diff --git a/.changeset/calm-ravens-protect.md b/.changeset/calm-ravens-protect.md
deleted file mode 100644
index 7f09e0b03f..0000000000
--- a/.changeset/calm-ravens-protect.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"rrweb": minor
-"rrweb-snapshot": minor
----
-
-Add an opt-in, versioned privacy policy with strict, balanced, custom, and
-legacy presets. Policies consistently protect text, form values, sensitive
-attributes, URLs, snapshots, and incremental mutations while preserving the
-existing rrweb masking options as the backwards-compatible legacy path. The
-vendor-neutral `data-privacy="exclude|mask|allow"` HTML binding works without
-recorder-specific configuration. Add fail-closed canvas-region masking for
-complex canvas applications, suppress unmasked full-snapshot canvas stills,
-and provide coarse and callback-based final attribute masking escape hatches.
diff --git a/.changeset/khaki-hoops-smile.md b/.changeset/khaki-hoops-smile.md
deleted file mode 100644
index a845151cc8..0000000000
--- a/.changeset/khaki-hoops-smile.md
+++ /dev/null
@@ -1,2 +0,0 @@
----
----
diff --git a/.changeset/kind-pumas-detect.md b/.changeset/kind-pumas-detect.md
deleted file mode 100644
index 324d54b127..0000000000
--- a/.changeset/kind-pumas-detect.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"@rrweb/rrweb-plugin-privacy-detectors": minor
-"rrweb": minor
-"rrweb-snapshot": minor
-"@rrweb/types": minor
----
-
-Move Highlight-style heuristic PII auto-detection out of `balanced`/`strict`
-defaults and into an opt-in `@rrweb/rrweb-plugin-privacy-detectors` plugin.
-Presets still mask form values and honor policy rules; email/phone/card/SSN/IP
-text matching is enabled only by the plugin or `applyPrivacyDetectors`.
diff --git a/.changeset/loud-lions-protect.md b/.changeset/loud-lions-protect.md
deleted file mode 100644
index da76e192f2..0000000000
--- a/.changeset/loud-lions-protect.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"rrweb": patch
-"rrweb-snapshot": patch
----
-
-Harden privacy detector compilation against nested and high-quantifier ReDoS
-patterns, lookaround, and named backreferences. Apply capture policies to CSS
-text, `_cssText`, inline style, and stylesheet mutations, and keep custom
-detector schema constraints aligned with runtime validation.
diff --git a/.changeset/privacy-at-capture-integration.md b/.changeset/privacy-at-capture-integration.md
new file mode 100644
index 0000000000..ddc48e5574
--- /dev/null
+++ b/.changeset/privacy-at-capture-integration.md
@@ -0,0 +1,65 @@
+---
+"rrweb-snapshot": minor
+"rrweb": minor
+"@rrweb/types": major
+"@rrweb/rrweb-plugin-privacy-detectors": minor
+"@rrweb/utils": minor
+---
+
+Privacy at Capture: policies now compile onto rrweb's existing masking
+primitives.
+
+- BREAKING: `@rrweb/rrweb-plugin-privacy-detectors`'s API and the
+  `RecordPlugin.applyPrivacyPolicy` hook are new, and several masking
+  decisions that used to have inconsistent defaults are now always enforced
+  (e.g. protected inputs, mask/unmask ties) -- the default preset introduced
+  by this change is named `minimal`, and recognizing another session-replay
+  tool's privacy classes is opt-in via `vendorCompat` rather than a
+  managed-preset default -- see the guide's migration section for the full
+  list. It covers the verified mask/block conventions of twenty-five
+  session-replay tools (each token sourced in the guide's "Vendor class
+  recognition" table), taking `true` for every vendor or an array of vendor
+  ids for just the named ones (an unknown id is dropped with a `console.warn`
+  naming it), and can only ever increase masking or blocking, never reveal:
+  no foreign tool's unmask or input-ignore convention is ever honored, under
+  any form of the setting. `needMaskingText`'s fail-closed catch and an explicit
+  `recordCanvas: true` under `strict` each log a one-time `console.warn`
+  instead of failing silently.
+- Add an opt-in, versioned `privacyPolicy` with `strict`/`balanced`/`minimal`
+  presets, the vendor-neutral `data-privacy` HTML binding (the severity
+  ladder `unmask` < `mask` < `ignore` < `block`, nearest annotated ancestor
+  deciding, with any unrecognized value failing closed to `mask`; `ignore`
+  masks like `mask` and additionally emits no input events for the subtree
+  at all, unlike the legacy events-only, per-element `.rr-ignore`),
+  fail-closed `canvasMasking`, and
+  attribute-masking escape hatches; existing masking options remain the
+  `minimal` default. Every masking decision fails closed: a callback that
+  throws or returns a non-string yields stars, an input whose
+  `type`/`autocomplete` cannot be read is treated as protected, a block
+  selector that throws while matching blocks with a one-time `console.warn`,
+  canvas mask regions scale against the layout content box (immune to CSS
+  transforms), and configuring `canvasMasking` forces the FPS capture path
+  on its own. `data-privacy` and the `rr-*` classes are managed-preset
+  features: under `minimal` a rule compiles to its bare selector and switches
+  nothing else on. The guide's new "For event consumers" section documents
+  what changes on the wire for anyone consuming the event stream directly
+  (nullable attributes, SVG media placeholders, starred text, the
+  `data-privacy` collision with pre-existing attributes, canvas keyframes
+  under a `canvasMasking` adapter -- `strict` emits no canvas events at all
+  -- and canvas-in-shadow-DOM discovery now requiring a native shadow root,
+  so polyfilled shadow canvases are no longer captured).
+- **Experimental:** opt-in heuristic PII detectors (email/phone/card/SSN/IP)
+  via `@rrweb/rrweb-plugin-privacy-detectors`, which logs a one-time
+  `console.info` the first time it applies its policy.
+- **Experimental, no vendor precedent:** recorded-DOM URL sanitization under
+  `balanced`/`strict`. **Open design question for upstream:** the Meta
+  event's own `href` is scoped like `balanced` (blocked-list-only param
+  masking) even under `strict`, since it is the recording's own address
+  rather than page-author markup; every DOM URL attribute keeps `strict`'s
+  normal mask-everything-unless-allowlisted treatment. A relative URL in an
+  attribute rrweb does not already absolutify (`<form action>`,
+  `<video poster>`, ...) is rewritten root-relative.
+- **Experimental optimization:** an unmask-selector presence probe avoids
+  the per-node ancestor walk `unmaskTextSelector` would otherwise force. The
+  probe costs one full-document element sweep per flush precisely when no
+  unmask target exists, scaling with DOM size.
diff --git a/.changeset/privacy-at-capture-vendor-compat-fidelity.md b/.changeset/privacy-at-capture-vendor-compat-fidelity.md
new file mode 100644
index 0000000000..e736222e2a
--- /dev/null
+++ b/.changeset/privacy-at-capture-vendor-compat-fidelity.md
@@ -0,0 +1,27 @@
+---
+"rrweb-snapshot": minor
+"rrweb": minor
+"@rrweb/types": minor
+---
+
+`vendorCompat` fidelity pass: entries now match the vendors' verified implementations, and gain an events-only ignore slot.
+
+- Vendor registry entries gain an `ignoreEvents` slot compiled into the new
+  `ignoreEventsSelector`: input events from a matching element are suppressed
+  and nothing else changes — no masking implied, unlike `data-privacy="ignore"`.
+- Sentry (`.sentry-ignore`, `[data-sentry-ignore]`), PostHog
+  (`.ph-ignore-input`), New Relic (`.nr-ignore`), and Highlight
+  (`.highlight-ignore`) ignore tokens are now honored, each verified from the
+  vendor's source.
+- The mapping doctrine is now pinned in code and tests: each vendor token maps
+  to the closest treatment our verbs express, never a less protective one, and
+  no entry may carry an allow/unmask-like selector in any slot.
+- Datadog `mask-user-input` stays mapped to text mask: form values are already
+  masked globally wherever compat applies, and dropping the token would record
+  the form-element text (e.g. `<option>` labels) it protects there.
+- Docs-tier remaps from verified vendor documentation: Heap's redact
+  attributes and Session Rewind's `[data-sr-redact]` move to block,
+  `[heap-ignore]` and `.userback-ignore` move to events-only ignore,
+  Mouseflow's `.mf-masked`/`[data-mf-replace]` move to block (they remove the
+  subtree there), and Smartlook's legacy `[data-recording-sensitive]` becomes
+  mask + events-ignore.
diff --git a/guide.md b/guide.md
index 054a8e6a53..f250304dc3 100644
--- a/guide.md
+++ b/guide.md
@@ -168,60 +168,46 @@ setInterval(save, 10 * 1000);
 
 The `record` function accepts the following options.
 
-| key                      | default            | description                                                                                                                                                                                   |
-| ------------------------ | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| emit                     | required           | the callback function to get emitted events                                                                                                                                                   |
-| checkoutEveryNth         | -                  | take a full snapshot after every N events<br />refer to the [checkout](#checkout) chapter                                                                                                     |
-| checkoutEveryNms         | -                  | take a full snapshot after every N ms<br />refer to the [checkout](#checkout) chapter                                                                                                         |
-| blockClass               | 'rr-block'         | Use a string or RegExp to configure which elements should be blocked, refer to the [privacy](#privacy) chapter                                                                                |
-| blockSelector            | null               | Use a string to configure which selector should be blocked, refer to the [privacy](#privacy) chapter                                                                                          |
-| ignoreClass              | 'rr-ignore'        | Use a string or RegExp to configure which elements should be ignored, refer to the [privacy](#privacy) chapter                                                                                |
-| ignoreSelector           | null               | Use a string to configure which selector should be ignored, refer to the [privacy](#privacy) chapter                                                                                          |
-| ignoreCSSAttributes      | null               | array of CSS attributes that should be ignored                                                                                                                                                |
-| maskTextClass            | 'rr-mask'          | Use a string or RegExp to configure which elements should be masked, refer to the [privacy](#privacy) chapter                                                                                 |
-| maskTextSelector         | null               | Use a string to configure which selector should be masked, refer to the [privacy](#privacy) chapter                                                                                           |
-| maskAllInputs            | false              | mask all input content as \*                                                                                                                                                                  |
-| maskInputOptions         | { password: true } | mask some kinds of input \*<br />refer to the [list](https://github.com/rrweb-io/rrweb/blob/588164aa12f1d94576f89ae0210b98f6e971c895/packages/rrweb-snapshot/src/types.ts#L77-L95)            |
-| maskInputFn              | -                  | customize mask input content recording logic                                                                                                                                                  |
-| maskTextFn               | -                  | customize mask text content recording logic                                                                                                                                                   |
-| privacyPolicy            | -                  | apply a versioned `strict`, `balanced`, `custom`, or `legacy` privacy policy before values are emitted                                                                                        |
-| slimDOMOptions           | {}                 | remove unnecessary parts of the DOM <br />refer to the [list](https://github.com/rrweb-io/rrweb/blob/588164aa12f1d94576f89ae0210b98f6e971c895/packages/rrweb-snapshot/src/types.ts#L97-L108)  |
-| dataURLOptions           | {}                 | Canvas image format and quality ,This parameter will be passed to the OffscreenCanvas.convertToBlob(),Using this parameter effectively reduces the size of the recorded data                  |
-| inlineStylesheet         | true               | Deprecated since 2.0.0. Still supported, but planned to be superseded by future `captureAssets` asset recording APIs.                                                                         |
-| hooks                    | {}                 | hooks for events<br />refer to the [list](https://github.com/rrweb-io/rrweb/blob/9488deb6d54a5f04350c063d942da5e96ab74075/src/types.ts#L207)                                                  |
-| packFn                   | -                  | refer to the [storage optimization recipe](./docs/recipes/optimize-storage.md)                                                                                                                |
-| sampling                 | -                  | refer to the [storage optimization recipe](./docs/recipes/optimize-storage.md)                                                                                                                |
-| recordCanvas             | false              | Whether to record the canvas element. Available options:<br/>`false`, <br/>`true`                                                                                                             |
-| canvasMasking            | -                  | Runtime adapter for masking regions of FPS-captured canvas frames. See Privacy below.                                                                                                         |
-| maskAllElementAttributes | false              | Masks every source string attribute in the final serialized representation. This reduces replay fidelity and takes precedence over `maskAttributeFn`.                                         |
-| maskAttributeFn          | -                  | Transforms each final serialized string attribute. Portable policy rules are applied afterward and cannot be overridden by this callback.                                                     |
-| recordCrossOriginIframes | false              | Whether to record cross origin iframes. rrweb has to be injected in each child iframe for this to work. Available options:<br/>`false`, <br/>`true`                                           |
-| recordAfter              | 'load'             | If the document is not ready, then the recorder will start recording after the specified event is fired. Available options: `DOMContentLoaded`, `load`                                        |
-| inlineImages             | false              | Deprecated since 2.0.0. Still supported, but planned to be superseded by future `captureAssets` asset recording APIs.                                                                         |
-| collectFonts             | false              | whether to collect fonts in the website                                                                                                                                                       |
-| userTriggeredOnInput     | false              | whether to add `userTriggered` on input events that indicates if this event was triggered directly by the user or not. [What is `userTriggered`?](https://github.com/rrweb-io/rrweb/pull/495) |
-| plugins                  | []                 | load plugins to provide extended record functions. [What are plugins?](./docs/recipes/plugin-api.md)                                                                                          |
-| errorHandler             | -                  | A callback that is called if something inside of rrweb throws an error. The callback receives the error as argument.                                                                          |
+| key                      | default            | description                                                                                                                                                                                          |
+| ------------------------ | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| emit                     | required           | the callback function to get emitted events                                                                                                                                                          |
+| checkoutEveryNth         | -                  | take a full snapshot after every N events<br />refer to the [checkout](#checkout) chapter                                                                                                            |
+| checkoutEveryNms         | -                  | take a full snapshot after every N ms<br />refer to the [checkout](#checkout) chapter                                                                                                                |
+| blockClass               | 'rr-block'         | Use a string or RegExp to configure which elements should be blocked, refer to the [privacy](#privacy) chapter                                                                                       |
+| blockSelector            | null               | Use a string to configure which selector should be blocked, refer to the [privacy](#privacy) chapter                                                                                                 |
+| ignoreClass              | 'rr-ignore'        | Use a string or RegExp to configure which elements should be ignored, refer to the [privacy](#privacy) chapter                                                                                       |
+| ignoreSelector           | null               | Use a string to configure which selector should be ignored, refer to the [privacy](#privacy) chapter                                                                                                 |
+| ignoreCSSAttributes      | null               | array of CSS attributes that should be ignored                                                                                                                                                       |
+| maskTextClass            | 'rr-mask'          | Use a string or RegExp to configure which elements should be masked, refer to the [privacy](#privacy) chapter                                                                                        |
+| maskTextSelector         | null               | Use a string to configure which selector should be masked, refer to the [privacy](#privacy) chapter                                                                                                  |
+| unmaskTextSelector       | null               | Use a string to configure which selector's text should never be masked, even under `strict` or a policy `mask` rule; merged with any policy `unmask` rules, refer to the [privacy](#privacy) chapter |
+| maskAllInputs            | false              | mask all input content as \*                                                                                                                                                                         |
+| maskInputOptions         | { password: true } | mask some kinds of input \*<br />refer to the [list](https://github.com/rrweb-io/rrweb/blob/588164aa12f1d94576f89ae0210b98f6e971c895/packages/rrweb-snapshot/src/types.ts#L77-L95)                   |
+| maskInputFn              | -                  | customize mask input content recording logic                                                                                                                                                         |
+| maskTextFn               | -                  | customize mask text content recording logic                                                                                                                                                          |
+| privacyPolicy            | -                  | apply a versioned `strict`, `balanced`, or `minimal` privacy policy before values are emitted, refer to the [privacy](#privacy) chapter                                                              |
+| slimDOMOptions           | {}                 | remove unnecessary parts of the DOM <br />refer to the [list](https://github.com/rrweb-io/rrweb/blob/588164aa12f1d94576f89ae0210b98f6e971c895/packages/rrweb-snapshot/src/types.ts#L97-L108)         |
+| dataURLOptions           | {}                 | Canvas image format and quality ,This parameter will be passed to the OffscreenCanvas.convertToBlob(),Using this parameter effectively reduces the size of the recorded data                         |
+| inlineStylesheet         | true               | Deprecated since 2.0.0. Still supported, but planned to be superseded by future `captureAssets` asset recording APIs.                                                                                |
+| hooks                    | {}                 | hooks for events<br />refer to the [list](https://github.com/rrweb-io/rrweb/blob/9488deb6d54a5f04350c063d942da5e96ab74075/src/types.ts#L207)                                                         |
+| packFn                   | -                  | refer to the [storage optimization recipe](./docs/recipes/optimize-storage.md)                                                                                                                       |
+| sampling                 | -                  | refer to the [storage optimization recipe](./docs/recipes/optimize-storage.md)                                                                                                                       |
+| recordCanvas             | false              | Whether to record the canvas element. Available options:<br/>`false`, <br/>`true`                                                                                                                    |
+| canvasMasking            | -                  | Runtime adapter for masking regions of FPS-captured canvas frames. See Privacy below.                                                                                                                |
+| maskAllElementAttributes | false              | Masks every source string attribute in the final serialized representation. This reduces replay fidelity and takes precedence over `maskAttributeFn`.                                                |
+| maskAttributeFn          | -                  | Transforms each final serialized string attribute. Portable policy rules are applied afterward and cannot be overridden by this callback.                                                            |
+| recordCrossOriginIframes | false              | Whether to record cross origin iframes. rrweb has to be injected in each child iframe for this to work. Available options:<br/>`false`, <br/>`true`                                                  |
+| recordAfter              | 'load'             | If the document is not ready, then the recorder will start recording after the specified event is fired. Available options: `DOMContentLoaded`, `load`                                               |
+| inlineImages             | false              | Deprecated since 2.0.0. Still supported, but planned to be superseded by future `captureAssets` asset recording APIs.                                                                                |
+| collectFonts             | false              | whether to collect fonts in the website                                                                                                                                                              |
+| userTriggeredOnInput     | false              | whether to add `userTriggered` on input events that indicates if this event was triggered directly by the user or not. [What is `userTriggered`?](https://github.com/rrweb-io/rrweb/pull/495)        |
+| plugins                  | []                 | load plugins to provide extended record functions. [What are plugins?](./docs/recipes/plugin-api.md)                                                                                                 |
+| errorHandler             | -                  | A callback that is called if something inside of rrweb throws an error. The callback receives the error as argument.                                                                                 |
 
 #### Privacy
 
-Use the vendor-neutral `data-privacy` attribute to declare capture privacy in
-application markup. rrweb recognizes it without recorder-specific
-configuration:
-
-```html
-<section data-privacy="exclude">Never capture this subtree</section>
-<section data-privacy="mask">Mask content in this subtree</section>
-<span data-privacy="allow">This content may be captured</span>
-```
-
-The values are case-sensitive. A declaration applies to descendants until a
-nearer declaration overrides it. An `exclude` declaration cannot be reopened,
-and protected credential and payment inputs remain masked under `allow`.
-Unknown values make no decision, so the element inherits from its nearest
-valid ancestor or the recorder defaults.
-
-The existing rrweb controls remain available as compatibility options:
+The existing rrweb masking options are always available and are exactly what
+you get by default (the `minimal` preset, below):
 
 - An element with the class name `.rr-block` will not be recorded. Instead, it will replay as a placeholder with the same dimension.
 - An element with the class name `.rr-ignore` will not record its input events.
@@ -229,16 +215,10 @@ The existing rrweb controls remain available as compatibility options:
 - `input[type="password"]` will be masked by default.
 - Mask options to mask the content in input elements.
 
-For a consistent policy across text, inputs, attributes, URLs, snapshots, and
-mutations, pass a versioned `privacyPolicy`:
-
-The machine-readable contract is published as
-`rrweb-snapshot/privacy-policy.schema.json` for SDK type generation and policy
-validation outside JavaScript.
+For a consistent policy across text, inputs, attributes, and URLs, pass a
+versioned `privacyPolicy`:
 
 ```js
-import { getRecordPrivacyDetectorsPlugin } from '@rrweb/rrweb-plugin-privacy-detectors';
-
 record({
   emit(event) {
     // store event
@@ -249,7 +229,7 @@ record({
     rules: [
       {
         target: { type: 'selector', selector: '.public-customer-name' },
-        action: 'allow',
+        action: 'unmask',
       },
       {
         target: { type: 'selector', selector: '.private' },
@@ -257,51 +237,403 @@ record({
       },
       {
         target: { type: 'selector', selector: '.payment-widget' },
-        action: 'exclude',
+        action: 'block',
       },
     ],
     url: {
       blockedQueryParameters: ['token', 'session'],
     },
   },
-  plugins: [
-    // Highlight-style fuzzy PII matching; omit this plugin to record
-    // unmatched page text unchanged.
-    getRecordPrivacyDetectorsPlugin(),
-  ],
 });
 ```
 
-The presets have the following behavior:
-
-- `strict` masks page text and form values, removes media sources, sanitizes
-  URL parameters, and disables canvas recording. Use a custom or balanced
-  policy with the canvas adapter below when the application can identify safe
-  regions precisely.
-- `balanced` masks form values while preserving normal page text. Heuristic
-  PII matching (email, phone, Luhn-valid payment card, SSN-like, and IPv4) is
-  **not** implied; opt in with `@rrweb/rrweb-plugin-privacy-detectors` or
-  `applyPrivacyDetectors`.
-- `custom` applies explicit rules and configured detectors. Password, hidden,
-  payment, and one-time-code inputs remain protected.
-- `legacy` uses the existing rrweb masking options without additional policy
-  behavior.
-
-`data-privacy` declarations and policy rules use the same `exclude`, `mask`, and
-`allow` actions. Explicit `allow` decisions can override preset defaults and
-heuristic detection, but cannot unmask protected credential or payment inputs.
-At the same selector distance, the safer action wins: `exclude` over `mask`
-over `allow`. Existing masking options are still applied when a policy does not
-make an explicit decision. Omitting `privacyPolicy` preserves existing behavior
-while still honoring `data-privacy` declarations.
+`preset` compiles to the following, on top of the `rules` above:
+
+| preset              | behavior                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `minimal` (default) | Inert: only the existing masking options above apply. `rules` still work (below), but the `data-privacy` attribute and cross-vendor class recognition described below are off.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `balanced`          | Masks every input value (like `maskAllInputs: true`); masks the `title`, `placeholder`, and `aria-label` attributes on every element; sanitizes URLs -- strips `username`/`password` (userinfo), removes the value of any query parameter in a default sensitive list (`access_token`, `auth`, `code`, `key`, `password`, `secret`, `session`, `token`) plus any configured `url.blockedQueryParameters`, and removes the hash unless `url.removeHash: false`. Query parameter names stay visible. Page text is untouched.                                                                                                                          |
+| `strict`            | Everything `balanced` does, plus: all page text is masked; media element sources (`<img>`, `<video>`, `<audio>`, `<iframe>`, `<embed>`, `<object>`, `<source>`) are dropped instead of captured, except that an `<img>` source or `<video>` poster on an element with declared integer `width`/`height` attributes is replaced by a neutral same-size placeholder image so the surrounding layout does not collapse; canvas recording is disabled outright, even with a `canvasMasking` adapter configured; and URL sanitization blocks _every_ query parameter's value unless you also set `url.allowedQueryParameters` to an explicit allow-list. |
+
+`minimal` is a permanent tier, not a transitional one: it is masking you
+configure yourself, through the classic options above. Password and
+payment input fields (native form controls) are always masked regardless
+of preset or configuration.
+`balanced` and `strict` are the managed presets.
+
+Masking an input value also suppresses the `selected` flag on the
+`<option>` elements of a `<select>`: which option is selected discloses the
+select's value just as the value itself does, so both follow one decision.
+This applies under `balanced`/`strict`, whenever a heuristic detector is
+active, and (as before) under `maskAllInputs` or `maskInputOptions.select`.
+
+CSS is never masked, on any preset or code path: `style`/`_cssText`
+attributes and `<style>` element text are exempt from every masking branch,
+including live `characterData` mutations.
+
+rrweb's own operational attributes -- `data-privacy` and
+`data-rr-is-password` -- are exempt too, on every preset and including under
+`maskAllElementAttributes` and `maskAttributeFn`. Masking them would only
+destroy the recorder's own signals: a starred `data-privacy` hides the
+declaration that explains why a subtree is masked, and a starred
+`data-rr-is-password` breaks the password re-detection that reads it back at
+replay.
+
+##### Annotate the markup: the `data-privacy` attribute
+
+`data-privacy` is rrweb's standard way to declare privacy intent. Put it on
+the element whose subtree it describes; under `balanced` and `strict` it is
+recognized directly in markup, no extra configuration required:
+
+```html
+<section data-privacy="block">Never capture this subtree</section>
+<section data-privacy="ignore">
+  Mask content, and never emit its input events
+</section>
+<section data-privacy="mask">Mask content in this subtree</section>
+<span data-privacy="unmask">This content may be captured</span>
+```
+
+The attribute names no vendor on purpose. That is what makes it portable:
+the declaration lives with the markup it protects, so it survives template
+refactors, a change of recorder configuration, and a change of
+session-replay tool -- write it once and it keeps meaning the same thing.
+It is also the annotation closest to the thing being protected: whoever adds
+a field to a form is the person who knows whether it is sensitive, and they
+can say so in the same edit rather than in a selector list maintained
+somewhere else.
+
+The four values above are the whole vocabulary, and they are case-sensitive.
+They form a severity ladder, `unmask < mask < ignore < block`, and the
+nearest annotated ancestor decides. `ignore` is `mask` plus event silence:
+the subtree's content is masked exactly as under `data-privacy="mask"`, and
+nothing typed or clicked in it is ever emitted -- not even a length-only
+starred value. A descendant `data-privacy="unmask"` inside an `ignore`
+subtree re-enables both content and events, exactly as it does inside
+`mask`; `block` remains absolute, and on one element the strictest verb
+present wins.
+
+The legacy `.rr-ignore` class (with the `ignoreClass`/`ignoreSelector`
+options) is an event-suppression-only noise control -- per-element, input
+events only, and it never masks content -- NOT a privacy mechanism.
+`data-privacy="ignore"` is its privacy-grade replacement.
+
+**Any other value masks.** `data-privacy="masked"`, `data-privacy="Block"`,
+`data-privacy=""` -- each of these protects the subtree exactly as
+`data-privacy="mask"` would. A value outside the vocabulary is a typo or a
+value from a version of rrweb that does not recognize it yet, and in both
+cases the author was reaching for protection, so the unknown value fails
+closed rather than making no decision. (This is a change from earlier
+pre-release builds, where an unknown value made no decision at all and the
+element inherited from its nearest annotated ancestor.)
+
+`mask-inputs` is reserved for a future input-only treatment; it is not
+implemented, so today it masks like any other unrecognized value. Do not
+use it to mean anything else.
+
+> `data-privacy` is a managed-preset feature. Under `minimal` it is off
+> entirely -- for every action, with or without rules -- and `rules` compile
+> to their bare selectors and nothing else. Switch to `balanced`/`strict` for
+> `data-privacy` support.
+
+##### Selector rules: for what the markup cannot reach
+
+Annotating the markup is not always possible -- third-party widgets, a
+templating layer you do not own, markup generated by a component library. For
+those, declare the same intent by selector in the policy.
+
+Rules (`rules: [{ target: { type: 'selector', selector }, action }]`) accept
+`mask`, `unmask`, or `block` -- the same three names as the `data-privacy`
+values -- and work under every preset, including `minimal`. An unrecognized
+action throws at compile time rather than being ignored. For text and for
+the masked-attribute defaults (`title`/`placeholder`/`aria-label`), the
+nearest matching ancestor decides, walking from the node up to the document
+root; if the very same element matches both a mask and an unmask selector,
+**mask** wins there (the same tie-break Sentry, Amplitude and Mixpanel use
+for text). `strict`'s mask-everything default is a fallback, not a marker,
+so it never takes part in that tie: an unmask ancestor still escapes it.
+`block` removes a subtree from capture entirely (it replays as a
+placeholder), which is why a `block` decision can't be reopened by a nested
+`mask` or `unmask`.
+Protected inputs -- password, hidden, and autocomplete `cc-*` /
+`current-password` / `new-password` / `one-time-code` fields -- always stay
+masked, regardless of any rule or preset. This holds even with no
+`privacyPolicy` configured at all, and regardless of `maskInputOptions` --
+these fields cannot be opted back into raw recording. (Previously, under
+`minimal`, `hidden` inputs and autocomplete-tagged credit-card/password/OTP
+fields could record their raw value; that is a breaking change from pre-v2
+behavior.)
+
+##### Vendor class recognition: opt-in migration compatibility
+
+Under `balanced` and `strict`, rrweb always recognizes its own conventions:
+
+- Mask: `.rr-mask`
+- Block: `.rr-block`
+- Unmask: `.rr-unmask`
+
+A page already instrumented for another session-replay tool also carries
+that tool's own mask/block class names. Set `vendorCompat: true` on the
+policy and rrweb recognizes those too, so such a page keeps the protection
+it already has from the moment you switch recorders, with no re-annotation
+pass:
+
+```js
+record({
+  privacyPolicy: { version: 1, preset: 'balanced', vendorCompat: true },
+});
+```
+
+`vendorCompat` takes three forms. `true` merges the mask, block, and
+events-only ignore tokens of every vendor in the table below. An array of
+vendor ids merges only the
+named vendors' tokens -- say `vendorCompat: ['posthog', 'datadog']` for a
+page annotated for exactly those two tools; the ids are `mixpanel`,
+`fullstory`, `amplitude`, `posthog`, `sentry`, `datadog`, `newrelic`,
+`highlight`, `logrocket`, `hotjar`, `clarity`, `smartlook`, `openreplay`,
+`contentsquare`, `heap`, `mouseflow`, `luckyorange`, `inspectlet`,
+`dynatrace`, `userback`, `zipy`, `quantummetric`, `glassbox`,
+`sessionstack`, and `sessionrewind`, and an unknown id is dropped with a
+`console.warn` naming it. An empty array (like `false` or leaving it
+unset) merges nothing.
+
+It is off by default because recognizing a foreign token changes what rrweb
+records based on markup the embedder may not control -- a class name that
+means "mask" to one tool may be an ordinary styling hook here -- so the
+decision to honor another vendor's vocabulary is made explicitly.
+
+**Honoring your own unmask class.** A tool adopting rrweb that wants its own
+reveal token honored (say `.acme-unmask`) declares it explicitly, through
+`unmaskTextSelector` or an `unmask` policy rule -- never through
+`vendorCompat`. The invariant holds for every form of the setting:
+`vendorCompat` merges mask and block tokens only, so no unmask/allow token
+of any vendor is ever merged.
+
+Every token below was verified against the vendor's official documentation
+or open-source SDK. The mapping rule: each token maps to the closest
+treatment rrweb's verbs express -- **mask** (text occluded, element still
+recorded), **block** (subtree removed or placeholdered), or **ignore**
+(input events suppressed, content untouched) -- and never to a less
+protective one. A vendor's ignore token silences input events from the
+annotated element itself, exactly as that vendor's recorder does; it
+carries no masking, unlike the native `data-privacy="ignore"`, which is
+mask plus silence. Vendors whose masking is configured purely from
+their own console with no reserved markup (Pendo, Statsig, Sprig, Userpilot,
+Cobrowse) have nothing to recognize.
+
+| Vendor                   | Mask tokens                                                                                                          | Block tokens                                                                  | Source                                                                                                                                                                                                                                                                                         |
+| ------------------------ | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Mixpanel                 | `.mp-mask`                                                                                                           | `.mp-block`                                                                   | mixpanel-js `src/recorder/masking.js`, `src/mixpanel-core.js`                                                                                                                                                                                                                                  |
+| FullStory                | `.fs-mask`, `.fs-mask-without-consent`                                                                               | `.fs-exclude`, `.fs-exclude-without-consent`                                  | "How do I protect my users' privacy in Fullstory?" (`-without-consent` variants are masked until FullStory's consent API reveals them; rrweb has no such API, so they are always honored)                                                                                                      |
+| Amplitude                | `.amp-mask`                                                                                                          | `.amp-block`                                                                  | Amplitude-TypeScript `session-replay-browser/src/constants.ts`                                                                                                                                                                                                                                 |
+| PostHog                  | `.ph-mask`                                                                                                           | `.ph-no-capture`                                                              | posthog-js `lazy-loaded-session-recorder.ts`                                                                                                                                                                                                                                                   |
+| Sentry                   | `.sentry-mask`, `[data-sentry-mask]`                                                                                 | `.sentry-block`, `[data-sentry-block]`                                        | sentry-javascript `replay-internal/src/util/getPrivacyOptions.ts`                                                                                                                                                                                                                              |
+| Datadog                  | `.dd-privacy-mask`, `[data-dd-privacy="mask"]`, `.dd-privacy-mask-user-input`, `[data-dd-privacy="mask-user-input"]` | `.dd-privacy-hidden`, `[data-dd-privacy="hidden"]`                            | browser-sdk `browser-rum-core/src/domain/privacyConstants.ts` (`mask-user-input` masks only form values there; here it masks text too, the safe direction)                                                                                                                                     |
+| New Relic                | `.nr-mask`, `[data-nr-mask]`                                                                                         | `.nr-block`, `[data-nr-block]`                                                | newrelic-browser-agent `src/common/config/init.js`                                                                                                                                                                                                                                             |
+| Highlight / LaunchDarkly | `.highlight-mask`                                                                                                    | `.highlight-block`                                                            | LaunchDarkly "Configuration for session replay"; `sdk/highlight-run/src/client/index.tsx`                                                                                                                                                                                                      |
+| LogRocket                |                                                                                                                      | `[data-private]` (any value), `._lr-hide`                                     | LogRocket DOM reference (`data-private` records only dimensions, which matches block)                                                                                                                                                                                                          |
+| Hotjar                   |                                                                                                                      | `[data-hj-suppress]`, `.data-hj-suppress`                                     | "How to Suppress Text, Images, Videos and User Input" (both spellings documented; text is masked in place there but images/videos are placeholdered too, and our mask verb leaves image sources readable, so block)                                                                            |
+| Microsoft Clarity        | `[data-clarity-mask]`                                                                                                |                                                                               | "Clarity masking"                                                                                                                                                                                                                                                                              |
+| Smartlook                | `[data-sl="mask"]`, `[data-recording-sensitive]` (legacy)                                                            | `[data-sl="exclude"]`, `[data-recording-disable]` (legacy)                    | Smartlook web Privacy API; the legacy attributes survive only in archived docs (`smartlook.github.io` via web.archive.org), where `data-recording-sensitive` masked text and also ignored input values/events -- so it is in the ignore list too                                               |
+| OpenReplay               | `[data-openreplay-obscured]`, `[data-openreplay-masked]` (deprecated alias)                                          | `[data-openreplay-hidden]`, `[data-openreplay-htmlmasked]` (deprecated alias) | OpenReplay "Sanitize data"; `tracker/src/main/app/sanitizer.ts`                                                                                                                                                                                                                                |
+| Contentsquare            | `[data-cs-encrypt]` (encrypted capture there; masked here)                                                           | `[data-cs-mask]` (content removed from collection)                            | Contentsquare "Personal data handling"                                                                                                                                                                                                                                                         |
+| Heap                     |                                                                                                                      | `[data-heap-redact-text]`, `[data-heap-redact-attributes]`                    | Heap "What privacy settings does Session replay inherit": both redact attributes redact the entire element in their replay, so block. `[heap-ignore]` suppresses autocapture events only and is absent from the replay-inheritance list, so it is in the ignore list. Attribute forms only     |
+| Mouseflow                | `[data-mf-replace-inner]` (inner text placeholdered, structure kept)                                                 | `.mf-excluded`, `.mf-masked`, `[data-mf-replace]`                             | Mouseflow "Excluding, masking and replacing content via code": `mf-masked` is "not recorded at all" and `data-mf-replace` swaps the subtree for its placeholder value, so both block                                                                                                           |
+| Lucky Orange             |                                                                                                                      | `.lo-sensitive`, `.losensitive` (text scrambled and images blanked, so block) | Lucky Orange "Privacy tools"                                                                                                                                                                                                                                                                   |
+| Inspectlet               | `.inspectlet-sensitive`, `.inspectletIgnore`                                                                         |                                                                               | Inspectlet "Excluding sensitive data"                                                                                                                                                                                                                                                          |
+| Dynatrace                | `[data-dtrum-mask]`                                                                                                  |                                                                               | Dynatrace Session Replay "URL exclusion and masking"                                                                                                                                                                                                                                           |
+| Userback                 |                                                                                                                      | `.userback-block`                                                             | Userback "Session replay": `userback-block` ignores the element and its children entirely; `.userback-ignore` keeps the element rendered and ignores its user input, so it is in the ignore list                                                                                               |
+| Zipy                     |                                                                                                                      | `.zipy-block`                                                                 | Zipy "Sensitive user data"                                                                                                                                                                                                                                                                     |
+| Quantum Metric           | `[data-qm-encrypt]` (encrypted capture there; masked here)                                                           | `[data-qm-block]`, `[data-qm-freeze-exclude]`                                 | No public docs; read from the shipped engine at `cdn.quantummetric.com/qscripts/quantum-*.js` (`encryptScrubList:["[data-qm-encrypt]"]`; `excludeDOMList` receives `[data-qm-freeze-exclude]`; `[data-qm-block]` appears in several customers' scrub rule sets rather than the engine default) |
+| Glassbox                 | `.cls_mask` (input values)                                                                                           |                                                                               | Observed-only: no public or archived docs; read from the shipped `detector-dom.min.js` SDK, where `cls_mask` is the one hard-coded owner-facing token and everything else is console configuration                                                                                             |
+| SessionStack             | `.sessionstack-sensitive`                                                                                            |                                                                               | SessionStack "Sensitive data" (archived copy; the live page blocks non-browser clients): text masked client-side by replacing each alphanumeric character with X                                                                                                                               |
+| Session Rewind           |                                                                                                                      | `[data-sr-redact]`                                                            | Session Rewind "Privacy settings" (Notion docs): the documented verb is "exclude"/"redact" for arbitrary elements with the replay rendering unspecified, so the stricter verb                                                                                                                  |
+
+Ignore tokens, recognized as events-only: Sentry's `.sentry-ignore` and
+`[data-sentry-ignore]` (their rrweb `ignoreSelector` defaults), PostHog's
+`.ph-ignore-input` (their `ignoreClass`), New Relic's `.nr-ignore` (their
+constant `ignore_class`; no attribute form ships), Highlight's
+`.highlight-ignore` (their `ignoreClass`), Heap's `[heap-ignore]`
+(autocapture-event suppression only; absent from their replay-inheritance
+list), and Userback's `.userback-ignore` (element rendered, its user input
+ignored). Each was verified, from the vendor's source or official docs, to
+suppress events without hiding content; honoring one can only reduce what
+is recorded, and the annotated element's content records normally, exactly
+as it does under that vendor. Smartlook's legacy
+`[data-recording-sensitive]` is the one dual-slot token: it masked text
+and ignored input events there, so it is in both the mask and ignore
+lists.
+
+Not recognized, deliberately: every vendor's reveal token (`.fs-unmask`,
+`.amp-unmask`, `.nr-unmask`, `[data-dd-privacy="allow"]`, `[data-hl-record]`,
+`[data-public]`, `[data-hj-allow]`, `[data-clarity-unmask]`,
+`[data-sl="unmask"]`, `[data-openreplay-unmask]`, `[data-cs-capture]`,
+`.lo-not-sensitive`, `[data-dtrum-allow]`, `[data-qm-allow]`), Smartlook's
+legacy `[data-recording-ignore]`, whose value-dependent semantics
+(`"mask"` or `"events"`) survive only in archived docs, and
+Mouseflow's `.mf-listen` modifier. Smartlook's `smartlook-hide` class is a
+mobile-WebView convention with no presence in the web bundle, and Heap's
+bare `heap-redact` is a documentation umbrella term rather than a token;
+neither is recognized. Nothing here rests on a guessed spelling: a token
+without a reachable official document or a shipped SDK to read it from is
+left out.
+
+`vendorCompat` can only ever **reduce** what is recorded, never reveal:
+enabling it merges only these mask, block, and events-only ignore lists.
+No foreign tool's unmask/allow convention is ever honored, on either
+setting -- not even Amplitude's own `.amp-unmask` -- because doing so would
+let markup the embedder may not control turn masking off. Unmasking comes
+only from `.rr-unmask`, the neutral `data-privacy="unmask"` attribute, or an
+explicit policy/recording option. If you want the compat mask/block lists,
+add the classes you need as `mask`/`block` rules instead.
+
+Datadog's `allow` and `mask-unless-allowlisted` values are excluded as
+reveal conventions. Datadog has no customer-facing ignore token: its
+internal `ignore` level covers scripts and metadata tags, not annotated
+elements, so nothing of Datadog's compiles into the ignore list.
+
+(`.rr-mask` and `.rr-block` also work under `minimal`, through the existing
+`maskTextClass`/`blockClass` options above. `vendorCompat` has no effect
+under `minimal`, which merges no class conventions of its own; setting it
+there logs a one-time `console.warn` rather than being silently ignored.)
+
+##### Escape hatches and selector validation
+
+`unmaskTextSelector` is a `record()`-level escape hatch for text: a plain CSS
+selector (merged with any policy `unmask` rule selectors) that stays
+unmasked even under `strict`'s mask-everything default or a `mask` rule. It
+covers text and the preset's masked attributes (`title`, `placeholder`,
+`aria-label`) on elements inside the matched subtree -- this option, a policy
+`unmask` rule and a recognized unmask class are merged into one
+selector and behave identically. It cannot unmask input
+values or a sanitized URL, and it cannot override a protected input, a
+dropped media source under `strict`, or a `block`.
+
+> **EXPERIMENTAL -- performance note.** Configuring any unmask selector would
+> otherwise force a per-node ancestor walk, so rrweb first probes once per
+> flush whether the selector matches anything in the document at all, and
+> skips the walk when it does not. The probe is a full-document element sweep
+> (including open shadow roots), and it costs the most in exactly the case it
+> optimizes for: when **no** unmask target is present, every element is
+> visited before the answer comes back `null`. That cost scales with DOM
+> size and is paid on every flush. On a very large DOM where the unmask
+> target is usually absent, prefer not configuring an unmask selector at all.
+
+An invalid `maskTextSelector`, `unmaskTextSelector` or `blockSelector` --
+either the `record()`-level string option or a policy rule's selector -- is
+validated at setup and **dropped with a `console.warn`** that names the
+fragments it dropped. Validation is per comma-separated fragment: in
+`.pii, .broken:has-typo(` only the malformed half is dropped and `.pii`
+keeps working, so one malformed fragment cannot take the others down with
+it -- including when the malformed half has a stray closing bracket or an
+unterminated quote, which is demoted to plain text rather than allowed to
+swallow the separators after it. Recording continues with the remaining selectors; a dropped
+`mask`/`block` selector therefore protects nothing, so watch for that
+warning rather than treating it as cosmetic. Where there is no `document` to
+validate against at all (server-side rendering, a worker), selectors are
+assumed valid rather than all dropped.
+A selector that passes validation but throws while matching (a hostile
+`matches` override, a detached document) still fails closed: a mask decision
+masks the affected text and attributes, and a block decision blocks the
+affected element, each with a one-time `console.warn`.
+
+```js
+record({
+  privacyPolicy: { version: 1, preset: 'strict' },
+  unmaskTextSelector: '.support-widget',
+});
+```
+
+##### Heuristic PII detectors
+
+Heuristic PII detection (email, phone, Luhn-valid payment card, SSN-like,
+IPv4) is never implied by a preset. Opt in with
+`@rrweb/rrweb-plugin-privacy-detectors` (or its `applyPrivacyDetectors`
+helper), which masks the whole text node when a detector matches -- there is
+no character-range masking and no support for custom detector patterns.
+Detection scans **page text only**, at snapshot time and on later live text
+mutations. It only applies to text that would otherwise be recorded unmasked
+-- text already masked by a preset, selector, or manual option keeps that
+masking (including a trusted manual `maskTextFn` output). Attribute values
+are not scanned; use the presets' masked-attribute defaults or policy rules
+for those.
+
+Input values are never scanned. Instead, **while detectors are active every
+input value is occluded to its length** (`'*'.repeat(value.length)`),
+whatever the preset -- the plugin's policy compiles to `maskAllInputs: true`
+even on a `minimal` base, and no unmask escape reopens it: neither
+`unmaskTextSelector`, nor a policy `unmask` rule, nor `.rr-unmask`
+reveals an input value. Scanning one would be worse than useless: a value is
+re-examined on every input event, so a card number is recorded verbatim in
+every prefix shorter than the first Luhn-valid length, and a value that
+scans clean still discloses every kind of PII the fixed pattern set does not
+model (passport numbers, non-US phone formats, dates of birth, account
+numbers, free text). Page text is different in kind -- already rendered, not
+accumulated a character at a time -- which is why scanning still applies
+there.
+
+```js
+import { getRecordPrivacyDetectorsPlugin } from '@rrweb/rrweb-plugin-privacy-detectors';
+
+record({
+  emit(event) {
+    // store event
+  },
+  plugins: [getRecordPrivacyDetectorsPlugin()],
+});
+```
+
+Once loaded, text detection runs independently of the active preset --
+including `minimal` -- on top of whatever masking that preset already applies,
+and input occlusion is unconditional. The first time the plugin applies its
+policy, it logs a one-time `console.info` ("privacy-detectors active: input
+values record as length-only stars") as a visible confirmation that input
+occlusion is in force.
+
+##### Attribute and input masking callbacks
+
+For unusual attribute-bearing applications, `maskAllElementAttributes` is the
+coarse fail-closed option and `maskAttributeFn(name, value, element)` is the
+targeted escape hatch. `maskAllElementAttributes` and `maskAttributeFn` are
+mutually exclusive: if both are supplied, `maskAllElementAttributes` wins and
+`maskAttributeFn` is ignored, with a one-time console warning. A throwing
+`maskAttributeFn` fails closed to stars rather than leaking the original
+value. Under `minimal`, `maskAttributeFn`'s return value is used as-is; under
+`balanced`/`strict` the compiled policy still runs on top of it (URL
+sanitization, `title`/`placeholder`/`aria-label` masking, ...) and can only
+narrow what the callback chose to keep, never restore something the policy
+would otherwise mask. `style`/`_cssText` are exempt from all of this.
+Likewise, under `minimal`, `maskInputFn`'s return value is trusted verbatim;
+under `balanced`/`strict` -- or with the detectors plugin loaded, which forces
+the same posture -- `maskInputFn` output is star-replaced: the callback
+controls length, never content. Every callback fails closed the
+same way: a `maskInputFn` or `maskTextFn` that throws, or returns anything
+other than a string, yields stars for the raw value instead of aborting the
+snapshot or recording the value. Protected inputs (see above) never reach
+`maskInputFn` at all, and an input whose `type` or `autocomplete` cannot be
+read (a proxied or cross-realm element that throws on property access) is
+treated as protected.
+
+##### Canvas masking
 
