Summary

This PR proposes an observational approach related to issue #6068: record restricted form-control state changes observed around evaluate, while preserving the original JavaScript result.

It overlaps with PR #6106, which adds an inline-wrapper warning. This PR explores a complementary CDP isolated-world observer.

Approach

• Observe control-state snapshots through an isolated execution world rather than running observer code in the evaluated page world.
• Attach typed, non-confirmatory observations to action and history data.
• Preserve the original evaluate result and schema-backed structured-output behavior.
• Bound best-effort snapshots and clean up pending CDP request futures on timeout or cancellation.
• Add focused coverage for control identity and DOM changes, snapshot failures, history disclosure, and real-CDP cancellation cleanup.

Important limitations

• A state change observed around evaluate is correlation, not proof that the evaluated code caused it or that a policy violation occurred. A legitimate synchronous page handler can also enable a control.
• The observation is not delivered to the agent during the run, so it does not itself prevent a bypass or guarantee truthful final reporting.
• The observer covers the main document and open shadow roots; it does not traverse child iframes.
• This is not an end-to-end fix for Bug: agent enables a disabled button with evaluate, places the order, and often reports a plain success #6068.

Validation

• Local focused command: .venv\Scripts\python.exe -m pytest -q tests/ci/test_evaluate_control_state_observation.py tests/ci/test_agent_history_policy.py tests/ci/test_sandbox_structured_output.py tests/ci/test_cdp_timeout.py — 63 passed in 11.83s, including the real-browser/CDP cancellation regression.
• File-scoped pre-commit checks passed.
• Ruff check, Ruff format check, Pyright, and git diff --check passed.
• GitHub Actions for head ed5b4ad505d5368badd33849fc00856483ce0ac8: test passed; lint passed. The “Evaluate PR” workflow was skipped.

Maintainer feedback requested

Would the isolated-world observer provide useful complementary coverage to #6106, or would you prefer this contribution to focus on a smaller independent test or history-integrity change?

This PR does not claim to fully fix or close #6068.