@@ -282,6 +282,38 @@ describe('bugsee umbrella launch', () => {
     expect(JSON.parse(perfPosts[0]?.body ?? '{}').transactions).toHaveLength(1);
   });
 
+  // A 30s tick is the ONLY delivery path the uploader had, so anything buffered since the last one was
+  // lost whenever the process ended first — which for a serverless invocation, a CLI, or a test is every
+  // time. `flush()` is documented as "get everything out"; it drained reports but not transactions.
+  it('flush() delivers buffered transactions instead of waiting for the interval', async () => {
+    const { scheduler } = fakeScheduler();
+    const { fn: transport, perfPosts } = recordingTransport();
+    const client = track(
+      launch('tok', base({ carrier: {}, scheduler, transport, performanceFlushIntervalMs: 7777 })),
+    );
+    (client.ext('performance').getActiveSpan() as Transaction).finish(); // buffered, no tick fired
+    expect(perfPosts).toHaveLength(0);
+
+    await client.flush();
+
+    expect(perfPosts).toHaveLength(1);
+    expect(JSON.parse(perfPosts[0]?.body ?? '{}').transactions).toHaveLength(1);
+  });
+
+  it('stop() delivers what was buffered rather than dropping it on teardown', async () => {
+    const { scheduler } = fakeScheduler();
+    const { fn: transport, perfPosts } = recordingTransport();
+    const client = launch(
+      'tok',
+      base({ carrier: {}, scheduler, transport, performanceFlushIntervalMs: 7777 }),
+    );
+    (client.ext('performance').getActiveSpan() as Transaction).finish();
+
+    await client.stop();
+
+    expect(perfPosts).toHaveLength(1);
+  });
+
   it('starts the uploader at performanceFlushIntervalMs', () => {
     const { scheduler, intervals } = fakeScheduler();
     track(launch('tok', base({ carrier: {}, scheduler, performanceFlushIntervalMs: 7777 })));
 
@@ -279,10 +279,25 @@ export function wireUmbrella(
   // already registered as the process singleton, so mutating its stop() here means the carrier singleton,
   // a repeat launch, and this return value are all one consistent client whose stop() tears the extensions
   // (performance, OTel propagation, consume) down before the core teardown.
+  //
+  // `flush()` is composed the same way and for the same reason: the performance uploader delivers on an
+  // interval, so without this everything buffered since the last tick is lost whenever the process ends
+  // first — the normal case for a serverless invocation, a CLI run, or a closing tab. The extension's
+  // drain runs BEFORE the core drain so a transaction batch and the reports leave in one flush.
   const stopClient = client.stop;
-  client.stop = (timeout?: number): Promise<boolean> => {
+  const flushClient = client.flush;
+  // No guard around it: `uploader.flush()` already catches a failed batch into `onError` and drops it, so
+  // a broken APM upload cannot turn a caller's flush()/stop() into a rejection and cost them the crash
+  // report they were flushing. Wrapping it again here would be untestable through this seam.
+  const flushExtensions = (): Promise<void> => wired.flush();
+  client.flush = async (timeout?: number): Promise<boolean> => {
+    await flushExtensions();
+    return flushClient(timeout);
+  };
+  client.stop = async (timeout?: number): Promise<boolean> => {
     void spanProcessor?.shutdown();
     offPropagation?.();
+    await flushExtensions();
     wired.stop();
     return stopClient(timeout);
   };
 
@@ -17,7 +17,7 @@
 // unit tests (bundle.test.ts), run in CI by the `test:unit` task — an assertion library that cannot fail is
 // precisely the theater this work removes, so every assertion has a negative test.
 import type { ManifestJson } from '@bugsee/protocol';
-import { strFromU8, unzipSync } from '@bugsee/util';
+import { gunzipSync, strFromU8, unzipSync } from '@bugsee/util';
 