 Canvas applications can provide capture-time regions when using FPS canvas
 sampling. Coordinates are CSS pixels relative to the canvas. Return `[]` when
 the frame is safe unchanged, or `null`/`undefined` when regions cannot be
-computed; rrweb skips unanswerable frames. Invalid rectangles and thrown errors
-also fail closed. Masking occurs before encoding, and configuring the adapter
-suppresses the separate `rr_dataURL` full-snapshot path so an unmasked still
-cannot bypass it.
+computed; rrweb skips unanswerable frames. Invalid rectangles and thrown
+errors also fail closed. Regions are scaled against the canvas's layout
+content box (`clientWidth`/`clientHeight` minus padding), never its
+transformed bounding rect, so a CSS `transform` on the canvas cannot shrink
+a mask. Supplying `canvasMasking` at all forces
+`sampling.canvas` onto the FPS/OffscreenCanvas capture path (defaulting to
+`4` if you haven't already set a number), regardless of what `isConfigured()`
+answers at that moment -- the capture mode is fixed at `record()` while
+`isConfigured()` is re-read every frame, and a provider that switches on
+later must already be on the path that can mask. That path is the only one
+that renders full frames through the masking adapter before they reach the
+encoding worker -- the raw command-stream capture mode
+(`sampling.canvas: 'all'`) replays canvas API calls verbatim and has no way to
+redact anything. Configuring the adapter also suppresses the separate
+`rr_dataURL` full-snapshot path, so an unmasked still can't bypass it.
 
 ```js
 record({
@@ -315,11 +647,127 @@ record({
 });
 ```
 
-For unusual attribute-bearing applications, `maskAllElementAttributes` is the
-coarse fail-closed option and `maskAttributeFn(name, value, element)` is the
-targeted escape hatch. The coarse option wins if both are supplied. Callback
-errors are masked rather than exposing the original value, and neither option
-can weaken password protection or a `privacyPolicy` decision.
+##### Migrating to Privacy at Capture
+
+Breaking changes versus pre-2.0 masking, for anyone upgrading:
+
+- `needMaskingText` and `serializeNodeWithId` (from `rrweb-snapshot`) take the
+  mask-text selector pre-split (`{maskAll, selector}`, from the exported
+  `splitMaskAllSelector`) instead of a raw string. Two coercions keep an
+  unmigrated caller masking rather than silently matching nothing: a raw
+  string or `null` in the selector slot is split on the spot, and a
+  `needMaskingText` call using the pre-2.0 positional signature
+  `(node, maskTextClass, maskTextSelector, checkAncestors)` is detected by
+  the boolean in the fourth slot and shifted back into place, so its ancestor
+  walk still happens. Migrate anyway -- the coercions are a safety net, not a
+  supported signature.
+- `<style>` text inside masked subtrees is never masked, on any path: CSS is
+  never masked.
+- `maskInputFn` output is star-replaced under `balanced`/`strict` (length
+  only, never content); `maskAttributeFn` output is policy-final and mutually
+  exclusive with `maskAllElementAttributes` (the latter wins, with a one-time
+  warning).
+- `password`/`hidden` inputs and autocomplete `cc-*`/`current-password`/
+  `new-password`/`one-time-code` fields (native form controls; custom
+  elements follow upstream behavior) are now always masked regardless of
+  `maskInputOptions`; previously some could record raw under `minimal`.
+- An invalid `maskTextSelector`/`unmaskTextSelector`/`blockSelector` is now
+  dropped with a `console.warn` at setup instead of silently ignored, per
+  comma-separated fragment rather than whole-string.
+- Same-element mask/unmask ties now resolve to masking (previously unmask
+  won).
+- Unmasking recognizes only `.rr-unmask`, `data-privacy="unmask"`, and
+  explicit policy/`record()` selectors. No foreign tool's unmask convention
+  is ever honored, on either `vendorCompat` setting (a page author's mask
+  decision is never overridden by a convention rrweb cannot verify).
+- Masking a form value also suppresses a `<select>` option's `selected` flag,
+  via the new exported `shouldMaskInput` predicate.
+- `maskInputValue` is deprecated in favor of `maskInput`.
+- `canvasMasking` only forces the FPS capture path when masking is actually
+  in force; `record()` no longer mutates the `sampling` object it was passed
+  and no longer re-exports `resolveCanvasSampling`.
+- `rrweb-snapshot`'s privacy types are re-exports from `@rrweb/types`, the new
+  source of truth; `rrweb-snapshot`'s public type surface is unchanged.
+- `ImageBitmapDataURLWorkerParams` (`@rrweb/types`) is now a union; privacy
+  rule `style`/`classification`, custom detectors, and the `'custom'` preset
+  are removed from the policy schema.
+- Heuristic detection now masks whole values (no character-range masking) and
+  scans page text only; input values are never scanned by detectors, on any
+  path -- see [Heuristic PII detectors](#heuristic-pii-detectors).
+- `sanitizeUrl` returns `null`, not `''`, for an unparseable URL, so the
+  attribute is dropped instead of emptied (an empty `src`/`href` re-resolves
+  to the document URL at replay and gets requested).
+- **EXPERIMENTAL, open design question for upstream:** the Meta event's own
+  `href` (via the new `sanitizeMetaUrl`) is scoped like `balanced` even
+  under `strict` -- masking only blocked-list parameters -- because it is
+  the recording's own address, not page-author markup; every DOM URL
+  attribute keeps `strict`'s normal mask-everything-unless-allowlisted
+  treatment.
+- Under URL sanitization (`balanced`/`strict`), a **relative** URL in an
+  attribute rrweb does not already absolutify -- `<form action>`,
+  `<video poster>`, and similar -- is rewritten root-relative: `pay/confirm`
+  is recorded as `/pay/confirm`. Sanitization parses against an internal
+  base URL and re-serializes the path, which normalizes away the difference
+  between a document-relative and a root-relative reference.
+- `data-privacy` and the native `rr-*` class conventions are managed-preset
+  features: under `minimal` a `mask`/`block`/`unmask` rule compiles to its
+  bare selector and switches nothing else on. (An earlier iteration turned
+  `data-privacy` on under `minimal` as soon as a same-action rule existed.)
+- These privacy helpers were removed from `rrweb-snapshot`'s exports, their
+  behavior folded into the plain masking primitives (`maskInput`,
+  `shouldMaskInput`, `resolveTextValue`, `finalizeAttribute`) plus the
+  compiled policy: `maskTextWithPrivacy`, `maskInputWithPrivacy`,
+  `shouldMaskInputWithPrivacy`, `maskAttributeWithPrivacy`,
+  `protectSerializedAttribute`, `getPrivacyAction`, and
+  `mergeBlockSelectors`.
+- `rrweb-snapshot`'s barrel now also re-exports four internals --
+  `splitSelectorList`, `stars`, `passesLuhn`, and `validateSelector`. They
+  are `@internal` and **unstable**: exported for cross-package use and direct
+  unit testing, not part of the supported API, and free to change or
+  disappear without a major bump.
+
+##### For event consumers
+
+The changes above are about configuring the recorder. If you consume the
+recorded event stream directly -- a replayer, an exporter, a redaction
+auditor -- Privacy at Capture changes what shows up on the wire, independent
+of any config you pass:
+
+- An attribute value can now be `null` where it previously carried a string.
+  This means the attribute was dropped entirely, not emptied -- e.g. a
+  blocked `<audio src>` with no placeholder to fall back to, or an
+  unparseable URL. Treat `null` the same as "attribute absent," not as an
+  empty string.
+- A masked media source (`src`, `poster`, and similar, on `<img>`/`<video>`)
+  is replaced by an inline `data:image/svg+xml` URI -- a solid-color
+  rectangle at the element's declared pixel `width`/`height` -- rather than
+  by the original bytes or a bare placeholder token. Layout-dependent
+  consumers can keep sizing off it; anything reading pixel content will see
+  the placeholder, not the source image.
+- Masked text is star-replaced character by character (`\S` becomes `*`);
+  whitespace, including newlines, is left untouched so line breaks and
+  spacing in the original still show through the stars.
+- With a `canvasMasking` adapter configured, canvas capture switches to the
+  FPS frame-image path: periodic full-frame snapshot events rather than
+  incremental drawing-command mutations. A consumer that replays canvas
+  mutations command-by-command will instead see whole-frame "keyframe"
+  events at the configured sampling rate. Under `strict` this does not
+  apply, because `strict` emits **no** canvas events at all: `blockMedia`
+  disables `recordCanvas` outright, even where it was explicitly requested
+  (with a one-time `console.warn`).
+- Canvas elements inside a shadow root are discovered only through **native**
+  shadow roots. A polyfilled shadow root is no longer walked for canvases, so
+  canvases that live only inside one are not captured.
+
+One more thing worth flagging if your pages already use a `data-privacy`
+attribute for something unrelated to rrweb: under `balanced`/`strict`,
+rrweb now reads that attribute as its own privacy binding regardless of who
+put it there or why. An element carrying `data-privacy="mask"` for some
+other purpose gets masked; an unrecognized value on it also masks (see the
+fail-closed rule above). This is a real collision, not a bug -- it is
+deliberately over-protective, on the theory that a false positive (masking
+something that did not need it) is a better failure mode than a false
+negative (missing something that did).
 
 #### Checkout
 
diff --git a/packages/plugins/rrweb-plugin-network-record/tsconfig.json b/packages/plugins/rrweb-plugin-network-record/tsconfig.json
index b70866e1ab..fc5391c651 100644
--- a/packages/plugins/rrweb-plugin-network-record/tsconfig.json
+++ b/packages/plugins/rrweb-plugin-network-record/tsconfig.json
@@ -1,7 +1,13 @@
 {
   "extends": "../../../tsconfig.base.json",
-  "include": ["src"],
-  "exclude": ["vite.config.ts", "vitest.config.ts", "test"],
+  "include": [
+    "src"
+  ],
+  "exclude": [
+    "vite.config.ts",
+    "vitest.config.ts",
+    "test"
+  ],
   "compilerOptions": {
     "rootDir": "src",
     "tsBuildInfoFile": "./tsconfig.tsbuildinfo"
@@ -12,6 +18,9 @@
     },
     {
       "path": "../../utils"
+    },
+    {
+      "path": "../../rrweb"
     }
   ]
 }
diff --git a/packages/plugins/rrweb-plugin-network-replay/tsconfig.json b/packages/plugins/rrweb-plugin-network-replay/tsconfig.json
index dd9ef0fc92..8d73f951ee 100644
--- a/packages/plugins/rrweb-plugin-network-replay/tsconfig.json
+++ b/packages/plugins/rrweb-plugin-network-replay/tsconfig.json
@@ -1,17 +1,25 @@
 {
   "extends": "../../../tsconfig.base.json",
-  "include": ["src"],
-  "exclude": ["vite.config.ts", "test"],
+  "include": [
+    "src"
+  ],
+  "exclude": [
+    "vite.config.ts",
+    "test"
+  ],
   "compilerOptions": {
     "rootDir": "src",
     "tsBuildInfoFile": "./tsconfig.tsbuildinfo"
   },
   "references": [
+    {
+      "path": "../rrweb-plugin-network-record"
+    },
     {
       "path": "../../types"
     },
     {
-      "path": "../rrweb-plugin-network-record"
+      "path": "../../rrweb"
     }
   ]
 }
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/README.md b/packages/plugins/rrweb-plugin-privacy-detectors/README.md
index 3dd036e5c2..5d5daa6491 100644
--- a/packages/plugins/rrweb-plugin-privacy-detectors/README.md
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/README.md
@@ -1,10 +1,26 @@
 # @rrweb/rrweb-plugin-privacy-detectors
 
-Opt-in Highlight-style heuristic PII matching for rrweb Privacy at Capture.
+Opt-in heuristic PII matching for rrweb Privacy at Capture — inspired by the
+automatic PII redaction found in commercial session-replay tooling:
+whole-value masking of a **page text node** when a detector matches (email,
+phone, Luhn-valid payment card, SSN-like, IPv4). Detection covers the full
+snapshot and later live text mutations.
 
-`balanced` and `strict` mask form values and honor `data-privacy` / policy
-rules. They do **not** scan page text for emails, phones, cards, SSNs, or IP
-addresses unless this plugin (or `applyPrivacyDetectors`) is used.
+**Input values are never scanned. While this plugin is loaded, every input
+value is occluded to its length instead** (`'*'.repeat(value.length)`),
+whatever privacy preset you configured — including none at all. The one
+exception follows from how the guarantee works: occlusion is driven by the
+compiled detector set, so loading the plugin with every detector flag
+disabled compiles to no detectors and does not force input occlusion. See
+[Why inputs are occluded rather than scanned](#why-inputs-are-occluded-rather-than-scanned).
+
+Attribute values are not scanned either -- attribute masking is handled by
+the privacy presets and policy rules instead.
+
+No privacy preset implies detection on its own. `balanced` and `strict` mask
+form values and honor `data-privacy` / policy rules, but neither one scans
+page text for emails, phones, cards, SSNs, or IP addresses unless this plugin
+(or `applyPrivacyDetectors`) is used.
 
 ## Installation
 
@@ -34,8 +50,18 @@ record({
 });
 ```
 
-If `privacyPolicy` is omitted, the plugin keeps the `legacy` preset (existing
-`maskTextFn` / `maskInputOptions` behavior) and only adds heuristic matching.
+If `privacyPolicy` is omitted, the plugin keeps the `minimal` preset (existing
+`maskTextFn` / `maskInputOptions` behavior) -- and still detects: detection is
+independent of preset, so a bare `record({ plugins: [getRecordPrivacyDetectorsPlugin()] })`
+with no `privacyPolicy` at all masks any page text node a detector matches,
+at snapshot time and on live text mutations, on top of whatever `maskTextFn`
+already does. Detectors only inspect text that would otherwise be recorded
+unmasked: where a manual option already masks (e.g. a trusted `maskTextFn`
+composition), that output is kept as-is.
+
+Input values are the exception to "independent of preset": the plugin's
+policy compiles to `maskAllInputs: true` even on a `minimal` base, so form
+values are occluded to length regardless of what you configured.
 
 For snapshot-only use (no recorder):
 
@@ -47,3 +73,40 @@ snapshot(document, {
   privacyPolicy: applyPrivacyDetectors({ version: 1, preset: 'balanced' }),
 });
 ```
+
+## Why inputs are occluded rather than scanned
+
+Two reasons, and neither is fixable by a better pattern set.
+
+**Scanning a value as it is typed records raw prefixes.** An input value is
+re-examined on every input event. A payment card number does not trip the
+`paymentCard` detector until it is long enough for Luhn to pass, so every
+keystroke before that is recorded verbatim and the full number is trivially
+reconstructable from the prefixes -- even though the final value comes out
+masked. The same holds for an email that is only an email once the `@` and
+the domain arrive.
+
+**A clean scan is still a disclosure.** Deciding to record a value because
+no detector matched publishes everything the detectors do not model:
+passport and national ID numbers outside the SSN shape, non-US phone
+formats, dates of birth, account and policy numbers, addresses, free-text
+answers. A fixed pattern set cannot enumerate PII, so "nothing matched" is
+never evidence that a value is safe.
+
+Occluding the value to its length sidesteps both: no prefix is ever recorded,
+and the decision does not depend on the pattern set being complete. Text
+nodes are different in kind -- page copy is already rendered and static, is
+not accumulated a character at a time, and is overwhelmingly not PII -- which
+is why scanning still applies there.
+
+If you know a field is sensitive, say so directly with `data-privacy="mask"`,
+a policy rule, or a `balanced`/`strict` preset. Detectors are a backstop, not
+a control.
+
+## Known limitations
+
+- If `applyPrivacyPolicy` returns something that fails to compile, `record()`
+  falls back to the un-transformed policy and only logs a `console.error` --
+  that fallback also drops the forced input occlusion.
+- Text longer than `MAX_SCAN_LENGTH` (10,000 characters) is masked wholesale
+  instead of scanned.
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts b/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts
index 88e663eedd..c4b279270c 100644
--- a/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/src/index.ts
@@ -13,10 +13,24 @@ export const PLUGIN_NAME = 'rrweb/privacy-detectors@1';
 
 export { applyPrivacyDetectors, DEFAULT_PRIVACY_DETECTORS };
 
+let loggedActiveOnce = false;
+
 /**
- * Highlight-style heuristic PII matching (email, phone, Luhn payment card,
- * SSN-like, IPv4). Opt in explicitly; `balanced` and `strict` do not enable
- * these detectors on their own.
+ * Heuristic PII matching (email, phone, Luhn payment card, SSN-like, IPv4)
+ * over **page text**; a detector hit masks the whole text node. Opt in
+ * explicitly; `balanced` and `strict` do not enable these detectors on
+ * their own.
+ *
+ * Input values are never scanned. The policy this plugin produces compiles
+ * to `maskAllInputs: true` whatever preset it started from -- including a
+ * bare `minimal` base -- so every input value is occluded to its length while
+ * the plugin is loaded. The forcing is driven by the compiled detector set,
+ * so disabling every detector flag compiles to no detectors and lifts the
+ * occlusion as well. Scanning a value as it is typed would record every
+ * raw prefix before a pattern could match (a card number is reconstructable
+ * from the keystrokes preceding the first Luhn-valid length), and a value
+ * that scans clean at every length would still be disclosed along with every
+ * kind of PII this fixed pattern set does not model.
  */
 export const getRecordPrivacyDetectorsPlugin: (
   options?: PrivacyDetectorsPluginOptions,
@@ -26,9 +40,15 @@ export const getRecordPrivacyDetectorsPlugin: (
   return {
     name: PLUGIN_NAME,
     applyPrivacyPolicy(policy) {
+      if (!loggedActiveOnce) {
+        loggedActiveOnce = true;
+        console.info(
+          'privacy-detectors active: input values record as length-only stars',
+        );
+      }
       const portable = (policy as PrivacyPolicy | undefined) || {
         version: 1 as const,
-        preset: 'legacy' as const,
+        preset: 'minimal' as const,
       };
       return applyPrivacyDetectors(portable, _options);
     },
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts b/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts
index cce77d559d..e6954e8a64 100644
--- a/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/test/index.test.ts
@@ -1,9 +1,18 @@
-import { describe, expect, it } from 'vitest';
+/**
+ * @vitest-environment jsdom
+ */
+import { describe, expect, it, vi } from 'vitest';
 import {
   applyPrivacyDetectors,
   getRecordPrivacyDetectorsPlugin,
   PLUGIN_NAME,
 } from '../src/index';
+import {
+  compilePrivacyPolicy,
+  detectSensitiveValue,
+  maskInput,
+  type PrivacyPolicy,
+} from 'rrweb-snapshot';
 
