diff --git a/docs/architecture/transport-and-protocol.md b/docs/architecture/transport-and-protocol.md
index af30e96..a3591c3 100644
--- a/docs/architecture/transport-and-protocol.md
+++ b/docs/architecture/transport-and-protocol.md
@@ -101,6 +101,8 @@ Three kinds of target get a session of their own:
 
 **Execution context IDs are numbered per session.** Two renderers will both hand out context 1, so the map from context to frame is keyed by session and context together. A frame's context ID is only meaningful on the session that owns that frame, and every call site pairs the two.
 
+**A frame's context ID is replaced on every navigation.** `Runtime.executionContextCreated` records the main world of the frame named in its `auxData` (an isolated world, with `isDefault: false`, never replaces it), `Runtime.executionContextDestroyed` drops the entry with that ID from the session that reported it, and `Runtime.executionContextsCleared` drops every entry that session reported. The three are read from one channel per session, so a navigation's teardown is always handled before the context that replaces it. They do not share a channel with `Page.loadEventFired`, so a navigation can complete while the old context is still recorded or before the new one is. Commands that name a context cover both cases. A frame with nothing recorded waits for its next context, bounded by the caller's timeout or 30 seconds, and fails at once with `MotusTargetClosedException` if the frame is detached or the page closes; the main frame instead leaves the ID out, which the browser resolves to the main frame's current main world. A command refused with "Cannot find context with specified id" is sent once more against whatever has been recorded since. The browser looks the context up before running anything, so the refused attempt never ran and the retry cannot run a script twice. BiDi has no counterpart: script there is addressed to a browsing context and runs in whatever realm it currently holds, so there is no ID to track or wait for.
+
 ### Routing a frame to its session
 
 `Page.SessionFor(IFrame?)` is the single lookup. A frame that owns a session is routed to it; every other frame, including a same-process child of an out-of-process frame, falls through to the page's own session. That fallback is what keeps every existing round trip byte-identical.
diff --git a/docs/guides/frames-and-iframes.md b/docs/guides/frames-and-iframes.md
index 1d4881b..9a3c831 100644
--- a/docs/guides/frames-and-iframes.md
+++ b/docs/guides/frames-and-iframes.md
@@ -90,7 +90,9 @@ if (frame.IsDetached)
 }
 ```
 
-`IsDetached` is how a removed frame is told apart from a selector that simply did not match. A held `IFrame` answers rather than failing obscurely several calls later.
+`IsDetached` is how a removed frame is told apart from a selector that simply did not match. A held `IFrame` answers rather than failing obscurely several calls later. Evaluating, reading content or resolving a locator through a detached frame throws `MotusTargetClosedException` straight away, and so does a call that was already waiting on the frame when it went.
+
+An evaluation, a locator or a content read issued the moment a frame finishes navigating runs in the new document. A frame's main world is replaced on every navigation and the browser reports the new one separately from the end of the navigation, so for a frame other than the main frame such a call waits for the new world to be reported, for up to 30 seconds or the call's own timeout, rather than running against the old document or in the main frame by mistake.
 
 ---
 
@@ -159,7 +161,7 @@ Each of these costs real time to rediscover.
 
 **The endpoint's target list is not a list of a page's frames.** `http://127.0.0.1:9222/json/list` reports one entry per CDP target, and only a frame the browser put in its own process has a target of its own. So the list shows those, typed `iframe` rather than `page`, and shows nothing at all for every frame the page's own renderer hosts. A document with two frames, one cross-origin and one `srcdoc`, produces exactly one `iframe` entry. Counting entries there will undercount the frames on the page, and filtering for `page` entries will miss all of them. Motus builds `page.Frames` from auto-attach and the frame tree instead, which covers both kinds, so read frames from there and treat the target list as a view of processes rather than of documents.
 
-**A frame changing process is not a frame going away, but a frame whose parent navigated is.** The browser announces a frame moved into another renderer process as a detach carrying the reason `swap`, and says the same for a document it puts into the back-forward cache. Motus tells both apart from a real removal: the frame stays in `page.Frames`, `IsDetached` stays false, no `FrameDetached` arrives, and the `IFrame` being held keeps working across the move. Navigation is the other case. Committing a new document in a frame drops the frames that frame hosted, because the new document reports its own, so a child frame is rediscovered after its parent navigates and comes back as a different `IFrame`, even when it loads the same URL. What that leaves to watch for is the handle from before. It reports `IsDetached`, and checking that is worth the line, because a frame the page no longer lists has no execution context of its own to aim at and an evaluation through it falls back to the page's, quietly answering for the main document rather than failing. Read the frame from `page.Frames` again after a navigation and wait for it as under [Traversing](#traversing), since for a moment after the parent commits its new document the subtree is empty.
+**A frame changing process is not a frame going away, but a frame whose parent navigated is.** The browser announces a frame moved into another renderer process as a detach carrying the reason `swap`, and says the same for a document it puts into the back-forward cache. Motus tells both apart from a real removal: the frame stays in `page.Frames`, `IsDetached` stays false, no `FrameDetached` arrives, and the `IFrame` being held keeps working across the move. Navigation is the other case. Committing a new document in a frame drops the frames that frame hosted, because the new document reports its own, so a child frame is rediscovered after its parent navigates and comes back as a different `IFrame`, even when it loads the same URL. What that leaves to watch for is the handle from before. It reports `IsDetached`, and anything run through it throws `MotusTargetClosedException` rather than answering for some other document. Read the frame from `page.Frames` again after a navigation and wait for it as under [Traversing](#traversing), since for a moment after the parent commits its new document the subtree is empty.
 
 **Application globals are absent from isolated worlds.** An isolated world shares the frame's document and nothing else, so the DOM is fully present while everything the application put on `window` is not. An expression that reads a framework handle returns `undefined` there and the failure looks like the application not having loaded. Use `ExecutionWorld.Main`, which is the default, whenever you are reading application state.
 
diff --git a/src/Motus.Mcp/Snapshot/FrameCollector.cs b/src/Motus.Mcp/Snapshot/FrameCollector.cs
index fbc932d..f1134f9 100644
--- a/src/Motus.Mcp/Snapshot/FrameCollector.cs
+++ b/src/Motus.Mcp/Snapshot/FrameCollector.cs
@@ -32,6 +32,10 @@ internal static class FrameCollector
     private const string SelfIndexExpression =
         "(() => { const p = window.parent; for (let i = 0; i < p.length; i++) { if (p[i] === window) return i; } return -1; })()";
 
+    // How long the frames of one document get to say which of their parent's contexts they are.
+    // A frame with a document answers in milliseconds.
+    private static readonly TimeSpan SelfIndexAllowance = TimeSpan.FromSeconds(1);
+
     // Which child browsing context this element holds, asked of the document the element lives in.
     private const string HostIndexExpression =
         "el => { const w = el.ownerDocument.defaultView; for (let i = 0; i < w.length; i++) { if (w[i] === el.contentWindow) return i; } return -1; }";
@@ -182,24 +186,32 @@ void Walk(IFrame frame)
     /// Frames that cannot answer, and any index two frames both claim, are left out, so a reading
     /// that is not trustworthy falls through to the order the engine gives instead of guessing.
     /// </summary>
+    /// <remarks>
+    /// A frame that has not loaded a document yet, such as a lazy iframe still below the fold, has
+    /// no context to evaluate in, and an evaluation there waits for one until its own timeout. So
+    /// every frame is asked at once and the answers are read after <see cref="SelfIndexAllowance"/>
+    /// at most: a frame that cannot answer costs the snapshot that allowance once, rather than a
+    /// full evaluation timeout for each such frame.
+    /// </remarks>
     private static async Task<IReadOnlyDictionary<int, IFrame>> ByContextIndexAsync(
         IReadOnlyList<IFrame> children)
     {
         var byContext = new Dictionary<int, IFrame>();
         var duplicates = new HashSet<int>();
 
-        foreach (var child in children)
+        var asks = children.Select(AskSelfIndex).ToList();
+        await Task.WhenAny(Task.WhenAll(asks), Task.Delay(SelfIndexAllowance)).ConfigureAwait(false);
+
+        for (var i = 0; i < children.Count; i++)
         {
-            int position;
-            try
-            {
-                position = await child.EvaluateAsync<int>(SelfIndexExpression).ConfigureAwait(false);
-            }
-            catch (Exception)
-            {
+            var child = children[i];
+            var ask = asks[i];
+
+            // Still waiting, or failed: either way this frame can't say where it belongs.
+            if (!ask.IsCompletedSuccessfully)
                 continue;
-            }
 
+            var position = ask.Result;
             if (position < 0)
                 continue;
 
@@ -213,6 +225,19 @@ private static async Task<IReadOnlyDictionary<int, IFrame>> ByContextIndexAsync(
         return byContext;
     }
 
+    // Never faults, so an answer that arrives after the allowance has nobody left to observe it.
+    private static async Task<int> AskSelfIndex(IFrame child)
+    {
+        try
+        {
+            return await child.EvaluateAsync<int>(SelfIndexExpression).ConfigureAwait(false);
+        }
+        catch (Exception)
+        {
+            return -1;
+        }
+    }
+
     /// <summary>
     /// The backend node ids of the frame elements in a document, in document order.
