diff --git a/docs/architecture/selectors-and-assertions.md b/docs/architecture/selectors-and-assertions.md
index a33aa03..a90183b 100644
--- a/docs/architecture/selectors-and-assertions.md
+++ b/docs/architecture/selectors-and-assertions.md
@@ -51,7 +51,7 @@ The text-based factories write their text as a JSON string literal followed by a
 
 `GetByLabel` reads an element's labels in the same order of precedence a browser computes a name from: the elements named by `aria-labelledby` when it resolves to any, otherwise a non-empty `aria-label`, otherwise the `<label>` elements associated with a form control through `for` or by wrapping it.
 
-`GetByRole` matches the accessible name exactly, as `Accessibility.queryAXTree` does. Elements the accessibility tree ignores, such as one inside `display: none` or `aria-hidden="true"`, never match.
+`GetByRole` matches the accessible name exactly, as `Accessibility.queryAXTree` does. Elements the accessibility tree ignores, such as one inside `display: none` or `aria-hidden="true"`, never match. It needs a Chromium-based browser; see [On Firefox](#on-firefox).
 
 ### Resolution scope: the page, or one frame
 
@@ -65,6 +65,14 @@ Measurement follows the same root. `ILocator.BoundingBoxAsync` reports page coor
 
 See [Frames and iframes](../guides/frames-and-iframes.md) for the caller-facing view.
 
+### On Firefox
+
+Every strategy that runs a query in the page (CSS, XPath, text, test id, and the `GetBy*` factories other than `GetByRole`) resolves on Firefox the same as on Chromium, and so do chained, parent and filtered locators, the locator actions and queries, and the assertions. Two actions are the exception, for reasons outside the locator: `ScreenshotAsync` captures through a page screenshot, which has no WebDriver BiDi translation yet, and `DblClickAsync` reaches the page as two single clicks. The element handles the strategies return are named by WebDriver BiDi shared ids; see [Transport and Protocol](transport-and-protocol.md) for how the CDP-shaped calls are translated.
+
+Three things need the accessibility tree, which WebDriver BiDi does not expose: `GetByRole` and `role=` selectors, the `_node` selector behind `LocatorByBackendNodeId`, and the `ToHaveAccessibleNameAsync` and `ToHaveRoleAsync` assertions. On Firefox each throws a `NotSupportedException` straight away that says so, rather than waiting out its timeout.
+
+A Firefox page does not report the frames inside it yet, so `page.Frames` holds only the main frame and there is no `IFrame` to build a locator on for an `<iframe>`.
+
 ### TestId Strategy
 
 `TestIdSelectorStrategy` accepts a configurable attribute name in its constructor (default `"data-testid"`). The `StrategyName` property returns the configured attribute name, so registering the strategy with a different attribute (for example, `"data-cy"`) also changes the prefix used in selector strings.
diff --git a/docs/architecture/transport-and-protocol.md b/docs/architecture/transport-and-protocol.md
index a3591c3..40550bf 100644
--- a/docs/architecture/transport-and-protocol.md
+++ b/docs/architecture/transport-and-protocol.md
@@ -156,6 +156,10 @@ BiDi requires an explicit `session.new` handshake after the WebSocket connects.
 
 Event subscriptions in `BiDiSession` also pass through `BiDiEventMap.GetEventTranslation` to remap CDP event names to BiDi event names and translate event payloads. Before yielding the first event for a given BiDi event name, `BiDiSession.EnsureSubscribedAsync` sends a `session.subscribe` command with the event name and, where applicable, the context ID. This subscription is tracked per-session in a `HashSet<string>` so it is only sent once.
 
+Script commands need more than a renamed method too, because CDP and BiDi name remote objects and carry values differently. The engine keeps a single opaque `objectId` string per remote object, while BiDi names a DOM node by its `sharedId` and any other object by a realm-bound `handle`. `BiDiScriptValues` hands a node out as its shared id with a `sharedId:` prefix and anything else as its handle, and turns the id back into `{ "sharedId": ... }` or `{ "handle": ... }` wherever it is sent as `this` or as an argument. A shared id is the same every time a node is serialized, so an element that two queries find is the same id both times, and it is the reference `input.setFiles` takes, which is how `DOM.setFileInputFiles` translates. Values travel as BiDi typed values both ways: a CDP argument becomes a local value, an object as a list of key and value pairs, and every argument is passed on, an empty one as `undefined`, so later ones keep their positions. A result comes back with its contents rebuilt as the JSON `JSON.stringify` would give, which is what a CDP call made by value returns, with a number JSON cannot hold reported as an `unserializableValue`.
+
+BiDi has no command that lists an object's properties, so `Runtime.getProperties` becomes a `script.callFunction` that returns the object to itself, serialized one level deep, and each element or entry becomes a property. That is what the selector strategies read: they evaluate their query to an array of elements and then make an element handle from each entry, so every strategy that queries the page, and every chained query, works on Firefox through this one translation. Only nodes and primitives among the entries come back usable, since BiDi gives a handle only to the value a call returns.
+
 Key events need more than a renamed method. CDP names a key by its DOM `key` value, such as `"Enter"` or `"Shift"`, but a WebDriver key action takes a single character, and every key that produces no character is named by the Private Use Area code point the WebDriver key table gives it: U+E006 for Enter, U+E004 for Tab, U+E008 for the left Shift and U+E050 for the right one. `BiDiKeyValues` does this mapping, and it reads the CDP `code` as well, so the right-hand modifiers, the numpad Enter and the numpad digits keep their location. A key that produces a character is sent as that character, and a key WebDriver has no value for, such as CapsLock, fails with a `NotSupportedException` before anything is sent. The CDP `modifiers` bitmask is not carried over, because WebDriver keeps the keys an input source holds between commands and derives the modifiers from them. A CDP `char` event becomes a pause, because a WebDriver key down already produces the key's text.
 
 ---
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 475c445..77e1767 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -178,7 +178,7 @@ Page.GetByPlaceholder("Search...")
 Page.GetByTestId("login-form")
 ```
 
-`GetByRole` matches implicit roles and computed accessible names, so a plain `<button>Submit</button>` is found without a `role` or `aria-label` attribute, and the name must match exactly. `GetByLabel` finds a control through its `<label for>`, a wrapping `<label>`, `aria-labelledby` or `aria-label`. `GetByText`, `GetByLabel`, `GetByPlaceholder`, `GetByTitle` and `GetByAltText` match a case-insensitive substring by default; pass `exact: true` to require the whole text, case-sensitively:
+`GetByRole` matches implicit roles and computed accessible names, so a plain `<button>Submit</button>` is found without a `role` or `aria-label` attribute, and the name must match exactly. `GetByLabel` finds a control through its `<label for>`, a wrapping `<label>`, `aria-labelledby` or `aria-label`. `GetByText`, `GetByLabel`, `GetByPlaceholder`, `GetByTitle` and `GetByAltText` match a case-insensitive substring by default; pass `exact: true` to require the whole text, case-sensitively. `GetByRole` reads the browser's accessibility tree, which only Chromium-based browsers expose, so on Firefox it throws a `NotSupportedException` and `GetByLabel`, `GetByText` or `GetByTestId` is the one to use; every other locator works on both:
 
 ```csharp
 Page.GetByText("welcome")               // matches "Welcome back, Ada"
diff --git a/docs/guides/frames-and-iframes.md b/docs/guides/frames-and-iframes.md
index 9a3c831..a6b5069 100644
--- a/docs/guides/frames-and-iframes.md
+++ b/docs/guides/frames-and-iframes.md
@@ -4,6 +4,8 @@ A page is a tree of frames. The main frame is the document you navigated to; eve
 
 Some of those frames run in a renderer process of their own. That changes a great deal underneath and nothing at all in the API: an out-of-process frame is discovered, traversed, evaluated, and clicked exactly like any other.
 
+Frames are reported on Chromium-based browsers. A Firefox page does not report the frames inside it yet, so there `page.Frames` holds only the main frame.
+
 ---
 
 ## Traversing
diff --git a/docs/guides/mcp-server.md b/docs/guides/mcp-server.md
index 891ab0f..9a29c62 100644
--- a/docs/guides/mcp-server.md
+++ b/docs/guides/mcp-server.md
@@ -309,7 +309,7 @@ An agent can also attach at any point with `browser_attach`, which is what to re
 motus mcp --allow-attach
 ```
 
-Attaching speaks the Chrome DevTools Protocol, so the browser at the other end is a Chromium-based one; Firefox is driven only by a session the server starts, with `--channel firefox`. Snapshot refs are unavailable in a Firefox session either way, because the accessibility tree they are built from is read over that same protocol: the `snapshot` tool says so rather than describing the page, and the coordinate tools take over from there with `--caps coordinates`.