 describe('privacy detectors plugin', () => {
   it('opts heuristic detectors onto a balanced policy', () => {
@@ -47,7 +56,7 @@ describe('privacy detectors plugin', () => {
     const plugin = getRecordPrivacyDetectorsPlugin();
     expect(plugin.applyPrivacyPolicy?.(undefined)).toMatchObject({
       version: 1,
-      preset: 'legacy',
+      preset: 'minimal',
       detectors: {
         email: true,
         phone: true,
@@ -57,4 +66,90 @@ describe('privacy detectors plugin', () => {
       },
     });
   });
+
+  it('plugin with no user policy yields a minimal policy whose compiled detectors are active', () => {
+    const plugin = getRecordPrivacyDetectorsPlugin();
+    const policy = plugin.applyPrivacyPolicy!(undefined) as PrivacyPolicy;
+    expect(policy.preset).toBe('minimal');
+    const compiled = compilePrivacyPolicy(policy);
+    expect(compiled.detectors.length).toBeGreaterThan(0);
+    expect(detectSensitiveValue('bob@example.com', compiled)).toBe(true);
+  });
+
+  it.each(['minimal', 'balanced', 'strict'] as const)(
+    'forces maskAllInputs on a %s base policy',
+    (preset) => {
+      const plugin = getRecordPrivacyDetectorsPlugin();
+      const policy = plugin.applyPrivacyPolicy!({
+        version: 1,
+        preset,
+      }) as PrivacyPolicy;
+      const compiled = compilePrivacyPolicy(policy);
+      // Input values are occluded to length, never scanned -- so the posture
+      // does not depend on which preset the page configured.
+      expect(compiled.maskAllInputs).toBe(true);
+      expect(compiled.preset).toBe(preset);
+    },
+  );
+
+  it('an unmask escape never reopens an input value', () => {
+    const plugin = getRecordPrivacyDetectorsPlugin();
+    const policy = plugin.applyPrivacyPolicy!({
+      version: 1,
+      preset: 'minimal',
+      rules: [
+        {
+          target: { type: 'selector', selector: '.rr-unmask' },
+          action: 'unmask',
+        },
+      ],
+    }) as PrivacyPolicy;
+    const compiled = compilePrivacyPolicy(policy);
+    expect(compiled.unmaskTextSelector).toContain('.rr-unmask');
+    // The unmask selector reopens text and the preset's masked attributes;
+    // `maskAllInputs` is consulted with no unmask escape at all.
+    expect(compiled.maskAllInputs).toBe(true);
+    expect(
+      maskInput({
+        element: document.createElement('input'),
+        tagName: 'input',
+        type: 'text',
+        value: 'Visible Name',
+        maskInputOptions: {},
+        privacy: compiled,
+      }),
+    ).toBe('*'.repeat('Visible Name'.length));
+  });
+});
+
+/**
+ * The module-level once-flag means this only reads cleanly against a fresh
+ * module instance -- `vi.resetModules()` plus a dynamic re-import isolates
+ * it from every other test in this file that already exercised
+ * `applyPrivacyPolicy`.
+ */
+describe('privacy-detectors active info log', () => {
+  it('logs once at first policy application, across plugin instances', async () => {
+    vi.resetModules();
+    const info = vi.spyOn(console, 'info').mockImplementation(() => undefined);
+    try {
+      const fresh = await import('../src/index');
+      const plugin = fresh.getRecordPrivacyDetectorsPlugin();
+      plugin.applyPrivacyPolicy?.({ version: 1, preset: 'minimal' });
+      plugin.applyPrivacyPolicy?.({ version: 1, preset: 'minimal' });
+      const secondPlugin = fresh.getRecordPrivacyDetectorsPlugin();
+      secondPlugin.applyPrivacyPolicy?.({ version: 1, preset: 'minimal' });
+
+      const activeLogs = info.mock.calls.filter(([msg]) =>
+        String(msg).includes('privacy-detectors active'),
+      );
+      expect(activeLogs).toHaveLength(1);
+      expect(activeLogs[0][0]).toContain(
+        'input values record as length-only stars',
+      );
+    } finally {
+      info.mockRestore();
+      vi.resetModules();
+    }
+  });
 });
diff --git a/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json b/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json
index 3412c6c7aa..dee9f4ff89 100644
--- a/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json
+++ b/packages/plugins/rrweb-plugin-privacy-detectors/tsconfig.json
@@ -1,17 +1,23 @@
 {
   "extends": "../../../tsconfig.base.json",
-  "include": ["src"],
-  "exclude": ["vite.config.ts", "vitest.config.ts", "test"],
+  "include": [
+    "src"
+  ],
+  "exclude": [
+    "vite.config.ts",
+    "vitest.config.ts",
+    "test"
+  ],
   "compilerOptions": {
     "rootDir": "src",
     "tsBuildInfoFile": "./tsconfig.tsbuildinfo"
   },
   "references": [
     {
-      "path": "../../rrweb-snapshot"
+      "path": "../../types"
     },
     {
-      "path": "../../types"
+      "path": "../../rrweb-snapshot"
     }
   ]
 }
diff --git a/packages/rrweb-snapshot/package.json b/packages/rrweb-snapshot/package.json
index 3db3a8d87b..a6dbad9681 100644
--- a/packages/rrweb-snapshot/package.json
+++ b/packages/rrweb-snapshot/package.json
@@ -46,13 +46,11 @@
         "types": "./dist/index.d.cts",
         "default": "./dist/rrweb-snapshot.umd.cjs"
       }
-    },
-    "./privacy-policy.schema.json": "./privacy-policy.schema.json"
+    }
   },
   "files": [
     "umd",
     "dist",
-    "privacy-policy.schema.json",
     "package.json"
   ],
   "sideEffects": false,
diff --git a/packages/rrweb-snapshot/privacy-policy.schema.json b/packages/rrweb-snapshot/privacy-policy.schema.json
deleted file mode 100644
index 6c323eac9a..0000000000
--- a/packages/rrweb-snapshot/privacy-policy.schema.json
+++ /dev/null
@@ -1,115 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://rrweb.io/schemas/privacy-policy-v1.json",
-  "title": "Privacy at Capture Policy v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["version", "preset"],
-  "properties": {
-    "version": { "const": 1 },
-    "preset": {
-      "enum": ["strict", "balanced", "custom", "legacy"]
-    },
-    "rules": {
-      "type": "array",
-      "items": { "$ref": "#/$defs/rule" }
-    },
-    "detectors": { "$ref": "#/$defs/detectors" },
-    "url": { "$ref": "#/$defs/url" }
-  },
-  "$defs": {
-    "sensitiveDataKind": {
-      "enum": [
-        "credential",
-        "payment",
-        "identity",
-        "contact",
-        "location",
-        "custom"
-      ]
-    },
-    "target": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["type", "selector"],
-      "properties": {
-        "type": { "const": "selector" },
-        "selector": { "type": "string", "minLength": 1 },
-        "attributes": {
-          "type": "array",
-          "items": { "type": "string", "minLength": 1 },
-          "uniqueItems": true
-        }
-      }
-    },
-    "rule": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["target", "action"],
-      "properties": {
-        "target": { "$ref": "#/$defs/target" },
-        "action": { "enum": ["allow", "mask", "exclude"] },
-        "style": {
-          "enum": ["replacement", "solid", "blur", "pixelate", "shuffle"]
-        },
-        "classification": { "$ref": "#/$defs/sensitiveDataKind" }
-      }
-    },
-    "customDetector": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["name", "pattern"],
-      "properties": {
-        "name": { "type": "string", "minLength": 1, "pattern": ".*\\S.*" },
-        "pattern": { "type": "string", "minLength": 1, "maxLength": 256 },
-        "flags": {
-          "type": "string",
-          "pattern": "^[dgimsuv]{0,7}$"
-        },
-        "classification": { "$ref": "#/$defs/sensitiveDataKind" },
-        "minimumLength": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 1024
-        },
-        "maximumMatchLength": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 1024
-        }
-      }
-    },
-    "detectors": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "email": { "type": "boolean" },
-        "phone": { "type": "boolean" },
-        "paymentCard": { "type": "boolean" },
-        "ssn": { "type": "boolean" },
-        "ipAddress": { "type": "boolean" },
-        "custom": {
-          "type": "array",
-          "items": { "$ref": "#/$defs/customDetector" }
-        }
-      }
-    },
-    "url": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "blockedQueryParameters": {
-          "type": "array",
-          "items": { "type": "string" },
-          "uniqueItems": true
-        },
-        "allowedQueryParameters": {
-          "type": "array",
-          "items": { "type": "string" },
-          "uniqueItems": true
-        },
-        "removeHash": { "type": "boolean" }
-      }
-    }
-  }
-}
diff --git a/packages/rrweb-snapshot/src/index.ts b/packages/rrweb-snapshot/src/index.ts
index 63841fb8bd..2991f97621 100644
--- a/packages/rrweb-snapshot/src/index.ts
+++ b/packages/rrweb-snapshot/src/index.ts
@@ -6,6 +6,8 @@ import snapshot, {
   visitSnapshot,
   cleanupSnapshot,
   needMaskingText,
+  splitMaskAllSelector,
+  type MaskTextSelector,
   classMatchesRegex,
   IGNORED_NODE,
   genId,
@@ -38,7 +40,9 @@ export {
   visitSnapshot,
   cleanupSnapshot,
   needMaskingText,
+  splitMaskAllSelector,
   classMatchesRegex,
   IGNORED_NODE,
   genId,
 };
+export type { MaskTextSelector };
diff --git a/packages/rrweb-snapshot/src/privacy.ts b/packages/rrweb-snapshot/src/privacy.ts
index 22f8b9806f..e09e0a9a5f 100644
--- a/packages/rrweb-snapshot/src/privacy.ts
+++ b/packages/rrweb-snapshot/src/privacy.ts
@@ -1,53 +1,225 @@
 import type {
+  CompiledDetector,
   CompiledPrivacyPolicy,
-  PrivacyAction,
+  MaskAttributeFn,
+  MaskTextFn,
   PrivacyDetectorOptions,
   PrivacyPolicy,
-  SensitiveDataKind,
-  MaskAttributeFn,
+  VendorCompatId,
 } from './types';
-import dom from '@rrweb/utils';
-
-const ACTION_PRIORITY: Record<PrivacyAction, number> = {
-  allow: 0,
-  mask: 1,
-  exclude: 2,
-};
-
-const DATA_PRIVACY_RULES: CompiledPrivacyPolicy['rules'] = [
-  {
-    action: 'allow',
-    selector: '[data-privacy="allow"]',
+import { parentElement, untaintedTagName } from '@rrweb/utils';
+
+const NATIVE_MASK_CLASSES = '.rr-mask';
+const NATIVE_UNMASK_CLASSES = '.rr-unmask';
+const NATIVE_BLOCK_CLASSES = '.rr-block';
+
+// Other tools' conventions, merged only under `vendorCompat` — `true` for
+// every vendor here, or an array naming just the vendors to honor. Every
+// token was verified against the vendor's official docs or open-source SDK;
+// the source for each is in guide.md's "Vendor class recognition" table.
+// The mapping rule: each token maps to the closest treatment our verbs
+// express (mask, block, ignoreEvents), never a less protective one.
+// `ignoreEvents` tokens suppress input events from the annotated element
+// only, exactly as the vendor's own recorder does — they never imply
+// masking, unlike `data-privacy="ignore"`, which is mask plus silence. No
+// vendor's unmask/allow token is ever merged, under any form of the
+// setting: `vendorCompat` may only reduce what is recorded, never reveal,
+// and `.rr-unmask` stays native-only.
+/** @internal exported for the registry invariant tests; not part of the privacy API. */
+export const VENDOR_COMPAT: Record<
+  VendorCompatId,
+  { mask: string[]; block: string[]; ignoreEvents?: string[] }
+> = {
+  mixpanel: { mask: ['.mp-mask'], block: ['.mp-block'] },
+  fullstory: {
+    // the -without-consent variants are masked until their consent API reveals
+    mask: ['.fs-mask', '.fs-mask-without-consent'],
+    block: ['.fs-exclude', '.fs-exclude-without-consent'],
   },
-  {
-    action: 'mask',
-    selector: '[data-privacy="mask"]',
+  amplitude: { mask: ['.amp-mask'], block: ['.amp-block'] },
+  posthog: {
+    // posthog-js lazy-loaded-session-recorder.ts: ph-mask -> maskTextClass,
+    // ph-no-capture -> blockClass, ph-ignore-input -> ignoreClass
+    mask: ['.ph-mask'],
+    block: ['.ph-no-capture'],
+    ignoreEvents: ['.ph-ignore-input'],
   },
-  {
-    action: 'exclude',
-    selector: '[data-privacy="exclude"]',
+  sentry: {
+    // sentry-javascript replay-internal/src/util/getPrivacyOptions.ts
+    mask: ['.sentry-mask', '[data-sentry-mask]'],
+    block: ['.sentry-block', '[data-sentry-block]'],
+    ignoreEvents: ['.sentry-ignore', '[data-sentry-ignore]'],
   },
-];
+  datadog: {
+    // browser-sdk browser-rum-core/src/domain/privacy.ts: mask-user-input
+    // masks form values (and form-element text such as <option> labels)
+    // only there; mapped to text mask here because form values are already
+    // masked globally wherever compat applies (`maskAllInputs`), and
+    // dropping the token would record the form-element text it protects
+    mask: [
+      '.dd-privacy-mask',
+      '[data-dd-privacy="mask"]',
+      '.dd-privacy-mask-user-input',
+      '[data-dd-privacy="mask-user-input"]',
+    ],
+    block: ['.dd-privacy-hidden', '[data-dd-privacy="hidden"]'],
+  },
+  newrelic: {
+    // newrelic-browser-agent src/common/config/init.js: nr-mask/[data-nr-mask]
+    // -> maskText, nr-block/[data-nr-block] -> block, nr-ignore -> ignoreClass
+    // (class only; no attribute form ships)
+    mask: ['.nr-mask', '[data-nr-mask]'],
+    block: ['.nr-block', '[data-nr-block]'],
+    ignoreEvents: ['.nr-ignore'],
+  },
+  // Highlight / LaunchDarkly: highlight-run client/index.tsx passes
+  // blockClass 'highlight-block' and ignoreClass 'highlight-ignore' to its
+  // rrweb fork, whose default maskTextClass is 'highlight-mask'
+  highlight: {
+    mask: ['.highlight-mask'],
+    block: ['.highlight-block'],
+    ignoreEvents: ['.highlight-ignore'],
+  },
+  // [data-private] blocks under any value: placeholder, delete, lipsum
+  logrocket: { mask: [], block: ['[data-private]', '._lr-hide'] },
+  // Text is masked in place there, but images/videos are placeholdered too
+  // (help.hotjar.com "How to Suppress Text, Images, Videos and User Input");
+  // our mask verb leaves image sources readable, so block stands. The class
+  // form is also documented.
+  hotjar: { mask: [], block: ['[data-hj-suppress]', '.data-hj-suppress'] },
+  // Microsoft Clarity
+  clarity: { mask: ['[data-clarity-mask]'], block: [] },
+  smartlook: {
+    // the data-recording-* legacy attributes survive only in archived docs
+    // (smartlook.github.io "Sensitive data protection", via web.archive.org):
+    // data-recording-sensitive masked text AND ignored input values/events
+    // there, so it joins ignoreEvents alongside mask
+    mask: ['[data-sl="mask"]', '[data-recording-sensitive]'],
+    block: ['[data-sl="exclude"]', '[data-recording-disable]'],
+    ignoreEvents: ['[data-recording-sensitive]'],
+  },
+  openreplay: {
+    // -masked/-htmlmasked are deprecated aliases, still honored
+    mask: ['[data-openreplay-obscured]', '[data-openreplay-masked]'],
+    block: ['[data-openreplay-hidden]', '[data-openreplay-htmlmasked]'],
+  },
+  contentsquare: {
+    // encrypted capture there, masked here; blocked content is removed there
+    mask: ['[data-cs-encrypt]'],
+    block: ['[data-cs-mask]'],
+  },
+  heap: {
+    // help.heap.io "What privacy settings does Session replay inherit":
+    // both redact attributes redact the entire element in replay, so block.
+    // [heap-ignore] suppresses autocapture events only and is absent from
+    // the replay-inheritance list, so events-only. Tokens are attributes:
+    // the SDK selects `[heap-ignore]`, not a class.
+    mask: [],
+    block: ['[data-heap-redact-text]', '[data-heap-redact-attributes]'],
+    ignoreEvents: ['[heap-ignore]'],
+  },
+  mouseflow: {
+    // help.mouseflow.com "Excluding, masking and replacing content via
+    // code": mf-masked is "not recorded at all" and data-mf-replace swaps
+    // the subtree for its placeholder value, so both block; only
+    // data-mf-replace-inner keeps the structure (inner text replaced)
+    mask: ['[data-mf-replace-inner]'],
+    block: ['.mf-excluded', '.mf-masked', '[data-mf-replace]'],
+  },
+  // text scrambled, images blanked; .losensitive is an alias
+  luckyorange: { mask: [], block: ['.lo-sensitive', '.losensitive'] },
+  inspectlet: {
+    mask: ['.inspectlet-sensitive', '.inspectletIgnore'],
+    block: [],
+  },
+  dynatrace: { mask: ['[data-dtrum-mask]'], block: [] },
+  userback: {
+    // support.userback.io "Session replay": userback-block ignores the
+    // element and its children entirely; userback-ignore keeps the element
+    // rendered and ignores its user input, so events-only
+    mask: [],
+    block: ['.userback-block'],
+    ignoreEvents: ['.userback-ignore'],
+  },
+  zipy: { mask: [], block: ['.zipy-block'] },
+  quantummetric: {
+    // observed-only: docs are login-gated, tokens read from the shipped
+    // engine. Encrypted capture there, masked here; qm-block is a
+    // customer-config convention, qm-freeze-exclude the DOM-capture exclude
+    mask: ['[data-qm-encrypt]'],
+    block: ['[data-qm-block]', '[data-qm-freeze-exclude]'],
+  },
+  // observed-only: read from the shipped SDK; the official docs are
+  // customer-gated with no public or archived copy to verify against
+  glassbox: { mask: ['.cls_mask'], block: [] },
+  sessionstack: { mask: ['.sessionstack-sensitive'], block: [] },
+  sessionrewind: {
+    // sessionrewind.notion.site "Privacy settings": the documented verb is
+    // "exclude"/"redact" for arbitrary elements, replay rendering
+    // unspecified — so the stricter verb
+    mask: [],
+    block: ['[data-sr-redact]'],
+  },
+};
 
-const PRIVACY_PRESETS = new Set(['strict', 'balanced', 'custom', 'legacy']);
-const MASK_STYLES = new Set([
-  'replacement',
-  'solid',
-  'blur',
-  'pixelate',
-  'shuffle',
-]);
+const VENDOR_IDS = Object.keys(VENDOR_COMPAT) as VendorCompatId[];
+
+/** The vendors a `vendorCompat` setting names; an unknown id is dropped with a warning, mirroring invalid-selector handling. */
+function resolveVendorCompat(
+  vendorCompat: PrivacyPolicy['vendorCompat'],
+): VendorCompatId[] {
+  if (vendorCompat === true) return VENDOR_IDS;
+  if (!Array.isArray(vendorCompat)) return [];
+  const known: VendorCompatId[] = [];
+  const unknown: string[] = [];
+  for (const id of vendorCompat) {
+    if (Object.prototype.hasOwnProperty.call(VENDOR_COMPAT, id)) {
+      known.push(id);
+    } else {
+      unknown.push(String(id));
+    }
+  }
+  if (unknown.length)
+    console.warn(
+      `[rrweb privacy] dropping unknown vendorCompat id: ${unknown.join(', ')}`,
+    );
+  return known;
+}
 
-const SENSITIVE_ATTRIBUTES = new Set([
-  'alt',
-  'aria-description',
-  'aria-label',
-  'placeholder',
-  'style',
-  'title',
-  '_csstext',
+function vendorCompatSelector(
+  vendors: VendorCompatId[],
+  action: 'mask' | 'block' | 'ignoreEvents',
+): string | null {
+  const tokens: string[] = [];
+  for (const id of vendors) tokens.push(...(VENDOR_COMPAT[id][action] ?? []));
+  return tokens.join(',') || null;
+}
+
+// `data-privacy` fails closed: the mask token is the bare attribute minus the
+// two values that mean something else, so an unrecognized value masks.
+const DATA_PRIVACY = '[data-privacy]';
+const DATA_PRIVACY_MASK =
+  '[data-privacy]:not([data-privacy="unmask"]):not([data-privacy="block"])';
+const DATA_PRIVACY_UNMASK = '[data-privacy="unmask"]';
+const DATA_PRIVACY_BLOCK = '[data-privacy="block"]';
+const DATA_PRIVACY_IGNORE = '[data-privacy="ignore"]';
+
+const PRIVACY_PRESETS = new Set(['strict', 'balanced', 'minimal']);
+const MASKED_ATTRIBUTE_DEFAULTS = ['title', 'placeholder', 'aria-label'];
+
+const CSS_ATTRIBUTES = new Set(['style', '_csstext']);
+
+const RENDERING_METADATA_ATTRIBUTES = new Set([
+  'rr_width',
+  'rr_height',
+  'rr_scrollleft',
+  'rr_scrolltop',
+  'rr_mediastate',
+  'rr_open_mode',
 ]);
 
+const OPERATIONAL_ATTRIBUTES = new Set(['data-privacy', 'data-rr-is-password']);
+
 const URL_ATTRIBUTES = new Set([
   'action',
   'background',
@@ -55,66 +227,43 @@ const URL_ATTRIBUTES = new Set([
   'formaction',
   'href',
   'poster',
+  'rr_src',
   'src',
   'xlink:href',
 ]);
 
+/** Attributes that point at media bytes; dropped entirely under `strict`. */
 const MEDIA_SOURCE_ATTRIBUTES = new Set([
   'background',
   'data',
   'poster',
+  'rr_src',
   'src',
   'srcset',
 ]);
 
-export const DEFAULT_PRIVACY_DETECTORS: Required<
-  Omit<PrivacyDetectorOptions, 'custom'>
-> = {
-  email: true,
-  phone: true,
-  paymentCard: true,
-  ssn: true,
-  ipAddress: true,
-};
+const MEDIA_TAGS = new Set([
+  'AUDIO',
+  'EMBED',
+  'IFRAME',
+  'IMG',
+  'OBJECT',
+  'SOURCE',
+  'VIDEO',
+]);
 
-/**
- * Opt into Highlight-style heuristic PII detectors (email, phone, Luhn card,
- * SSN-like, IPv4). These are not implied by `balanced` or `strict`; load them
- * through this helper or `@rrweb/rrweb-plugin-privacy-detectors`.
- */
-export function applyPrivacyDetectors(
-  policy: PrivacyPolicy | undefined,
-  options?: Partial<typeof DEFAULT_PRIVACY_DETECTORS>,
-): PrivacyPolicy {
-  const base: PrivacyPolicy = policy || { version: 1, preset: 'balanced' };
-  return {
-    ...base,
-    detectors: {
-      ...DEFAULT_PRIVACY_DETECTORS,
-      ...options,
-      ...base.detectors,
-    },
-  };
-}
+const MEDIA_PLACEHOLDER_ATTRIBUTES = new Map([
+  ['IMG', new Set(['src', 'srcset', 'poster'])],
+  ['VIDEO', new Set(['poster'])],
+]);
 
-const DETECTOR_SCAN_CHUNK_SIZE = 8_192;
-const CUSTOM_DETECTOR_SCAN_CHUNK_SIZE = 512;
-const MAX_DETECTOR_MATCHES = 1_000;
-const MAX_CUSTOM_PATTERN_LENGTH = 256;
-const MAX_CUSTOM_MATCH_LENGTH = 1_024;
-const MAX_CUSTOM_QUANTIFIERS = 12;
-const DEFAULT_CUSTOM_MATCH_LENGTH = 256;
-
-const PROTECTED_AUTOCOMPLETE = new Set([
-  'cc-csc',
-  'cc-exp',
-  'cc-exp-month',
-  'cc-exp-year',
-  'cc-name',
-  'cc-number',
-  'current-password',
-  'new-password',
-  'one-time-code',
+const PLAIN_PIXEL_DIMENSION = /^\d{1,5}$/;
+
+export const FORM_VALUE_TAGS = new Set([
+  'INPUT',
+  'OPTION',
+  'SELECT',
+  'TEXTAREA',
 ]);
 
 const DEFAULT_BLOCKED_QUERY_PARAMETERS = [
@@ -128,523 +277,452 @@ const DEFAULT_BLOCKED_QUERY_PARAMETERS = [
   'token',
 ];
 
-const FORM_VALUE_TAGS = new Set(['INPUT', 'OPTION', 'SELECT', 'TEXTAREA']);
-
-const MEDIA_TAGS = new Set([
-  'AUDIO',
-  'EMBED',
-  'IFRAME',
-  'IMG',
-  'OBJECT',
-  'SOURCE',
-  'VIDEO',
-]);
-
-const SAFE_GENERATED_ATTRIBUTES = new Set([
-  'rr_width',
-  'rr_height',
-  'rr_left',
-  'rr_top',
-  'rr_position',
-  'rr_transform',
-  'rr_display',
-  'rr_scrollleft',
-  'rr_scrolltop',
-  'rr_mediastate',
-  'rr_open_mode',
-]);
+const CARD_CANDIDATE = /(?:^|[^0-9-])((?:\d[ -]?){12,18}\d)(?:$|[^0-9-])/;
+const SSN_PATTERN = /\b(?!000|666|9\d{2})\d{3}-?(?!00)\d{2}-?(?!0000)\d{4}\b/;
+const EMAIL_PATTERN =
+  /[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]{1,64}@[a-zA-Z0-9-]{1,63}(?:\.[a-zA-Z0-9-]{1,63})+/;
+const PHONE_PATTERN = /(?:^|\s)\+?\d{0,3}[\s.-]?\(?\d[\d ().-]{5,13}\d(?:$|\s)/;
+const IPV4_PATTERN = /\b(?:\d{1,3}\.){3}\d{1,3}\b/;
+const MAX_SCAN_LENGTH = 10_000;
 
-export type SensitiveMatch = {
-  start: number;
-  end: number;
-  kind: SensitiveDataKind;
-  detector: string;
+export const DEFAULT_PRIVACY_DETECTORS: Required<PrivacyDetectorOptions> = {
+  email: true,
+  phone: true,
+  paymentCard: true,
+  ssn: true,
+  ipAddress: true,
 };
 
-export function compilePrivacyPolicy(
+/** Opts into heuristic PII text detectors; see guide.md "Heuristic PII detectors". */
+export function applyPrivacyDetectors(
   policy: PrivacyPolicy | undefined,
-): CompiledPrivacyPolicy {
-  const effectivePolicy: PrivacyPolicy = policy || {
-    version: 1,
-    preset: 'legacy',
-  };
-  if (effectivePolicy.version !== 1) {
-    throw new Error(
-      `Unsupported Privacy at Capture policy version: ${String(
-        effectivePolicy.version,
-      )}`,
-    );
-  }
-  if (!PRIVACY_PRESETS.has(effectivePolicy.preset)) {
-    throw new Error(
-      `Unsupported privacy preset: ${String(effectivePolicy.preset)}`,
-    );
-  }
-
-  const policyRules = (effectivePolicy.rules || []).map((rule) => {
-    if (!rule.target || rule.target.type !== 'selector') {
-      throw new Error(
-        `Unsupported privacy target type: ${String(rule.target?.type)}`,
-      );
-    }
-    if (!rule.target.selector)
-      throw new Error('Privacy rule selector cannot be empty');
-    if (!(rule.action in ACTION_PRIORITY)) {
-      throw new Error(`Unsupported privacy action: ${String(rule.action)}`);
-    }
-    if (rule.style && !MASK_STYLES.has(rule.style)) {
-      throw new Error(`Unsupported privacy mask style: ${String(rule.style)}`);
-    }
-    return {
-      action: rule.action,
-      style: rule.style,
-      classification: rule.classification,
-      selector: rule.target.selector,
-      attributes: rule.target.attributes
-        ? new Set(
-            rule.target.attributes.map((attribute) => attribute.toLowerCase()),
-          )
-        : undefined,
-    };
-  });
-  const rules = [...DATA_PRIVACY_RULES, ...policyRules];
-
-  const detectorOptions = {
-    ...effectivePolicy.detectors,
+  options?: PrivacyDetectorOptions,
+): PrivacyPolicy {
+  const base: PrivacyPolicy = policy || { version: 1, preset: 'minimal' };
+  return {
+    ...base,
+    detectors: {
+      ...DEFAULT_PRIVACY_DETECTORS,
+      ...options,
+      ...base.detectors,
+    },
   };
-  const detectors: CompiledPrivacyPolicy['detectors'] = [];
+}
 
-  if (detectorOptions.email) {
-    detectors.push({
-      name: 'email',
-      regex:
-        /[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]{1,64}@[a-zA-Z0-9-]{1,63}(?:\.[a-zA-Z0-9-]{1,63})+/g,
-      classification: 'contact',
-      minimumLength: 6,
-      maximumMatchLength: 320,
-      scanChunkSize: DETECTOR_SCAN_CHUNK_SIZE,
-      validate: (candidate) => candidate.length <= 254,
-    });
-  }
-  if (detectorOptions.phone) {
+export function buildDetectors(
+  options: PrivacyDetectorOptions | undefined,
+): CompiledDetector[] {
+  const opts = options || {};
+  const detectors: CompiledDetector[] = [];
+  if (opts.email)
+    detectors.push({ name: 'email', test: (v) => EMAIL_PATTERN.test(v) });
+  if (opts.phone)
     detectors.push({
       name: 'phone',
-      regex: /(?:\+?\d[\d ().-]{7,29}\d)/g,
-      classification: 'contact',
-      minimumLength: 10,
-      maximumMatchLength: 32,
-      scanChunkSize: DETECTOR_SCAN_CHUNK_SIZE,
-      validate: (candidate) => {
-        const length = candidate.replace(/\D/g, '').length;
-        return length >= 10 && length <= 15;
+      test: (v) => {
+        const m = PHONE_PATTERN.exec(v);
+        if (!m) return false;
+        const digits = m[0].replace(/\D/g, '');
+        return digits.length >= 10 && digits.length <= 15;
       },
     });
-  }
-  if (detectorOptions.paymentCard) {
+  if (opts.paymentCard)
     detectors.push({
       name: 'payment-card',
-      regex: /(?:\d[ -]?){12,18}\d/g,
-      classification: 'payment',
-      minimumLength: 13,
-      maximumMatchLength: 37,
-      scanChunkSize: DETECTOR_SCAN_CHUNK_SIZE,
-      validate: passesLuhn,
-    });
-  }
-  if (detectorOptions.ssn) {
-    detectors.push({
-      name: 'ssn',
-      regex: /\b\d{3}-?\d{2}-?\d{4}\b/g,
-      classification: 'identity',
-      minimumLength: 9,
-      maximumMatchLength: 11,
-      scanChunkSize: DETECTOR_SCAN_CHUNK_SIZE,
+      test: (v) => {
+        const m = CARD_CANDIDATE.exec(v);
+        return !!m && passesLuhn(m[1]);
+      },
     });
-  }
-  if (detectorOptions.ipAddress) {
+  if (opts.ssn)
+    detectors.push({ name: 'ssn', test: (v) => SSN_PATTERN.test(v) });
+  if (opts.ipAddress)
     detectors.push({
       name: 'ip-address',
-      regex: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
-      classification: 'location',
-      minimumLength: 7,
-      maximumMatchLength: 15,
-      scanChunkSize: DETECTOR_SCAN_CHUNK_SIZE,
-      validate: (candidate) =>
-        candidate.split('.').every((part) => Number(part) <= 255),
-    });
-  }
-  for (const detector of detectorOptions.custom || []) {
-    const minimumLength = detector.minimumLength ?? 1;
-    const maximumMatchLength =
-      detector.maximumMatchLength ?? DEFAULT_CUSTOM_MATCH_LENGTH;
-    validateCustomDetector(
-      detector.name,
-      detector.pattern,
-      detector.flags,
-      minimumLength,
-      maximumMatchLength,
-    );
-    detectors.push({
-      name: detector.name,
-      regex: new RegExp(detector.pattern, ensureGlobalFlag(detector.flags)),
-      classification: detector.classification || 'custom',
-      minimumLength,
-      maximumMatchLength,
-      scanChunkSize: CUSTOM_DETECTOR_SCAN_CHUNK_SIZE,
+      test: (v) => {
+        const m = IPV4_PATTERN.exec(v);
+        return !!m && m[0].split('.').every((p) => Number(p) <= 255);
+      },
     });
-  }
-
-  return {
-    policy: effectivePolicy,
-    rules,
-    detectors,
-    minimumDetectorLength:
-      detectors.length > 0
-        ? Math.min(...detectors.map((detector) => detector.minimumLength))
-        : Number.POSITIVE_INFINITY,
-    blockSelector:
-      rules
-        .filter((rule) => rule.action === 'exclude' && !rule.attributes)
-        .map((rule) => rule.selector)
-        .join(',') || null,
-  };
+  return detectors;
 }
 
-export function mergeBlockSelectors(
-  legacySelector: string | null,
-  privacy: CompiledPrivacyPolicy | undefined,
-): string | null {
-  return (
-    [legacySelector, privacy?.blockSelector].filter(Boolean).join(',') || null
-  );
+/** Runs the compiled detectors over one text node or `characterData` mutation value. */
+export function detectSensitiveValue(
+  value: string,
+  privacy: CompiledPrivacyPolicy,
+): boolean {
+  if (!privacy.detectors.length || !value) return false;
+  if (value.length > MAX_SCAN_LENGTH) return true;
+  const { detectors } = privacy;
+  for (let index = 0; index < detectors.length; index += 1) {
+    if (detectors[index].test(value)) return true;
+  }
+  return false;
 }
 
-export function getPrivacyAction(
-  element: Element | null,
-  privacy: CompiledPrivacyPolicy | undefined,
-  attribute?: string,
-  requireExplicitAttribute = false,
-): PrivacyAction | undefined {
-  if (!element || !privacy) return undefined;
-
-  let best:
-    | { action: PrivacyAction; distance: number; priority: number }
-    | undefined;
-  let current: Element | null = element;
-  let distance = 0;
-
-  while (current) {
-    for (const rule of privacy.rules) {
-      if (requireExplicitAttribute && !rule.attributes) continue;
-      if (
-        attribute &&
-        rule.attributes &&
-        !rule.attributes.has(attribute.toLowerCase())
-      ) {
-        continue;
-      }
-      if (!attribute && rule.attributes) continue;
-
-      let matches = false;
-      try {
-        matches = current.matches(rule.selector);
-      } catch {
-        continue;
-      }
-      if (!matches) continue;
+/** Occludes non-whitespace to stars, preserving layout; contrast `stars`, which occludes to length. */
+function starText(value: string): string {
+  return value.replace(/[\S]/g, '*');
+}
 
-      const priority = ACTION_PRIORITY[rule.action];
-      if (
-        !best ||
-        distance < best.distance ||
-        (distance === best.distance && priority > best.priority)
-      ) {
-        best = { action: rule.action, distance, priority };
-      }
+/** The single decision point for text content, on both the snapshot and the mutation path. */
+export function resolveTextValue({
+  value,
+  parent,
+  parentTagName,
+  needsMask,
+  maskTextFn,
+  privacy,
+  exemptScript,
+}: {
+  value: string;
+  /** Source of the STYLE/SCRIPT exemptions and the element passed to `maskTextFn`. */
+  parent: HTMLElement | null;
+  /** `untaintedTagName(parent)`, if the caller already computed it (hot path). */
+  parentTagName?: string;
+  needsMask: boolean;
+  maskTextFn: MaskTextFn | undefined;
+  privacy: CompiledPrivacyPolicy | undefined;
+  exemptScript: boolean;
+}): string {
+  if (!value) return value;
+  const tagName = parentTagName ?? untaintedTagName(parent);
+  if (tagName === 'STYLE') return value;
+  const isScript = tagName === 'SCRIPT';
+  if (needsMask) {
+    if (isScript && exemptScript) return value;
+    if (!maskTextFn) return starText(value);
+    // A callback that throws or returns a non-string fails closed to stars.
+    let masked: unknown;
+    try {
+      masked = maskTextFn(value, parent);
+    } catch {
+      return starText(value);
     }
-    current = parentElementAcrossShadowRoot(current);
-    distance += 1;
+    return typeof masked === 'string' ? masked : starText(value);
   }
-
-  return best?.action;
+  if (isScript) return value;
+  if (privacy && detectSensitiveValue(value, privacy)) return starText(value);
+  return value;
 }
 
-export function maskTextWithPrivacy(
-  value: string,
-  element: HTMLElement | null,
+/** Whether `toDataURL` may run: not under `blockMedia`, and not alongside a configured canvas masking provider. */
+export function shouldCapturePixels(
   privacy: CompiledPrivacyPolicy | undefined,
-  legacyMask: boolean,
-  legacyMaskFn?: (text: string, element: HTMLElement | null) => string,
-): string {
-  if (!privacy) {
-    return legacyMask ? applyLegacyMask(value, element, legacyMaskFn) : value;
-  }
+  canvasMaskingConfigured?: () => boolean,
+): boolean {
+  return !privacy?.blockMedia && !canvasMaskingConfigured?.();
+}
 
-  if (nativeElementTagName(element) === 'SCRIPT') {
-    return 'SCRIPT_PLACEHOLDER';
+export function validateSelector(selector: string): boolean {
+  // No document to ask (SSR, a worker, a non-DOM test harness): assume valid
+  // rather than dropping every selector the policy declared. `matches()` is
+  // wrapped in a catch at capture time that masks (text, attributes) or
+  // blocks (block selectors), which stays the fail-closed backstop for
+  // anything actually malformed.
+  if (typeof document === 'undefined') return true;
+  try {
+    document.createDocumentFragment().querySelector(selector);
+    return true;
+  } catch {
+    return false;
   }
+}
 