     /// </summary>
diff --git a/src/Motus/Page/Page.Evaluation.cs b/src/Motus/Page/Page.Evaluation.cs
index eb9a07c..39c7a20 100644
--- a/src/Motus/Page/Page.Evaluation.cs
+++ b/src/Motus/Page/Page.Evaluation.cs
@@ -15,20 +15,27 @@ public async Task<T> EvaluateAsync<T>(string expression, object? arg = null)
 
     public async Task<IJSHandle> EvaluateHandleAsync(string expression, object? arg = null)
     {
-        var contextId = _mainFrameId is not null
-            ? GetExecutionContextId(_mainFrameId)
-            : null;
-
-        var result = await _session.SendAsync(
-            "Runtime.evaluate",
-            new RuntimeEvaluateParams(
-                Expression: WrapExpression(expression, arg),
-                ReturnByValue: false,
-                AwaitPromise: true,
-                ContextId: contextId),
-            CdpJsonContext.Default.RuntimeEvaluateParams,
-            CdpJsonContext.Default.RuntimeEvaluateResult,
-            CancellationToken.None).ConfigureAwait(false);
+        var wrapped = WrapExpression(expression, arg);
+
+        async Task<(IMotusSession Session, RuntimeEvaluateResult Result)> Evaluate(ExecutionTarget target)
+        {
+            var evaluated = await target.Session.SendAsync(
+                "Runtime.evaluate",
+                new RuntimeEvaluateParams(
+                    Expression: wrapped,
+                    ReturnByValue: false,
+                    AwaitPromise: true,
+                    ContextId: target.ContextId),
+                CdpJsonContext.Default.RuntimeEvaluateParams,
+                CdpJsonContext.Default.RuntimeEvaluateResult,
+                CancellationToken.None).ConfigureAwait(false);
+
+            return (target.Session, evaluated);
+        }
+
+        var (session, result) = _mainFrameId is not null
+            ? await RunInFrameAsync(_mainFrameId, Evaluate).ConfigureAwait(false)
+            : await Evaluate(new ExecutionTarget(_session, null)).ConfigureAwait(false);
 
         if (result.ExceptionDetails is not null)
             throw new InvalidOperationException(
@@ -38,7 +45,7 @@ public async Task<IJSHandle> EvaluateHandleAsync(string expression, object? arg
             throw new InvalidOperationException(
                 "Expression did not return an object. Use EvaluateAsync<T> for primitive values.");
 
-        return new JsHandle(_session, result.Result.ObjectId);
+        return new JsHandle(session, result.Result.ObjectId);
     }
 
     public async Task<T> WaitForFunctionAsync<T>(string expression, object? arg = null, double? timeout = null)
diff --git a/src/Motus/Page/Page.Events.cs b/src/Motus/Page/Page.Events.cs
index 8cd4f0b..1d39a85 100644
--- a/src/Motus/Page/Page.Events.cs
+++ b/src/Motus/Page/Page.Events.cs
@@ -97,10 +97,11 @@ internal void StartFrameStructureEventPump(IMotusSession session, CancellationTo
             CdpJsonContext.Default.PageFrameStoppedLoadingEvent,
             evt => FrameStoppedLoading?.Invoke(evt.FrameId), ct);
 
-        _ = PumpEventsAsync(session,
-            "Runtime.executionContextCreated",
-            CdpJsonContext.Default.RuntimeExecutionContextCreatedEvent,
-            OnExecutionContextCreated, ct);
+        // Contexts are made and torn down by the same navigations, so their events are read
+        // together for the same reason as the frame tree's. BiDi has no counterpart to listen for
+        // (see PumpExecutionContextEventsAsync).
+        if (session is not BiDiSession)
+            _ = PumpExecutionContextEventsAsync(session, ct);
 
         _ = PumpEventsAsync(session,
             "Runtime.consoleAPICalled",
@@ -291,6 +292,10 @@ private void DetachFrame(string frameId)
             return;
 
         frame.MarkDetached();
+
+        // Anyone waiting for this frame's next context would otherwise wait out the clock.
+        SignalExecutionContextWaiters(frameId);
+
         FrameDetached?.Invoke(this, frame);
     }
 
@@ -310,34 +315,6 @@ private void RecordFrameOwnership(string frameId, IMotusSession source, bool isP
             _frameIdToSession[frameId] = source;
     }
 
-    private void OnExecutionContextCreated(RuntimeExecutionContextCreatedEvent evt)
-    {
-        var ctx = evt.Context;
-
-        // Extract frameId from auxData if present
-        string? frameId = null;
-        var isDefaultWorld = true;
-        if (ctx.AuxData is JsonElement aux && aux.ValueKind == JsonValueKind.Object)
-        {
-            if (aux.TryGetProperty("frameId", out var fid))
-                frameId = fid.GetString();
-
-            // A frame has one main world and any number of others beside it. Only the main world
-            // is the frame's context: an isolated world reports the same frame id, and recording
-            // it here would send every later main-world evaluation into the isolated world, where
-            // the page's own globals do not exist. That failure is silent, so it is guarded at the
-            // one place contexts are recorded rather than at each reader.
-            if (aux.TryGetProperty("isDefault", out var isDefault)
-                && isDefault.ValueKind is JsonValueKind.False)
-            {
-                isDefaultWorld = false;
-            }
-        }
-
-        if (frameId is not null && isDefaultWorld)
-            _frameIdToExecutionContext[frameId] = ctx.Id;
-    }
-
     private void OnConsoleApiCalled(RuntimeConsoleApiCalledEvent evt)
     {
         var text = string.Join(" ", evt.Args.Select(a =>
diff --git a/src/Motus/Page/Page.ExecutionContexts.cs b/src/Motus/Page/Page.ExecutionContexts.cs
new file mode 100644
index 0000000..2fc929c
--- /dev/null
+++ b/src/Motus/Page/Page.ExecutionContexts.cs
@@ -0,0 +1,396 @@
+using System.Collections.Concurrent;
+using System.Text.Json;
+using Motus.Abstractions;
+
+namespace Motus;
+
+/// <summary>
+/// The execution context each frame's main world currently runs in, and what a caller does when a
+/// frame has none yet.
+/// </summary>
+internal sealed partial class Page
+{
+    /// <summary>
+    /// How long a command waits for a frame to report its next main world when the caller gives no
+    /// shorter bound of its own. The same default every other wait in Motus uses.
+    /// </summary>
+    private static readonly TimeSpan ExecutionContextWaitTimeout = TimeSpan.FromMilliseconds(30_000);
+
+    /// <summary>
+    /// The text the browser answers with when a command names an execution context that no longer
+    /// exists.
+    /// </summary>
+    private const string StaleContextMessage = "Cannot find context with specified id";
+
+    /// <summary>
+    /// A frame's main world: its context id, and the session that reported it.
+    /// </summary>
+    /// <remarks>
+    /// A context id is numbered by the renderer that owns it, so two sessions can report the same
+    /// number for two different worlds, and an id means nothing on any session but its own. Keeping
+    /// the session alongside the id is what lets a late notice from one session leave alone a
+    /// context another session has since reported for the same frame.
+    /// </remarks>
+    private readonly record struct FrameExecutionContext(int Id, IMotusSession Session);
+
+    /// <summary>
+    /// Where a command about a frame is sent: the session, and the context to name, or null for the
+    /// session's default, which is the main world of the frame at that session's root.
+    /// </summary>
+    internal readonly record struct ExecutionTarget(IMotusSession Session, int? ContextId);
+
+    private readonly ConcurrentDictionary<string, FrameExecutionContext> _frameIdToExecutionContext = new();
+
+    // Callers waiting for a frame to report its next main world. One completion per frame, shared by
+    // every caller waiting on that frame and replaced once it fires, so it says only that something
+    // changed and each caller looks again. It fires when a context is recorded for the frame and when
+    // the frame goes away, so nobody waits out the clock on a frame that will never answer.
+    private readonly ConcurrentDictionary<string, TaskCompletionSource> _executionContextWaiters = new();
+
+    /// <summary>
+    /// Reads the events that make and unmake execution contexts on one session, in the order the
+    /// browser sent them.
+    /// </summary>
+    /// <remarks>
+    /// A navigation tears down the old document's contexts and announces the new document's in that
+    /// order. Read on separate loops, the new document's context could be recorded first and the
+    /// teardown handled after it, which would wipe out the one context the frame actually has. One
+    /// channel for the three keeps the teardown ahead of the replacement.
+    /// <para>
+    /// WebDriver BiDi has no counterpart to subscribe to here. Script there is addressed to a
+    /// browsing context and runs in whatever realm that context holds at the time, so there is no id
+    /// to go stale and nothing to track.
+    /// </para>
+    /// </remarks>
+    private async Task PumpExecutionContextEventsAsync(IMotusSession session, CancellationToken ct)
+    {
+        string[] events =
+        [
+            "Runtime.executionContextCreated",
+            "Runtime.executionContextDestroyed",
+            "Runtime.executionContextsCleared",
+        ];
+
+        try
+        {
+            await foreach (var raw in session.SubscribeAsync(events, ct).ConfigureAwait(false))
+            {
+                try
+                {
+                    switch (raw.Method)
+                    {
+                        case "Runtime.executionContextCreated":
+                            if (JsonSerializer.Deserialize(raw.Params, CdpJsonContext.Default.RuntimeExecutionContextCreatedEvent) is { } created)
+                                OnExecutionContextCreated(created, session);
+                            break;
+                        case "Runtime.executionContextDestroyed":
+                            if (JsonSerializer.Deserialize(raw.Params, CdpJsonContext.Default.RuntimeExecutionContextDestroyedEvent) is { } destroyed)
+                                OnExecutionContextDestroyed(destroyed.ExecutionContextId, session);
+                            break;
+                        case "Runtime.executionContextsCleared":
+                            OnExecutionContextsCleared(session);
+                            break;
+                    }
+                }
+                catch
+                {
+                    // Prevent a malformed event from killing the event pump
+                }
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // Expected on page close
+        }
+    }
+
+    private void OnExecutionContextCreated(RuntimeExecutionContextCreatedEvent evt, IMotusSession source)
+    {
+        var ctx = evt.Context;
+
+        // Extract frameId from auxData if present
+        string? frameId = null;
+        var isDefaultWorld = true;
+        if (ctx.AuxData is JsonElement aux && aux.ValueKind == JsonValueKind.Object)
+        {
+            if (aux.TryGetProperty("frameId", out var fid))
+                frameId = fid.GetString();
+
+            // A frame has one main world and any number of others beside it. Only the main world
+            // is the frame's context: an isolated world reports the same frame id, and recording
+            // it here would send every later main-world evaluation into the isolated world, where
+            // the page's own globals do not exist. That failure is silent, so it is guarded at the
+            // one place contexts are recorded rather than at each reader.