 /** The subset of the mock collector this library needs — keeps it usable from every harness. */
 export interface UploadsSource {
@@ -147,6 +147,28 @@ export function assertNoContractViolations(source: ViolationSource): void {
  *
  * An empty secret is rejected — it would match every file and turn this into a no-op that always passes.
  */
+/**
+ * The searchable bytes of a bundle entry: gzip-compressed ones are INFLATED first.
+ *
+ * Without this the scan is blind to exactly the file most likely to carry typed characters. `replay.bin`
+ * is written gzipped, so a secret recorded verbatim inside it is not a substring of the stored bytes and
+ * a raw scan sweeps clean over a real leak — measured, not theorised: a real-Chromium run with masking
+ * disabled put a typed password in plaintext inside `replay.bin` and this function passed it.
+ *
+ * Detection is by gzip magic (`1f 8b`) rather than by filename, so it covers any compressed entry.
+ *
+ * A truncated or corrupt stream throws, deliberately uncaught here: the caller already wraps this in the
+ * lenient decode whose fallback searches the RAW bytes, which is exactly the right answer for a file
+ * whose claimed compression is a lie. Catching it here as well was dead code — a mutation that removed
+ * the inner handler changed no test outcome, which is what exposed it.
+ */
+function decompressed(bytes: Uint8Array): Uint8Array {
+  if (bytes.length < 2 || bytes[0] !== 0x1f || bytes[1] !== 0x8b) {
+    return bytes;
+  }
+  return gunzipSync(bytes);
+}
+
 export function assertNoSecrets(bundle: ParsedBundle, secrets: readonly string[]): void {
   // The apptoken exemption keys on PROVENANCE, not the name: only the assembler's structural apptoken (a
   // root entry the manifest does not declare) is skipped. An attachment that merely happens to be called
@@ -167,7 +189,7 @@ export function assertNoSecrets(bundle: ParsedBundle, secrets: readonly string[]
     // Decode leniently: binary payloads still surface ASCII substrings, which is what a leak looks like.
     let text: string;
     try {
-      text = strFromU8(bytes);
+      text = strFromU8(decompressed(bytes));
     } catch {
       text = Buffer.from(bytes).toString('latin1');
     }
 
@@ -53,6 +53,16 @@ export interface MockCollector {
   echoHits: number;
   /** The request headers of each /echo hit (so a test can assert injected traceparent/tracestate). */
   echoHeaders: Array<Record<string, string | string[] | undefined>>;
+  /**
+   * Performance transactions posted to `/v2/performance/transactions`, flattened across batches.
+   *
+   * The mock had no such route, so every batch 404'd into `onError` and no harness could see APM data at
+   * all — the SDK's transactions were the one payload nothing verified. The OTel consume bridge feeds
+   * this same endpoint, so it is also how a consumed OTel span becomes visible.
+   */
+  transactions: Array<Record<string, unknown>>;
+  /** OTLP/HTTP-JSON export requests posted to `/v1/traces` (the produce-direction tee). */
+  otlpTraces: Array<Record<string, unknown>>;
   /**
    * Every envelope that failed schema validation, in arrival order. The collector RECORDS rather than
    * rejects, so a contract break shows up as a readable test failure instead of an opaque upload error
@@ -77,9 +87,26 @@ const readBody = (req: IncomingMessage): Promise<Uint8Array> =>
 // `app.utils.js` success()/error().
 const envelope = (result: unknown): unknown => ({ ok: true, result });
 
+/**
+ * The CORS headers the REAL collector must send, because the browser SDK is always cross-origin with the
+ * page that loaded it — a customer's app runs on their domain and uploads to Bugsee's.
+ *
+ * The mock did not send them, which meant no harness could ever drive the SDK from a real browser: the
+ * very first upload fails at the preflight with an opaque "Failed to fetch". Every browser-tier suite ran
+ * under jsdom, where fetch enforces no same-origin policy, so the gap was invisible until a real Chromium
+ * was pointed at this server.
+ */
+const corsHeaders = (): Record<string, string> => ({
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET, POST, PUT, OPTIONS',
+  'access-control-allow-headers': '*',
+  'access-control-expose-headers': '*',
+  'access-control-max-age': '600',
+});
+
 const sendJson = (res: ServerResponse, status: number, payload: unknown): void => {
   const body = Buffer.from(JSON.stringify(payload));
-  res.writeHead(status, { 'content-type': 'application/json' });
+  res.writeHead(status, { 'content-type': 'application/json', ...corsHeaders() });
   res.end(body);
 };
 