-  const action = getPrivacyAction(element, privacy);
-  if (privacy.policy.preset === 'legacy' && !action) {
-    return legacyMask ? applyLegacyMask(value, element, legacyMaskFn) : value;
-  }
-  if (action === 'allow') return value;
-  if (action === 'exclude') return '';
-  if (action === 'mask' || privacy.policy.preset === 'strict') {
-    return replacePreservingShape(value);
-  }
-  if (legacyMask) return applyLegacyMask(value, element, legacyMaskFn);
-  if (privacy.detectors.length > 0) {
-    return maskSensitiveRanges(value, detectSensitiveText(value, privacy));
+function matchesInDocumentOrOpenShadowRoots(
+  root: Document | ShadowRoot,
+  selector: string,
+): boolean {
+  if (root.querySelector(selector)) return true;
+  const all = root.querySelectorAll('*');
+  for (let index = 0; index < all.length; index += 1) {
+    const sr = (all[index] as HTMLElement).shadowRoot;
+    if (sr && matchesInDocumentOrOpenShadowRoots(sr, selector)) return true;
   }
-  return value;
+  return false;
 }
 
-export function shouldMaskInputWithPrivacy(
-  element: HTMLElement,
-  privacy: CompiledPrivacyPolicy | undefined,
-  legacyMask: boolean,
-): boolean {
-  if (!privacy) return legacyMask;
-
-  const action = getPrivacyAction(element, privacy);
-  if (privacy.policy.preset === 'legacy' && !action) return legacyMask;
-  if (isProtectedInput(element)) return true;
-  if (action === 'mask') return true;
-  if (action === 'exclude') return true;
-  if (action === 'allow') return false;
-  if (privacy.policy.preset === 'strict') return true;
-  if (privacy.policy.preset === 'balanced') return true;
-  return legacyMask;
+/** EXPERIMENTAL: resolves `unmaskTextSelector` to `null` when nothing in `doc` currently matches it; call once per flush, not per node. */
+export function resolveUnmaskTextSelector(
+  doc: Document,
+  unmaskTextSelector: string | null,
+): string | null {
+  if (!unmaskTextSelector) return null;
+  try {
+    return matchesInDocumentOrOpenShadowRoots(doc, unmaskTextSelector)
+      ? unmaskTextSelector
+      : null;
+  } catch {
+    return unmaskTextSelector;
+  }
 }
 
-export function maskInputWithPrivacy(
-  value: string,
-  element: HTMLElement,
-  privacy: CompiledPrivacyPolicy | undefined,
-  legacyMask: boolean,
-  legacyMaskFn?: (text: string, element: HTMLElement) => string,
-): string {
-  if (!shouldMaskInputWithPrivacy(element, privacy, legacyMask)) return value;
-  const action = getPrivacyAction(element, privacy);
-  if (!privacy || (privacy.policy.preset === 'legacy' && !action)) {
-    return legacyMaskFn
-      ? legacyMaskFn(value, element)
-      : '*'.repeat(value.length);
+/** @internal exported for direct unit testing; not part of the privacy API. */
+export function splitSelectorList(selector: string): string[] {
+  // A quote or opener that never closes is demoted to plain text and the
+  // scan restarts, so one malformed fragment cannot swallow the separators
+  // after it; a stray closer is simply ignored. Each restart demotes one more
+  // index, so the loop is bounded by the selector's length.
+  const demoted = new Set<number>();
+  for (;;) {
+    const parts: string[] = [];
+    const openers: number[] = [];
+    let quote: string | null = null;
+    let quoteAt = -1;
+    let start = 0;
+    for (let index = 0; index < selector.length; index += 1) {
+      const char = selector[index];
+      if (char === '\\') {
+        index += 1;
+        continue;
+      }
+      if (quote) {
+        if (char === quote) quote = null;
+        continue;
+      }
+      if (demoted.has(index)) continue;
+      if (char === '"' || char === "'") {
+        quote = char;
+        quoteAt = index;
+      } else if (char === '(' || char === '[') openers.push(index);
+      else if (char === ')' || char === ']') openers.pop();
+      else if (char === ',' && openers.length === 0) {
+        parts.push(selector.slice(start, index));
+        start = index + 1;
+      }
+    }
+    if (quote) {
+      demoted.add(quoteAt);
+      continue;
+    }
+    if (openers.length) {
+      demoted.add(openers[openers.length - 1]);
+      continue;
+    }
+    parts.push(selector.slice(start));
+    return parts;
   }
-  return replacePreservingShape(value);
 }
 
-export function maskAttributeWithPrivacy(
-  element: HTMLElement,
-  name: string,
-  value: string | null,
-  privacy: CompiledPrivacyPolicy | undefined,
+function joinSelectors(
+  selectors: Array<string | null | undefined>,
 ): string | null {
-  if (!value || !privacy) return value;
-
-  const normalizedName = name.toLowerCase();
-  const standardSensitiveAttribute =
-    normalizedName === 'value' ||
-    SENSITIVE_ATTRIBUTES.has(normalizedName) ||
-    URL_ATTRIBUTES.has(normalizedName);
-  const action = getPrivacyAction(
-    element,
-    privacy,
-    normalizedName,
-    !standardSensitiveAttribute,
-  );
-  if (privacy.policy.preset === 'legacy' && !action) return value;
-  if (normalizedName === 'value' && isProtectedInput(element)) {
-    return replacePreservingShape(value);
-  }
-  if (action === 'allow') return value;
-  if (action === 'exclude') return null;
-  if (action === 'mask') return replacePreservingShape(value);
-  if (
-    privacy.policy.preset === 'strict' &&
-    normalizedName === 'value' &&
-    FORM_VALUE_TAGS.has(nativeElementTagName(element))
-  ) {
-    return replacePreservingShape(value);
+  const kept = new Set<string>();
+  for (const s of selectors) {
+    if (!s) continue;
+    const fragments = splitSelectorList(s);
+    if (validateSelector(s)) {
+      for (const part of fragments) {
+        const trimmed = part.trim();
+        if (trimmed) kept.add(trimmed);
+      }
+      continue;
+    }
+    // One malformed fragment used to take the whole comma-separated list with
+    // it, silently un-masking everything the surviving fragments covered.
+    // Re-validate fragment by fragment and keep the ones that stand alone.
+    const dropped: string[] = [];
+    for (const part of fragments) {
+      const trimmed = part.trim();
+      if (!trimmed) continue;
+      if (validateSelector(trimmed)) kept.add(trimmed);
+      else dropped.push(trimmed);
+    }
+    if (dropped.length)
+      console.warn(
+        `[rrweb privacy] dropping invalid selector: ${dropped.join(', ')}`,
+      );
   }
+  return [...kept].join(',') || null;
+}
 
-  if (
-    privacy.policy.preset === 'strict' &&
-    MEDIA_TAGS.has(nativeElementTagName(element)) &&
-    MEDIA_SOURCE_ATTRIBUTES.has(normalizedName)
-  ) {
-    return null;
-  }
-  if (URL_ATTRIBUTES.has(normalizedName)) {
-    return sanitizeUrl(value, privacy);
-  }
-  if (SENSITIVE_ATTRIBUTES.has(normalizedName)) {
-    return privacy.policy.preset === 'strict'
-      ? replacePreservingShape(value)
-      : maskSensitiveRanges(value, detectSensitiveText(value, privacy));
+export function compilePrivacyPolicy(
+  policy?: PrivacyPolicy,
+): CompiledPrivacyPolicy {
+  const effective: PrivacyPolicy = policy || { version: 1, preset: 'minimal' };
+  if (effective.version !== 1)
+    throw new Error(
+      `Unsupported Privacy at Capture policy version: ${String(
+        effective.version,
+      )}`,
+    );
+  if (!PRIVACY_PRESETS.has(effective.preset))
+    throw new Error(`Unsupported privacy preset: ${String(effective.preset)}`);
+  const preset = effective.preset;
+  const managed = preset !== 'minimal';
+  const compatVendors = resolveVendorCompat(effective.vendorCompat);
+  if (compatVendors.length && !managed)
+    console.warn(
+      '[rrweb privacy] vendorCompat has no effect under the minimal preset; use balanced or strict, or add the classes as mask/block rules.',
+    );
+  const detectors = buildDetectors(effective.detectors);
+  const maskAllInputs = managed || detectors.length > 0;
+  const maskedAttributes = new Set(managed ? MASKED_ATTRIBUTE_DEFAULTS : []);
+  const blockMedia = preset === 'strict';
+  const sanitizeUrls = managed;
+
+  const bySelector = {
+    mask: [] as string[],
+    unmask: [] as string[],
+    block: [] as string[],
+  };
+  for (const rule of effective.rules || []) {
+    if (
+      !rule.target ||
+      rule.target.type !== 'selector' ||
+      !rule.target.selector
+    )
+      throw new Error('Privacy rules require a non-empty selector target');
+    if (!Object.prototype.hasOwnProperty.call(bySelector, rule.action))
+      throw new Error(`Unsupported privacy action: ${String(rule.action)}`);
+    bySelector[rule.action].push(rule.target.selector);
   }
-  return value;
+
+  // Under `minimal` the rules compile to their bare selectors and nothing
+  // else: `data-privacy` and the native `rr-*` class conventions are
+  // managed-preset features, and a `mask`/`block` rule does not switch them
+  // on. (`.rr-mask`/`.rr-block` still reach `minimal` recordings through the
+  // separate `maskTextClass`/`blockClass` options.)
+  return {
+    preset,
+    maskTextSelector: managed
+      ? preset === 'strict'
+        ? '*'
+        : joinSelectors([
+            DATA_PRIVACY_MASK,
+            NATIVE_MASK_CLASSES,
+            vendorCompatSelector(compatVendors, 'mask'),
+            ...bySelector.mask,
+          ])
+      : joinSelectors(bySelector.mask),
+    unmaskTextSelector: joinSelectors(
+      managed
+        ? [DATA_PRIVACY_UNMASK, NATIVE_UNMASK_CLASSES, ...bySelector.unmask]
+        : bySelector.unmask,
+    ),
+    blockSelector: joinSelectors(
+      managed
+        ? [
+            DATA_PRIVACY_BLOCK,
+            NATIVE_BLOCK_CLASSES,
+            vendorCompatSelector(compatVendors, 'block'),
+            ...bySelector.block,
+          ]
+        : bySelector.block,
+    ),
+    ignoreSelector: managed ? DATA_PRIVACY_IGNORE : null,
+    ignoreEventsSelector: managed
+      ? joinSelectors([vendorCompatSelector(compatVendors, 'ignoreEvents')])
+      : null,
+    maskAllInputs,
+    maskedAttributes,
+    attributePolicyInert:
+      !blockMedia && !sanitizeUrls && maskedAttributes.size === 0,
+    blockMedia,
+    sanitizeUrls,
+    blockedQueryParameters: new Set(
+      [
+        ...DEFAULT_BLOCKED_QUERY_PARAMETERS,
+        ...(effective.url?.blockedQueryParameters || []),
+      ].map((n) => n.toLowerCase()),
+    ),
+    allowedQueryParameters: effective.url?.allowedQueryParameters
+      ? new Set(
+          effective.url.allowedQueryParameters.map((n) => n.toLowerCase()),
+        )
+      : null,
+    removeHash: effective.url?.removeHash !== false,
+    detectors,
+  };
 }
 
 /**
- * Apply runtime attribute escape hatches without allowing them to undo the
- * portable policy. The coarse mode wins over the callback, and the policy is
- * always the final authority.
+ * Whether input events from `element`'s subtree are suppressed entirely: the
+ * nearest `data-privacy` annotation, ancestor-or-self, is `ignore`. A nearer
+ * annotation of any other value overrides, per the severity ladder
+ * `unmask, mask, ignore, block`. Any throw fails closed to suppression.
  */
-export function protectSerializedAttribute({
-  element,
-  name,
-  value,
-  privacy,
-  maskAllElementAttributes = false,
-  maskAttributeFn,
-  isGenerated = false,
-}: {
-  element: Element;
-  name: string;
-  value: string | null;
-  privacy: CompiledPrivacyPolicy | undefined;
-  maskAllElementAttributes?: boolean;
-  maskAttributeFn?: MaskAttributeFn;
-  isGenerated?: boolean;
-}): string | null {
-  if (!value) return value;
-
-  let protectedValue = value;
-  if (maskAllElementAttributes) {
-    protectedValue =
-      isGenerated && SAFE_GENERATED_ATTRIBUTES.has(name.toLowerCase())
-        ? value
-        : '*'.repeat(value.length);
-  } else if (maskAttributeFn) {
+export function isEventIgnored(
+  element: Element,
+  privacy: CompiledPrivacyPolicy | undefined,
+): boolean {
+  if (!privacy) return false;
+  // A vendorCompat ignore token silences events from the annotated element
+  // itself, exactly as the vendor's own input observer does; it carries no
+  // masking and takes no part in the data-privacy severity ladder below.
+  if (privacy.ignoreEventsSelector) {
     try {
-      protectedValue = maskAttributeFn(name, value, element);
+      if (element.matches(privacy.ignoreEventsSelector)) return true;
     } catch {
-      // A masking callback is part of the privacy boundary; failure must not
-      // silently publish the original value.
-      protectedValue = '*'.repeat(value.length);
+      return true;
     }
   }
-
-  return maskAttributeWithPrivacy(
-    element as HTMLElement,
-    name,
-    protectedValue,
-    privacy,
-  );
-}
-
-export function sanitizeUrl(
-  value: string,
-  privacy: CompiledPrivacyPolicy | undefined,
-): string {
-  if (!privacy || privacy.policy.preset === 'legacy') return value;
+  if (!privacy.ignoreSelector) return false;
   try {
-    const url = new URL(value, 'https://rrweb.invalid');
-    const allowed = privacy.policy.url?.allowedQueryParameters?.map((name) =>
-      name.toLowerCase(),
-    );
-    const blocked = new Set(
-      [
-        ...DEFAULT_BLOCKED_QUERY_PARAMETERS,
-        ...(privacy.policy.url?.blockedQueryParameters || []),
-      ].map((name) => name.toLowerCase()),
-    );
-
-    for (const [name, parameterValue] of url.searchParams) {
-      if (
-        (privacy.policy.preset === 'strict' && !allowed) ||
-        (allowed && !allowed.includes(name.toLowerCase())) ||
-        blocked.has(name.toLowerCase()) ||
-        detectSensitiveText(parameterValue, privacy).length > 0
-      ) {
-        url.searchParams.set(name, '*');
-      }
-    }
-    url.pathname = maskSensitiveRanges(
-      url.pathname,
-      detectSensitiveText(url.pathname, privacy),
-    );
-    if (privacy.policy.url?.removeHash !== false) url.hash = '';
-
-    if (url.origin === 'https://rrweb.invalid') {
-      return `${url.pathname}${url.search}${url.hash}`;
-    }
-    return url.toString();
+    const annotated = element.closest(DATA_PRIVACY);
+    return annotated !== null && annotated.matches(privacy.ignoreSelector);
   } catch {
-    return maskSensitiveRanges(value, detectSensitiveText(value, privacy));
+    return true;
   }
 }
 
-export function detectSensitiveText(
-  value: string,
-  privacy: CompiledPrivacyPolicy,
-): SensitiveMatch[] {
-  if (
-    privacy.detectors.length === 0 ||
-    value.length < privacy.minimumDetectorLength
-  ) {
-    return [];
-  }
+/** Validates and merges a `record()`-level selector with the compiled policy's; invalid fragments are dropped with a warning. */
+export function mergeSelectors(
+  manualSelector: string | null | undefined,
+  compiledSelector: string | null | undefined,
+): string | null {
+  return joinSelectors([manualSelector, compiledSelector]);
+}
 
-  const matches: SensitiveMatch[] = [];
-  for (const detector of privacy.detectors) {
-    if (value.length < detector.minimumLength) continue;
-
-    for (
-      let offset = 0;
-      offset < value.length;
-      offset += detector.scanChunkSize
-    ) {
-      const primaryEnd = Math.min(
-        offset + detector.scanChunkSize,
-        value.length,
-      );
-      const scanEnd = Math.min(
-        primaryEnd + detector.maximumMatchLength - 1,
-        value.length,
-      );
-      const chunk = value.slice(offset, scanEnd);
-      detector.regex.lastIndex = 0;
-      let match: RegExpExecArray | null;
-      while ((match = detector.regex.exec(chunk))) {
-        const start = offset + match.index;
-        if (start >= primaryEnd) break;
-        if (match[0].length > detector.maximumMatchLength) {
-          matches.push({
-            start: 0,
-            end: value.length,
-            kind: detector.classification,
-            detector: `${detector.name}:oversize`,
-          });
-          return mergeMatches(matches);
-        }
-        if (!detector.validate || detector.validate(match[0])) {
-          matches.push({
-            start,
-            end: start + match[0].length,
-            kind: detector.classification,
-            detector: detector.name,
-          });
-          if (matches.length >= MAX_DETECTOR_MATCHES) {
-            // Detection is a privacy boundary. If a hostile value produces an
-            // unreasonable number of matches, mask the complete value because
-            // later detectors have not necessarily scanned its prefix.
-            matches.push({
-              start: 0,
-              end: value.length,
-              kind: detector.classification,
-              detector: `${detector.name}:overflow`,
-            });
-            return mergeMatches(matches);
-          }
-        }
-        if (match[0].length === 0) detector.regex.lastIndex += 1;
-      }
-    }
-  }
-  return mergeMatches(matches);
+/** The privacy state one recording pass (or one `snapshot()` call) runs on. */
+export type PrivacyContext = {
+  privacy: CompiledPrivacyPolicy;
+  blockSelector: string | null;
+  maskTextSelector: string | null;
+  unmaskTextSelector: string | null;
+};
+
+/** The one privacy prologue: compile the policy, merge every `record()`-level selector with its compiled counterpart, and write the merged unmask selector back onto the policy. */
+export function resolvePrivacyContext({
+  privacy: compiled,
+  privacyPolicy,
+  blockSelector = null,
+  maskTextSelector = null,
+  unmaskTextSelector = null,
+}: {
+  privacy?: CompiledPrivacyPolicy;
+  privacyPolicy?: PrivacyPolicy;
+  blockSelector?: string | null;
+  maskTextSelector?: string | null;
+  unmaskTextSelector?: string | null;
+}): PrivacyContext {
+  const base = compiled || compilePrivacyPolicy(privacyPolicy);
+  const mergedMaskTextSelector = mergeSelectors(
+    maskTextSelector,
+    base.maskTextSelector,
+  );
+  const mergedUnmaskTextSelector = mergeSelectors(
+    unmaskTextSelector,
+    base.unmaskTextSelector,
+  );
+  // Both merged selectors are written back so `finalizeAttribute`, which
+  // reads the policy, resolves mask/unmask ties with the same lists text does.
+  const unchanged =
+    mergedMaskTextSelector === base.maskTextSelector &&
+    mergedUnmaskTextSelector === base.unmaskTextSelector;
+  return {
+    privacy: unchanged
+      ? base
+      : {
+          ...base,
+          maskTextSelector: mergedMaskTextSelector,
+          unmaskTextSelector: mergedUnmaskTextSelector,
+        },
+    blockSelector: mergeSelectors(blockSelector, base.blockSelector),
+    maskTextSelector: mergedMaskTextSelector,
+    unmaskTextSelector: mergedUnmaskTextSelector,
+  };
 }
 
 export function passesLuhn(candidate: string): boolean {
@@ -665,272 +743,299 @@ export function passesLuhn(candidate: string): boolean {
   return sum % 10 === 0;
 }
 
-export function replacePreservingShape(value: string): string {
-  return value.replace(/[\p{L}\p{N}]/gu, (character) =>
-    /\p{N}/u.test(character) ? '0' : 'x',
-  );
-}
+let maskAttributeConflictWarned = false;
 
-function isProtectedInput(element: HTMLElement): boolean {
-  if (nativeElementTagName(element) !== 'INPUT') return false;
-  const input = element as HTMLInputElement;
-  if (
-    input.type === 'password' ||
-    input.type === 'hidden' ||
-    input.hasAttribute('data-rr-is-password')
-  ) {
-    return true;
-  }
-  return input.autocomplete
-    .toLowerCase()
-    .split(/\s+/)
-    .some((token) => PROTECTED_AUTOCOMPLETE.has(token));
+/** Occludes a value to its length; contrast `starText`, which preserves whitespace/layout. */
+export function stars(value: string): string {
+  return '*'.repeat(value.length);
 }
 
-function validateCustomDetector(
-  name: string,
-  pattern: string,
-  flags: string | undefined,
-  minimumLength: number,
-  maximumMatchLength: number,
-): void {
-  const label = name || '<unnamed>';
-  if (!name.trim()) throw new Error('Custom detector name cannot be empty');
-  if (!pattern || pattern.length > MAX_CUSTOM_PATTERN_LENGTH) {
-    throw new Error(
-      `Custom detector "${label}" pattern must be 1-${MAX_CUSTOM_PATTERN_LENGTH} characters`,
-    );
-  }
-  if (
-    !Number.isInteger(minimumLength) ||
-    minimumLength < 1 ||
-    minimumLength > MAX_CUSTOM_MATCH_LENGTH
-  ) {
-    throw new Error(
-      `Custom detector "${label}" minimumLength must be an integer from 1-${MAX_CUSTOM_MATCH_LENGTH}`,
-    );
-  }
-  if (
-    !Number.isInteger(maximumMatchLength) ||
-    maximumMatchLength < 1 ||
-    maximumMatchLength > MAX_CUSTOM_MATCH_LENGTH
-  ) {
-    throw new Error(
-      `Custom detector "${label}" maximumMatchLength must be an integer from 1-${MAX_CUSTOM_MATCH_LENGTH}`,
-    );
-  }
-  if (minimumLength > maximumMatchLength) {
-    throw new Error(
-      `Custom detector "${label}" minimumLength cannot exceed maximumMatchLength`,
-    );
-  }
-  if (
-    flags &&
-    (!/^[dgimsuv]*$/.test(flags) || new Set(flags).size !== flags.length)
-  ) {
-    throw new Error(`Custom detector "${label}" has unsupported regex flags`);
-  }
-  if (
-    /\\[1-9]/.test(pattern) ||
-    /\\k</.test(pattern) ||
-    hasLookaroundOrNamedGroup(pattern)
-  ) {
-    throw new Error(
-      `Custom detector "${label}" cannot use lookaround, named groups, or backreferences`,
-    );
-  }
-  const scan = scanCustomPattern(pattern);
-  if (scan.nestedRepetition) {
-    throw new Error(
-      `Custom detector "${label}" contains ambiguous nested repetition`,
-    );
-  }
-  if (scan.quantifiers > MAX_CUSTOM_QUANTIFIERS) {
-    throw new Error(`Custom detector "${label}" contains too many quantifiers`);
-  }
+/** The mask selector without the `'*'` mask-everything fallback, which is a default rather than a marker and so never takes part in a tie. */
+function concreteMaskSelector(privacy: CompiledPrivacyPolicy): string | null {
+  const selector = privacy.maskTextSelector;
+  if (!selector) return null;
+  if (selector.indexOf('*') === -1) return selector;
+  const kept = splitSelectorList(selector)
+    .map((part) => part.trim())
+    .filter((part) => part && part !== '*');
+  return kept.join(',') || null;
+}
 
-  let regex: RegExp;
+/**
+ * Attributes resolve like text: the nearest annotated ancestor decides, and
+ * on the same element mask beats unmask. Any throw keeps the attribute masked.
+ */
+function isUnmasked(
+  element: Element,
+  privacy: CompiledPrivacyPolicy,
+  memo?: UnmaskMemo,
+): boolean {
+  if (!privacy.unmaskTextSelector) return false;
+  if (memo && memo.element === element) return memo.answer;
+  let answer = false;
   try {
-    regex = new RegExp(pattern, ensureGlobalFlag(flags));
+    const mask = concreteMaskSelector(privacy);
+    let current: Element | null = element;
+    while (current) {
+      if (mask && current.matches(mask)) break;
+      if (current.matches(privacy.unmaskTextSelector)) {
+        answer = true;
+        break;
+      }
+      current = parentElement(current);
+    }
   } catch {
-    throw new Error(`Custom detector "${label}" contains an invalid regex`);
+    answer = false;
   }
-  regex.lastIndex = 0;
-  if (regex.test('')) {
-    throw new Error(`Custom detector "${label}" cannot match empty text`);
+  if (memo) {
+    memo.element = element;
+    memo.answer = answer;
   }
+  return answer;
 }
 
-function quantifierLength(pattern: string, index: number): number {
-  const character = pattern[index];
-  if (character === '*' || character === '+' || character === '?') {
-    return pattern[index + 1] === '?' ? 2 : 1;
-  }
-  if (character === '{') {
-    const match = pattern.slice(index).match(/^\{\d+(?:,\d*)?\}/);
-    if (!match) return 0;
-    return match[0].length + (pattern[index + match[0].length] === '?' ? 1 : 0);
-  }
-  return 0;
+/** One element's `isUnmasked` answer, reused across its whole attribute sweep. */
+type UnmaskMemo = { element: Element | null; answer: boolean };
+
+// Everything a srcset parser reads as a delimiter is escaped too, so the
+// placeholder is a valid candidate URL there and not just in `src`.
+const URI_UNSAFE = /[<>#" ,]/g;
+const URI_ESCAPES: Record<string, string> = {
+  '<': '%3C',
+  '>': '%3E',
+  '#': '%23',
+  '"': '%22',
+  ' ': '%20',
+  ',': '%2C',
+};
+const placeholderCache = new Map<string, string>();
+
+function placeholderImage(width: string, height: string): string {
+  const key = `${width}x${height}`;
+  const cached = placeholderCache.get(key);
+  if (cached !== undefined) return cached;
+  const svg =
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}">` +
+    `<rect width="${width}" height="${height}" fill="#ddd"/></svg>`;
+  const encoded = `data:image/svg+xml;utf8,${svg.replace(
+    URI_UNSAFE,
+    (char) => URI_ESCAPES[char],
+  )}`;
+  if (placeholderCache.size < 100) placeholderCache.set(key, encoded);
+  return encoded;
 }
 
-function hasLookaroundOrNamedGroup(pattern: string): boolean {
-  let inCharacterClass = false;
-  let escaped = false;
-
-  for (let index = 0; index < pattern.length; index += 1) {
-    const character = pattern[index];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (character === '\\') {
-      escaped = true;
-      continue;
-    }
-    if (character === '[') {
-      inCharacterClass = true;
-      continue;
-    }
-    if (character === ']' && inCharacterClass) {
-      inCharacterClass = false;
-      continue;
-    }
-    if (inCharacterClass || character !== '(') continue;
-    if (pattern[index + 1] !== '?') continue;
-    if (pattern[index + 2] === ':') continue;
-    return true;
+/** Size attributes first; for an `<img>` the intrinsic size is the fallback. Never a layout measurement. */
+function declaredDimensions(element: Element): [string, string] | null {
+  try {
+    const width = element.getAttribute('width');
+    const height = element.getAttribute('height');
+    if (
+      width !== null &&
+      height !== null &&
+      PLAIN_PIXEL_DIMENSION.test(width) &&
+      PLAIN_PIXEL_DIMENSION.test(height)
+    )
+      return [width, height];
+    const { naturalWidth, naturalHeight } = element as HTMLImageElement;
+    if (
+      Number.isInteger(naturalWidth) &&
+      Number.isInteger(naturalHeight) &&
+      naturalWidth > 0 &&
+      naturalHeight > 0
+    )
+      return [String(naturalWidth), String(naturalHeight)];
+    return null;
+  } catch {
+    return null;
   }
-  return false;
 }
 
-function scanCustomPattern(pattern: string): {
-  nestedRepetition: boolean;
-  quantifiers: number;
-} {
-  const groups: Array<{ repeated: boolean; alternation: boolean }> = [];
-  let inCharacterClass = false;
-  let escaped = false;
-  let quantifiers = 0;
-
-  for (let index = 0; index < pattern.length; index += 1) {
-    const character = pattern[index];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (character === '\\') {
-      escaped = true;
-      continue;
-    }
-    if (character === '[') {
-      inCharacterClass = true;
-      continue;
-    }
-    if (character === ']' && inCharacterClass) {
-      inCharacterClass = false;
-      continue;
-    }
-    if (inCharacterClass) continue;
-
-    if (character === '(') {
-      groups.push({ repeated: false, alternation: false });
-      if (pattern[index + 1] === '?' && pattern[index + 2] === ':') {
-        index += 2;
-      }
-      continue;
-    }
-    if (character === '|') {
-      const group = groups[groups.length - 1];
-      if (group) group.alternation = true;
-      continue;
-    }
+function blockedMediaValue(
+  element: Element,
+  tagName: string,
+  normalizedName: string,
+): string | null {
+  const placeholderNames = MEDIA_PLACEHOLDER_ATTRIBUTES.get(tagName);
+  if (!placeholderNames || !placeholderNames.has(normalizedName)) return null;
+  const dimensions = declaredDimensions(element);
+  if (!dimensions) return null;
+  return placeholderImage(dimensions[0], dimensions[1]);
+}
 
-    const length = quantifierLength(pattern, index);
-    if (length > 0) {
-      quantifiers += 1;
-      const group = groups[groups.length - 1];
-      if (group) group.repeated = true;
-      index += length - 1;
-      continue;
-    }
+/** The single decision point for every attribute rrweb records, called once per attribute at the end of serialization. */
+export function finalizeAttribute({
+  element,
+  name,
+  value,
+  privacy,
+  maskAllElementAttributes = false,
+  maskAttributeFn,
+  isGenerated = false,
+  unmaskMemo,
+}: {
+  element: Element;
+  name: string;
+  value: string | null;
+  privacy: CompiledPrivacyPolicy | undefined;
+  maskAllElementAttributes?: boolean;
+  maskAttributeFn?: MaskAttributeFn;
+  isGenerated?: boolean;
+  /** @internal see `UnmaskMemo`; supplied by `finalizeAttributes` */
+  unmaskMemo?: UnmaskMemo;
+}): string | null {
+  if (
+    !maskAllElementAttributes &&
+    !maskAttributeFn &&
+    (!privacy || privacy.attributePolicyInert)
+  )
+    return value;
+  if (value === null || value === '') return value;
 
-    if (character !== ')') continue;
+  const normalizedName = name.toLowerCase();
+  if (isGenerated && RENDERING_METADATA_ATTRIBUTES.has(normalizedName))
+    return value;
+  if (OPERATIONAL_ATTRIBUTES.has(normalizedName)) return value;
+  if (CSS_ATTRIBUTES.has(normalizedName)) return value;
 
-    const group = groups.pop();
-    if (!group) continue;
-    const outerLength = quantifierLength(pattern, index + 1);
-    if (outerLength > 0 && (group.repeated || group.alternation)) {
-      return { nestedRepetition: true, quantifiers };
-    }
-    const parent = groups[groups.length - 1];
-    if (parent && (group.repeated || outerLength > 0)) {
-      parent.repeated = true;
+  if (maskAllElementAttributes) {
+    if (maskAttributeFn && !maskAttributeConflictWarned) {
+      maskAttributeConflictWarned = true;
+      console.warn(
+        '[rrweb privacy] maskAllElementAttributes is set; maskAttributeFn is ignored.',
+      );
     }
+    return stars(value);
   }
 
-  return { nestedRepetition: false, quantifiers };
-}
+  let current = value;
+  if (maskAttributeFn) {
+    try {
+      const masked = maskAttributeFn(name, value, element);
+      current = typeof masked === 'string' ? masked : stars(value);
+    } catch {
+      return stars(value);
+    }
+  }
 
-function applyLegacyMask(
-  value: string,
-  element: HTMLElement | null,
-  maskFn?: (text: string, element: HTMLElement | null) => string,
-): string {
-  return maskFn ? maskFn(value, element) : value.replace(/[\S]/g, '*');
-}
+  if (!privacy) return current;
 
-function maskSensitiveRanges(value: string, matches: SensitiveMatch[]): string {
-  if (!matches.length) return value;
-  let result = '';
-  let cursor = 0;
-  for (const match of matches) {
-    result += value.slice(cursor, match.start);
-    result += replacePreservingShape(value.slice(match.start, match.end));
-    cursor = match.end;
+  if (privacy.blockMedia && MEDIA_SOURCE_ATTRIBUTES.has(normalizedName)) {
+    const tagName = untaintedTagName(element);
+    if (MEDIA_TAGS.has(tagName))
+      return blockedMediaValue(element, tagName, normalizedName);
   }
-  return result + value.slice(cursor);
-}
-
-function mergeMatches(matches: SensitiveMatch[]): SensitiveMatch[] {
-  const sorted = matches.sort((a, b) => a.start - b.start || b.end - a.end);
-  const result: SensitiveMatch[] = [];
-  for (const match of sorted) {
-    const previous = result[result.length - 1];
-    if (previous && match.start <= previous.end) {
-      previous.end = Math.max(previous.end, match.end);
-      continue;
-    }
-    result.push({ ...match });
+  if (URL_ATTRIBUTES.has(normalizedName)) return sanitizeUrl(current, privacy);
+  if (privacy.maskedAttributes.has(normalizedName)) {
+    return isUnmasked(element, privacy, unmaskMemo) ? current : stars(current);
   }
-  return result;
+  if (
+    normalizedName === 'value' &&
+    privacy.preset === 'strict' &&
+    FORM_VALUE_TAGS.has(untaintedTagName(element))
+  ) {
+    return stars(current);
+  }
+  return current;
 }
 
-function ensureGlobalFlag(flags = ''): string {
-  return flags.includes('g') ? flags : `${flags}g`;
+/** Runs every attribute through `finalizeAttribute` once, in place, after serialization. */
+export function finalizeAttributes(
+  attributes: Record<string, unknown>,
+  {
+    element,
+    privacy,
+    maskAllElementAttributes,
+    maskAttributeFn,
+    generatedAttributes,
+  }: {
+    element: Element;
+    privacy: CompiledPrivacyPolicy | undefined;
+    maskAllElementAttributes?: boolean;
+    maskAttributeFn?: MaskAttributeFn;
+    /** names this serializer wrote itself; see `finalizeAttribute`'s step 1 */
+    generatedAttributes?: Set<string>;
+  },
+): void {
+  const unmaskMemo: UnmaskMemo = { element: null, answer: false };
+  for (const name in attributes) {
+    const value = attributes[name];
+    if (typeof value !== 'string' && value !== null) continue;
+    attributes[name] = finalizeAttribute({
+      element,
+      name,
+      value,
+      privacy,
+      maskAllElementAttributes,
+      maskAttributeFn,
+      isGenerated: generatedAttributes?.has(name),
+      unmaskMemo,
+    });
+  }
 }
 
