diff --git a/packages/app/src/components/browser/vnode-transform.ts b/packages/app/src/components/browser/vnode-transform.ts
index bdab0584..c5e06266 100644
--- a/packages/app/src/components/browser/vnode-transform.ts
+++ b/packages/app/src/components/browser/vnode-transform.ts
@@ -12,13 +12,39 @@ interface SerializedVNode {
 
 type TransformInput = SerializedVNode | string | number | null
 
+/**
+ * Inline event attributes (`<button onclick="…">`) are captured as STRINGS, and
+ * Preact reads any `on*` prop as a listener: it stamps its own bookkeeping
+ * property onto the value, which throws `Cannot create property … on string`
+ * and aborts the whole render. One such attribute anywhere in the document was
+ * enough to leave the replay iframe blank with nothing logged — the render
+ * never reached an `<html>` element, so the caller's own guard returned early.
+ *
+ * Dropping them costs nothing: the replay is a static reconstruction and
+ * `#renderVdom` strips `<script>` tags for the same reason, so a handler has
+ * nothing left to fire. A function value (never produced by capture) is left
+ * alone so a real listener still binds.
+ */
+function withoutInlineHandlers(
+  props: Record<string, unknown>
+): Record<string, unknown> {
+  const kept: Record<string, unknown> = {}
+  for (const [key, value] of Object.entries(props)) {
+    if (!(/^on[A-Za-z]/.test(key) && typeof value === 'string')) {
+      kept[key] = value
+    }
+  }
+  return kept
+}
+
 export function transform(node: TransformInput): VNode<{}> {
   if (typeof node !== 'object' || node === null) {
     // Plain string/number text node — return as-is for Preact to render as text.
     return node as unknown as VNode<{}>
   }
 
-  const { children, ...props } = node.props ?? {}
+  const { children, ...rawProps } = node.props ?? {}
+  const props = withoutInlineHandlers(rawProps)
   /**
    * ToDo(Christian): fix way we collect data on added nodes in script
    */
diff --git a/packages/app/tests/vnode-transform.test.ts b/packages/app/tests/vnode-transform.test.ts
index 4b7b4ed8..f2656b56 100644
--- a/packages/app/tests/vnode-transform.test.ts
+++ b/packages/app/tests/vnode-transform.test.ts
@@ -2,7 +2,7 @@
  * @vitest-environment happy-dom
  */
 import { describe, expect, it } from 'vitest'
-import type { VNode } from 'preact'
+import { render, type VNode } from 'preact'
 
 import { transform } from '../src/components/browser/vnode-transform.js'
 // The producers on the other side of the wire. `transform` only ever sees what
@@ -320,6 +320,45 @@ describe('transform', () => {
       expect(propsOf(username)['data-wdio-ref']).toBe(ref)
     })
 
+    it('renders without throwing when the page carries an inline handler', () => {
+      // The crux: Preact reads any `on*` prop as a listener and stamps its own
+      // bookkeeping onto the value. A captured handler is a STRING, so that
+      // throws `Cannot create property … on string` and aborts the render
+      // mid-tree — #renderVdom then finds no <html> and returns early, leaving
+      // the replay iframe blank with nothing logged. One attribute anywhere in
+      // the document was enough (measured on a real mobile-web trace).
+      const root = transform(
+        captureDocument(
+          '<head></head><body><button onclick="submitIt()">Go</button></body>'
+        )
+      )
+
+      const container = document.createDocumentFragment()
+      expect(() => render(root, container)).not.toThrow()
+      expect(container.firstElementChild?.tagName).toBe('HTML')
+      expect(container.firstElementChild?.querySelector('button')).toBeTruthy()
+    })
+
+    it('drops the inline handler rather than rendering it', () => {
+      // Nothing is lost: the replay is a static reconstruction and
+      // #renderVdom strips <script> tags for the same reason, so a handler has
+      // nothing left to fire.
+      const captured = captureFragment(
+        '<button onclick="submitIt()">Go</button>'
+      )
+
+      expect(propsOf(transform(captured)).onclick).toBeUndefined()
+    })
+
+    it('keeps a function-valued handler, which capture never produces', () => {
+      // Narrow the guard to the string case so a real listener still binds if
+      // one is ever passed in by hand.
+      const handler = () => {}
+      const node = transform({ type: 'button', props: { onClick: handler } })
+
+      expect(propsOf(node).onClick).toBe(handler)
+    })
+
     it('gives a one-child head a bare child rather than a list', () => {
       // snapshot.ts's #renderNewDocument prepends its <base> by spreading
       // head.props.children, so this shape — a real page with a single <title>
diff --git a/packages/core/src/spec-trace-helpers.ts b/packages/core/src/spec-trace-helpers.ts
index 51108c8b..ff35270d 100644
--- a/packages/core/src/spec-trace-helpers.ts
+++ b/packages/core/src/spec-trace-helpers.ts
@@ -36,6 +36,14 @@ export interface SpecRange {
   networkStartIdx: number
   mutationStartIdx: number
   traceLogStartIdx: number
+  /** How many in-flight captures the adapter had recorded when this slice
+   *  opened — the same shape as the index fields above, over the capture list
+   *  rather than a data array. A flush waits for the captures AFTER this point
+   *  and no others: those are its own, while an earlier one belongs to a slice
+   *  that has already had its wait. Absent for an adapter that records no
+   *  boundaries or awaits its captures inline (the WDIO service), where the
+   *  wait is a no-op either way. */
+  captureStartIdx?: number
 }
 
