diff --git a/.changeset/nightwatch-run-all.md b/.changeset/nightwatch-run-all.md
new file mode 100644
index 00000000..a80fe4f4
--- /dev/null
+++ b/.changeset/nightwatch-run-all.md
@@ -0,0 +1,7 @@
+---
+'@wdio/nightwatch-devtools': patch
+'@wdio/devtools-backend': patch
+'@wdio/devtools-app': patch
+---
+
+Enable Run all for Nightwatch, which the dashboard disabled although the backend could already run the whole config. Run all now replays the selection the run was launched with (spec paths, `--tag`, `--group`, `--env` and the like) rather than every spec in the config, and a rerun in between does not narrow it.
diff --git a/.changeset/selenium-run-all-launch-command.md b/.changeset/selenium-run-all-launch-command.md
new file mode 100644
index 00000000..7a098058
--- /dev/null
+++ b/.changeset/selenium-run-all-launch-command.md
@@ -0,0 +1,5 @@
+---
+'@wdio/selenium-devtools': patch
+---
+
+Keep Run all on the original command after a targeted rerun. A rerun's process was started with a name filter, and Run all used to be built from that process's own arguments, so it replayed the filter; it now inherits the command the dashboard's first run published. Run all also no longer comes out as `npm run npx` when the tests were started with `npx` or `pnpm exec`, and a spec path or filter containing a space now reaches the relaunched run as one argument.
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 4bb9a40a..73d17608 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -29,6 +29,10 @@
 - [ ] `script` (page-injected runtime)
 - [ ] `trace` (Trace mode)
 
+## Capability matrix
+
+- [ ] `packages/conformance/src/features.ts` updated, and tables regenerated with `pnpm docs:capabilities`, if this adds or changes user-facing behaviour
+
 ## Notes for reviewers
 
 [//]: # (Anything non-obvious: design trade-offs, alternatives you ruled out, follow-ups. If this PR touches more than one adapter, say why the shared logic doesn't live in `core`.)
diff --git a/CLAUDE.md b/CLAUDE.md
index 533471c9..608e5dc0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -29,6 +29,7 @@ Run from repo root unless noted.
 | `pnpm demo:wdio` / `pnpm demo:nightwatch` / `pnpm demo:selenium` | Run the per-framework example projects. Useful for manual verification of UI or runtime changes. **No package pins a browser driver**, deliberately: a pinned `chromedriver` rots against whatever Chrome the developer has, and because pnpm puts the package's `node_modules/.bin` on `PATH`, Selenium Manager finds it there, prefers it over resolving, and on a major mismatch only *warns* before returning it anyway. The session then fails to start. With nothing on `PATH` both adapters resolve a matching driver (Nightwatch's Chrome service builder sets `requiresDriverBinary: false` and passes an unset `server_path` through to the same resolver), and nightwatch declares `chromedriver` an optional peer. |
 | `pnpm demo:wdio:mobile` / `:selenium:mobile` / `:nightwatch:mobile` / `:python:mobile` | The same, against Appium. All four build the same capability bag and drive the Clock app that ships with every Android system image (keying a duration on the timer keypad, never starting a timer), so a native example needs no `.apk`. `DEVTOOLS_MOBILE_PLATFORM=ios` runs the iOS spec instead — all four adapters — which drives Settings because the simulator ships no Clock, from a separate spec per platform rather than a branch. The simulator is chosen by udid and defaults to whichever is already booted, and an unmatched `IOS_DEVICE_NAME` is refused: naming one that does not exist makes the XCUITest driver create and boot it, every run, rather than fail. That refusal and the booted-simulator preflight are **local** policy — `xcrun simctl` enumerates local simulators and nothing else — so `IOS_UDID` and a non-local `APPIUM_HOST` both bypass them, or a real device and a cloud grid would be refused a run they were correctly configured for. `DEVTOOLS_MOBILE=web` drives the device's own browser on both platforms — Chrome on Android, Safari on iOS, which the XCUITest driver serves without a chromedriver. `examples/MOBILE.md` holds the prerequisites and the `DEVTOOLS_MOBILE` / `APPIUM_APP` switches; `DEVTOOLS_MODE=trace` flips any demo to trace mode. |
 | `pnpm dev` | Run all packages in parallel dev mode. |
+| `pnpm docs:capabilities` | Render the per-adapter capability tables from `packages/conformance/src/features.ts` into `README.md`; `--website <webdriverio checkout>` also renders the docs-site tables, `--check` fails instead of writing, and `--parity` lists every feature some adapter lacks plus the evidence counts. |
 | `python3 packages/selenium-devtools-py/scripts/changes.py next-version` | The version a Python-adapter release would publish, from the fragments pending in `changes/`. `check --base <ref>` is the CI gate; `apply` is what the release runs. |
 
 `selenium-devtools` exposes per-runner variants of its example via `pnpm --filter @wdio/selenium-devtools example:mocha` / `:mocha:allure` / `:jest` / `:cucumber`.
@@ -48,6 +49,7 @@ Defined in root `tsconfig.json`:
 | `@wdio/devtools-script` / `*` | `packages/script/src/...` |
 | `@wdio/devtools-service` / `*` | `packages/service/src/...` |
 | `@wdio/selenium-devtools` / `*` | `packages/selenium-devtools/src/...` |
+| `@wdio/nightwatch-devtools/*` | `packages/nightwatch-devtools/src/*` (subpaths only, for type imports such as the option types) |
 | `@wdio/devtools-shared` / `*` | `packages/shared/src/...` |
 | `@wdio/devtools-core` / `*` | `packages/core/src/...` |
 | `@wdio/devtools-trace` / `*` | `packages/trace/src/...` |
@@ -259,6 +261,7 @@ Neither is hand-versioned: both assemble the version and the changelog at releas
 ### Documentation
 
 - User-facing docs live in two places that must stay in sync: this repo's `README.md` (+ per-package READMEs) and the **WebdriverIO devtools webpage** (`website/docs/devtools/**` in the `webdriverio/webdriverio` repo — e.g. `wdio/TraceMode.md`). When a change adds, removes, or alters user-facing behavior (a new option, CLI, flag, output, or workflow), update the README here **and** mirror it to the matching webpage doc in the same change. A docs PR that updates only one side isn't complete.
+- The capability tables (the README's support, dashboard and mobile tables, the docs site's `CrossFrameworkSupport.md` and `MobileTesting.md`) are generated, never edited by hand. `packages/conformance/src/features.ts` declares every user-facing feature with a cell per adapter, typed as a complete map over the conformance suite's adapter ids, so a new adapter does not compile until each feature declares it. A partial or unsupported cell carries a required reason, which renders as the footnote. A supported cell carries its evidence: conformance rules the adapter has no known gap against (rendered "✅ tested"), a test file in that adapter's own tests or a shared package's (`core`, `trace`, `backend`), or why it is checked by hand. The cell builders and rule groups are in `capability-helpers.ts` beside it, so `features.ts` stays the list alone. Two coverage checks keep a new feature from bypassing the list: every user-facing option (`capability-options.ts`, keyed on the real option types of the shared base and each JS adapter, plus the Python `enable()` keywords, pytest options and user-facing `DEVTOOLS_*` variables read from source by a test) names a feature id, typed so a misspelt id fails to compile, or says why it is not one; and every conformance rule backs a tested cell or is listed in `INTERNAL_RULES` with a reason. A test fails when the README tables are out of date; the docs-site copy is refreshed with `pnpm docs:capabilities --website <checkout>` in the same change.
 
 ---
 
@@ -269,7 +272,7 @@ Documented divergences from the conventions above. They exist today as debt to b
 ### Architecture
 
 - `replaceCommand` has two semantics — Selenium mutates in place (preserves `_id`/`id` for chained calls); Nightwatch splices and reissues. Both call the same `core/suite-helpers` factories; the storage strategy stays adapter-specific because runner integrations differ. Could be unified by parameterizing the policy if the divergence ever causes a real problem.
-- `patchNodeAssert` (via `core/assert-patcher`) is now wired in all three adapters, default-on behind each adapter's `captureAssertions` option (opt out with `captureAssertions: false`). Framework matcher libraries differ: Service taps expect-webdriverio's `beforeAssertion`/`afterAssertion` hooks so passing+failing matchers render as `expect.*` actions (mechanism in the assert-capture entry below); Nightwatch native `assert`/`verify` and Selenium's `node:assert` also surface passing+failing rows via their reconcile/patch paths. The remaining gap is Selenium's jest-style `expect()` (and chai): jest/vitest expose no pass+fail assertion hook, so only failing matchers surface there.
+- `patchNodeAssert` (via `core/assert-patcher`) is now wired in all three adapters, default-on behind each adapter's `captureAssertions` option (opt out with `captureAssertions: false`). Framework matcher libraries differ: Service taps expect-webdriverio's `beforeAssertion`/`afterAssertion` hooks so passing+failing matchers render as `expect.*` actions (mechanism in the assert-capture entry below); Nightwatch native `assert`/`verify` and Selenium's `node:assert` also surface passing+failing rows via their reconcile/patch paths. The remaining gap is Selenium's jest-style `expect()` (and chai): jest/vitest expose no assertion hook, so those matchers produce no rows at all, and a failing one only marks its test failed. Nightwatch's own `expect` API is not wrapped either, so it produces no rows.
 - BiDi is auto-attached in Service and Selenium; Nightwatch is opt-in via `bidi: true` and requires `webSocketUrl: true` in capabilities.
 - **Network has three sources, and the page's Resource Timing is the floor.** BiDi (all four adapters) and Nightwatch's Chrome performance log are driver-side and carry headers and status. The page collector carries two: its patched `fetch`/`XMLHttpRequest` (the only source with bodies) and the document's Resource Timing buffer (`script/src/collectors/resourceTiming.ts`): every load with timing phases and size, a status on Chromium only, never headers. Resource Timing is the only network source a browser without BiDi has, which is Safari and every Appium session (Appium's BiDi reference lists `session.*` alone). The collector reads the buffer at construction, which is what covers loads made before a `<script>`-injected collector existed, then observes; a second evaluation of the bundle in the same document keeps the first collector (next entry), so the buffer is read once per document. Its two page sources are deduplicated inside the collector: the patch *claims* each call (absolute URL without fragment, which is the form the buffer names, plus start time), a `fetch`/`xmlhttprequest` entry within 1 s of a claim is taken so the row with headers and body is the one kept, and because the entry can arrive before the call has answered, a taken entry is *held* until the patch records the call (the entry is then its second listing and dropped) or drops it (no content-type, a rejected fetch, an XHR `error`/`abort`/`timeout`: the held entry becomes the request's only record). Recording a failed call as a failed row instead was tried and reverted: the service and Nightwatch keep the page's patched rows beside BiDi's, so on Chrome every blocked beacon was listed twice (Nightwatch example 35 → 67 failure rows); without BiDi a failed call therefore reads as unknown rather than failed, which is the entry's own account of it. Against a driver-side source the gate is `processTracePayload`'s `skipResourceTimingRequests`, which drops only the Resource Timing rows and leaves the patched rows their bodies, and **the gate is evidence, not a subscription**: measured on Appium 3.7's XCUITest driver, selenium-webdriver's BiDi inspectors attach cleanly and then deliver nothing, so gating on `bidiActive` (or on `browser.isBidi`) withheld the page's rows and the trace had zero network rows. Each adapter therefore latches on the first BiDi network event it receives (service `#bidiNetworkObserved`, set in `handleNetworkRequestStarted`; Selenium and Nightwatch `bidiNetworkObserved`, set in their `buildBidiSinks`; Python `stats["observed"]`, read by `bidi.network_serving`) and gates on that. Nightwatch's performance log is deliberately **not** a gate either: a capability can name a log the driver never serves (XCUITest), and the log is read after the drain in any case, so `perfLogs.ts` `upgradeResourceTimingRows` pairs each log entry with the page's row for the same load (URL, nearest `timestamp`, the log's being dated from CDP's `wallTime` because the monotonic clock only diffs within a session) and lays the log's method, headers, status and size over that row, keeping the row's id, clock and measured phases, and re-sends it under the id, which the dashboard replaces in place. The reverse order is covered too: a load that completes between the drain and the log read reaches the session as the log's row first, so the session keeps it in `loadsListedByLog` until the next drain, where `withoutLoadsTheLogListed` spends it on the page's one row for it (same URL, nearest `timestamp` within 2 s). A ledger spent per load, not a scan of the rows the session holds: the scan read the collector's own patched fetch row, or a row the log had already upgraded, as the listing of a *second* request to that URL inside the window and dropped that request outright (a fetch answered with a content-type-less 204 after one answered with JSON lost its only row). Spent at the next drain that reaches the driver, a collector-less document included, and forgotten at a session replacement (`armReplacedSession`), because the page observed the load before the log could list it: a row absent from that drain is never coming, and a load kept longer would take the row of the next request to the same URL. Residual, Chrome only (Safari and Appium serve no log, so the ledger stays empty there): the log also lists the collector's own patched fetch/XHR calls, whose row is not a Resource Timing row, so `upgradeResourceTimingRows` appends the log's row beside the patched one (main ingested both too) and the ledger can spend it on the row of a different request to that URL inside the window, as it can on the next document's load of a shared asset; the request then survives as its own log row, without the page's phases, so the cost is a row's shape rather than a request. Python withholds the whole page batch once BiDi is serving, as selenium-devtools does (whose console gate, `bidiConsoleObserved`, is evidence-based for the same reason); both lose the patched rows' bodies there rather than list each fetch twice beside its BiDi row, which is what the service's keep does. Residuals: a drain that lands before the first BiDi event of a page is delivered can pass that page's rows once, and Nightwatch clears both flags at a session rotation, so loads in the window before BiDi re-attaches can be listed by both.
   - **A second evaluation of the collector bundle in one document keeps the first collector.** Every adapter probes for the collector before injecting, but two callers can pass the probe before either injection has run (Nightwatch's navigation proxy and its drain's recovery, Selenium's navigation hook and its recovery), and the second evaluation used to replace `window.wdioTraceCollector` and drop everything the first had buffered. Measured on Android Chrome through Appium, where there is no BiDi and the `<script>` path is the only one: Nightwatch injected twice 11 ms apart and the trace had **0 network rows** for a run that loaded two pages, because the replacement also could not re-read the Resource Timing buffer without listing the first collector's loads again. `collector.ts` now exports `alreadyInstalled` and keeps the instance it finds, and `index.ts` skips its bootstrap on that flag, so the second script is a no-op rather than a second observer feeding the same collector; the adapters' probes only save the round trips. The `chrome-native:` new-tab document a mobile Chrome session opens on is ignored with the rest of the browser's own schemes, since a session starts there before its first navigation; that list is `shared/browser-schemes.ts`, read by core's injection gate and the collector's request filter alike, so the two cannot drift again.
@@ -291,7 +294,7 @@ Documented divergences from the conventions above. They exist today as debt to b
   - A plain script's tree is one synthetic suite holding one synthetic test, and both denote the whole run, so its launch command doubles as its rerun template (no slot — the backend substitutes nothing) and all three controls are honest. Refusing the row-scoped ones instead would disable the button beside the only row the tree has.
   - **Two unrelated events share the `clearExecutionData` scope, and the receiver cannot tell them apart from the uid.** A run STARTING (`backend/src/index.ts` `handleTestRun`, one per `POST /api/tests/run`) and ONE ENTRY resetting inside a run already in flight (`nightwatch-devtools/src/cucumber-lifecycle.ts`, which re-emits a scenario suite and must not wipe its siblings) arrive under the same scope with the same shape. The app inferred the difference by comparing the uid against `rerunState.activeRerunSuiteUid` — a latch that outlived its rerun, so the *next* run start at a different scope read as a child clear of the last one and **skipped its wipe entirely**: rerun a suite, then the file or Tests, and the Actions/Console/Network tabs kept the previous run's rows and grew with each rerun. `ClearExecutionDataWsPayload.runStart` now states it on the wire (it has to be on the wire, not local to the clicking window — popouts see only WS events), and the app clears both latches when it is set. A backend test asserts the flag actually ships: the app-side fix reads it, so dropping it would restore the bug with every app test still green.
     - Still open, same class: `app/src/components/browser/snapshot.ts` `#videos` is only ever pushed to, so the screencast "Recording N" dropdown accumulates every session of every run for the life of the page (observed at 17). That component listens only to the `screencast-ready` window event and never learns a run started.
-  - **A rerun's process collects a SUBSET, so anything it derives from "this collection" is wrong for the tree it merges into.** Three bugs of that one shape, all found by rerunning a single pytest test. The third is the one that shows the rule has a limit: (c) the **launch command** — what Run-all spawns — was built from the child's own invocation, which the backend had narrowed to a single nodeid, so one targeted rerun rescoped Run-all to that test permanently and the tree kept showing only what that child collected. Unlike (a) and (b) this is not recoverable inside the child: its arguments no longer mention what it was narrowed from. The original travels down instead, as `REUSE_ENV.LAUNCH_COMMAND` beside the rest of the reuse handshake; the *rerun template* stays locally derived, since only this process can say how its own interpreter selects a test. **Fixed in the Python adapter only** — `selenium-devtools/src/rerunManager.ts` still derives its launch command from `captureLaunchCommand()`, i.e. from the child's own argv, so a mocha/jest rerun carrying an inherited `--grep` republishes that as Run-all. It already strips those filters out of the *template* for this reason; the getter is what is left. A second consumer makes the inherit-or-derive resolution itself core's, with `captureLaunchCommand` staying adapter-local. The other two: (a) `SuiteStats.order` — which `test-entry-state.ts` `orderedChildren` sorts a suite's tests and child suites by — was pytest's `enumerate(session.items)` index, so a rerun restamped its one test as position 0 and the row jumped above the class it was written below. It is now the item's **source line**, a property of the test rather than of the collection; within a module pytest collects in definition order, so the two agree wherever both are meaningful (a plugin that reorders collection is the exception, and there the line is the more stable answer anyway). (b) `suite-merge.ts` `resetStaleChildrenOnRerun` flipped every settled child *suite* to `pending` whenever an incoming suite arrived `pending` — but a single-test rerun re-emits the parent as `pending` carrying only the one test it collected, so a sibling class suite was set spinning and never reported again, keeping the spinner for the rest of the session with all of its own tests still green. `mergeTests` already froze sibling *tests* on `activeRerunTestUid`; that guard now covers child suites too. A suite on the path to the target is unaffected either way — it re-reports its own state.
+  - **A rerun's process collects a SUBSET, so anything it derives from "this collection" is wrong for the tree it merges into.** Three bugs of that one shape, all found by rerunning a single pytest test. The third is the one that shows the rule has a limit: (c) the **launch command** — what Run-all spawns — was built from the child's own invocation, which the backend had narrowed to a single nodeid, so one targeted rerun rescoped Run-all to that test permanently and the tree kept showing only what that child collected. Unlike (a) and (b) this is not recoverable inside the child: its arguments no longer mention what it was narrowed from. The original travels down instead, as `REUSE_ENV.LAUNCH_COMMAND` beside the rest of the reuse handshake; the *rerun template* stays locally derived, since only this process can say how its own interpreter selects a test. The inherit-or-derive resolution is Selenium's `helpers/launch-command.ts` `resolveLaunchCommand`, read only while the reuse handshake is live (a leftover export must not pin Run all on a first run); it stays in the adapter until a second JS adapter needs it, since Python mirrors it in `rerun.py` `_inherited_launch` and cannot import core. `captureLaunchCommand` ignores `npm_lifecycle_event` when `npm_command` is `exec` (`npx` sets the event to `npx` and `pnpm exec` sets none, so neither names a script to rerun) and shell-quotes each argument of its argv fallback, which the backend splits with `shellParse`. Nightwatch has no launch command, since the backend relaunches it through its framework path; the run that starts the backend records its CLI selection in `RUNNER_ENV.NIGHTWATCH_INITIAL_ARGS` (shared `encodeInitialArgs` / `parseInitialArgs`), or clears the variable when it selected nothing, in its own process, which a rerun child attaching in reuse mode cannot touch. The selection is specs made absolute plus every other flag without `--config`; Nightwatch parses argv with minimist and declares no boolean flags, so a flag's following bare word is its value and is never rewritten as a path, and only an entry script in the `nightwatch` package's `bin` folder counts as the CLI. The backend's `framework-filters.ts` `runAllFilters` replays it for both Nightwatch runners, as `WDIO_INITIAL_SPECS` does for every other. The other two: (a) `SuiteStats.order` — which `test-entry-state.ts` `orderedChildren` sorts a suite's tests and child suites by — was pytest's `enumerate(session.items)` index, so a rerun restamped its one test as position 0 and the row jumped above the class it was written below. It is now the item's **source line**, a property of the test rather than of the collection; within a module pytest collects in definition order, so the two agree wherever both are meaningful (a plugin that reorders collection is the exception, and there the line is the more stable answer anyway). (b) `suite-merge.ts` `resetStaleChildrenOnRerun` flipped every settled child *suite* to `pending` whenever an incoming suite arrived `pending` — but a single-test rerun re-emits the parent as `pending` carrying only the one test it collected, so a sibling class suite was set spinning and never reported again, keeping the spinner for the rest of the session with all of its own tests still green. `mergeTests` already froze sibling *tests* on `activeRerunTestUid`; that guard now covers child suites too. A suite on the path to the target is unaffected either way — it re-reports its own state.
 - **A `wait()` poll is the user's one call, not a row per tick.** selenium-webdriver's `driver.wait(until.…)` runs its first poll inside the call, with the spec line on the stack, and every later one from a timer with no user frame; the retry fold keyed on command, args and call source, so the first poll stood alone and the rest folded beside it, and because the driver patcher does not await `onCommand`, a poll could also arrive before the previous one had its id and start a third row. `captureOrReplaceCommand` now runs one capture at a time per capturer, and `RetryTracker.isRetryIgnoringSource` folds a source-less repeat into the sourced row only when it is one of a wait's own polls: the patched `wait()` runs its condition inside an `AsyncLocalStorage` (`driverPatcher.ts` `waitPoll`), which marks `CapturedCommand.duringWait` for exactly those commands, per driver and per async chain. A source-less call outside a wait (a node_modules helper) stays its own row, and so does a later call from the user's own code. Accepted cost: a library that polls from its own timer rather than through `driver.wait()` shows a row per poll.
 - **Safari delivers a synthesized mouse click only to its frontmost window, and a live run opens the dashboard in another browser.** safaridriver's `performInteractionSequence` answers success either way, so a click issued while the Safari window is not frontmost reaches nothing: measured on desktop Safari 26.5 with no DevTools involved at all, the page reported `document.hasFocus() === false` (once `visibilityState: hidden`), no pointer event fired, and the submit never happened in 3 of 3 attempts, while after activating Safari every click landed; the user's own manual click in that window logged in. Live mode is where it shows, because the dashboard window and the wait for it to connect are what move focus; trace mode mostly escapes it and Chrome never has it. This was earlier recorded as "the Python adapter's login flow on desktop Safari is flaky" with the per-command work as the suspect; that work only widens the window. The Selenium adapter switches to the session's own window handle before every element click, sendKeys, clear and submit on a Safari session (`DriverPatcherHooks.beforeInput`, the plugin's `focusForInput`): a WebDriver window switch brings exactly that window forward, one round trip, and holds whatever took the front in between, measured 3 of 3 live logins against 0 of 2 before. `open -a Safari` was tried first and is not enough, since it activates Safari's most recent window, which can be the user's own (`visibilityState: hidden` in the automation window afterwards). The WDIO service, Nightwatch and Python still use `core/browser-focus.ts` `restoreBrowserFocus` (`open -a Safari`) once after session bring-up in live mode, with that weakness; a per-input switch there is the next step. The Selenium dashboard also opens behind the current window on macOS for a Safari session (`dashboardLaunchCommand`, `open -n -g`). The Nightwatch BDD example's assertions are separately not Safari-proof (4 of 7 fail on Safari).
 - **A trace archive is a full recording of the page, and there is no redaction policy anywhere in capture.** Whatever the run put on screen or typed is in the zip, usually several times over: measured on the Python login example, its demo credential appears ~103 times across six places — the page's own displayed text (90x, the-internet prints it), the DOM mutation stream, the `Element.fill` command args, the transcript, the captured test source, and `*-elements.json`. `shared/element-scripts.ts` blanks an `<input type="password">` value, which is worth having because nothing downstream reads that field, but it removes **2 of those ~103** and closes nothing on its own. `buildElementScripts` now projects a captured record down to what is actually read (`selector` + `boundingBox` + context), so `value` and `href` leave the archive entirely — justified as dead data, **not** as a redaction: the same archive still carries 15 hrefs in `trace.mutations` independent of `elements.json`, and 29 `value` attribute mutations recording a typed string keystroke by keystroke (`t`, `to`, `tom`, ...). `@wdio/elements` keeps returning the full `BrowserElementInfo` from its own live call, which is its documented API. A real policy has to act at the collector and the command-arg serializer — a masking-selector or `maskInputs` option — not at one resource. Until then, treat a trace zip as sensitive as the run that produced it.
@@ -342,11 +345,11 @@ Documented divergences from the conventions above. They exist today as debt to b
 - **Actions that only read the page inherit the preceding action's capture** (`packages/trace/src/trace-frame-snapshots.ts` `claimAfter`). It is non-consuming and falls back to the most recent earlier capture instead of returning nothing, because several actions legitimately share one page state — Nightwatch emits its native assertion rows in a batch whose execution windows collapse onto one instant, and handing the capture to whichever claimed first left the rest of the batch with no DOM, no a11y tree and no screenshot. Nightwatch correspondingly takes **no** capture for an assertion row (`captureAssertCommand`): those rows are emitted at test-end but positioned back on their real execution window, so probing there recorded the page as it was *then* under a timestamp seconds earlier (an assert that ran on `/secure` rendered the `/login` page the test later logged out to).
 - **Every per-action snapshot probe is timeout-guarded** (`core/action-snapshot.ts` `probe`, `SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS`), not just the in-page scripts. Nightwatch's `browser.getCurrentUrl()`/`getTitle()` are QUEUED commands: called from inside the plugin's own command hook they enqueue behind the command still running and never resolve, and one unguarded probe in the capture's `Promise.all` stranded the whole snapshot — 10 of 14 captures never settled, so those actions reached the trace with no DOM, no a11y tree and no element rects. Nightwatch now runs all four probes (url/title/screenshot/script) over the raw WebDriver HTTP transport in `nightwatch-devtools/src/helpers/webdriverHttp.ts`, bypassing the queue entirely — the pattern `takeScreenshotViaHttp` already used. Relatedly, `runWith` treats a `null` script result as its fallback: a driver that answers `null` instead of rejecting (no-such-session, transport-swallowed script error) otherwise handed the serializers a non-array and lost the entire snapshot, screenshot and all.
 - The per-test `screenshot` and `video` options live on the **WDIO `ServiceOptions` only** — not `BaseDevToolsOptions` — because only the service implements them (an option belongs on an adapter until a second adapter consumes it, mirroring the core-helper rule; putting them on the shared base made them appear available in Selenium/Nightwatch and broke those adapters' `Required<>` option types). The policy *types* (`TraceScreenshotPolicy`/`TraceVideoPolicy`) and the capture/slice/encode logic (`core/screenshot-artifact.ts`, `core/video-slice.ts`) are framework-agnostic, so Selenium/Nightwatch adoption was wiring-only — now done (Selenium adds the options on its own `DevToolsOptions` with full inline attach; Nightwatch adds them produce-only — see the Allure-attach entry below). All are gated to `traceGranularity:'test'` (per-test inline Allure); coarser granularities keep artifacts in the manifest. Video records the screencast continuously and slices per-test by wall-time — the session frame buffer is bounded by `maxBufferFrames` (default 2000; decimates keeping first/last), and on non-Chrome the polling recorder issues many `takeScreenshot`s that flood `@wdio/allure-reporter` (pair with `disableWebdriverStepsReporting`).
-- The `filmstrip` option (dense screencast into the trace) is on **`BaseDevToolsOptions`** — the counterexample to the screenshot/video entry above — because all three adapters implement it (the "second consumer → base" rule realized). Core owns the work (`core/screencast-trace.ts` `thinScreencastFrames`/`buildDenseScreencast`; slice windowing in `spec-trace-helpers.ts`); adapters only default the option, un-gate the recorder in trace mode when it's set, and feed `recorder.frames` into the finalize context. Each adapter captures frames while the recorder is still alive (service `onReload` → `#filmstripFrames`; Selenium `onDriverEnd` drain before nulling; Nightwatch `#finalizeCurrentScreencast` snapshot before delegating), and each finalize context spreads `[...accumulated, ...(live recorder frames)]` so a **mid-run** per-spec/per-test slice flush (which fires before the recorder is drained) isn't blank. When dense frames are present they **supersede** the sparse per-action filmstrip (the per-action DOM `elements`/`snapshot` are carried independently by the `frame-snapshot` events, so no DOM data is lost); a run without dense frames keeps the sparse filmstrip, byte-stable with before. Thinning is applied at export; the live session frame buffer is bounded by `maxBufferFrames` (default 2000; see the screenshot/video entry above). Per-test filmstrip slicing follows the same per-test-hook availability as `traceGranularity:'test'` (works for WDIO mocha/cucumber, Selenium mocha, Nightwatch exports-object/cucumber; Nightwatch BDD `describe/it` degrades to session scope per the entry below), and non-Chrome polling carries the same reporter-noise caveat.
+- The `filmstrip` option (dense screencast into the trace) is on **`BaseDevToolsOptions`** — the counterexample to the screenshot/video entry above — because all three adapters implement it (the "second consumer → base" rule realized). Core owns the work (`core/screencast-trace.ts` `thinScreencastFrames`/`buildDenseScreencast`; slice windowing in `spec-trace-helpers.ts`); adapters only default the option, un-gate the recorder in trace mode when it's set, and feed `recorder.frames` into the finalize context. Each adapter captures frames while the recorder is still alive (service `onReload` → `#filmstripFrames`; Selenium `onDriverEnd` drain before nulling; Nightwatch `#finalizeCurrentScreencast` snapshot before delegating), and each finalize context spreads `[...accumulated, ...(live recorder frames)]` so a **mid-run** per-spec/per-test slice flush (which fires before the recorder is drained) isn't blank. When dense frames are present they **supersede** the sparse per-action filmstrip (the per-action DOM `elements`/`snapshot` are carried independently by the `frame-snapshot` events, so no DOM data is lost); a run without dense frames keeps the sparse filmstrip, byte-stable with before. Thinning is applied at export; the live session frame buffer is bounded by `maxBufferFrames` (default 2000; see the screenshot/video entry above). Per-test filmstrip slicing follows the same per-test-hook availability as `traceGranularity:'test'` (works for WDIO mocha/cucumber, Selenium mocha, Nightwatch cucumber; Nightwatch `describe/it` and exports-object degrade to session scope per the entry below), and non-Chrome polling carries the same reporter-noise caveat.
 - Per-test artifact **Allure attachment** is cross-adapter via a pluggable sink in `core/allure-artifacts.ts` (`AllureAttachSink`; `captureAndAttachScreenshot`/`captureAndAttachVideo`/`attachTraceArtifact`/`lastRenderedScreenshot` — moved out of the WDIO service). The service supplies a `@wdio/allure-reporter` sink; **Selenium** supplies an `allure-js-commons` `attachment()` sink (runtime-agnostic — attaches under any allure runner adapter — gated on `globalThis.allureTestRuntime`, dynamic-imported as an optional peer dep). An **undefined sink = produce-only** (write file + manifest, skip attach). Caveats: (a) **Selenium inline-attach needs awaited runner hooks** — its mocha `afterEach`/jest `afterEach`/cucumber `After` are now async + awaited so the async produce+attach lands while the allure adapter still holds the current test open (fire-and-forget attaches to the next test or drops); Gherkin `AfterStep` is awaited too, so a step's trace slice, native app requests included, is written before the next step records its boundary. (b) **Nightwatch inline-attach is unsupported** — `nightwatch-allure` is post-hoc with no live attach API, and `allure-js-commons` no-ops in a Nightwatch run (nothing calls `setGlobalTestRuntime`); Nightwatch is produce-only. Revisit if an `allure-js-commons`-based Nightwatch runtime adapter appears (then it's a sink swap). (c) **video is standalone** in both adapters (recorder starts for `video != off` OR filmstrip in trace mode; the orphan session-webm encode is trace-gated to stop-only).
 - **node:assert error display** (`core/assert-patcher.ts` `describeAssertFailure`): node auto-generates a per-character COLORED diff as the AssertionError message; once any consumer strips the ANSI (allure-mocha, the app console filter, plain terminals) the actual/expected interleave into mush (`'ExampleThis DIs Nomt…'`). The patcher pulls node's clean `.actual`/`.expected` into a `CollapsedAssertResult` AND **rewrites the auto-generated message** (and its echo in the stack) as a value-bearing `Expected: … / Received: …` block. Because `toError` returns the thrown error itself, this rewrite reaches every consumer — the trace's Errors tab, the runner console, and **allure-mocha's error box** (which would otherwise show the ANSI-stripped mush). It only touches node's auto-generated messages; a user-supplied message and errors without `actual`/`expected` (e.g. `assert.ok`) pass through unchanged. This is a deliberate mutation of the thrown assert error — node's auto-message is a display artifact, and the rewrite is strictly more readable and matches `@wdio/allure-reporter`'s `Expected/Received` shape.
 - Nightwatch native asserts are buffered at call time and emitted in one batch at test-end (Nightwatch exposes no per-assertion execution/outcome hook reachable from the plugin — `client.queue.tree` / `client.reporter` aren't on `browser`). Streaming mid-run would flash every assert green before its outcome is known, so rows are held and reconciled against `results.testcases[*].assertions` at `afterEach` (the flat `results.assertions` only reflects the last testcase). The exporter re-sorts commands by timestamp (`buildActionEvents`) so the batched rows land at their real timeline positions rather than clustering at flush time. `actual` is parsed from the failure message (`but got: …`, failures only) into a collapsed `{passed, expected, actual}` result; `expected` is the assertion arg — the label still mirrors the call args, not the derived values.
-- Nightwatch's BDD `describe/it` interface fires the plugin's global `beforeEach`/`afterEach` **once per module** (with an empty `currentTest.name`), not per `it` — Nightwatch runs the individual `it`s internally with no per-testcase hook or event reachable from the plugin (the lib emits only transport-level events). So `traceGranularity:'test'` records a single slice boundary (the first test) and collapses to one session-scoped slice; retry-aware/per-test retention (`tracePolicy`) degrades to session scope for this interface. Per-test slicing works for adapters/styles that expose per-test hooks (WDIO mocha/cucumber, Selenium mocha; likely Nightwatch's exports-object style, unverified). Session-granularity trace is unaffected. **No per-test support has been built for this interface** — real per-`it` slicing needs a hook Nightwatch doesn't surface; deferred to a full-picture pass, not attempted yet.
+- Nightwatch's BDD `describe/it` interface fires the plugin's global `beforeEach`/`afterEach` **once per module** (with an empty `currentTest.name`), not per `it` — Nightwatch runs the individual `it`s internally with no per-testcase hook or event reachable from the plugin (the lib emits only transport-level events). So `traceGranularity:'test'` records a single slice boundary (the first test) and collapses to one session-scoped slice; retry-aware/per-test retention (`tracePolicy`) degrades to session scope for this interface. Per-test slicing works for adapters/styles that expose per-test hooks (WDIO mocha/cucumber, Selenium mocha/jest/cucumber, Nightwatch cucumber). Nightwatch's exports-object style collapses the same way: `lib/testsuite/index.js` runs the global `beforeEach`/`afterEach` once per test module for both interfaces. Session-granularity trace is unaffected. **No per-test support has been built for this interface** — real per-`it` slicing needs a hook Nightwatch doesn't surface; deferred to a full-picture pass, not attempted yet.
   - **Empirically confirmed** (BDD example, `mode:'trace'` + `traceGranularity:'test'` + `tracePolicy:'retain-on-failure'` + `screenshot:'on'` + `video:'retain-on-failure'`): the one collapsed slice is keyed to the **first** test's uid (the artifacts manifest's `tests[]` still carries every testcase with correct `state`, so metadata capture is fine — it's the *slice/artifact* keying that collapses). Consequence: with a passing first test and a failing later test, the screenshot **produces** (policy `'on'` captures regardless of outcome, keyed to the first test) but the **trace zip and video are dropped** — `retain-on-failure` evaluates the first (passing) test's outcome, and the actually-failing test never gets its own slice to retain. The per-test produce-only path itself (screenshot/video write + manifest) is correct; only the BDD slice-keying limits it.
 - **Nightwatch cucumber: traces generate, capture asserts with real pass/fail, and carry DOM mutations** (via the `test/` harness, 2026-07; both remaining gaps closed and re-verified 2026-08-06). Three fixes made the cucumber runner emit a useful trace: **(1) build** — `packages/nightwatch-devtools/tsup.config.ts` now compiles `src/helpers/cucumberHooks.cts` → `dist/helpers/cucumberHooks.cjs` as a self-contained CJS bundle (`@cucumber/cucumber` external). Previously the build ran only `tsup src/index.ts --clean`, so that file never existed and Cucumber's `require:[cucumberHooksPath]` registered *no* hooks (glob matched nothing) → zero capture. `PLUGIN_GLOBAL_KEY` moved to a leaf module `plugin-global-key.ts` so the hooks bundle stays tiny and CJS-safe (importing it via `constants.ts` dragged in core → `createRequire(import.meta.url)`, which throws when bundled to CJS). **(2) capture ordering** — a pre-quit cucumber `After` hook (`order:1000`, `captureCucumberScenarioBeforeQuit`) runs the trace capture + slice flush while the per-scenario browser session is live (the `order:-1` finalize is post browser-quit, so the flush bailed on the absent `sessionId`). Requires `traceGranularity:'test'` (per-scenario slices). **(3) native asserts** — the same pre-quit hook drains `browserProxy.drainNativeAssertCalls()` and calls `captureNativeAssertions` (the `afterEach` path early-returns for cucumber), so `assert.*` rows now appear. Console/network (BiDi) + commands + asserts + frames + sources + transcript are captured. BDD and live mode are unaffected.
   - **Assert outcomes are correlated off the assertion's own promise, because the results bag does not exist.** Cucumber's Nightwatch client is built by `createClient` with **no reporter**, so `SimplifiedReporter.logAssertResult` no-ops and `results.assertions`/`results.testcases` are *never* populated — no scenario-level reconcile can recover them, which is why `currentTest: undefined` was a dead end. `nativeAssertions.ts` `observedAssertOutcome` reads the outcome from the returned promise instead (`lib/core/asynctree.js` `shouldRejectNodePromise`: a failing `assert.*` rejects its deferred, a failing `verify.*` resolves *with* the AssertionError, a pass resolves with the command value). A fulfilment of `undefined` stays **neutral** — that is an assertion enqueued but never executed after an earlier `assert.*` emptied the queue, and reading it as a pass would paint a never-run assertion green. The results bag still wins where it exists and the row's window comes from whichever source supplied the outcome, so the describe/it timeline is byte-stable. Measured: **4 of 4 assert rows with a real pass/fail** (was 2 of 4 rows, 0 correlated), spanning real 44–372 ms windows instead of a synthetic 1 ms.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d5cee62c..05a81430 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -107,6 +107,16 @@ Python CI run fails on *"Pinned backend serves this adapter's contract"*, the
 answer is that the backend has not been released yet, not that your branch is
 wrong. Raise it by hand only when you are also releasing the backend.
 
