(websocket.StatusNormalClosure, "stopped")
+		m.conn = nil
+	}
+	m.lifeMu.Unlock()
+
+	m.clearState()
+}
+
+// clearState resets sessions, pending requests, and computed state.
+// It also fails all in-flight send() calls so their goroutines are unblocked.
+func (m *Monitor) clearState() {
+	m.currentURL.Store("")
+
+	m.sessionsMu.Lock()
+	m.sessions = make(map[string]targetInfo)
+	m.sessionsMu.Unlock()
+
+	m.pendReqMu.Lock()
+	m.pendingRequests = make(map[string]networkReqState)
+	m.pendReqMu.Unlock()
+
+	m.failPendingCommands()
+
+	m.computed.resetOnNavigation()
+}
+
+// failPendingCommands unblocks all in-flight send() calls by delivering an
+// error response. This prevents goroutine leaks when the connection is torn
+// down during reconnect.
+func (m *Monitor) failPendingCommands() {
+	m.pendMu.Lock()
+	old := m.pending
+	m.pending = make(map[int64]chan cdpMessage)
+	m.pendMu.Unlock()
+
+	disconnectErr := &cdpError{Code: -1, Message: "connection closed"}
+	for _, ch := range old {
+		select {
+		case ch <- cdpMessage{Error: disconnectErr}:
+		default:
+		}
+	}
+}
+
+// readLoop reads CDP messages, routing responses to pending callers and dispatching events.
+func (m *Monitor) readLoop(ctx context.Context) {
+	m.lifeMu.Lock()
+	done := m.done
+	conn := m.conn
+	m.lifeMu.Unlock()
+	defer close(done)
+
+	if conn == nil {
+		return
+	}
+
+	for {
+		_, b, err := conn.Read(ctx)
+		if err != nil {
+			return
+		}
+
+		var msg cdpMessage
+		if err := json.Unmarshal(b, &msg); err != nil {
+			continue
+		}
+
+		if msg.ID != nil {
+			m.pendMu.Lock()
+			ch, ok := m.pending[*msg.ID]
+			m.pendMu.Unlock()
+			if ok {
+				select {
+				case ch <- msg:
+				default:
+					// send() already timed out and deregistered; discard.
+				}
+			}
+			continue
+		}
+
+		m.dispatchEvent(msg)
+	}
+}
+
+// send issues a CDP command and blocks until the response arrives.
+func (m *Monitor) send(ctx context.Context, method string, params any, sessionID string) (json.RawMessage, error) {
+	id := m.nextID.Add(1)
+
+	var rawParams json.RawMessage
+	if params != nil {
+		b, err := json.Marshal(params)
+		if err != nil {
+			return nil, fmt.Errorf("marshal params: %w", err)
+		}
+		rawParams = b
+	}
+
+	req := cdpMessage{ID: &id, Method: method, Params: rawParams, SessionID: sessionID}
+	reqBytes, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("marshal request: %w", err)
+	}
+
+	ch := make(chan cdpMessage, 1)
+	m.pendMu.Lock()
+	m.pending[id] = ch
+	m.pendMu.Unlock()
+	defer func() {
+		m.pendMu.Lock()
+		delete(m.pending, id)
+		m.pendMu.Unlock()
+	}()
+
+	m.lifeMu.Lock()
+	conn := m.conn
+	m.lifeMu.Unlock()
+	if conn == nil {
+		return nil, fmt.Errorf("cdpmonitor: connection not open")
+	}
+
+	// coder/websocket allows concurrent Read + Write on the same Conn.
+	if err := conn.Write(ctx, websocket.MessageText, reqBytes); err != nil {
+		return nil, fmt.Errorf("write: %w", err)
+	}
+
+	select {
+	case resp := <-ch:
+		if resp.Error != nil {
+			return nil, resp.Error
+		}
+		return resp.Result, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+// initSession enables CDP domains, injects the interaction-tracking script,
+// and manually attaches to any targets already open when the monitor started.