+            if (aux.TryGetProperty("isDefault", out var isDefault)
+                && isDefault.ValueKind is JsonValueKind.False)
+            {
+                isDefaultWorld = false;
+            }
+        }
+
+        if (frameId is null || !isDefaultWorld)
+            return;
+
+        _frameIdToExecutionContext[frameId] = new FrameExecutionContext(ctx.Id, source);
+        SignalExecutionContextWaiters(frameId);
+    }
+
+    /// <summary>
+    /// Forgets a context the browser has torn down, wherever it was recorded.
+    /// </summary>
+    /// <remarks>
+    /// Only an entry with the same id from the same session is dropped. A frame that has moved to
+    /// another process already has its new context recorded from the new session by the time the
+    /// old session reports the old one gone, and that report is not about the new one.
+    /// </remarks>
+    private void OnExecutionContextDestroyed(int contextId, IMotusSession source)
+    {
+        foreach (var (frameId, context) in _frameIdToExecutionContext)
+        {
+            if (context.Id == contextId && ReferenceEquals(context.Session, source))
+                _frameIdToExecutionContext.TryRemove(new KeyValuePair<string, FrameExecutionContext>(frameId, context));
+        }
+
+        foreach (var frameId in _frameIdToIsolatedWorld.Keys)
+        {
+            _frames.TryGetValue(frameId, out var frame);
+            if (ReferenceEquals(SessionFor(frame), source))
+                DropIsolatedWorld(frameId, contextId);
+        }
+    }
+
+    /// <summary>
+    /// Forgets every context one session reported, which is what the browser announces when the
+    /// document at that session's root is replaced.
+    /// </summary>
+    private void OnExecutionContextsCleared(IMotusSession source)
+    {
+        foreach (var (frameId, context) in _frameIdToExecutionContext)
+        {
+            if (ReferenceEquals(context.Session, source))
+                _frameIdToExecutionContext.TryRemove(new KeyValuePair<string, FrameExecutionContext>(frameId, context));
+        }
+
+        foreach (var (frameId, world) in _frameIdToIsolatedWorld)
+        {
+            _frames.TryGetValue(frameId, out var frame);
+            if (ReferenceEquals(SessionFor(frame), source))
+                _frameIdToIsolatedWorld.TryRemove(new KeyValuePair<string, Lazy<Task<int>>>(frameId, world));
+        }
+    }
+
+    /// <summary>
+    /// Forgets every context reported over a session that has gone away.
+    /// </summary>
+    /// <remarks>
+    /// Only contexts that session reported are dropped, not every context of the frames it hosted.
+    /// A frame moving back into its parent's process has its new context reported by the parent's
+    /// session, and that can be recorded before the old target's departure is handled. Dropping it
+    /// then would leave the frame waiting for a context that has already arrived.
+    /// </remarks>
+    private void ForgetExecutionContextsFrom(string? sessionId)
+    {
+        if (sessionId is null)
+            return;
+
+        foreach (var (frameId, context) in _frameIdToExecutionContext)
+        {
+            if (context.Session.SessionId == sessionId)
+                _frameIdToExecutionContext.TryRemove(new KeyValuePair<string, FrameExecutionContext>(frameId, context));
+        }
+    }
+
+    /// <summary>
+    /// Drops the frame's isolated world when it is the one with the given id, so the next ask makes
+    /// a fresh one rather than handing back a world the browser has torn down.
+    /// </summary>
+    private void DropIsolatedWorld(string frameId, int contextId)
+    {
+        if (_frameIdToIsolatedWorld.TryGetValue(frameId, out var world)
+            && world.IsValueCreated
+            && world.Value.IsCompletedSuccessfully
+            && world.Value.Result == contextId)
+        {
+            _frameIdToIsolatedWorld.TryRemove(new KeyValuePair<string, Lazy<Task<int>>>(frameId, world));
+        }
+    }
+
+    /// <summary>
+    /// Wakes every caller waiting on the frame, so each looks again at what it now has.
+    /// </summary>
+    private void SignalExecutionContextWaiters(string frameId)
+    {
+        if (_executionContextWaiters.TryRemove(frameId, out var waiters))
+            waiters.TrySetResult();
+    }
+
+    /// <summary>
+    /// Runs a command against a frame's main world, waiting for the frame's next one when it has
+    /// none, and sending once more when the context it named turns out to be gone.
+    /// </summary>
+    /// <param name="frameId">The frame to run in.</param>
+    /// <param name="command">Sends the command to the session and context it is handed.</param>
+    /// <param name="ct">Bounds the wait for a context, alongside the page's own lifetime.</param>
+    /// <remarks>
+    /// A navigation's load event and its new context arrive on different loops, so a caller that
+    /// starts work the moment a navigation completes can find the old document's context still
+    /// recorded, or no context at all. The second case waits here for the new one. The first is
+    /// caught when the browser rejects the old id, and is retried once against whatever has been
+    /// recorded since.
+    /// </remarks>
+    internal Task<T> RunInFrameAsync<T>(
+        string frameId, Func<ExecutionTarget, Task<T>> command, CancellationToken ct = default) =>
+        RunInMainWorldAsync(frameId, mainFrameUsesDefault: false, command, ct);
+
+    /// <summary>
+    /// Runs a selector query against a frame's main world. The page's main frame, and anything
+    /// that is not a frame of this page, uses the session's default context rather than a recorded
+    /// id, which is what page-level locators have always sent and which cannot go stale.
+    /// </summary>
+    /// <param name="frame">The frame to run in, or null for the page's main frame.</param>
+    /// <param name="command">Sends the command to the session and context it is handed.</param>
+    /// <param name="ct">Bounds the wait for a context, alongside the page's own lifetime.</param>
+    internal Task<T> RunInSelectorContextAsync<T>(
+        IFrame? frame, Func<ExecutionTarget, Task<T>> command, CancellationToken ct = default)
+    {
+        if (frame is not Frame f || f.Id == SyntheticSelectorFrameId)
+            return command(new ExecutionTarget(SessionFor(frame), null));
+
+        return RunInMainWorldAsync(f.Id, mainFrameUsesDefault: true, command, ct);
+    }
+
+    private async Task<T> RunInMainWorldAsync<T>(
+        string frameId, bool mainFrameUsesDefault, Func<ExecutionTarget, Task<T>> command, CancellationToken ct)
+    {
+        var target = await ResolveMainWorldAsync(frameId, mainFrameUsesDefault, ct).ConfigureAwait(false);
+
+        try
+        {
+            return await command(target).ConfigureAwait(false);
+        }
+        catch (MotusProtocolException ex) when (target.ContextId is { } stale && IsStaleContextError(ex))
+        {
+            // The browser looks a context up before it compiles or runs anything, so a command it
+            // turns away for naming a dead context has not run at all. Sending it once more cannot
+            // run the caller's script twice, which is what makes this retry safe for commands that
+            // change the page as well as for ones that only read it.
+            ForgetExecutionContext(frameId, new FrameExecutionContext(stale, target.Session));
+            target = await ResolveMainWorldAsync(frameId, mainFrameUsesDefault, ct).ConfigureAwait(false);
+            return await command(target).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    /// Runs a command against the frame's isolated world, making a fresh world and sending once
+    /// more when the one it named has gone with the document it was made for.
+    /// </summary>
+    internal async Task<T> RunInIsolatedWorldAsync<T>(string frameId, Func<ExecutionTarget, Task<T>> command)
+    {
+        await WhenFrameReadyAsync(frameId).ConfigureAwait(false);
+        _frames.TryGetValue(frameId, out var frame);
+
+        var target = new ExecutionTarget(
+            SessionFor(frame), await GetIsolatedWorldContextIdAsync(frameId).ConfigureAwait(false));
+
+        try
+        {
+            return await command(target).ConfigureAwait(false);
+        }
+        catch (MotusProtocolException ex) when (target.ContextId is { } stale && IsStaleContextError(ex))
+        {
+            // Safe to send again for the reason given in RunInMainWorldAsync: a dead context is
+            // refused before anything runs.
+            DropIsolatedWorld(frameId, stale);
+            target = new ExecutionTarget(
+                SessionFor(frame), await GetIsolatedWorldContextIdAsync(frameId).ConfigureAwait(false));
+            return await command(target).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    /// Decides where a command about a frame's main world goes, waiting for the frame to report one
+    /// when it has none.
+    /// </summary>
+    /// <remarks>
+    /// The main frame never waits. With nothing recorded, the page session's default context is the
+    /// main frame's current main world, so leaving the id out reaches the right document and cannot
+    /// name a dead one. Any other frame has no such fallback: leaving the id out would run in the
+    /// main frame instead, quietly and with the wrong answer, so it waits for its own context.
+    /// A frame that has gone away fails at once rather than waiting for a context that will never
+    /// come.
+    /// </remarks>
+    private async Task<ExecutionTarget> ResolveMainWorldAsync(
+        string frameId, bool mainFrameUsesDefault, CancellationToken ct)
+    {
+        await WhenFrameReadyAsync(frameId).ConfigureAwait(false);
+        _frames.TryGetValue(frameId, out var frame);
+
+        // BiDi addresses script to a browsing context and has no context ids to wait for.
+        if (_session is BiDiSession)
+            return new ExecutionTarget(SessionFor(frame), null);
+
+        var isMainFrame = string.Equals(frameId, _mainFrameId, StringComparison.Ordinal);
+        if (isMainFrame && mainFrameUsesDefault)
+            return new ExecutionTarget(_session, null);
+
+        if (_frameIdToExecutionContext.TryGetValue(frameId, out var known))
+            return new ExecutionTarget(known.Session, known.Id);
+
+        if (isMainFrame)
+            return new ExecutionTarget(_session, null);
+
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct, _pageCts.Token);
+        cts.CancelAfter(ExecutionContextWaitTimeout);
+
+        while (true)
+        {
+            // Registered before looking, so a context recorded or a detach made between the look
+            // and the wait still wakes this caller.