 /**
@@ -262,6 +270,9 @@ export interface SpecBoundaryContext {
     mutations: ArrayLike<unknown>
     traceLogs: ArrayLike<unknown>
   }
+  /** The adapter's live in-flight capture list, stamped onto each range as
+   *  `captureStartIdx`. Live by reference: it grows as the run does. */
+  pendingCaptures?: ArrayLike<unknown>
 }
 
 /** Push a new slice range and return the previous (unflushed) range to flush.
@@ -290,7 +301,8 @@ function pushSliceRange(
     consoleStartIdx: ctx.capturer.consoleLogs.length,
     networkStartIdx: ctx.capturer.networkRequests.length,
     mutationStartIdx: ctx.capturer.mutations.length,
-    traceLogStartIdx: ctx.capturer.traceLogs.length
+    traceLogStartIdx: ctx.capturer.traceLogs.length,
+    captureStartIdx: ctx.pendingCaptures?.length ?? 0
   })
 
   return prevRange
diff --git a/packages/core/src/trace-finalizer.ts b/packages/core/src/trace-finalizer.ts
index ce79f0ff..989d89bf 100644
--- a/packages/core/src/trace-finalizer.ts
+++ b/packages/core/src/trace-finalizer.ts
@@ -81,8 +81,20 @@ export interface TraceExportContext {
   flushed: Set<string>
   /** Adapters keep their differing dir logic; range is set for spec writes. */
   resolveOutputDir: (range?: SpecRange) => string
-  /** Pending snapshot captures to settle before writing (selenium/nightwatch). */
+  /** Everything finalize must settle before writing: the adapters' in-flight
+   *  captures AND their eager slice-write promises (selenium/nightwatch). */
   awaitPending?: Promise<unknown>[]
+  /** The captures alone, live by reference and in record order, so an eager
+   *  flush can settle the ones from `SpecRange.captureStartIdx` on — its own —
+   *  without waiting on another slice's. */
+  pendingCaptures?: readonly Promise<unknown>[]
+  /** Session-wide work every slice depends on whatever its window: the metadata
+   *  read (viewport, device, capabilities), captured once at session start and
+   *  stamped on every trace written after it. Scoping cannot cover this — it
+   *  belongs to no slice — and a slice written before it resolves carries the
+   *  fallback viewport, which finalize cannot correct once the artifact exists.
+   *  Only the WDIO service defers it; the others await theirs inline. */
+  metadataCapture?: Promise<unknown>
   log?: (level: 'info' | 'warn', msg: string) => void
   onArtifact?: (a: TraceArtifact) => void
   /** When true, finalize writes a `devtools-artifacts-<sessionId>.json` manifest
@@ -140,26 +152,62 @@ async function settlePending(
   return result
 }
 