+Attaching speaks the Chrome DevTools Protocol, so the browser at the other end is a Chromium-based one; Firefox is driven only by a session the server starts, with `--channel firefox`. Snapshot refs are unavailable in a Firefox session either way, because the accessibility tree they are built from is read over that same protocol: the `snapshot` tool says so rather than describing the page. A selector still reaches an element anywhere a ref is accepted, except a `role=` selector, which reads that same tree, and the coordinate tools take over from there with `--caps coordinates`.
 
 Three consequences are worth knowing:
 
@@ -429,7 +429,7 @@ navigate(url: "https://example.com/status", snapshot: true)
 |---|---|---|
 | `--connect` | _(none)_ | Drive a browser that is already running instead of starting one. Takes the debugging endpoint it was started with (`http://127.0.0.1:9222`) or its CDP WebSocket URL. The browser is never closed by the server, and the options that describe starting one no longer apply. |
 | `--headless` | `true` | Run the browser without a visible window. Pass `--headless false` to watch the agent drive a real window. |
-| `--channel` | `chromium` | Browser to drive: `chromium`, `chrome`, `edge`, or `firefox`. A channel named here has to be installed: the server stops with an error rather than starting a different browser in its place. Snapshot refs need a Chromium-based browser, because the accessibility tree they are built from is read over the Chrome DevTools Protocol; on Firefox the `snapshot` tool says so rather than describing the page, and the coordinate tools still work against a screenshot, which makes `--caps coordinates` worth adding for a Firefox session. |
+| `--channel` | `chromium` | Browser to drive: `chromium`, `chrome`, `edge`, or `firefox`. A channel named here has to be installed: the server stops with an error rather than starting a different browser in its place. Snapshot refs need a Chromium-based browser, because the accessibility tree they are built from is read over the Chrome DevTools Protocol; on Firefox the `snapshot` tool says so rather than describing the page, selectors other than `role=` still work in place of refs, and the coordinate tools still work against a screenshot, which makes `--caps coordinates` worth adding for a Firefox session. |
 | `--executable-path` | _(none)_ | Start this browser binary instead of resolving one from `--channel`. Pins a session to an exact build, and is the way past a channel the server cannot find. |
 | `--browser-arg` | _(none)_ | An extra command-line argument for the browser. Attach the value with `=`, and repeat the flag for more than one: `--browser-arg=--no-sandbox --browser-arg=--disable-dev-shm-usage`. Chromium refuses to start as root, so a container usually needs `--no-sandbox`. |
 | `--user-data-dir` | _(none)_ | Browser profile directory. Cookies, history, and signed-in sessions persist in it between runs instead of every session starting clean. |
diff --git a/src/Motus/Locator/Locator.cs b/src/Motus/Locator/Locator.cs
index ac8541f..c42a8df 100644
--- a/src/Motus/Locator/Locator.cs
+++ b/src/Motus/Locator/Locator.cs
@@ -58,6 +58,13 @@ private Locator(Page page, Frame? frameRoot, string selector, int? nthIndex, str
     // The frame this locator resolves against, falling back to the page's main frame.
     private IFrame ResolutionFrame => _frameRoot ?? _page.GetFrameForSelectors();
 
+    // Whether the locator is rooted at a frame inside the page, rather than at the page or its main
+    // frame. Only such a frame has a viewport of its own, so only its elements need measuring in
+    // the page's coordinate space. A main-frame root is measured the way a page-level locator is,
+    // which also keeps it off the Chromium-only box model command.
+    private bool IsRootedInChildFrame =>
+        _frameRoot is not null && !ReferenceEquals(_frameRoot, _page.GetFrameForSelectors());
+
     // The session that owns this locator's frame. Always the page session while every frame
     // renders in the page's process, but looked up so that stops being an assumption.
     private IMotusSession Session => _page.SessionFor(_frameRoot);
@@ -119,6 +126,10 @@ internal async Task<bool> HasClassAsync(string className, CancellationToken ct)
 
     private async Task<AccessibilityAXNodeSimple?> QuerySingleAXNodeAsync(CancellationToken ct)
     {
+        // Checked before resolving, so an element that has not rendered yet does not hold the
+        // assertion polling until its timeout for an answer it could never give.
+        CapabilityGuard.RequireAccessibilityTree(Session, "ToHaveAccessibleNameAsync and ToHaveRoleAsync");
+
         var objectId = await ResolveObjectIdCoreAsync(ct).ConfigureAwait(false);
 
         if (!_accessibilityEnabled)
@@ -493,7 +504,7 @@ private async Task<BoundingBox> GetBoundingBoxOrThrowAsync(string objectId, Canc
         // and touch input is dispatched in the page's coordinate space. Reading the rect through
         // the element would aim input at the frame's offset rather than the element, so a
         // frame-rooted locator measures with the box model, which is reported against the page.
-        if (_frameRoot is not null)
+        if (IsRootedInChildFrame)
         {
             var pageBox = await GetPageRelativeBoxAsync(objectId, ct).ConfigureAwait(false);
             if (pageBox is not null)
@@ -701,7 +712,7 @@ internal static (int parentSteps, string remaining) ParseParentPrefix(string sel
     private async Task<bool> ScrollIntoViewAsync(string objectId, CancellationToken ct)
     {
         var scrolled = await ActionabilityChecker.ScrollIntoViewIfNeededAsync(Session, objectId, ct).ConfigureAwait(false);
-        if (_frameRoot is null)
+        if (!IsRootedInChildFrame)
             return true;
 
         var box = await GetPageRelativeBoxAsync(objectId, ct).ConfigureAwait(false);
@@ -1182,7 +1193,7 @@ public async Task<string> InputValueAsync(double? timeout = null)
         // Reported in the page's coordinate space, the same space input is dispatched in, so a box
         // read here can be handed straight to the mouse. Measuring through the element instead
         // would answer in the frame's own space and quietly disagree with where a click lands.
-        if (_frameRoot is not null)
+        if (IsRootedInChildFrame)
         {
             var pageBox = await GetPageRelativeBoxAsync(objectId, cts.Token).ConfigureAwait(false);
             if (pageBox is not null)
diff --git a/src/Motus/Selectors/RoleSelectorStrategy.cs b/src/Motus/Selectors/RoleSelectorStrategy.cs
index cd6fb75..740eae2 100644
--- a/src/Motus/Selectors/RoleSelectorStrategy.cs
+++ b/src/Motus/Selectors/RoleSelectorStrategy.cs
@@ -28,8 +28,8 @@ public async Task<IReadOnlyList<IElementHandle>> ResolveAsync(
     {
         var page = SelectorStrategyHelpers.GetPage(frame);
         var session = page.SessionFor(frame);
-        CapabilityGuard.Require(session.Capabilities, MotusCapabilities.AccessibilityTree,
-            "Role selector (Accessibility.queryAXTree)", CapabilityGuard.GetTransportDescription(session));
+        CapabilityGuard.RequireAccessibilityTree(session, "GetByRole and role= selectors",
+            "Match by label, text, test id or CSS selector instead.");
 
         var (role, name) = ParseRoleSelector(selector);
 
diff --git a/src/Motus/Transport/BiDi/BiDiJsonContext.cs b/src/Motus/Transport/BiDi/BiDiJsonContext.cs
index 1b42ab6..446570d 100644
--- a/src/Motus/Transport/BiDi/BiDiJsonContext.cs
+++ b/src/Motus/Transport/BiDi/BiDiJsonContext.cs
@@ -92,17 +92,19 @@ internal sealed record BiDiScriptEvaluateResult(
     [property: JsonPropertyName("result")] BiDiScriptRemoteValue? Result = null,
     [property: JsonPropertyName("exceptionDetails")] BiDiScriptExceptionDetails? ExceptionDetails = null);
 
-internal sealed record BiDiScriptLocalValue(
-    [property: JsonPropertyName("type")] string Type,
-    [property: JsonPropertyName("value")] JsonElement? Value = null);
+internal sealed record BiDiScriptSerializationOptions(
+    [property: JsonPropertyName("maxObjectDepth")] int? MaxObjectDepth = null);
 
+// Arguments and this are local values or remote references, whose shape depends on what they
+// carry, so they are built as JSON by BiDiScriptValues rather than modelled here.