+            var changed = _executionContextWaiters.GetOrAdd(
+                frameId, _ => new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously));
+
+            if (_frameIdToExecutionContext.TryGetValue(frameId, out var context))
+                return new ExecutionTarget(context.Session, context.Id);
+
+            ThrowIfUnreachable(frameId, frame);
+
+            try
+            {
+                await changed.Task.WaitAsync(cts.Token).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+            {
+                if (_pageCts.IsCancellationRequested)
+                    throw PageClosedWhileWaiting(frameId);
+
+                throw new WaitTimeoutException(
+                    condition: "frame execution context",
+                    timeoutDuration: ExecutionContextWaitTimeout,
+                    lastEvaluatedValue: null,
+                    message: $"Frame '{frameId}' did not report an execution context within " +
+                             $"{ExecutionContextWaitTimeout.TotalMilliseconds}ms.");
+            }
+        }
+    }
+
+    private void ThrowIfUnreachable(string frameId, Frame? frame)
+    {
+        if (_isClosed)
+            throw PageClosedWhileWaiting(frameId);
+
+        if (frame is null || frame.IsDetached || !_frames.ContainsKey(frameId))
+            throw new MotusTargetClosedException("frame", frameId, $"Frame '{frameId}' was detached.");
+    }
+
+    private MotusTargetClosedException PageClosedWhileWaiting(string frameId) =>
+        new("page", _targetId, $"The page was closed while waiting for frame '{frameId}' to report an execution context.");
+
+    /// <summary>
+    /// Drops a context the browser has said is gone, unless something newer has replaced it.
+    /// </summary>
+    private void ForgetExecutionContext(string frameId, FrameExecutionContext stale) =>
+        _frameIdToExecutionContext.TryRemove(new KeyValuePair<string, FrameExecutionContext>(frameId, stale));
+
+    private static bool IsStaleContextError(MotusProtocolException ex) =>
+        ex.Message.Contains(StaleContextMessage, StringComparison.Ordinal);
+}
diff --git a/src/Motus/Page/Page.Frames.cs b/src/Motus/Page/Page.Frames.cs
index a9456c2..a8ce363 100644
--- a/src/Motus/Page/Page.Frames.cs
+++ b/src/Motus/Page/Page.Frames.cs
@@ -127,11 +127,12 @@ private void OnTargetDetached(TargetDetachedFromTargetEvent evt)
             // it to the page session, and Page.frameDetached from the parent stays the only signal
             // that a frame has actually gone away.
             _frameIdToSession.TryRemove(frameId, out _);
-            _frameIdToExecutionContext.TryRemove(frameId, out _);
             _frameIdToIsolatedWorld.TryRemove(frameId, out _);
             _frameTargetInit.TryRemove(frameId, out _);
         }
 
+        ForgetExecutionContextsFrom(evt.SessionId);
+
         if (_context.SessionRegistry.TryGetSession(evt.SessionId, out var detached))
             detached?.CleanupChannels();
 
diff --git a/src/Motus/Page/Page.Viewport.cs b/src/Motus/Page/Page.Viewport.cs
index dcee56c..bcbb2b6 100644
--- a/src/Motus/Page/Page.Viewport.cs
+++ b/src/Motus/Page/Page.Viewport.cs
@@ -64,8 +64,6 @@ public Task<IElementHandle> AddScriptTagAsync(string? url = null, string? conten
     internal async Task<IElementHandle> AddScriptTagAsync(string? url, string? content, IFrame? frame)
     {
         await WhenFrameReadyAsync(frame).ConfigureAwait(false);
-        var session = SessionFor(frame);
-        var contextId = frame is null ? null : GetSelectorContextId(frame);
 
         string js;
         if (url is not null)
@@ -79,13 +77,18 @@ internal async Task<IElementHandle> AddScriptTagAsync(string? url, string? conte
             js = "(() => { const s = document.createElement('script'); s.textContent = " + serializedContent + "; document.head.appendChild(s); return s; })()";
         }
 
-        var result = await session.SendAsync(
-            "Runtime.evaluate",
-            new RuntimeEvaluateParams(Expression: js, ReturnByValue: false, AwaitPromise: false,
-                ContextId: contextId),
-            CdpJsonContext.Default.RuntimeEvaluateParams,
-            CdpJsonContext.Default.RuntimeEvaluateResult,
-            _pageCts.Token).ConfigureAwait(false);
+        var (session, result) = await RunInSelectorContextAsync(frame, async target =>
+        {
+            var evaluated = await target.Session.SendAsync(
+                "Runtime.evaluate",
+                new RuntimeEvaluateParams(Expression: js, ReturnByValue: false, AwaitPromise: false,
+                    ContextId: target.ContextId),
+                CdpJsonContext.Default.RuntimeEvaluateParams,
+                CdpJsonContext.Default.RuntimeEvaluateResult,
+                _pageCts.Token).ConfigureAwait(false);
+
+            return (target.Session, evaluated);
+        }, _pageCts.Token).ConfigureAwait(false);
 
         if (result.Result.ObjectId is null)
             throw new InvalidOperationException("Failed to create script element.");
@@ -103,8 +106,6 @@ public Task<IElementHandle> AddStyleTagAsync(string? url = null, string? content
     internal async Task<IElementHandle> AddStyleTagAsync(string? url, string? content, IFrame? frame)
     {
         await WhenFrameReadyAsync(frame).ConfigureAwait(false);
-        var session = SessionFor(frame);
-        var contextId = frame is null ? null : GetSelectorContextId(frame);
 
         string js;
         if (url is not null)
@@ -118,13 +119,18 @@ internal async Task<IElementHandle> AddStyleTagAsync(string? url, string? conten
             js = "(() => { const s = document.createElement('style'); s.textContent = " + serializedContent + "; document.head.appendChild(s); return s; })()";
         }
 
-        var result = await session.SendAsync(
-            "Runtime.evaluate",
-            new RuntimeEvaluateParams(Expression: js, ReturnByValue: false, AwaitPromise: false,
-                ContextId: contextId),
-            CdpJsonContext.Default.RuntimeEvaluateParams,
-            CdpJsonContext.Default.RuntimeEvaluateResult,
-            _pageCts.Token).ConfigureAwait(false);
+        var (session, result) = await RunInSelectorContextAsync(frame, async target =>
+        {
+            var evaluated = await target.Session.SendAsync(
+                "Runtime.evaluate",
+                new RuntimeEvaluateParams(Expression: js, ReturnByValue: false, AwaitPromise: false,
+                    ContextId: target.ContextId),
+                CdpJsonContext.Default.RuntimeEvaluateParams,
+                CdpJsonContext.Default.RuntimeEvaluateResult,
+                _pageCts.Token).ConfigureAwait(false);
+
+            return (target.Session, evaluated);
+        }, _pageCts.Token).ConfigureAwait(false);
 
         if (result.Result.ObjectId is null)
             throw new InvalidOperationException("Failed to create style element.");
diff --git a/src/Motus/Page/Page.cs b/src/Motus/Page/Page.cs
index f4181ce..7f615a5 100644
--- a/src/Motus/Page/Page.cs
+++ b/src/Motus/Page/Page.cs
@@ -25,8 +25,6 @@ internal sealed partial class Page : IPage
     // own for every frame the browser puts in its own process.
     private readonly List<string> _frameOrder = [];
 
-    private readonly ConcurrentDictionary<string, int> _frameIdToExecutionContext = new();
-
     // Frames that render in their own process are reached over a session of their own. A frame
     // absent from this map is driven over the page session, which is every frame the page's own
     // renderer hosts.
@@ -259,27 +257,6 @@ internal IFrame GetFrameForSelectors() =>
             ? frame
             : new Frame(this, SyntheticSelectorFrameId, parentFrameId: null);
 
-    /// <summary>
-    /// Returns the execution context to resolve selectors in for the given frame, or null to use
-    /// the session default.
-    /// </summary>
-    /// <remarks>
-    /// The main frame maps to the default context, which is what every page-level locator has
-    /// always used, so page-level resolution keeps sending exactly what it sent before. Passing an
-    /// explicit id for the main frame would also be fragile: a context id can go stale across a
-    /// navigation, where null always resolves to whatever the current default is.
-    /// </remarks>
-    internal int? GetSelectorContextId(IFrame frame)
-    {
-        if (frame is not Frame f)
-            return null;
-
-        if (f.Id == _mainFrameId || f.Id == SyntheticSelectorFrameId)
-            return null;
-
-        return GetExecutionContextId(f.Id);
-    }
-
     /// <summary>
     /// Returns the session that owns the given frame, or the page session when the frame is null
     /// or is hosted by the page's own renderer.