-/** Settle in-flight snapshot captures under the timeout cap, warning if the
- *  bound elapses. Never throws; never hangs. */
-async function awaitPendingCaptures(ctx: TraceExportContext): Promise<void> {
-  if (!ctx.awaitPending?.length) {
+/**
+ * Settle in-flight work under the timeout cap, warning if the bound elapses.
+ * Never throws; never hangs.
+ *
+ * `sliceFrom` is an eager per-slice flush, and it waits on exactly its OWN
+ * captures: the ones the adapter recorded after this slice opened. A capture
+ * from an earlier slice is that slice's business and has already had its wait,
+ * so a single wedged driver read cannot tax every later slice — and nothing of
+ * this slice's own is skipped, which guessing by "have we awaited this promise
+ * before" could not promise.
+ *
+ * Finalize passes no index and waits on everything, deliberately: the full list
+ * also carries the adapters' eager slice-WRITE promises, and the artifacts
+ * manifest is written from what they produce, so skipping one there would let
+ * the manifest be written while a slice still is.
+ */
+async function awaitPendingCaptures(
+  ctx: TraceExportContext,
+  sliceFrom?: number
+): Promise<void> {
+  // Session-wide prerequisites ride along with both: they belong to no slice,
+  // and re-awaiting a settled one is free.
+  const sessionWide = ctx.metadataCapture ? [ctx.metadataCapture] : []
+  const pending =
+    sliceFrom === undefined
+      ? [...sessionWide, ...(ctx.awaitPending ?? [])]
+      : [
+          ...sessionWide,
+          ...Array.from(ctx.pendingCaptures ?? []).slice(sliceFrom)
+        ]
+  if (!pending.length) {
     return
   }
-  const timedOut = await settlePending(
-    ctx.awaitPending,
-    PENDING_SETTLE_TIMEOUT_MS
-  )
+  const timedOut = await settlePending(pending, PENDING_SETTLE_TIMEOUT_MS)
   if (timedOut) {
     ctx.log?.(
       'warn',
-      `One or more of ${ctx.awaitPending.length} snapshot capture(s) did not ` +
+      `One or more of ${pending.length} snapshot capture(s) did not ` +
         `settle within ${PENDING_SETTLE_TIMEOUT_MS}ms; writing trace with the ` +
         'snapshots captured so far.'
     )
   }
 }
 
+/** The range that bounds `range`, read from the adapter's LIVE list — the next
+ *  test's boundary is appended to it as that test starts, so a flush that waited
+ *  sees a bound that did not exist when it began. Identity lookup: every caller
+ *  passes a range it took from this same array. */
+function successorOf(
+  ctx: TraceExportContext,
+  range: SpecRange
+): SpecRange | undefined {
+  const index = ctx.ranges.indexOf(range)
+  return index === -1 ? undefined : ctx.ranges[index + 1]
+}
+
 function sliceCountWarning(count: number): string {
   return (
     `traceGranularity produced ${count} trace slices. Consider pairing it ` +
@@ -240,6 +288,18 @@ export async function flushRangeTrace(
   }
   ctx.flushed.add(range.key)
 
+  // A slice is written from whatever the capturer holds RIGHT NOW, and the
+  // adapters' DOM captures are fire-and-forget, so an eager flush has to settle
+  // them or it writes a slice describing a page nobody has read yet. Cheap
+  // where those captures already resolved (a desktop drain is milliseconds),
+  // and load-bearing where they cannot: on Appium every page-side call is a
+  // round trip of hundreds of ms to seconds, so the per-test slice reliably
+  // beat the collector and carried no `trace.mutations` at all. Bounded by the
+  // same timeout the finalizer uses, so a stuck capture delays a test hook
+  // rather than hanging it. Scoped to this slice's own captures; finalize
+  // waits on everything.
+  await awaitPendingCaptures(ctx, range.captureStartIdx ?? 0)
+
   const isTestSlice = range.testUid !== undefined
   const sliceMetadata = isTestSlice
     ? filterTestMetadataByUid(ctx.testMetadata, range.testUid!)
@@ -261,7 +321,14 @@ export async function flushRangeTrace(
   const writeSlice = isTestSlice ? writeTestSliceTrace : writeSpecTrace
   artifact.path = await writeSlice({
     range,
-    nextRange,
+    // Re-resolved AFTER the wait, which can span the start of the next test:
+    // Nightwatch — and Selenium's cucumber hook — start the flush without
+    // awaiting it, and an eager flush is open-ended, so that test's commands
+    // and mutations would land in this test's trace. Its boundary appears in
+    // `ctx.ranges` as it starts, which closes this slice on exactly the bound
+    // that now exists. Freezing indexes before the wait cannot serve: the
+    // captures being waited for append to those same arrays.
+    nextRange: nextRange ?? successorOf(ctx, range),
     capturer: ctx.capturer,
     actionSnapshots: ctx.actionSnapshots ?? [],
     screencastFrames: ctx.screencastFrames,
diff --git a/packages/core/tests/trace-finalizer.test.ts b/packages/core/tests/trace-finalizer.test.ts
index e436f3de..9a1d9a04 100644
--- a/packages/core/tests/trace-finalizer.test.ts
+++ b/packages/core/tests/trace-finalizer.test.ts
@@ -20,6 +20,9 @@ import {
   type TestMetadataMap
 } from '@wdio/devtools-shared'
 