 internal sealed record BiDiScriptCallFunctionParams(
     [property: JsonPropertyName("functionDeclaration")] string FunctionDeclaration,
     [property: JsonPropertyName("awaitPromise")] bool AwaitPromise,
     [property: JsonPropertyName("target")] BiDiScriptTarget Target,
-    [property: JsonPropertyName("arguments")] BiDiScriptLocalValue[]? Arguments = null,
+    [property: JsonPropertyName("arguments")] JsonElement[]? Arguments = null,
     [property: JsonPropertyName("resultOwnership")] string? ResultOwnership = null,
-    [property: JsonPropertyName("this")] BiDiScriptLocalValue? This = null);
+    [property: JsonPropertyName("this")] JsonElement? This = null,
+    [property: JsonPropertyName("serializationOptions")] BiDiScriptSerializationOptions? SerializationOptions = null);
 
 internal sealed record BiDiScriptCallFunctionResult(
     [property: JsonPropertyName("type")] string Type,
@@ -119,6 +121,11 @@ internal sealed record BiDiInputPerformActionsParams(
 
 internal sealed record BiDiInputPerformActionsResult;
 
+internal sealed record BiDiInputSetFilesParams(
+    [property: JsonPropertyName("context")] string Context,
+    [property: JsonPropertyName("element")] JsonElement Element,
+    [property: JsonPropertyName("files")] string[] Files);
+
 internal sealed record BiDiInputActionSequence(
     [property: JsonPropertyName("type")] string Type,
     [property: JsonPropertyName("id")] string Id,
@@ -213,12 +220,13 @@ internal sealed record BiDiNetworkHeader(
 [JsonSerializable(typeof(BiDiScriptExceptionDetails))]
 [JsonSerializable(typeof(BiDiScriptEvaluateParams))]
 [JsonSerializable(typeof(BiDiScriptEvaluateResult))]
-[JsonSerializable(typeof(BiDiScriptLocalValue))]
+[JsonSerializable(typeof(BiDiScriptSerializationOptions))]
 [JsonSerializable(typeof(BiDiScriptCallFunctionParams))]
 [JsonSerializable(typeof(BiDiScriptCallFunctionResult))]
 // Input domain
 [JsonSerializable(typeof(BiDiInputPerformActionsParams))]
 [JsonSerializable(typeof(BiDiInputPerformActionsResult))]
+[JsonSerializable(typeof(BiDiInputSetFilesParams))]
 [JsonSerializable(typeof(BiDiInputActionSequence))]
 [JsonSerializable(typeof(BiDiInputSourceParameters))]
 [JsonSerializable(typeof(BiDiInputAction))]
diff --git a/src/Motus/Transport/BiDi/BiDiScriptValues.cs b/src/Motus/Transport/BiDi/BiDiScriptValues.cs
new file mode 100644
index 0000000..80d4452
--- /dev/null
+++ b/src/Motus/Transport/BiDi/BiDiScriptValues.cs
@@ -0,0 +1,319 @@
+using System.Text.Json;
+
+namespace Motus;
+
+/// <summary>
+/// Converts between the values CDP script commands carry and the ones WebDriver BiDi expects:
+/// remote object ids and remote references, CDP call arguments and BiDi local values, and BiDi
+/// remote values and the plain JSON a CDP call made by value returns.
+/// </summary>
+/// <remarks>
+/// <para>
+/// The engine keeps one opaque string per remote object, the CDP <c>objectId</c>, but BiDi has two
+/// ways to name one. A handle names any object in the realm that made it, and only while that
+/// realm lives. A shared id names a DOM node, is the same every time the node is serialized, and
+/// is accepted from any realm of the node's document. Nodes are handed out by shared id, so an
+/// element found by one query is the same id when another query finds it again, and every other
+/// object by handle. A shared id carries <see cref="SharedIdPrefix"/> so it can be told apart when
+/// it comes back as <c>this</c> or as an argument; a handle is passed through as it is.
+/// </para>
+/// <para>
+/// BiDi serializes structured values as typed remote values, an object as a list of key and value
+/// pairs, rather than as JSON. A CDP call made by value expects the JSON <c>JSON.stringify</c>
+/// would give, so the remote value is rebuilt into that shape, and a CDP argument is turned into
+/// the local value BiDi expects the same way in reverse.
+/// </para>
+/// </remarks>
+internal static class BiDiScriptValues
+{
+    /// <summary>
+    /// Marks an object id that is a BiDi shared id rather than a handle.
+    /// </summary>
+    internal const string SharedIdPrefix = "sharedId:";
+
+    /// <summary>
+    /// The object id for a BiDi remote value: its shared id for a node, its handle otherwise, or
+    /// null when it has neither.
+    /// </summary>
+    internal static string? ToObjectId(JsonElement remoteValue)
+    {
+        if (remoteValue.ValueKind != JsonValueKind.Object)
+            return null;
+
+        var sharedId = remoteValue.GetStringOrNull("sharedId");
+        if (sharedId is not null)
+            return SharedIdPrefix + sharedId;
+
+        return remoteValue.GetStringOrNull("handle");
+    }
+
+    /// <summary>
+    /// The shared id inside an object id, or null when the object id is a handle.
+    /// </summary>
+    internal static string? SharedIdOf(string objectId) =>
+        objectId.StartsWith(SharedIdPrefix, StringComparison.Ordinal)
+            ? objectId[SharedIdPrefix.Length..]
+            : null;
+
+    /// <summary>
+    /// The BiDi remote reference for an object id: <c>{ "sharedId": ... }</c> for a node and
+    /// <c>{ "handle": ... }</c> for anything else.
+    /// </summary>
+    internal static JsonElement ToRemoteReference(string objectId)
+    {
+        var sharedId = SharedIdOf(objectId);
+        return sharedId is not null
+            ? JsonBuilder.FromObject(new { sharedId })
+            : JsonBuilder.FromObject(new { handle = objectId });
+    }
+
+    /// <summary>
+    /// The BiDi local value for a CDP call argument, which names a remote object, carries a value,
+    /// carries an unserializable number, or is empty for <c>undefined</c>.
+    /// </summary>
+    internal static JsonElement ToLocalValue(JsonElement cdpArgument)
+    {
+        var objectId = cdpArgument.GetStringOrNull("objectId");
+        if (objectId is not null)
+            return ToRemoteReference(objectId);
+
+        var unserializable = cdpArgument.GetStringOrNull("unserializableValue");
+        if (unserializable is not null)
+        {
+            return unserializable.EndsWith('n')
+                ? JsonBuilder.FromObject(new { type = "bigint", value = unserializable[..^1] })
+                : JsonBuilder.FromObject(new { type = "number", value = unserializable });
+        }
+
+        return cdpArgument.TryGetProperty("value", out var value)
+            ? FromJson(value)
+            : JsonBuilder.FromObject(new { type = "undefined" });
+    }
+
+    /// <summary>
+    /// The BiDi local value for a JSON value.
+    /// </summary>
+    internal static JsonElement FromJson(JsonElement value)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream))
+            WriteLocalValue(writer, value);
+
+        using var doc = JsonDocument.Parse(stream.ToArray());
+        return doc.RootElement.Clone();
+    }
+
+    private static void WriteLocalValue(Utf8JsonWriter writer, JsonElement value)
+    {
+        writer.WriteStartObject();
+        switch (value.ValueKind)
+        {
+            case JsonValueKind.String:
+                writer.WriteString("type", "string");
+                writer.WritePropertyName("value");
+                value.WriteTo(writer);
+                break;
+            case JsonValueKind.Number:
+                writer.WriteString("type", "number");
+                writer.WritePropertyName("value");
+                value.WriteTo(writer);
+                break;
+            case JsonValueKind.True:
+            case JsonValueKind.False:
+                writer.WriteString("type", "boolean");
+                writer.WriteBoolean("value", value.GetBoolean());
+                break;
+            case JsonValueKind.Array:
+                writer.WriteString("type", "array");
+                writer.WriteStartArray("value");
+                foreach (var item in value.EnumerateArray())
+                    WriteLocalValue(writer, item);
+                writer.WriteEndArray();
+                break;
+            case JsonValueKind.Object:
+                writer.WriteString("type", "object");
+                writer.WriteStartArray("value");
+                foreach (var property in value.EnumerateObject())
+                {
+                    writer.WriteStartArray();
+                    writer.WriteStringValue(property.Name);
+                    WriteLocalValue(writer, property.Value);
+                    writer.WriteEndArray();
+                }
+                writer.WriteEndArray();
+                break;
+            case JsonValueKind.Null:
+                writer.WriteString("type", "null");
+                break;
+            default:
+                writer.WriteString("type", "undefined");
+                break;
+        }
+        writer.WriteEndObject();
+    }
+
+    /// <summary>
+    /// The CDP remote object for a BiDi remote value: its type, its object id when it has one, and
+    /// its value as JSON when it has one.
+    /// </summary>
+    internal static object ToCdpRemoteObject(JsonElement remoteValue)
+    {
+        var type = remoteValue.GetStringOrNull("type") ?? "undefined";
+        var (cdpType, cdpSubtype) = MapType(type);
+        var objectId = ToObjectId(remoteValue);
+
+        // A number JSON cannot hold arrives as a string, and CDP reports it the same way.