+func (m *Monitor) initSession(ctx context.Context) {
+	_, _ = m.send(ctx, "Target.setAutoAttach", map[string]any{
+		"autoAttach":             true,
+		"waitForDebuggerOnStart": false,
+		"flatten":                true,
+	}, "")
+	m.enableDomains(ctx, "")
+	_ = m.injectScript(ctx, "")
+	m.attachExistingTargets(ctx)
+}
+
+// attachExistingTargets fetches all open targets and attaches to any that are
+// not already tracked. This catches pages that were open before Start() was called.
+func (m *Monitor) attachExistingTargets(ctx context.Context) {
+	result, err := m.send(ctx, "Target.getTargets", nil, "")
+	if err != nil {
+		return
+	}
+	var resp struct {
+		TargetInfos []cdpTargetInfo `json:"targetInfos"`
+	}
+	if err := json.Unmarshal(result, &resp); err != nil {
+		return
+	}
+	for _, ti := range resp.TargetInfos {
+		if ti.Type != "page" {
+			continue
+		}
+		m.sessionsMu.RLock()
+		alreadyAttached := false
+		for _, info := range m.sessions {
+			if info.targetID == ti.TargetID {
+				alreadyAttached = true
+				break
+			}
+		}
+		m.sessionsMu.RUnlock()
+		if alreadyAttached {
+			continue
+		}
+		go func(targetID string) {
+			res, err := m.send(ctx, "Target.attachToTarget", map[string]any{
+				"targetId": targetID,
+				"flatten":  true,
+			}, "")
+			if err != nil {
+				return
+			}
+			var attached struct {
+				SessionID string `json:"sessionId"`
+			}
+			if json.Unmarshal(res, &attached) == nil && attached.SessionID != "" {
+				m.enableDomains(ctx, attached.SessionID)
+				_ = m.injectScript(ctx, attached.SessionID)
+			}
+		}(ti.TargetID)
+	}
+}
+
+// restartReadLoop waits for the current readLoop to exit, then starts a new one.
+func (m *Monitor) restartReadLoop(ctx context.Context) {
+	m.lifeMu.Lock()
+	done := m.done
+	m.lifeMu.Unlock()
+
+	<-done
+
+	m.lifeMu.Lock()
+	m.done = make(chan struct{})
+	m.lifeMu.Unlock()
+
+	go m.readLoop(ctx)
+}
+
+// subscribeToUpstream reconnects with backoff on Chrome restarts, publishing disconnect/reconnect events.
+func (m *Monitor) subscribeToUpstream(ctx context.Context) {
+	ch, cancel := m.upstreamMgr.Subscribe()
+	defer cancel()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case newURL, ok := <-ch:
+			if !ok {
+				return
+			}
+			m.handleUpstreamRestart(ctx, newURL)
+		}
+	}
+}
+
+// handleUpstreamRestart tears down the old connection, reconnects with backoff,
+// and re-initializes the CDP session.
+func (m *Monitor) handleUpstreamRestart(ctx context.Context, newURL string) {
+	m.publish(events.Event{
+		Ts:          time.Now().UnixMilli(),
+		Type:        EventMonitorDisconnected,
+		Category:    events.CategorySystem,
+		Source:      events.Source{Kind: events.KindLocalProcess},
+		DetailLevel: events.DetailMinimal,
+		Data:        json.RawMessage(`{"reason":"chrome_restarted"}`),
+	})
+
+	startReconnect := time.Now()
+
+	m.lifeMu.Lock()
+	if m.conn != nil {
+		_ = m.conn.Close(websocket.StatusNormalClosure, "reconnecting")
+		m.conn = nil
+	}
+	m.lifeMu.Unlock()
+
+	m.clearState()
+
+	if !m.reconnectWithBackoff(ctx, newURL) {
+		return
+	}
+
+	m.restartReadLoop(ctx)
+	go m.initSession(ctx)
+
+	m.publish(events.Event{
+		Ts:          time.Now().UnixMilli(),
+		Type:        EventMonitorReconnected,
+		Category:    events.CategorySystem,
+		Source:      events.Source{Kind: events.KindLocalProcess},
+		DetailLevel: events.DetailMinimal,
+		Data: json.RawMessage(fmt.Sprintf(
+			`{"reconnect_duration_ms":%d}`,
+			time.Since(startReconnect).Milliseconds(),
+		)),
+	})
+}
+
+var reconnectBackoffs = []time.Duration{
+	250 * time.Millisecond,
+	500 * time.Millisecond,
+	1 * time.Second,
+	2 * time.Second,
+}
+
+// reconnectWithBackoff attempts to dial newURL up to 10 times with exponential backoff.