+## Adding a feature
+
+Every user-facing feature is listed in [`packages/conformance/src/features.ts`](./packages/conformance/src/features.ts), with what each of the four adapters (WebdriverIO, Selenium, Nightwatch, Python) does with it. The capability tables in this README and on the docs site are generated from it.
+
+1. Add an entry: an id, a name, the tables it appears in, and a cell for every adapter.
+2. A supported cell names its evidence with the helpers in `capability-helpers.ts` beside it: `tested(rules)` for conformance rules that check it, `covered(path)` for a test file in that adapter's own tests (or `core`, `trace` or `backend` when the adapter adds no logic of its own), or `byHand(reason)` saying how to check it by hand. A partial or unsupported cell names the reason, which becomes the table's footnote.
+3. Run `pnpm docs:capabilities` to regenerate the README tables. `pnpm docs:capabilities --parity` lists every feature some adapter lacks.
+
+CI fails when an adapter is missing from an entry, a reason or evidence is missing, a test file does not exist or sits outside those tests, a new option or conformance rule maps to no feature, or the README tables are out of date.
+
 ## Before you push
 
 - `pnpm build`, `pnpm test`, and `pnpm lint` all green — don't push red.
diff --git a/README.md b/README.md
index 0a566cc8..f5828d61 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,47 @@ Want a portable artifact instead of a live UI (CI / agent diffing)? Switch to **
 - **Jasmine**: Complete integration with grep-based filtering
 - **Cucumber**: Scenario-level and example-specific execution with feature:line targeting
 
+**Dashboard and options by adapter:**
+
+<!-- capability-matrix:readme-dashboard:start -->
+<!-- Generated by `pnpm docs:capabilities` in webdriverio/devtools from packages/conformance/src/features.ts. Do not edit by hand. -->
+
+| Feature | WebdriverIO | Selenium | Nightwatch | Python |
+|---|---|---|---|---|
+| One row per command in the Actions list | ✅ tested | ✅ tested | ✅ tested | ✅ tested |
+| Screenshot on every command row | ✅ | ✅ | ✅ | ✅ |
+| Browser console logs | ✅ | ✅ | ✅ | ✅ |
+| Source tab opens the test line that ran the command | ✅ | ✅ | ✅ | ✅ |
+| Metadata tab (session, capabilities, device) | ✅ | ✅ | ✅ | ✅ |
+| Performance timings on navigation rows | ✅ | ✅ | ✅ | ✅ |
+| Failed command in the Errors tab, with the browser's message | ✅ tested | ✅ tested | ✅ tested | ✅ tested |
+| Run, Rerun and Run all from the dashboard | ⚠️ no Cucumber step rerun ¹ | ⚠️ no Cucumber step rerun ¹ | ⚠️ no Cucumber step rerun ¹ | ✅ |
+| Preserve & Rerun (compare a failed run with its rerun) | ✅ | ✅ | ✅ | ✅ |
+| Dashboard window opens by itself in live mode, and can be turned off | ⚠️ always opens ² | ✅ `openUi: false` | ⚠️ always opens ³ | ✅ `DEVTOOLS_OPEN=0` |
+| Turn off per-command screenshots (`captureScreenshots`) | ❌ ⁴ | ✅ | ❌ ⁵ | ❌ ⁵ |
+| Force the test browser headless (`headless`) | ❌ ⁶ | ⚠️ Chrome only ⁷ | ❌ ⁶ | ❌ ⁶ |
+| Safari kept frontmost so input lands (live mode) | ⚠️ once ⁸ | ✅ before each element input | ⚠️ once ⁸ | ⚠️ once ⁸ |
+
+✅ tested: proven for that adapter by the cross-adapter conformance suite. ✅: supported, backed by a named test or a manual check listed in [the feature list](https://github.com/webdriverio/devtools/blob/main/packages/conformance/src/features.ts).
+
+¹ Under Cucumber a Gherkin step has no CLI filter of its own, so the dashboard reruns scenarios and features, not single steps.
+
+² The service always opens the dashboard in live mode; `devtoolsCapabilities` picks its browser but cannot skip it.
+
+³ Nightwatch always opens the dashboard in live mode.
+
+⁴ No option: every command row takes a screenshot, except on Appium, where only native sessions in live mode do.
+
+⁵ No option: every command row takes a screenshot.
+
+⁶ No option: set headless in the browser capabilities, as for any run.
+
+⁷ The option adds `--headless=old` to `goog:chromeOptions` only, so other browsers stay headed; set their own headless capability.
+
+⁸ Brings Safari to the front once after the session starts (live mode, local macOS), so a click issued after another window took the front can still land nowhere.
+
+<!-- capability-matrix:readme-dashboard:end -->
+
 ### 📊 Real-Time Visualization
 - **Live Browser Preview**: View the application under test in a scaled iframe with automatic screenshot updates
 - **Actions Timeline**: Command-by-command execution log with timestamps and parameters
@@ -102,29 +143,72 @@ The dashboard runs in one of **two modes**, set per adapter via the shared `mode
 
 All three JavaScript adapters (`@wdio/devtools-service`, `@wdio/selenium-devtools`, `@wdio/nightwatch-devtools`) emit the **same normalized trace** through the shared `@wdio/devtools-core` capture library, so one archive format and one player serve every framework.
 
-The trace **format and the player are identical** across those three, but **capture completeness varies** — WebdriverIO is the most complete; Selenium and Nightwatch cover the core flow with some gaps (e.g. inline-Allure per-test artifacts, retry-aware retention, Cucumber step nesting, auto BiDi). Each adapter's README lists its specifics.
+The Python adapter (`selenium-devtools-py`) writes the same archive through the backend, so the trace **format and the player are identical** across all four, but **capture completeness varies**: WebdriverIO is the most complete, and the others cover the core flow with the gaps the table below names. Each adapter's README lists its specifics.
 