+        if (type == "number" && remoteValue.TryGetProperty("value", out var number)
+            && number.ValueKind == JsonValueKind.String)
+        {
+            return new { type = cdpType, unserializableValue = number.GetString() };
+        }
+
+        if (type == "bigint" && remoteValue.GetStringOrNull("value") is { } digits)
+            return new { type = cdpType, unserializableValue = digits + "n" };
+
+        var json = ToJson(remoteValue);
+        return json is null
+            ? new { type = cdpType, subtype = cdpSubtype, objectId }
+            : new { type = cdpType, subtype = cdpSubtype, value = (object?)json, objectId };
+    }
+
+    /// <summary>
+    /// Rebuilds a BiDi remote value as the JSON <c>JSON.stringify</c> would give for it, or null
+    /// when there is none, as for <c>undefined</c> and functions.
+    /// </summary>
+    /// <remarks>
+    /// Arrays and plain objects are rebuilt from their serialized contents. A node, a map, a
+    /// regular expression and any other object becomes an empty object, which is what CDP returns
+    /// for them by value too. A value BiDi did not serialize, because it was already seen higher up
+    /// or lies past the serialization depth, has no contents and becomes an empty array or object.
+    /// </remarks>
+    internal static JsonElement? ToJson(JsonElement remoteValue)
+    {
+        using var stream = new MemoryStream();
+        using (var writer = new Utf8JsonWriter(stream))
+        {
+            if (!WriteJson(writer, remoteValue))
+                return null;
+        }
+
+        using var doc = JsonDocument.Parse(stream.ToArray());
+        return doc.RootElement.Clone();
+    }
+
+    // Writes the JSON for a remote value, or nothing and false when JSON has no value for it, so a
+    // caller writing an object leaves the key out and one writing an array writes null instead.
+    private static bool WriteJson(Utf8JsonWriter writer, JsonElement remoteValue)
+    {
+        var type = remoteValue.GetStringOrNull("type");
+        remoteValue.TryGetProperty("value", out var value);
+
+        switch (type)
+        {
+            case "undefined":
+            case "function":
+            case "symbol":
+                return false;
+            case "null":
+                writer.WriteNullValue();
+                return true;
+            case "string":
+            case "bigint":
+            case "date":
+                writer.WriteStringValue(value.ValueKind == JsonValueKind.String ? value.GetString() : string.Empty);
+                return true;
+            case "boolean":
+                writer.WriteBooleanValue(value.ValueKind == JsonValueKind.True);
+                return true;
+            case "number":
+                WriteNumber(writer, value);
+                return true;
+            case "array":
+                writer.WriteStartArray();
+                if (value.ValueKind == JsonValueKind.Array)
+                {
+                    foreach (var item in value.EnumerateArray())
+                    {
+                        if (!WriteJson(writer, item))
+                            writer.WriteNullValue();
+                    }
+                }
+                writer.WriteEndArray();
+                return true;
+            case "object":
+                writer.WriteStartObject();
+                if (value.ValueKind == JsonValueKind.Array)
+                {
+                    foreach (var pair in value.EnumerateArray())
+                    {
+                        if (pair.ValueKind != JsonValueKind.Array || pair.GetArrayLength() != 2)
+                            continue;
+
+                        var key = pair[0].ValueKind == JsonValueKind.String
+                            ? pair[0].GetString()!
+                            : pair[0].GetStringOrNull("value") ?? string.Empty;
+
+                        // Written to a scratch buffer first, because a value JSON leaves out takes
+                        // its key with it.
+                        using var buffer = new MemoryStream();
+                        using (var inner = new Utf8JsonWriter(buffer))
+                        {
+                            if (!WriteJson(inner, pair[1]))
+                                continue;
+                        }
+
+                        writer.WritePropertyName(key);
+                        using var doc = JsonDocument.Parse(buffer.ToArray());
+                        doc.RootElement.WriteTo(writer);
+                    }
+                }
+                writer.WriteEndObject();
+                return true;
+            default:
+                writer.WriteStartObject();
+                writer.WriteEndObject();
+                return true;
+        }
+    }
+
+    // NaN and the infinities have no JSON spelling and become null, as JSON.stringify makes them;
+    // negative zero is zero.
+    private static void WriteNumber(Utf8JsonWriter writer, JsonElement value)
+    {
+        if (value.ValueKind == JsonValueKind.Number)
+        {
+            value.WriteTo(writer);
+            return;
+        }
+
+        if (value.ValueKind == JsonValueKind.String && value.GetString() == "-0")
+        {
+            writer.WriteNumberValue(0);
+            return;
+        }
+
+        writer.WriteNullValue();
+    }
+
+    private static (string type, string? subtype) MapType(string biDiType) => biDiType switch
+    {
+        "string" => ("string", null),
+        "number" => ("number", null),
+        "bigint" => ("bigint", null),
+        "boolean" => ("boolean", null),
+        "symbol" => ("symbol", null),
+        "function" => ("function", null),
+        "null" => ("object", "null"),
+        "undefined" => ("undefined", null),
+        "array" => ("object", "array"),
+        "node" => ("object", "node"),
+        "regexp" => ("object", "regexp"),
+        "date" => ("object", "date"),
+        "map" => ("object", "map"),
+        "set" => ("object", "set"),
+        "error" => ("object", "error"),
+        "promise" => ("object", "promise"),
+        "object" => ("object", null),
+        _ => ("object", null)
+    };
+}
diff --git a/src/Motus/Transport/BiDi/BiDiTranslationRegistry.cs b/src/Motus/Transport/BiDi/BiDiTranslationRegistry.cs
index fa3d558..d157fb9 100644
--- a/src/Motus/Transport/BiDi/BiDiTranslationRegistry.cs
+++ b/src/Motus/Transport/BiDi/BiDiTranslationRegistry.cs
@@ -1,3 +1,4 @@
+using System.Globalization;
 using System.Text.Json;
 
 namespace Motus;
@@ -48,12 +49,14 @@ private static Dictionary<string, IBiDiTranslation> BuildTranslations()
             // Script
             new RuntimeEvaluateTranslation(),
             new RuntimeCallFunctionOnTranslation(),
+            new RuntimeGetPropertiesTranslation(),
             new RuntimeReleaseObjectTranslation(),
 
             // Input
             new InputDispatchKeyEventTranslation(),
             new InputDispatchMouseEventTranslation(),
             new InputDispatchTouchEventTranslation(),
+            new DomSetFileInputFilesTranslation(),
 
             // Network
             new FetchEnableTranslation(),
@@ -459,6 +462,11 @@ public JsonElement TranslateResult(JsonElement bidiResult)
 /// CDP params: { functionDeclaration, objectId?, arguments?, returnByValue?, awaitPromise? }
 /// CDP result: { result: RuntimeRemoteObject, exceptionDetails? }
 /// </summary>
+/// <remarks>
+/// The object id becomes <c>this</c> and each argument a local value, both as
+/// <see cref="BiDiScriptValues"/> describes. Every argument is passed on, an empty one as
+/// <c>undefined</c>, so the ones after it keep their positions.
+/// </remarks>
 internal sealed class RuntimeCallFunctionOnTranslation : IBiDiTranslation
 {
     public string CdpMethod => "Runtime.callFunctionOn";
@@ -470,33 +478,18 @@ public JsonElement TranslateParams(JsonElement cdpParams, string? contextId)
         var awaitPromise = cdpParams.GetBoolOrDefault("awaitPromise", false);
         var returnByValue = cdpParams.GetBoolOrDefault("returnByValue", false);
 
-        // Build BiDi arguments from CDP arguments
-        BiDiScriptLocalValue[]? bidiArgs = null;
+        JsonElement[]? bidiArgs = null;
         if (cdpParams.TryGetProperty("arguments", out var args) &&
-            args.ValueKind == JsonValueKind.Array)
+            args.ValueKind == JsonValueKind.Array &&
+            args.GetArrayLength() > 0)
         {
-            var list = new List<BiDiScriptLocalValue>();
-            foreach (var arg in args.EnumerateArray())
-            {
-                if (arg.TryGetProperty("value", out var val))
-                {
-                    list.Add(new BiDiScriptLocalValue(
-                        Type: MapValueKindToType(val.ValueKind),
-                        Value: val));
-                }
-            }
-            bidiArgs = list.Count > 0 ? list.ToArray() : null;
+            bidiArgs = args.EnumerateArray().Select(BiDiScriptValues.ToLocalValue).ToArray();
         }
 
-        // Map objectId to a "this" reference
-        BiDiScriptLocalValue? thisRef = null;
         var objectId = cdpParams.GetStringOrNull("objectId");
-        if (objectId is not null)
-        {
-            thisRef = new BiDiScriptLocalValue(
-                Type: "handle",
-                Value: JsonSerializer.SerializeToElement(objectId));
-        }
+        JsonElement? thisRef = objectId is not null
+            ? BiDiScriptValues.ToRemoteReference(objectId)
+            : null;
 
         return JsonSerializer.SerializeToElement(
             new BiDiScriptCallFunctionParams(
@@ -511,17 +504,83 @@ public JsonElement TranslateParams(JsonElement cdpParams, string? contextId)
 
     public JsonElement TranslateResult(JsonElement bidiResult)
         => ScriptResultTranslator.ToCdpResult(bidiResult);
+}
 
-    private static string MapValueKindToType(JsonValueKind kind) => kind switch
+/// <summary>
+/// Runtime.getProperties -> script.callFunction
+/// CDP params: { objectId, ownProperties? }
+/// CDP result: { result: [{ name, value: RuntimeRemoteObject }] }
+/// </summary>
+/// <remarks>
+/// BiDi has no command that lists an object's properties, but serializing an array or an object
+/// carries its contents, and every node among them carries the shared id that names it. So the
+/// object is handed back to itself as <c>this</c> and returned, one level deep, and each element
+/// or entry becomes a property. That is enough for what the engine reads properties for: the
+/// elements of an array of matches. Only nodes and primitives come back usable; any other object
+/// among the contents has its serialized value but no object id, since BiDi gives a handle only to
+/// the value a call returns.