+/** Mirrors the ceiling in trace-finalizer.ts (module-private there). */
+const PENDING_SETTLE_TIMEOUT_MS = 5000
+
 function makeCapturer(commandCount = 4): TraceCapturer {
   return {
     mutations: [],
@@ -617,6 +620,130 @@ describe('flushRangeTrace', () => {
     await expect(fs.readdir(outputDir)).resolves.toEqual([])
   })
 
+  // Nightwatch — and Selenium's cucumber hook — start the eager flush without
+  // awaiting it, so the next test can begin while the capture wait runs. An
+  // open-ended slice would then swallow that test's rows.
+  it('closes an open-ended slice on a boundary that appears during the wait', async () => {
+    const capturer = makeCapturer(2)
+    const ranges = [range('/spec.js', 0)]
+    // Resolves only after the "next test" has recorded its boundary and
+    // appended a command — exactly the interleaving being guarded.
+    const capture = Promise.resolve().then(() => {
+      capturer.commandsLog.push({
+        command: 'url',
+        args: ['https://example.test/next-test'],
+        timestamp: 9999,
+        startTime: 9998
+      })
+      ranges.push(range('/spec.js', capturer.commandsLog.length - 1))
+    })
+
+    // ndjson-directory so the slice can be read back as plain files — the
+    // bound being asserted is the same either way.
+    const artifact = await flushRangeTrace(
+      ctx({
+        capturer,
+        ranges,
+        awaitPending: [capture],
+        format: 'ndjson-directory'
+      }),
+      ranges[0]!
+    )
+
+    const written = await fs.readFile(
+      path.join(artifact!.path, 'trace.trace'),
+      'utf8'
+    )
+    expect(written).toContain('https://example.test/0')
+    expect(written).not.toContain('next-test')
+  })
+
+  // The adapters keep ONE run-long capture list and hand it to every flush, so
+  // a slice must wait for its own captures and nobody else's: otherwise one
+  // wedged driver read costs every later slice the ceiling.
+  it(
+    'waits only on the captures recorded after the slice opened',
+    async () => {
+      const stuck = new Promise<void>(() => {})
+      let ownSettled = false
+      const own = new Promise<void>((resolve) =>
+        setTimeout(() => {
+          ownSettled = true
+          resolve()
+        }, 50)
+      )
+      // `stuck` belongs to an earlier slice; `own` to this one.
+      const pendingCaptures = [stuck, own]
+      const scoped = { ...range('/b.js', 0), captureStartIdx: 1 }
+
+      const started = Date.now()
+      await flushRangeTrace(
+        ctx({ pendingCaptures, awaitPending: [stuck, own] }),
+        scoped
+      )
+      const elapsed = Date.now() - started
+
+      // Waited for its own capture, and not for the earlier stuck one.
+      expect(ownSettled).toBe(true)
+      expect(elapsed).toBeLessThan(PENDING_SETTLE_TIMEOUT_MS / 2)
+    },
+    PENDING_SETTLE_TIMEOUT_MS * 4
+  )
+
+  // The WDIO service awaits its captures inline and defers only the session
+  // metadata read, so its slice has no captures to scope — and the viewport it
+  // stamps cannot be corrected once the artifact is written.
+  it(
+    'waits for the session metadata read even with no captures of its own',
+    async () => {
+      let read = false
+      const metadataCapture = new Promise<void>((resolve) =>
+        setTimeout(() => {
+          read = true
+          resolve()
+        }, 50)
+      )
+
+      await flushRangeTrace(ctx({ metadataCapture, pendingCaptures: [] }), {
+        ...range('/spec.js', 0),
+        captureStartIdx: 0
+      })
+
+      expect(read).toBe(true)
+    },
+    PENDING_SETTLE_TIMEOUT_MS * 4
+  )
+
+  // The same list carries the adapters' eager slice WRITES, and the manifest is
+  // written from what they produce — so finalize waits on everything, including
+  // work an eager flush left behind.
+  it(
+    'still waits at finalize for work no slice waited on',
+    async () => {
+      let released = false
+      let release = () => {}
+      const slow = new Promise<void>((resolve) => {
+        release = () => {
+          released = true
+          resolve()
+        }
+      })
+
+      setTimeout(release, 50)
+      await finalizeTraceExport(
+        ctx({
+          granularity: 'session',
+          ranges: [],
+          flushed: new Set(),
+          awaitPending: [slow],
+          pendingCaptures: []
+        })
+      )
+      expect(released).toBe(true)
+    },
+    PENDING_SETTLE_TIMEOUT_MS * 4
+  )
+
   it('returns undefined for an already-flushed spec', async () => {
     const flushed = new Set<string>(['/spec.js'])
     const artifact = await flushRangeTrace(
diff --git a/packages/nightwatch-devtools/src/trace-context.ts b/packages/nightwatch-devtools/src/trace-context.ts
index 712e7e83..2ac2f859 100644
--- a/packages/nightwatch-devtools/src/trace-context.ts
+++ b/packages/nightwatch-devtools/src/trace-context.ts
@@ -66,6 +66,7 @@ export function buildTraceContext(
         configPath: input.configPath
       }),
     awaitPending: [...input.capturer.snapshotCaptures, ...input.traceFlushes],
+    pendingCaptures: input.capturer.snapshotCaptures,
     // Nightwatch feeds real per-test attempt numbers via TestAttemptTracker
     // (B4), so retry-aware policies use per-test attempts, not the fallback.
     attemptInfoAvailable: true,
diff --git a/packages/nightwatch-devtools/src/trace-slices.ts b/packages/nightwatch-devtools/src/trace-slices.ts
index 33111723..0cf5b5d4 100644
--- a/packages/nightwatch-devtools/src/trace-slices.ts
+++ b/packages/nightwatch-devtools/src/trace-slices.ts
@@ -39,7 +39,9 @@ function boundaryContext(ctx: TestSliceCtx): SpecBoundaryContext {
   return {
     specRanges: ctx.specRanges,
     flushedSpecs: ctx.flushedSpecs,
-    capturer: ctx.sessionCapturer
+    capturer: ctx.sessionCapturer,
+    // Stamped onto the range so its own flush waits for exactly these.
+    pendingCaptures: ctx.sessionCapturer.snapshotCaptures
   }
 }
 