-**Trace-mode support by adapter:**
+**Support by adapter:**
 
-| Capability | WebdriverIO | Selenium | Nightwatch |
-|---|---|---|---|
-| Trace mode + `show-trace` player | ✅ | ✅ | ✅ |
-| DOM time-travel (mutation capture) | ✅ | ✅ ¹ | ✅ |
-| Dense filmstrip (`filmstrip`) | ✅ CDP push | ✅ CDP push | ⚠️ polling only |
-| Per-test granularity (`traceGranularity: 'test'`) | ✅ | ✅ | ⚠️ ² |
-| Retry-aware retention (`tracePolicy`) | ✅ | ✅ | ⚠️ ³ |
-| Cucumber step nesting | Scenario→Step ⁴ | ✅ full | Feature→Scenario ⁵ |
-| Inline Allure attach | ✅ | ✅ | ⚠️ produce-only ⁶ |
-| Assertion capture (`captureAssertions`) | ✅ | ✅ | ✅ |
-| Auto BiDi capture | ✅ auto | ✅ auto | ⚠️ opt-in ⁷ |
-
-¹ With BiDi, Selenium registers the page collector at document start, so every document anchors its own DOM as WebdriverIO's does. Without BiDi it falls back to injecting the collector after each navigation, and there a navigation's snapshot can lag the command that triggered it.
-² Nightwatch's Cucumber and exports-object interfaces get real per-test slicing; the BDD `describe/it` interface collapses to a single session-scoped slice keyed to the first test.
-³ Only `retain-on-failure` works; the other retry-aware policies degrade to it because Nightwatch's `--retries` re-runs a testcase internally without re-firing the per-test hooks.
-⁴ WebdriverIO does not yet carry feature-level ancestry, so its Cucumber nesting is Scenario→Step.
-⁵ Nightwatch does not yet stamp per-step nesting (Feature→Scenario only).
-⁶ Nightwatch has no live Allure attach API, so per-test `screenshot`/`video` are written to disk and listed in the manifest but not attached to an Allure test.
-⁷ Opt-in via `bidi: true` + `webSocketUrl: true` in capabilities.
+<!-- capability-matrix:readme-trace:start -->
+<!-- Generated by `pnpm docs:capabilities` in webdriverio/devtools from packages/conformance/src/features.ts. Do not edit by hand. -->
+
+| Feature | WebdriverIO | Selenium | Nightwatch | Python |
+|---|---|---|---|---|
+| Trace mode + `show-trace` player | ✅ | ✅ | ✅ | ✅ |
+| DOM time-travel (mutation capture) | ✅ tested | ⚠️ with BiDi ¹ | ⚠️ with BiDi ¹ | ✅ tested |
+| Network requests (browser sessions) | ✅ tested | ⚠️ with BiDi ² | ⚠️ with BiDi ³ | ✅ tested |
+| Screencast (`filmstrip` / video) | ✅ CDP push (Chrome), polling elsewhere | ✅ CDP push (Chromium), polling elsewhere | ⚠️ polling only ⁴ | ✅ CDP push (Chromium), one frame per command elsewhere |
+| Per-test granularity (`traceGranularity: 'test'`) | ✅ | ✅ | ⚠️ ⁵ | ✅ |
+| Retry-aware retention (`tracePolicy`) | ✅ | ✅ | ⚠️ `retain-on-failure` only ⁶ | ⚠️ `retain-on-failure` only ⁷ |
+| Per-test `screenshot` / `video`, attached to Allure | ✅ | ✅ | ⚠️ produce-only ⁸ | ❌ ⁹ |
+| Cucumber Feature→Scenario→Step nesting | ⚠️ Scenario→Step ¹⁰ | ✅ | ⚠️ Feature→Scenario ¹¹ | ❌ ¹² |
+| Assertion capture (`captureAssertions`) | ✅ | ⚠️ `node:assert` only ¹³ | ⚠️ no `expect` ¹⁴ | ✅ |
+| BiDi console / network capture | ✅ auto | ✅ auto | ⚠️ opt-in ¹⁵ | ✅ auto |
+| A11y tab + pick-locator overlay (trace player) | ✅ | ✅ | ✅ | ✅ |
+| Transcript + Copy-for-LLM (trace player) | ✅ | ✅ | ✅ | ✅ |
+| Unpacked trace output (`traceFormat: 'ndjson-directory'`) | ✅ | ✅ | ✅ | ❌ zip only ¹⁶ |
+| Artifacts manifest for CI and reporters (`emitArtifactsManifest`) | ✅ | ✅ | ⚠️ opt-in ¹⁷ | ❌ ¹⁸ |
+| Network without BiDi (Safari, Appium mobile browsers) | ⚠️ ¹⁹ | ⚠️ ¹⁹ | ⚠️ ¹⁹ | ⚠️ ¹⁹ |
+
+✅ tested: proven for that adapter by the cross-adapter conformance suite. ✅: supported, backed by a named test or a manual check listed in [the feature list](https://github.com/webdriverio/devtools/blob/main/packages/conformance/src/features.ts).
+
+¹ Without BiDi (Safari, Appium) the page collector is injected after each navigation, so a page the test leaves within tens of milliseconds is never captured.
+
+² Without BiDi a page the test leaves within tens of milliseconds is never drained, so its requests are not listed.
+
+³ Without BiDi (`bidi: true`) or Chrome's performance log (`goog:loggingPrefs`), a page the test leaves within tens of milliseconds is never drained, so its requests are not listed.
+
+⁴ Nightwatch exposes no stable CDP handle, so frames come from a `takeScreenshot` poll every 200 ms.
+
+⁵ Nightwatch fires the global `beforeEach` / `afterEach` once per test module for `describe/it` and exports-object tests, so they collapse to one slice keyed to the first test; Cucumber scenarios get real per-test slices.
+
+⁶ For `describe/it` and exports-object tests, `--retries` reruns a testcase internally without firing the per-test hooks again, so the other policies behave like `retain-on-failure`; Cucumber scenarios record every attempt.
+
+⁷ Nothing the Python adapter sends carries an attempt number, so the retry-aware policies behave like `retain-on-failure`.
+
+⁸ Nightwatch has no live Allure attach API, so per-test screenshots and videos are written to disk and listed in the manifest but not attached.
+
+⁹ The Python adapter has no `screenshot` / `video` options and no Allure attachment yet.
+
+¹⁰ The service records no feature ancestry for a scenario, so the trace nests Scenario→Step.
+
+¹¹ Nightwatch steps are not stamped as nested groups, so the trace nests Feature→Scenario.
+
+¹² The Python adapter stamps no Feature or Step groups, so a pytest-bdd scenario is one flat test group with no Feature parent and no Step children.
+
+¹³ `node:assert` rows pass and fail; jest-style `expect()` and chai produce no rows at all, and a failing matcher only marks its test failed.
+
+¹⁴ `assert.*`, `verify.*` and `node:assert` rows pass and fail; Nightwatch's `expect` API produces no rows.
+
+¹⁵ Nightwatch turns it on with `bidi: true` plus `webSocketUrl: true` in the capabilities.
+
+¹⁶ The Python adapter has no option for it and sends no format in its export request, so the backend writes a zip.
+
+¹⁷ Nightwatch has no live Allure signal to turn the manifest on by itself, so it stays opt-in.
+
+¹⁸ The Python adapter writes no artifacts manifest.
+
+¹⁹ Fetch and XHR calls carry headers and bodies; every other load comes from the page's Resource Timing buffer, with timing and size but no headers or body, and no status on Safari.
+
+<!-- capability-matrix:readme-trace:end -->
 
 In trace mode no DevTools UI window opens. At session end the adapter writes trace artifacts into a `test-results/` folder (created next to the resolved spec/config directory), suitable for offline replay, AI-agent diffing, or any consumer that prefers a portable artifact over a live UI.
 
@@ -133,6 +217,7 @@ In trace mode no DevTools UI window opens. At session end the adapter writes tra
 | **WebdriverIO** | `services: [['devtools', { mode: 'trace' }]]` |
 | **Selenium** | `DevTools.configure({ mode: 'trace' })` (before importing `selenium-webdriver`) |
 | **Nightwatch** | `globals: nightwatchDevtools({ mode: 'trace' })` |
+| **Python** | `pytest --devtools-trace`, or `devtools.enable(trace=True)` in a plain script |
 
 The trace artifact contains:
 - `trace.trace` — NDJSON `context-options` + `before`/`after` action events. When test hooks are available (Mocha's `it()` / Cucumber's `Scenario()`), each test becomes a `Tracing.tracingGroup` span — an open/close `before`/`after` pair with `method: "tracingGroup"` and `params.name` set to the test title. Child actions inside the group carry `parentId` pointing back to the group's `callId`, so timeline viewers render tests as labelled spans wrapping their commands.
@@ -216,7 +301,29 @@ The discriminator is the **browser name in the capabilities**, not the device: m
 
 A hybrid app is the case capabilities alone cannot answer, because the answer changes mid-run. Appium reports `NATIVE_APP` or a webview context, and anything that is not `NATIVE_APP` counts as a webview — the `WEBVIEW_` prefix is a convention, and a driver naming its webview otherwise would have its DOM capture skipped. Following the context costs no round trip: the switch command carries its destination in its own arguments.
 
-**Per-adapter:** all four adapters detect a native session and skip page-side capture on one. Only the **WebdriverIO** service additionally follows a hybrid app into its webview; Nightwatch, Selenium and the Python adapter answer from the startup capabilities, so a hybrid session's webview half is captured as if it were still native.
+**Per-adapter:**
+
+<!-- capability-matrix:readme-mobile:start -->
+<!-- Generated by `pnpm docs:capabilities` in webdriverio/devtools from packages/conformance/src/features.ts. Do not edit by hand. -->
+
+| Feature | WebdriverIO | Selenium | Nightwatch | Python |
+|---|---|---|---|---|
+| Network without BiDi (Safari, Appium mobile browsers) | ⚠️ ¹ | ⚠️ ¹ | ⚠️ ¹ | ⚠️ ¹ |
+| Mobile browser sessions (Chrome on Android, Safari on iOS) | ✅ | ✅ | ✅ | ✅ |
+| iOS (XCUITest): native apps and Safari | ✅ | ✅ | ✅ | ✅ |
+| Native session detected, page-side capture skipped | ✅ | ✅ | ✅ | ✅ |
+| Follows a hybrid app into its webview | ⚠️ string form only ² | ⚠️ ³ | ⚠️ ³ | ⚠️ ³ |
+| Native app network through appium-interceptor (`appium:intercept`) | ✅ Android | ✅ Android | ✅ Android | ✅ Android |
+
+✅ tested: proven for that adapter by the cross-adapter conformance suite. ✅: supported, backed by a named test or a manual check listed in [the feature list](https://github.com/webdriverio/devtools/blob/main/packages/conformance/src/features.ts).
+
+¹ Fetch and XHR calls carry headers and bodies; every other load comes from the page's Resource Timing buffer, with timing and size but no headers or body, and no status on Safari.
+
+² Follows `switchContext('WEBVIEW_...')`; the object form (`{ title }` / `{ url }`) and `switchAppiumContext` leave capture on the native side.
+
+³ Decides from the startup capabilities, so a hybrid app's webview half is captured as if it were still native.
+
+<!-- capability-matrix:readme-mobile:end -->
 
 **In the dashboard**, a phone capture is framed as the device — a full-height device column with the action list and dock beside it — in both live mode and the trace player. The trace's `context-options` records the platform, model and OS version, read back so the player labels frames without guessing.
 
diff --git a/package.json b/package.json
index da60a025..d8b1bf29 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "demo:python:mobile": "python3 examples/selenium-py/mobile/${DEVTOOLS_MOBILE_PLATFORM:-android}/*.py",
     "dev": "pnpm --parallel dev",
     "preview": "pnpm --parallel preview",
+    "docs:capabilities": "tsx packages/conformance/src/capability-matrix.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
diff --git a/packages/app/test-ui/sidebar/explorer/explorer.test.ts b/packages/app/test-ui/sidebar/explorer/explorer.test.ts
index 2334968c..ee122aef 100644
--- a/packages/app/test-ui/sidebar/explorer/explorer.test.ts
+++ b/packages/app/test-ui/sidebar/explorer/explorer.test.ts
@@ -24,7 +24,7 @@ import {
   mochaMetadata,
   mochaRunnerOptions,
   nestedRun,
-  nightwatchMetadata,
+  noRunAllMetadata,
   profileSuite,
   SPEC_FILE,
   suiteFragment,
@@ -61,7 +61,7 @@ const CUCUMBER_REASON =
   'Single-test execution is not supported by this framework.'
 
 /** A run-all refusal is its own reason: it is not a suite run, and the runners
- *  that refuse it (Nightwatch) can run suites perfectly well. */
+ *  that refuse it can run suites perfectly well. */
 const RUN_ALL_REASON =
   'Running every test at once is not supported by this framework.'
 
@@ -722,7 +722,7 @@ describe('wdio-devtools-sidebar-explorer', () => {
     it('disables the run control for a runner that cannot run everything', async () => {
       const explorer = await mountExplorer(
         mixedStateRun.registry,
-        nightwatchMetadata
+        noRunAllMetadata
       )
 
       const run = shadow<HTMLButtonElement>(explorer, RUN_ALL_BUTTON)
@@ -732,12 +732,12 @@ describe('wdio-devtools-sidebar-explorer', () => {
 
     it('still stops the run for a runner that cannot run everything', async () => {
       // Launching and stopping are separate concerns: /api/tests/stop takes no
-      // body and kills whatever the backend spawned, so a Nightwatch run — which
-      // has no run-everything entry point — must still be stoppable from here.
+      // body and kills whatever the backend spawned, so a run whose runner has
+      // no run-everything entry point must still be stoppable from here.
       const requests = recordBackend()
       const explorer = await mountExplorer(
         mixedStateRun.registry,
-        nightwatchMetadata
+        noRunAllMetadata
       )
 
       const stop = shadow<HTMLButtonElement>(explorer, STOP_ALL_BUTTON)
@@ -754,7 +754,7 @@ describe('wdio-devtools-sidebar-explorer', () => {
       const requests = recordBackend()
       const explorer = await mountExplorer(
         mixedStateRun.registry,
-        nightwatchMetadata
+        noRunAllMetadata
       )
       const run = shadow<HTMLButtonElement>(explorer, RUN_ALL_BUTTON)
       expect(run?.disabled).toBe(true)
@@ -778,14 +778,14 @@ describe('wdio-devtools-sidebar-explorer', () => {
 
     // The disabled attribute is not the gate: a programmatic dispatch, a
     // keyboard binding or a toolbar refactor all enter the handler without a
-    // real click. `#runAllSuites` used to guard on `canRunSuites` — which
-    // Nightwatch HAS — so the POST went through; it now guards on the same
+    // real click. `#runAllSuites` used to guard on `canRunSuites`, which such
+    // a runner has, so the POST went through; it now guards on the same
     // `canRunAll` the button is rendered from.
     it('refuses a run-all that reaches the handler without a real click, and says why', async () => {
       const requests = recordBackend()
       const explorer = await mountExplorer(
         mixedStateRun.registry,
-        nightwatchMetadata
+        noRunAllMetadata
       )
 
       const logs = await capture<string>(window, 'app-logs', () =>
@@ -803,7 +803,7 @@ describe('wdio-devtools-sidebar-explorer', () => {
       const requests = recordBackend()
       const explorer = await mountExplorer(
         mixedStateRun.registry,
-        nightwatchMetadata
+        noRunAllMetadata
       )
       const detail: TestRunDetail = { uid: '*', entryType: 'suite' }
 
@@ -820,7 +820,7 @@ describe('wdio-devtools-sidebar-explorer', () => {
     it('explains the refusal in the run control tooltip, and only then', async () => {
       const refusing = await mountExplorer(
         mixedStateRun.registry,
-        nightwatchMetadata
+        noRunAllMetadata
       )
       const running = await mountExplorer(mixedStateRun.registry, mochaMetadata)
 
diff --git a/packages/app/test-ui/sidebar/fixtures.ts b/packages/app/test-ui/sidebar/fixtures.ts
index da5a238f..32ed1c06 100644
--- a/packages/app/test-ui/sidebar/fixtures.ts
+++ b/packages/app/test-ui/sidebar/fixtures.ts
@@ -276,8 +276,11 @@ export const mochaMetadata = runnerMetadata(mochaRunnerOptions)
 /** Cucumber drives its own steps, so a single test cannot be run alone. */
 export const cucumberMetadata = runnerMetadata({ framework: 'cucumber' })
 
-/** Nightwatch exposes no run-everything entry point. */
-export const nightwatchMetadata = runnerMetadata({ framework: 'nightwatch' })
+/** A runner that declares it cannot run everything; every built-in runner can. */
+export const noRunAllMetadata = runnerMetadata({
+  ...mochaRunnerOptions,
+  runCapabilities: { canRunAll: false }
+})
 
 export type TestEntryProps = Partial<
   Pick<
diff --git a/packages/app/tests/runnerCapabilities.test.ts b/packages/app/tests/runnerCapabilities.test.ts
index 57eaf390..c6f66123 100644
--- a/packages/app/tests/runnerCapabilities.test.ts
+++ b/packages/app/tests/runnerCapabilities.test.ts
@@ -95,10 +95,10 @@ describe('getRunCapabilities', () => {
   })
 
   it('reads the runner off a trace zip, which carries no runner options', () => {
-    expect(getRunCapabilities(playerMd('nightwatch'))).toEqual({
+    expect(getRunCapabilities(playerMd('nightwatch-cucumber'))).toEqual({
       canRunSuites: true,
-      canRunTests: true,
-      canRunAll: false
+      canRunTests: false,
+      canRunAll: true
     })
   })
 })
@@ -150,9 +150,19 @@ describe('getRunAllDisabledReason', () => {
     ).toBeUndefined()
   })
   it('names the run-all refusal when the runner cannot', () => {
-    expect(getRunAllDisabledReason(md({ framework: 'nightwatch' }))).toBe(
-      RUN_ALL_REFUSAL
-    )
+    expect(
+      getRunAllDisabledReason(md({ runCapabilities: { canRunAll: false } }))
+    ).toBe(RUN_ALL_REFUSAL)
+  })
+
+  // Regression: Nightwatch was refused Run all although the backend runs its whole config.
+  it('offers Run all to both Nightwatch runners', () => {
+    expect(
+      getRunAllDisabledReason(md({ framework: 'nightwatch' }))
+    ).toBeUndefined()
+    expect(
+      getRunAllDisabledReason(md({ framework: 'nightwatch-cucumber' }))
+    ).toBeUndefined()
   })
 })
 
diff --git a/packages/backend/src/bin-resolver.ts b/packages/backend/src/bin-resolver.ts
index f5ac6414..03182845 100644
--- a/packages/backend/src/bin-resolver.ts
+++ b/packages/backend/src/bin-resolver.ts
@@ -7,12 +7,12 @@ const require = createRequire(import.meta.url)
 
 /**
  * Resolve the nightwatch CLI entry point. Honors `DEVTOOLS_NIGHTWATCH_BIN`
- * for testing/override; otherwise walks up from `baseDir` looking for
+ * for testing/override; otherwise walks up from each of `baseDirs` in turn looking for
  * `node_modules/nightwatch/package.json` and resolves its `bin` to the
  * actual JS entry (avoids running the shell-script wrapper at
  * `node_modules/.bin/nightwatch` via node).
  */
-export function resolveNightwatchBin(baseDir: string): string {
+export function resolveNightwatchBin(...baseDirs: string[]): string {
   const envOverride = process.env[RUNNER_ENV.NIGHTWATCH_BIN]
   if (envOverride) {
     const resolved = path.isAbsolute(envOverride)
@@ -23,6 +23,19 @@ export function resolveNightwatchBin(baseDir: string): string {
     }
   }
 
+  for (const baseDir of baseDirs) {
+    const found = findNightwatchFrom(baseDir)
+    if (found) {
+      return found
+    }
+  }
+
+  throw new Error(
+    'Cannot find nightwatch binary. Install nightwatch locally or set DEVTOOLS_NIGHTWATCH_BIN env var.'
+  )
+}
+
+function findNightwatchFrom(baseDir: string): string | undefined {
   let dir = baseDir
   const root = path.parse(dir).root
   while (dir !== root) {
@@ -47,7 +60,7 @@ export function resolveNightwatchBin(baseDir: string): string {
           }
         }
       } catch {
-        // malformed package.json — continue walking
+        // A malformed package.json: keep walking.
       }
     }
     const parent = path.dirname(dir)
@@ -57,9 +70,7 @@ export function resolveNightwatchBin(baseDir: string): string {
     dir = parent
   }
 
-  throw new Error(
-    'Cannot find nightwatch binary. Install nightwatch locally or set DEVTOOLS_NIGHTWATCH_BIN env var.'
-  )
+  return undefined
 }
 
 /**
diff --git a/packages/backend/src/framework-filters.ts b/packages/backend/src/framework-filters.ts
index 730b7c6e..1162afed 100644
--- a/packages/backend/src/framework-filters.ts
+++ b/packages/backend/src/framework-filters.ts
@@ -167,3 +167,23 @@ export function getFilterBuilder(runnerId: string | undefined): FilterBuilder {
       return DEFAULT_FILTERS
   }
 }
+
+/** What the run that started the backend was launched with, which Run all replays. */
+export interface RunAllSelection {
+  wdioSpecs: string[]
+  nightwatchArgs: string[]
+}
+
+/** The arguments that scope Run all to that selection, in the runner's own CLI form. */
+export function runAllFilters(
+  runnerId: string | undefined,
+  selection: RunAllSelection
+): string[] {
+  switch (runnerId) {
+    case 'nightwatch':
+    case 'nightwatch-cucumber':
+      return [...selection.nightwatchArgs]
+    default:
+      return selection.wdioSpecs.flatMap((spec) => ['--spec', spec])
+  }
+}
diff --git a/packages/backend/src/runner.ts b/packages/backend/src/runner.ts
index 258b8718..1b499cee 100644
--- a/packages/backend/src/runner.ts
+++ b/packages/backend/src/runner.ts
@@ -9,10 +9,16 @@ import {
   RERUN_SLOT,
   REUSE_ENV,
   RUNNER_ENV,
+  parseInitialArgs,
   type RunnerRequestBody
 } from '@wdio/devtools-shared'
 import { WDIO_CONFIG_FILENAMES, NIGHTWATCH_CONFIG_FILENAMES } from './types.js'
-import { escapeFilterRegex, getFilterBuilder } from './framework-filters.js'
+import {
+  escapeFilterRegex,
+  getFilterBuilder,
+  runAllFilters,
+  type RunAllSelection
+} from './framework-filters.js'
 import { resolveNightwatchBin, resolveWdioBin } from './bin-resolver.js'
 
 const log = logger('@wdio/devtools-runner')
@@ -42,6 +48,21 @@ function stripNameTestNameSlot(template: string): string {
   return template.slice(0, leftEdge) + template.slice(idx + NAME_SLOT.length)
 }
 
+/** The selection the run that started this backend was launched with; both are written in this process. */
+function runAllSelection(): RunAllSelection {
+  const wdioSpecs = (process.env[RUNNER_ENV.WDIO_INITIAL_SPECS] ?? '')
+    .split(path.delimiter)
+    .filter(Boolean)
+  const raw = process.env[RUNNER_ENV.NIGHTWATCH_INITIAL_ARGS]
+  const nightwatchArgs = parseInitialArgs(raw)
+  if (raw && !nightwatchArgs) {
+    log.warn(
+      `Ignoring ${RUNNER_ENV.NIGHTWATCH_INITIAL_ARGS}: not a JSON array of strings`
+    )
+  }
+  return { wdioSpecs, nightwatchArgs: nightwatchArgs ?? [] }
+}
+
 class TestRunner {
   #child?: ChildProcess
   #lastPayload?: RunnerRequestBody
@@ -111,7 +132,8 @@ class TestRunner {
       process.env[RUNNER_ENV.RUNNER_CWD] || path.dirname(configPath)
     const args: string[] = isNightwatch
       ? [
-          resolveNightwatchBin(this.#baseDir),
+          // Beside the config finds an install nested under it, the launch directory one under a shared config.
+          resolveNightwatchBin(path.dirname(configPath), this.#baseDir),
           '--config',
           configPath,
           ...this.#buildFilters(payload)
@@ -316,15 +338,8 @@ class TestRunner {
     const builder = getFilterBuilder(framework)
     const baseFilters = builder({ specArg, payload })
 
-    // Scope "Run All" to the user's original --spec args. Nightwatch resolves specs via its own filter.
-    if (payload.runAll && !framework.startsWith('nightwatch')) {
-      const initialSpecs = process.env[RUNNER_ENV.WDIO_INITIAL_SPECS]
-      if (initialSpecs) {
-        const specs = initialSpecs.split(path.delimiter).filter(Boolean)
-        for (const spec of specs) {
-          baseFilters.push('--spec', spec)
-        }
-      }
+    if (payload.runAll) {
+      baseFilters.push(...runAllFilters(framework, runAllSelection()))
     }
 
     return baseFilters
diff --git a/packages/backend/tests/bin-resolver.test.ts b/packages/backend/tests/bin-resolver.test.ts
index 9e70eb73..6e79cc80 100644
--- a/packages/backend/tests/bin-resolver.test.ts
+++ b/packages/backend/tests/bin-resolver.test.ts
@@ -72,6 +72,16 @@ describe('resolveNightwatchBin — walk-up node_modules search', () => {
     expect(resolveNightwatchBin(child)).toBe(expected)
   })
 