+/// </remarks>
+internal sealed class RuntimeGetPropertiesTranslation : IBiDiTranslation
+{
+    public string CdpMethod => "Runtime.getProperties";
+    public string BiDiMethod => "script.callFunction";
+
+    public JsonElement TranslateParams(JsonElement cdpParams, string? contextId)
     {
-        JsonValueKind.String => "string",
-        JsonValueKind.Number => "number",
-        JsonValueKind.True or JsonValueKind.False => "boolean",
-        JsonValueKind.Null => "null",
-        JsonValueKind.Array => "array",
-        JsonValueKind.Object => "object",
-        _ => "undefined"
-    };
+        var objectId = cdpParams.GetStringOrNull("objectId") ?? string.Empty;
+
+        return JsonSerializer.SerializeToElement(
+            new BiDiScriptCallFunctionParams(
+                FunctionDeclaration: "function() { return this; }",
+                AwaitPromise: false,
+                Target: new BiDiScriptTarget(Context: contextId ?? string.Empty),
+                ResultOwnership: "none",
+                This: BiDiScriptValues.ToRemoteReference(objectId),
+                SerializationOptions: new BiDiScriptSerializationOptions(MaxObjectDepth: 1)),
+            BiDiJsonContext.Default.BiDiScriptCallFunctionParams);
+    }
+
+    public JsonElement TranslateResult(JsonElement bidiResult)
+    {
+        if (bidiResult.GetStringOrNull("type") == "exception")
+        {
+            var text = bidiResult.TryGetProperty("exceptionDetails", out var details)
+                ? details.GetStringOrNull("text")
+                : null;
+            throw new BiDiProtocolException($"Reading the object's properties failed: {text ?? "Evaluation failed"}");
+        }
+
+        var properties = new List<object>();
+        if (bidiResult.TryGetProperty("result", out var remoteValue) &&
+            remoteValue.TryGetProperty("value", out var contents) &&
+            contents.ValueKind == JsonValueKind.Array)
+        {
+            var isArray = remoteValue.GetStringOrNull("type") is "array" or "nodelist" or "htmlcollection";
+            var index = 0;
+            foreach (var item in contents.EnumerateArray())
+            {
+                if (isArray)
+                {
+                    properties.Add(new
+                    {
+                        name = (index++).ToString(CultureInfo.InvariantCulture),
+                        value = BiDiScriptValues.ToCdpRemoteObject(item)
+                    });
+                }
+                else if (item.ValueKind == JsonValueKind.Array && item.GetArrayLength() == 2 &&
+                         item[0].ValueKind == JsonValueKind.String)
+                {
+                    properties.Add(new
+                    {
+                        name = item[0].GetString(),
+                        value = BiDiScriptValues.ToCdpRemoteObject(item[1])
+                    });
+                }
+            }
+        }
+
+        return JsonBuilder.FromObject(new { result = properties });
+    }
 }
 
 /// <summary>
@@ -546,7 +605,7 @@ internal static class ScriptResultTranslator
 {
     internal static JsonElement ToCdpResult(JsonElement bidiResult)
     {
-        // BiDi result: { type: "success"|"exception", result?: { type, value?, handle? }, exceptionDetails? }
+        // BiDi result: { type: "success"|"exception", result?: RemoteValue, exceptionDetails? }
         var resultType = bidiResult.GetStringOrNull("type") ?? "success";
 
         if (resultType == "exception")
@@ -565,59 +624,11 @@ internal static JsonElement ToCdpResult(JsonElement bidiResult)
             });
         }
 
-        // Success path
         if (bidiResult.TryGetProperty("result", out var remoteValue))
-        {
-            var type = remoteValue.GetStringOrNull("type") ?? "undefined";
-            var handle = remoteValue.GetStringOrNull("handle");
-
-            // Map BiDi type to CDP type
-            var (cdpType, cdpSubtype) = MapBiDiTypeToCdp(type);
-
-            if (remoteValue.TryGetProperty("value", out var value))
-            {
-                return JsonBuilder.FromObject(new
-                {
-                    result = new
-                    {
-                        type = cdpType,
-                        subtype = cdpSubtype,
-                        value = (object?)value,
-                        objectId = handle
-                    }
-                });
-            }
-
-            return JsonBuilder.FromObject(new
-            {
-                result = new
-                {
-                    type = cdpType,
-                    subtype = cdpSubtype,
-                    objectId = handle
-                }
-            });
-        }
+            return JsonBuilder.FromObject(new { result = BiDiScriptValues.ToCdpRemoteObject(remoteValue) });
 
         return JsonBuilder.FromObject(new { result = new { type = "undefined" } });
     }
-
-    private static (string type, string? subtype) MapBiDiTypeToCdp(string biDiType) => biDiType switch
-    {
-        "string" => ("string", null),
-        "number" => ("number", null),
-        "boolean" => ("boolean", null),
-        "null" => ("object", "null"),
-        "undefined" => ("undefined", null),
-        "array" => ("object", "array"),
-        "node" => ("object", "node"),
-        "regexp" => ("object", "regexp"),
-        "date" => ("object", "date"),
-        "map" => ("object", "map"),
-        "set" => ("object", "set"),
-        "object" => ("object", null),
-        _ => ("object", null)
-    };
 }
 
 // ──────────────────────────────────────────────
@@ -817,6 +828,43 @@ public JsonElement TranslateResult(JsonElement bidiResult)
         => JsonBuilder.Empty();
 }
 
+/// <summary>
+/// DOM.setFileInputFiles -> input.setFiles
+/// CDP params: { files, objectId }
+/// BiDi params: { context, element: { sharedId }, files }
+/// </summary>
+/// <remarks>
+/// BiDi names the input by its shared id, which every element a locator or a query hands out
+/// carries. An input reached any other way has no shared id to send.
+/// </remarks>
+internal sealed class DomSetFileInputFilesTranslation : IBiDiTranslation
+{
+    public string CdpMethod => "DOM.setFileInputFiles";
+    public string BiDiMethod => "input.setFiles";
+
+    public JsonElement TranslateParams(JsonElement cdpParams, string? contextId)
+    {
+        var objectId = cdpParams.GetStringOrNull("objectId");
+        var sharedId = objectId is null ? null : BiDiScriptValues.SharedIdOf(objectId);
+        if (sharedId is null)
+            throw new BiDiProtocolException("Setting input files needs the input element, and none was given.");
+
+        var files = cdpParams.TryGetProperty("files", out var list) && list.ValueKind == JsonValueKind.Array
+            ? list.EnumerateArray().Select(f => f.GetString() ?? string.Empty).ToArray()
+            : [];
+
+        return JsonSerializer.SerializeToElement(
+            new BiDiInputSetFilesParams(
+                Context: contextId ?? string.Empty,
+                Element: BiDiScriptValues.ToRemoteReference(objectId!),
+                Files: files),
+            BiDiJsonContext.Default.BiDiInputSetFilesParams);
+    }
+
+    public JsonElement TranslateResult(JsonElement bidiResult)
+        => JsonBuilder.Empty();
+}
+
 // ──────────────────────────────────────────────
 // Network translations
 // ──────────────────────────────────────────────
diff --git a/src/Motus/Transport/MotusCapabilities.cs b/src/Motus/Transport/MotusCapabilities.cs
index 5b225c6..ad84344 100644
--- a/src/Motus/Transport/MotusCapabilities.cs
+++ b/src/Motus/Transport/MotusCapabilities.cs
@@ -68,6 +68,24 @@ internal static void Require(
         }
     }
 
+    /// <summary>
+    /// Fails unless the session can read the browser's accessibility tree, saying which feature
+    /// needed it and that only a Chromium-based browser has one to read.