@@ -359,30 +336,27 @@ private List<Frame> OrderedFrames()
         }
     }
 
-    internal int? GetExecutionContextId(string frameId) =>
-        _frameIdToExecutionContext.TryGetValue(frameId, out var id) ? id : null;
-
     internal async Task<T> EvaluateInFrameAsync<T>(
-        string frameId, string expression, object? arg = null, ExecutionWorld world = ExecutionWorld.Main)
+        string frameId, string expression, object? arg = null, ExecutionWorld world = ExecutionWorld.Main,
+        CancellationToken ct = default)
     {
-        await WhenFrameReadyAsync(frameId).ConfigureAwait(false);
-
-        _frames.TryGetValue(frameId, out var frame);
-
-        var contextId = world == ExecutionWorld.Isolated
-            ? await GetIsolatedWorldContextIdAsync(frameId).ConfigureAwait(false)
-            : GetExecutionContextId(frameId);
-
-        var result = await SessionFor(frame).SendAsync(
-            "Runtime.evaluate",
-            new RuntimeEvaluateParams(
-                Expression: WrapExpression(expression, arg),
-                ReturnByValue: true,
-                AwaitPromise: true,
-                ContextId: contextId),
-            CdpJsonContext.Default.RuntimeEvaluateParams,
-            CdpJsonContext.Default.RuntimeEvaluateResult,
-            CancellationToken.None).ConfigureAwait(false);
+        var wrapped = WrapExpression(expression, arg);
+
+        Task<RuntimeEvaluateResult> Evaluate(ExecutionTarget target) =>
+            target.Session.SendAsync(
+                "Runtime.evaluate",
+                new RuntimeEvaluateParams(
+                    Expression: wrapped,
+                    ReturnByValue: true,
+                    AwaitPromise: true,
+                    ContextId: target.ContextId),
+                CdpJsonContext.Default.RuntimeEvaluateParams,
+                CdpJsonContext.Default.RuntimeEvaluateResult,
+                CancellationToken.None);
+
+        var result = world == ExecutionWorld.Isolated
+            ? await RunInIsolatedWorldAsync(frameId, Evaluate).ConfigureAwait(false)
+            : await RunInFrameAsync(frameId, Evaluate, ct).ConfigureAwait(false);
 
         if (result.ExceptionDetails is not null)
             throw new InvalidOperationException(
@@ -402,7 +376,8 @@ internal async Task<T> WaitForFunctionInFrameAsync<T>(
         {
             try
             {
-                var result = await EvaluateInFrameAsync<JsonElement>(frameId, expression, arg).ConfigureAwait(false);
+                var result = await EvaluateInFrameAsync<JsonElement>(
+                    frameId, expression, arg, ct: cts.Token).ConfigureAwait(false);
 
                 if (IsTruthy(result))
                     return result.Deserialize<T>()!;
@@ -411,6 +386,11 @@ internal async Task<T> WaitForFunctionInFrameAsync<T>(
             {
                 // Evaluation failed, will retry
             }
+            catch (OperationCanceledException) when (cts.Token.IsCancellationRequested)
+            {
+                // Ran out of time waiting for the frame's context
+                break;
+            }
 
             try
             {
diff --git a/src/Motus/Protocol/CdpJsonContext.cs b/src/Motus/Protocol/CdpJsonContext.cs
index 0847dd4..d75bfd0 100644
--- a/src/Motus/Protocol/CdpJsonContext.cs
+++ b/src/Motus/Protocol/CdpJsonContext.cs
@@ -78,6 +78,7 @@ namespace Motus;
 [JsonSerializable(typeof(RuntimeExceptionThrownEvent))]
 [JsonSerializable(typeof(RuntimeBindingCalledEvent))]
 [JsonSerializable(typeof(RuntimeExecutionContextCreatedEvent))]
+[JsonSerializable(typeof(RuntimeExecutionContextDestroyedEvent))]
 // --- Emulation domain ---
 [JsonSerializable(typeof(EmulationSetDeviceMetricsOverrideParams))]
 [JsonSerializable(typeof(EmulationSetDeviceMetricsOverrideResult))]
@@ -555,6 +556,9 @@ internal sealed record RuntimeExecutionContextDescription(
 internal sealed record RuntimeExecutionContextCreatedEvent(
     RuntimeExecutionContextDescription Context);
 
+internal sealed record RuntimeExecutionContextDestroyedEvent(
+    int ExecutionContextId);
+
 internal sealed record RuntimeConsoleApiCalledEvent(
     string Type,
     RuntimeRemoteObject[] Args,
diff --git a/src/Motus/Selectors/SelectorStrategyHelpers.cs b/src/Motus/Selectors/SelectorStrategyHelpers.cs
index eabd388..69b0399 100644
--- a/src/Motus/Selectors/SelectorStrategyHelpers.cs
+++ b/src/Motus/Selectors/SelectorStrategyHelpers.cs
@@ -20,18 +20,22 @@ internal static async Task<IReadOnlyList<IElementHandle>> EvalToHandlesAsync(
         IFrame frame, string js, CancellationToken ct)
     {
         var page = GetPage(frame);
-        var session = page.SessionFor(frame);
-
-        var result = await session.SendAsync(
-            "Runtime.evaluate",
-            new RuntimeEvaluateParams(
-                Expression: js,
-                ReturnByValue: false,
-                AwaitPromise: false,
-                ContextId: page.GetSelectorContextId(frame)),
-            CdpJsonContext.Default.RuntimeEvaluateParams,
-            CdpJsonContext.Default.RuntimeEvaluateResult,
-            ct).ConfigureAwait(false);
+
+        var (session, result) = await page.RunInSelectorContextAsync(frame, async target =>
+        {
+            var evaluated = await target.Session.SendAsync(
+                "Runtime.evaluate",
+                new RuntimeEvaluateParams(
+                    Expression: js,
+                    ReturnByValue: false,
+                    AwaitPromise: false,
+                    ContextId: target.ContextId),
+                CdpJsonContext.Default.RuntimeEvaluateParams,
+                CdpJsonContext.Default.RuntimeEvaluateResult,
+                ct).ConfigureAwait(false);
+
+            return (target.Session, evaluated);
+        }, ct).ConfigureAwait(false);
 
         if (result.ExceptionDetails is not null)
             throw new InvalidOperationException(
@@ -101,16 +105,17 @@ internal static async Task<ElementHandle> ResolveNodeToHandleAsync(
     {
         var page = GetPage(frame);
 
-        var result = await page.SessionFor(frame).SendAsync(
-            "Runtime.evaluate",
-            new RuntimeEvaluateParams(
-                Expression: "document.documentElement",
-                ReturnByValue: false,
-                AwaitPromise: false,
-                ContextId: page.GetSelectorContextId(frame)),
-            CdpJsonContext.Default.RuntimeEvaluateParams,
-            CdpJsonContext.Default.RuntimeEvaluateResult,
-            ct).ConfigureAwait(false);
+        var result = await page.RunInSelectorContextAsync(frame, target =>
+            target.Session.SendAsync(
+                "Runtime.evaluate",
+                new RuntimeEvaluateParams(
+                    Expression: "document.documentElement",
+                    ReturnByValue: false,
+                    AwaitPromise: false,
+                    ContextId: target.ContextId),
+                CdpJsonContext.Default.RuntimeEvaluateParams,
+                CdpJsonContext.Default.RuntimeEvaluateResult,
+                ct), ct).ConfigureAwait(false);
 
         return result.ExceptionDetails is null ? result.Result.ObjectId : null;
     }
diff --git a/tests/Motus.Mcp.Tests/Snapshot/InlineFrameIntegrationTests.cs b/tests/Motus.Mcp.Tests/Snapshot/InlineFrameIntegrationTests.cs
index 17b184e..0b5ce8c 100644
--- a/tests/Motus.Mcp.Tests/Snapshot/InlineFrameIntegrationTests.cs
+++ b/tests/Motus.Mcp.Tests/Snapshot/InlineFrameIntegrationTests.cs
@@ -112,6 +112,28 @@ public async Task ClickingInsideAFrame_IsAsQuickAsClickingThePage()
             $"a click inside a frame took {stopwatch.ElapsedMilliseconds} ms");
     }
 
+    [TestMethod]
+    public async Task ALazyFrameBelowTheFold_DoesNotHoldUpThePageSnapshot()
+    {
+        // A lazy iframe that has not scrolled into view has no document, so it never reports an
+        // execution context and an evaluation in it waits for one until it times out.
+        var page = await _pages!.GetOrCreateActivePageAsync();
+        await page.SetContentAsync(
+            "<iframe title='Payment frame' srcdoc='<button>Pay now</button>'></iframe>"
+            + "<div style='height:6000px'></div>"
+            + $"<iframe title='Lazy one' loading=lazy src='{_server!.IndexUrl}'></iframe>"
+            + $"<iframe title='Lazy two' loading=lazy src='{_server.IndexUrl}'></iframe>");
+
+        var stopwatch = Stopwatch.StartNew();
+        var text = TextOf(await SnapshotAsync());
+        stopwatch.Stop();
+
+        StringAssert.Contains(text, "- button \"Pay now\"");
+        Assert.IsTrue(
+            stopwatch.Elapsed < TimeSpan.FromSeconds(10),
+            $"the snapshot took {stopwatch.ElapsedMilliseconds} ms");
+    }
+
     [TestMethod]
     public async Task WithNoRoomForFrames_ThePageSaysWhatItLeftOut()
     {
diff --git a/tests/Motus.Mcp.Tests/Snapshot/InlineFrameSnapshotTests.cs b/tests/Motus.Mcp.Tests/Snapshot/InlineFrameSnapshotTests.cs
index 2d6e63b..d36b08c 100644
--- a/tests/Motus.Mcp.Tests/Snapshot/InlineFrameSnapshotTests.cs
+++ b/tests/Motus.Mcp.Tests/Snapshot/InlineFrameSnapshotTests.cs
@@ -110,6 +110,30 @@ public async Task EachFrame_NumbersItsOwnRefsBehindItsOwnIndex()
     /// <summary>
     /// A page whose only content is an element hosting one frame, and that frame's own document.
     /// </summary>
+    [TestMethod]
+    public async Task AFrameThatCannotEvaluateYet_DoesNotHoldUpThePageSnapshot()
+    {
+        // A lazy iframe below the fold has no document, so an evaluation in it waits for one.