+  // Regression: launched from /repo/e2e with --config ../nightwatch.conf.js, the search from the config's folder never reached e2e/node_modules.
+  it('falls back to the next start directory when the first finds nothing', () => {
+    const configDir = path.join(tmpDir, 'shared')
+    const launchDir = path.join(tmpDir, 'e2e')
+    fs.mkdirSync(configDir, { recursive: true })
+    fs.mkdirSync(launchDir, { recursive: true })
+    const expected = plantNightwatch(launchDir)
+    expect(resolveNightwatchBin(configDir, launchDir)).toBe(expected)
+  })
+
   it('supports object-form bin: { nightwatch: ... }', () => {
     const expected = plantNightwatch(tmpDir, {
       nightwatch: 'bin/nightwatch.js'
diff --git a/packages/backend/tests/framework-filters.test.ts b/packages/backend/tests/framework-filters.test.ts
index df365007..77dca3a0 100644
--- a/packages/backend/tests/framework-filters.test.ts
+++ b/packages/backend/tests/framework-filters.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import type { RunnerRequestBody } from '@wdio/devtools-shared'
-import { getFilterBuilder } from '../src/framework-filters.js'
+import { getFilterBuilder, runAllFilters } from '../src/framework-filters.js'
 
 function payload(
   overrides: Partial<RunnerRequestBody> = {}
@@ -269,3 +269,30 @@ describe('nightwatch-cucumber filter builder', () => {
     ).toEqual(['--name', '^a\\.b\\*c$'])
   })
 })
+
+describe('runAllFilters', () => {
+  const selection = {
+    wdioSpecs: ['/abs/a.e2e.ts'],
+    nightwatchArgs: ['/abs/tests/login.js', '--tag', 'smoke']
+  }
+
+  it('replays the Nightwatch selection for both Nightwatch runners', () => {
+    expect(runAllFilters('nightwatch', selection)).toEqual(
+      selection.nightwatchArgs
+    )
+    expect(runAllFilters('nightwatch-cucumber', selection)).toEqual(
+      selection.nightwatchArgs
+    )
+  })
+
+  it('scopes every other runner to the WDIO initial specs', () => {
+    expect(runAllFilters('mocha', selection)).toEqual([
+      '--spec',
+      '/abs/a.e2e.ts'
+    ])
+    expect(runAllFilters(undefined, selection)).toEqual([
+      '--spec',
+      '/abs/a.e2e.ts'
+    ])
+  })
+})
diff --git a/packages/backend/tests/runner.test.ts b/packages/backend/tests/runner.test.ts
index 2590a3c0..0ed68b09 100644
--- a/packages/backend/tests/runner.test.ts
+++ b/packages/backend/tests/runner.test.ts
@@ -5,6 +5,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import { RERUN_SLOT, REUSE_ENV } from '@wdio/devtools-shared'
 
+import type * as BinResolver from '../src/bin-resolver.js'
 import type { RunnerRequestBody } from '../src/types.js'
 
 vi.mock('node:child_process')
@@ -16,6 +17,11 @@ vi.mock('node:fs', () => ({
   }
 }))
 
+vi.mock('../src/bin-resolver.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof BinResolver>()
+  return { ...actual, resolveNightwatchBin: vi.fn(actual.resolveNightwatchBin) }
+})
+
 vi.mock('node:module', () => ({
   createRequire: () => ({
     resolve: () => '/mock/wdio/cli/index.js'
@@ -29,6 +35,7 @@ const MOCK_WDIO_BIN = '/mock/wdio/bin/wdio.js'
 
 // Now import after mocks are set up
 const { testRunner } = await import('../src/runner.js')
+const { resolveNightwatchBin } = await import('../src/bin-resolver.js')
 
 describe('TestRunner', () => {
   const mockConfigPath = '/test/wdio.conf.ts'
@@ -408,6 +415,80 @@ describe('TestRunner', () => {
 
       delete process.env.DEVTOOLS_WDIO_INITIAL_SPECS
     })
+
+    // Regression: Nightwatch's Run all ran every spec in the config, not the selection the run was launched with.
+    it('replays the selection a Nightwatch run was launched with', async () => {
+      process.env.DEVTOOLS_NIGHTWATCH_BIN = '/mock/nightwatch/bin/nightwatch'
+      process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS = JSON.stringify([
+        '/abs/tests/login.js',
+        '--tag',
+        'smoke'
+      ])
+      vi.mocked(spawn).mockReturnValue(createMockChild())
+      try {
+        await testRunner.run({
+          uid: 'run-all',
+          entryType: 'suite',
+          runAll: true,
+          framework: 'nightwatch',
+          configFile: mockConfigPath
+        })
+        const args = vi.mocked(spawn).mock.calls[0][1] as string[]
+        expect(args.slice(-3)).toEqual([
+          '/abs/tests/login.js',
+          '--tag',
+          'smoke'
+        ])
+        expect(args).not.toContain('--spec')
+      } finally {
+        delete process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS
+        delete process.env.DEVTOOLS_NIGHTWATCH_BIN
+      }
+    })
+
+    // Regression: resolving the binary from the launch directory missed a Nightwatch installed beside a nested config.
+    it('spawns from the launch directory but finds Nightwatch beside its config', async () => {
+      process.env.DEVTOOLS_NIGHTWATCH_BIN = '/mock/nightwatch/bin/nightwatch'
+      process.env.DEVTOOLS_RUNNER_CWD = '/launch/dir'
+      vi.mocked(spawn).mockReturnValue(createMockChild())
+      try {
+        await testRunner.run({
+          uid: 'run-all',
+          entryType: 'suite',
+          runAll: true,
+          framework: 'nightwatch',
+          configFile: mockConfigPath
+        })
+        expect(vi.mocked(resolveNightwatchBin)).toHaveBeenLastCalledWith(
+          path.dirname(mockConfigPath),
+          '/launch/dir'
+        )
+        expect(vi.mocked(spawn).mock.calls[0][2]?.cwd).toBe('/launch/dir')
+      } finally {
+        delete process.env.DEVTOOLS_RUNNER_CWD
+        delete process.env.DEVTOOLS_NIGHTWATCH_BIN
+      }
+    })
+
+    it('runs the whole Nightwatch config when the selection is absent or unreadable', async () => {
+      vi.mocked(spawn).mockReturnValue(createMockChild())
+      process.env.DEVTOOLS_NIGHTWATCH_BIN = '/mock/nightwatch/bin/nightwatch'
+      process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS = '{not json'
+      try {
+        await testRunner.run({
+          uid: 'run-all',
+          entryType: 'suite',
+          runAll: true,
+          framework: 'nightwatch',
+          configFile: mockConfigPath
+        })
+        const args = vi.mocked(spawn).mock.calls[0][1] as string[]
+        expect(args.slice(-2)).toEqual(['--config', mockConfigPath])
+      } finally {
+        delete process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS
+        delete process.env.DEVTOOLS_NIGHTWATCH_BIN
+      }
+    })
   })
 
   describe('framework dispatch via Map (CodeQL hardening)', () => {
@@ -520,6 +601,23 @@ describe('TestRunner', () => {
       expect(spawnedArgs()).toEqual(['-m', 'pytest', 'examples/'])
     })
 
+    // The Selenium adapter quotes its argv fallback this way; each argument must survive the backend's shell parse whole.
+    it('keeps quoted arguments of a run-all launch command whole', async () => {
+      await testRunner.run({
+        uid: '__RUN_ALL__',
+        entryType: 'suite',
+        runAll: true,
+        launchCommand: "node /x/mocha 'specs/my login.js' --grep 'a b'"
+      })
+
+      expect(spawnedArgs()).toEqual([
+        '/x/mocha',
+        'specs/my login.js',
+        '--grep',
+        'a b'
+      ])
+    })
+
     it('still regex-escapes a name-pattern template', async () => {
       await testRunner.run({
         uid: 'some-uid',
diff --git a/packages/conformance/src/agreement.ts b/packages/conformance/src/agreement.ts
index 3028cdc1..68aae5e2 100644
--- a/packages/conformance/src/agreement.ts
+++ b/packages/conformance/src/agreement.ts
@@ -194,12 +194,9 @@ function gapExplains(
       )
     )
   }
+  // Every adapter offers every run control its runner can serve, so no gap excuses a difference here.
   if (d.rule === RULES.agreeOnRunControls) {
-    return runControlsExplained(
-      gaps,
-      normalized.get(holder.adapter),
-      normalized.get(other.adapter)
-    )
+    return false
   }
   if (d.rule === RULES.agreeOnRequests) {
     // Each side's requests plus the loads its own declared gap left unlisted must agree.
@@ -226,22 +223,6 @@ function gapExplains(
   return true
 }
 
-// The gap explains the absence of the controls it declares and nothing else, so a control lost since is a finding.
-function runControlsExplained(
-  gaps: KnownGap[],
-  holder: NormalizedRun | undefined,
-  other: NormalizedRun | undefined
-): boolean {
-  if (!holder || !other) {
-    return false
-  }
-  const lacks = new Set<string>(gaps.flatMap((g) => g.lacksRunControls ?? []))
-  return sameRunControls(holder.runControls, {
-    ...other.runControls,
-    advertised: other.runControls.advertised.filter((c) => !lacks.has(c))
-  })
-}
-
 const sameRunControls = (a: RunControls, b: RunControls) =>
   a.served === b.served && sameList(a.advertised, b.advertised)
 
diff --git a/packages/conformance/src/allowlist.ts b/packages/conformance/src/allowlist.ts
index 1e2bece2..8544f392 100644
--- a/packages/conformance/src/allowlist.ts
+++ b/packages/conformance/src/allowlist.ts
@@ -1,4 +1,3 @@
-import { BIDI_MODES, RULES } from './constants.js'
 import type {
   AdapterId,
   BidiMode,
@@ -38,15 +37,7 @@ export const KNOWN_GAPS: KnownGap[] = [
     reason:
       'Without BiDi the collector is appended as a <script> and the destination is anchored by polling for the old collector to disappear, so a document the test leaves within tens of ms is never anchored and its Resource Timing buffer dies undrained with it. CLAUDE.md Known debt: "Document-start injection is what removes the whole race class".',
     timingDependent: true
-  },
-  ...BIDI_MODES.map((bidi): KnownGap => ({
-    adapter: 'nightwatch-devtools',
-    bidi,
-    rules: [RULES.agreeOnRunControls],
-    lacksRunControls: ['canRunAll'],
-    reason:
-      'Nightwatch advertises no Run-all: the backend reruns a Nightwatch config through its framework path, which selects suites and tests but has no whole-run entry. Documented on the capability matrix.'
-  }))
+  }
 ]
 
 /** An `adapters-agree-*` rule is judged by the comparison; every other rule by the run itself. */
diff --git a/packages/conformance/src/capabilities.ts b/packages/conformance/src/capabilities.ts
new file mode 100644
index 00000000..159b28a5
--- /dev/null
+++ b/packages/conformance/src/capabilities.ts
@@ -0,0 +1,35 @@
+import { RULES } from './constants.js'
+import type { AdapterId, RuleId } from './types.js'
+
+// A Record, so a new adapter id fails to compile until it has a column title.
+const ADAPTER_TITLES: Record<AdapterId, string> = {
+  'devtools-service': 'WebdriverIO',
+  'selenium-devtools': 'Selenium',
+  'nightwatch-devtools': 'Nightwatch',
+  'selenium-devtools-py': 'Python'
+}
+
+/** Column order of every rendered table. */
+export const ADAPTER_COLUMNS = (
+  Object.entries(ADAPTER_TITLES) as [AdapterId, string][]
+).map(([id, title]) => ({ id, title }))
+
+/** Rules that prove no feature cell on their own: a comparison between adapters, or a precondition of a feature rather than the feature. */
+export const INTERNAL_RULES: Partial<Record<RuleId, string>> = {
+  [RULES.agreeOnRequests]:
+    'Compares the adapters with one another; each adapter is judged by every-browser-request-listed.',
+  [RULES.agreeOnActions]:
+    'Compares the adapters with one another; each adapter is judged by one-row-per-browser-action.',
+  [RULES.agreeOnErrors]:
+    'Compares the adapters with one another; each adapter is judged by failed-command-has-error-row.',
+  [RULES.agreeOnPages]:
+    'Compares the adapters with one another; each adapter is judged by row-replays-its-page.',
+  [RULES.agreeOnSnapshots]:
+    'Compares the adapters with one another; each adapter is judged by every-document-anchored.',
+  [RULES.agreeOnRunControls]:
+    'Compares the adapters with one another; each adapter is judged by run-controls-are-served.',
+  [RULES.metadataFirst]:
+    'Checks that metadata reaches the dashboard before the first command, not the session, capabilities and device the Metadata tab shows.',
+  [RULES.runControlsServed]:
+    'Checks that every run control the dashboard offers has a command to serve it, not that Run, Rerun and Run all work.'
+}
diff --git a/packages/conformance/src/capability-helpers.ts b/packages/conformance/src/capability-helpers.ts
new file mode 100644
index 00000000..29ce4dfa
--- /dev/null
+++ b/packages/conformance/src/capability-helpers.ts
@@ -0,0 +1,93 @@
+import { RULES } from './constants.js'
+import type { AdapterId, Cell, RuleId } from './types.js'
+
+/** Where each adapter's own tests live, from the repo root. */
+export const ADAPTER_TESTS: Record<AdapterId, string> = {
+  'devtools-service': 'packages/service/tests/',
+  'selenium-devtools': 'packages/selenium-devtools/tests/',
+  'nightwatch-devtools': 'packages/nightwatch-devtools/tests/',
+  'selenium-devtools-py': 'packages/selenium-devtools-py/tests/'
+}
+
+/** Packages every adapter builds on, so their tests may stand in where an adapter adds no logic of its own. */
+export const SHARED_TESTS = [
+  'packages/core/tests/',
+  'packages/trace/tests/',
+  'packages/backend/tests/'
+]
+
+export const DOM_RULES: RuleId[] = [
+  RULES.documentAnchored,
+  RULES.anchorOnce,
+  RULES.anchorBirthTime,
+  RULES.rowReplaysPage
+]
+export const ACTION_RULES: RuleId[] = [
+  RULES.rowPerAction,
+  RULES.completionStamp,
+  RULES.navigationNamesDestination,
+  RULES.replaceTargetsRow
+]
+export const NETWORK_RULES: RuleId[] = [
+  RULES.requestListed,
+  RULES.requestListedOnce,
+  RULES.requestSourceServed
+]
+export const ERROR_RULES: RuleId[] = [
+  RULES.failureRecorded,
+  RULES.errorCarriesBrowserMessage
+]
+
+/** Supported, and checked for this adapter by the conformance suite. */
+export const tested = (rules: RuleId[], label?: string): Cell => ({
+  support: 'supported',
+  evidence: { kind: 'rule', rules },
+  label
+})
+/** Supported, and exercised by this test file. */
+export const covered = (path: string, label?: string): Cell => ({
+  support: 'supported',
+  evidence: { kind: 'test', path },
+  label
+})
+/** Supported, and checked by hand for the stated reason. */
+export const byHand = (reason: string, label?: string): Cell => ({
+  support: 'supported',
+  evidence: { kind: 'manual', reason },
+  label
+})
+export const partial = (reason: string, label?: string): Cell => ({
+  support: 'partial',
+  reason,
+  label
+})
+export const unsupported = (reason: string, label?: string): Cell => ({
+  support: 'unsupported',
+  reason,
+  label
+})
+
+export const allTested = (rules: RuleId[]): Record<AdapterId, Cell> => ({
+  'devtools-service': tested(rules),
+  'selenium-devtools': tested(rules),
+  'nightwatch-devtools': tested(rules),
+  'selenium-devtools-py': tested(rules)
+})
+
+// Built from the stream every adapter sends, so one shared test covers all four.
+export const allCovered = (path: string): Record<AdapterId, Cell> => ({
+  'devtools-service': covered(path),
+  'selenium-devtools': covered(path),
+  'nightwatch-devtools': covered(path),
+  'selenium-devtools-py': covered(path)
+})
+
+/** The one definition of "tested" that the renderer, parity and rule coverage all read. */
+export function conformanceRules(cell: Cell): readonly RuleId[] {
+  return cell.support === 'supported' && cell.evidence.kind === 'rule'
+    ? cell.evidence.rules
+    : []
+}
+
+export const isConformanceTested = (cell: Cell) =>
+  conformanceRules(cell).length > 0
diff --git a/packages/conformance/src/capability-matrix.ts b/packages/conformance/src/capability-matrix.ts
new file mode 100644
index 00000000..488f9d4d
--- /dev/null
+++ b/packages/conformance/src/capability-matrix.ts
@@ -0,0 +1,125 @@
+// `pnpm docs:capabilities [--check] [--parity] [--website <webdriverio checkout>]`: renders the capability tables.
+
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+
+import { validateFeatures } from './capability-validation.js'
+import { CAPABILITY_TABLES, README_PAGE, REPO_ROOT } from './constants.js'
+import { renderParity, replaceBlock } from './render-capabilities.js'
+import type { CapabilityTable, CapabilityTarget } from './types.js'
+
+export function targetsFor(websiteRoot?: string): CapabilityTarget[] {
+  return (
+    Object.entries(CAPABILITY_TABLES) as [CapabilityTable, string][]
+  ).flatMap(([table, page]) => {
+    if (page === README_PAGE) {
+      return [{ table, file: path.join(REPO_ROOT, page) }]
+    }
+    return websiteRoot ? [{ table, file: path.join(websiteRoot, page) }] : []
+  })
+}
+
+/** Each file with every one of its tables rendered; throws before anything is written if any target cannot be. */
+export function renderFiles(
+  targets: CapabilityTarget[]
+): Map<string, { current: string; next: string }> {
+  const files = new Map<string, { current: string; next: string }>()
+  const problems: string[] = []
+  for (const { table, file } of targets) {
+    if (!files.has(file)) {
+      if (!existsSync(file)) {
+        problems.push(`${file}: not found`)
+        continue
+      }
+      const current = readFileSync(file, 'utf8')
+      files.set(file, { current, next: current })
+    }
+    const entry = files.get(file)
+    if (!entry) {
+      continue
+    }
+    try {
+      entry.next = replaceBlock(entry.next, table)
+    } catch (err) {
+      problems.push(`${file}: ${(err as Error).message}`)
+    }
+  }
+  if (problems.length) {
+    throw new Error(problems.join('\n'))
+  }
+  return files
+}
+
+/** The files whose tables differ from the declared source, rewritten unless `check` is set. */
+export function syncTables(
+  targets: CapabilityTarget[],
+  check: boolean
+): string[] {
+  const stale = [...renderFiles(targets)].filter(
+    ([, { current, next }]) => current !== next
+  )
+  if (!check) {
+    for (const [file, { next }] of stale) {
+      writeFileSync(file, next)
+    }
+  }
+  return stale.map(([file]) => file)
+}
+
+/** `--website <dir>` or `--website=<dir>`; the value must not be another flag. */
+export function parseArgs(argv: string[]): {
+  check: boolean
+  parity: boolean
+  websiteRoot?: string
+} {
+  let check = false
+  let parity = false
+  let websiteRoot: string | undefined
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i]
+    if (arg === '--check') {
+      check = true
+    } else if (arg === '--parity') {
+      parity = true
+    } else if (arg === '--website' || arg.startsWith('--website=')) {
+      const value =
+        arg === '--website' ? argv[++i] : arg.slice('--website='.length)
+      if (!value || value.startsWith('--')) {
+        throw new Error('--website needs the path of a webdriverio checkout')
+      }
+      websiteRoot = path.resolve(value)
+    } else {
+      throw new Error(`unknown argument ${arg}`)
+    }
+  }
+  return { check, parity, websiteRoot }
+}
+
+function main(argv: string[]): number {
+  try {
+    const problems = validateFeatures()
+    if (problems.length) {
+      throw new Error(`features.ts is invalid:\n  ${problems.join('\n  ')}`)
+    }
+    const { check, parity, websiteRoot } = parseArgs(argv)
+    // Printed in addition to the sync, so adding --parity never skips a --check.
+    if (parity) {
+      console.log(`${renderParity()}\n`)
+    }
+    const stale = syncTables(targetsFor(websiteRoot), check)
+    for (const file of stale) {
+      console.log(`${check ? 'out of date' : 'updated'}: ${file}`)
+    }
+    return check && stale.length ? 1 : 0
+  } catch (err) {
+    console.error(`docs:capabilities: ${(err as Error).message}`)
+    return 1
+  }
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === path.resolve(import.meta.filename)
+) {
+  process.exitCode = main(process.argv.slice(2))
+}
diff --git a/packages/conformance/src/capability-options.ts b/packages/conformance/src/capability-options.ts
new file mode 100644
index 00000000..3033e451
--- /dev/null
+++ b/packages/conformance/src/capability-options.ts
@@ -0,0 +1,132 @@
+import type { BaseDevToolsOptions } from '@wdio/devtools-shared'
+import type { ServiceOptions } from '@wdio/devtools-service'
+import type { DevToolsOptions as SeleniumOptions } from '@wdio/selenium-devtools/types'
+import type { DevToolsOptions as NightwatchOptions } from '@wdio/nightwatch-devtools/types'
+
+import type { FeatureId } from './features.js'
+import type {
+  AdapterId,
+  Feature,
+  OptionTarget as AnyOptionTarget
+} from './types.js'
+
+// Typed on the feature ids, so an option naming a misspelt feature fails to compile.
+type OptionTarget = AnyOptionTarget<FeatureId>
+
+type OwnKeys<T> = Exclude<keyof T, keyof BaseDevToolsOptions>
+
+const WHERE_THE_BACKEND_LISTENS = {
+  notFeature: 'Where the dashboard backend listens.'
+}
+
+// Keyed on the option types themselves, so a new option fails to compile until it is placed.
+export const SHARED_OPTIONS: Record<keyof BaseDevToolsOptions, OptionTarget> = {
+  port: WHERE_THE_BACKEND_LISTENS,
+  hostname: WHERE_THE_BACKEND_LISTENS,
+  screencast: { feature: 'filmstrip' },
+  captureAssertions: { feature: 'assertion-capture' },
+  mode: { feature: 'trace-mode' },
+  traceFormat: { feature: 'trace-format' },
+  traceGranularity: { feature: 'per-test-granularity' },
+  tracePolicy: { feature: 'retry-retention' },
+  filmstrip: { feature: 'filmstrip' },
+  emitArtifactsManifest: { feature: 'artifacts-manifest' }
+}
+
+export const SERVICE_OPTIONS: Record<OwnKeys<ServiceOptions>, OptionTarget> = {
+  screenshot: { feature: 'per-test-artifacts' },
+  video: { feature: 'per-test-artifacts' },
+  devtoolsCapabilities: { feature: 'dashboard-window' }
+}
+
+export const SELENIUM_OPTIONS: Record<
+  OwnKeys<SeleniumOptions>,
+  OptionTarget
+> = {
+  openUi: { feature: 'dashboard-window' },
+  captureScreenshots: { feature: 'screenshot-switch' },
+  rerunCommand: { feature: 'run-controls' },
+  headless: { feature: 'headless' },
+  screenshot: { feature: 'per-test-artifacts' },
+  video: { feature: 'per-test-artifacts' }
+}
+
+export const NIGHTWATCH_OPTIONS: Record<
+  OwnKeys<NightwatchOptions>,
+  OptionTarget
+> = {
+  bidi: { feature: 'auto-bidi' },
+  screenshot: { feature: 'per-test-artifacts' },
+  video: { feature: 'per-test-artifacts' }
+}
+
+const TURNS_THE_ADAPTER_ON = {
+  notFeature: 'Turns the adapter on.'
+}
+
+// Internal handshake variables (rerun reuse, runner cwd) come from the shared contract and are set by the backend, not by users.
+/** `enable()` keywords, pytest flags and ini keys, and `DEVTOOLS_*` variables; a test reads the real ones from the source. */
+export const PYTHON_OPTIONS: Record<string, OptionTarget> = {
+  host: WHERE_THE_BACKEND_LISTENS,
+  port: WHERE_THE_BACKEND_LISTENS,
+  webdriver_cls: {
+    notFeature:
+      'Which WebDriver class to instrument, for a project that subclasses it.'
+  },
+  trace: { feature: 'trace-mode' },
+  filmstrip: { feature: 'filmstrip' },
+  a11y: { feature: 'a11y-overlay' },
+  trace_policy: { feature: 'retry-retention' },
+  trace_granularity: { feature: 'per-test-granularity' },
+  '--devtools': TURNS_THE_ADAPTER_ON,
+  '--devtools-trace': { feature: 'trace-mode' },
+  '--devtools-trace-granularity': { feature: 'per-test-granularity' },
+  '--devtools-trace-policy': { feature: 'retry-retention' },
+  devtools: TURNS_THE_ADAPTER_ON,
+  devtools_trace: { feature: 'trace-mode' },
+  devtools_trace_granularity: { feature: 'per-test-granularity' },
+  devtools_trace_policy: { feature: 'retry-retention' },
+  DEVTOOLS_HOST: WHERE_THE_BACKEND_LISTENS,
+  DEVTOOLS_PORT: WHERE_THE_BACKEND_LISTENS,
+  DEVTOOLS_BACKEND_CMD: {
+    notFeature: 'Which command launches the dashboard backend.'
+  },
+  DEVTOOLS_ENABLE: TURNS_THE_ADAPTER_ON,
+  DEVTOOLS_BIDI: { feature: 'auto-bidi' },
+  DEVTOOLS_OPEN: { feature: 'dashboard-window' },
+  DEVTOOLS_TRACE: { feature: 'trace-mode' },
+  DEVTOOLS_FILMSTRIP: { feature: 'filmstrip' },
+  DEVTOOLS_A11Y: { feature: 'a11y-overlay' },
+  DEVTOOLS_TRACE_POLICY: { feature: 'retry-retention' },
+  DEVTOOLS_TRACE_GRANULARITY: { feature: 'per-test-granularity' }
+}
+
+export const OPTION_MAPS: Record<
+  AdapterId | 'shared',
+  Record<string, OptionTarget>
+> = {
+  shared: SHARED_OPTIONS,
+  'devtools-service': SERVICE_OPTIONS,
+  'selenium-devtools': SELENIUM_OPTIONS,
+  'nightwatch-devtools': NIGHTWATCH_OPTIONS,
+  'selenium-devtools-py': PYTHON_OPTIONS
+}
+
+/** Every option names a declared feature, or says why it is not one. */
+export function optionProblems(features: readonly Feature[]): string[] {
+  const ids = new Set(features.map((f) => f.id))
+  return Object.entries(OPTION_MAPS).flatMap(([owner, options]) =>
+    Object.entries(options).flatMap(([option, target]) => {
+      if ('feature' in target) {
+        return ids.has(target.feature)
+          ? []
+          : [
+              `option ${owner}.${option}: names unknown feature ${target.feature}`
+            ]
+      }
+      return target.notFeature.trim()
+        ? []
+        : [`option ${owner}.${option}: not a feature, but no reason`]
+    })
+  )
+}
diff --git a/packages/conformance/src/capability-validation.ts b/packages/conformance/src/capability-validation.ts
new file mode 100644
index 00000000..7135097c
--- /dev/null
+++ b/packages/conformance/src/capability-validation.ts
@@ -0,0 +1,146 @@
+import { statSync } from 'node:fs'
+import path from 'node:path'
+
+import { FEATURES } from './features.js'
+import { KNOWN_GAPS } from './allowlist.js'
+import { ADAPTER_COLUMNS, INTERNAL_RULES } from './capabilities.js'
+import {
+  ADAPTER_TESTS,
+  SHARED_TESTS,
+  conformanceRules
+} from './capability-helpers.js'
+import { optionProblems } from './capability-options.js'
+import { REPO_ROOT, RULES } from './constants.js'
+import type { AdapterId, Cell, Feature, RuleId } from './types.js'
+
+/** Problems the declaration can have that its types cannot rule out; empty when it is sound. */
+export function validateFeatures(
+  features: readonly Feature[] = FEATURES,
+  internalRules: Partial<Record<RuleId, string>> = INTERNAL_RULES
+): string[] {
+  return [
+    ...rowProblems(features),
+    ...ruleCoverageProblems(features, internalRules),
+    ...optionProblems(features)
+  ]
+}
+
+/** Per row: a cell for every adapter, a reason where one is due, real evidence behind every supported cell. */
+export function rowProblems(features: readonly Feature[]): string[] {
+  const problems: string[] = []
+  const known = new Set<string>(Object.values(RULES))
+  const ids = new Set<string>()
+  for (const feature of features) {
+    if (ids.has(feature.id)) {
+      problems.push(`${feature.id}: declared twice`)
+    }
+    ids.add(feature.id)
+    if (feature.tables.length === 0) {
+      problems.push(`${feature.id}: appears in no table`)
+    }
+    for (const { id: adapter } of ADAPTER_COLUMNS) {
+      const cell = feature.cells[adapter]
+      if (!cell) {
+        problems.push(`${feature.id}: no cell for ${adapter}`)
+        continue
+      }
+      problems.push(
+        ...cellProblems(cell, adapter, known).map(
+          (p) => `${feature.id} / ${adapter}: ${p}`
+        )
+      )
+    }
+  }
+  return problems
+}
+
+/** Every conformance rule backs some tested cell, or is listed as internal with a reason. */
+export function ruleCoverageProblems(
+  features: readonly Feature[],
+  internalRules: Partial<Record<RuleId, string>>
+): string[] {
+  const proving = new Set<RuleId>(
+    features.flatMap((f) => Object.values(f.cells).flatMap(conformanceRules))
+  )
+  return (Object.values(RULES) as RuleId[]).flatMap((rule) => {
+    const internal = internalRules[rule]
+    if (internal !== undefined && !internal.trim()) {
+      return [`rule ${rule}: internal without a reason`]
+    }
+    if (proving.has(rule) && internal !== undefined) {
+      return [`rule ${rule}: listed as internal but proves a cell`]
+    }
+    return proving.has(rule) || internal !== undefined
+      ? []
+      : [`rule ${rule}: proves no feature and is not listed as internal`]
+  })
+}
+
+const blank = (text: unknown) => typeof text !== 'string' || !text.trim()
+
+function cellProblems(
+  cell: Cell,
+  adapter: AdapterId,
+  known: Set<string>
+): string[] {
+  if (cell.support !== 'supported') {
+    return blank(cell.reason) ? ['a reason is required'] : []
+  }
+  // The types rule these out; a cell built outside them (a cast, plain JS) is reported rather than crashing the run.
+  const evidence = cell.evidence as unknown as
+    Record<string, unknown> | undefined
+  if (!evidence || typeof evidence !== 'object') {
+    return ['supported without evidence']
+  }
+  switch (evidence.kind) {
+    case 'manual':
+      return blank(evidence.reason)
+        ? ['manual evidence needs the reason no test covers it']
+        : []
+    case 'test':
+      return testProblems(evidence.path, adapter)
+    case 'rule':
+      return ruleProblems(evidence.rules, adapter, known)
+    default:
+      return [`evidence of unknown kind ${String(evidence.kind)}`]
+  }
+}
+
+function testProblems(test: unknown, adapter: AdapterId): string[] {
+  if (blank(test)) {
+    return ['test evidence names no file']
+  }
+  const relative = path.posix.normalize(String(test))
+  const allowed = [ADAPTER_TESTS[adapter], ...SHARED_TESTS]
+  if (!allowed.some((dir) => relative.startsWith(dir))) {
+    return [
+      `test ${relative} is outside ${ADAPTER_TESTS[adapter]} and the shared packages' tests`
+    ]
+  }
+  try {
+    return statSync(path.join(REPO_ROOT, relative)).isFile()
+      ? []
+      : [`test ${relative} is not a file`]
+  } catch {
+    return [`test ${relative} does not exist`]
+  }
+}
+
+function ruleProblems(
+  rules: unknown,
+  adapter: AdapterId,
+  known: Set<string>
+): string[] {
+  if (!Array.isArray(rules) || rules.length === 0) {
+    return ['rule evidence names no rule']
+  }
+  return rules.flatMap((rule: string) => {
+    if (!known.has(rule)) {
+      return [`unknown rule ${rule}`]
+    }
+    const gap = KNOWN_GAPS.find(
+      (g) => g.adapter === adapter && g.rules.includes(rule as RuleId)
+    )
+    return gap ? [`${rule} is a known gap (bidi: ${gap.bidi})`] : []
+  })
+}
diff --git a/packages/conformance/src/constants.ts b/packages/conformance/src/constants.ts
index b775d285..928c98ce 100644
--- a/packages/conformance/src/constants.ts
+++ b/packages/conformance/src/constants.ts
@@ -143,3 +143,22 @@ export const REPORT_INDEX = 'index.html'
 