-function nativeElementTagName(element: Element | null | undefined): string {
-  if (!element) return '';
-  const tagName = element.tagName;
-  if (typeof tagName === 'string') return tagName.toUpperCase();
-  // HTMLFormElement (and similar) expose named controls as own properties,
-  // so `<input name="tagName">` shadows the prototype getter.
+/**
+ * EXPERIMENTAL: no session-replay vendor sanitizes URLs in the recorded DOM;
+ * see the changeset.
+ *
+ * `paramsMode` is an internal knob, not part of the public policy surface:
+ * `'preset'` (the default) is `strict`'s normal mask-every-param-unless-
+ * allowlisted behavior; `'blocklist'` forces the `balanced` treatment
+ * (mask only `blockedQueryParameters`/non-`allowedQueryParameters`) even
+ * under `strict`. `sanitizeMetaUrl` is the one caller that needs it -- see
+ * its doc comment. This keeps the preset special-case inside the URL layer
+ * instead of leaking a `strict`-vs-Meta branch into core.
+ */
+export function sanitizeUrl(
+  value: string,
+  privacy: CompiledPrivacyPolicy | undefined,
+  { paramsMode = 'preset' }: { paramsMode?: 'preset' | 'blocklist' } = {},
+): string | null {
+  if (!value) return value;
+  if (!privacy || !privacy.sanitizeUrls) return value;
   try {
-    const native: unknown = Object.getOwnPropertyDescriptor(
-      Element.prototype,
-      'tagName',
-    )?.get?.call(element);
-    return typeof native === 'string' ? native.toUpperCase() : '';
+    const url = new URL(value, 'https://rrweb.invalid');
+    url.username = '';
+    url.password = '';
+    const maskAllParams =
+      paramsMode === 'preset' &&
+      privacy.preset === 'strict' &&
+      !privacy.allowedQueryParameters;
+    for (const [name] of url.searchParams) {
+      const lower = name.toLowerCase();
+      if (
+        maskAllParams ||
+        (privacy.allowedQueryParameters &&
+          !privacy.allowedQueryParameters.has(lower)) ||
+        privacy.blockedQueryParameters.has(lower)
+      ) {
+        url.searchParams.set(name, '*');
+      }
+    }
+    if (privacy.removeHash) url.hash = '';
+    if (url.origin === 'https://rrweb.invalid')
+      return `${url.pathname}${url.search}${url.hash}`;
+    return url.toString();
   } catch {
-    return '';
+    return null;
   }
 }
 
-function parentElementAcrossShadowRoot(element: Element): Element | null {
-  const parent = dom.parentElement(element);
-  if (parent) return parent;
-  const root = dom.getRootNode(element);
-  if (!root || !('host' in root) || !('mode' in root)) return null;
-  return dom.host(root as ShadowRoot);
+/**
+ * EXPERIMENTAL, open design question for upstream: sanitizes the Meta
+ * event's `window.location.href` with blocked-list-only parameter masking
+ * (the `balanced` treatment), even under `strict`, where every other URL in
+ * the recorded DOM masks every param unless explicitly allowlisted. The
+ * Meta event's URL is the recording's own address bar, not markup the page
+ * author wrote -- treating it identically to an arbitrary `<a href>` would
+ * make `strict` unusable for reconstructing which page a session happened
+ * on, since almost every app puts routing state in its own URL. Whether
+ * that asymmetry is the right default, versus a dedicated option, is not
+ * settled; see the changeset.
+ */
+export function sanitizeMetaUrl(
+  value: string,
+  privacy: CompiledPrivacyPolicy | undefined,
+): string | null {
+  return sanitizeUrl(value, privacy, { paramsMode: 'blocklist' });
 }
diff --git a/packages/rrweb-snapshot/src/snapshot-utils.ts b/packages/rrweb-snapshot/src/snapshot-utils.ts
index 33455e212a..c546c9501c 100644
--- a/packages/rrweb-snapshot/src/snapshot-utils.ts
+++ b/packages/rrweb-snapshot/src/snapshot-utils.ts
@@ -11,7 +11,9 @@ export {
   is2DCanvasBlank,
   isElement,
   isShadowRoot,
-  maskInputValue,
+  maskInput,
+  shouldMaskInput,
+  isProtectedInput,
   isNativeShadowDom,
   stringifyStylesheet,
   getInputType,
diff --git a/packages/rrweb-snapshot/src/snapshot.ts b/packages/rrweb-snapshot/src/snapshot.ts
index df476d7c31..8722fb251a 100644
--- a/packages/rrweb-snapshot/src/snapshot.ts
+++ b/packages/rrweb-snapshot/src/snapshot.ts
@@ -25,7 +25,8 @@ import {
   is2DCanvasBlank,
   isElement,
   isShadowRoot,
-  maskInputValue,
+  maskInput,
+  shouldMaskInput,
   isNativeShadowDom,
   stringifyStylesheet,
   getInputType,
@@ -35,12 +36,13 @@ import {
   markCssSplits,
 } from './snapshot-utils';
 import {
-  compilePrivacyPolicy,
-  maskAttributeWithPrivacy,
-  maskInputWithPrivacy,
-  maskTextWithPrivacy,
-  mergeBlockSelectors,
-  protectSerializedAttribute,
+  finalizeAttribute,
+  finalizeAttributes,
+  resolvePrivacyContext,
+  resolveTextValue,
+  resolveUnmaskTextSelector,
+  shouldCapturePixels,
+  splitSelectorList,
 } from './privacy';
 import dom from '@rrweb/utils';
 
@@ -223,29 +225,41 @@ export function ignoreAttribute(
   return ['video', 'audio'].includes(tagName) && name === 'autoplay';
 }
 
+export function classMatches(el: Element, matcher: string | RegExp): boolean {
+  const { classList } = el;
+  if (typeof matcher === 'string') return classList.contains(matcher);
+  for (let index = classList.length; index--; ) {
+    if (matcher.test(classList[index])) return true;
+  }
+  return false;
+}
+
+let warnedBlockDecisionThrew = false;
+
 export function _isBlockedElement(
   element: HTMLElement,
   blockClass: string | RegExp,
   blockSelector: string | null,
 ): boolean {
   try {
-    if (typeof blockClass === 'string') {
-      if (element.classList.contains(blockClass)) {
-        return true;
-      }
-    } else {
-      for (let eIndex = element.classList.length; eIndex--; ) {
-        const className = element.classList[eIndex];
-        if (blockClass.test(className)) {
-          return true;
-        }
-      }
+    if (classMatches(element, blockClass)) {
+      return true;
     }
     if (blockSelector) {
       return element.matches(blockSelector);
     }
   } catch (e) {
-    //
+    // Fail closed: a block decision that cannot be made blocks, the same
+    // way a mask decision that throws masks.
+    if (!warnedBlockDecisionThrew) {
+      warnedBlockDecisionThrew = true;
+      console.warn(
+        `privacy block decision threw; failing closed to blocking — check custom selectors: ${
+          e instanceof Error ? e.message : String(e)
+        }`,
+      );
+    }
+    return true;
   }
 
   return false;
@@ -262,57 +276,107 @@ export function classMatchesRegex(
     return classMatchesRegex(dom.parentNode(node), regex, checkAncestors);
   }
 
-  for (let eIndex = (node as HTMLElement).classList.length; eIndex--; ) {
-    const className = (node as HTMLElement).classList[eIndex];
-    if (regex.test(className)) {
-      return true;
-    }
-  }
+  if (classMatches(node as HTMLElement, regex)) return true;
   if (!checkAncestors) return false;
   return classMatchesRegex(dom.parentNode(node), regex, checkAncestors);
 }
 
+export type MaskTextSelector = {
+  maskAll: boolean;
+  selector: string | null;
+};
+
+export function splitMaskAllSelector(
+  maskTextSelector: string | null,
+): MaskTextSelector {
+  if (!maskTextSelector) return { maskAll: false, selector: null };
+  let maskAll = false;
+  const kept: string[] = [];
+  for (const part of splitSelectorList(maskTextSelector)) {
+    if (part.trim() === '*') maskAll = true;
+    else kept.push(part);
+  }
+  return {
+    maskAll,
+    selector: maskAll ? kept.join(',') || null : maskTextSelector,
+  };
+}
+
+let warnedMaskDecisionThrew = false;
+
+/**
+ * Two shapes are accepted here, and both are coerced at runtime rather than
+ * being trusted from the type signature:
+ *
+ * - `maskTextSelector` may arrive as a raw selector string (the pre-2.0
+ *   shape) instead of the `{maskAll, selector}` pair from
+ *   `splitMaskAllSelector`, and is split on the spot.
+ * - The whole call may use the pre-2.0 *positional* signature
+ *   `(node, maskTextClass, maskTextSelector, checkAncestors)`, which puts a
+ *   boolean where `unmaskTextSelector` now sits. A boolean in that slot is
+ *   detected and shifted back into `checkAncestors`, so the ancestor walk an
+ *   unmigrated caller asked for still happens. Left uncoerced this failed
+ *   *open*: `checkAncestors` landed as `undefined`, the walk stopped at the
+ *   node itself, and a `.rr-mask` ancestor no longer masked.
+ */
 export function needMaskingText(
   node: Node,
   maskTextClass: string | RegExp,
-  maskTextSelector: string | null,
-  checkAncestors: boolean,
+  maskTextSelector: MaskTextSelector | string | null,
+  unmaskTextSelector: string | boolean | null,
+  checkAncestors?: boolean,
+  inheritedNeedsMask = false,
 ): boolean {
-  let el: Element;
-  if (isElement(node)) {
-    el = node;
-    if (!dom.childNodes(el).length) {
-      // optimisation: we can avoid any of the below checks on leaf elements
-      // as masking is applied to child text nodes only
-      return false;
-    }
-  } else if (dom.parentElement(node) === null) {
-    // should warn? maybe a text node isn't attached to a parent node yet?
-    return false;
-  } else {
-    el = dom.parentElement(node)!;
+  if (typeof unmaskTextSelector === 'boolean') {
+    // legacy 4-arg call: the boolean is `checkAncestors`.
+    checkAncestors = unmaskTextSelector;
+    unmaskTextSelector = null;
+    inheritedNeedsMask = false;
+  } else if (checkAncestors === undefined) {
+    // an omitted `checkAncestors` walks, the wider (fail-closed) reading.
+    checkAncestors = true;
   }
   try {
-    if (typeof maskTextClass === 'string') {
-      if (checkAncestors) {
-        if (el.closest(`.${maskTextClass}`)) return true;
-      } else {
-        if (el.classList.contains(maskTextClass)) return true;
+    const { maskAll, selector } =
+      typeof maskTextSelector === 'string' || !maskTextSelector
+        ? splitMaskAllSelector(maskTextSelector ?? null)
+        : maskTextSelector;
+    if ((maskAll || inheritedNeedsMask) && !unmaskTextSelector) return true;
+    let el: Element;
+    if (isElement(node)) {
+      el = node;
+      if (!dom.childNodes(el).length) {
+        return inheritedNeedsMask;
       }
+    } else if (dom.parentElement(node) === null) {
+      return inheritedNeedsMask || maskAll;
     } else {
-      if (classMatchesRegex(el, maskTextClass, checkAncestors)) return true;
+      el = dom.parentElement(node)!;
     }
-    if (maskTextSelector) {
-      if (checkAncestors) {
-        if (el.closest(maskTextSelector)) return true;
-      } else {
-        if (el.matches(maskTextSelector)) return true;
-      }
+    let current: Element | null = el;
+    while (current) {
+      if (
+        classMatches(current, maskTextClass) ||
+        (selector && current.matches(selector))
+      )
+        return true;
+      if (unmaskTextSelector && current.matches(unmaskTextSelector))
+        return false;
+      if (!checkAncestors) break;
+      current = dom.parentElement(current);
     }
+    return maskAll || inheritedNeedsMask;
   } catch (e) {
-    //
+    if (!warnedMaskDecisionThrew) {
+      warnedMaskDecisionThrew = true;
+      console.warn(
+        `privacy mask decision threw; failing closed to masking — check custom selectors: ${
+          e instanceof Error ? e.message : String(e)
+        }`,
+      );
+    }
+    return true;
   }
-  return false;
 }
 
 // https://stackoverflow.com/a/36155560
@@ -529,18 +593,11 @@ function serializeTextNode(
   },
 ): serializedNode {
   const { needsMask, maskTextFn, rootId, cssCaptured, privacy } = options;
-  // The parent node may not be a html element which has a tagName attribute.
-  // Named form controls can also shadow `tagName` (e.g. <input name="tagName">).
-  // So just let it be undefined which is ok in this use case.
-  const parent = dom.parentNode(n);
-  const parentTagName =
-    parent && typeof (parent as HTMLElement).tagName === 'string'
-      ? (parent as HTMLElement).tagName.toUpperCase()
-      : undefined;
+  const parent = dom.parentElement(n);
+  const parentTagName = dom.untaintedTagName(parent);
   let textContent: string | null = '';
-  const isStyle = parentTagName === 'STYLE' ? true : undefined;
-  const isScript = parentTagName === 'SCRIPT' ? true : undefined;
-  if (isScript) {
+  const isStyle = parentTagName === 'STYLE';
+  if (parentTagName === 'SCRIPT') {
     textContent = 'SCRIPT_PLACEHOLDER';
   } else if (!cssCaptured) {
     textContent = dom.textContent(n);
@@ -552,20 +609,16 @@ function serializeTextNode(
       textContent = absolutifyURLs(textContent, getHref(options.doc));
     }
   }
-  if (!isScript && textContent) {
-    if (privacy) {
-      textContent = maskTextWithPrivacy(
-        textContent,
-        dom.parentElement(n),
-        privacy,
-        needsMask,
-        maskTextFn,
-      );
-    } else if (!isStyle && needsMask) {
-      textContent = maskTextFn
-        ? maskTextFn(textContent, dom.parentElement(n))
-        : textContent.replace(/[\S]/g, '*');
-    }
+  if (textContent) {
+    textContent = resolveTextValue({
+      value: textContent,
+      parent,
+      parentTagName,
+      needsMask,
+      maskTextFn,
+      privacy,
+      exemptScript: true,
+    });
   }
 
   return {
@@ -621,10 +674,11 @@ function serializeElementNode(
   const tagName = getValidTagName(n);
   let attributes: attributes = {};
   const generatedAttributeNames = new Set<string>();
+  // late `<img>` load-listener writes still go through `finalizeAttribute`.
   let serializationComplete = false;
-  const protectLateAttribute = (name: string, value: string) =>
+  const finalizeLateAttribute = (name: string, value: string) =>
     serializationComplete
-      ? protectSerializedAttribute({
+      ? finalizeAttribute({
           element: n,
           name,
           value,
@@ -638,16 +692,12 @@ function serializeElementNode(
   for (let i = 0; i < len; i++) {
     const attr = n.attributes[i];
     if (!ignoreAttribute(tagName, attr.name, attr.value)) {
-      const transformed = transformAttribute(
+      attributes[attr.name] = transformAttribute(
         doc,
         tagName,
         toLowerCase(attr.name),
         attr.value,
       );
-      const protectedValue = privacy
-        ? maskAttributeWithPrivacy(n, attr.name, transformed, privacy)
-        : transformed;
-      if (protectedValue !== null) attributes[attr.name] = protectedValue;
     }
   }
   // remote css
@@ -689,34 +739,32 @@ function serializeElementNode(
       value
     ) {
       const type = getInputType(n);
-      if (privacy) {
-        const legacyMask = Boolean(
-          maskInputOptions[tagName as keyof MaskInputOptions] ||
-            (type && maskInputOptions[type as keyof MaskInputOptions]),
-        );
-        attributes.value = maskInputWithPrivacy(
-          value,
-          n,
-          privacy,
-          legacyMask,
-          maskInputFn,
-        );
-      } else {
-        attributes.value = maskInputValue({
-          element: n,
-          type,
-          tagName,
-          value,
-          maskInputOptions,
-          maskInputFn,
-        });
-      }
+      attributes.value = maskInput({
+        element: n,
+        type,
+        tagName,
+        value,
+        maskInputOptions,
+        maskInputFn,
+        privacy,
+      });
     } else if (checked) {
       attributes.checked = checked;
     }
   }
   if (tagName === 'option') {
-    if ((n as HTMLOptionElement).selected && !maskInputOptions['select']) {
+    // The `selected` flag discloses the parent <select>'s value just as
+    // surely as the value attribute does, so it is governed by the <select>'s
+    // own masking decision -- policy included. Reading `maskInputOptions`
+    // alone let a balanced/strict policy record the chosen option verbatim.
+    const selectionMasked = shouldMaskInput({
+      element: n,
+      tagName: 'select',
+      type: null,
+      maskInputOptions,
+      privacy,
+    });
+    if ((n as HTMLOptionElement).selected && !selectionMasked) {
       attributes.selected = true;
     } else {
       // ignore the html attribute (which corresponds to DOM (n as HTMLOptionElement).defaultSelected)
@@ -739,8 +787,7 @@ function serializeElementNode(
   if (
     tagName === 'canvas' &&
     recordCanvas &&
-    !canvasMaskingConfigured?.() &&
-    privacy?.policy.preset !== 'strict'
+    shouldCapturePixels(privacy, canvasMaskingConfigured)
   ) {
     if ((n as ICanvas).__context === '2d') {
       // only record this on 2d canvas
@@ -773,11 +820,7 @@ function serializeElementNode(
     }
   }
   // save image offline
-  if (
-    tagName === 'img' &&
-    inlineImages &&
-    privacy?.policy.preset !== 'strict'
-  ) {
+  if (tagName === 'img' && inlineImages && shouldCapturePixels(privacy)) {
     if (!canvasService) {
       canvasService = doc.createElement('canvas');
       canvasCtx = canvasService.getContext('2d');
@@ -792,7 +835,7 @@ function serializeElementNode(
         canvasService!.width = image.naturalWidth;
         canvasService!.height = image.naturalHeight;
         canvasCtx!.drawImage(image, 0, 0);
-        attributes.rr_dataURL = protectLateAttribute(
+        attributes.rr_dataURL = finalizeLateAttribute(
           'rr_dataURL',
           canvasService!.toDataURL(dataURLOptions.type, dataURLOptions.quality),
         );
@@ -811,7 +854,7 @@ function serializeElementNode(
       }
       if (image.crossOrigin === 'anonymous') {
         priorCrossOrigin
-          ? (attributes.crossOrigin = protectLateAttribute(
+          ? (attributes.crossOrigin = finalizeLateAttribute(
               'crossOrigin',
               priorCrossOrigin,
             ))
@@ -871,22 +914,13 @@ function serializeElementNode(
     delete attributes.src; // prevent auto loading
   }
 
-  // Apply runtime attribute controls to the final representation, after
-  // synthesized form/layout values. The portable policy remains the last
-  // authority inside protectSerializedAttribute.
-  for (const [name, value] of Object.entries(attributes)) {
-    if (typeof value === 'string' || value === null) {
-      attributes[name] = protectSerializedAttribute({
-        element: n,
-        name,
-        value,
-        privacy,
-        maskAllElementAttributes,
-        maskAttributeFn,
-        isGenerated: generatedAttributeNames.has(name),
-      });
-    }
-  }
+  finalizeAttributes(attributes, {
+    element: n,
+    privacy,
+    maskAllElementAttributes,
+    maskAttributeFn,
+    generatedAttributes: generatedAttributeNames,
+  });
   serializationComplete = true;
 
   let isCustomElement: true | undefined;
@@ -1043,7 +1077,18 @@ export function serializeNodeWithId(
     blockClass: string | RegExp;
     blockSelector: string | null;
     maskTextClass: string | RegExp;
-    maskTextSelector: string | null;
+    /** The pre-split pair from `splitMaskAllSelector`; a raw string is still accepted, coerced by `needMaskingText`. */
+    maskTextSelector: MaskTextSelector | string | null;
+    /** Resolved against *this* document by the unmask presence probe. */
+    unmaskTextSelector: string | null;
+    /**
+     * The same selector before the probe resolved it away. Carried so the two
+     * deferred re-serializations below (a nested iframe document, a late
+     * stylesheet) can re-probe against their own document: a target that
+     * exists only inside an iframe is absent from the parent and would
+     * otherwise be resolved to `null` for the whole tree.
+     */
+    unresolvedUnmaskTextSelector?: string | null;
     skipChild: boolean;
     inlineStylesheet: boolean;
     newlyAddedElement?: boolean;
@@ -1073,6 +1118,8 @@ export function serializeNodeWithId(
     stylesheetLoadTimeout?: number;
     cssCaptured?: boolean;
     privacy?: CompiledPrivacyPolicy;
+    /** `needMaskingText` results memoised for one `snapshot()` call; not passed to the two deferred re-serializations below. */
+    maskDecisionCache?: Map<Node, boolean>;
   },
 ): serializedNodeWithId | null {
   const {
@@ -1082,6 +1129,8 @@ export function serializeNodeWithId(
     blockSelector,
     maskTextClass,
     maskTextSelector,
+    unmaskTextSelector,
+    unresolvedUnmaskTextSelector = unmaskTextSelector,
     skipChild = false,
     inlineStylesheet = true,
     maskInputOptions = {},
@@ -1103,19 +1152,29 @@ export function serializeNodeWithId(
     newlyAddedElement = false,
     cssCaptured = false,
     privacy,
+    maskDecisionCache,
   } = options;
   let { needsMask } = options;
   let { preserveWhiteSpace = true } = options;
 
-  if (!needsMask) {
-    // perf: if needsMask = true, children won't also need to check
-    const checkAncestors = needsMask === undefined; // if false, we've already checked ancestors
-    needsMask = needMaskingText(
-      n as Element,
-      maskTextClass,
-      maskTextSelector,
-      checkAncestors,
-    );
+  if (!needsMask || unmaskTextSelector) {
+    const checkAncestors =
+      needsMask === undefined || Boolean(unmaskTextSelector);
+    const walkStart = isElement(n) ? n : dom.parentElement(n) || n;
+    const cached = maskDecisionCache?.get(walkStart);
+    if (cached !== undefined) {
+      needsMask = cached;
+    } else {
+      needsMask = needMaskingText(
+        n as Element,
+        maskTextClass,
+        maskTextSelector,
+        unmaskTextSelector,
+        checkAncestors,
+        needsMask === true,
+      );
+      maskDecisionCache?.set(walkStart, needsMask);
+    }
   }
 
   const _serializedNode = serializeNode(n, {
@@ -1201,6 +1260,8 @@ export function serializeNodeWithId(
       needsMask,
       maskTextClass,
       maskTextSelector,
+      unmaskTextSelector,
+      unresolvedUnmaskTextSelector,
       skipChild,
       inlineStylesheet,
       maskInputOptions,
@@ -1222,6 +1283,7 @@ export function serializeNodeWithId(
       keepIframeSrcFn,
       cssCaptured: false,
       privacy,
+      maskDecisionCache,
     };
 
     if (
@@ -1281,6 +1343,14 @@ export function serializeNodeWithId(
             needsMask,
             maskTextClass,
             maskTextSelector,
+            // The nested document runs its own presence probe: an unmask
+            // target may exist only in here, where the parent's resolved
+            // value (probed against the parent document) says `null`.
+            unmaskTextSelector: resolveUnmaskTextSelector(
+              iframeDoc,
+              unresolvedUnmaskTextSelector,
+            ),
+            unresolvedUnmaskTextSelector,
             skipChild: false,
             inlineStylesheet,
             maskInputOptions,
@@ -1337,6 +1407,13 @@ export function serializeNodeWithId(
             needsMask,
             maskTextClass,
             maskTextSelector,
+            // Deferred to stylesheet load, so re-probe: the document may have
+            // grown an unmask target since the original pass resolved.
+            unmaskTextSelector: resolveUnmaskTextSelector(
+              doc,
+              unresolvedUnmaskTextSelector,
+            ),
+            unresolvedUnmaskTextSelector,
             skipChild: false,
             inlineStylesheet,
             maskInputOptions,
@@ -1382,6 +1459,7 @@ function snapshot(
     blockSelector?: string | null;
     maskTextClass?: string | RegExp;
     maskTextSelector?: string | null;
+    unmaskTextSelector?: string | null;
     inlineStylesheet?: boolean;
     maskAllInputs?: boolean | MaskInputOptions;
     maskTextFn?: MaskTextFn;
@@ -1407,14 +1485,17 @@ function snapshot(
     stylesheetLoadTimeout?: number;
     keepIframeSrcFn?: KeepIframeSrcFn;
     privacyPolicy?: PrivacyPolicy;
+    /** @internal an already-compiled policy, merged with the selector options above; avoids re-compiling on every full snapshot. */
+    privacy?: CompiledPrivacyPolicy;
   },
 ): serializedNodeWithId | null {
   const {
     mirror = new Mirror(),
     blockClass = 'rr-block',
-    blockSelector: legacyBlockSelector = null,
+    blockSelector: manualBlockSelector = null,
     maskTextClass = 'rr-mask',
-    maskTextSelector = null,
+    maskTextSelector: manualMaskTextSelector = null,
+    unmaskTextSelector: manualUnmaskTextSelector = null,
     inlineStylesheet = true,
     inlineImages = false,
     recordCanvas = false,
@@ -1434,9 +1515,29 @@ function snapshot(
     stylesheetLoadTimeout,
     keepIframeSrcFn = () => false,
     privacyPolicy,
+    privacy: compiledPrivacy,
   } = options || {};
-  const privacy = compilePrivacyPolicy(privacyPolicy);
-  const blockSelector = mergeBlockSelectors(legacyBlockSelector, privacy);
+  const {
+    privacy,
+    blockSelector,
+    maskTextSelector,
+    unmaskTextSelector: mergedUnmaskTextSelector,
+  } = resolvePrivacyContext({
+    privacy: compiledPrivacy,
+    privacyPolicy,
+    blockSelector: manualBlockSelector,
+    maskTextSelector: manualMaskTextSelector,
+    unmaskTextSelector: manualUnmaskTextSelector,
+  });
+  // Resolved per document: the unresolved selector rides along beside it, so
+  // nested iframe documents re-probe for themselves rather than inheriting
+  // this document's "nothing matches" answer.
+  const unmaskTextSelector = resolveUnmaskTextSelector(
+    n,
+    mergedUnmaskTextSelector,
+  );
+  const splitMaskTextSelector = splitMaskAllSelector(maskTextSelector);
+  const maskDecisionCache = new Map<Node, boolean>();
   const maskInputOptions: MaskInputOptions =
     maskAllInputs === true
       ? {
@@ -1470,7 +1571,9 @@ function snapshot(
     blockClass,
     blockSelector,
     maskTextClass,
-    maskTextSelector,
+    maskTextSelector: splitMaskTextSelector,
+    unmaskTextSelector,
+    unresolvedUnmaskTextSelector: mergedUnmaskTextSelector,
     skipChild: false,
     inlineStylesheet,
     maskInputOptions,
@@ -1492,6 +1595,7 @@ function snapshot(
     keepIframeSrcFn,
     newlyAddedElement: false,
     privacy,
+    maskDecisionCache,
   });
 }
 
diff --git a/packages/rrweb-snapshot/src/types.ts b/packages/rrweb-snapshot/src/types.ts
index bdd3d2aefa..73682cdfed 100644
--- a/packages/rrweb-snapshot/src/types.ts
+++ b/packages/rrweb-snapshot/src/types.ts
@@ -74,116 +74,19 @@ export type MaskAttributeFn = (
   element: Element,
 ) => string;
 
-/** A versioned, portable Privacy at Capture policy understood by rrweb. */
-export type PrivacyPolicy = {
-  version: 1;
-  preset: PrivacyPreset;
-  rules?: PrivacyRule[];
-  detectors?: PrivacyDetectorOptions;
-  url?: PrivacyUrlOptions;
-};
-
-export type PrivacyPreset = 'strict' | 'balanced' | 'custom' | 'legacy';
-
-export type PrivacyAction = 'allow' | 'mask' | 'exclude';
-
-/**
- * `blur`, `pixelate`, and `shuffle` are portable policy vocabulary reserved
- * for visual recorders. DOM text is currently rendered with `replacement`.
- */
-export type PrivacyMaskStyle =
-  | 'replacement'
-  | 'solid'
-  | 'blur'
-  | 'pixelate'
-  | 'shuffle';
-
-export type SensitiveDataKind =
-  | 'credential'
-  | 'payment'
-  | 'identity'
-  | 'contact'
-  | 'location'
-  | 'custom';
-
-export type PrivacyRule = {
-  target: PrivacyTarget;
-  action: PrivacyAction;
-  style?: PrivacyMaskStyle;
-  classification?: SensitiveDataKind;
-};
-
-export type PrivacyTarget = {
-  type: 'selector';
-  /** A CSS selector. Rules also apply to descendants of the matched node. */
-  selector: string;
-  /**
-   * Restrict an element rule to these attributes. Without this field, a rule
-   * applies to element text, form values, and the standard sensitive
-   * attributes.
-   */
-  attributes?: string[];
-};
-
-export type PrivacyDetectorOptions = Partial<{
-  /**
-   * Explicit opt-in flags for built-in heuristic detectors. Presets do not
-   * enable these; use `@rrweb/rrweb-plugin-privacy-detectors` or
-   * `applyPrivacyDetectors`.
-   */
-  email: boolean;
-  phone: boolean;
-  paymentCard: boolean;
-  ssn: boolean;
-  ipAddress: boolean;
-  custom: Array<{
-    name: string;
-    pattern: string;
-    flags?: string;
-    classification?: SensitiveDataKind;
-    /** Skip this detector for shorter values. Defaults to 1. */
-    minimumLength?: number;
-    /**
-     * Maximum possible match length. Used as overlap when scanning long values
-     * in bounded chunks. Defaults to 256 and cannot exceed 1,024. Must be at
-     * least `minimumLength`.
-     */
-    maximumMatchLength?: number;
-  }>;
-}>;
-
-export type PrivacyUrlOptions = {
-  /** Query parameter names whose values are always removed. */
-  blockedQueryParameters?: string[];
-  /**
-   * When supplied, all query parameter values except these are removed.
-   * Parameter names remain visible so replays retain useful routing context.
-   */
-  allowedQueryParameters?: string[];
-  removeHash?: boolean;
-};
-
-/** @internal Runtime form shared by snapshot and incremental observers. */
-export type CompiledPrivacyPolicy = {
-  policy: PrivacyPolicy;
-  rules: Array<
-    Omit<PrivacyRule, 'target'> & {
-      selector: string;
-      attributes?: Set<string>;
-    }
-  >;
-  detectors: Array<{
-    name: string;
-    regex: RegExp;
-    classification: SensitiveDataKind;
-    minimumLength: number;
-    maximumMatchLength: number;
-    scanChunkSize: number;
-    validate?: (candidate: string) => boolean;
-  }>;
-  minimumDetectorLength: number;
-  blockSelector: string | null;
-};
+/** Declared in `@rrweb/types`, the source of truth; re-exported so this package's public surface is unchanged. */
+export type {
+  PrivacyPolicy,
+  PrivacyPreset,
+  PrivacyAction,
+  PrivacyRule,
+  PrivacyTarget,
+  VendorCompatId,
+  PrivacyDetectorOptions,
+  PrivacyUrlOptions,
+  CompiledDetector,
+  CompiledPrivacyPolicy,
+} from '@rrweb/types';
 
 export type KeepIframeSrcFn = (src: string) => boolean;
 
diff --git a/packages/rrweb-snapshot/src/utils.ts b/packages/rrweb-snapshot/src/utils.ts
index fa6336dad6..cacb49e4cc 100644
--- a/packages/rrweb-snapshot/src/utils.ts
+++ b/packages/rrweb-snapshot/src/utils.ts
@@ -11,6 +11,7 @@
  *   modules while keeping this module as a compatibility shim for external users
  */
 import type {
+  CompiledPrivacyPolicy,
   idNodeMap,
   MaskInputFn,
   MaskInputOptions,
@@ -28,6 +29,7 @@ import type {
   elementNode,
 } from '@rrweb/types';
 import dom from '@rrweb/utils';
+import { stars } from './privacy';
 
 export function isElement(n: Node): n is Element {
   return n.nodeType === n.ELEMENT_NODE;
@@ -259,6 +261,7 @@ export function createMirror(): Mirror {
   return new Mirror();
 }
 
+/** @deprecated use `maskInput`; this is a shim over it, so an always-protected input is now masked here too. */
 export function maskInputValue({
   element,
   maskInputOptions,
@@ -274,20 +277,15 @@ export function maskInputValue({
   value: string | null;
   maskInputFn?: MaskInputFn;
 }): string {
-  let text = value || '';
-  const actualType = type && toLowerCase(type);
-
-  if (
-    maskInputOptions[tagName.toLowerCase() as keyof MaskInputOptions] ||
-    (actualType && maskInputOptions[actualType as keyof MaskInputOptions])
-  ) {
-    if (maskInputFn) {
-      text = maskInputFn(text, element);
-    } else {
-      text = '*'.repeat(text.length);
-    }
-  }
-  return text;
+  return maskInput({
+    element,
+    maskInputOptions,
+    tagName,
+    type,
+    value: value || '',
+    maskInputFn,
+    privacy: undefined,
+  });
 }
 
 export function toLowerCase<T extends string>(str: T): Lowercase<T> {
@@ -368,6 +366,17 @@ export function isNodeMetaEqual(a: serializedNode, b: serializedNode): boolean {
  * where passwords should be masked.
  */
 export function getInputType(element: HTMLElement): Lowercase<string> | null {
+  try {
+    return readInputType(element);
+  } catch {
+    // A proxied or cross-realm element can throw on property access; the
+    // masking paths treat an unreadable type as protected (see `isProtectedInput`).
+    return null;
+  }
+}
+
+/** `getInputType` without the guard, for callers that fail closed on a throw. */
+function readInputType(element: HTMLElement): Lowercase<string> | null {
   // when omitting the type of input element(e.g. <input />), the type is treated as text
   const type = (element as HTMLInputElement).type;
 
@@ -379,6 +388,145 @@ export function getInputType(element: HTMLElement): Lowercase<string> | null {
     : null;
 }
 