+func (m *Monitor) reconnectWithBackoff(ctx context.Context, newURL string) bool {
+	for attempt := range 10 {
+		if ctx.Err() != nil {
+			return false
+		}
+
+		idx := min(attempt, len(reconnectBackoffs)-1)
+		select {
+		case <-ctx.Done():
+			return false
+		case <-time.After(reconnectBackoffs[idx]):
+		}
+
+		conn, _, err := websocket.Dial(ctx, newURL, nil)
+		if err != nil {
+			continue
+		}
+		conn.SetReadLimit(wsReadLimit)
+
+		m.lifeMu.Lock()
+		m.conn = conn
+		m.lifeMu.Unlock()
+		return true
+	}
+	return false
+}
diff --git a/server/lib/cdpmonitor/monitor_test.go b/server/lib/cdpmonitor/monitor_test.go
new file mode 100644
index 00000000..6a6f22e4
--- /dev/null
+++ b/server/lib/cdpmonitor/monitor_test.go
@@ -0,0 +1,227 @@
+package cdpmonitor
+
+import (
+	"context"
+	"encoding/json"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/onkernel/kernel-images/server/lib/events"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAutoAttach(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	ec := newEventCollector()
+	upstream := newTestUpstream(srv.wsURL())
+	m := New(upstream, ec.publishFn(), 99)
+	require.NoError(t, m.Start(context.Background()))
+	defer m.Stop()
+
+	msg := srv.readFromMonitor(t, 3*time.Second)
+	assert.Equal(t, "Target.setAutoAttach", msg.Method)
+
+	var params struct {
+		AutoAttach             bool `json:"autoAttach"`
+		WaitForDebuggerOnStart bool `json:"waitForDebuggerOnStart"`
+		Flatten                bool `json:"flatten"`
+	}
+	require.NoError(t, json.Unmarshal(msg.Params, &params))
+	assert.True(t, params.AutoAttach)
+	assert.False(t, params.WaitForDebuggerOnStart)
+	assert.True(t, params.Flatten)
+
+	stopResponder := make(chan struct{})
+	go listenAndRespond(srv, stopResponder, nil)
+	defer close(stopResponder)
+	srv.sendToMonitor(t, map[string]any{"id": msg.ID, "result": map[string]any{}})
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Target.attachedToTarget",
+		"params": map[string]any{
+			"sessionId":  "session-abc",
+			"targetInfo": map[string]any{"targetId": "target-xyz", "type": "page", "url": "https://example.com"},
+		},
+	})
+	require.Eventually(t, func() bool {
+		m.sessionsMu.RLock()
+		defer m.sessionsMu.RUnlock()
+		_, ok := m.sessions["session-abc"]
+		return ok
+	}, 2*time.Second, 50*time.Millisecond, "session not stored")
+
+	m.sessionsMu.RLock()
+	info := m.sessions["session-abc"]
+	m.sessionsMu.RUnlock()
+	assert.Equal(t, "target-xyz", info.targetID)
+	assert.Equal(t, "page", info.targetType)
+}
+
+func TestLifecycle(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	ec := newEventCollector()
+	upstream := newTestUpstream(srv.wsURL())
+	m := New(upstream, ec.publishFn(), 99)
+
+	assert.False(t, m.IsRunning(), "idle at boot")
+
+	require.NoError(t, m.Start(context.Background()))
+	assert.True(t, m.IsRunning(), "running after Start")
+	srv.readFromMonitor(t, 2*time.Second)
+
+	m.Stop()