 // Long enough to identify an argument, short enough to keep a timeline row on one line.
 export const TARGET_MAX_CHARS = 120
+
+export const README_PAGE = 'README.md'
+
+/** Where each capability table is rendered, relative to this repo or to a webdriverio checkout. */
+export const CAPABILITY_TABLES = {
+  'readme-trace': README_PAGE,
+  'readme-dashboard': README_PAGE,
+  'readme-mobile': README_PAGE,
+  'cross-framework': 'website/docs/devtools/CrossFrameworkSupport.md',
+  mobile: 'website/docs/devtools/MobileTesting.md'
+} as const
+
+export const SUPERSCRIPTS = ['⁰', '¹', '²', '³', '⁴', '⁵', '⁶', '⁷', '⁸', '⁹']
+
+export const GENERATED_NOTICE =
+  '<!-- Generated by `pnpm docs:capabilities` in webdriverio/devtools from packages/conformance/src/features.ts. Do not edit by hand. -->'
+
+export const LEGEND =
+  '✅ tested: proven for that adapter by the cross-adapter conformance suite. ✅: supported, backed by a named test or a manual check listed in [the feature list](https://github.com/webdriverio/devtools/blob/main/packages/conformance/src/features.ts).'
diff --git a/packages/conformance/src/features.ts b/packages/conformance/src/features.ts
new file mode 100644
index 00000000..a82ab5c3
--- /dev/null
+++ b/packages/conformance/src/features.ts
@@ -0,0 +1,508 @@
+// Every user-facing feature and what each adapter does with it; see CONTRIBUTING.md "Adding a feature".
+
+import {
+  ACTION_RULES,
+  ADAPTER_TESTS,
+  DOM_RULES,
+  ERROR_RULES,
+  NETWORK_RULES,
+  allCovered,
+  allTested,
+  byHand,
+  covered,
+  partial,
+  tested,
+  unsupported
+} from './capability-helpers.js'
+import type { Feature } from './types.js'
+
+const WDIO = ADAPTER_TESTS['devtools-service']
+const SELENIUM = ADAPTER_TESTS['selenium-devtools']
+const NIGHTWATCH = ADAPTER_TESTS['nightwatch-devtools']
+const PYTHON = ADAPTER_TESTS['selenium-devtools-py']
+
+const SAFARI_FOCUS_ONCE =
+  'Brings Safari to the front once after the session starts (live mode, local macOS), so a click issued after another window took the front can still land nowhere.'
+const NO_SCREENSHOT_SWITCH = 'No option: every command row takes a screenshot.'
+const NO_TRACE_FORMAT_TEST =
+  "The writer is tested in `packages/trace/tests/trace-exporter.test.ts`; no test covers the adapter handing `traceFormat` on, so check by hand with `traceFormat: 'ndjson-directory'` on the example."
+const NO_TIMINGS_TEST = (demo: string) =>
+  `No unit test asserts the timings reach the navigation row; check by hand with \`pnpm ${demo}\`.`
+const NO_HEADLESS_OPTION =
+  'No option: set headless in the browser capabilities, as for any run.'
+const WITHOUT_BIDI_ANCHOR =
+  'Without BiDi (Safari, Appium) the page collector is injected after each navigation, so a page the test leaves within tens of milliseconds is never captured.'
+const WITHOUT_BIDI_DRAIN =
+  'Without BiDi a page the test leaves within tens of milliseconds is never drained, so its requests are not listed.'
+const SELENIUM_JS_FILMSTRIP = 'CDP push (Chromium), polling elsewhere'
+const NETWORK_FLOOR =
+  "Fetch and XHR calls carry headers and bodies; every other load comes from the page's Resource Timing buffer, with timing and size but no headers or body, and no status on Safari."
+const NO_CUCUMBER_STEP_RERUN =
+  'Under Cucumber a Gherkin step has no CLI filter of its own, so the dashboard reruns scenarios and features, not single steps.'
+const STARTUP_CAPS_ONLY =
+  "Decides from the startup capabilities, so a hybrid app's webview half is captured as if it were still native."
+// appium-interceptor is an Android plugin; iOS app traffic needs a device or proxy capture outside the adapters.
+const onAndroid = (path: string) => covered(path, 'Android')
+const NEEDS_APPIUM_WEB = (demo: string) =>
+  `Needs an Appium device; check by hand with \`DEVTOOLS_MOBILE=web pnpm ${demo}\`.`
+const NEEDS_IOS = (demo: string) =>
+  `Needs a booted iOS simulator; check by hand with \`DEVTOOLS_MOBILE_PLATFORM=ios pnpm ${demo}\`.`
+
+export const FEATURES = [
+  {
+    id: 'trace-mode',
+    name: 'Trace mode + `show-trace` player',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}trace-action-capture.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}trace-granularity.test.ts`),
+      'nightwatch-devtools': covered(`${NIGHTWATCH}traceSlices.test.ts`),
+      'selenium-devtools-py': covered(`${PYTHON}test_trace_export.py`)
+    }
+  },
+  {
+    id: 'dom-time-travel',
+    name: 'DOM time-travel (mutation capture)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': tested(DOM_RULES),
+      'selenium-devtools': partial(WITHOUT_BIDI_ANCHOR, 'with BiDi'),
+      'nightwatch-devtools': partial(WITHOUT_BIDI_ANCHOR, 'with BiDi'),
+      'selenium-devtools-py': tested(DOM_RULES)
+    }
+  },
+  {
+    id: 'network-requests',
+    name: 'Network requests (browser sessions)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': tested(NETWORK_RULES),
+      'selenium-devtools': partial(WITHOUT_BIDI_DRAIN, 'with BiDi'),
+      'nightwatch-devtools': partial(
+        "Without BiDi (`bidi: true`) or Chrome's performance log (`goog:loggingPrefs`), a page the test leaves within tens of milliseconds is never drained, so its requests are not listed.",
+        'with BiDi'
+      ),
+      'selenium-devtools-py': tested(NETWORK_RULES)
+    }
+  },
+  {
+    id: 'filmstrip',
+    name: 'Screencast (`filmstrip` / video)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(
+        `${WDIO}screencast.test.ts`,
+        'CDP push (Chrome), polling elsewhere'
+      ),
+      'selenium-devtools': covered(
+        `${SELENIUM}screencast.test.ts`,
+        SELENIUM_JS_FILMSTRIP
+      ),
+      'nightwatch-devtools': partial(
+        'Nightwatch exposes no stable CDP handle, so frames come from a `takeScreenshot` poll every 200 ms.',
+        'polling only'
+      ),
+      'selenium-devtools-py': covered(
+        `${PYTHON}test_cdp_screencast.py`,
+        'CDP push (Chromium), one frame per command elsewhere'
+      )
+    }
+  },
+  {
+    id: 'per-test-granularity',
+    name: "Per-test granularity (`traceGranularity: 'test'`)",
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}trace-granularity.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}trace-granularity.test.ts`),
+      'nightwatch-devtools': partial(
+        'Nightwatch fires the global `beforeEach` / `afterEach` once per test module for `describe/it` and exports-object tests, so they collapse to one slice keyed to the first test; Cucumber scenarios get real per-test slices.'
+      ),
+      // The Python adapter ships no Node; the backend slices its run per test.
+      'selenium-devtools-py': covered(
+        'packages/backend/tests/trace-slice.test.ts'
+      )
+    }
+  },
+  {
+    id: 'retry-retention',
+    name: 'Retry-aware retention (`tracePolicy`)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}trace-granularity.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}attempt-capture.test.ts`),
+      'nightwatch-devtools': partial(
+        'For `describe/it` and exports-object tests, `--retries` reruns a testcase internally without firing the per-test hooks again, so the other policies behave like `retain-on-failure`; Cucumber scenarios record every attempt.',
+        '`retain-on-failure` only'
+      ),
+      'selenium-devtools-py': partial(
+        'Nothing the Python adapter sends carries an attempt number, so the retry-aware policies behave like `retain-on-failure`.',
+        '`retain-on-failure` only'
+      )
+    }
+  },
+  {
+    id: 'per-test-artifacts',
+    name: 'Per-test `screenshot` / `video`, attached to Allure',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}screencast-lifecycle.test.ts`),
+      'selenium-devtools': byHand(
+        'No test covers the adapter producing and attaching the per-test files; check by hand with `pnpm --filter @wdio/selenium-devtools example:mocha:allure`.'
+      ),
+      'nightwatch-devtools': partial(
+        'Nightwatch has no live Allure attach API, so per-test screenshots and videos are written to disk and listed in the manifest but not attached.',
+        'produce-only'
+      ),
+      'selenium-devtools-py': unsupported(
+        'The Python adapter has no `screenshot` / `video` options and no Allure attachment yet.'
+      )
+    }
+  },
+  {
+    id: 'cucumber-nesting',
+    name: 'Cucumber Feature→Scenario→Step nesting',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': partial(
+        'The service records no feature ancestry for a scenario, so the trace nests Scenario→Step.',
+        'Scenario→Step'
+      ),
+      'selenium-devtools': covered(`${SELENIUM}index.test.ts`),
+      'nightwatch-devtools': partial(
+        'Nightwatch steps are not stamped as nested groups, so the trace nests Feature→Scenario.',
+        'Feature→Scenario'
+      ),
+      'selenium-devtools-py': unsupported(
+        'The Python adapter stamps no Feature or Step groups, so a pytest-bdd scenario is one flat test group with no Feature parent and no Step children.'
+      )
+    }
+  },
+  {
+    id: 'assertion-capture',
+    name: 'Assertion capture (`captureAssertions`)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}assert-capture.test.ts`),
+      'selenium-devtools': partial(
+        '`node:assert` rows pass and fail; jest-style `expect()` and chai produce no rows at all, and a failing matcher only marks its test failed.',
+        '`node:assert` only'
+      ),
+      'nightwatch-devtools': partial(
+        "`assert.*`, `verify.*` and `node:assert` rows pass and fail; Nightwatch's `expect` API produces no rows.",
+        'no `expect`'
+      ),
+      'selenium-devtools-py': covered(`${PYTHON}test_assertions.py`)
+    }
+  },
+  {
+    id: 'auto-bidi',
+    name: 'BiDi console / network capture',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': byHand(
+        'No test covers the service attaching BiDi by itself; check by hand with `pnpm demo:wdio`.',
+        'auto'
+      ),
+      'selenium-devtools': byHand(
+        'No test covers `webSocketUrl` being set on the Builder and BiDi attached; check by hand with `pnpm demo:selenium`.',
+        'auto'
+      ),
+      'nightwatch-devtools': partial(
+        'Nightwatch turns it on with `bidi: true` plus `webSocketUrl: true` in the capabilities.',
+        'opt-in'
+      ),
+      'selenium-devtools-py': covered(
+        `${PYTHON}test_instrumentation.py`,
+        'auto'
+      )
+    }
+  },
+  {
+    id: 'a11y-overlay',
+    name: 'A11y tab + pick-locator overlay (trace player)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}action-snapshot.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}action-snapshot.test.ts`),
+      'nightwatch-devtools': covered(
+        `${NIGHTWATCH}actionSnapshotDialect.test.ts`
+      ),
+      'selenium-devtools-py': covered(`${PYTHON}test_a11y_elements.py`)
+    }
+  },
+  {
+    id: 'transcript',
+    name: 'Transcript + Copy-for-LLM (trace player)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: allCovered('packages/trace/tests/trace-transcript.test.ts')
+  },
+  {
+    id: 'actions-list',
+    name: 'One row per command in the Actions list',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: allTested(ACTION_RULES)
+  },
+  {
+    id: 'command-screenshots',
+    name: 'Screenshot on every command row',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}session.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}teardown-settle.test.ts`),
+      'nightwatch-devtools': byHand(
+        'No unit test attaches the row screenshot; check the dashboard with `pnpm demo:nightwatch`.'
+      ),
+      'selenium-devtools-py': covered(`${PYTHON}test_instrumentation.py`)
+    }
+  },
+  {
+    id: 'console-logs',
+    name: 'Browser console logs',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}session.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}session.test.ts`),
+      'nightwatch-devtools': covered(`${NIGHTWATCH}session.test.ts`),
+      'selenium-devtools-py': covered(`${PYTHON}test_bidi.py`)
+    }
+  },
+  {
+    id: 'source-tab',
+    name: 'Source tab opens the test line that ran the command',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}session.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}index.test.ts`),
+      'nightwatch-devtools': covered(`${NIGHTWATCH}browserProxy.test.ts`),
+      'selenium-devtools-py': covered(`${PYTHON}test_pytest_plugin.py`)
+    }
+  },
+  {
+    id: 'metadata-tab',
+    name: 'Metadata tab (session, capabilities, device)',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': covered(`${WDIO}session-metadata.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}driverMetadata.test.ts`),
+      'nightwatch-devtools': byHand(
+        'No test asserts the capabilities in the metadata the adapter sends; check the Metadata tab with `pnpm demo:nightwatch`.'
+      ),
+      'selenium-devtools-py': covered(`${PYTHON}test_instrumentation.py`)
+    }
+  },
+  {
+    id: 'performance-timings',
+    name: 'Performance timings on navigation rows',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': byHand(NO_TIMINGS_TEST('demo:wdio')),
+      'selenium-devtools': byHand(NO_TIMINGS_TEST('demo:selenium')),
+      'nightwatch-devtools': byHand(NO_TIMINGS_TEST('demo:nightwatch')),
+      'selenium-devtools-py': covered(`${PYTHON}test_performance.py`)
+    }
+  },
+  {
+    id: 'failed-command-errors',
+    name: "Failed command in the Errors tab, with the browser's message",
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: allTested(ERROR_RULES)
+  },
+  {
+    id: 'run-controls',
+    name: 'Run, Rerun and Run all from the dashboard',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': partial(
+        NO_CUCUMBER_STEP_RERUN,
+        'no Cucumber step rerun'
+      ),
+      'selenium-devtools': partial(
+        NO_CUCUMBER_STEP_RERUN,
+        'no Cucumber step rerun'
+      ),
+      'nightwatch-devtools': partial(
+        NO_CUCUMBER_STEP_RERUN,
+        'no Cucumber step rerun'
+      ),
+      // pytest has no Gherkin steps to rerun.
+      'selenium-devtools-py': covered(`${PYTHON}test_rerun.py`)
+    }
+  },
+  {
+    id: 'preserve-rerun',
+    name: 'Preserve & Rerun (compare a failed run with its rerun)',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: allCovered('packages/backend/tests/preserve-across-rerun.test.ts')
+  },
+  {
+    id: 'dashboard-window',
+    name: 'Dashboard window opens by itself in live mode, and can be turned off',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': partial(
+        'The service always opens the dashboard in live mode; `devtoolsCapabilities` picks its browser but cannot skip it.',
+        'always opens'
+      ),
+      'selenium-devtools': byHand(
+        'No unit test asserts the window stays shut; check by hand with `openUi: false` on the Selenium example.',
+        '`openUi: false`'
+      ),
+      'nightwatch-devtools': partial(
+        'Nightwatch always opens the dashboard in live mode.',
+        'always opens'
+      ),
+      'selenium-devtools-py': covered(
+        `${PYTHON}test_lifecycle.py`,
+        '`DEVTOOLS_OPEN=0`'
+      )
+    }
+  },
+  {
+    id: 'screenshot-switch',
+    name: 'Turn off per-command screenshots (`captureScreenshots`)',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': unsupported(
+        'No option: every command row takes a screenshot, except on Appium, where only native sessions in live mode do.'
+      ),
+      'selenium-devtools': byHand(
+        'No unit test asserts that `captureScreenshots: false` skips the row screenshot; check on the Selenium example.'
+      ),
+      'nightwatch-devtools': unsupported(NO_SCREENSHOT_SWITCH),
+      'selenium-devtools-py': unsupported(NO_SCREENSHOT_SWITCH)
+    }
+  },
+  {
+    id: 'headless',
+    name: 'Force the test browser headless (`headless`)',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': unsupported(NO_HEADLESS_OPTION),
+      'selenium-devtools': partial(
+        'The option adds `--headless=old` to `goog:chromeOptions` only, so other browsers stay headed; set their own headless capability.',
+        'Chrome only'
+      ),
+      'nightwatch-devtools': unsupported(NO_HEADLESS_OPTION),
+      'selenium-devtools-py': unsupported(NO_HEADLESS_OPTION)
+    }
+  },
+  {
+    id: 'safari-focus',
+    name: 'Safari kept frontmost so input lands (live mode)',
+    tables: ['readme-dashboard', 'cross-framework'],
+    cells: {
+      'devtools-service': partial(SAFARI_FOCUS_ONCE, 'once'),
+      'selenium-devtools': byHand(
+        'No test covers the Safari window switch before an input; check live on desktop Safari.',
+        'before each element input'
+      ),
+      'nightwatch-devtools': partial(SAFARI_FOCUS_ONCE, 'once'),
+      'selenium-devtools-py': partial(SAFARI_FOCUS_ONCE, 'once')
+    }
+  },
+  {
+    id: 'trace-format',
+    name: "Unpacked trace output (`traceFormat: 'ndjson-directory'`)",
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': byHand(NO_TRACE_FORMAT_TEST),
+      'selenium-devtools': byHand(NO_TRACE_FORMAT_TEST),
+      'nightwatch-devtools': byHand(NO_TRACE_FORMAT_TEST),
+      'selenium-devtools-py': unsupported(
+        'The Python adapter has no option for it and sends no format in its export request, so the backend writes a zip.',
+        'zip only'
+      )
+    }
+  },
+  {
+    id: 'artifacts-manifest',
+    name: 'Artifacts manifest for CI and reporters (`emitArtifactsManifest`)',
+    tables: ['readme-trace', 'cross-framework'],
+    cells: {
+      'devtools-service': byHand(
+        'No test covers the service turning the manifest on when an Allure reporter is configured; check by hand with one configured.'
+      ),
+      'selenium-devtools': covered(`${SELENIUM}attempt-capture.test.ts`),
+      'nightwatch-devtools': partial(
+        'Nightwatch has no live Allure signal to turn the manifest on by itself, so it stays opt-in.',
+        'opt-in'
+      ),
+      'selenium-devtools-py': unsupported(
+        'The Python adapter writes no artifacts manifest.'
+      )
+    }
+  },
+  {
+    id: 'network-without-bidi',
+    name: 'Network without BiDi (Safari, Appium mobile browsers)',
+    tables: ['readme-trace', 'readme-mobile', 'cross-framework', 'mobile'],
+    cells: {
+      'devtools-service': partial(NETWORK_FLOOR),
+      'selenium-devtools': partial(NETWORK_FLOOR),
+      'nightwatch-devtools': partial(NETWORK_FLOOR),
+      'selenium-devtools-py': partial(NETWORK_FLOOR)
+    }
+  },
+  {
+    id: 'mobile-browser',
+    name: 'Mobile browser sessions (Chrome on Android, Safari on iOS)',
+    tables: ['readme-mobile', 'mobile'],
+    cells: {
+      'devtools-service': covered(`${WDIO}session.test.ts`),
+      'selenium-devtools': byHand(NEEDS_APPIUM_WEB('demo:selenium:mobile')),
+      'nightwatch-devtools': byHand(NEEDS_APPIUM_WEB('demo:nightwatch:mobile')),
+      'selenium-devtools-py': byHand(NEEDS_APPIUM_WEB('demo:python:mobile'))
+    }
+  },
+  {
+    id: 'ios',
+    name: 'iOS (XCUITest): native apps and Safari',
+    tables: ['readme-mobile', 'mobile'],
+    cells: {
+      'devtools-service': byHand(NEEDS_IOS('demo:wdio:mobile')),
+      'selenium-devtools': byHand(NEEDS_IOS('demo:selenium:mobile')),
+      'nightwatch-devtools': byHand(NEEDS_IOS('demo:nightwatch:mobile')),
+      'selenium-devtools-py': byHand(NEEDS_IOS('demo:python:mobile'))
+    }
+  },
+  {
+    id: 'native-detected',
+    name: 'Native session detected, page-side capture skipped',
+    tables: ['readme-mobile', 'mobile'],
+    cells: {
+      'devtools-service': covered(`${WDIO}session.test.ts`),
+      'selenium-devtools': covered(`${SELENIUM}session.test.ts`),
+      'nightwatch-devtools': covered(`${NIGHTWATCH}native-session.test.ts`),
+      'selenium-devtools-py': covered(`${PYTHON}test_device.py`)
+    }
+  },
+  {
+    id: 'hybrid-webview',
+    name: 'Follows a hybrid app into its webview',
+    tables: ['readme-mobile', 'mobile'],
+    cells: {
+      'devtools-service': partial(
+        "Follows `switchContext('WEBVIEW_...')`; the object form (`{ title }` / `{ url }`) and `switchAppiumContext` leave capture on the native side.",
+        'string form only'
+      ),
+      'selenium-devtools': partial(STARTUP_CAPS_ONLY),
+      'nightwatch-devtools': partial(STARTUP_CAPS_ONLY),
+      'selenium-devtools-py': partial(STARTUP_CAPS_ONLY)
+    }
+  },
+  {
+    id: 'native-network',
+    name: 'Native app network through appium-interceptor (`appium:intercept`)',
+    tables: ['readme-mobile', 'mobile'],
+    cells: {
+      'devtools-service': onAndroid(`${WDIO}intercepted-network.test.ts`),
+      'selenium-devtools': onAndroid(`${SELENIUM}native-network.test.ts`),
+      'nightwatch-devtools': onAndroid(`${NIGHTWATCH}native-session.test.ts`),
+      'selenium-devtools-py': onAndroid(`${PYTHON}test_interceptor_network.py`)
+    }
+  }
+] as const satisfies readonly Feature[]
+
+/** Every feature id, so an option or reference to a misspelt feature fails to compile. */
+export type FeatureId = (typeof FEATURES)[number]['id']
diff --git a/packages/conformance/src/render-capabilities.ts b/packages/conformance/src/render-capabilities.ts
new file mode 100644
index 00000000..e72e98c7
--- /dev/null
+++ b/packages/conformance/src/render-capabilities.ts
@@ -0,0 +1,145 @@
+import { FEATURES } from './features.js'
+import { ADAPTER_COLUMNS } from './capabilities.js'
+import { isConformanceTested } from './capability-helpers.js'
+import { GENERATED_NOTICE, LEGEND, SUPERSCRIPTS } from './constants.js'
+import type { CapabilityTable, Cell, Feature } from './types.js'
+
+export function superscript(n: number): string {
+  return String(n)
+    .split('')
+    .map((digit) => SUPERSCRIPTS[Number(digit)])
+    .join('')
+}
+
+export const markerFor = (table: CapabilityTable, edge: 'start' | 'end') =>
+  `<!-- capability-matrix:${table}:${edge} -->`
+
+function mark(cell: Cell): string {
+  switch (cell.support) {
+    case 'supported':
+      return isConformanceTested(cell) ? '✅ tested' : '✅'
+    case 'partial':
+      return '⚠️'
+    case 'unsupported':
+      return '❌'
+  }
+}
+
+/** One table, with each distinct reason numbered once in the order it first appears. */
+export function renderTable(
+  table: CapabilityTable,
+  features: readonly Feature[] = FEATURES
+): string {
+  const rows = features.filter((f) => f.tables.includes(table))
+  const reasons: string[] = []
+  const footnote = (reason: string) => {
+    const index = reasons.indexOf(reason)
+    if (index !== -1) {
+      return index + 1
+    }
+    reasons.push(reason)
+    return reasons.length
+  }
+  const cellText = (cell: Cell) => {
+    const parts = [mark(cell)]
+    if (cell.label) {
+      parts.push(cell.label)
+    }
+    if (cell.support !== 'supported') {
+      parts.push(superscript(footnote(cell.reason)))
+    }
+    return parts.join(' ')
+  }
+  const lines = [
+    `| Feature | ${ADAPTER_COLUMNS.map((a) => a.title).join(' | ')} |`,
+    `|---|${ADAPTER_COLUMNS.map(() => '---').join('|')}|`,
+    ...rows.map(
+      (row) =>
+        `| ${row.name} | ${ADAPTER_COLUMNS.map((a) => cellText(row.cells[a.id])).join(' | ')} |`
+    )
+  ]
+  const blocks = [lines.join('\n'), LEGEND]
+  if (reasons.length) {
+    blocks.push(...reasons.map((r, i) => `${superscript(i + 1)} ${r}`))
+  }
+  return blocks.join('\n\n')
+}
+
+/** The full marker block, as it sits in a page. */
+export function renderBlock(
+  table: CapabilityTable,
+  features?: readonly Feature[]
+): string {
+  return [
+    markerFor(table, 'start'),
+    GENERATED_NOTICE,
+    '',
+    renderTable(table, features),
+    '',
+    markerFor(table, 'end')
+  ].join('\n')
+}
+
+/** Replaces the page's one marker block for this table; throws, naming the problem, when it has none, two, or a reversed pair. */
+export function replaceBlock(
+  page: string,
+  table: CapabilityTable,
+  features?: readonly Feature[]
+): string {
+  const startMarker = markerFor(table, 'start')
+  const endMarker = markerFor(table, 'end')
+  const starts = page.split(startMarker).length - 1
+  const ends = page.split(endMarker).length - 1
+  if (starts === 0 && ends === 0) {
+    throw new Error(
+      `no ${table} table; insert the lines ${startMarker} and ${endMarker} where it belongs`
+    )
+  }
+  if (starts !== 1 || ends !== 1) {
+    throw new Error(
+      `${starts} start and ${ends} end markers for ${table}; keep exactly one ${startMarker} and one ${endMarker}`
+    )
+  }
+  const start = page.indexOf(startMarker)
+  const end = page.indexOf(endMarker)
+  if (end < start) {
+    throw new Error(`${endMarker} comes before ${startMarker}`)
+  }
+  return (
+    page.slice(0, start) +
+    renderBlock(table, features) +
+    page.slice(end + endMarker.length)
+  )
+}
+
+/** Each feature some adapter lacks, with that adapter's mark and reason, then a count of the evidence behind every cell. */
+export function renderParity(features: readonly Feature[] = FEATURES): string {
+  const gaps = features.filter((f) =>
+    ADAPTER_COLUMNS.some((a) => f.cells[a.id].support !== 'supported')
+  )
+  const lines = [
+    `Features not supported by every adapter: ${gaps.length} of ${features.length}`
+  ]
+  for (const row of gaps) {
+    lines.push('', `${row.id}: ${row.name}`)
+    for (const { id, title } of ADAPTER_COLUMNS) {
+      const cell = row.cells[id]
+      if (cell.support !== 'supported') {
+        const shown = [mark(cell), cell.label].filter(Boolean).join(' ')
+        lines.push(`  ${title}: ${shown}. ${cell.reason}`)
+      }
+    }
+  }
+  const counts = { rule: 0, test: 0, manual: 0, gap: 0 }
+  for (const row of features) {
+    for (const { id } of ADAPTER_COLUMNS) {
+      const cell = row.cells[id]
+      counts[cell.support === 'supported' ? cell.evidence.kind : 'gap']++
+    }
+  }
+  lines.push(
+    '',
+    `Cells: ${counts.rule} conformance-tested, ${counts.test} unit-tested, ${counts.manual} checked by hand, ${counts.gap} partial or unsupported`
+  )
+  return lines.join('\n')
+}
diff --git a/packages/conformance/src/types.ts b/packages/conformance/src/types.ts
index 3d202aaf..aa000e4f 100644
--- a/packages/conformance/src/types.ts
+++ b/packages/conformance/src/types.ts
@@ -1,13 +1,13 @@
 import type {
   CommandLog,
   NetworkRequest,
-  RunCapabilities,
   TraceMutation
 } from '@wdio/devtools-shared'
 