+        var page = new FakeToolPage(Document(
+            Node("Iframe", "Payment frame", 7),
+            Node("Iframe", "Lazy frame", 8)));
+        var main = new FakeToolFrame(page, "http://example.test/");
+        page.FrameTree = main;
+
+        var loaded = main.AddChild("http://example.test/frame.html");
+        loaded.Snapshot = Document(Node("button", "Pay now", 42));
+
+        var lazy = main.AddChild("");
+        lazy.EvaluateNeverCompletes = true;
+        lazy.Snapshot = Document();
+
+        var snapshot = new PageSnapshotService(page).TakeSnapshotAsync();
+        var finished = await Task.WhenAny(snapshot, Task.Delay(TimeSpan.FromSeconds(10)));
+
+        Assert.AreSame(snapshot, finished, "the snapshot waited on a frame that could not answer");
+        StringAssert.Contains(await snapshot, "button \"Pay now\"");
+    }
+
     private static FakeToolPage PageWithOneFrame(out FakeToolFrame frame)
     {
         var page = new FakeToolPage(Document(Node("Iframe", "Payment frame", 7)));
diff --git a/tests/Motus.Mcp.Tests/Tools/CoreToolsFakes.cs b/tests/Motus.Mcp.Tests/Tools/CoreToolsFakes.cs
index 816011f..7b821a7 100644
--- a/tests/Motus.Mcp.Tests/Tools/CoreToolsFakes.cs
+++ b/tests/Motus.Mcp.Tests/Tools/CoreToolsFakes.cs
@@ -1016,10 +1016,18 @@ public ILocator LocatorByBackendNodeId(long backendNodeId)
         return page.RecordingLocator;
     }
 
+    /// <summary>
+    /// When set, <see cref="EvaluateAsync{T}"/> never completes, like a frame that has no document
+    /// to evaluate in yet.
+    /// </summary>
+    public bool EvaluateNeverCompletes { get; set; }
+
     public Task<T> EvaluateAsync<T>(string expression, object? arg = null)
     {
         Evaluated.Add(expression);
-        return Task.FromResult(default(T)!);
+        return EvaluateNeverCompletes
+            ? new TaskCompletionSource<T>().Task
+            : Task.FromResult(default(T)!);
     }
 
     public Task<T> EvaluateAsync<T>(string expression, object? arg, EvaluateOptions options)
diff --git a/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs b/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs
index 1ba9f42..73aabee 100644
--- a/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs
+++ b/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs
@@ -138,6 +138,38 @@ public async Task Firefox_NewPage_HasMainFrameAndTakesContentWithoutNavigation()
         Assert.AreEqual(2, await page.MainFrame.EvaluateAsync<int>("1 + 1"));
     }
 
+    /// <summary>
+    /// Evaluating straight after a navigation works on Firefox too. BiDi addresses script to a
+    /// browsing context rather than to an execution context id, so there is no id to go stale, and
+    /// the waiting Chromium needs must not get in its way.
+    /// </summary>
+    [TestMethod]
+    public async Task Firefox_EvaluateRightAfterNavigation_Succeeds()
+    {
+        if (!FirefoxAvailable())
+        {
+            Assert.Inconclusive("Firefox not found on this machine.");
+            return;
+        }
+
+        await using var browser = await MotusLauncher.LaunchAsync(
+            new LaunchOptions { Headless = true, Channel = BrowserChannel.Firefox });
+
+        for (var i = 0; i < 30; i++)
+        {
+            var context = await browser.NewContextAsync();
+            var page = await context.NewPageAsync();
+
+            await page.GotoAsync("about:blank");
+            Assert.AreEqual(2, await page.EvaluateAsync<int>("1+1"), $"iteration {i}");
+
+            await page.GotoAsync($"data:text/html,<title>t{i}</title>");
+            Assert.AreEqual($"t{i}", await page.TitleAsync(), $"iteration {i}");
+
+            await context.CloseAsync();
+        }
+    }
+
     /// <summary>
     /// Pointer actions scroll their target into view with a script that runs in the page rather
     /// than with a Chromium-only command, so the script has to behave the same under Firefox. It is
diff --git a/tests/Motus.Tests/Page/ExecutionContextIntegrationTests.cs b/tests/Motus.Tests/Page/ExecutionContextIntegrationTests.cs
new file mode 100644
index 0000000..bafcb00
--- /dev/null
+++ b/tests/Motus.Tests/Page/ExecutionContextIntegrationTests.cs
@@ -0,0 +1,160 @@
+using Motus.Abstractions;
+
+namespace Motus.Tests.Page;
+
+/// <summary>
+/// Evaluating the moment a navigation completes, against a real browser.
+/// </summary>
+/// <remarks>
+/// A navigation's load event and the new document's execution context arrive separately, so a
+/// caller that evaluates straight after <c>GotoAsync</c> could reach the page before the new
+/// context had been recorded and be refused with "Cannot find context with specified id". It only
+/// happened some of the time, so these tests repeat the sequence rather than relying on one run.
+/// </remarks>
+[TestClass]
+[TestCategory("Integration")]
+public class ExecutionContextIntegrationTests
+{
+    private const int Iterations = 40;
+
+    private CrossOriginFixtureServer _server = null!;
+    private IBrowser? _browser;
+
+    [TestInitialize]
+    public async Task Setup()
+    {
+        _server = new CrossOriginFixtureServer();
+
+        try
+        {
+            _browser = await MotusLauncher.LaunchAsync(new LaunchOptions
+            {
+                Headless = true,
+                Args = _server.IsolationArgs
+            });
+        }
+        catch (FileNotFoundException)
+        {
+            Assert.Inconclusive("No browser found; skipping integration tests.");
+        }
+    }
+
+    [TestCleanup]
+    public async Task Cleanup()
+    {
+        if (_browser is not null)
+            await _browser.DisposeAsync();
+
+        _server?.Dispose();
+    }
+
+    /// <summary>
+    /// The sequence the problem was reported with: a fresh context and page, one navigation, and
+    /// an evaluation straight after it.
+    /// </summary>
+    [TestMethod]
+    public async Task EvaluateRightAfterNavigatingAFreshPage_Succeeds()
+    {
+        for (var i = 0; i < Iterations; i++)
+        {
+            var context = await _browser!.NewContextAsync();
+            var page = await context.NewPageAsync();
+
+            await page.GotoAsync("about:blank");
+            Assert.AreEqual(2, await page.EvaluateAsync<int>("1+1"), $"iteration {i}");
+
+            await page.GotoAsync($"data:text/html,<title>t{i}</title><p>{i}</p>");
+            Assert.AreEqual($"t{i}", await page.TitleAsync(), $"iteration {i}");
+            StringAssert.Contains(await page.ContentAsync(), $"<p>{i}</p>");
+
+            await context.CloseAsync();
+        }
+    }
+
+    /// <summary>
+    /// A navigation to another site moves the page into a new renderer process, which replaces the
+    /// main world with one numbered by a different process.
+    /// </summary>
+    [TestMethod]
+    public async Task EvaluateRightAfterACrossOriginNavigation_RunsInTheNewDocument()
+    {
+        var page = await _browser!.NewPageAsync();
+
+        for (var i = 0; i < Iterations / 2; i++)
+        {
+            await page.GotoAsync(_server.PrimaryOrigin + "/deep.html");
+            Assert.AreEqual("deep", await page.EvaluateAsync<string>("window.marker"), $"iteration {i}");
+
+            await page.GotoAsync(_server.SecondaryOrigin + "/middle.html");
+            Assert.AreEqual("middle", await page.EvaluateAsync<string>("window.marker"), $"iteration {i}");
+            Assert.AreEqual(_server.SecondaryOrigin, await page.EvaluateAsync<string>("location.origin"));
+        }
+    }
+
+    /// <summary>
+    /// A frame that navigates on its own replaces only its own main world. An evaluation in it must
+    /// reach the new document, not the old one and not the page's main frame.
+    /// </summary>
+    [TestMethod]
+    public async Task EvaluateInAFrameRightAfterItNavigates_RunsInThatFramesNewDocument()
+    {
+        var page = await _browser!.NewPageAsync();
+        await page.GotoAsync(_server.OrderedUrl);
+        var frame = await FirstChildFrameAsync(page);
+
+        for (var i = 0; i < Iterations / 4; i++)
+        {
+            await frame.GotoAsync(_server.PrimaryOrigin + "/deep.html");
+            Assert.AreEqual("deep", await frame.EvaluateAsync<string>("window.marker"), $"iteration {i}");
+            Assert.AreEqual(0, await frame.EvaluateAsync<int>("window.clicks"));
+
+            await frame.GotoAsync(_server.PrimaryOrigin + "/ordered-child.html?again=" + i);
+            Assert.AreEqual(
+                "child",
+                await frame.EvaluateAsync<string>("document.querySelector('p').textContent"),
+                $"iteration {i}");
+        }
+
+        Assert.IsNull(
+            await page.EvaluateAsync<string?>("window.marker ?? null"),
+            "the frame's evaluations never landed in the main frame");
+    }
+
+    /// <summary>
+    /// Same as above for a locator, which resolves through the frame's context rather than through
+    /// an evaluation of the caller's own.
+    /// </summary>
+    [TestMethod]
+    public async Task LocatorInAFrameRightAfterItNavigates_ResolvesInThatFramesNewDocument()
+    {
+        var page = await _browser!.NewPageAsync();
+        await page.GotoAsync(_server.OrderedUrl);
+        var frame = await FirstChildFrameAsync(page);
+
+        for (var i = 0; i < Iterations / 4; i++)
+        {
+            await frame.GotoAsync(_server.PrimaryOrigin + "/deep.html");
+            Assert.AreEqual("deep", await frame.Locator("#target").TextContentAsync(), $"iteration {i}");
+
+            await frame.GotoAsync(_server.PrimaryOrigin + "/ordered-child.html?again=" + i);
+            Assert.AreEqual("child", await frame.Locator("p").TextContentAsync(), $"iteration {i}");
+        }
+    }
+
+    private static async Task<IFrame> FirstChildFrameAsync(IPage page)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(10);
+        while (DateTime.UtcNow < deadline)
+        {
+            var frame = page.MainFrame.ChildFrames.FirstOrDefault(
+                f => f.Url.EndsWith("/ordered-child.html?i=0", StringComparison.Ordinal));
+            if (frame is not null)
+                return frame;
+
+            await Task.Delay(100);
+        }
+
+        Assert.Inconclusive("The fixture's first child frame never appeared.");
+        return null!;
+    }
+}
diff --git a/tests/Motus.Tests/Page/ExecutionContextTrackingTests.cs b/tests/Motus.Tests/Page/ExecutionContextTrackingTests.cs
new file mode 100644
index 0000000..cd07019
--- /dev/null
+++ b/tests/Motus.Tests/Page/ExecutionContextTrackingTests.cs
@@ -0,0 +1,479 @@
+using System.Collections.Concurrent;
+using System.Text.Json;
+using Motus.Abstractions;
+using Motus.Tests.Transport;
+
+namespace Motus.Tests.Page;
+
+/// <summary>
+/// Which execution context the page sends a frame's evaluations to, as the browser makes and tears
+/// down contexts around it.