+	assert.False(t, m.IsRunning(), "stopped after Stop")
+
+	require.NoError(t, m.Start(context.Background()))
+	assert.True(t, m.IsRunning(), "running after second Start")
+	srv.readFromMonitor(t, 2*time.Second)
+
+	require.NoError(t, m.Start(context.Background()))
+	assert.True(t, m.IsRunning(), "running after implicit restart")
+
+	m.Stop()
+	assert.False(t, m.IsRunning(), "stopped at end")
+}
+
+func TestReconnect(t *testing.T) {
+	srv1 := newTestServer(t)
+
+	upstream := newTestUpstream(srv1.wsURL())
+	ec := newEventCollector()
+	m := New(upstream, ec.publishFn(), 99)
+	require.NoError(t, m.Start(context.Background()))
+	defer m.Stop()
+
+	srv1.readFromMonitor(t, 2*time.Second)
+
+	srv2 := newTestServer(t)
+	defer srv2.close()
+	defer srv1.close()
+
+	upstream.notifyRestart(srv2.wsURL())
+
+	ec.waitFor(t, "monitor_disconnected", 3*time.Second)
+	srv2.readFromMonitor(t, 5*time.Second)
+
+	ev := ec.waitFor(t, "monitor_reconnected", 3*time.Second)
+	var data map[string]any
+	require.NoError(t, json.Unmarshal(ev.Data, &data))
+	_, ok := data["reconnect_duration_ms"]
+	assert.True(t, ok, "missing reconnect_duration_ms")
+}
+
+func TestAttachExistingTargets(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	responder := func(msg cdpMessage) any {
+		switch msg.Method {
+		case "Target.getTargets":
+			return map[string]any{
+				"id": msg.ID,
+				"result": map[string]any{
+					"targetInfos": []any{
+						map[string]any{"targetId": "existing-1", "type": "page", "url": "https://preexisting.example.com"},
+					},
+				},
+			}
+		case "Target.attachToTarget":
+			srv.sendToMonitor(t, map[string]any{
+				"method": "Target.attachedToTarget",
+				"params": map[string]any{
+					"sessionId":  "session-existing-1",
+					"targetInfo": map[string]any{"targetId": "existing-1", "type": "page", "url": "https://preexisting.example.com"},
+				},
+			})
+			return map[string]any{"id": msg.ID, "result": map[string]any{"sessionId": "session-existing-1"}}
+		}
+		return nil
+	}
+
+	m, _, cleanup := startMonitor(t, srv, responder)
+	defer cleanup()
+
+	require.Eventually(t, func() bool {
+		m.sessionsMu.RLock()
+		defer m.sessionsMu.RUnlock()
+		_, ok := m.sessions["session-existing-1"]
+		return ok
+	}, 3*time.Second, 50*time.Millisecond, "existing target not auto-attached")
+
+	m.sessionsMu.RLock()
+	info := m.sessions["session-existing-1"]
+	m.sessionsMu.RUnlock()
+	assert.Equal(t, "existing-1", info.targetID)
+}
+
+func TestURLPopulated(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	_, ec, cleanup := startMonitor(t, srv, nil)
+	defer cleanup()
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Page.frameNavigated",
+		"params": map[string]any{
+			"frame": map[string]any{"id": "f1", "url": "https://example.com/page"},
+		},
+	})
+	ec.waitFor(t, "navigation", 2*time.Second)
+
+	srv.sendToMonitor(t, map[string]any{
+		"method": "Runtime.consoleAPICalled",
+		"params": map[string]any{