+const AUTOCOMPLETE_SEPARATOR = /\s+/;
+
+const PROTECTED_AUTOCOMPLETE = new Set([
+  'cc-csc',
+  'cc-exp',
+  'cc-exp-month',
+  'cc-exp-year',
+  'cc-name',
+  'cc-number',
+  'current-password',
+  'new-password',
+  'one-time-code',
+]);
+
+function hasProtectedAutocomplete(element: HTMLElement): boolean {
+  // The attribute first: the IDL getter exposes the *parsed* autofill value,
+  // which is '' (not nullish) when the token order is invalid, so reading it
+  // first would hide a `cc-number` the markup plainly declares.
+  const autocomplete =
+    element.getAttribute('autocomplete') ||
+    (element as HTMLInputElement).autocomplete;
+  if (!autocomplete || typeof autocomplete !== 'string') return false;
+  const lower = autocomplete.toLowerCase();
+  if (PROTECTED_AUTOCOMPLETE.has(lower)) return true;
+  if (!AUTOCOMPLETE_SEPARATOR.test(lower)) return false;
+  return lower
+    .split(AUTOCOMPLETE_SEPARATOR)
+    .some((token) => PROTECTED_AUTOCOMPLETE.has(token));
+}
+
+/** Inputs always masked regardless of `maskInputOptions` or privacy preset. */
+export function isProtectedInput(element: HTMLElement): boolean {
+  if (dom.untaintedTagName(element) !== 'INPUT') return false;
+  try {
+    const type = readInputType(element);
+    if (type === 'password' || type === 'hidden') {
+      return true;
+    }
+    return hasProtectedAutocomplete(element);
+  } catch {
+    // An element whose type or autocomplete cannot be read is protected.
+    return true;
+  }
+}
+
+/**
+ * `isProtectedInput` minus the `INPUT` tag requirement, for paths that decide
+ * whether an element's `value` is a credential rather than an ordinary
+ * attribute. A component library's `<ion-input type="password">` discloses a
+ * password through its own `type` property exactly as a native input does.
+ *
+ * Deliberately narrower than `isProtectedInput`: only `password` and the
+ * protected autocomplete tokens match. `hidden` is excluded, and so is every
+ * other `.type` string, so `<li type="disc">`, `<ol type="1">`, `<meter>` and
+ * `<progress>` are not swept in -- that over-masking is what keeping this
+ * `password`-specific avoids.
+ */
+export function isProtectedTypeLike(element: HTMLElement): boolean {
+  try {
+    if (readInputType(element) === 'password') return true;
+    return hasProtectedAutocomplete(element);
+  } catch {
+    return true;
+  }
+}
+
+export function maskInput({
+  element,
+  tagName,
+  type,
+  value,
+  maskInputOptions,
+  maskInputFn,
+  privacy,
+}: {
+  element: HTMLElement;
+  tagName: string;
+  type: string | null;
+  value: string;
+  maskInputOptions: MaskInputOptions;
+  maskInputFn?: MaskInputFn;
+  privacy: CompiledPrivacyPolicy | undefined;
+}): string {
+  if (isProtectedInput(element)) return stars(value);
+
+  const presetWantsMask = !!privacy && privacy.maskAllInputs;
+  if (
+    !presetWantsMask &&
+    !manualWantsInputMask(tagName, type, maskInputOptions)
+  )
+    return value;
+
+  if (!maskInputFn) return stars(value);
+  // A callback that throws or returns a non-string fails closed to the raw
+  // value's length, the same contract `finalizeAttribute` gives `maskAttributeFn`.
+  let masked: unknown;
+  try {
+    masked = maskInputFn(value, element);
+  } catch {
+    return stars(value);
+  }
+  if (typeof masked !== 'string') return stars(value);
+  return presetWantsMask ? stars(masked) : masked;
+}
+
+/** The predicate `maskInput` computes; also used where a value discloses a form value without passing through `maskInput` itself (e.g. `<option selected>`). */
+export function shouldMaskInput({
+  element,
+  tagName,
+  type,
+  maskInputOptions,
+  privacy,
+}: {
+  element: HTMLElement;
+  tagName: string;
+  type: string | null;
+  maskInputOptions: MaskInputOptions;
+  privacy: CompiledPrivacyPolicy | undefined;
+}): boolean {
+  return (
+    (!!privacy && privacy.maskAllInputs) ||
+    manualWantsInputMask(tagName, type, maskInputOptions) ||
+    isProtectedInput(element)
+  );
+}
+
+/** Whether the pre-v2 `maskInputOptions` bag opts this tag or input type in. */
+export function manualWantsInputMask(
+  tagName: string,
+  type: string | null,
+  maskInputOptions: MaskInputOptions,
+): boolean {
+  const actualType = type && toLowerCase(type);
+  return Boolean(
+    maskInputOptions[tagName.toLowerCase() as keyof MaskInputOptions] ||
+      (actualType && maskInputOptions[actualType as keyof MaskInputOptions]),
+  );
+}
+
 /**
  * Extracts the file extension from an a path, considering search parameters and fragments.
  * @param path - Path to file
diff --git a/packages/rrweb-snapshot/test/privacy-integration.test.ts b/packages/rrweb-snapshot/test/privacy-integration.test.ts
new file mode 100644
index 0000000000..d220471ddc
--- /dev/null
+++ b/packages/rrweb-snapshot/test/privacy-integration.test.ts
@@ -0,0 +1,1512 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import snapshot from '../src/snapshot';
+import {
+  compilePrivacyPolicy,
+  finalizeAttribute,
+  resolvePrivacyContext,
+  resolveTextValue,
+} from '../src/privacy';
+import { maskInput, isProtectedInput } from '../src/utils';
+import type { PrivacyPolicy } from '../src/types';
+
+function serialize(html: string, privacyPolicy?: PrivacyPolicy): string {
+  document.body.innerHTML = html;
+  return JSON.stringify(snapshot(document, { privacyPolicy }));
+}
+
+/** Attaches an open shadow root to `#host` and fills it. */
+function withShadowRoot(lightHtml: string, shadowHtml: string): void {
+  document.body.innerHTML = lightHtml;
+  const host = document.querySelector('#host') as HTMLElement;
+  host.attachShadow({ mode: 'open' }).innerHTML = shadowHtml;
+}
+
+describe('text masking v2', () => {
+  const strict: PrivacyPolicy = { version: 1, preset: 'strict' };
+
+  it('strict masks page text', () => {
+    expect(serialize('<p>hello world</p>', strict)).not.toContain(
+      'hello world',
+    );
+  });
+
+  it('never masks <style> text, even under strict inside masked subtrees', () => {
+    const out = serialize(
+      '<div><style>body{color:red}</style><p>secret</p></div>',
+      strict,
+    );
+    expect(out).toMatch(/body\s*\{\s*color:\s*red/);
+    expect(out).not.toContain('secret');
+  });
+
+  it('never masks the <style> text node itself when the css is not captured as _cssText', () => {
+    document.body.innerHTML =
+      '<div><style>body{color:red}</style><p>secret</p></div>';
+    const styleEl = document.querySelector('style') as HTMLStyleElement;
+    // with no CSSOM sheet (CSP, cross-origin) the CSS stays on the text node
+    // instead of moving to `_cssText`, which is what actually exercises
+    // serializeTextNode's `isStyle` exemption
+    Object.defineProperty(styleEl, 'sheet', { get: () => null });
+    const out = JSON.stringify(snapshot(document, { privacyPolicy: strict }));
+    expect(out).toContain('body{color:red}');
+    expect(out).not.toContain('secret');
+  });
+
+  it('unmask selector wins for its subtree, nearest ancestor decides', () => {
+    const out = serialize(
+      '<div class="rr-unmask"><p>visible</p><div class="rr-mask"><p>hidden</p></div></div>',
+      strict,
+    );
+    expect(out).toContain('visible');
+    expect(out).not.toContain('hidden');
+  });
+
+  it('does not let a foreign unmask token escape strict masking', () => {
+    const out = serialize(
+      '<div class="amp-unmask"><p>still hidden</p></div>',
+      strict,
+    );
+    expect(out).not.toContain('still hidden');
+  });
+
+  /**
+   * `vendorCompat` can only ever add masking or blocking, never reveal:
+   * `.amp-unmask` stays unhonored even with the flag on. See the guide's
+   * vendor-recognition section.
+   */
+  it('still does not honor .amp-unmask once vendorCompat is on', () => {
+    const out = serialize('<div class="amp-unmask"><p>still hidden</p></div>', {
+      version: 1,
+      preset: 'strict',
+      vendorCompat: true,
+    });
+    expect(out).not.toContain('still hidden');
+  });
+
+  it('recognizes a foreign mask class only once vendorCompat is on', () => {
+    const balanced: PrivacyPolicy = { version: 1, preset: 'balanced' };
+    expect(
+      serialize('<div class="ph-mask"><p>phtext</p></div>', balanced),
+    ).toContain('phtext');
+    expect(
+      serialize('<div class="ph-mask"><p>phtext</p></div>', {
+        ...balanced,
+        vendorCompat: true,
+      }),
+    ).not.toContain('phtext');
+  });
+
+  it('recognizes a foreign block class only once vendorCompat is on', () => {
+    const balanced: PrivacyPolicy = { version: 1, preset: 'balanced' };
+    expect(
+      serialize('<div class="ph-no-capture"><p>phblock</p></div>', balanced),
+    ).toContain('phblock');
+    expect(
+      serialize('<div class="ph-no-capture"><p>phblock</p></div>', {
+        ...balanced,
+        vendorCompat: true,
+      }),
+    ).not.toContain('phblock');
+  });
+
+  /**
+   * The fail-closed rule, end to end: a `data-privacy` typo protects the
+   * subtree instead of silently doing nothing.
+   */
+  it('masks a subtree whose data-privacy value is not recognized', () => {
+    const balanced: PrivacyPolicy = { version: 1, preset: 'balanced' };
+    expect(
+      serialize('<div data-privacy="masked"><p>typo text</p></div>', balanced),
+    ).not.toContain('typo text');
+    expect(
+      serialize('<div data-privacy=""><p>empty value</p></div>', balanced),
+    ).not.toContain('empty value');
+    // the recognized values are unaffected
+    expect(
+      serialize('<div data-privacy="unmask"><p>kept</p></div>', strict),
+    ).toContain('kept');
+    expect(
+      serialize('<div data-privacy="mask"><p>gone</p></div>', balanced),
+    ).not.toContain('gone');
+    expect(
+      serialize('<div data-privacy="block"><p>blocked</p></div>', balanced),
+    ).not.toContain('blocked');
+  });
+
+  /**
+   * Different levels: nearest ancestor wins (covered above). Same element:
+   * mask wins. Sentry resolves the tie with `maskDistance <= unmaskDistance`,
+   * and Amplitude and Mixpanel both check their mask list first -- an element
+   * carrying both markers is masked everywhere, so rrweb matches.
+   */
+  it('same element matching both mask and unmask is masked, not unmasked', () => {
+    const out = serialize(
+      '<div class="rr-unmask rr-mask"><p>tie broken</p></div>',
+      strict,
+    );
+    expect(out).not.toContain('tie broken');
+  });
+
+  it('same-element tie is masked for the data-privacy variant too', () => {
+    const out = serialize(
+      '<div data-privacy="unmask" class="rr-mask"><p>tie broken</p></div>',
+      strict,
+    );
+    expect(out).not.toContain('tie broken');
+  });
+
+  it('same-element tie is masked under balanced, where nothing else masks', () => {
+    const out = serialize(
+      '<div class="rr-unmask rr-mask"><p>tie broken</p></div><p>untouched</p>',
+      { version: 1, preset: 'balanced' },
+    );
+    expect(out).not.toContain('tie broken');
+    // balanced does not mask page text at large -- only the tied element
+    expect(out).toContain('untouched');
+  });
+
+  it('a mask tie on an ancestor still loses to a nearer unmask descendant', () => {
+    // the same-element rule must not leak into the cross-level rule
+    const out = serialize(
+      '<div class="rr-unmask rr-mask"><div class="rr-unmask"><p>visible</p></div><p>hidden</p></div>',
+      strict,
+    );
+    expect(out).toContain('visible');
+    expect(out).not.toContain('hidden');
+  });
+
+  it("a user-supplied unmaskTextSelector escapes strict's mask-everything default", () => {
+    document.body.innerHTML =
+      '<div class="support-widget"><p>visible</p></div><p>hidden</p>';
+    const out = JSON.stringify(
+      snapshot(document, {
+        privacyPolicy: strict,
+        unmaskTextSelector: '.support-widget',
+      }),
+    );
+    expect(out).toContain('visible');
+    expect(out).not.toContain('hidden');
+  });
+
+  /**
+   * The unmask presence probe resolves the selector to `null` when nothing in
+   * *this* document matches it. A nested same-origin iframe is a separate
+   * document: the parent's "nothing matches" answer used to be threaded into
+   * it verbatim, so an unmask target living only inside the frame was
+   * ignored. Each document now re-probes with the unresolved selector.
+   */
+  it('lets a nested same-origin iframe resolve the unmask selector itself', async () => {
+    document.body.innerHTML = '<p>parent hidden</p><iframe id="f"></iframe>';
+    const frame = document.querySelector('#f') as HTMLIFrameElement;
+    const inner = frame.contentDocument!;
+    inner.body.innerHTML =
+      '<div class="support-widget"><p>frame visible</p></div>' +
+      '<p>frame hidden</p>';
+
+    const serialized = await new Promise<string>((resolve) => {
+      snapshot(document, {
+        privacyPolicy: strict,
+        // the target exists only inside the frame, never in the parent
+        unmaskTextSelector: '.support-widget',
+        onIframeLoad: (_el, node) => resolve(JSON.stringify(node)),
+      });
+    });
+
+    expect(serialized).toContain('frame visible');
+    expect(serialized).not.toContain('frame hidden');
+  });
+
+  it('detectors mask the whole text node under minimal when configured', () => {
+    const withDetectors: PrivacyPolicy = {
+      version: 1,
+      preset: 'minimal',
+      detectors: { paymentCard: true, phone: true },
+    };
+    const out = serialize(
+      '<p>call 5551234567 4111 1111 1111 1111 now</p>',
+      withDetectors,
+    );
+    expect(out).not.toContain('4111 1111 1111 1111');
+  });
+
+  it('detectors occlude every input value at snapshot time, clean or not', () => {
+    const withDetectors: PrivacyPolicy = {
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    };
+    const out = serialize(
+      '<input type="text" value="bob@example.com">' +
+        '<input type="text" value="Visible Name">',
+      withDetectors,
+    );
+    expect(out).not.toContain('bob@example.com');
+    expect(out).toContain('*'.repeat('bob@example.com'.length));
+    // The clean value is occluded too: input values are never scanned, so
+    // "no detector matched" is not a reason to record one.
+    expect(out).not.toContain('Visible Name');
+    expect(out).toContain('*'.repeat('Visible Name'.length));
+  });
+
+  it('an unmask rule cannot reveal an input value while detectors are on', () => {
+    const withDetectors: PrivacyPolicy = {
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+      rules: [
+        {
+          target: { type: 'selector', selector: '.rr-unmask' },
+          action: 'unmask',
+        },
+      ],
+    };
+    const out = serialize(
+      '<input class="rr-unmask" type="text" value="Visible Name">',
+      withDetectors,
+    );
+    expect(out).not.toContain('Visible Name');
+    expect(out).toContain('*'.repeat('Visible Name'.length));
+  });
+
+  it('keeps masking inherited from an ancestor outside the shadow root', () => {
+    withShadowRoot(
+      '<div class="rr-mask"><div id="host"></div></div>',
+      '<p>secret</p>',
+    );
+    const out = JSON.stringify(
+      snapshot(document, {
+        privacyPolicy: { version: 1, preset: 'balanced' },
+      }),
+    );
+    expect(out).not.toContain('secret');
+  });
+
+  it('lets an unmask selector inside the shadow root escape a masked host', () => {
+    withShadowRoot(
+      '<div class="rr-mask"><div id="host"></div></div>',
+      '<div class="rr-unmask"><p>visible</p></div>',
+    );
+    const out = JSON.stringify(
+      snapshot(document, {
+        privacyPolicy: { version: 1, preset: 'balanced' },
+      }),
+    );
+    expect(out).toContain('visible');
+  });
+
+  it('masks a text node parented directly by a shadow root under strict', () => {
+    document.body.innerHTML = '<div id="host"></div>';
+    const host = document.querySelector('#host') as HTMLElement;
+    host
+      .attachShadow({ mode: 'open' })
+      .appendChild(document.createTextNode('secret'));
+    const out = JSON.stringify(snapshot(document, { privacyPolicy: strict }));
+    expect(out).not.toContain('secret');
+  });
+
+  it('minimal without detectors leaves text untouched', () => {
+    expect(serialize('<p>bob@example.com</p>', undefined)).toContain(
+      'bob@example.com',
+    );
+  });
+});
+
+describe('data-privacy="ignore" snapshots exactly like mask', () => {
+  const balanced: PrivacyPolicy = { version: 1, preset: 'balanced' };
+
+  it('masks text and attributes identically to data-privacy="mask"', () => {
+    const markup = (verb: string) =>
+      `<div data-privacy="${verb}" title="secret title"><p>secret text</p></div>`;
+    const asIgnore = serialize(markup('ignore'), balanced);
+    expect(asIgnore).not.toContain('secret text');
+    expect(asIgnore).not.toContain('secret title');
+    // Identical to the mask serialization, apart from the verb itself and
+    // the serializer's global node-id counter.
+    const normalize = (out: string) =>
+      out.replace(/"(rootId|id)":\d+/g, '"$1":0');
+    expect(
+      normalize(
+        asIgnore.replace('"data-privacy":"ignore"', '"data-privacy":"mask"'),
+      ),
+    ).toBe(normalize(serialize(markup('mask'), balanced)));
+  });
+
+  it('a descendant unmask re-enables content inside an ignore subtree', () => {
+    const out = serialize(
+      '<div data-privacy="ignore"><p>hidden text</p><div data-privacy="unmask"><p>shown text</p></div></div>',
+      balanced,
+    );
+    expect(out).not.toContain('hidden text');
+    expect(out).toContain('shown text');
+  });
+
+  it('same-element ignore + .rr-unmask resolves to ignore: still masked', () => {
+    const out = serialize(
+      '<div class="rr-unmask" data-privacy="ignore"><p>secret text</p></div>',
+      balanced,
+    );
+    expect(out).not.toContain('secret text');
+  });
+
+  it('legacy .rr-ignore never masks content', () => {
+    const out = serialize(
+      '<div class="rr-ignore"><p>legacy text</p></div>',
+      balanced,
+    );
+    expect(out).toContain('legacy text');
+  });
+});
+
+describe('maskInput v2', () => {
+  const balanced = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+  const minimal = compilePrivacyPolicy(undefined);
+  const input = (attrs = '') => {
+    document.body.innerHTML = `<input ${attrs} value="4111 1111 1111 1111">`;
+    return document.querySelector('input') as HTMLInputElement;
+  };
+  it('balanced masks all inputs shape-free (stars, not digits)', () => {
+    const out = maskInput({
+      element: input(),
+      tagName: 'input',
+      type: 'text',
+      value: '4111 1111 1111 1111',
+      maskInputOptions: {},
+      privacy: balanced,
+    });
+    expect(out).toBe('*'.repeat(19));
+  });
+  it('balanced + maskInputFn: fn controls length only, never content', () => {
+    const out = maskInput({
+      element: input(),
+      tagName: 'input',
+      type: 'text',
+      value: 'secret',
+      maskInputOptions: {},
+      maskInputFn: () => '[redacted]',
+      privacy: balanced,
+    });
+    expect(out).toBe('*'.repeat('[redacted]'.length));
+  });
+  // The callback decides length, never content, and a broken callback must
+  // not take the snapshot down or record the raw value: same contract as
+  // `maskAttributeFn` in `finalizeAttribute`.
+  it('balanced + maskInputFn returning a non-string fails closed to stars', () => {
+    const out = maskInput({
+      element: input(),
+      tagName: 'input',
+      type: 'text',
+      value: 'secret',
+      maskInputOptions: {},
+      maskInputFn: (() => undefined) as unknown as (v: string) => string,
+      privacy: balanced,
+    });
+    expect(out).toBe('*'.repeat('secret'.length));
+  });
+  it('maskInputFn that throws fails closed to stars, on any preset', () => {
+    const boom = () => {
+      throw new Error('boom');
+    };
+    for (const privacy of [balanced, minimal]) {
+      const out = maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'secret',
+        maskInputOptions: { text: true },
+        maskInputFn: boom,
+        privacy,
+      });
+      expect(out).toBe('*'.repeat('secret'.length));
+    }
+  });
+  it('minimal + maskInputFn returning a non-string fails closed to stars', () => {
+    const out = maskInput({
+      element: input(),
+      tagName: 'input',
+      type: 'text',
+      value: 'secret',
+      maskInputOptions: { text: true },
+      maskInputFn: (() => 42) as unknown as (v: string) => string,
+      privacy: minimal,
+    });
+    expect(out).toBe('*'.repeat('secret'.length));
+  });
+  it('maskTextFn that throws or returns a non-string fails closed to stars', () => {
+    const parent = document.createElement('p');
+    const base = {
+      value: 'hello world',
+      parent,
+      needsMask: true,
+      exemptScript: false,
+    };
+    expect(
+      resolveTextValue({
+        ...base,
+        maskTextFn: () => {
+          throw new Error('boom');
+        },
+      }),
+    ).toBe('***** *****');
+    expect(
+      resolveTextValue({
+        ...base,
+        maskTextFn: (() => null) as unknown as (v: string) => string,
+      }),
+    ).toBe('***** *****');
+  });
+  it('masks a password even when maskInputOptions says password: false', () => {
+    const pw = document.createElement('input');
+    pw.type = 'password';
+    const out = maskInput({
+      element: pw,
+      tagName: 'input',
+      type: 'password',
+      value: 'hunter2',
+      maskInputOptions: { password: false },
+      privacy: minimal,
+    });
+    expect(out).toBe('*'.repeat(7));
+  });
+  it('minimal + maskInputFn trusted verbatim when minimal options mask', () => {
+    const out = maskInput({
+      element: input(),
+      tagName: 'input',
+      type: 'text',
+      value: 'secret',
+      maskInputOptions: { text: true },
+      maskInputFn: () => '[redacted]',
+      privacy: minimal,
+    });
+    expect(out).toBe('[redacted]');
+  });
+  it('minimal without options passes value through', () => {
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'plain',
+        maskInputOptions: {},
+        privacy: minimal,
+      }),
+    ).toBe('plain');
+  });
+  it('detectors occlude every input value to length, matched or not', () => {
+    const withDetectors = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(withDetectors.maskAllInputs).toBe(true);
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'bob@example.com',
+        maskInputOptions: {},
+        privacy: withDetectors,
+      }),
+    ).toBe('*'.repeat('bob@example.com'.length));
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'plain',
+        maskInputOptions: {},
+        privacy: withDetectors,
+      }),
+    ).toBe('*****');
+  });
+  it('every keystroke prefix is occluded at its own length', () => {
+    const withDetectors = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { paymentCard: true },
+    });
+    const card = '4111111111111111';
+    for (let i = 1; i <= card.length; i++) {
+      expect(
+        maskInput({
+          element: input(),
+          tagName: 'input',
+          type: 'text',
+          value: card.slice(0, i),
+          maskInputOptions: {},
+          privacy: withDetectors,
+        }),
+      ).toBe('*'.repeat(i));
+    }
+  });
+  it('a maskInputFn controls length only while detectors are on', () => {
+    const withDetectors = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(
+      maskInput({
+        element: input(),
+        tagName: 'input',
+        type: 'text',
+        value: 'bob@example.com',
+        maskInputOptions: { text: true },
+        maskInputFn: () => '[redacted]',
+        privacy: withDetectors,
+      }),
+    ).toBe('*'.repeat('[redacted]'.length));
+  });
+  it('protected inputs always mask, even minimal with no options', () => {
+    expect(
+      maskInput({
+        element: input('type="password"'),
+        tagName: 'input',
+        type: 'password',
+        value: 'pw',
+        maskInputOptions: {},
+        privacy: minimal,
+      }),
+    ).toBe('**');
+    expect(isProtectedInput(input('autocomplete="cc-number"'))).toBe(true);
+  });
+});
+
+describe('late attribute writes after the finalization sweep', () => {
+  /**
+   * `inlineImages` writes `rr_dataURL` from an `<img>` load listener, which
+   * fires after `finalizeAttributes` has already run for that node. The
+   * late-write guard must route that value through `finalizeAttribute` or a
+   * coarse `maskAllElementAttributes` would be bypassed by every image that
+   * was still loading at snapshot time.
+   */
+  it('masks rr_dataURL written by a late image load under maskAllElementAttributes', () => {
+    const getContext = vi
+      .spyOn(HTMLCanvasElement.prototype, 'getContext')
+      .mockImplementation(
+        () =>
+          ({
+            drawImage: () => undefined,
+          } as unknown as CanvasRenderingContext2D),
+      );
+    const toDataURL = vi
+      .spyOn(HTMLCanvasElement.prototype, 'toDataURL')
+      .mockReturnValue('data:image/png;base64,AAAA');
+    document.body.innerHTML = '<img id="late" src="late.png">';
+    const img = document.getElementById('late') as HTMLImageElement;
+    // jsdom never loads images: complete stays false, so the listener path is taken.
+    Object.defineProperty(img, 'complete', { value: false });
+    Object.defineProperty(img, 'naturalWidth', { value: 4 });
+    Object.defineProperty(img, 'naturalHeight', { value: 4 });
+
+    const tree = snapshot(document, {
+      inlineImages: true,
+      maskAllElementAttributes: true,
+    });
+    const find = (n: any): any =>
+      n?.tagName === 'img' ? n : (n?.childNodes || []).map(find).find(Boolean);
+    const node = find(tree);
+    expect(node.attributes.rr_dataURL).toBeUndefined();
+
+    img.dispatchEvent(new Event('load'));
+
+    expect(node.attributes.rr_dataURL).toBe(
+      '*'.repeat('data:image/png;base64,AAAA'.length),
+    );
+    getContext.mockRestore();
+    toDataURL.mockRestore();
+    document.body.innerHTML = '';
+  });
+});
+
+describe('finalizeAttribute', () => {
+  const strict = compilePrivacyPolicy({ version: 1, preset: 'strict' });
+  const balanced = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+  const minimal = compilePrivacyPolicy({ version: 1, preset: 'minimal' });
+
+  const el = (
+    html = '<img title="Bob" style="color:red" src="https://u:p@a.com/i.png?token=t">',
+    selector = 'img',
+  ) => {
+    document.body.innerHTML = html;
+    return document.querySelector(selector) as Element;
+  };
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('never masks style, even under strict', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'style',
+        value: 'color:red',
+        privacy: strict,
+      }),
+    ).toBe('color:red');
+  });
+
+  it('never masks _cssText, on any path', () => {
+    expect(
+      finalizeAttribute({
+        element: el('<style></style>', 'style'),
+        name: '_cssText',
+        value: 'body{color:red}',
+        privacy: strict,
+        maskAllElementAttributes: true,
+      }),
+    ).toBe('body{color:red}');
+  });
+
+  it('masks listed attributes under strict/balanced', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: strict,
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'placeholder',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'aria-label',
+        value: 'Bob',
+        privacy: minimal,
+      }),
+    ).toBe('Bob');
+  });
+
+  it('strict nulls media sources; URLs sanitized elsewhere', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'src',
+        value: 'https://a.com/i.png',
+        privacy: strict,
+      }),
+    ).toBeNull();
+    expect(
+      finalizeAttribute({
+        element: el('<a href="#"></a>', 'a'),
+        name: 'href',
+        value: 'https://u:p@a.com/x?token=t',
+        privacy: balanced,
+      }),
+    ).toBe('https://a.com/x?token=*');
+    // non-media element keeps a sanitized src under strict
+    expect(
+      finalizeAttribute({
+        element: el('<div></div>', 'div'),
+        name: 'src',
+        value: 'https://a.com/x?page=1',
+        privacy: strict,
+      }),
+    ).toBe('https://a.com/x?page=*');
+  });
+
+  describe('dimension-preserving placeholders for blocked images', () => {
+    it('swaps a blocked img src for a same-size SVG when dimensions are declared', () => {
+      const out = finalizeAttribute({
+        element: el('<img src="https://a.com/i.png" width="120" height="80">'),
+        name: 'src',
+        value: 'https://a.com/i.png',
+        privacy: strict,
+      });
+      expect(out).toMatch(/^data:image\/svg\+xml;utf8,/);
+      expect(out).toContain('width=%22120%22');
+      expect(out).toContain('height=%2280%22');
+      // the real source never survives into the placeholder
+      expect(out).not.toContain('a.com');
+    });
+
+    it('covers srcset on an img and poster on a video', () => {
+      expect(
+        finalizeAttribute({
+          element: el('<img srcset="a.png 1x" width="10" height="10">'),
+          name: 'srcset',
+          value: 'a.png 1x',
+          privacy: strict,
+        }),
+      ).toContain('width=%2210%22');
+      expect(
+        finalizeAttribute({
+          element: el(
+            '<video poster="p.png" width="640" height="360"></video>',
+            'video',
+          ),
+          name: 'poster',
+          value: 'p.png',
+          privacy: strict,
+        }),
+      ).toContain('width=%22640%22');
+    });
+
+    it('keeps returning null for an img with no declared dimensions', () => {
+      expect(
+        finalizeAttribute({
+          element: el('<img src="https://a.com/i.png">'),
+          name: 'src',
+          value: 'https://a.com/i.png',
+          privacy: strict,
+        }),
+      ).toBeNull();
+    });
+
+    it.each([
+      ['<img src="i.png" width="50%" height="80">'],
+      ['<img src="i.png" width="auto" height="auto">'],
+      ['<img src="i.png" width="-10" height="10">'],
+      ['<img src="i.png" width="120">'],
+    ])('rejects unusable dimensions: %s', (html) => {
+      expect(
+        finalizeAttribute({
+          element: el(html),
+          name: 'src',
+          value: 'i.png',
+          privacy: strict,
+        }),
+      ).toBeNull();
+    });
+
+    it('derives placeholder dimensions from content attributes only, never a layout measurement', () => {
+      const rect = vi.spyOn(Element.prototype, 'getBoundingClientRect');
+      finalizeAttribute({
+        element: el('<img src="https://a.com/i.png" width="120" height="80">'),
+        name: 'src',
+        value: 'https://a.com/i.png',
+        privacy: strict,
+      });
+      expect(rect).not.toHaveBeenCalled();
+      rect.mockRestore();
+    });
+
+    it('falls back to the intrinsic size when an img has no size attributes', () => {
+      // naturalWidth/naturalHeight are intrinsic, not a layout measurement,
+      // so a CSS-sized image still gets a same-size placeholder.
+      const img = el('<img src="a.png">');
+      Object.defineProperty(img, 'naturalWidth', { value: 320 });
+      Object.defineProperty(img, 'naturalHeight', { value: 200 });
+      const out = finalizeAttribute({
+        element: img,
+        name: 'src',
+        value: 'a.png',
+        privacy: strict,
+      });
+      expect(out).toContain('width=%22320%22');
+      expect(out).toContain('height=%22200%22');
+    });
+
+    it('emits a placeholder that is a valid srcset candidate (no whitespace)', () => {
+      const out = finalizeAttribute({
+        element: el('<img srcset="a.png 1x" width="10" height="10">'),
+        name: 'srcset',
+        value: 'a.png 1x',
+        privacy: strict,
+      }) as string;
+      expect(out.startsWith('data:image/svg+xml')).toBe(true);
+      expect(/\s/.test(out)).toBe(false);
+      // a comma after the data-URL prefix would start a new srcset candidate
+      expect(out.slice('data:image/svg+xml;utf8,'.length)).not.toContain(',');
+    });
+
+    it('leaves non-image media sources dropped even when sized', () => {
+      // the renamed cross-origin iframe source
+      expect(
+        finalizeAttribute({
+          element: el('<iframe width="300" height="200"></iframe>', 'iframe'),
+          name: 'rr_src',
+          value: 'https://x.com/',
+          privacy: strict,
+        }),
+      ).toBeNull();
+      expect(
+        finalizeAttribute({
+          element: el('<embed src="a.swf" width="10" height="10">', 'embed'),
+          name: 'src',
+          value: 'a.swf',
+          privacy: strict,
+        }),
+      ).toBeNull();
+      expect(
+        finalizeAttribute({
+          element: el('<audio src="a.mp3"></audio>', 'audio'),
+          name: 'src',
+          value: 'a.mp3',
+          privacy: strict,
+        }),
+      ).toBeNull();
+      expect(
+        finalizeAttribute({
+          element: el('<source src="a.png" width="10" height="10">', 'source'),
+          name: 'src',
+          value: 'a.png',
+          privacy: strict,
+        }),
+      ).toBeNull();
+    });
+  });
+
+  describe('operational attributes are exempt from every masking branch', () => {
+    it('maskAllElementAttributes cannot star data-privacy', () => {
+      expect(
+        finalizeAttribute({
+          element: el('<div data-privacy="mask"></div>', 'div'),
+          name: 'data-privacy',
+          value: 'mask',
+          privacy: strict,
+          maskAllElementAttributes: true,
+        }),
+      ).toBe('mask');
+    });
+
+    it('maskAllElementAttributes cannot star data-rr-is-password', () => {
+      expect(
+        finalizeAttribute({
+          element: el('<input data-rr-is-password="true">', 'input'),
+          name: 'data-rr-is-password',
+          value: 'true',
+          privacy: strict,
+          maskAllElementAttributes: true,
+        }),
+      ).toBe('true');
+    });
+
+    it('the exemption covers only names a code path reads back', () => {
+      // `data-rrweb-id` used to sit in the set although nothing in the repo
+      // reads it. An exemption is unconditional, so a name that buys nothing
+      // is pure downside: it stays maskable.
+      expect(
+        finalizeAttribute({
+          element: el('<div data-rrweb-id="42"></div>', 'div'),
+          name: 'data-rrweb-id',
+          value: '42',
+          privacy: strict,
+          maskAllElementAttributes: true,
+        }),
+      ).toBe('**');
+    });
+
+    it('maskAttributeFn is never invoked for an operational attribute', () => {
+      const maskAttributeFn = vi.fn(() => 'REWRITTEN');
+      expect(
+        finalizeAttribute({
+          element: el('<div data-privacy="unmask"></div>', 'div'),
+          name: 'data-privacy',
+          value: 'unmask',
+          privacy: strict,
+          maskAttributeFn,
+        }),
+      ).toBe('unmask');
+      expect(maskAttributeFn).not.toHaveBeenCalled();
+      // ...but it still runs for an ordinary attribute on the same element
+      finalizeAttribute({
+        element: el('<div data-privacy="unmask" title="x"></div>', 'div'),
+        name: 'title',
+        value: 'x',
+        privacy: minimal,
+        maskAttributeFn,
+      });
+      expect(maskAttributeFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('matches the attribute name case-insensitively', () => {
+      expect(
+        finalizeAttribute({
+          element: el('<div DATA-PRIVACY="mask"></div>', 'div'),
+          name: 'DATA-PRIVACY',
+          value: 'mask',
+          privacy: strict,
+          maskAllElementAttributes: true,
+        }),
+      ).toBe('mask');
+    });
+  });
+
+  it('masks value on form tags under strict only', () => {
+    expect(
+      finalizeAttribute({
+        element: el('<input value="abc">', 'input'),
+        name: 'value',
+        value: 'abc',
+        privacy: strict,
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el('<li value="3"></li>', 'li'),
+        name: 'value',
+        value: '3',
+        privacy: strict,
+      }),
+    ).toBe('3');
+    expect(
+      finalizeAttribute({
+        element: el('<input value="abc">', 'input'),
+        name: 'value',
+        value: 'abc',
+        privacy: balanced,
+      }),
+    ).toBe('abc');
+  });
+
+  it('maskAllElementAttributes stars everything except generated', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: undefined,
+        maskAllElementAttributes: true,
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'rr_open_mode',
+        value: 'modal',
+        privacy: undefined,
+        maskAllElementAttributes: true,
+        isGenerated: true,
+      }),
+    ).toBe('modal');
+  });
+
+  it('generated attributes are exempt from maskAttributeFn and the policy', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'rr_width',
+        value: '100px',
+        privacy: strict,
+        maskAttributeFn: () => 'nope',
+        isGenerated: true,
+      }),
+    ).toBe('100px');
+  });
+
+  /**
+   * The `isGenerated` flag alone is one point of failure: a mis-set flag on a
+   * page-authored attribute would leak it verbatim. The exemption is gated on
+   * a fixed rendering-metadata name allowlist as well, so both must agree.
+   */
+  it('the isGenerated flag alone does not exempt a page attribute name', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: undefined,
+        maskAllElementAttributes: true,
+        isGenerated: true,
+      }),
+    ).toBe('***');
+    // ... and the policy path is reached too, not just the kill switch
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+        isGenerated: true,
+      }),
+    ).toBe('***');
+  });
+
+  it('rr_dataURL is not on the allowlist even when flagged generated', () => {
+    // it holds real page pixels, unlike rr_width/rr_scrollTop/...
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'rr_dataURL',
+        value: 'data:image/png;base64,AAA',
+        privacy: strict,
+        maskAllElementAttributes: true,
+        isGenerated: true,
+      }),
+    ).toBe('*'.repeat('data:image/png;base64,AAA'.length));
+  });
+
+  it('every rendering-metadata name the serializer generates is exempt', () => {
+    for (const name of [
+      'rr_width',
+      'rr_height',
+      'rr_scrollLeft',
+      'rr_scrollTop',
+      'rr_mediaState',
+      'rr_open_mode',
+    ]) {
+      expect(
+        finalizeAttribute({
+          element: el(),
+          name,
+          value: 'v',
+          privacy: strict,
+          maskAllElementAttributes: true,
+          isGenerated: true,
+        }),
+      ).toBe('v');
+    }
+  });
+
+  /**
+   * An unmask ancestor is an explicit "this subtree is safe" statement, and
+   * escapes the preset's masked-attribute defaults -- Sentry's
+   * `maskAttribute` consults its unmask selector the same way.
+   */
+  it('an unmask ancestor escapes the masked-attribute defaults', () => {
+    expect(
+      finalizeAttribute({
+        element: el('<img title="Bob" class="rr-unmask">'),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('Bob');
+    expect(
+      finalizeAttribute({
+        element: el('<div class="rr-unmask"><img title="Bob"></div>'),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('Bob');
+    expect(
+      finalizeAttribute({
+        element: el('<img title="Bob">'),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('***');
+  });
+
+  it('a selector that throws grants no unmask escape; the attribute stays masked', () => {
+    const matches = vi
+      .spyOn(Element.prototype, 'matches')
+      .mockImplementation(() => {
+        throw new Error('boom');
+      });
+    expect(
+      finalizeAttribute({
+        element: el('<img title="Bob" class="rr-unmask">'),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('***');
+    matches.mockRestore();
+  });
+
+  /**
+   * Attributes resolve exactly like text: the nearest annotated ancestor
+   * decides, and on the same element mask beats unmask. Before this, the
+   * attribute path consulted only the unmask selector, so an unmask ancestor
+   * revealed `title`/`placeholder`/`aria-label` through a nearer mask marker
+   * that text masking would have honored.
+   */
+  it('same element carrying mask and unmask keeps the attribute masked', () => {
+    expect(
+      finalizeAttribute({
+        element: el('<img title="Bob" class="rr-mask rr-unmask">'),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('***');
+  });
+
+  it('the nearest annotated ancestor decides for attributes too', () => {
+    expect(
+      finalizeAttribute({
+        element: el(
+          '<div class="rr-unmask"><div class="rr-mask"><img title="Bob"></div></div>',
+        ),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el(
+          '<div class="rr-mask"><div class="rr-unmask"><img title="Bob"></div></div>',
+        ),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+      }),
+    ).toBe('Bob');
+  });
+
+  it('under strict the mask-everything default does not join the attribute tie', () => {
+    expect(
+      finalizeAttribute({
+        element: el('<div class="rr-unmask"><img title="Bob"></div>'),
+        name: 'title',
+        value: 'Bob',
+        privacy: strict,
+      }),
+    ).toBe('Bob');
+  });
+
+  it('a record()-level maskTextSelector takes part in the attribute tie', () => {
+    const ctx = resolvePrivacyContext({
+      privacyPolicy: { version: 1, preset: 'balanced' },
+      maskTextSelector: '.widget',
+    });
+    expect(
+      finalizeAttribute({
+        element: el(
+          '<div class="rr-unmask"><div class="widget"><img title="Bob"></div></div>',
+        ),
+        name: 'title',
+        value: 'Bob',
+        privacy: ctx.privacy,
+      }),
+    ).toBe('***');
+  });
+
+  it('honors a record()-level unmaskTextSelector, not just policy selectors', () => {
+    document.body.innerHTML =
+      '<div class="support-widget"><img title="Bob"></div>' +
+      '<div class="rr-unmask"><img title="Alice"></div>' +
+      '<div class="policy-safe"><img title="Carol"></div>' +
+      '<img title="Dave">';
+
+    const out = JSON.stringify(
+      snapshot(document, {
+        privacyPolicy: {
+          version: 1,
+          preset: 'balanced',
+          rules: [
+            {
+              target: { type: 'selector', selector: '.policy-safe' },
+              action: 'unmask',
+            },
+          ],
+        },
+        unmaskTextSelector: '.support-widget',
+      }),
+    );
+
+    expect(out).toContain('"Bob"'); // record()-level option
+    expect(out).toContain('"Alice"'); // .rr-unmask
+    expect(out).toContain('"Carol"'); // policy rule
+    expect(out).not.toContain('"Dave"'); // no escape -> still starred
+  });
+
+  it('the unmask escape cannot reopen a URL or a blocked media source', () => {
+    expect(
+      finalizeAttribute({
+        element: el('<img class="rr-unmask" src="https://a.com/?token=t">'),
+        name: 'src',
+        value: 'https://a.com/?token=t',
+        privacy: balanced,
+      }),
+    ).toBe('https://a.com/?token=*');
+    expect(
+      finalizeAttribute({
+        element: el('<img class="rr-unmask" src="https://a.com/i.png">'),
+        name: 'src',
+        value: 'https://a.com/i.png',
+        privacy: strict,
+      }),
+    ).toBeNull();
+  });
+
+  // NOTE: must be the first test in this file that combines maskAll + fn --
+  // the warning is one-time per module instance.
+  it('warns once when maskAttributeFn is ignored under maskAllElementAttributes', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const call = () =>
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: undefined,
+        maskAllElementAttributes: true,
+        maskAttributeFn: () => 'from-fn',
+      });
+    expect(call()).toBe('***');
+    expect(call()).toBe('***');
+    expect(warn).toHaveBeenCalledTimes(1);
+  });
+
+  it('maskAttributeFn throw fails closed to stars; fn ignored under maskAll', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: undefined,
+        maskAttributeFn: () => {
+          throw new Error('boom');
+        },
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: strict,
+        maskAllElementAttributes: true,
+        maskAttributeFn: () => 'from-fn',
+      }),
+    ).toBe('***');
+  });
+
+  it('feeds maskAttributeFn output into the policy, which is the final authority', () => {
+    // The callback is a pipeline stage, not an escape hatch: under balanced or
+    // strict the policy applies on top of whatever it returned.
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: strict,
+        maskAttributeFn: (name, value) => `[${name}:${value.length}]`,
+      }),
+    ).toBe('*'.repeat('[title:3]'.length));
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: balanced,
+        maskAttributeFn: () => '[MASKED]',
+      }),
+    ).toBe('*'.repeat('[MASKED]'.length));
+    // Under minimal the policy block is the identity, so the callback's output
+    // survives verbatim.
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: minimal,
+        maskAttributeFn: () => '[MASKED]',
+      }),
+    ).toBe('[MASKED]');
+    // ...and an attribute the policy does not touch keeps the fn's output on
+    // every preset.
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'data-x',
+        value: 'Bob',
+        privacy: strict,
+        maskAttributeFn: () => '[MASKED]',
+      }),
+    ).toBe('[MASKED]');
+  });
+
+  it('drops a media source the fn emptied, rather than recording src=""', () => {
+    // '' must not short-circuit the policy: rebuild.ts treats null (attribute
+    // removed) and '' (setAttribute(name, '')) differently, so an emptied
+    // <img src> under strict has to come out null, not ''.
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'src',
+        value: 'https://a.com/i.png',
+        privacy: strict,
+        maskAttributeFn: () => '',
+      }),
+    ).toBeNull();
+    expect(
+      finalizeAttribute({
+        element: el('<iframe src="https://x.com/"></iframe>', 'iframe'),
+        name: 'rr_src',
+        value: 'https://x.com/',
+        privacy: strict,
+        maskAttributeFn: () => '',
+      }),
+    ).toBeNull();
+    // On the branches that do not drop it, an emptied value stays empty
+    // instead of being resolved into a path by sanitizeUrl.
+    expect(
+      finalizeAttribute({
+        element: el('<a href="#"></a>', 'a'),
+        name: 'href',
+        value: 'https://x.com/',
+        privacy: balanced,
+        maskAttributeFn: () => '',
+      }),
+    ).toBe('');
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: 'Bob',
+        privacy: strict,
+        maskAttributeFn: () => '',
+      }),
+    ).toBe('');
+  });
+
+  it('fails closed when maskAttributeFn returns a non-string', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'data-x',
+        value: 'Bob',
+        privacy: minimal,
+        maskAttributeFn: () => undefined as unknown as string,
+      }),
+    ).toBe('***');
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'data-x',
+        value: 'a longer value',
+        privacy: undefined,
+        maskAttributeFn: () => ({ nope: true } as unknown as string),
+      }),
+    ).toBe('*'.repeat('a longer value'.length));
+  });
+
+  it('applies the strict media-source and URL rules to the renamed rr_src', () => {
+    const iframe = () => el('<iframe src="https://x.com/"></iframe>', 'iframe');
+    expect(
+      finalizeAttribute({
+        element: iframe(),
+        name: 'rr_src',
+        value: 'https://u:p@x.com/?token=t',
+        privacy: strict,
+      }),
+    ).toBeNull();
+    expect(
+      finalizeAttribute({
+        element: iframe(),
+        name: 'rr_src',
+        value: 'https://u:p@x.com/?token=t',
+        privacy: balanced,
+      }),
+    ).toBe('https://x.com/?token=*');
+  });
+
+  it('passes through null/empty values and untouched attributes', () => {
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'title',
+        value: null,
+        privacy: strict,
+      }),
+    ).toBeNull();
+    expect(
+      finalizeAttribute({
+        element: el(),
+        name: 'data-x',
+        value: 'plain',
+        privacy: strict,
+      }),
+    ).toBe('plain');
+  });
+});
+
+describe('attribute finalization through the serializer', () => {
+  /**
+   * A cross-origin `<iframe>` rrweb cannot see into has its `src` renamed to
+   * `rr_src` *before* finalization runs, so the renamed name has to carry the
+   * same policy weight as `src` -- otherwise userinfo and query tokens ride
+   * out of the recording verbatim.
+   */
+  function serializeOpaqueIframe(
+    src: string,
+    privacyPolicy: PrivacyPolicy,
+  ): string {
+    document.body.innerHTML = `<iframe src="${src}"></iframe>`;
+    // jsdom hands out a blank contentDocument for every iframe; a real
+    // cross-origin frame has none, which is what triggers the rr_src rename.
+    Object.defineProperty(
+      document.querySelector('iframe')!,
+      'contentDocument',
+      {
+        value: null,
+      },
+    );
+    return JSON.stringify(snapshot(document, { privacyPolicy }));
+  }
+
+  it('sanitizes the renamed rr_src of a cross-origin iframe under balanced', () => {
+    const out = serializeOpaqueIframe('https://u:p@x.com/?token=t', {
+      version: 1,
+      preset: 'balanced',
+    });
+    expect(out).toContain('"rr_src":"https://x.com/?token=*"');
+    expect(out).not.toContain('u:p@x.com');
+    expect(out).not.toContain('token=t');
+  });
+
+  it('drops the renamed rr_src of a cross-origin iframe under strict', () => {
+    const out = serializeOpaqueIframe('https://u:p@x.com/?token=t', {
+      version: 1,
+      preset: 'strict',
+    });
+    expect(out).toContain('"rr_src":null');
+    expect(out).not.toContain('x.com');
+  });
+});
+
+/**
+ * The `selected` flag on an `<option>` discloses the parent `<select>`'s
+ * value without that value ever passing through `maskInput`. The decision
+ * used to read `maskInputOptions['select']` alone, so a `balanced`/`strict`
+ * policy -- which masks every input value -- still recorded which option the
+ * user had chosen.
+ */
+describe('<option selected> follows the select value decision', () => {
+  const OPTIONS =
+    '<select><option value="a">A</option><option value="b" selected>B</option></select>';
+
+  it('balanced does not record which option is selected', () => {
+    const out = serialize(OPTIONS, { version: 1, preset: 'balanced' });
+    expect(out).not.toContain('"selected"');
+  });
+
+  it('strict does not record which option is selected', () => {
+    const out = serialize(OPTIONS, { version: 1, preset: 'strict' });
+    expect(out).not.toContain('"selected"');
+  });
+
+  /**
+   * Detectors force `maskAllInputs` whatever the preset, so the flag has to
+   * follow even on a `minimal` base.
+   */
+  it('an active detector suppresses it even under minimal', () => {
+    const out = serialize(OPTIONS, {
+      version: 1,
+      preset: 'minimal',
+      detectors: { email: true },
+    });
+    expect(out).not.toContain('"selected"');
+  });
+
+  it('minimal with no input masking still records it', () => {
+    const out = serialize(OPTIONS, { version: 1, preset: 'minimal' });
+    expect(out).toContain('"selected":true');
+  });
+
+  it('minimal honors maskInputOptions.select exactly as before', () => {
+    document.body.innerHTML = OPTIONS;
+    const out = JSON.stringify(
+      snapshot(document, { maskAllInputs: { select: true } }),
+    );
+    expect(out).not.toContain('"selected"');
+  });
+});
diff --git a/packages/rrweb-snapshot/test/privacy-perf.test.ts b/packages/rrweb-snapshot/test/privacy-perf.test.ts
new file mode 100644
index 0000000000..96a8cc77cb
--- /dev/null
+++ b/packages/rrweb-snapshot/test/privacy-perf.test.ts
@@ -0,0 +1,139 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import snapshot from '../src/snapshot';
+import { compilePrivacyPolicy } from '../src/privacy';
+
+/**
+ * Guards the "minimal is sacred" performance contract: a recorder that never
+ * opted into the v2 privacy policy must pay zero cost for it. If any of
+ * these selectors show up in an `Element.prototype.matches` call during a
+ * minimal snapshot, `compilePrivacyPolicy`/`mergeBlockSelectors`/
+ * `needMaskingText` have started doing privacy-selector work even when the
+ * caller never asked for it.
+ */
+const PRIVACY_SELECTOR_FRAGMENTS = [
+  'data-privacy',
+  'rr-mask',
+  'rr-unmask',
+  'rr-block',
+  'mp-mask',
+  'mp-block',
+  'fs-mask',
+  'fs-exclude',
+  'amp-mask',
+  'amp-block',
+  'ph-mask',
+  'ph-no-capture',
+  'sentry-mask',
+  'sentry-block',
+  'data-sentry-mask',
+  'dd-privacy',
+  'nr-mask',
+  'nr-block',
+];
+
+function buildDeepDom() {
+  document.body.innerHTML =
+    '<div>'.repeat(200) + 'deep text' + '</div>'.repeat(200);
+}
+
+function privacyAttributableCalls(spy: ReturnType<typeof vi.spyOn>) {
+  return spy.mock.calls.filter(
+    ([sel]) =>
+      typeof sel === 'string' &&
+      PRIVACY_SELECTOR_FRAGMENTS.some((fragment) => sel.includes(fragment)),
+  );
+}
+
+describe('privacy v2 perf smoke', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
+    vi.restoreAllMocks();
+  });
+
+  it('minimal snapshot performs no privacy selector matching', () => {
+    // Sanity-check the compiled shape a caller gets when it never opts into
+    // v2 privacy: every selector is null/empty, so nothing should ever
+    // reach `.matches()` with a privacy-attributable selector.
+    const compiled = compilePrivacyPolicy(undefined);
+    expect(compiled.preset).toBe('minimal');
+    expect(compiled.maskTextSelector).toBeNull();
+    expect(compiled.blockSelector).toBeNull();
+
+    const spy = vi.spyOn(Element.prototype, 'matches');
+    buildDeepDom();
+
+    // No `privacyPolicy` passed in the options object at all -- this is the
+    // shape every pre-v2 caller uses.
+    snapshot(document, {});
+
+    const privacyCalls = privacyAttributableCalls(spy);
+    expect(privacyCalls).toEqual([]);
+    spy.mockRestore();
+  });
+
+  it('snapshot with no privacy argument at all behaves identically (minimal sacred)', () => {
+    const spy = vi.spyOn(Element.prototype, 'matches');
+    buildDeepDom();
+
+    snapshot(document);
+
+    const privacyCalls = privacyAttributableCalls(spy);
+    expect(privacyCalls).toEqual([]);
+    spy.mockRestore();
+  });
+});
+
+/**
+ * Every non-minimal preset compiles a non-null `unmaskTextSelector` (strict
+ * and balanced both always include `[data-privacy="unmask"]` and
+ * `.rr-unmask`, rule-configured or not). That forces
+ * `serializeNodeWithId`'s `checkAncestors` branch permanently on, which
+ * re-walks ancestors with `Element.prototype.matches` for every single node
+ * instead of trusting the inherited masking decision -- O(nodes * depth) on
+ * a page that has no unmask target anywhere. `resolveUnmaskTextSelector`
+ * probes once per snapshot/flush and passes `null` downward when nothing
+ * matches, restoring the cheap short-circuit.
+ */
+describe('privacy v2 unmask-selector short-circuit perf', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
+    vi.restoreAllMocks();
+  });
+
+  function buildDeepWideDom(depth: number, leaves: number) {
+    document.body.innerHTML =
+      '<div>'.repeat(depth) +
+      '<p>leaf text</p>'.repeat(leaves) +
+      '</div>'.repeat(depth);
+  }
+
+  it('strict snapshot with no unmask target anywhere avoids per-node ancestor walks', () => {
+    buildDeepWideDom(40, 40);
+    const spy = vi.spyOn(Element.prototype, 'matches');
+
+    snapshot(document, { privacyPolicy: { version: 1, preset: 'strict' } });
+
+    // Without the short-circuit this scales with leaves * depth (thousands
+    // of calls for 40x40); with it, the one-time presence probe means the
+    // per-node walk never engages, so the call count stays close to a
+    // single linear pass over the tree. A loose bound catches a regression
+    // to the old O(nodes * depth) behavior without pinning an exact count.
+    expect(spy.mock.calls.length).toBeLessThan(200);
+    spy.mockRestore();
+  });
+
+  it('strict snapshot still finds and honors an .rr-unmask target when one exists', () => {
+    document.body.innerHTML =
+      '<div class="rr-unmask"><p>visible</p></div><p>hidden</p>';
+
+    const out = JSON.stringify(
+      snapshot(document, { privacyPolicy: { version: 1, preset: 'strict' } }),
+    );
+
+    expect(out).toContain('visible');
+    expect(out).not.toContain('hidden');
+  });
+});
diff --git a/packages/rrweb-snapshot/test/privacy.test.ts b/packages/rrweb-snapshot/test/privacy.test.ts
index 3498873c92..f741be3dc8 100644
--- a/packages/rrweb-snapshot/test/privacy.test.ts
+++ b/packages/rrweb-snapshot/test/privacy.test.ts
@@ -1,709 +1,1614 @@
 /**
  * @vitest-environment jsdom
  */
-import { beforeEach, describe, expect, it } from 'vitest';
-import snapshot from '../src/snapshot';
+import { describe, it, expect, vi, afterEach } from 'vitest';
 import {
-  applyPrivacyDetectors,
   compilePrivacyPolicy,
-  detectSensitiveText,
-  getPrivacyAction,
-  maskInputWithPrivacy,
-  maskTextWithPrivacy,
-  passesLuhn,
+  validateSelector,
+  mergeSelectors,
+  resolvePrivacyContext,
+  detectSensitiveValue,
+  buildDetectors,
   sanitizeUrl,
+  sanitizeMetaUrl,
+  splitSelectorList,
+  resolveTextValue,
+  resolveUnmaskTextSelector,
+  isEventIgnored,
+  VENDOR_COMPAT,
 } from '../src/privacy';
+import snapshot, {
+  _isBlockedElement,
+  needMaskingText,
+  splitMaskAllSelector,
+} from '../src/snapshot';
 