diff --git a/packages/selenium-devtools/src/helpers/commandPostActions.ts b/packages/selenium-devtools/src/helpers/commandPostActions.ts
index 3577b586..6acbd500 100644
--- a/packages/selenium-devtools/src/helpers/commandPostActions.ts
+++ b/packages/selenium-devtools/src/helpers/commandPostActions.ts
@@ -83,9 +83,17 @@ export async function enrichFindResult(
 
 /**
  * On navigation commands, drain the page-side collector and capture Performance
- * API data onto the command entry, plus browser logs. Fire-and-forget; errors
- * are logged unless the session has already finalized (post-quit errors are
- * expected and uninteresting).
+ * API data onto the command entry, plus browser logs. Errors are logged unless
+ * the session has already finalized (post-quit errors are expected and
+ * uninteresting).
+ *
+ * Returns its promise so the caller can TRACK it: under the fallback injection
+ * this work is four sequential driver round trips (probe, append, readiness
+ * poll, drain), which against Appium is seconds rather than the milliseconds a
+ * desktop driver costs. Untracked, a per-test slice flushed at `afterEach` had
+ * nothing to wait for and was written before the collector existed — measured
+ * on a mobile-web run, the probe for a test's own navigation returned after
+ * that test had already ended, and every slice carried no DOM at all.
  *
  * When `entry` is provided, the shared `CAPTURE_PERFORMANCE_SCRIPT` runs
  * against the driver and attaches navigation / resources / cookies /
@@ -98,8 +106,8 @@ export function captureNavigationTrace(
   entry?: CommandLog,
   args?: unknown[],
   driver?: unknown
-): void {
-  void (async () => {
+): Promise<void> {
+  return (async () => {
     try {
       // Fallback path: an appended `<script>` dies with its document, so every
       // navigation needs it back. Under the document-start preload the
@@ -320,12 +328,17 @@ export async function handleOnCommand(
     void enrichFindResult(capturer, cmd.rawResult, entry, entry.timestamp)
   }
   if (capturer.isNavigationCommand(cmd.command) && !cmd.fromElement) {
-    captureNavigationTrace(
-      capturer,
-      () => ctx.finalized,
-      entry,
-      cmd.args,
-      ctx.driver
+    // Tracked, not fired and forgotten: this is the path that instruments a
+    // freshly loaded document, and a per-test flush must not write a slice
+    // describing a page it has not read yet.
+    ctx.snapshotCaptures.push(
+      captureNavigationTrace(
+        capturer,
+        () => ctx.finalized,
+        entry,
+        cmd.args,
+        ctx.driver
+      )
     )
   }
   maybeDrainAfterDomCommand(ctx, capturer, cmd)
diff --git a/packages/selenium-devtools/src/session-lifecycle.ts b/packages/selenium-devtools/src/session-lifecycle.ts
index a072d9ef..2f5a53ce 100644
--- a/packages/selenium-devtools/src/session-lifecycle.ts
+++ b/packages/selenium-devtools/src/session-lifecycle.ts
@@ -418,6 +418,7 @@ export function buildTraceExportContext(
         testFilePath: range ? range.specFile : testFilePath
       }),
     awaitPending: [...ctx.snapshotCaptures, ...ctx.traceFlushes],
+    pendingCaptures: ctx.snapshotCaptures,
     log: (level, msg) => log[level](msg),
     // Off by default; explicit option wins, else auto-enable when an
     // allure-js-commons runtime is active (the same signal the Allure sink uses).
@@ -437,7 +438,9 @@ function boundaryContext(
   return {