+			"type": "log",
+			"args": []any{map[string]any{"type": "string", "value": "test"}},
+		},
+	})
+	ev := ec.waitFor(t, "console_log", 2*time.Second)
+	assert.Equal(t, "https://example.com/page", ev.URL)
+}
+
+func TestScreenshot(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.close()
+
+	m, ec, cleanup := startMonitor(t, srv, nil)
+	defer cleanup()
+
+	var captureCount atomic.Int32
+	m.screenshotFn = func(ctx context.Context, displayNum int) ([]byte, error) {
+		captureCount.Add(1)
+		return minimalPNG, nil
+	}
+
+	t.Run("capture_and_publish", func(t *testing.T) {
+		m.tryScreenshot(context.Background())
+		require.Eventually(t, func() bool { return captureCount.Load() == 1 }, 2*time.Second, 20*time.Millisecond)
+
+		ev := ec.waitFor(t, "screenshot", 2*time.Second)
+		assert.Equal(t, events.CategorySystem, ev.Category)
+		assert.Equal(t, events.KindLocalProcess, ev.Source.Kind)
+		var data map[string]any
+		require.NoError(t, json.Unmarshal(ev.Data, &data))
+		assert.NotEmpty(t, data["png"])
+	})
+
+	t.Run("rate_limited", func(t *testing.T) {
+		before := captureCount.Load()
+		m.tryScreenshot(context.Background())
+		time.Sleep(100 * time.Millisecond)
+		assert.Equal(t, before, captureCount.Load(), "should be rate-limited within 2s")
+	})
+
+	t.Run("captures_after_cooldown", func(t *testing.T) {
+		m.lastScreenshotAt.Store(time.Now().Add(-3 * time.Second).UnixMilli())
+		before := captureCount.Load()
+		m.tryScreenshot(context.Background())
+		require.Eventually(t, func() bool { return captureCount.Load() > before }, 2*time.Second, 20*time.Millisecond)
+	})
+}
diff --git a/server/lib/cdpmonitor/screenshot.go b/server/lib/cdpmonitor/screenshot.go
new file mode 100644
index 00000000..e3ca3c39
--- /dev/null
+++ b/server/lib/cdpmonitor/screenshot.go
@@ -0,0 +1,89 @@
+package cdpmonitor
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os/exec"
+	"time"
+
+	"github.com/onkernel/kernel-images/server/lib/events"
+)
+
+// tryScreenshot triggers a screenshot if the rate-limit window has elapsed.
+// It uses an atomic CAS on lastScreenshotAt to ensure only one screenshot runs
+// at a time.
+func (m *Monitor) tryScreenshot(ctx context.Context) {
+	now := time.Now().UnixMilli()
+	last := m.lastScreenshotAt.Load()
+	if now-last < 2000 {
+		return
+	}
+	if !m.lastScreenshotAt.CompareAndSwap(last, now) {
+		return
+	}
+	go m.captureScreenshot(ctx)
+}
+
+// captureScreenshot takes a screenshot via ffmpeg x11grab (or the screenshotFn
+// seam in tests), optionally downscales it, and publishes a screenshot event.
+func (m *Monitor) captureScreenshot(ctx context.Context) {
+	var pngBytes []byte
+	var err error
+
+	if m.screenshotFn != nil {
+		pngBytes, err = m.screenshotFn(ctx, m.displayNum)
+	} else {
+		pngBytes, err = captureViaFFmpeg(ctx, m.displayNum, 1)
+	}
+	if err != nil {
+		return
+	}
+
+	// Downscale if base64 output would exceed 950KB (~729KB raw).