@@ -96,6 +123,8 @@ export async function startMockCollector(): Promise<MockCollector> {
   const issues: Array<Record<string, unknown>> = [];
   const uploads: CapturedUpload[] = [];
   const echoHeaders: Array<Record<string, string | string[] | undefined>> = [];
+  const transactions: Array<Record<string, unknown>> = [];
+  const otlpTraces: Array<Record<string, unknown>> = [];
   let echoHits = 0;
   let issueSeq = 0;
   // Maps an upload path (/upload/<n>) to the issueId we minted for it, so a captured PUT can be
@@ -108,6 +137,15 @@ export async function startMockCollector(): Promise<MockCollector> {
     const url = req.url ?? '/';
     const method = req.method ?? 'GET';
 
+    // Preflight. A cross-origin PUT, and a POST carrying `content-type: application/json`, are both
+    // non-simple requests, so a real browser sends OPTIONS first and never issues the upload at all
+    // unless it is answered.
+    if (method === 'OPTIONS') {
+      res.writeHead(204, corsHeaders());
+      res.end();
+      return;
+    }
+
     void (async () => {
       try {
         if (method === 'POST' && url.endsWith('/v2/sessions')) {
@@ -174,20 +212,38 @@ export async function startMockCollector(): Promise<MockCollector> {
           } catch (err) {
             violations.push({ where: 'manifest', errors: `unreadable bundle: ${String(err)}` });
           }
-          res.writeHead(200);
+          res.writeHead(200, corsHeaders());
           res.end();
           return;
         }
+        if (method === 'POST' && url.endsWith('/v2/performance/transactions')) {
+          const body = await readBody(req);
+          const batch = JSON.parse(Buffer.from(body).toString('utf8')) as {
+            transactions?: Array<Record<string, unknown>>;
+          };
+          transactions.push(...(batch.transactions ?? []));
+          sendJson(res, 200, envelope({ accepted: batch.transactions?.length ?? 0 }));
+          return;
+        }
+        if (method === 'POST' && url.endsWith('/v1/traces')) {
+          // OTLP/HTTP-JSON. A real collector answers with an (empty) ExportTraceServiceResponse.
+          const body = await readBody(req);
+          otlpTraces.push(
+            JSON.parse(Buffer.from(body).toString('utf8')) as Record<string, unknown>,
+          );
+          sendJson(res, 200, {});
+          return;
+        }
         if (url.startsWith('/echo')) {
           echoHits += 1;
           echoHeaders.push({ ...req.headers }); // captures any injected traceparent/tracestate
           sendJson(res, 200, { ok: true, ts: 'e2e' });
           return;
         }
-        res.writeHead(404);
+        res.writeHead(404, corsHeaders());
         res.end();
       } catch (err) {
-        res.writeHead(500);
+        res.writeHead(500, corsHeaders());
         res.end(String(err));
       }
     })();
@@ -203,6 +259,8 @@ export async function startMockCollector(): Promise<MockCollector> {
     issues,
     uploads,
     echoHeaders,
+    transactions,
+    otlpTraces,
     violations,
     get echoHits() {
       return echoHits;
 
@@ -0,0 +1,12 @@
+// The literals the browser scenario types into the page and the browser e2e asserts on.
+//
+// They live in their own module because `browser-scenario.ts` runs on import — it touches `window` at
+// module scope, which is correct in a page and a `ReferenceError` in the node test process. Importing the
+// values from here keeps ONE definition without dragging the page's side effects into the runner.
+
+/** The value typed into the password field. It must not reach ANY byte of ANY uploaded file. */
+export const BROWSER_SECRET = 'pw-e2e-MUST-NOT-SHIP-9f3a';
+/** The value typed into an ordinary (non-sensitive) field. */
+export const BROWSER_VISIBLE_TEXT = 'ordinary-visible-input';
+/** Text rendered into the page body, masked by rrweb's `maskAllText`. */
+export const BROWSER_BODY_TEXT = 'body-text-e2e-marker';