+    /// </summary>
+    /// <param name="session">The session the feature would read the tree through.</param>
+    /// <param name="featureName">What needed the tree, written as the subject of "read".</param>
+    /// <param name="alternative">What to use instead, as a sentence, or null.</param>
+    internal static void RequireAccessibilityTree(
+        IMotusSession session, string featureName, string? alternative = null)
+    {
+        if ((session.Capabilities & MotusCapabilities.AccessibilityTree) != 0)
+            return;
+
+        var message = $"{featureName} read the browser's accessibility tree, which only Chromium-based " +
+                      $"browsers expose, and this browser is driven over {GetTransportDescription(session)}.";
+        throw new NotSupportedException(alternative is null ? message : message + " " + alternative);
+    }
+
     internal static string GetTransportDescription(IMotusTransport transport) => transport switch
     {
         CdpTransport => "Chrome/CDP",
diff --git a/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs b/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs
index 73aabee..5e4fca7 100644
--- a/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs
+++ b/tests/Motus.Tests/Browser/FirefoxIntegrationTests.cs
@@ -173,7 +173,7 @@ public async Task Firefox_EvaluateRightAfterNavigation_Succeeds()
     /// <summary>
     /// Pointer actions scroll their target into view with a script that runs in the page rather
     /// than with a Chromium-only command, so the script has to behave the same under Firefox. It is
-    /// run directly here because locator resolution is not yet translated for WebDriver BiDi.
+    /// run directly here so the scroll decisions can be checked one at a time.
     /// </summary>
     [TestMethod]
     public async Task Firefox_ScrollIntoViewScript_ScrollsOnlyWhenNeeded()
diff --git a/tests/Motus.Tests/Locator/FirefoxLocatorIntegrationTests.cs b/tests/Motus.Tests/Locator/FirefoxLocatorIntegrationTests.cs
new file mode 100644
index 0000000..ab77376
--- /dev/null
+++ b/tests/Motus.Tests/Locator/FirefoxLocatorIntegrationTests.cs
@@ -0,0 +1,358 @@
+using System.Diagnostics;
+using Motus.Abstractions;
+using Motus.Assertions;
+
+namespace Motus.Tests.Locator;
+
+/// <summary>
+/// Pins that locators work on Firefox, where every command reaches the browser through the
+/// WebDriver BiDi translation rather than CDP.
+/// </summary>
+/// <remarks>
+/// A locator turns its matches into element handles and then drives each one through script calls
+/// that name the element, so these cover every selector strategy that runs in the page, the
+/// chained and parent queries that start from an element, the actions that scroll and confirm what
+/// they did, and the assertions that wait for an element to appear. <c>GetByRole</c> reads the
+/// accessibility tree, which WebDriver BiDi does not expose, and is pinned to fail with a clear
+/// message instead.
+/// </remarks>
+[TestClass]
+[TestCategory("Integration")]
+[TestCategory("Firefox")]
+public class FirefoxLocatorIntegrationTests
+{
+    private static IBrowser? s_browser;
+    private IBrowserContext? _context;
+    private IPage? _page;
+
+    [ClassInitialize]
+    public static async Task ClassSetup(TestContext _)
+    {
+        try
+        {
+            BrowserFinder.Resolve(BrowserChannel.Firefox, executablePath: null);
+        }
+        catch (FileNotFoundException)
+        {
+            return;
+        }
+
+        s_browser = await MotusLauncher.LaunchAsync(
+            new LaunchOptions { Headless = true, Channel = BrowserChannel.Firefox });
+    }
+
+    [ClassCleanup]
+    public static async Task ClassTeardown()
+    {
+        if (s_browser is not null)
+            await s_browser.DisposeAsync();
+    }
+
+    [TestInitialize]
+    public async Task Setup()
+    {
+        if (s_browser is null)
+        {
+            Assert.Inconclusive("Firefox not found on this machine.");
+            return;
+        }
+
+        _context = await s_browser.NewContextAsync();
+        _page = await _context.NewPageAsync();
+    }
+
+    [TestCleanup]
+    public async Task Cleanup()
+    {
+        if (_context is not null)
+            await _context.CloseAsync();
+    }
+
+    private async Task<IPage> ContentAsync(string html)
+    {
+        await _page!.SetContentAsync(html);
+        return _page;
+    }
+
+    /// <summary>
+    /// The repro from the issue: a CSS locator that clicks a button.
+    /// </summary>
+    [TestMethod]
+    public async Task Click_CssLocator_ClicksTheElement()
+    {
+        var page = await ContentAsync(
+            "<button onclick=\"document.body.dataset.clicked='yes'\">Save</button>");
+
+        await page.Locator("button").ClickAsync(timeout: 10_000);
+
+        Assert.AreEqual("yes", await page.EvaluateAsync<string>("document.body.dataset.clicked"));
+    }
+
+    /// <summary>
+    /// The main frame's locators are measured like the page's, so a click through one needs
+    /// nothing Chromium-only either.
+    /// </summary>
+    [TestMethod]
+    public async Task Click_MainFrameLocator_ClicksTheElement()
+    {
+        var page = await ContentAsync(
+            "<div style='height:5000px'></div>"
+            + "<button onclick=\"document.body.dataset.clicked='yes'\">Save</button>");
+
+        await page.MainFrame.GetByText("Save").ClickAsync(timeout: 10_000);
+
+        Assert.AreEqual("yes", await page.EvaluateAsync<string>("document.body.dataset.clicked"));
+        Assert.IsNotNull(await page.MainFrame.Locator("button").BoundingBoxAsync());
+    }
+
+    [TestMethod]
+    public async Task Fill_ThenRead_RoundTripsTheValue()
+    {
+        var page = await ContentAsync("<input id=name>");
+
+        await page.Locator("#name").FillAsync("Ada", timeout: 10_000);
+
+        Assert.AreEqual("Ada", await page.Locator("#name").InputValueAsync());
+        Assert.AreEqual("Ada", await page.EvaluateAsync<string>("document.getElementById('name').value"));
+    }
+
+    /// <summary>
+    /// Every strategy that runs a query in the page finds the element it was written for.
+    /// </summary>
+    [TestMethod]
+    public async Task EveryInPageStrategy_FindsItsElement()
+    {
+        var page = await ContentAsync(
+            "<p id=greeting>Hello there</p>"
+            + "<label for=email>Email</label><input id=email placeholder='you@example.com'>"
+            + "<span id=tagged data-testid=status>ok</span>"
+            + "<img id=logo alt='Company logo' title='Logo' src='data:,'>");
+
+        Assert.AreEqual("greeting", await page.GetByText("hello there").GetAttributeAsync("id"));
+        Assert.AreEqual("email", await page.GetByLabel("Email").GetAttributeAsync("id"));
+        Assert.AreEqual("email", await page.GetByPlaceholder("you@").GetAttributeAsync("id"));
+        Assert.AreEqual("tagged", await page.GetByTestId("status").GetAttributeAsync("id"));
+        Assert.AreEqual("logo", await page.GetByAltText("Company logo").GetAttributeAsync("id"));
+        Assert.AreEqual("logo", await page.GetByTitle("Logo").GetAttributeAsync("id"));
+        Assert.AreEqual("greeting", await page.Locator("xpath=//p").GetAttributeAsync("id"));
+        Assert.AreEqual("greeting", await page.Locator("text=Hello there").Last.GetAttributeAsync("id"));
+        Assert.AreEqual(1, await page.Locator("css=#tagged").CountAsync());
+    }
+
+    /// <summary>
+    /// A chained locator queries under each element the first part matched, and a parent step walks
+    /// up from it. Both start from an element rather than the document, and two matches that share a
+    /// parent count it once.
+    /// </summary>
+    [TestMethod]
+    public async Task ChainedAndParentLocators_QueryFromTheElement()
+    {
+        var page = await ContentAsync(
+            "<ul id=a><li class=item>One</li><li class=item>Two</li></ul>"
+            + "<ul id=b><li class=item>Three</li></ul>");
+
+        var underA = page.Locator("#a").Locator(".item");
+        Assert.AreEqual(2, await underA.CountAsync());
+        CollectionAssert.AreEqual(new[] { "One", "Two" }, (await underA.AllTextContentsAsync()).ToArray());
+
+        Assert.AreEqual(2, await page.Locator(".item").Locator("..").CountAsync());
+        Assert.AreEqual("b", await page.GetByText("Three").Locator("..").GetAttributeAsync("id"));
+        Assert.AreEqual(2, await page.Locator("ul").First.Locator("li").CountAsync());
+    }
+
+    /// <summary>
+    /// The rest of the actions and queries, each through the same element reference.
+    /// </summary>
+    /// <remarks>
+    /// A double-click is left out: Firefox counts the two clicks it is made of as two single
+    /// clicks, which is about how mouse input is translated rather than how the element is found.