+/// </summary>
+/// <remarks>
+/// A navigation destroys the old document's main world and creates the new one's, and the load
+/// event that ends the navigation travels separately from both. An evaluation that starts the
+/// moment a navigation completes must neither name the old document's context, which the browser
+/// rejects, nor leave the context out for a frame other than the main one, which runs the script in
+/// the main frame instead.
+/// </remarks>
+[TestClass]
+public class ExecutionContextTrackingTests
+{
+    private MethodAwareFakeCdpSocket _socket = null!;
+    private CdpTransport _transport = null!;
+    private CdpSessionRegistry _registry = null!;
+    private Motus.Browser _browser = null!;
+
+    // Every Runtime.evaluate the page sent, with the session it went to and the context it named.
+    private readonly ConcurrentQueue<(string? SessionId, int? ContextId)> _evaluations = new();
+
+    // Contexts the fake browser refuses as already torn down.
+    private readonly ConcurrentDictionary<int, bool> _deadContexts = new();
+
+    [TestInitialize]
+    public async Task Setup()
+    {
+        _socket = new MethodAwareFakeCdpSocket();
+        _transport = new CdpTransport(_socket);
+        await _transport.ConnectAsync(new Uri("ws://localhost:1234"), CancellationToken.None);
+        _registry = new CdpSessionRegistry(_transport);
+        _browser = new Motus.Browser(
+            _transport, _registry, process: null, tempUserDataDir: null,
+            handleSigint: false, handleSigterm: false);
+
+        _socket.Respond(
+            "Browser.getVersion",
+            """{"result": {"protocolVersion":"1.3","product":"Chrome/120","revision":"@x","userAgent":"UA","jsVersion":"12"}}""");
+
+        await _browser.InitializeAsync(CancellationToken.None);
+
+        _socket.Respond("Target.createBrowserContext", """{"result": {"browserContextId": "ctx-1"}}""");
+        _socket.Respond("Target.createTarget", """{"result": {"targetId": "target-1"}}""");
+        _socket.Respond("Target.attachToTarget", """{"result": {"sessionId": "session-1"}}""");
+        _socket.Respond("Page.getFrameTree", """
+            {
+                "sessionId": "session-1",
+                "result": {
+                    "frameTree": {
+                        "frame": { "id": "frame-main", "loaderId": "loader-1", "name": "", "url": "about:blank" }
+                    }
+                }
+            }
+            """);
+
+        _socket.SetHandler(envelope =>
+        {
+            var method = envelope.GetProperty("method").GetString();
+            if (method != "Runtime.evaluate")
+                throw new InvalidOperationException($"Unexpected {method}");
+
+            var id = envelope.GetProperty("id").GetInt32();
+            var sessionId = envelope.TryGetProperty("sessionId", out var s) ? s.GetString() : null;
+            int? contextId = envelope.GetProperty("params").TryGetProperty("contextId", out var c)
+                ? c.GetInt32()
+                : null;
+
+            _evaluations.Enqueue((sessionId, contextId));
+
+            if (contextId is { } named && _deadContexts.ContainsKey(named))
+            {
+                return $$"""
+                    {
+                        "id": {{id}},
+                        "sessionId": "{{sessionId}}",
+                        "error": { "code": -32000, "message": "Cannot find context with specified id" }
+                    }
+                    """;
+            }
+
+            return $$"""
+                {
+                    "id": {{id}},
+                    "sessionId": "{{sessionId}}",
+                    "result": { "result": { "type": "number", "value": 2 } }
+                }
+                """;
+        });
+    }
+
+    [TestCleanup]
+    public async Task Cleanup() => await _transport.DisposeAsync();
+
+    [TestMethod]
+    public async Task ContextDestroyed_IsNoLongerNamed()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(7, "frame-main");
+        await Settle();
+
+        await page.EvaluateAsync<int>("1 + 1");
+        Assert.AreEqual(7, LastEvaluation().ContextId);
+
+        ContextDestroyed(7);
+        await Settle();
+
+        await page.EvaluateAsync<int>("1 + 1");
+        Assert.IsNull(
+            LastEvaluation().ContextId,
+            "with its context gone, the main frame falls back to the session default, which cannot be stale");
+    }
+
+    [TestMethod]
+    public async Task ContextsCleared_IsNoLongerNamed()
+    {
+        var page = await _browser.NewPageAsync();
+        AttachFrame("frame-child", "frame-main");
+        ContextCreated(7, "frame-main");
+        ContextCreated(8, "frame-child");
+        await Settle();
+
+        ContextsCleared();
+        await Settle();
+
+        await page.EvaluateAsync<int>("1 + 1");
+        Assert.IsNull(LastEvaluation().ContextId, "the main frame's context was cleared with the rest");
+
+        var child = Frame(page, "frame-child");
+        var pending = child.EvaluateAsync<int>("1 + 1");
+        await Settle();
+        Assert.IsFalse(pending.IsCompleted, "the child's context was cleared too, so it waits for its next");
+
+        ContextCreated(9, "frame-child");
+        Assert.AreEqual(2, await pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.AreEqual(9, LastEvaluation().ContextId);
+    }
+
+    [TestMethod]
+    public async Task IsolatedWorld_DoesNotReplaceTheMainWorld()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(7, "frame-main");
+        ContextCreated(12, "frame-main", isDefault: false);
+        await Settle();
+
+        await page.EvaluateAsync<int>("1 + 1");
+
+        Assert.AreEqual(7, LastEvaluation().ContextId, "an isolated world is not the frame's context");
+    }
+
+    [TestMethod]
+    public async Task DestroyedThenCreated_OnTheSameSession_KeepsTheNewContext()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(7, "frame-main");
+        await Settle();
+
+        // The order a navigation reports them in. Read on separate loops, the teardown could be
+        // handled after the replacement and leave the frame with nothing.
+        ContextDestroyed(7);
+        ContextCreated(8, "frame-main");
+        await Settle();
+
+        await page.EvaluateAsync<int>("1 + 1");
+
+        Assert.AreEqual(8, LastEvaluation().ContextId);
+    }
+
+    [TestMethod]
+    public async Task ChildFrame_WithNoContextYet_WaitsForItsOwnRatherThanRunningInTheMainFrame()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(7, "frame-main");
+        AttachFrame("frame-child", "frame-main");
+        await Settle();
+
+        var pending = Frame(page, "frame-child").EvaluateAsync<int>("1 + 1");
+        await Settle();
+
+        Assert.IsFalse(pending.IsCompleted, "nothing is sent until the frame has a context of its own");
+        Assert.AreEqual(0, _evaluations.Count);
+
+        ContextCreated(11, "frame-child");
+
+        Assert.AreEqual(2, await pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.AreEqual(11, LastEvaluation().ContextId);
+    }
+
+    [TestMethod]
+    public async Task StaleContext_IsRetriedOnceAgainstTheNextOne()
+    {
+        var page = await _browser.NewPageAsync();
+        AttachFrame("frame-child", "frame-main");
+        ContextCreated(11, "frame-child");
+        await Settle();
+
+        // The browser has torn the context down but the page has not heard yet, which is the window
+        // between a navigation's load event and its context events.
+        _deadContexts[11] = true;
+
+        var pending = Frame(page, "frame-child").EvaluateAsync<int>("1 + 1");
+        await Settle();
+
+        Assert.IsFalse(pending.IsCompleted, "after the refusal, the retry waits for the frame's next context");
+        Assert.AreEqual(1, _evaluations.Count);
+
+        ContextCreated(12, "frame-child");
+
+        Assert.AreEqual(2, await pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        CollectionAssert.AreEqual(
+            new int?[] { 11, 12 },
+            _evaluations.Select(e => e.ContextId).ToArray(),
+            "one refused attempt against the dead context, then one against the new one");
+    }
+
+    [TestMethod]
+    public async Task StaleContext_OnTheMainFrame_IsRetriedOnce()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(7, "frame-main");
+        await Settle();
+        _deadContexts[7] = true;
+
+        Assert.AreEqual(2, await page.EvaluateAsync<int>("1 + 1"));
+
+        var sent = _evaluations.Select(e => e.ContextId).ToArray();
+        Assert.AreEqual(2, sent.Length, "exactly one retry");
+        Assert.AreEqual(7, sent[0]);
+        Assert.IsNull(sent[1], "the retry goes to the main frame's current default context");
+    }
+
+    [TestMethod]
+    public async Task StaleContext_RefusedTwice_IsNotRetriedAgain()
+    {
+        var page = await _browser.NewPageAsync();
+        AttachFrame("frame-child", "frame-main");
+        ContextCreated(11, "frame-child");
+        await Settle();
+        _deadContexts[11] = true;
+        _deadContexts[12] = true;
+
+        var pending = Frame(page, "frame-child").EvaluateAsync<int>("1 + 1");
+        await Settle();
+        ContextCreated(12, "frame-child");
+
+        var ex = await Assert.ThrowsExceptionAsync<MotusProtocolException>(
+            () => pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        StringAssert.Contains(ex.Message, "Cannot find context");
+        Assert.AreEqual(2, _evaluations.Count, "one retry, not a loop");
+    }
+
+    [TestMethod]
+    public async Task DetachedFrame_FailsAtOnce()
+    {
+        var page = await _browser.NewPageAsync();
+        AttachFrame("frame-child", "frame-main");
+        await Settle();
+        var child = Frame(page, "frame-child");
+
+        DetachFrame("frame-child");
+        await Settle();
+
+        await Assert.ThrowsExceptionAsync<MotusTargetClosedException>(
+            () => child.EvaluateAsync<int>("1 + 1").WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.AreEqual(0, _evaluations.Count, "nothing is sent for a frame that has gone");
+    }
+
+    [TestMethod]
+    public async Task FrameDetachedWhileWaiting_FailsTheWaiter()
+    {
+        var page = await _browser.NewPageAsync();
+        AttachFrame("frame-child", "frame-main");
+        await Settle();
+
+        var pending = Frame(page, "frame-child").EvaluateAsync<int>("1 + 1");
+        await Settle();
+        Assert.IsFalse(pending.IsCompleted);
+
+        DetachFrame("frame-child");
+
+        await Assert.ThrowsExceptionAsync<MotusTargetClosedException>(
+            () => pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.AreEqual(0, _evaluations.Count);
+    }
+
+    [TestMethod]
+    public async Task PageClosedWhileWaiting_FailsTheWaiter()
+    {
+        var page = await _browser.NewPageAsync();
+        AttachFrame("frame-child", "frame-main");
+        await Settle();
+
+        var pending = Frame(page, "frame-child").EvaluateAsync<int>("1 + 1");
+        await Settle();
+        Assert.IsFalse(pending.IsCompleted);
+
+        await page.DisposeAsync();
+
+        var ex = await Assert.ThrowsExceptionAsync<MotusTargetClosedException>(
+            () => pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.AreEqual("page", ex.TargetType);
+    }
+
+    [TestMethod]
+    public async Task ContextEventsFromOneSession_LeaveAnotherSessionsContextAlone()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(5, "frame-main");
+        await Settle();
+
+        AdoptOutOfProcessFrame();
+        await Settle(250);
+
+        // Context ids are numbered per renderer, so the frame's own process can hand out the same
+        // number the page's process already used.