 import type {
   ACTION_METHODS,
   BIDI_MODES,
+  CAPABILITY_TABLES,
   RESPONSIBILITIES,
   RULES
 } from './constants.js'
@@ -111,8 +111,6 @@ export interface NormalizedRun {
   requests: string[]
 }
 
-export type RunControl = keyof RunCapabilities
-
 /** The run controls a metadata frame offers: the capabilities advertised, and whether a command or config serves them. */
 export interface RunControls {
   advertised: string[]
@@ -170,8 +168,6 @@ export interface KnownGap {
   reason: string
   /** Set when the gap is a race, so a run that happens to win it is not stale. */
   timingDependent?: boolean
-  /** For a run-controls gap, the controls the holder does not offer: it explains their absence and nothing else. */
-  lacksRunControls?: RunControl[]
 }
 
 export interface Judgement {
@@ -236,3 +232,45 @@ export interface Timeline {
   /** Violations with no subject, or whose subject is not on the timeline. */
   unplaced: Violation[]
 }
+
+/** Where a feature row is rendered: a marker block in a markdown page. */
+export type CapabilityTable = keyof typeof CAPABILITY_TABLES
+
+/** How a supported cell is known to hold. */
+export type Evidence =
+  /** Checked for this adapter by the cross-adapter conformance suite. */
+  | { readonly kind: 'rule'; readonly rules: readonly RuleId[] }
+  /** Exercised by this test file, a path from the repo root. */
+  | { readonly kind: 'test'; readonly path: string }
+  /** Checked by hand, with why no automated check covers it yet. */
+  | { readonly kind: 'manual'; readonly reason: string }
+
+export type Cell =
+  | {
+      readonly support: 'supported'
+      readonly evidence: Evidence
+      readonly label?: string
+    }
+  | {
+      readonly support: 'partial' | 'unsupported'
+      readonly reason: string
+      readonly label?: string
+    }
+
+/** One row of the matrix: a user-facing feature and what each adapter does with it. */
+export interface Feature {
+  readonly id: string
+  readonly name: string
+  readonly tables: readonly CapabilityTable[]
+  readonly cells: Readonly<Record<AdapterId, Cell>>
+}
+
+/** What a user-facing option controls: a feature row, or why it is not one. */
+export type OptionTarget<Id extends string = string> =
+  { feature: Id } | { notFeature: string }
+
+/** One table in one page file. */
+export interface CapabilityTarget {
+  table: CapabilityTable
+  file: string
+}
diff --git a/packages/conformance/tests/agreement.test.ts b/packages/conformance/tests/agreement.test.ts
index b91b21d2..09135e53 100644
--- a/packages/conformance/tests/agreement.test.ts
+++ b/packages/conformance/tests/agreement.test.ts
@@ -5,10 +5,12 @@ import type { RunnerOptions } from '@wdio/devtools-shared'
 import { compareRuns, judgeDivergences } from '../src/agreement.js'
 import { RULES } from '../src/constants.js'
 import { normalizeRun } from '../src/normalize.js'
+import { KNOWN_GAPS } from '../src/allowlist.js'
 import { renderReport } from '../src/report-html.js'
 import type {
   AdapterId,
   BidiMode,
+  KnownGap,
   RunReport,
   Violation,
   WireFrame
@@ -363,36 +365,24 @@ describe('judgeDivergences', () => {
     return judgeDivergences(compareRuns([nw, js]), [nw, js])
   }
 
-  it('excuses only the run control the gap declares absent', () => {
-    const { unexplained, explained, stale } = nightwatchAgainstSelenium({
-      canRunAll: false,
-      canRunSuites: true,
-      canRunTests: true
-    })
-    expect(unexplained).toEqual([])
-    expect(explained.map((d) => d.rule)).toEqual([RULES.agreeOnRunControls])
+  it('finds no run-controls difference now that Nightwatch offers every control', () => {
+    const { unexplained, explained, stale } = nightwatchAgainstSelenium(
+      EVERY_CONTROL.runCapabilities
+    )
+    expect([...unexplained, ...explained]).toEqual([])
     expect(stale).toEqual([])
   })
 
-  // Regression: any run-controls difference was explained once Nightwatch held its gap, so a lost control passed.
-  it('does not excuse a run control the holder lost since declaring its gap', () => {
+  it('reports a run control one adapter does not offer as unexplained', () => {
     const { unexplained } = nightwatchAgainstSelenium({
       canRunAll: false,
       canRunSuites: true,
-      canRunTests: false
+      canRunTests: true
     })
     expect(unexplained.map((d) => d.rule)).toEqual([RULES.agreeOnRunControls])
     expect(unexplained[0].message).toContain(
-      'canRunSuites; served vs canRunAll, canRunSuites, canRunTests; served'
-    )
-  })
-
-  it('reports a comparison gap that no longer occurs as stale', () => {
-    const { unexplained, stale } = nightwatchAgainstSelenium(
-      EVERY_CONTROL.runCapabilities
+      'canRunSuites, canRunTests; served vs canRunAll, canRunSuites, canRunTests; served'
     )
-    expect(unexplained).toEqual([])
-    expect(stale.map((g) => g.adapter)).toEqual(['nightwatch-devtools'])
   })
 })
 
@@ -413,15 +403,27 @@ describe('the agreement section of the report', () => {
 
   // Regression: the comparison's stale gaps never reached the report, which read AGREE while the test failed.
   it('shows a stale comparison gap instead of calling the mode agreed', () => {
-    const html = renderReport([
-      report('nightwatch-devtools', stream(1, NW, { options: EVERY_CONTROL })),
-      report('selenium-devtools', stream(2, JS, { options: EVERY_CONTROL }))
-    ])
-    expect(html).toContain('STALE GAPS (1)')
-    expect(html).toContain(
-      'Stale gap</strong> for <code>nightwatch-devtools</code>'
-    )
-    expect(html).not.toContain('>AGREE<')
+    // Every real comparison gap is a race and never stale, so this one is declared for the test alone.
+    const gap: KnownGap = {
+      adapter: 'nightwatch-devtools',
+      bidi: 'live',
+      rules: [RULES.agreeOnActions],
+      reason: 'Test fixture: a difference that no longer occurs.'
+    }
+    KNOWN_GAPS.push(gap)
+    try {
+      const html = renderReport([
+        report('nightwatch-devtools', stream(1, NW)),
+        report('selenium-devtools', stream(2, JS))
+      ])
+      expect(html).toContain('STALE GAPS (1)')
+      expect(html).toContain(
+        'Stale gap</strong> for <code>nightwatch-devtools</code>'
+      )
+      expect(html).not.toContain('>AGREE<')
+    } finally {
+      KNOWN_GAPS.splice(KNOWN_GAPS.indexOf(gap), 1)
+    }
   })
 })
 