+    /// </remarks>
+    [TestMethod]
+    public async Task OtherActionsAndQueries_ReachTheElement()
+    {
+        var page = await ContentAsync(
+            "<button id=b onmouseover=\"document.body.dataset.hover='yes'\""
+            + " onpointerdown=\"document.body.dataset.touch=event.pointerType\">Go <b>now</b></button>"
+            + "<input id=t value=old onkeydown=\"if (event.key === 'Enter') document.body.dataset.enter='yes'\">"
+            + "<input id=off disabled>");
+
+        var button = page.Locator("#b");
+        await button.HoverAsync(timeout: 10_000);
+        await button.TapAsync(timeout: 10_000);
+        Assert.AreEqual("yes", await page.EvaluateAsync<string>("document.body.dataset.hover"), "hover");
+        Assert.AreEqual("touch", await page.EvaluateAsync<string>("document.body.dataset.touch"), "tap");
+
+        Assert.AreEqual("Go now", await button.InnerTextAsync());
+        Assert.AreEqual("Go <b>now</b>", await button.InnerHTMLAsync());
+        Assert.IsTrue(await button.IsVisibleAsync());
+        Assert.IsTrue(await button.IsEnabledAsync());
+        Assert.IsFalse(await page.Locator("#off").IsEnabledAsync());
+        var box = await button.BoundingBoxAsync();
+        Assert.IsNotNull(box);
+        Assert.IsTrue(box.Width > 0 && box.Height > 0);
+
+        var field = page.Locator("#t");
+        await field.ClearAsync(timeout: 10_000);
+        await field.TypeAsync("new");
+        await field.PressAsync("Enter");
+        Assert.AreEqual("new", await field.InputValueAsync());
+        Assert.AreEqual("yes", await page.EvaluateAsync<string>("document.body.dataset.enter"), "press");
+        Assert.IsTrue(await field.IsEditableAsync());
+
+        var handle = await field.ElementHandleAsync();
+        Assert.AreEqual("new", await handle.EvaluateAsync<string>("function() { return this.value; }"));
+    }
+
+    /// <summary>
+    /// A pointer action scrolls a target below the fold into view before it clicks.
+    /// </summary>
+    [TestMethod]
+    public async Task Click_ScrollsATargetBelowTheFoldIntoView()
+    {
+        // BiDi has no viewport emulation, so the spacer is taller than any default window instead.
+        var page = await ContentAsync(
+            "<div style='height:5000px'></div>"
+            + "<button onclick=\"document.body.dataset.clicked='yes'\">Far</button>");
+
+        await page.Locator("button").ClickAsync(timeout: 10_000);
+
+        Assert.AreEqual("yes", await page.EvaluateAsync<string>("document.body.dataset.clicked"));
+        Assert.IsTrue(await page.EvaluateAsync<double>("window.scrollY") > 0, "The page did not scroll.");
+    }
+
+    [TestMethod]
+    public async Task CheckAndUncheck_ConfirmTheState()
+    {
+        var page = await ContentAsync("<input type=checkbox id=agree><label for=agree>Agree</label>");
+        var box = page.Locator("#agree");
+
+        await box.CheckAsync(timeout: 10_000);
+        Assert.IsTrue(await box.IsCheckedAsync());
+
+        // Already checked: nothing to click, and still checked afterwards.
+        await box.CheckAsync(timeout: 10_000);
+        Assert.IsTrue(await box.IsCheckedAsync());
+
+        await box.UncheckAsync(timeout: 10_000);
+        Assert.IsFalse(await box.IsCheckedAsync());
+    }
+
+    /// <summary>
+    /// The state is read back after the click, so a click a handler cancels is reported rather than
+    /// passing as though it had checked the box.
+    /// </summary>
+    [TestMethod]
+    public async Task Check_ACancelledClick_Throws()
+    {
+        var page = await ContentAsync("<input type=checkbox id=stuck onclick='event.preventDefault()'>");
+
+        var ex = await Assert.ThrowsExceptionAsync<MotusException>(
+            () => page.Locator("#stuck").CheckAsync(timeout: 10_000));
+
+        StringAssert.Contains(ex.Message, "still unchecked");
+    }
+
+    /// <summary>
+    /// An assertion made before the element renders waits for it, and an assertion about an element
+    /// that never renders fails at its timeout reporting the element missing.
+    /// </summary>
+    [TestMethod]
+    public async Task Assertions_WaitForAMissingElement()
+    {
+        var page = await ContentAsync(
+            "<p>start</p><script>setTimeout(() => {"
+            + "const h = document.createElement('h1'); h.id = 'done'; h.textContent = 'Saved';"
+            + "document.body.append(h); }, 1000)</script>");
+
+        Assert.AreEqual(0, await page.Locator("#done").CountAsync(),
+            "The element rendered before the assertion started.");
+
+        var options = new AssertionOptions { Timeout = 10_000 };
+        await Expect.That(page.Locator("#done")).ToBeVisibleAsync(options);
+        await Expect.That(page.Locator("#done")).ToHaveTextAsync("Saved", options);
+
+        var elapsed = Stopwatch.StartNew();
+        await Expect.That(page.Locator("#nope")).ToBeHiddenAsync(options);
+        Assert.IsTrue(elapsed.ElapsedMilliseconds < 2_000,
+            $"ToBeHidden on a missing element took {elapsed.ElapsedMilliseconds}ms.");
+
+        var ex = await Assert.ThrowsExceptionAsync<MotusAssertionException>(
+            () => Expect.That(page.Locator("#nope"))
+                .ToHaveTextAsync("Saved", new AssertionOptions { Timeout = 1_500 }));
+        Assert.AreEqual("<element not found>", ex.Actual);
+    }
+
+    /// <summary>
+    /// The element itself can be handed to a script as an argument, and arrays and objects reach
+    /// the page as arrays and objects.
+    /// </summary>
+    [TestMethod]
+    public async Task ElementAndStructuredArguments_ReachThePage()
+    {
+        var page = await ContentAsync(
+            "<select id=s multiple><option value=a>A</option><option value=b>B</option><option value=c>C</option></select>"
+            + "<div id=d></div>");
+
+        var selected = await page.Locator("#s").SelectOptionAsync(["a", "c"]);
+        CollectionAssert.AreEqual(new[] { "a", "c" }, selected.ToArray());
+
+        var tag = await page.Locator("#d").EvaluateWithElementAsync<string>(
+            "(el, arg) => el.tagName + ':' + arg.label + ':' + arg.items.length", new { label = "x", items = new[] { 1, 2 } });
+        Assert.AreEqual("DIV:x:2", tag);
+
+        await page.EvaluateAsync<object?>(
+            "document.getElementById('d').addEventListener('ping', e => document.body.dataset.ping = String(e.bubbles))");
+        await page.Locator("#d").DispatchEventAsync("ping", new { bubbles = true });
+        Assert.AreEqual("true", await page.EvaluateAsync<string>("document.body.dataset.ping"));
+    }
+
+    /// <summary>
+    /// Files are set on the input a locator found, by the same reference every other command uses
+    /// for it.
+    /// </summary>
+    [TestMethod]
+    public async Task SetInputFiles_SetsTheFilesOnTheInput()
+    {
+        var page = await ContentAsync("<input type=file id=f multiple>");
+
+        await page.Locator("#f").SetInputFilesAsync(
+        [
+            new FilePayload("a.txt", "text/plain", "hello"u8.ToArray()),
+            new FilePayload("b.txt", "text/plain", "hi"u8.ToArray()),
+        ], timeout: 10_000);
+
+        Assert.AreEqual("a.txt,b.txt", await page.EvaluateAsync<string>(
+            "Array.from(document.getElementById('f').files).map(f => f.name).join(',')"));
+        Assert.AreEqual(5, await page.EvaluateAsync<int>("document.getElementById('f').files[0].size"));
+    }
+
+    /// <summary>
+    /// <c>GetByRole</c> reads the accessibility tree, which only Chromium exposes. On Firefox it
+    /// fails at once and says so, rather than timing out or matching nothing.