+        ContextCreated(5, "frame-oop", sessionId: "session-2");
+        await Settle();
+
+        // The page's process reports its own context 5 gone, and then clears the lot.
+        ContextDestroyed(5);
+        ContextsCleared();
+        await Settle();
+
+        var oop = Frame(page, "frame-oop");
+        Assert.AreEqual(2, await oop.EvaluateAsync<int>("1 + 1").WaitAsync(TimeSpan.FromSeconds(5)));
+
+        var last = LastEvaluation();
+        Assert.AreEqual("session-2", last.SessionId);
+        Assert.AreEqual(5, last.ContextId, "the frame's own process still holds its context");
+    }
+
+    [TestMethod]
+    public async Task FrameReturningToThePageProcess_KeepsTheContextItReportedThere()
+    {
+        var page = await _browser.NewPageAsync();
+        ContextCreated(5, "frame-main");
+        AdoptOutOfProcessFrame();
+        await Settle(250);
+        ContextCreated(5, "frame-oop", sessionId: "session-2");
+        await Settle();
+
+        // The frame navigates back to its parent's origin. The page's process reports the new
+        // document's context, and the frame's own target goes away. The two travel separately, so
+        // the context can be recorded before the target's departure is handled, and the departure
+        // must not take the new context with it.
+        ContextCreated(20, "frame-oop");
+        await Settle();
+        TargetDetached("session-2");
+        await Settle();
+
+        var oop = Frame(page, "frame-oop");
+        Assert.AreEqual(2, await oop.EvaluateAsync<int>("1 + 1").WaitAsync(TimeSpan.FromSeconds(5)));
+
+        var last = LastEvaluation();
+        Assert.AreEqual("session-1", last.SessionId);
+        Assert.AreEqual(20, last.ContextId, "the context the page's process reported for the frame");
+    }
+
+    private (string? SessionId, int? ContextId) LastEvaluation()
+    {
+        Assert.IsTrue(_evaluations.Count > 0, "no Runtime.evaluate was sent");
+        return _evaluations.Last();
+    }
+
+    private static IFrame Frame(IPage page, string frameId)
+        => page.Frames.Single(f => ((global::Motus.Frame)f).Id == frameId);
+
+    private static Task Settle(int ms = 100) => Task.Delay(ms);
+
+    private void ContextCreated(int id, string frameId, bool isDefault = true, string sessionId = "session-1")
+        => _socket.Enqueue($$"""
+            {
+                "method": "Runtime.executionContextCreated",
+                "sessionId": "{{sessionId}}",
+                "params": {
+                    "context": {
+                        "id": {{id}},
+                        "origin": "://",
+                        "name": "",
+                        "auxData": { "frameId": "{{frameId}}", "isDefault": {{(isDefault ? "true" : "false")}} }
+                    }
+                }
+            }
+            """);
+
+    private void ContextDestroyed(int id, string sessionId = "session-1")
+        => _socket.Enqueue($$"""
+            {
+                "method": "Runtime.executionContextDestroyed",
+                "sessionId": "{{sessionId}}",
+                "params": { "executionContextId": {{id}} }
+            }
+            """);
+
+    private void ContextsCleared(string sessionId = "session-1")
+        => _socket.Enqueue($$"""
+            {
+                "method": "Runtime.executionContextsCleared",
+                "sessionId": "{{sessionId}}",
+                "params": {}
+            }
+            """);
+
+    private void AttachFrame(string frameId, string parent)
+        => _socket.Enqueue($$"""
+            {
+                "method": "Page.frameAttached",
+                "sessionId": "session-1",
+                "params": { "frameId": "{{frameId}}", "parentFrameId": "{{parent}}" }
+            }
+            """);
+
+    private void DetachFrame(string frameId)
+        => _socket.Enqueue($$"""
+            {
+                "method": "Page.frameDetached",
+                "sessionId": "session-1",
+                "params": { "frameId": "{{frameId}}" }
+            }
+            """);
+
+    private void TargetDetached(string sessionId)
+        => _socket.Enqueue($$"""
+            {
+                "method": "Target.detachedFromTarget",
+                "sessionId": "session-1",
+                "params": { "sessionId": "{{sessionId}}" }
+            }
+            """);
+
+    /// <summary>
+    /// Has the page adopt a frame that renders in a process of its own, reached over session-2.
+    /// </summary>
+    private void AdoptOutOfProcessFrame()
+    {
+        _socket.Respond("Page.getFrameTree", """
+            {
+                "sessionId": "session-2",
+                "result": {
+                    "frameTree": {
+                        "frame": {
+                            "id": "frame-oop",
+                            "parentId": "frame-main",
+                            "loaderId": "loader-2",
+                            "name": "",
+                            "url": "http://b.test/child.html"
+                        }
+                    }
+                }
+            }
+            """);
+
+        _socket.Enqueue("""
+            {
+                "method": "Target.attachedToTarget",
+                "sessionId": "session-1",
+                "params": {
+                    "sessionId": "session-2",
+                    "waitingForDebugger": false,
+                    "targetInfo": {
+                        "targetId": "frame-oop",
+                        "type": "iframe",
+                        "title": "child",
+                        "url": "http://b.test/child.html",
+                        "attached": true
+                    }
+                }
+            }
+            """);
+    }
+}
diff --git a/tests/Motus.Tests/Page/OutOfProcessFrameTests.cs b/tests/Motus.Tests/Page/OutOfProcessFrameTests.cs
index 8a64d3a..9345e9a 100644
--- a/tests/Motus.Tests/Page/OutOfProcessFrameTests.cs
+++ b/tests/Motus.Tests/Page/OutOfProcessFrameTests.cs
@@ -345,6 +345,57 @@ private static (int Width, int Height) ReadPngSize(byte[] png)
         return (width, height);
     }
 
+    /// <summary>
+    /// A frame that leaves its own process for its parent's is the same frame, and evaluating in it
+    /// once it gets there has to reach the document it now holds.
+    /// </summary>
+    /// <remarks>
+    /// The page's process reports the frame's new context and the frame's old target goes away,
+    /// and those two arrive separately. Handling the departure second must not forget the context
+    /// the page's process has just reported, or the next evaluation waits for one that has already
+    /// come. A few round trips give both orders a chance to happen.
+    /// </remarks>
+    [TestMethod]
+    public async Task CrossOriginFrame_MovingIntoItsParentsProcess_StillEvaluates()
+    {
+        var middle = await FrameAsync("middle");
+        var page = (Motus.Page)_page!;
+
+        for (var i = 0; i < 4; i++)
+        {
+            await _page!.EvaluateAsync<object?>(
+                $"document.getElementById('remote').src = '{_server.PrimaryOrigin}/deep.html?i={i}'");
+            await WaitUntilAsync(
+                () => middle.Url.Contains($"/deep.html?i={i}", StringComparison.Ordinal) && !page.HasOwnSession(middle),
+                "the frame never moved into its parent's process");
+
+            Assert.AreEqual(
+                "deep",
+                await middle.EvaluateAsync<string>("window.marker").WaitAsync(TimeSpan.FromSeconds(10)),
+                $"round trip {i}");
+
+            await _page.EvaluateAsync<object?>(
+                $"document.getElementById('remote').src = '{_server.SecondaryOrigin}/middle.html?i={i}'");
+            await WaitUntilAsync(
+                () => middle.Url.Contains($"/middle.html?i={i}", StringComparison.Ordinal) && page.HasOwnSession(middle),
+                "the frame never moved back into a process of its own");
+
+            Assert.AreEqual(
+                "middle",
+                await middle.EvaluateAsync<string>("window.marker").WaitAsync(TimeSpan.FromSeconds(10)),
+                $"round trip {i}");
+        }
+
+        static async Task WaitUntilAsync(Func<bool> condition, string message)
+        {
+            var deadline = DateTime.UtcNow.AddSeconds(10);
+            while (!condition() && DateTime.UtcNow < deadline)
+                await Task.Delay(50);
+
+            Assert.IsTrue(condition(), message);
+        }
+    }
+
     [TestMethod]
     public async Task DetachingAFrame_LeavesItsHandleReportingDetached()
     {