     specRanges: ctx.specRanges,
     flushedSpecs: ctx.flushedSpecs,
-    capturer
+    capturer,
+    // Stamped onto the range so its own flush waits for exactly these.
+    pendingCaptures: ctx.snapshotCaptures
   }
 }
 
diff --git a/packages/service/src/index.ts b/packages/service/src/index.ts
index 0e9f684b..48c5b7d6 100644
--- a/packages/service/src/index.ts
+++ b/packages/service/src/index.ts
@@ -191,10 +191,12 @@ export default class DevToolsHookService implements Services.ServiceInstance {
         this.#options.emitArtifactsManifest ?? this.#allureReporterConfigured,
       collectedArtifacts: this.#artifacts,
       onArtifact: (a) => this.#artifacts.push(a),
-      // Settled under core's timeout cap before anything is written, so a
-      // `getWindowSize` left hanging by a tearing-down session degrades to the
-      // fallback instead of deadlocking the export.
-      awaitPending: this.#metadataCapture ? [this.#metadataCapture] : []
+      // Settled under core's timeout cap before anything is written — every
+      // slice as well as the final export, since a slice written before the
+      // viewport read lands carries the fallback and cannot be corrected after
+      // the fact. A `getWindowSize` left hanging by a tearing-down session
+      // degrades to that fallback instead of deadlocking the export.
+      metadataCapture: this.#metadataCapture
     }
   }
 
diff --git a/packages/service/src/session-metadata.ts b/packages/service/src/session-metadata.ts
index 1c1a4e75..79132cb3 100644
--- a/packages/service/src/session-metadata.ts
+++ b/packages/service/src/session-metadata.ts
@@ -3,7 +3,11 @@
 // unit-testable and the plugin only forwards its lifecycle hook.
 
 import logger from '@wdio/logger'
-import { resolveViewport as coreResolveViewport } from '@wdio/devtools-core'
+import {
+  SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS,
+  resolveViewport as coreResolveViewport,
+  withTimeout
+} from '@wdio/devtools-core'
 import {
   deviceFromCapabilities,
   type Metadata,
@@ -24,15 +28,27 @@ const log = logger('@wdio/devtools-service')
  * captured image measures the image instead. Wherever there IS a DOM it is
  * load-bearing geometry: the player sizes the replay iframe from it, and the
  * exporter falls back to 1280x720 without it.
+ *
+ * Bounded here rather than left to whoever awaits it. This is the one driver
+ * read in the metadata path, and a session tearing down can leave it hanging
+ * forever — while every trace written from then on waits for it, per slice.
+ * Under `traceGranularity: 'test'` that is another ceiling's delay at EVERY
+ * test-end hook instead of one degradation to the fallback viewport. The rest
+ * of the metadata needs no driver, so a timed-out read still yields the
+ * capabilities and device.
  */
 async function resolveViewport(
   browser: WebdriverIO.Browser
 ): Promise<Viewport | undefined> {
-  return coreResolveViewport(browser.capabilities, {
-    runScript: (body) => browser.execute(body),
-    getWindowSize: () => browser.getWindowSize(),
-    onWarn: (message) => log.warn(message)
-  })
+  return withTimeout(
+    coreResolveViewport(browser.capabilities, {
+      runScript: (body) => browser.execute(body),
+      getWindowSize: () => browser.getWindowSize(),
+      onWarn: (message) => log.warn(message)
+    }),
+    SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS,
+    undefined
+  )
 }
 