+    /// </summary>
+    [TestMethod]
+    public async Task GetByRole_FailsWithAClearError()
+    {
+        var page = await ContentAsync("<button>Save</button>");
+
+        var elapsed = Stopwatch.StartNew();
+        var ex = await Assert.ThrowsExceptionAsync<NotSupportedException>(
+            () => page.GetByRole("button", "Save").ClickAsync(timeout: 10_000));
+
+        Assert.IsTrue(elapsed.ElapsedMilliseconds < 5_000, $"Failed after {elapsed.ElapsedMilliseconds}ms.");
+        StringAssert.Contains(ex.Message, "GetByRole");
+        StringAssert.Contains(ex.Message, "Chromium");
+    }
+
+    [TestMethod]
+    public async Task AccessibilityAssertions_FailWithAClearError()
+    {
+        var page = await ContentAsync("<button>Save</button>");
+
+        var ex = await Assert.ThrowsExceptionAsync<NotSupportedException>(
+            () => Expect.That(page.Locator("button")).ToHaveRoleAsync("button", new AssertionOptions { Timeout = 10_000 }));
+
+        StringAssert.Contains(ex.Message, "ToHaveRoleAsync");
+        StringAssert.Contains(ex.Message, "Chromium");
+    }
+}
diff --git a/tests/Motus.Tests/Transport/BiDi/BiDiTranslationTests.cs b/tests/Motus.Tests/Transport/BiDi/BiDiTranslationTests.cs
index db83130..af7a35e 100644
--- a/tests/Motus.Tests/Transport/BiDi/BiDiTranslationTests.cs
+++ b/tests/Motus.Tests/Transport/BiDi/BiDiTranslationTests.cs
@@ -214,6 +214,164 @@ public void RuntimeCallFunctionOn_Translates_Params()
         Assert.AreEqual(true, bidiParams.GetProperty("awaitPromise").GetBoolean());
     }
 
+    [TestMethod]
+    public void RuntimeCallFunctionOn_ObjectId_Becomes_This_Reference()
+    {
+        var translation = GetTranslation("Runtime.callFunctionOn");
+
+        var onNode = translation.TranslateParams(
+            Parse("""{"functionDeclaration":"function(){}","objectId":"sharedId:node-7"}"""), "ctx-1");
+        var onHandle = translation.TranslateParams(
+            Parse("""{"functionDeclaration":"function(){}","objectId":"handle-3"}"""), "ctx-1");
+
+        Assert.AreEqual("""{"sharedId":"node-7"}""", onNode.GetProperty("this").GetRawText());
+        Assert.AreEqual("""{"handle":"handle-3"}""", onHandle.GetProperty("this").GetRawText());
+        Assert.AreEqual("ctx-1", onNode.GetProperty("target").GetProperty("context").GetString());
+        Assert.AreEqual("root", onNode.GetProperty("resultOwnership").GetString());
+    }
+
+    [TestMethod]
+    public void RuntimeCallFunctionOn_Arguments_Become_Local_Values_In_Order()
+    {
+        var translation = GetTranslation("Runtime.callFunctionOn");
+
+        var cdpParams = Parse("""
+            {"functionDeclaration":"function(){}","arguments":[
+                {"objectId":"sharedId:node-1"},
+                {},
+                {"value":null},
+                {"value":"s"},
+                {"value":["a",2]},
+                {"value":{"bubbles":true,"detail":{"n":1}}},
+                {"unserializableValue":"NaN"}
+            ]}
+            """);
+        var args = translation.TranslateParams(cdpParams, "ctx-1").GetProperty("arguments");
+
+        Assert.AreEqual(7, args.GetArrayLength());
+        Assert.AreEqual("""{"sharedId":"node-1"}""", args[0].GetRawText());
+        Assert.AreEqual("""{"type":"undefined"}""", args[1].GetRawText());
+        Assert.AreEqual("""{"type":"null"}""", args[2].GetRawText());
+        Assert.AreEqual("""{"type":"string","value":"s"}""", args[3].GetRawText());
+        Assert.AreEqual(
+            """{"type":"array","value":[{"type":"string","value":"a"},{"type":"number","value":2}]}""",
+            args[4].GetRawText());
+        Assert.AreEqual(
+            """{"type":"object","value":[["bubbles",{"type":"boolean","value":true}],["detail",{"type":"object","value":[["n",{"type":"number","value":1}]]}]]}""",
+            args[5].GetRawText());
+        Assert.AreEqual("""{"type":"number","value":"NaN"}""", args[6].GetRawText());
+    }
+
+    [TestMethod]
+    public void ScriptResult_Node_Is_Named_By_Its_SharedId()
+    {
+        var translation = GetTranslation("Runtime.callFunctionOn");
+
+        var cdpResult = translation.TranslateResult(Parse(
+            """{"type":"success","result":{"type":"node","sharedId":"node-9","handle":"h-1","value":{"nodeType":1}}}"""));
+
+        var remote = cdpResult.GetProperty("result");
+        Assert.AreEqual("object", remote.GetProperty("type").GetString());
+        Assert.AreEqual("node", remote.GetProperty("subtype").GetString());
+        Assert.AreEqual("sharedId:node-9", remote.GetProperty("objectId").GetString());
+    }
+
+    [TestMethod]
+    public void ScriptResult_Structured_Value_Becomes_Plain_Json()
+    {
+        var translation = GetTranslation("Runtime.callFunctionOn");
+
+        var cdpResult = translation.TranslateResult(Parse("""
+            {"type":"success","result":{"type":"object","value":[
+                ["x",{"type":"number","value":1.5}],
+                ["gone",{"type":"undefined"}],
+                ["list",{"type":"array","value":[{"type":"string","value":"a"},{"type":"undefined"},{"type":"number","value":"NaN"}]}],
+                ["el",{"type":"node","sharedId":"n"}]
+            ]}}
+            """));
+
+        Assert.AreEqual(
+            """{"x":1.5,"list":["a",null,null],"el":{}}""",
+            cdpResult.GetProperty("result").GetProperty("value").GetRawText());
+    }
+
+    [TestMethod]
+    public void ScriptResult_Unserializable_Number_Is_Reported_As_Such()
+    {
+        var translation = GetTranslation("Runtime.evaluate");
+
+        var cdpResult = translation.TranslateResult(Parse(
+            """{"type":"success","result":{"type":"number","value":"-Infinity"}}"""));
+
+        var remote = cdpResult.GetProperty("result");
+        Assert.AreEqual("-Infinity", remote.GetProperty("unserializableValue").GetString());
+        Assert.IsFalse(remote.TryGetProperty("value", out _));
+    }
+
+    [TestMethod]
+    public void RuntimeGetProperties_Returns_The_Object_To_Itself()
+    {
+        var translation = GetTranslation("Runtime.getProperties");
+        Assert.AreEqual("script.callFunction", translation.BiDiMethod);
+
+        var bidiParams = translation.TranslateParams(
+            Parse("""{"objectId":"array-handle","ownProperties":true}"""), "ctx-1");
+
+        Assert.AreEqual("""{"handle":"array-handle"}""", bidiParams.GetProperty("this").GetRawText());
+        Assert.AreEqual("ctx-1", bidiParams.GetProperty("target").GetProperty("context").GetString());
+        Assert.AreEqual("none", bidiParams.GetProperty("resultOwnership").GetString());
+        Assert.AreEqual(1, bidiParams.GetProperty("serializationOptions").GetProperty("maxObjectDepth").GetInt32());
+    }
+
+    [TestMethod]
+    public void RuntimeGetProperties_Array_Elements_Become_Indexed_Properties()
+    {
+        var translation = GetTranslation("Runtime.getProperties");
+
+        var cdpResult = translation.TranslateResult(Parse("""
+            {"type":"success","result":{"type":"array","value":[
+                {"type":"node","sharedId":"node-a","value":{"nodeType":1}},
+                {"type":"node","sharedId":"node-b","value":{"nodeType":1}}
+            ]}}
+            """));
+
+        var properties = JsonSerializer.Deserialize(cdpResult, CdpJsonContext.Default.RuntimeGetPropertiesResult)!.Result;
+        Assert.AreEqual(2, properties.Length);
+        Assert.AreEqual("0", properties[0].Name);
+        Assert.AreEqual("sharedId:node-a", properties[0].Value!.ObjectId);
+        Assert.AreEqual("1", properties[1].Name);
+        Assert.AreEqual("sharedId:node-b", properties[1].Value!.ObjectId);
+    }
+
+    [TestMethod]
+    public void RuntimeGetProperties_Object_Entries_Become_Named_Properties()
+    {
+        var translation = GetTranslation("Runtime.getProperties");
+
+        var cdpResult = translation.TranslateResult(Parse("""
+            {"type":"success","result":{"type":"object","value":[["first",{"type":"string","value":"x"}]]}}
+            """));
+
+        var properties = JsonSerializer.Deserialize(cdpResult, CdpJsonContext.Default.RuntimeGetPropertiesResult)!.Result;
+        Assert.AreEqual(1, properties.Length);
+        Assert.AreEqual("first", properties[0].Name);
+        Assert.AreEqual("x", properties[0].Value!.Value!.Value.GetString());
+    }
+
+    [TestMethod]
+    public void DomSetFileInputFiles_Names_The_Input_By_SharedId()
+    {
+        var translation = GetTranslation("DOM.setFileInputFiles");
+        Assert.AreEqual("input.setFiles", translation.BiDiMethod);
+
+        var bidiParams = translation.TranslateParams(
+            Parse("""{"files":["/tmp/a.txt"],"objectId":"sharedId:input-1"}"""), "ctx-1");
+
+        Assert.AreEqual("ctx-1", bidiParams.GetProperty("context").GetString());
+        Assert.AreEqual("""{"sharedId":"input-1"}""", bidiParams.GetProperty("element").GetRawText());
+        Assert.AreEqual("/tmp/a.txt", bidiParams.GetProperty("files")[0].GetString());
+    }
+
     [TestMethod]
     public void RuntimeReleaseObject_Is_NoOp()
     {