+	const rawThreshold = 729 * 1024
+	for scale := 2; len(pngBytes) > rawThreshold && scale <= 16 && m.screenshotFn == nil; scale *= 2 {
+		pngBytes, err = captureViaFFmpeg(ctx, m.displayNum, scale)
+		if err != nil {
+			return
+		}
+	}
+
+	encoded := base64.StdEncoding.EncodeToString(pngBytes)
+	data, _ := json.Marshal(map[string]string{"png": encoded})
+
+	m.publish(events.Event{
+		Ts:          time.Now().UnixMilli(),
+		Type:        "screenshot",
+		Category:    events.CategorySystem,
+		Source:      events.Source{Kind: events.KindLocalProcess},
+		DetailLevel: events.DetailStandard,
+		Data:        data,
+	})
+}
+
+// captureViaFFmpeg runs ffmpeg x11grab to capture a PNG screenshot.
+// If divisor > 1, a scale filter is applied to reduce the output size.
+func captureViaFFmpeg(ctx context.Context, displayNum, divisor int) ([]byte, error) {
+	args := []string{
+		"-f", "x11grab",
+		"-i", fmt.Sprintf(":%d", displayNum),
+		"-vframes", "1",
+	}
+	if divisor > 1 {
+		args = append(args, "-vf", fmt.Sprintf("scale=iw/%d:ih/%d", divisor, divisor))
+	}
+	args = append(args, "-f", "image2", "pipe:1")
+
+	var out bytes.Buffer
+	cmd := exec.CommandContext(ctx, "ffmpeg", args...)
+	cmd.Stdout = &out
+	cmd.Stderr = io.Discard
+	if err := cmd.Run(); err != nil {
+		return nil, err
+	}
+	return out.Bytes(), nil
+}
diff --git a/server/lib/cdpmonitor/types.go b/server/lib/cdpmonitor/types.go
new file mode 100644
index 00000000..7e6a2ebe
--- /dev/null
+++ b/server/lib/cdpmonitor/types.go
@@ -0,0 +1,139 @@
+package cdpmonitor
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// Event type constants for all events published by the cdpmonitor.
+const (
+	EventConsoleLog          = "console_log"
+	EventConsoleError        = "console_error"
+	EventNetworkRequest      = "network_request"
+	EventNetworkResponse     = "network_response"
+	EventNetworkLoadingFailed = "network_loading_failed"
+	EventNetworkIdle         = "network_idle"
+	EventNavigation          = "navigation"
+	EventDOMContentLoaded    = "dom_content_loaded"
+	EventPageLoad            = "page_load"
+	EventLayoutShift         = "layout_shift"
+	EventLayoutSettled       = "layout_settled"
+	EventNavigationSettled   = "navigation_settled"
+	EventTargetCreated       = "target_created"
+	EventTargetDestroyed     = "target_destroyed"
+	EventInteractionClick    = "interaction_click"
+	EventInteractionKey      = "interaction_key"
+	EventScrollSettled       = "scroll_settled"
+	EventMonitorDisconnected = "monitor_disconnected"
+	EventMonitorReconnected  = "monitor_reconnected"
+)
+
+// targetInfo holds metadata about an attached CDP target/session.
+type targetInfo struct {
+	targetID   string
+	url        string
+	targetType string
+}
+
+// cdpError is the JSON-RPC error object returned by Chrome.
+type cdpError struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+}
+
+func (e *cdpError) Error() string {
+	return fmt.Sprintf("CDP error %d: %s", e.Code, e.Message)
+}
+
+// cdpMessage is the JSON-RPC message envelope used by Chrome's DevTools Protocol.
+// ID is a pointer so we can distinguish an absent id (event) from id=0 (which
+// Chrome never sends, but using a pointer is more correct than relying on that).
+type cdpMessage struct {
+	ID        *int64          `json:"id,omitempty"`
+	Method    string          `json:"method,omitempty"`
+	Params    json.RawMessage `json:"params,omitempty"`
+	SessionID string          `json:"sessionId,omitempty"`
+	Result    json.RawMessage `json:"result,omitempty"`
+	Error     *cdpError       `json:"error,omitempty"`
+}
+
+// networkReqState holds request + response metadata until loadingFinished.