 /**
diff --git a/packages/service/tests/session-metadata.test.ts b/packages/service/tests/session-metadata.test.ts
index 76db4085..7436dfb1 100644
--- a/packages/service/tests/session-metadata.test.ts
+++ b/packages/service/tests/session-metadata.test.ts
@@ -1,5 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 
+import { SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS } from '@wdio/devtools-core'
+
 import { resolveSessionMetadata } from '../src/session-metadata.js'
 import { TraceType } from '../src/types.js'
 
@@ -133,6 +135,30 @@ describe('resolveSessionMetadata', () => {
     expect(metadata.type).toBe(TraceType.Testrunner)
   })
 
+  it('gives up on a viewport read that never answers', async () => {
+    // A session tearing down can leave this read hanging forever, and every
+    // trace written from then on waits for it — per slice under
+    // `traceGranularity: 'test'`. It has to settle on its own so that
+    // degradation happens once, not at every test-end hook.
+    const browser = browserDouble({
+      isMobile: true,
+      capabilities: NATIVE_CAPS,
+      getWindowSize: vi.fn().mockReturnValue(new Promise(() => {}))
+    })
+
+    vi.useFakeTimers()
+    try {
+      const settled = resolveSessionMetadata(browser, TraceType.Testrunner)
+      await vi.advanceTimersByTimeAsync(SNAPSHOT_DRIVER_PROBE_TIMEOUT_MS)
+      const metadata = await settled
+
+      expect('viewport' in metadata).toBe(false)
+      expect(metadata.device?.name).toBe('Pixel 7')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('omits a viewport a desktop page answered as null', async () => {
     const browser = browserDouble({
       capabilities: { browserName: 'chrome' },
diff --git a/packages/service/tests/trace-metadata.test.ts b/packages/service/tests/trace-metadata.test.ts
index e76bf228..fa0799b9 100644
--- a/packages/service/tests/trace-metadata.test.ts
+++ b/packages/service/tests/trace-metadata.test.ts
@@ -294,14 +294,18 @@ describe('session metadata vs. an immediately finalizing spec', () => {
 
     // Finalize while the driver has not answered yet — the race the review
     // found. The promise must reach core, which settles it under its own cap.
+    // `metadataCapture` rather than the generic pending list: this read belongs
+    // to no slice, so core awaits it for EVERY trace it writes — a per-test
+    // slice flushed before it lands would carry the fallback viewport, and an
+    // artifact already written cannot be corrected.
     await service.after()
     const ctx = finalizeTraceExport.mock.calls.at(-1)?.[0] as {
-      awaitPending?: Promise<unknown>[]
+      metadataCapture?: Promise<unknown>
     }
-    expect(ctx.awaitPending).toHaveLength(1)
+    expect(ctx.metadataCapture).toBeDefined()
 
     release({ width: 1080, height: 2219 })
-    await ctx.awaitPending?.[0]
+    await ctx.metadataCapture
     // And once it lands it is STORED, not merely published: the zip reads this.
     expect(mockSessionCapturerInstance.mergeMetadata).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -321,9 +325,9 @@ describe('session metadata vs. an immediately finalizing spec', () => {
     await service.after()
 
     const ctx = finalizeTraceExport.mock.calls.at(-1)?.[0] as {
-      awaitPending?: Promise<unknown>[]
+      metadataCapture?: Promise<unknown>
     }
-    await expect(ctx.awaitPending?.[0]).resolves.toBeUndefined()
+    await expect(ctx.metadataCapture).resolves.toBeUndefined()
     // The viewport is dropped; everything else the session knew survives.
     expect(mockSessionCapturerInstance.mergeMetadata).toHaveBeenCalledWith(
       expect.objectContaining({