Pup - Puppeteer Bridge

Foreground gate matching abe's dual-key contract: foreground:true without foregroundReason opens background with foregroundDenied, raise/focus without a reason is refused with foreground_reason_required, and every granted foreground is logged, recorded in lastAgentUpdate, and surfaced as lastForeground in status.

Sized opens keep their requested x/y (the legacy re-assert clobbered geometry back to the primary origin, blocking second-monitor placement; now z-only via AD state:bottom force:false), and window-management is granted by default so getScreenDetails can enumerate the real monitor layout.

Park after the page settles so the first paint's window-raise happens invisibly off-screen; the window's first visible frame is full-size, z-bottomed, and z-confirmed, eliminating the transient on-top blip other threads' windows showed.

Re-assert z-bottom after the open's navigation and at the load event (the first cross-origin nav re-shows the window at first paint and raised it after the park's z-confirm had passed), and after open_tab's new-tab first paint; all with force:false so a user-held window is never yanked.

Placement doctrine: geometry via CDP plain bounds only sized from the page's own screen metrics, re-bottom after every move, confirm the z-order via desktop_list_windows, and move the window back off-screen if z-bottom cannot be confirmed; AD set_window_bounds and CDP maximize are both banned from background placement because each raises the window.

Never use CDP windowState maximized for background placement: Chromium implements it as SW_MAXIMIZE which raises the window to the top of the z-order and covered the user's work; placement now uses AD desktop_set_window_bounds restore:false sized from desktop_list_monitors, preserving the forced z-bottom.

Background windows now appear already-maximized: the park stages the window just past the left screen edge (invisible but monitor-adjacent) before the OS maximize, eliminating the visible small-then-grow; verify and heal thresholds tightened to catch a window stuck at the staging spot.

Adopt AD 1.9.115's force:true on desktop_set_window_state state:bottom so the launch park bottoms a foreground window in one AD call; legacy PS fallback retained only for AD 1.9.114 and older and auto-obsoletes as desktops update.

When AD skips z-bottom because the window is foreground (its requested skip-on-foreground semantics), the launch park now force-bottoms via the legacy path, fixing park-failed on the post-restart foreground-reassignment case; AD follow-up filed for a force flag.

Adopt AD 1.9.114's desktop_set_window_state state:bottom for the park's z-order step, deleting the last PowerShell from the open path so window management is fully direct API, with a legacy PS fallback for desktops on older AD.

Remove the launch-park user-click escape hatch entirely: foreground-at-park has non-user causes (Windows reassigns foreground to a fresh window after the previous foreground window is destroyed, e.g. on a bridge-update restart), which forced never-clicked windows onto the user's screen; the launch park now bottoms unconditionally and a user who clicked during the 2s gap just clicks once more.

Hard rule: a window is never moved on-screen until z-bottom is confirmed; under parallel-open load a lagged hwnd lookup used to place an un-bottomed window on top of the user's work; now it retries up to 8x then stays off-screen as an honest park-failed, and park-failed windows self-heal on any status query.

Badge calls now check AD's real result and log failures instead of silently swallowing them, and the tab-path badge debounce only arms on success so a failed badge retries on the next call.

Self-heal windows stranded off-screen by older builds at reattach and on the open_tab/switch_tab hot path, re-badge debounced so long-lived shared windows like adom-shotlog stay clickable and badged; teach anonymous creators the owner param; enrich open_tab and switch_tab describe entries.

Fix the flash 'pending vs cleared' focus latch: install the window-focus hook into the CURRENT document too, not only future navigations, so windows the user already clicked report flash cleared and the still-unseen window is identifiable programmatically.

Park places the window via the OS maximize (CDP windowState) instead of a screen-size probe that could fail mid-navigation and produce 1600x900 windows; move to primary monitor then maximize, no activation.

Fix the user-click detection: use GetForegroundWindow (the OS truth) instead of document.hasFocus which lies for CDP-created windows and false-fired user-foreground on every open; the z-bottom PS call now checks foreground first at zero extra cost.

Direct-API park: CDP setWindowBounds addresses the exact window (parking the wrong window impossible), AD find_window replaces EnumWindows PS, park runs at newPage so no wait loop, verification checks position not focus, badge fires the instant the park lands.

Close the launch gap: a taskbar click during the first seconds now brings the window up on-screen at top full-size instead of activating it invisibly off-screen; unambiguous because no-startup-window means only the user can make the window foreground.

Eliminate the focus steal at the source: background launches use --no-startup-window so the window is created by a background process the OS denies foreground to; the stability watch, timers, and re-parks are deleted, so a user taskbar click at any moment sticks.