+type networkReqState struct {
+	sessionID    string
+	method       string
+	url          string
+	headers      json.RawMessage
+	postData     string
+	resourceType string
+	status       int
+	statusText   string
+	resHeaders   json.RawMessage
+	mimeType     string
+}
+
+// cdpConsoleArg is a single Runtime.consoleAPICalled argument.
+// Value is json.RawMessage because CDP sends strings, numbers, objects, etc.
+type cdpConsoleArg struct {
+	Type  string          `json:"type"`
+	Value json.RawMessage `json:"value,omitempty"`
+}
+
+// cdpConsoleParams is the shape of Runtime.consoleAPICalled params.
+type cdpConsoleParams struct {
+	Type       string          `json:"type"`
+	Args       []cdpConsoleArg `json:"args"`
+	StackTrace json.RawMessage `json:"stackTrace"`
+}
+
+// cdpExceptionDetails is the shape of Runtime.exceptionThrown params.
+type cdpExceptionDetails struct {
+	ExceptionDetails struct {
+		Text         string          `json:"text"`
+		LineNumber   int             `json:"lineNumber"`
+		ColumnNumber int             `json:"columnNumber"`
+		URL          string          `json:"url"`
+		StackTrace   json.RawMessage `json:"stackTrace"`
+	} `json:"exceptionDetails"`
+}
+
+// cdpTargetInfo is the shared TargetInfo shape used by Target events.
+type cdpTargetInfo struct {
+	TargetID string `json:"targetId"`
+	Type     string `json:"type"`
+	URL      string `json:"url"`
+}
+
+// cdpNetworkRequestParams is the shape of Network.requestWillBeSent params.
+type cdpNetworkRequestParams struct {
+	RequestID    string `json:"requestId"`
+	ResourceType string `json:"resourceType"`
+	Request      struct {
+		Method   string          `json:"method"`
+		URL      string          `json:"url"`
+		Headers  json.RawMessage `json:"headers"`
+		PostData string          `json:"postData"`
+	} `json:"request"`
+	Initiator json.RawMessage `json:"initiator"`
+}
+
+// cdpResponseReceivedParams is the shape of Network.responseReceived params.
+type cdpResponseReceivedParams struct {
+	RequestID string `json:"requestId"`
+	Response  struct {
+		Status     int             `json:"status"`
+		StatusText string          `json:"statusText"`
+		Headers    json.RawMessage `json:"headers"`
+		MimeType   string          `json:"mimeType"`
+	} `json:"response"`
+}
+
+// cdpAttachedToTargetParams is the shape of Target.attachedToTarget params.
+type cdpAttachedToTargetParams struct {
+	SessionID  string        `json:"sessionId"`
+	TargetInfo cdpTargetInfo `json:"targetInfo"`
+}
+
+// cdpTargetCreatedParams is the shape of Target.targetCreated params.
+type cdpTargetCreatedParams struct {
+	TargetInfo cdpTargetInfo `json:"targetInfo"`
+}
diff --git a/server/lib/cdpmonitor/util.go b/server/lib/cdpmonitor/util.go
new file mode 100644
index 00000000..26b250c0
--- /dev/null
+++ b/server/lib/cdpmonitor/util.go
@@ -0,0 +1,115 @@
+package cdpmonitor
+
+import (
+	"encoding/json"
+	"slices"
+	"strings"
+	"unicode/utf8"
+)
+
+// consoleArgString extracts a display string from a CDP console argument.
+// For strings it unquotes the JSON value; for other types it returns the raw JSON.
+func consoleArgString(a cdpConsoleArg) string {
+	if len(a.Value) == 0 {
+		return a.Type // e.g. "undefined", "null"
+	}
+	if a.Type == "string" {
+		var s string
+		if json.Unmarshal(a.Value, &s) == nil {
+			return s
+		}
+	}
+	return string(a.Value)
+}
+
+// isTextualResource reports whether the resource warrants body capture.
+// resourceType is checked first; mimeType is a fallback for resources with no type (e.g. in-flight at attach time).