-const balanced = () =>
-  compilePrivacyPolicy(
-    applyPrivacyDetectors({ version: 1, preset: 'balanced' }),
-  )!;
-
-describe('privacy policy', () => {
-  beforeEach(() => {
-    document.documentElement.innerHTML = '<head></head><body></body>';
+describe('block decisions fail closed', () => {
+  it('blocks the element and warns once when the block selector throws while matching', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const el = document.createElement('div');
+    const matches = vi.spyOn(el, 'matches').mockImplementation(() => {
+      throw new Error('boom');
+    });
+    expect(_isBlockedElement(el, 'rr-block', '.x')).toBe(true);
+    expect(_isBlockedElement(el, 'rr-block', '.x')).toBe(true);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(warn.mock.calls[0][0]).toContain('block');
+    matches.mockRestore();
+    warn.mockRestore();
   });
 
-  it('detects cards with Luhn instead of masking every long number', () => {
-    const privacy = balanced();
-    const value = 'valid 4111 1111 1111 1111 invalid 4111 1111 1111 1112';
-    const matches = detectSensitiveText(value, privacy);
-
-    expect(passesLuhn('4111 1111 1111 1111')).toBe(true);
-    expect(passesLuhn('4111 1111 1111 1112')).toBe(false);
-    expect(
-      matches.filter((match) => match.detector === 'payment-card'),
-    ).toEqual([
-      expect.objectContaining({
-        start: value.indexOf('4111 1111 1111 1111'),
-        end: value.indexOf('4111 1111 1111 1111') + 19,
-      }),
-    ]);
+  it('does not block when nothing matches and nothing throws', () => {
+    const el = document.createElement('div');
+    expect(_isBlockedElement(el, 'rr-block', '.x')).toBe(false);
   });
+});
 
-  it('masks only detected ranges in balanced text', () => {
-    const element = document.createElement('p');
-    expect(
-      maskTextWithPrivacy(
-        'Contact person@example.com about order 12345',
-        element,
-        balanced(),
-        false,
-      ),
-    ).toBe('Contact xxxxxx@xxxxxxx.xxx about order 12345');
+describe('compilePrivacyPolicy v2', () => {
+  it('minimal preset compiles to inert options', () => {
+    const c = compilePrivacyPolicy(undefined);
+    expect(c.preset).toBe('minimal');
+    expect(c.maskTextSelector).toBeNull();
+    expect(c.blockSelector).toBeNull();
+    expect(c.maskAllInputs).toBe(false);
+    expect([...c.maskedAttributes]).toEqual([]);
+    expect(c.sanitizeUrls).toBe(false);
+    expect(c.detectors).toEqual([]);
+    expect(c.attributePolicyInert).toBe(true);
   });
-
-  it('does not enable heuristic detectors from the balanced preset alone', () => {
-    const element = document.createElement('p');
-    const privacy = compilePrivacyPolicy({
+  it('any active detector forces maskAllInputs, even on a minimal base', () => {
+    const c = compilePrivacyPolicy({
       version: 1,
-      preset: 'balanced',
+      preset: 'minimal',
+      detectors: { email: true },
     });
-    expect(
-      maskTextWithPrivacy(
-        'Contact person@example.com about order 12345',
-        element,
-        privacy,
-        false,
-      ),
-    ).toBe('Contact person@example.com about order 12345');
-    expect(privacy.detectors).toEqual([]);
+    expect(c.preset).toBe('minimal');
+    expect(c.maskAllInputs).toBe(true);
+    // ...and nothing else about the minimal preset moves.
+    expect(c.maskTextSelector).toBeNull();
+    expect([...c.maskedAttributes]).toEqual([]);
+    expect(c.sanitizeUrls).toBe(false);
   });
-
-  it('lets applyPrivacyDetectors opt into heuristic matching', () => {
-    expect(
-      applyPrivacyDetectors(
-        {
-          version: 1,
-          preset: 'balanced',
-          detectors: { email: false },
-        },
-        { email: true },
-      ).detectors,
-    ).toMatchObject({
-      email: false,
-      phone: true,
-      paymentCard: true,
-    });
-  });
-
-  it('runs configured detectors in custom policies', () => {
-    const element = document.createElement('p');
-    const privacy = compilePrivacyPolicy({
+  it('a detectors block with every flag off leaves the preset alone', () => {
+    const c = compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
+      preset: 'minimal',
       detectors: {
-        custom: [{ name: 'account-id', pattern: 'acct_[0-9]+' }],
+        email: false,
+        phone: false,
+        paymentCard: false,
+        ssn: false,
+        ipAddress: false,
       },
     });
-
-    expect(
-      maskTextWithPrivacy(
-        'Account acct_12345 is active',
-        element,
-        privacy,
-        false,
-      ),
-    ).toBe('Account xxxx_00000 is active');
+    expect(c.detectors).toEqual([]);
+    expect(c.maskAllInputs).toBe(false);
   });
-
-  it('rejects unsafe or unbounded custom detector configurations', () => {
-    const policyWith = (pattern: string, flags?: string) => () =>
-      compilePrivacyPolicy({
-        version: 1,
-        preset: 'custom',
-        detectors: {
-          custom: [{ name: 'unsafe', pattern, flags }],
-        },
-      });
-
-    expect(policyWith('(a+)+$')).toThrow('ambiguous nested repetition');
-    expect(policyWith('(a|aa)+$')).toThrow('ambiguous nested repetition');
-    expect(policyWith('(a+){1,20}')).toThrow('ambiguous nested repetition');
-    expect(policyWith('(a{1,10})+')).toThrow('ambiguous nested repetition');
-    expect(policyWith('(?:a+)+')).toThrow('ambiguous nested repetition');
-    expect(policyWith('(a)\\1')).toThrow('backreferences');
-    expect(policyWith('(?<x>a)\\k<x>')).toThrow('backreferences');
-    expect(policyWith('(?=secret)')).toThrow('lookaround');
-    expect(policyWith('(?!secret)')).toThrow('lookaround');
-    expect(policyWith('a*')).toThrow('cannot match empty text');
-    expect(policyWith('account', 'y')).toThrow('unsupported regex flags');
-    expect(policyWith('a'.repeat(257))).toThrow('must be 1-256 characters');
-    expect(policyWith('a?'.repeat(13))).toThrow('too many quantifiers');
-    expect(() =>
-      compilePrivacyPolicy({
-        version: 1,
-        preset: 'custom',
-        detectors: {
-          custom: [
+  it('balanced masks inputs, attributes and URLs but not text', () => {
+    const c = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+    expect(c.maskAllInputs).toBe(true);
+    expect([...c.maskedAttributes]).toEqual([
+      'title',
+      'placeholder',
+      'aria-label',
+    ]);
+    expect(c.sanitizeUrls).toBe(true);
+    expect(c.maskTextSelector).not.toContain('*');
+    expect(c.maskTextSelector).toContain('[data-privacy]');
+    expect(c.maskTextSelector).toContain('.rr-mask');
+    expect(c.blockSelector).toContain('[data-privacy="block"]');
+    expect(c.blockSelector).toContain('.rr-block');
+    expect(c.attributePolicyInert).toBe(false);
+  });
+  it('strict masks all text and blocks media', () => {
+    const c = compilePrivacyPolicy({ version: 1, preset: 'strict' });
+    expect(c.maskTextSelector).toBe('*');
+    expect(c.blockMedia).toBe(true);
+  });
+  it('compiles rules into selector lists', () => {
+    const c = compilePrivacyPolicy({
+      version: 1,
+      preset: 'balanced',
+      rules: [
+        { target: { type: 'selector', selector: '.pii' }, action: 'mask' },
+        { target: { type: 'selector', selector: '.safe' }, action: 'unmask' },
+        { target: { type: 'selector', selector: '.gone' }, action: 'block' },
+      ],
+    });
+    expect(c.maskTextSelector).toContain('.pii');
+    expect(c.unmaskTextSelector).toContain('.safe');
+    expect(c.blockSelector).toContain('.gone');
+  });
+  it('rejects a pre-v2 action name outright', () => {
+    for (const action of ['allow', 'exclude']) {
+      expect(() =>
+        compilePrivacyPolicy({
+          version: 1,
+          preset: 'balanced',
+          rules: [
             {
-              name: 'too-wide',
-              pattern: 'account_[0-9]+',
-              maximumMatchLength: 1_025,
+              target: { type: 'selector', selector: '.x' },
+              action: action as never,
             },
           ],
+        }),
+      ).toThrow(/Unsupported privacy action/);
+    }
+  });
+  it('drops invalid selectors individually with a warning, keeps the rest', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const c = compilePrivacyPolicy({
+      version: 1,
+      preset: 'balanced',
+      rules: [
+        {
+          target: { type: 'selector', selector: ':::garbage' },
+          action: 'block',
         },
-      }),
-    ).toThrow('maximumMatchLength');
+        { target: { type: 'selector', selector: '.valid' }, action: 'block' },
+      ],
+    });
+    expect(c.blockSelector).toContain('.valid');
+    expect(c.blockSelector).not.toContain(':::garbage');
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining(':::garbage'));
+    warn.mockRestore();
+  });
+  it('throws on bad version/preset/empty selector', () => {
     expect(() =>
-      compilePrivacyPolicy({
-        version: 1,
-        preset: 'custom',
-        detectors: {
-          custom: [
-            {
-              name: 'inverted',
-              pattern: 'account_[0-9]+',
-              minimumLength: 32,
-              maximumMatchLength: 8,
-            },
-          ],
-        },
-      }),
-    ).toThrow('minimumLength cannot exceed maximumMatchLength');
-
+      compilePrivacyPolicy({ version: 2 as never, preset: 'minimal' }),
+    ).toThrow();
+    expect(() =>
+      compilePrivacyPolicy({ version: 1, preset: 'custom' as never }),
+    ).toThrow();
     expect(() =>
       compilePrivacyPolicy({
         version: 1,
-        preset: 'custom',
-        detectors: {
-          custom: [
-            { name: 'account-id', pattern: 'acct_[0-9]+' },
-            { name: 'optional-colour', pattern: 'colou?r' },
-            { name: 'grouped', pattern: '(?:acct_)[0-9]{4,12}' },
-            { name: 'repeated-atom', pattern: '(foo)+' },
-          ],
-        },
+        preset: 'balanced',
+        rules: [{ target: { type: 'selector', selector: '' }, action: 'mask' }],
       }),
-    ).not.toThrow();
+    ).toThrow();
   });
-
-  it('uses detector length fast paths and finds matches across scan chunks', () => {
-    const custom = compilePrivacyPolicy({
+  it('precomputes lowercased query parameter sets', () => {
+    const c = compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
-      detectors: {
-        custom: [
-          {
-            name: 'account-id',
-            pattern: 'acct_[0-9]+',
-            minimumLength: 12,
-            maximumMatchLength: 32,
-          },
-        ],
-      },
+      preset: 'strict',
+      url: { blockedQueryParameters: ['SessionID'] },
     });
-    expect(detectSensitiveText('acct_1', custom)).toEqual([]);
-    const customBoundaryValue = `${'x'.repeat(508)}acct_12345`;
-    expect(detectSensitiveText(customBoundaryValue, custom)).toEqual([
-      expect.objectContaining({ start: 508, end: customBoundaryValue.length }),
-    ]);
+    expect(c.blockedQueryParameters.has('sessionid')).toBe(true);
+    expect(c.blockedQueryParameters.has('token')).toBe(true); // default list
+  });
+});
+/**
+ * `data-privacy` carries a fixed vocabulary. A value outside it is almost
+ * always a typo or a value from a future version, and in both cases the author
+ * was reaching for protection -- so an unrecognized value masks rather than
+ * making no decision. The compiled mask token is the bare attribute minus the
+ * two values that mean something else, which is what makes this work without
+ * any precedence logic: `[data-privacy="unmask"]` and `[data-privacy="block"]`
+ * are excluded from the mask list by construction, and everything else in the
+ * attribute's value space falls into it.
+ */
+describe('an unrecognized data-privacy value fails closed to mask', () => {
+  const balanced = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
 