diff --git a/packages/conformance/tests/capabilities.test.ts b/packages/conformance/tests/capabilities.test.ts
new file mode 100644
index 00000000..9513f30a
--- /dev/null
+++ b/packages/conformance/tests/capabilities.test.ts
@@ -0,0 +1,420 @@
+import { describe, expect, it } from 'vitest'
+
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+
+import { FEATURES } from '../src/features.js'
+import { ADAPTER_COLUMNS, INTERNAL_RULES } from '../src/capabilities.js'
+import { optionProblems } from '../src/capability-options.js'
+import { parseArgs, syncTables, targetsFor } from '../src/capability-matrix.js'
+import {
+  rowProblems,
+  ruleCoverageProblems,
+  validateFeatures
+} from '../src/capability-validation.js'
+import { CAPABILITY_TABLES, LEGEND, RULES } from '../src/constants.js'
+import {
+  markerFor,
+  renderBlock,
+  renderParity,
+  renderTable,
+  replaceBlock,
+  superscript
+} from '../src/render-capabilities.js'
+import type {
+  AdapterId,
+  CapabilityTable,
+  Cell,
+  Feature,
+  RuleId
+} from '../src/types.js'
+
+const BY_HAND: Cell = {
+  support: 'supported',
+  evidence: { kind: 'manual', reason: 'Check by hand.' }
+}
+const byRule = (rules: RuleId[]): Cell => ({
+  support: 'supported',
+  evidence: { kind: 'rule', rules }
+})
+const byTest = (path: string): Cell => ({
+  support: 'supported',
+  evidence: { kind: 'test', path }
+})
+
+const allCells = (cell: Cell): Record<AdapterId, Cell> => ({
+  'devtools-service': cell,
+  'selenium-devtools': cell,
+  'nightwatch-devtools': cell,
+  'selenium-devtools-py': cell
+})
+
+const feature = (over: Partial<Feature> = {}): Feature => ({
+  id: 'probe',
+  name: 'Probe',
+  tables: ['cross-framework'],
+  cells: allCells(BY_HAND),
+  ...over
+})
+
+describe('validateFeatures', () => {
+  it('accepts the declared source', () => {
+    expect(validateFeatures()).toEqual([])
+  })
+
+  it('rejects an empty reason', () => {
+    const blank = feature({
+      cells: {
+        ...allCells(BY_HAND),
+        'selenium-devtools': { support: 'partial', reason: '  ' }
+      }
+    })
+    expect(rowProblems([blank])).toEqual([
+      'probe / selenium-devtools: a reason is required'
+    ])
+  })
+
+  it('rejects rule evidence naming a rule that does not exist', () => {
+    const unknown = feature({
+      cells: allCells(byRule(['no-such-rule' as RuleId]))
+    })
+    expect(rowProblems([unknown])).toContain(
+      'probe / devtools-service: unknown rule no-such-rule'
+    )
+  })
+
+  it('rejects rule evidence the adapter holds a known gap against', () => {
+    const gapped = feature({
+      cells: allCells(byRule([RULES.documentAnchored]))
+    })
+    const problems = rowProblems([gapped])
+    expect(problems).toContain(
+      'probe / selenium-devtools: every-document-anchored is a known gap (bidi: off)'
+    )
+    expect(problems.some((p) => p.startsWith('probe / devtools-service'))).toBe(
+      false
+    )
+  })
+
+  it('rejects a test path that does not exist and manual evidence without a reason', () => {
+    const row = feature({
+      cells: {
+        ...allCells(BY_HAND),
+        'devtools-service': byTest('packages/service/tests/no-such.test.ts'),
+        'selenium-devtools': {
+          support: 'supported',
+          evidence: { kind: 'manual', reason: ' ' }
+        }
+      }
+    })
+    expect(rowProblems([row])).toEqual([
+      'probe / devtools-service: test packages/service/tests/no-such.test.ts does not exist',
+      'probe / selenium-devtools: manual evidence needs the reason no test covers it'
+    ])
+  })
+
+  it("rejects a test outside the adapter's own and the shared packages' tests, and a directory", () => {
+    const row = feature({
+      cells: {
+        ...allCells(BY_HAND),
+        'devtools-service': byTest(
+          'packages/selenium-devtools/tests/session.test.ts'
+        ),
+        'selenium-devtools': byTest('packages/selenium-devtools/src/index.ts'),
+        'nightwatch-devtools': byTest(
+          'packages/nightwatch-devtools/tests/../../../package.json'
+        ),
+        'selenium-devtools-py': byTest('packages/core/tests/')
+      }
+    })
+    const problems = rowProblems([row])
+    expect(problems).toHaveLength(4)
+    expect(problems[0]).toContain('is outside packages/service/tests/')
+    expect(problems[1]).toContain(
+      'is outside packages/selenium-devtools/tests/'
+    )
+    expect(problems[2]).toContain(
+      'is outside packages/nightwatch-devtools/tests/'
+    )
+    expect(problems[3]).toBe(
+      'probe / selenium-devtools-py: test packages/core/tests/ is not a file'
+    )
+  })
+
+  it('reports malformed evidence instead of throwing', () => {
+    const row = feature({
+      cells: {
+        ...allCells(BY_HAND),
+        'devtools-service': { support: 'supported' } as Cell,
+        'selenium-devtools': {
+          support: 'supported',
+          evidence: { kind: 'tests', path: 'x' }
+        } as unknown as Cell,
+        'nightwatch-devtools': {
+          support: 'supported',
+          evidence: { kind: 'manual' }
+        } as unknown as Cell
+      }
+    })
+    expect(rowProblems([row])).toEqual([
+      'probe / devtools-service: supported without evidence',
+      'probe / selenium-devtools: evidence of unknown kind tests',
+      'probe / nightwatch-devtools: manual evidence needs the reason no test covers it'
+    ])
+  })
+
+  it('accepts a test file in the adapter tests or a shared package', () => {
+    const row = feature({
+      cells: allCells(byTest('packages/core/tests/trace-finalizer.test.ts'))
+    })
+    expect(rowProblems([row])).toEqual([])
+  })
+
+  it('rejects a missing adapter, a duplicate id and a row in no table', () => {
+    const { 'selenium-devtools-py': _python, ...three } = allCells(BY_HAND)
+    const missing = feature({ cells: three as Record<AdapterId, Cell> })
+    expect(rowProblems([missing, feature({ tables: [] })])).toEqual([
+      'probe: no cell for selenium-devtools-py',
+      'probe: declared twice',
+      'probe: appears in no table'
+    ])
+  })
+})
+
+describe('rule coverage', () => {
+  it('flags a rule that proves nothing and is not internal', () => {
+    expect(ruleCoverageProblems([feature()], {})).toContain(
+      `rule ${RULES.metadataFirst}: proves no feature and is not listed as internal`
+    )
+  })
+
+  it('flags an internal rule without a reason, or one that also proves a cell', () => {
+    const proven = feature({
+      cells: allCells(byRule([RULES.metadataFirst]))
+    })
+    const problems = ruleCoverageProblems([proven], {
+      ...INTERNAL_RULES,
+      [RULES.metadataFirst]: 'Internal.',
+      [RULES.failureRecorded]: ' '
+    })
+    expect(problems).toContain(
+      `rule ${RULES.metadataFirst}: listed as internal but proves a cell`
+    )
+    expect(problems).toContain(
+      `rule ${RULES.failureRecorded}: internal without a reason`
+    )
+  })
+})
+
+describe('option coverage', () => {
+  it('flags an option that names a feature nobody declared', () => {
+    expect(optionProblems([])).toContain(
+      'option shared.mode: names unknown feature trace-mode'
+    )
+  })
+
+  it('places every option of the declared source', () => {
+    expect(optionProblems(FEATURES)).toEqual([])
+  })
+})
+
+describe('renderTable', () => {
+  it('has a column for every adapter', () => {
+    const header = renderTable('cross-framework').split('\n')[0]
+    expect(header).toBe(
+      `| Feature | ${ADAPTER_COLUMNS.map((a) => a.title).join(' | ')} |`
+    )
+  })
+
+  it('marks conformance-tested cells, and explains both marks under every table', () => {
+    const proven = feature({
+      cells: allCells(byRule([RULES.failureRecorded]))
+    })
+    expect(renderTable('cross-framework', [proven])).toContain(
+      '| Probe | ✅ tested | ✅ tested | ✅ tested | ✅ tested |'
+    )
+    expect(renderTable('cross-framework', [feature()])).toContain(
+      `| Probe | ✅ | ✅ | ✅ | ✅ |\n\n${LEGEND}`
+    )
+  })
+
+  it('numbers each distinct reason once and lists it under the table', () => {
+    const rows = [
+      feature({
+        cells: {
+          ...allCells(BY_HAND),
+          'selenium-devtools': {
+            support: 'partial',
+            label: 'with BiDi',
+            reason: 'Same.'
+          },
+          'nightwatch-devtools': { support: 'partial', reason: 'Same.' },
+          'selenium-devtools-py': {
+            support: 'unsupported',
+            label: 'n/a',
+            reason: 'Other.'
+          }
+        }
+      })
+    ]
+    expect(renderTable('cross-framework', rows)).toBe(
+      [
+        '| Feature | WebdriverIO | Selenium | Nightwatch | Python |',
+        '|---|---|---|---|---|',
+        '| Probe | ✅ | ⚠️ with BiDi ¹ | ⚠️ ¹ | ❌ n/a ² |',
+        '',
+        LEGEND,
+        '',
+        '¹ Same.',
+        '',
+        '² Other.'
+      ].join('\n')
+    )
+  })
+
+  it('renders only the rows declared for that table', () => {
+    const mobile = renderTable('mobile')
+    const rows: readonly Feature[] = FEATURES
+    for (const row of rows) {
+      expect(mobile.includes(`| ${row.name} |`)).toBe(
+        row.tables.includes('mobile')
+      )
+    }
+  })
+
+  it('writes multi-digit footnote numbers', () => {
+    expect(superscript(12)).toBe('¹²')
+  })
+})
+
+describe('renderParity', () => {
+  it('lists each feature some adapter lacks, with its mark and reason, then the evidence counts', () => {
+    const rows = [
+      feature(),
+      feature({
+        id: 'gap',
+        name: 'Gap',
+        cells: {
+          ...allCells(byRule([RULES.failureRecorded])),
+          'nightwatch-devtools': {
+            support: 'partial',
+            label: 'opt-in',
+            reason: 'Why.'
+          }
+        }
+      })
+    ]
+    expect(renderParity(rows)).toBe(
+      [
+        'Features not supported by every adapter: 1 of 2',
+        '',
+        'gap: Gap',
+        '  Nightwatch: ⚠️ opt-in. Why.',
+        '',
+        'Cells: 3 conformance-tested, 0 unit-tested, 4 checked by hand, 1 partial or unsupported'
+      ].join('\n')
+    )
+  })
+})
+
+describe('replaceBlock', () => {
+  it('replaces only what sits between the markers', () => {
+    const page = [
+      'before',
+      '<!-- capability-matrix:mobile:start -->',
+      'stale',
+      '<!-- capability-matrix:mobile:end -->',
+      'after'
+    ].join('\n')
+    expect(replaceBlock(page, 'mobile')).toBe(
+      `before\n${renderBlock('mobile')}\nafter`
+    )
+  })
+
+  it('names the marker lines to insert when the page has none', () => {
+    expect(() => replaceBlock('no table here', 'mobile')).toThrow(
+      `insert the lines ${markerFor('mobile', 'start')} and ${markerFor('mobile', 'end')}`
+    )
+  })
+
+  it('refuses a duplicated block and a reversed pair, each with its own message', () => {
+    const block = `${markerFor('mobile', 'start')}\n${markerFor('mobile', 'end')}`
+    expect(() => replaceBlock(`${block}\n${block}`, 'mobile')).toThrow(
+      '2 start and 2 end markers'
+    )
+    expect(() =>
+      replaceBlock(
+        `${markerFor('mobile', 'end')}\n${markerFor('mobile', 'start')}`,
+        'mobile'
+      )
+    ).toThrow('comes before')
+  })
+})
+
+describe('docs:capabilities arguments', () => {
+  it('takes the website path in either form', () => {
+    expect(parseArgs(['--website', 'a']).websiteRoot).toBe(path.resolve('a'))
+    expect(parseArgs(['--website=a', '--check'])).toEqual({
+      check: true,
+      parity: false,
+      websiteRoot: path.resolve('a')
+    })
+    expect(parseArgs(['--parity']).parity).toBe(true)
+  })
+
+  it('rejects a flag or nothing as the website path', () => {
+    expect(() => parseArgs(['--website', '--check'])).toThrow('needs the path')
+    expect(() => parseArgs(['--website'])).toThrow('needs the path')
+    expect(() => parseArgs(['--website='])).toThrow('needs the path')
+  })
+})
+
+describe('syncTables', () => {
+  const tables: CapabilityTable[] = ['readme-trace', 'readme-mobile']
+  const blocks = tables
+    .map((t) => `${markerFor(t, 'start')}\nstale\n${markerFor(t, 'end')}`)
+    .join('\n')
+
+  it('writes a file once with all of its tables, and writes nothing when any target fails', () => {
+    const dir = mkdtempSync(path.join(tmpdir(), 'capabilities-'))
+    try {
+      const good = path.join(dir, 'good.md')
+      const bad = path.join(dir, 'bad.md')
+      writeFileSync(good, blocks)
+      writeFileSync(bad, 'no markers')
+      const targets = [
+        ...tables.map((table) => ({ table, file: good })),
+        { table: 'mobile' as const, file: bad }
+      ]
+      expect(() => syncTables(targets, false)).toThrow('bad.md')
+      expect(readFileSync(good, 'utf8')).toBe(blocks)
+
+      expect(syncTables(targets.slice(0, 2), false)).toEqual([good])
+      expect(readFileSync(good, 'utf8')).toBe(
+        tables.map((t) => renderBlock(t)).join('\n')
+      )
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it('reports a missing file before writing anything', () => {
+    expect(() =>
+      syncTables([{ table: 'mobile', file: '/nonexistent/page.md' }], true)
+    ).toThrow('not found')
+  })
+})
+
+describe('generated tables', () => {
+  it('every table has at least one row', () => {
+    for (const table of Object.keys(CAPABILITY_TABLES)) {
+      expect(FEATURES.some((f) => f.tables.includes(table as never))).toBe(true)
+    }
+  })
+
+  // Run `pnpm docs:capabilities` when this fails.
+  it('README.md matches the declared source', () => {
+    expect(syncTables(targetsFor(), true)).toEqual([])
+  })
+})
diff --git a/packages/conformance/tests/capability-python-options.test.ts b/packages/conformance/tests/capability-python-options.test.ts
new file mode 100644
index 00000000..b47c103e
--- /dev/null
+++ b/packages/conformance/tests/capability-python-options.test.ts
@@ -0,0 +1,80 @@
+import { spawnSync } from 'node:child_process'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+import { PYTHON_OPTIONS } from '../src/capability-options.js'
+import { REPO_ROOT } from '../src/constants.js'
+
+const PKG = path.join(
+  REPO_ROOT,
+  'packages/selenium-devtools-py/src/selenium_devtools'
+)
+const hasPython = spawnSync('python3', ['--version']).status === 0
+
+// Parsed with Python's own ast rather than imported, so the check needs no selenium install.
+const READ_OPTIONS = `
+import ast, json, sys
+init, plugin, constants = sys.argv[1:4]
+
+def tree(path):
+    return ast.parse(open(path).read())
+
+enable = next((n for n in ast.walk(tree(init))
+               if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef)) and n.name == "enable"), None)
+if enable is None:
+    sys.exit("enable() not found in " + init)
+a = enable.args
+names = [p.arg for p in a.posonlyargs + a.args + a.kwonlyargs]
+names += ["*" + a.vararg.arg] if a.vararg else []
+names += ["**" + a.kwarg.arg] if a.kwarg else []
+
+for call in ast.walk(tree(plugin)):
+    if not (isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute)):
+        continue
+    strings = [x.value for x in call.args if isinstance(x, ast.Constant) and isinstance(x.value, str)]
+    if call.func.attr == "addoption":
+        longs = [s for s in strings if s.startswith("--")]
+        names += longs or strings
+    elif call.func.attr == "addini" and strings:
+        names.append(strings[0])
+
+for node in tree(constants).body:
+    if (isinstance(node, ast.Assign) and isinstance(node.value, ast.Constant)
+            and isinstance(node.value.value, str) and node.value.value.startswith("DEVTOOLS_")
+            and any(isinstance(t, ast.Name) and t.id.startswith("ENV_") for t in node.targets)):
+        names.append(node.value.value)
+
+print(json.dumps(names))
+`
+
+function pythonOptions(): string[] {
+  const run = spawnSync(
+    'python3',
+    [
+      '-I',
+      '-c',
+      READ_OPTIONS,
+      path.join(PKG, '__init__.py'),
+      path.join(PKG, 'pytest_plugin.py'),
+      path.join(PKG, 'constants.py')
+    ],
+    { encoding: 'utf8' }
+  )
+  if (run.status !== 0) {
+    throw new Error(
+      `could not read the Python adapter's options: ${run.stderr}`
+    )
+  }
+  return JSON.parse(run.stdout) as string[]
+}
+
+describe('Python adapter options', () => {
+  it.skipIf(!hasPython)(
+    'maps every enable() keyword, pytest option and DEVTOOLS_* variable, and nothing else',
+    () => {
+      const found = [...new Set(pythonOptions())].sort()
+      expect(found.length).toBeGreaterThan(10)
+      expect(Object.keys(PYTHON_OPTIONS).sort()).toEqual(found)
+    }
+  )
+})
diff --git a/packages/nightwatch-devtools/src/constants.ts b/packages/nightwatch-devtools/src/constants.ts
index cd15390d..1dd985c5 100644
--- a/packages/nightwatch-devtools/src/constants.ts
+++ b/packages/nightwatch-devtools/src/constants.ts
@@ -73,6 +73,9 @@ export { SPINNER_RE } from '@wdio/devtools-core'
  *  truth — service uses the same pattern under the name SPEC_FILE_RE). */
 export { SPEC_FILE_RE as TEST_FILE_PATTERN } from '@wdio/devtools-shared'
 
+/** The CLI flags that name the config file, left out of the selection Run all replays (the backend passes its own). */
+export const NIGHTWATCH_CONFIG_FLAGS = ['--config', '-c']
+
 /** Nightwatch config file names to search for, in priority order. */
 export const CONFIG_FILENAMES = [
   'nightwatch.conf.cjs',
diff --git a/packages/nightwatch-devtools/src/helpers/utils.ts b/packages/nightwatch-devtools/src/helpers/utils.ts
index 05fdb2b0..d38ccf5f 100644
--- a/packages/nightwatch-devtools/src/helpers/utils.ts
+++ b/packages/nightwatch-devtools/src/helpers/utils.ts
@@ -7,7 +7,11 @@ import {
   isUserCodeFrame,
   normalizeFilePath
 } from '@wdio/devtools-core'
-import { TEST_FILE_PATTERN, CONFIG_FILENAMES } from '../constants.js'
+import {
+  TEST_FILE_PATTERN,
+  CONFIG_FILENAMES,
+  NIGHTWATCH_CONFIG_FLAGS
+} from '../constants.js'
 import type {
   NightwatchTestCase,
   TestFileMetadata,
@@ -52,8 +56,8 @@ export function incrementCounters(
 }
 
 /** This adapter's runner identity. Both Nightwatch runners take the same
- *  locator dialect, but the id also reaches the dashboard's run capabilities,
- *  where the cucumber variant differs. */
+ *  locator dialect, but the id also picks the dashboard's run controls from
+ *  shared's runner defaults, where the cucumber variant differs. */
 export function nightwatchRunnerId(isCucumberRunner: boolean): TestRunnerId {
   return isCucumberRunner ? 'nightwatch-cucumber' : 'nightwatch'
 }
@@ -65,13 +69,68 @@ export function buildPluginMetadataOptions(input: {
   return {
     framework: nightwatchRunnerId(input.isCucumberRunner),
     configFile: input.configPath,
-    baseDir: process.cwd(),
-    runCapabilities: {
-      canRunSuites: true,
-      canRunTests: !input.isCucumberRunner,
-      canRunAll: false
+    baseDir: process.cwd()
+  }
+}
+
+/** Whether this process is the Nightwatch CLI: its entry script sits in the `bin` folder of the `nightwatch` package. */
+export function isNightwatchCli(entry: string | undefined): boolean {
+  if (!entry) {
+    return false
+  }
+  try {
+    const script = fs.realpathSync(entry)
+    const pkgDir = path.dirname(path.dirname(script))
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8')
+    ) as { name?: unknown }
+    return (
+      path.basename(path.dirname(script)) === 'bin' && pkg.name === 'nightwatch'
+    )
+  } catch {
+    // No such file, or no readable package.json above it: not the Nightwatch CLI.
+    return false
+  }
+}
+
+/** The CLI's own selection (specs, --tag, --env, ...) without --config, specs made absolute since the backend spawns from the config's directory. */
+export function captureNightwatchSelection(
+  argv: string[] = process.argv,
+  cwd: string = process.cwd()
+): string[] | undefined {
+  if (!isNightwatchCli(argv[1])) {
+    return undefined
+  }
+  const spec = (arg: string) => {
+    const local = path.resolve(cwd, arg)
+    return fs.existsSync(local) ? local : arg
+  }
+  const args: string[] = []
+  const rest = argv.slice(2)
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i]
+    if (arg === '--') {
+      args.push(arg, ...rest.slice(i + 1).map(spec))
+      break
+    }
+    if (!arg.startsWith('-')) {
+      args.push(spec(arg))
+      continue
+    }
+    // Nightwatch parses argv with minimist and declares no boolean flags, so a flag takes the next bare word as its value.
+    const next = rest[i + 1]
+    const takesNext =
+      !arg.includes('=') &&
+      !arg.startsWith('--no-') &&
+      next !== undefined &&
+      !next.startsWith('-')
+    const value = takesNext ? rest[++i] : undefined
+    if (NIGHTWATCH_CONFIG_FLAGS.includes(arg.split('=')[0])) {
+      continue
     }
+    args.push(arg, ...(value === undefined ? [] : [value]))
   }
+  return args.length ? args : undefined
 }
 
 /**
diff --git a/packages/nightwatch-devtools/src/run-lifecycle.ts b/packages/nightwatch-devtools/src/run-lifecycle.ts
index f1383674..36fb823a 100644
--- a/packages/nightwatch-devtools/src/run-lifecycle.ts
+++ b/packages/nightwatch-devtools/src/run-lifecycle.ts
@@ -12,7 +12,7 @@ import * as os from 'node:os'
 import logger from '@wdio/logger'
 import { remote } from 'webdriverio'
 import { errorMessage } from '@wdio/devtools-core'
-import { REUSE_ENV } from '@wdio/devtools-shared'
+import { REUSE_ENV, RUNNER_ENV, encodeInitialArgs } from '@wdio/devtools-shared'
 import { start, stop } from '@wdio/devtools-backend'
 
 import type { SessionCapturer } from './session.js'
@@ -25,7 +25,11 @@ import type {
   NightwatchCurrentTest
 } from './types.js'
 import { TIMING, PLUGIN_GLOBAL_KEY } from './constants.js'
-import { findFreePort, resolveNightwatchConfig } from './helpers/utils.js'
+import {
+  captureNightwatchSelection,
+  findFreePort,
+  resolveNightwatchConfig
+} from './helpers/utils.js'
 
 const log = logger('@wdio/nightwatch-devtools:run-lifecycle')
 
@@ -102,6 +106,17 @@ export async function runPluginBefore(ctx: PluginBeforeCtx): Promise<void> {
         ctx.options.port,
         ctx.options.hostname
       )
+      // The backend runs in this process for the whole session, so a rerun child can never narrow it.
+      const selection = captureNightwatchSelection()
+      if (selection) {
+        process.env[RUNNER_ENV.NIGHTWATCH_INITIAL_ARGS] =
+          encodeInitialArgs(selection)
+      } else {
+        // An inherited value from the shell would otherwise scope Run all to someone else's selection.
+        delete process.env[RUNNER_ENV.NIGHTWATCH_INITIAL_ARGS]
+      }
+      // A relative path in a flag (`--test tests/a.js`) resolves against the launch directory, not the config's.
+      process.env[RUNNER_ENV.RUNNER_CWD] ??= process.cwd()
       log.info('🚀 Starting DevTools backend...')
       const { port } = await start(ctx.options)
       ctx.options.port = port
diff --git a/packages/nightwatch-devtools/tests/runLifecycle.test.ts b/packages/nightwatch-devtools/tests/runLifecycle.test.ts
index 684974e9..d7825cbb 100644
--- a/packages/nightwatch-devtools/tests/runLifecycle.test.ts
+++ b/packages/nightwatch-devtools/tests/runLifecycle.test.ts
@@ -1,9 +1,14 @@
 import * as fs from 'node:fs'
+import * as os from 'node:os'
+import * as path from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { remote } from 'webdriverio'
 
+import { start } from '@wdio/devtools-backend'
 import {
   openDevtoolsBrowser,
+  runPluginBefore,
+  type PluginBeforeCtx,
   type RunLifecycleCtx
 } from '../src/run-lifecycle.js'
 