+func isTextualResource(resourceType, mimeType string) bool {
+	switch resourceType {
+	case "Font", "Image", "Media", "Stylesheet", "Script":
+		return false
+	}
+	return isCapturedMIME(mimeType)
+}
+
+// isCapturedMIME returns true for MIME types whose bodies are worth capturing.
+// Binary formats (vendor types, binary encodings, raw streams) are excluded.
+func isCapturedMIME(mime string) bool {
+	if mime == "" {
+		return false // unknown
+	}
+	for _, prefix := range []string{"image/", "font/", "audio/", "video/"} {
+		if strings.HasPrefix(mime, prefix) {
+			return false
+		}
+	}
+	if slices.Contains([]string{
+		"application/octet-stream",
+		"application/wasm",
+		"application/pdf",
+		"application/zip",
+		"application/gzip",
+		"application/x-protobuf",
+		"application/x-msgpack",
+		"application/x-thrift",
+		"application/javascript",
+		"application/x-javascript",
+		"text/javascript",
+		"text/css",
+	}, mime) {
+		return false
+	}
+	// Skip vendor binary formats; allow vnd types with text-based suffixes (+json, +xml, +csv).
+	if sub, ok := strings.CutPrefix(mime, "application/vnd."); ok {
+		for _, textSuffix := range []string{"+json", "+xml", "+csv"} {
+			if strings.HasSuffix(sub, textSuffix) {
+				return true
+			}
+		}
+		return false
+	}
+	return true
+}
+
+// bodyCapFor returns the max body capture size for a MIME type.
+// Structured data (JSON, XML, form data) gets 8 KB; everything else gets 4 KB.
+func bodyCapFor(mime string) int {
+	const fullCap = 8 * 1024
+	const contextCap = 4 * 1024
+	structuredPrefixes := []string{
+		"application/json",
+		"application/xml",
+		"application/x-www-form-urlencoded",
+		"application/graphql",
+		"text/xml",
+		"text/csv",
+	}
+	for _, p := range structuredPrefixes {
+		if strings.HasPrefix(mime, p) {
+			return fullCap
+		}
+	}
+	// vnd types with +json/+xml suffix are treated as structured.
+	for _, suffix := range []string{"+json", "+xml"} {
+		if strings.HasSuffix(mime, suffix) {
+			return fullCap
+		}
+	}
+	return contextCap
+}
+
+// truncateBody caps body at the given limit on a valid UTF-8 boundary.
+func truncateBody(body string, maxBody int) string {
+	if len(body) <= maxBody {
+		return body
+	}
+	if maxBody <= utf8.UTFMax {
+		return body[:maxBody]
+	}
+	// Walk back at most UTFMax bytes to find a clean rune boundary.
+	i := maxBody
+	for i > maxBody-utf8.UTFMax && !utf8.RuneStart(body[i]) {
+		i--
+	}
+	return body[:i]
+}
diff --git a/server/lib/events/event.go b/server/lib/events/event.go
index cb5565d8..5ef7060e 100644
--- a/server/lib/events/event.go
+++ b/server/lib/events/event.go
@@ -69,17 +69,17 @@ type Envelope struct {
 }
 
 // CategoryFor derives an EventCategory from an event type string.
-// It splits on the first dot and maps the prefix to a category.
+// It splits on the first underscore and maps the prefix to a category.
 func CategoryFor(eventType string) EventCategory {
-	prefix, _, _ := strings.Cut(eventType, ".")
+	prefix, _, _ := strings.Cut(eventType, "_")
 	switch prefix {
 	case "console":
 		return CategoryConsole
 	case "network":
 		return CategoryNetwork
-	case "page", "navigation", "dom", "target":
+	case "page", "navigation", "dom", "target", "layout":
 		return CategoryPage
-	case "interaction", "layout", "scroll":
+	case "interaction", "scroll":
 		return CategoryInteraction
 	case "liveview":
 		return CategoryLiveview