fix(flow): keep the WebSocket guard's state out of the page's reach

packages/flow/openadapt_flow/__main__.py

@@ -2378,6 +2378,11 @@ def _attached_web_page(backend_cfg, *, url: Optional[str], workflow=None):
     task's first screen before starting it; any other screen fails step 1's
     checks before input. Leaving the context only drops the DevTools
     connection. Every refusal raises :class:`SystemExit` before any input.
+
+    The tab was opened before this run attached, so its page loaded before
+    the WebSocket guard (:func:`~openadapt_flow.backends.playwright_backend.prepare_ws_guard`)
+    and a create-form save on it refuses to hold. The guard is installed on
+    attach: a document the tab loads after that (reload it) can hold one.
     """
 
     from openadapt_flow.interactive_recorder import (
@@ -2421,6 +2426,10 @@ def _attached_web_page(backend_cfg, *, url: Optional[str], workflow=None):
             )
         except BrowserAttachError as exc:
             raise SystemExit(f"REFUSED: {exc}. Nothing was executed.") from None
+        from openadapt_flow.backends.playwright_backend import prepare_ws_guard
+
+        # Documents the tab loads from now on are guarded from their start.
+        prepare_ws_guard(page)
         recorded = getattr(workflow, "viewport", None)
         if recorded:
             try:

packages/flow/openadapt_flow/agent_guard/session.py

@@ -21,6 +21,12 @@
 is not seen, so start the guard before the agent starts the task. Only the
 attached tab is guarded.
 
+This guard holds saves with CDP ``Fetch``, not the Playwright backend's wire
+check. Replaying run 2 on a tab attached over CDP (``run
+--browser-cdp-endpoint``) uses the wire check, whose WebSocket guard can't
+cover a page opened before the attach: a create-form save there refuses to
+hold until the tab is reloaded.
+
 Output, under ``out_dir``::
 
     recording/          run 1, in the format ``compile`` reads (with network.jsonl)