@@ -63,3 +68,79 @@ describe('openDevtoolsBrowser', () => {
     expect(ctx.devtoolsBrowser).toBeUndefined()
   })
 })
+
+// Regression: Run all ran every spec in the config, because the backend never learned what the run selected.
+describe('runPluginBefore', () => {
+  const argv = [...process.argv]
+  const env = { ...process.env }
+  const pkg = path.join(
+    fs.mkdtempSync(path.join(os.tmpdir(), 'nw-cli-')),
+    'nightwatch'
+  )
+  fs.mkdirSync(path.join(pkg, 'bin'), { recursive: true })
+  fs.writeFileSync(path.join(pkg, 'package.json'), '{"name":"nightwatch"}')
+  fs.writeFileSync(path.join(pkg, 'bin', 'nightwatch'), '')
+  const nightwatchBin = path.join(pkg, 'bin', 'nightwatch')
+
+  afterEach(() => {
+    process.argv = [...argv]
+    process.env = { ...env }
+  })
+
+  const ctx = () =>
+    ({
+      options: { hostname: 'localhost', port: 39417, mode: 'live' },
+      setConfigPath: vi.fn(),
+      openDevtoolsBrowserAt: vi.fn(async () => {}),
+      handleReuse: vi.fn(),
+      plugin: {}
+    }) as unknown as PluginBeforeCtx
+
+  it('hands the backend the selection the Nightwatch CLI was launched with', async () => {
+    delete process.env.DEVTOOLS_APP_REUSE
+    delete process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS
+    process.argv = ['/usr/bin/node', nightwatchBin, '--tag', 'smoke']
+    // Stops the run at start(), which comes after the selection is stamped.
+    vi.mocked(start).mockRejectedValueOnce(new Error('stop here'))
+    await expect(runPluginBefore(ctx())).rejects.toThrow('stop here')
+    expect(
+      JSON.parse(process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS ?? '[]')
+    ).toEqual(['--tag', 'smoke'])
+  })
+
+  // Regression: a bare run kept an inherited selection, so Run all replayed someone else's specs.
+  it('clears an inherited selection when this run selects nothing', async () => {
+    delete process.env.DEVTOOLS_APP_REUSE
+    process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS = '["/old/tests/login.js"]'
+    process.argv = ['/usr/bin/node', nightwatchBin, '--config', 'nw.conf.js']
+    vi.mocked(start).mockRejectedValueOnce(new Error('stop here'))
+    await expect(runPluginBefore(ctx())).rejects.toThrow('stop here')
+    expect(process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS).toBeUndefined()
+  })
+
+  // Regression: Run all spawned from the config's folder, so `--test tests/a.js` resolved against the wrong directory.
+  it('records the launch directory for Run all, keeping one the user set', async () => {
+    delete process.env.DEVTOOLS_APP_REUSE
+    delete process.env.DEVTOOLS_RUNNER_CWD
+    process.argv = ['/usr/bin/node', nightwatchBin, '--test', 'tests/a.js']
+    vi.mocked(start).mockRejectedValueOnce(new Error('stop here'))
+    await expect(runPluginBefore(ctx())).rejects.toThrow('stop here')
+    expect(process.env.DEVTOOLS_RUNNER_CWD).toBe(process.cwd())
+
+    process.env.DEVTOOLS_RUNNER_CWD = '/chosen/dir'
+    vi.mocked(start).mockRejectedValueOnce(new Error('stop here'))
+    await expect(runPluginBefore(ctx())).rejects.toThrow('stop here')
+    expect(process.env.DEVTOOLS_RUNNER_CWD).toBe('/chosen/dir')
+    delete process.env.DEVTOOLS_RUNNER_CWD
+  })
+
+  it('leaves the selection to the run that started the backend when it is a rerun', async () => {
+    process.env.DEVTOOLS_APP_REUSE = '1'
+    process.env.DEVTOOLS_APP_HOST = 'localhost'
+    process.env.DEVTOOLS_APP_PORT = '3000'
+    delete process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS
+    process.argv = ['/usr/bin/node', nightwatchBin, '--testcase', 'one test']
+    await runPluginBefore(ctx())
+    expect(process.env.DEVTOOLS_NIGHTWATCH_INITIAL_ARGS).toBeUndefined()
+  })
+})
diff --git a/packages/nightwatch-devtools/tests/utils.test.ts b/packages/nightwatch-devtools/tests/utils.test.ts
index a90c17cf..abd5db2b 100644
--- a/packages/nightwatch-devtools/tests/utils.test.ts
+++ b/packages/nightwatch-devtools/tests/utils.test.ts
@@ -13,6 +13,8 @@ import {
   generateStableUid,
   getTestIcon,
   incrementCounters,
+  captureNightwatchSelection,
+  isNightwatchCli,
   parseCucumberScenario,
   resolveNightwatchConfig
 } from '../src/helpers/utils.js'
@@ -110,35 +112,83 @@ describe('nightwatchRunnerId', () => {
 })
 
 describe('buildPluginMetadataOptions', () => {
-  it('marks nightwatch + cucumber + canRunTests=false', () => {
-    expect(
-      buildPluginMetadataOptions({ isCucumberRunner: true, configPath: '/x' })
-    ).toMatchObject({
+  // The run controls come from shared's runner defaults, so the adapter declares none of its own.
+  it('names the runner and declares no run controls of its own', () => {
+    const cucumber = buildPluginMetadataOptions({
+      isCucumberRunner: true,
+      configPath: '/x'
+    })
+    expect(cucumber).toMatchObject({
       framework: 'nightwatch-cucumber',
-      configFile: '/x',
-      runCapabilities: {
-        canRunSuites: true,
-        canRunTests: false,
-        canRunAll: false
-      }
+      configFile: '/x'
     })
-  })
-
-  it('marks plain nightwatch + canRunTests=true', () => {
+    expect(cucumber).not.toHaveProperty('runCapabilities')
     expect(
       buildPluginMetadataOptions({
         isCucumberRunner: false,
         configPath: undefined
-      })
-    ).toMatchObject({
-      framework: 'nightwatch',
-      configFile: undefined,
-      runCapabilities: {
-        canRunSuites: true,
-        canRunTests: true,
-        canRunAll: false
-      }
-    })
+      }).framework
+    ).toBe('nightwatch')
+  })
+})
+
+describe('captureNightwatchSelection', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nw-args-'))
+  fs.mkdirSync(path.join(dir, 'tests'), { recursive: true })
+  fs.writeFileSync(path.join(dir, 'tests', 'login.js'), '')
+  // A folder named like a flag value, which must not be rewritten into a path.
+  fs.mkdirSync(path.join(dir, 'smoke'))
+  const pkg = path.join(dir, 'node_modules', 'nightwatch')
+  fs.mkdirSync(path.join(pkg, 'bin'), { recursive: true })
+  fs.writeFileSync(path.join(pkg, 'package.json'), '{"name":"nightwatch"}')
+  fs.writeFileSync(path.join(pkg, 'bin', 'nightwatch'), '')
+  const cli = ['/usr/bin/node', path.join(pkg, 'bin', 'nightwatch')]
+
+  it('keeps the selection without --config, with spec paths made absolute', () => {
+    expect(
+      captureNightwatchSelection(
+        [...cli, '-c', 'nw.conf.js', 'tests/login.js', '--env', 'chrome'],
+        dir
+      )
+    ).toEqual([path.join(dir, 'tests', 'login.js'), '--env', 'chrome'])
+    expect(
+      captureNightwatchSelection(
+        [...cli, '--config=nw.conf.js', '--group', 'login'],
+        dir
+      )
+    ).toEqual(['--group', 'login'])
+  })
+
+  // Regression: a flag value naming a local folder was replayed as an absolute path and matched no tests.
+  it('never rewrites a flag value, even one that names a local folder', () => {
+    expect(captureNightwatchSelection([...cli, '--tag', 'smoke'], dir)).toEqual(
+      ['--tag', 'smoke']
+    )
+    expect(
+      captureNightwatchSelection([...cli, '--tag=smoke', 'smoke'], dir)
+    ).toEqual(['--tag=smoke', path.join(dir, 'smoke')])
+  })
+
+  it('selects nothing for a bare run', () => {
+    expect(
+      captureNightwatchSelection([...cli, '--config', 'nw.conf.js'], dir)
+    ).toBeUndefined()
+  })
+
+  // Regression: any entry script with "nightwatch" in its path was taken for the CLI, so a wrapper's own flags were replayed.
+  it('recognises the CLI by its package, not by a path that mentions it', () => {
+    const wrapper = path.join(dir, 'nightwatch-e2e', 'run.js')
+    fs.mkdirSync(path.dirname(wrapper), { recursive: true })
+    fs.writeFileSync(wrapper, '')
+    expect(isNightwatchCli(cli[1])).toBe(true)
+    expect(isNightwatchCli(wrapper)).toBe(false)
+    expect(isNightwatchCli(undefined)).toBe(false)
+    expect(
+      captureNightwatchSelection(
+        ['/usr/bin/node', wrapper, '--retries', '2'],
+        dir
+      )
+    ).toBeUndefined()
   })
 })
 
diff --git a/packages/selenium-devtools/src/helpers/launch-command.ts b/packages/selenium-devtools/src/helpers/launch-command.ts
new file mode 100644
index 00000000..3e41d836
--- /dev/null
+++ b/packages/selenium-devtools/src/helpers/launch-command.ts
@@ -0,0 +1,46 @@
+import { REUSE_ENV } from '@wdio/devtools-shared'
+
+/** Single-quote for `sh -c`; embedded single-quotes get the `'\''` dance. */
+export function shellQuote(s: string): string {
+  if (s === '') {
+    return "''"
+  }
+  if (/^[a-zA-Z0-9_\-./=:@]+$/.test(s)) {
+    return s
+  }
+  return `'${s.replace(/'/g, "'\\''")}'`
+}
+
+/** The command that reruns this whole process: the npm script it was started by, else its own argv. */
+export function captureLaunchCommand(): string {
+  // `npx`/`pnpm exec` report themselves as `npm_command=exec` (npx also sets the event to `npx`): there is no script to rerun.
+  const npmScript =
+    process.env.npm_command === 'exec'
+      ? undefined
+      : process.env.npm_lifecycle_event
+  const npmConfigUserAgent = process.env.npm_config_user_agent ?? ''
+  if (npmScript) {
+    const tool = npmConfigUserAgent.startsWith('pnpm')
+      ? 'pnpm'
+      : npmConfigUserAgent.startsWith('yarn')
+        ? 'yarn'
+        : 'npm'
+    return tool === 'npm' ? `npm run ${npmScript}` : `${tool} ${npmScript}`
+  }
+  return [process.argv0, ...process.argv.slice(1)].map(shellQuote).join(' ')
+}
+
+// A rerun's process was launched with a narrowed selection, so Run all cannot be derived from its own arguments.
+function inheritedLaunchCommand(env: NodeJS.ProcessEnv): string | undefined {
+  if (env[REUSE_ENV.REUSE] !== '1') {
+    return undefined
+  }
+  return env[REUSE_ENV.LAUNCH_COMMAND] || undefined
+}
+
+/** A rerun's inherited Run-all command, read only while the reuse handshake is live, else this process's own. */
+export function resolveLaunchCommand(
+  env: NodeJS.ProcessEnv = process.env
+): string {
+  return inheritedLaunchCommand(env) ?? captureLaunchCommand()
+}
diff --git a/packages/selenium-devtools/src/helpers/utils.ts b/packages/selenium-devtools/src/helpers/utils.ts
index 88d0961b..62950c7e 100644
--- a/packages/selenium-devtools/src/helpers/utils.ts
+++ b/packages/selenium-devtools/src/helpers/utils.ts
@@ -30,17 +30,3 @@ export { isPortInUse, findFreePort } from '@wdio/devtools-core'
  */
 /** Derive a human-readable request type from URL and MIME type. */
 export { getRequestType } from '@wdio/devtools-core'
-
-export function captureLaunchCommand(): string {
-  const npmScript = process.env.npm_lifecycle_event
-  const npmConfigUserAgent = process.env.npm_config_user_agent ?? ''
-  if (npmScript) {
-    const tool = npmConfigUserAgent.startsWith('pnpm')
-      ? 'pnpm'
-      : npmConfigUserAgent.startsWith('yarn')
-        ? 'yarn'
-        : 'npm'
-    return tool === 'npm' ? `npm run ${npmScript}` : `${tool} ${npmScript}`
-  }
-  return [process.argv0, ...process.argv.slice(1)].join(' ')
-}
diff --git a/packages/selenium-devtools/src/rerunManager.ts b/packages/selenium-devtools/src/rerunManager.ts
index 3dc9d175..4af3c773 100644
--- a/packages/selenium-devtools/src/rerunManager.ts
+++ b/packages/selenium-devtools/src/rerunManager.ts
@@ -1,4 +1,4 @@
-import { captureLaunchCommand } from './helpers/utils.js'
+import { resolveLaunchCommand, shellQuote } from './helpers/launch-command.js'
 
 // Per-runner CLI flag for filtering by test/scenario name.
 const FILTER_FLAGS: Record<string, string> = {
@@ -27,7 +27,7 @@ export class RerunManager {
    *  flag the template replays — not `Metadata.runner`, which names the
    *  adapter. */
   constructor(detectedRunner: string) {
-    this.#launchCommand = captureLaunchCommand()
+    this.#launchCommand = resolveLaunchCommand()
     this.#detectedRunner = detectedRunner
   }
 
@@ -48,7 +48,7 @@ export class RerunManager {
       process.argv0,
       ...process.argv.slice(1)
     ])
-    const quoted = argv.map((a) => this.#shellQuote(a)).join(' ')
+    const quoted = argv.map(shellQuote).join(' ')
     return `${quoted} ${flag} "{{testName}}"`
   }
 
@@ -75,15 +75,4 @@ export class RerunManager {
   get launchCommand() {
     return this.#launchCommand
   }
-
-  /** Single-quote for `sh -c`; embedded single-quotes get the `'\''` dance. */
-  #shellQuote(s: string): string {
-    if (s === '') {
-      return "''"
-    }
-    if (/^[a-zA-Z0-9_\-./=:@]+$/.test(s)) {
-      return s
-    }
-    return `'${s.replace(/'/g, "'\\''")}'`
-  }
 }
diff --git a/packages/selenium-devtools/src/types.ts b/packages/selenium-devtools/src/types.ts
index 7de5b1de..8119241c 100644
--- a/packages/selenium-devtools/src/types.ts
+++ b/packages/selenium-devtools/src/types.ts
@@ -33,7 +33,7 @@ export interface DevToolsOptions extends BaseDevToolsOptions {
   /** Command template for per-test rerun. {{testName}} is substituted. */
   rerunCommand?: string
   /**
-   * Force the *test* browser into headless mode by injecting --headless=new
+   * Force the *test* browser into headless mode by injecting --headless=old
    * into Chrome capabilities. The dashboard window (auto-opened by openUi)
    * is unaffected. Defaults to false to preserve user-supplied options.
    */
diff --git a/packages/selenium-devtools/tests/index.test.ts b/packages/selenium-devtools/tests/index.test.ts
index d14ccc14..45425fe1 100644
--- a/packages/selenium-devtools/tests/index.test.ts
+++ b/packages/selenium-devtools/tests/index.test.ts
@@ -21,9 +21,9 @@ import {
   findTestLineInFile,
   isPortInUse,
   findFreePort,
-  getRequestType,
-  captureLaunchCommand
+  getRequestType
 } from '../src/helpers/utils.js'
+import { captureLaunchCommand } from '../src/helpers/launch-command.js'
 import { SessionCapturer } from '../src/session.js'
 import {
   patchSelenium,
@@ -178,6 +178,7 @@ describe('helpers/utils', () => {
   it('captureLaunchCommand prefers npm/yarn/pnpm scripts, falls back to argv', () => {
     const env = { ...process.env }
     try {
+      delete process.env.npm_command
       process.env.npm_lifecycle_event = 'test'
       process.env.npm_config_user_agent = 'npm/10.0.0'
       expect(captureLaunchCommand()).toBe('npm run test')
@@ -194,6 +195,40 @@ describe('helpers/utils', () => {
       process.env = env
     }
   })
+
+  // Regression: the argv fallback joined arguments with spaces, so a spec path or --grep with a space split apart on Run all.
+  it('captureLaunchCommand quotes each argument of the argv fallback', () => {
+    const env = { ...process.env }
+    const argv = process.argv
+    try {
+      process.env.npm_command = 'exec'
+      process.argv = [argv[0], '/x/mocha', 'specs/my login.js', '--grep', 'a b']
+      expect(captureLaunchCommand()).toBe(
+        `${process.argv0} /x/mocha 'specs/my login.js' --grep 'a b'`
+      )
+    } finally {
+      process.env = env
+      process.argv = argv
+    }
+  })
+
+  // Regression: under `npx mocha` npm sets npm_lifecycle_event=npx, which was published as `npm run npx`.
+  it('captureLaunchCommand replays argv under npx and pnpm exec, which run no script', () => {
+    const env = { ...process.env }
+    try {
+      process.env.npm_command = 'exec'
+      process.env.npm_lifecycle_event = 'npx'
+      process.env.npm_config_user_agent = 'npm/11.0.0'
+      expect(captureLaunchCommand()).not.toContain('npm run')
+      expect(captureLaunchCommand()).toContain(process.argv0)
+
+      delete process.env.npm_lifecycle_event
+      process.env.npm_config_user_agent = 'pnpm/10.0.0'
+      expect(captureLaunchCommand()).toContain(process.argv0)
+    } finally {
+      process.env = env
+    }
+  })
 })
 
 // ───── SessionCapturer ──────────────────────────────────────────────────────
@@ -798,6 +833,7 @@ describe('RerunManager', () => {
   })
 
   it('launchCommand surfaces the npm script the user ran', () => {
+    delete process.env.npm_command
     process.env.npm_lifecycle_event = 'example:mocha'
     process.env.npm_config_user_agent = 'npm/10.0.0'
     expect(new RerunManager('mocha').launchCommand).toBe(
@@ -805,6 +841,19 @@ describe('RerunManager', () => {
     )
   })
 
+  // Regression: a rerun child derived Run all from its own narrowed argv, so Run all replayed the rerun's filter.
+  it('launchCommand inherits the Run-all command a rerun was spawned with', () => {
+    process.argv = ['node', 'mocha', 'spec.js', '--grep', 'one test']
+    process.env.DEVTOOLS_APP_REUSE = '1'
+    process.env.DEVTOOLS_RERUN_LAUNCH_COMMAND = 'npx mocha spec.js'
+    expect(new RerunManager('mocha').launchCommand).toBe('npx mocha spec.js')
+
+    delete process.env.DEVTOOLS_APP_REUSE
+    expect(new RerunManager('mocha').launchCommand).not.toBe(
+      'npx mocha spec.js'
+    )
+  })
+
   it('rerunTemplate uses the correct filter flag per runner and returns undefined for unknown ones', () => {
     process.argv = ['node', '/path/to/test.js']
     expect(new RerunManager('mocha').rerunTemplate).toContain(
diff --git a/packages/service/src/index.ts b/packages/service/src/index.ts
index 38b9c7d5..be144568 100644
--- a/packages/service/src/index.ts
+++ b/packages/service/src/index.ts
@@ -433,7 +433,7 @@ export default class DevToolsHookService implements Services.ServiceInstance {
   }
 
   // Tag the scenario's commands with a stable per-step uid so the trace nests
-  // them under the step (Feature→Scenario→Step). The uid combines the scenario
+  // them under the step (Scenario→Step; no feature ancestry is recorded). The uid combines the scenario
   // uid with a per-scenario counter, so repeated step text can't collide.
   beforeStep(step?: { text?: string; keyword?: string }) {
     if (!this.#currentTestUid) {
diff --git a/packages/shared/src/run-capabilities.ts b/packages/shared/src/run-capabilities.ts
index dcdae877..c65a70e0 100644
--- a/packages/shared/src/run-capabilities.ts
+++ b/packages/shared/src/run-capabilities.ts
@@ -7,15 +7,17 @@ export const DEFAULT_CAPABILITIES: RunCapabilities = {
   canRunAll: true
 }
 
-/** Per-runner defaults, keyed by the lower-cased runner id, for adapters that declare nothing. */
+// A Gherkin step has no CLI filter of its own, so a Cucumber runner reruns scenarios and features only.
+const CUCUMBER_CAPABILITIES: RunCapabilities = {
+  canRunSuites: true,
+  canRunTests: false,
+  canRunAll: true
+}
+
+/** Per-runner defaults where they differ from DEFAULT_CAPABILITIES, keyed by the lower-cased runner id. */
 export const FRAMEWORK_CAPABILITIES: Record<string, RunCapabilities> = {
-  cucumber: { canRunSuites: true, canRunTests: false, canRunAll: true },
-  'nightwatch-cucumber': {
-    canRunSuites: true,
-    canRunTests: false,
-    canRunAll: false
-  },
-  nightwatch: { canRunSuites: true, canRunTests: true, canRunAll: false }
+  cucumber: CUCUMBER_CAPABILITIES,
+  'nightwatch-cucumber': CUCUMBER_CAPABILITIES
 }
 
 const runnerOptionsOf = (metadata: Metadata | undefined) =>
diff --git a/packages/shared/src/runner.ts b/packages/shared/src/runner.ts
index 822725ce..2b11feb9 100644
--- a/packages/shared/src/runner.ts
+++ b/packages/shared/src/runner.ts
@@ -45,11 +45,36 @@ export const RUNNER_ENV = {
   WDIO_CONFIG: 'DEVTOOLS_WDIO_CONFIG',
   NIGHTWATCH_CONFIG: 'DEVTOOLS_NIGHTWATCH_CONFIG',
   WDIO_INITIAL_SPECS: 'DEVTOOLS_WDIO_INITIAL_SPECS',
+  // The selection the Nightwatch run was launched with (specs, --tag, --env, ...), without --config; see encodeInitialArgs.
+  NIGHTWATCH_INITIAL_ARGS: 'DEVTOOLS_NIGHTWATCH_INITIAL_ARGS',
   RUNNER_CWD: 'DEVTOOLS_RUNNER_CWD',
   WDIO_BIN: 'DEVTOOLS_WDIO_BIN',
   NIGHTWATCH_BIN: 'DEVTOOLS_NIGHTWATCH_BIN'
 } as const
 
+/** The value of `RUNNER_ENV.NIGHTWATCH_INITIAL_ARGS`: a JSON array of strings. */
+export function encodeInitialArgs(args: readonly string[]): string {
+  return JSON.stringify(args)
+}
+
+/** The arguments `encodeInitialArgs` wrote, or undefined for an absent or malformed value. */
+export function parseInitialArgs(
+  raw: string | undefined
+): string[] | undefined {
+  if (!raw) {
+    return undefined
+  }
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    return undefined
+  }
+  return Array.isArray(parsed) && parsed.every((a) => typeof a === 'string')
+    ? parsed
+    : undefined
+}
+
 /**
  * Slots an adapter leaves in its `rerunCommand`, which the backend fills in
  * when the dashboard reruns one entry. The two differ in what they select by,
diff --git a/packages/shared/tests/initial-args.test.ts b/packages/shared/tests/initial-args.test.ts
new file mode 100644
index 00000000..211ef63e
--- /dev/null
+++ b/packages/shared/tests/initial-args.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { encodeInitialArgs, parseInitialArgs } from '../src/runner.js'
+
+describe('initial args', () => {
+  it('round-trips a selection, spaces and all', () => {
+    const args = ['/abs/tests/my login.js', '--tag', 'smoke']
+    expect(parseInitialArgs(encodeInitialArgs(args))).toEqual(args)
+  })
+
+  it('reads an absent, malformed or non-string-array value as no selection', () => {
+    expect(parseInitialArgs(undefined)).toBeUndefined()
+    expect(parseInitialArgs('')).toBeUndefined()
+    expect(parseInitialArgs('{not json')).toBeUndefined()
+    expect(parseInitialArgs('["a", 1]')).toBeUndefined()
+    expect(parseInitialArgs('"a"')).toBeUndefined()
+  })
+})
diff --git a/packages/shared/tests/run-capabilities.test.ts b/packages/shared/tests/run-capabilities.test.ts
index 19219cce..c3ef1c45 100644
--- a/packages/shared/tests/run-capabilities.test.ts
+++ b/packages/shared/tests/run-capabilities.test.ts
@@ -37,8 +37,10 @@ describe('resolveRunCapabilities', () => {
 
   it("falls back to the runner's defaults, whatever the case of its id", () => {
     expect(
-      resolveRunCapabilities(metadata({ options: { framework: 'Nightwatch' } }))
-    ).toEqual(FRAMEWORK_CAPABILITIES.nightwatch)
+      resolveRunCapabilities(
+        metadata({ options: { framework: 'Nightwatch-Cucumber' } })
+      )
+    ).toEqual(FRAMEWORK_CAPABILITIES['nightwatch-cucumber'])
   })
 
   it('falls back to the global defaults for an unlisted or unknown runner', () => {
diff --git a/tsconfig.json b/tsconfig.json
index 5f4bb283..f488b249 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -42,7 +42,8 @@
       "@wdio/devtools-service": ["./packages/service/src/index.ts"],
       "@wdio/devtools-service/*": ["./packages/service/src/*"],
       "@wdio/selenium-devtools": ["./packages/selenium-devtools/src/index.ts"],
-      "@wdio/selenium-devtools/*": ["./packages/selenium-devtools/src/*"]
+      "@wdio/selenium-devtools/*": ["./packages/selenium-devtools/src/*"],
+      "@wdio/nightwatch-devtools/*": ["./packages/nightwatch-devtools/src/*"]
     }
   },
   // This file is both the `extends` base for every package config and, run