-    const value = `${'x'.repeat(8_187)}4111 1111 1111 1111`;
+  function matchesMask(html: string): boolean {
+    document.body.innerHTML = html;
+    const el = document.querySelector('#t') as HTMLElement;
+    return el.matches(balanced.maskTextSelector as string);
+  }
+
+  afterEach(() => {
+    document.body.innerHTML = '';
+  });
+
+  it.each([
+    ['a typo', 'masked'],
+    ['the empty value', ''],
+    ['a value from another vocabulary', 'exclude'],
+    ['the reserved input-only value', 'mask-inputs'],
+    ['a wrong-case spelling', 'Mask'],
+  ])('%s masks', (_name, value) => {
+    expect(matchesMask(`<div id="t" data-privacy="${value}"></div>`)).toBe(
+      true,
+    );
+  });
+
+  it('leaves the two recognized non-mask values out of the mask list', () => {
+    expect(matchesMask('<div id="t" data-privacy="unmask"></div>')).toBe(false);
+    expect(matchesMask('<div id="t" data-privacy="block"></div>')).toBe(false);
+    // ...and they still reach their own lists
+    document.body.innerHTML =
+      '<div id="u" data-privacy="unmask"></div>' +
+      '<div id="b" data-privacy="block"></div>';
     expect(
-      detectSensitiveText(value, balanced()).some(
-        (match) => match.detector === 'payment-card' && match.start === 8_187,
+      (document.querySelector('#u') as HTMLElement).matches(
+        balanced.unmaskTextSelector as string,
+      ),
+    ).toBe(true);
+    expect(
+      (document.querySelector('#b') as HTMLElement).matches(
+        balanced.blockSelector as string,
       ),
     ).toBe(true);
   });
 
-  it('fails closed when a value produces too many detector matches', () => {
-    const privacy = compilePrivacyPolicy({
+  it('recognizes data-privacy="mask" itself', () => {
+    expect(matchesMask('<div id="t" data-privacy="mask"></div>')).toBe(true);
+  });
+
+  it('does not fire on an element with no data-privacy attribute at all', () => {
+    expect(matchesMask('<div id="t"></div>')).toBe(false);
+  });
+
+  /**
+   * `data-privacy` is a managed-preset feature, full stop. It used to switch
+   * itself on under `minimal` as soon as a same-action rule existed -- and
+   * only for `mask`/`block`, never `unmask` -- so whether the attribute did
+   * anything depended on an unrelated rule. Under `minimal` the rules now
+   * compile to their bare selectors and nothing else.
+   */
+  it('is entirely off under minimal, with or without rules', () => {
+    const bare = compilePrivacyPolicy({ version: 1, preset: 'minimal' });
+    expect(bare.maskTextSelector).toBeNull();
+    expect(bare.blockSelector).toBeNull();
+    expect(bare.unmaskTextSelector).toBeNull();
+
+    const withRules = compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
-      detectors: {
-        custom: [
-          {
-            name: 'digit',
-            pattern: '[0-9]',
-            maximumMatchLength: 1,
-          },
-        ],
-      },
+      preset: 'minimal',
+      rules: [
+        { target: { type: 'selector', selector: '.x' }, action: 'mask' },
+        { target: { type: 'selector', selector: '.y' }, action: 'block' },
+        { target: { type: 'selector', selector: '.z' }, action: 'unmask' },
+      ],
     });
-    const value = '1'.repeat(1_500);
-    expect(detectSensitiveText(value, privacy)).toEqual([
-      expect.objectContaining({ start: 0, end: value.length }),
-    ]);
+    expect(withRules.maskTextSelector).toBe('.x');
+    expect(withRules.blockSelector).toBe('.y');
+    expect(withRules.unmaskTextSelector).toBe('.z');
 
-    const oversize = compilePrivacyPolicy({
+    document.body.innerHTML =
+      '<div id="m" data-privacy="mask"></div>' +
+      '<div id="t" data-privacy="typo"></div>' +
+      '<div id="b" data-privacy="block"></div>' +
+      '<div id="u" data-privacy="unmask"></div>';
+    const matches = (id: string, selector: string | null) =>
+      (document.querySelector(`#${id}`) as HTMLElement).matches(
+        selector as string,
+      );
+    expect(matches('m', withRules.maskTextSelector)).toBe(false);
+    expect(matches('t', withRules.maskTextSelector)).toBe(false);
+    expect(matches('b', withRules.blockSelector)).toBe(false);
+    expect(matches('u', withRules.unmaskTextSelector)).toBe(false);
+  });
+
+  it('does not merge the native rr-* classes into a minimal policy either', () => {
+    const withRules = compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
-      detectors: {
-        custom: [
-          {
-            name: 'bounded-digits',
-            pattern: '[0-9]+',
-            maximumMatchLength: 4,
-          },
-        ],
-      },
+      preset: 'minimal',
+      rules: [
+        { target: { type: 'selector', selector: '.x' }, action: 'mask' },
+        { target: { type: 'selector', selector: '.y' }, action: 'block' },
+      ],
     });
-    const oversizeValue = 'public 12345 trailing text';
-    expect(detectSensitiveText(oversizeValue, oversize)).toEqual([
-      expect.objectContaining({ start: 0, end: oversizeValue.length }),
-    ]);
+    // `.rr-mask`/`.rr-block` reach a `minimal` recording through the separate
+    // `maskTextClass`/`blockClass` options, not through the compiled policy.
+    expect(withRules.maskTextSelector).not.toContain('.rr-mask');
+    expect(withRules.blockSelector).not.toContain('.rr-block');
   });
+});
 
-  it('masks style text under policy while keeping script placeholders', () => {
-    const style = document.createElement('style');
-    const script = document.createElement('script');
-    expect(
-      maskTextWithPrivacy(
-        '.person@example.com { color: red }',
-        style,
-        balanced(),
-        false,
-      ),
-    ).toBe('.xxxxxx@xxxxxxx.xxx { color: red }');
+/**
+ * `data-privacy="ignore"` is `mask` plus event silence: content masks through
+ * the fail-closed mask token (no dedicated mask entry), and the compiled
+ * `ignoreSelector` lets the record side suppress the subtree's input events.
+ * Severity ladder: unmask < mask < ignore < block, nearest annotation wins.
+ */
+describe('data-privacy="ignore"', () => {
+  const balanced = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+
+  afterEach(() => {
+    document.body.innerHTML = '';
+  });
+
+  it('content is masked by the compiled policy, exactly as mask is', () => {
+    document.body.innerHTML =
+      '<div id="i" data-privacy="ignore"></div>' +
+      '<div id="m" data-privacy="mask"></div>';
+    const mask = balanced.maskTextSelector as string;
+    expect((document.querySelector('#i') as HTMLElement).matches(mask)).toBe(
+      true,
+    );
+    expect((document.querySelector('#m') as HTMLElement).matches(mask)).toBe(
+      true,
+    );
+  });
+
+  it('compiles an ignoreSelector under managed presets, none under minimal', () => {
+    expect(balanced.ignoreSelector).toBe('[data-privacy="ignore"]');
     expect(
-      maskTextWithPrivacy(
-        '.person@example.com { color: red }',
-        style,
-        compilePrivacyPolicy({ version: 1, preset: 'strict' }),
-        false,
-      ),
-    ).toBe('.xxxxxx@xxxxxxx.xxx { xxxxx: xxx }');
+      compilePrivacyPolicy({ version: 1, preset: 'strict' }).ignoreSelector,
+    ).toBe('[data-privacy="ignore"]');
     expect(
-      maskTextWithPrivacy(
-        'window.secret = "person@example.com"',
-        script,
-        balanced(),
-        false,
-      ),
-    ).toBe('SCRIPT_PLACEHOLDER');
+      compilePrivacyPolicy({ version: 1, preset: 'minimal' }).ignoreSelector,
+    ).toBeNull();
   });
 
-  it('detects emails with more than four domain labels', () => {
-    const value = 'Contact first.last@sub.mail.company.co.uk today';
+  it('isEventIgnored: the nearest data-privacy annotation decides', () => {
+    document.body.innerHTML =
+      '<div data-privacy="ignore"><input id="in-ignore">' +
+      '<div data-privacy="unmask"><input id="in-unmask"></div>' +
+      '<div data-privacy="mask"><input id="in-mask"></div></div>' +
+      '<input id="outside">';
+    const el = (id: string) => document.querySelector(`#${id}`) as HTMLElement;
+    expect(isEventIgnored(el('in-ignore'), balanced)).toBe(true);
+    expect(isEventIgnored(el('in-unmask'), balanced)).toBe(false);
+    expect(isEventIgnored(el('in-mask'), balanced)).toBe(false);
+    expect(isEventIgnored(el('outside'), balanced)).toBe(false);
+  });
+
+  it('isEventIgnored is inert under minimal, where data-privacy is off', () => {
+    document.body.innerHTML = '<div data-privacy="ignore"><input id="t"></div>';
+    const minimal = compilePrivacyPolicy({ version: 1, preset: 'minimal' });
     expect(
-      detectSensitiveText(value, balanced()).some(
-        (match) =>
-          match.detector === 'email' &&
-          value.slice(match.start, match.end) ===
-            'first.last@sub.mail.company.co.uk',
-      ),
-    ).toBe(true);
+      isEventIgnored(document.querySelector('#t') as HTMLElement, minimal),
+    ).toBe(false);
+    expect(
+      isEventIgnored(document.querySelector('#t') as HTMLElement, undefined),
+    ).toBe(false);
+  });
+});
+
+/**
+ * Recognizing another tool's classes changes what rrweb records based on
+ * markup the embedder may not control, so it is an explicit opt-in rather
+ * than a managed-preset default.
+ */
+describe('vendorCompat', () => {
+  const off = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+  const on = compilePrivacyPolicy({
+    version: 1,
+    preset: 'balanced',
+    vendorCompat: true,
   });
 
-  it('uses nearest explicit rules and safer action for ties', () => {
-    document.body.innerHTML = `
-      <main class="allow mask">
-        <section class="allow"><span id="target">secret</span></section>
-      </main>`;
-    const target = document.querySelector('#target')!;
-    const privacy = compilePrivacyPolicy({
+  it('is off by default: only rrweb-native conventions are merged', () => {
+    expect(off.maskTextSelector).toContain('.rr-mask');
+    expect(off.blockSelector).toContain('.rr-block');
+    expect(off.unmaskTextSelector).toContain('.rr-unmask');
+    for (const foreign of [
+      '.ph-mask',
+      '.mp-mask',
+      '.fs-mask',
+      '.amp-mask',
+      '.sentry-mask',
+      '[data-sentry-mask]',
+      '.dd-privacy-mask',
+      '[data-nr-mask]',
+    ])
+      expect(off.maskTextSelector).not.toContain(foreign);
+    for (const foreign of [
+      '.ph-no-capture',
+      '.mp-block',
+      '.fs-exclude',
+      '.amp-block',
+      '.sentry-block',
+      '.dd-privacy-hidden',
+      '[data-nr-block]',
+    ])
+      expect(off.blockSelector).not.toContain(foreign);
+  });
+
+  it('merges the foreign mask and block tokens when enabled', () => {
+    expect(on.maskTextSelector).toContain('.ph-mask');
+    expect(on.maskTextSelector).toContain('.dd-privacy-mask'); // Datadog
+    expect(on.maskTextSelector).toContain('[data-nr-mask]'); // New Relic
+    expect(on.maskTextSelector).toContain('.sentry-mask');
+    expect(on.blockSelector).toContain('.dd-privacy-hidden'); // Datadog
+    expect(on.blockSelector).toContain('[data-nr-block]'); // New Relic
+    expect(on.blockSelector).toContain('.sentry-block');
+    // native tokens are still there alongside them
+    expect(on.maskTextSelector).toContain('.rr-mask');
+    expect(on.blockSelector).toContain('.rr-block');
+  });
+
+  it("recognizes both of Sentry's block spellings, class and attribute", () => {
+    // Sentry ships `.sentry-block` and `[data-sentry-block]` as defaults
+    // (getPrivacyOptions.ts); recognizing the class alone left the attribute
+    // form unprotected under vendorCompat.
+    expect(on.blockSelector).toContain('.sentry-block');
+    expect(on.blockSelector).toContain('[data-sentry-block]');
+  });
+
+  it("recognizes FullStory's consent-gated variants as plain mask/exclude", () => {
+    // "without consent" means masked/excluded until FullStory's own consent
+    // API reveals them; rrweb has no such API, so they are always honored.
+    expect(on.maskTextSelector).toContain('.fs-mask-without-consent');
+    expect(on.blockSelector).toContain('.fs-exclude-without-consent');
+  });
+
+  /**
+   * The extended vendor set. Every token here was verified against the
+   * vendor's official documentation or open-source SDK (see guide.md's
+   * "Vendor class recognition" table). Mapping rule: a token whose vendor
+   * semantics hide only text joins the mask list; one that removes or
+   * placeholders the element's whole content (images, children) joins the
+   * block list, the more protective of the two.
+   */
+  const extendedMask = [
+    '.highlight-mask', // Highlight / LaunchDarkly
+    '[data-clarity-mask]', // Microsoft Clarity
+    '[data-sl="mask"]', // Smartlook
+    '[data-openreplay-obscured]', // OpenReplay
+    '[data-openreplay-masked]', // OpenReplay (deprecated alias, still honored)
+    '[data-cs-encrypt]', // Contentsquare (encrypted capture; masked here)
+    '[data-mf-replace-inner]', // Mouseflow (inner text replaced, structure kept)
+    '.inspectlet-sensitive', // Inspectlet
+    '.inspectletIgnore', // Inspectlet
+    '[data-dtrum-mask]', // Dynatrace
+    '[data-qm-encrypt]', // Quantum Metric (encrypted capture there; masked here)
+    '.cls_mask', // Glassbox (observed-only; docs are customer-gated)
+    '.sessionstack-sensitive', // SessionStack
+    '[data-recording-sensitive]', // Smartlook legacy (masked there; also events-ignored)
+  ];
+  const extendedBlock = [
+    '.highlight-block', // Highlight / LaunchDarkly
+    '[data-private]', // LogRocket (any value)
+    '._lr-hide', // LogRocket (legacy)
+    '[data-hj-suppress]', // Hotjar (attribute form; images placeholdered there)
+    '.data-hj-suppress', // Hotjar (class form, also documented)
+    '[data-sl="exclude"]', // Smartlook
+    '[data-openreplay-hidden]', // OpenReplay
+    '[data-openreplay-htmlmasked]', // OpenReplay (deprecated alias)
+    '[data-cs-mask]', // Contentsquare (content removed from collection)
+    '[data-heap-redact-text]', // Heap (whole element redacted in their replay)
+    '[data-heap-redact-attributes]', // Heap (whole element redacted in their replay)
+    '.mf-masked', // Mouseflow ("not recorded at all" there)
+    '[data-mf-replace]', // Mouseflow (subtree swapped for placeholder value)
+    '.mf-excluded', // Mouseflow
+    '.lo-sensitive', // Lucky Orange (text scrambled, images blanked)
+    '.losensitive', // Lucky Orange (alias)
+    '.userback-block', // Userback
+    '.zipy-block', // Zipy
+    '[data-qm-block]', // Quantum Metric (customer-config convention)
+    '[data-qm-freeze-exclude]', // Quantum Metric (DOM-capture exclude)
+    '[data-recording-disable]', // Smartlook legacy
+    '[data-sr-redact]', // Session Rewind ("exclude"; rendering unspecified there)
+  ];
+  // Reveal tokens are never merged anywhere; ignore-like tokens listed here
+  // are the ones with no verified events-only semantics, so they stay
+  // unmerged too. (`.highlight-ignore` moved to ignoreEvents once its
+  // events-only behavior was verified from the highlight-run source.)
+  const foreignRevealOrIgnore = [
+    '[data-hl-record]',
+    '[data-public]',
+    '[data-hj-allow]',
+    '.data-hj-allow',
+    '[data-clarity-unmask]',
+    '[data-sl="unmask"]',
+    '[data-openreplay-unmask]',
+    '[data-cs-capture]',
+    '.lo-not-sensitive',
+    '.lonotsensitive',
+    '[data-dtrum-allow]',
+    '.mf-listen',
+    '[data-qm-allow]',
+    '[data-recording-ignore]',
+    '.smartlook-hide',
+    '.smartlook-show',
+    '.heap-ignore', // documented only as the attribute; the class has no evidence
+  ];
+
+  it('recognizes the extended vendor set as mask or block', () => {
+    for (const token of extendedMask)
+      expect(on.maskTextSelector).toContain(token);
+    for (const token of extendedBlock)
+      expect(on.blockSelector).toContain(token);
+  });
+
+  it('never merges a foreign reveal token, on either setting', () => {
+    for (const token of foreignRevealOrIgnore) {
+      for (const list of [
+        on.maskTextSelector,
+        on.blockSelector,
+        on.unmaskTextSelector,
+        on.ignoreEventsSelector,
+        off.maskTextSelector,
+        off.blockSelector,
+        off.unmaskTextSelector,
+        off.ignoreEventsSelector,
+      ])
+        expect(list ?? '').not.toContain(token);
+    }
+  });
+
+  /**
+   * A vendor ignore token is events-only there, so it compiles into the
+   * events-only `ignoreEventsSelector` and never into mask, block, or
+   * unmask — an element carrying one keeps its recorded content.
+   */
+  describe('ignoreEvents tokens', () => {
+    const ignoreTokens = [
+      '.sentry-ignore',
+      '[data-sentry-ignore]',
+      '.ph-ignore-input',
+      '.nr-ignore',
+      '.highlight-ignore',
+      '[heap-ignore]', // autocapture-event suppression only there
+      '.userback-ignore', // element rendered, its user input ignored there
+      '[data-recording-sensitive]', // Smartlook legacy: masked AND events-ignored
+    ];
+    // Every ignore token except Smartlook's legacy dual-slot one, which is
+    // deliberately in the mask list too (it masked text there as well).
+    const eventsOnlyTokens = ignoreTokens.filter(
+      (token) => token !== '[data-recording-sensitive]',
+    );
+
+    it('compiles the vendor ignore tokens into ignoreEventsSelector', () => {
+      for (const token of ignoreTokens)
+        expect(on.ignoreEventsSelector).toContain(token);
+      expect(off.ignoreEventsSelector).toBeNull();
+      expect(
+        compilePrivacyPolicy({
+          version: 1,
+          preset: 'minimal',
+          vendorCompat: true,
+        }).ignoreEventsSelector,
+      ).toBeNull();
+    });
+
+    it('never leaks an events-only token into mask, block, or unmask', () => {
+      for (const token of eventsOnlyTokens) {
+        expect(on.maskTextSelector ?? '').not.toContain(token);
+        expect(on.blockSelector ?? '').not.toContain(token);
+        expect(on.unmaskTextSelector ?? '').not.toContain(token);
+      }
+      // The dual-slot exception is mask + ignore, never unmask or block.
+      expect(on.maskTextSelector).toContain('[data-recording-sensitive]');
+      expect(on.unmaskTextSelector ?? '').not.toContain(
+        '[data-recording-sensitive]',
+      );
+    });
+
+    it('an array compiles only the named vendors ignore tokens', () => {
+      const sentryOnly = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['sentry'],
+      });
+      expect(sentryOnly.ignoreEventsSelector).toContain('.sentry-ignore');
+      expect(sentryOnly.ignoreEventsSelector).toContain('[data-sentry-ignore]');
+      expect(sentryOnly.ignoreEventsSelector ?? '').not.toContain(
+        '.ph-ignore-input',
+      );
+      const posthogOnly = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['posthog'],
+      });
+      expect(posthogOnly.ignoreEventsSelector).toBe('.ph-ignore-input');
+      const datadogOnly = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['datadog'],
+      });
+      // Datadog has no customer-facing ignore token (its IGNORE level is
+      // internal to the SDK); nothing compiles here.
+      expect(datadogOnly.ignoreEventsSelector).toBeNull();
+    });
+
+    it('isEventIgnored: matches on the annotated element itself, not ancestors', () => {
+      document.body.innerHTML =
+        '<input id="self" class="sentry-ignore">' +
+        '<div class="sentry-ignore"><input id="nested"></div>';
+      const sentry = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['sentry'],
+      });
+      const el = (id: string) =>
+        document.querySelector(`#${id}`) as HTMLElement;
+      // Element-matched, mirroring the vendors' own input observers, which
+      // test the event target only.
+      expect(isEventIgnored(el('self'), sentry)).toBe(true);
+      expect(isEventIgnored(el('nested'), sentry)).toBe(false);
+      // Another vendor's compat does not honor the token.
+      const posthog = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['posthog'],
+      });
+      expect(isEventIgnored(el('self'), posthog)).toBe(false);
+    });
+
+    it('suppresses events only: an ignore-annotated element is not masked', () => {
+      document.body.innerHTML = '<p id="t" class="sentry-ignore">text</p>';
+      const sentry = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['sentry'],
+      });
+      const el = document.querySelector('#t') as HTMLElement;
+      expect(isEventIgnored(el, sentry)).toBe(true);
+      expect(el.matches(sentry.maskTextSelector as string)).toBe(false);
+      expect(el.matches(sentry.blockSelector as string)).toBe(false);
+    });
+
+    it('a throwing matches() fails closed to suppression', () => {
+      const sentry = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['sentry'],
+      });
+      const el = document.createElement('input');
+      vi.spyOn(el, 'matches').mockImplementation(() => {
+        throw new Error('boom');
+      });
+      expect(isEventIgnored(el, sentry)).toBe(true);
+    });
+  });
+
+  /**
+   * The registry-wide monotonicity invariant, pinned statically: no vendor
+   * entry — mask, block, or ignoreEvents — may carry a selector that could
+   * reveal content. Checked both against the vendors' known allow/unmask
+   * vocabularies and against the generic substrings those vocabularies use,
+   * so a future entry that smuggles one in fails here regardless of vendor.
+   */
+  it('no registry entry carries an allow/unmask-like selector, in any slot', () => {
+    const revealSubstrings = ['unmask', 'unblock', 'allow'];
+    const knownRevealTokens = [
+      '[data-hl-record]',
+      '[data-public]',
+      '[data-hj-allow]',
+      '.data-hj-allow',
+      '[data-clarity-unmask]',
+      '[data-sl="unmask"]',
+      '[data-openreplay-unmask]',
+      '[data-cs-capture]',
+      '.lo-not-sensitive',
+      '.lonotsensitive',
+      '.smartlook-show',
+      '.mf-listen',
+      '.ph-include',
+    ];
+    for (const [vendor, entry] of Object.entries(VENDOR_COMPAT)) {
+      const selectors = [
+        ...entry.mask,
+        ...entry.block,
+        ...(entry.ignoreEvents ?? []),
+      ];
+      for (const selector of selectors) {
+        const lower = selector.toLowerCase();
+        for (const substring of revealSubstrings)
+          expect(
+            lower.includes(substring),
+            `${vendor}: ${selector} looks like a reveal token`,
+          ).toBe(false);
+        expect(
+          knownRevealTokens.includes(selector),
+          `${vendor}: ${selector} is a known reveal token`,
+        ).toBe(false);
+      }
+    }
+  });
+
+  it('every compat token is a valid selector and survives the merge', () => {
+    // A typo in the list would be dropped with a warning at compile time
+    // and silently protect nothing; this pins the whole list as valid.
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
-      rules: [
-        {
-          target: { type: 'selector', selector: '.allow' },
-          action: 'allow',
-        },
-        {
-          target: { type: 'selector', selector: '.mask' },
-          action: 'mask',
-        },
-      ],
+      preset: 'balanced',
+      vendorCompat: true,
     });
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+    for (const token of [...extendedMask, ...extendedBlock])
+      expect(validateSelector(token)).toBe(true);
+  });
 
-    expect(getPrivacyAction(target, privacy)).toBe('allow');
-    expect(
-      getPrivacyAction(
-        document.querySelector('main'),
+  it('warns when vendorCompat is set under minimal, where it has no effect', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    compilePrivacyPolicy({ version: 1, preset: 'minimal', vendorCompat: true });
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('vendorCompat'));
+    warn.mockClear();
+    compilePrivacyPolicy({
+      version: 1,
+      preset: 'balanced',
+      vendorCompat: true,
+    });
+    compilePrivacyPolicy({ version: 1, preset: 'minimal' });
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
+  /**
+   * `vendorCompat` may only ever add masking or blocking, never reveal:
+   * `.rr-unmask` is the only unmask token, on or off. No foreign tool's
+   * unmask/allow convention is ever honored, regardless of the flag —
+   * enabling compat cannot turn a foreign marker into an unmask signal.
+   */
+  it('never honors a foreign unmask token, flag on or off', () => {
+    expect(on.unmaskTextSelector).toContain('.rr-unmask');
+    for (const foreign of [
+      '.amp-unmask',
+      '.sentry-unmask',
+      '.dd-privacy-allow',
+      '[data-dd-privacy="allow"]',
+      '.nr-unmask',
+      '.ph-no-mask',
+      '.fs-unmask',
+      '.mp-unmask',
+    ]) {
+      expect(on.unmaskTextSelector).not.toContain(foreign);
+      expect(off.unmaskTextSelector).not.toContain(foreign);
+    }
+  });
+
+  it('stays inert under minimal, which never merged vendor classes', () => {
+    const c = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
+      vendorCompat: true,
+    });
+    expect(c.maskTextSelector).toBeNull();
+    expect(c.blockSelector).toBeNull();
+  });
+
+  /**
+   * `vendorCompat` also takes an array of vendor ids, merging only those
+   * vendors' tokens: `true` stays the union of every vendor, `[]` merges
+   * none, and an unknown id is dropped with a warning naming it.
+   */
+  describe('granular vendor selection', () => {
+    afterEach(() => {
+      document.body.innerHTML = '';
+    });
+
+    /** An element carrying `token` (class or attribute form), attached. */
+    function elementFor(token: string): HTMLElement {
+      const el = document.createElement('div');
+      const attr = /^\[([^\]=]+)(?:="([^"]*)")?\]$/.exec(token);
+      if (attr) el.setAttribute(attr[1], attr[2] ?? '');
+      else el.className = token.slice(1);
+      document.body.appendChild(el);
+      return el;
+    }
+
+    it('true behaves as the full legacy set: every vendor token still matches', () => {
+      const coreMask = [
+        '.mp-mask',
+        '.fs-mask',
+        '.fs-mask-without-consent',
+        '.amp-mask',
+        '.ph-mask',
+        '.sentry-mask',
+        '[data-sentry-mask]',
+        '.dd-privacy-mask',
+        '[data-dd-privacy="mask"]',
+        '.dd-privacy-mask-user-input',
+        '[data-dd-privacy="mask-user-input"]',
+        '.nr-mask',
+        '[data-nr-mask]',
+      ];
+      const coreBlock = [
+        '.mp-block',
+        '.fs-exclude',
+        '.fs-exclude-without-consent',
+        '.amp-block',
+        '.ph-no-capture',
+        '.sentry-block',
+        '[data-sentry-block]',
+        '.dd-privacy-hidden',
+        '[data-dd-privacy="hidden"]',
+        '.nr-block',
+        '[data-nr-block]',
+      ];
+      for (const token of [...coreMask, ...extendedMask])
+        expect(elementFor(token).matches(on.maskTextSelector as string)).toBe(
+          true,
+        );
+      for (const token of [...coreBlock, ...extendedBlock])
+        expect(elementFor(token).matches(on.blockSelector as string)).toBe(
+          true,
+        );
+    });
+
+    it('true equals naming every vendor', () => {
+      const all = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: [
+          'mixpanel',
+          'fullstory',
+          'amplitude',
+          'posthog',
+          'sentry',
+          'datadog',
+          'newrelic',
+          'highlight',
+          'logrocket',
+          'hotjar',
+          'clarity',
+          'smartlook',
+          'openreplay',
+          'contentsquare',
+          'heap',
+          'mouseflow',
+          'luckyorange',
+          'inspectlet',
+          'dynatrace',
+          'userback',
+          'zipy',
+          'quantummetric',
+          'glassbox',
+          'sessionstack',
+          'sessionrewind',
+        ],
+      });
+      expect(all.maskTextSelector).toBe(on.maskTextSelector);
+      expect(all.blockSelector).toBe(on.blockSelector);
+    });
+
+    it('an array merges only the named vendors', () => {
+      const posthogOnly = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['posthog'],
+      });
+      const mask = posthogOnly.maskTextSelector as string;
+      expect(elementFor('.ph-mask').matches(mask)).toBe(true);
+      expect(elementFor('.mp-mask').matches(mask)).toBe(false);
+      expect(posthogOnly.blockSelector).toContain('.ph-no-capture');
+      expect(posthogOnly.blockSelector).not.toContain('.mp-block');
+    });
+
+    it('an empty array merges no vendor tokens at all', () => {
+      const none = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: [],
+      });
+      expect(none.maskTextSelector).toBe(off.maskTextSelector);
+      expect(none.blockSelector).toBe(off.blockSelector);
+    });
+
+    it('warns naming an unknown id and skips it, keeping the known ones', () => {
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const c = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['posthog', 'hotjarr' as never],
+      });
+      expect(warn).toHaveBeenCalledWith(expect.stringContaining('hotjarr'));
+      expect(c.blockSelector).toContain('.ph-no-capture');
+      expect(c.maskTextSelector).toContain('.ph-mask');
+      warn.mockRestore();
+    });
+
+    it('booleans still compile: false merges nothing', () => {
+      const asFalse = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: false,
+      });
+      expect(asFalse.maskTextSelector).toBe(off.maskTextSelector);
+      expect(asFalse.blockSelector).toBe(off.blockSelector);
+    });
+
+    it('never merges an unmask token under the array form either', () => {
+      const named = compilePrivacyPolicy({
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['amplitude', 'fullstory', 'datadog'],
+      });
+      for (const foreign of [
+        '.amp-unmask',
+        '.fs-unmask',
+        '.dd-privacy-allow',
+        '[data-dd-privacy="allow"]',
+      ]) {
+        expect(named.maskTextSelector).not.toContain(foreign);
+        expect(named.blockSelector).not.toContain(foreign);
+        expect(named.unmaskTextSelector).not.toContain(foreign);
+      }
+    });
+  });
+});
+
+describe('validateSelector', () => {
+  it('accepts valid, rejects invalid', () => {
+    expect(validateSelector('.a > [data-x="1"]')).toBe(true);
+    expect(validateSelector(':::nope')).toBe(false);
+  });
+
+  /**
+   * With no `document` to ask (SSR, a worker, a non-DOM harness) the probe
+   * used to throw a `ReferenceError` into the caller's catch and report every
+   * selector invalid -- dropping the entire compiled policy, fail-open. The
+   * runtime catch-to-mask around `matches()` stays the fail-closed backstop.
+   */
+  it('assumes valid when there is no document to probe with', () => {
+    vi.stubGlobal('document', undefined);
+    try {
+      expect(validateSelector('.a')).toBe(true);
+      expect(validateSelector(':::nope')).toBe(true);
+      expect(
         compilePrivacyPolicy({
           version: 1,
-          preset: 'custom',
+          preset: 'minimal',
           rules: [
-            {
-              target: { type: 'selector', selector: '.allow' },
-              action: 'allow',
-            },
-            {
-              target: { type: 'selector', selector: '.mask' },
-              action: 'mask',
-            },
+            { target: { type: 'selector', selector: '.pii' }, action: 'mask' },
           ],
-        }),
-      ),
-    ).toBe('mask');
-  });
-
-  it('recognizes data-privacy without recorder configuration', () => {
-    document.body.innerHTML = `
-      <section data-privacy="mask" title="Private title">
-        <p>Private customer <span data-privacy="allow">Public label</span></p>
-        <input type="text" value="Private input" />
-        <input data-privacy="allow" type="password" value="secret-password" />
-      </section>
-      <section data-privacy="exclude">Excluded account 12345</section>`;
-
-    const payload = JSON.stringify(snapshot(document));
-
-    expect(payload).not.toContain('Private title');
-    expect(payload).not.toContain('Private customer');
-    expect(payload).not.toContain('Private input');
-    expect(payload).not.toContain('secret-password');
-    expect(payload).not.toContain('Excluded account 12345');
-    expect(payload).toContain('Public label');
-  });
-
-  it('inherits past invalid data-privacy values and resolves ties safely', () => {
-    document.body.innerHTML = `
-      <main data-privacy="mask">
-        <span id="invalid" data-privacy="unknown">Private</span>
-        <span id="tie" data-privacy="allow" class="policy-mask">Private</span>
-      </main>`;
-    const privacy = compilePrivacyPolicy({
+        }).maskTextSelector,
+      ).toBe('.pii');
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+});
+/**
+ * The splitter exists so that merging and deduplicating selector lists never
+ * rewrites what a fragment means. Every case here is a comma that is NOT a
+ * separator.
+ */
+describe('splitSelectorList', () => {
+  it('splits an ordinary list on its separators', () => {
+    expect(splitSelectorList('.a,.b,.c')).toEqual(['.a', '.b', '.c']);
+    expect(splitSelectorList('.only')).toEqual(['.only']);
+  });
+
+  it('keeps commas nested in a functional pseudo-class', () => {
+    expect(splitSelectorList(':is(.a,.b)')).toEqual([':is(.a,.b)']);
+    expect(splitSelectorList(':not(.a,.b),.c')).toEqual([':not(.a,.b)', '.c']);
+  });
+
+  it('keeps commas inside an attribute value', () => {
+    expect(splitSelectorList('[data-x="p,q"]')).toEqual(['[data-x="p,q"]']);
+    expect(splitSelectorList("[data-x='p,q'],.c")).toEqual([
+      "[data-x='p,q']",
+      '.c',
+    ]);
+  });
+
+  it('keeps an escaped comma, quoted or not', () => {
+    expect(splitSelectorList('.a\\,b')).toEqual(['.a\\,b']);
+    expect(splitSelectorList('.a\\,b,b')).toEqual(['.a\\,b', 'b']);
+    expect(splitSelectorList('[data-x="p\\"q,r"]')).toEqual([
+      '[data-x="p\\"q,r"]',
+    ]);
+  });
+
+  it('does not run past the end on a trailing backslash', () => {
+    expect(splitSelectorList('.a\\')).toEqual(['.a\\']);
+  });
+
+  // A malformed fragment must only take itself down. Before these cases were
+  // handled, a stray closer or an unterminated quote swallowed every later
+  // separator, so the valid selectors after it were dropped along with it.
+  it('still splits after a stray closing bracket', () => {
+    expect(splitSelectorList('.a),.b,.c')).toEqual(['.a)', '.b', '.c']);
+    expect(splitSelectorList('.a]),.b')).toEqual(['.a])', '.b']);
+  });
+
+  it('still splits after an unterminated quote', () => {
+    expect(splitSelectorList('[data-x="unterminated],.b')).toEqual([
+      '[data-x="unterminated]',
+      '.b',
+    ]);
+    expect(splitSelectorList(".a',.b")).toEqual([".a'", '.b']);
+  });
+
+  it('still splits after an unclosed opener', () => {
+    expect(splitSelectorList(':is(.a,.b')).toEqual([':is(.a', '.b']);
+    expect(splitSelectorList('[data-x,.b')).toEqual(['[data-x', '.b']);
+  });
+
+  it('keeps a balanced list intact once an earlier fragment is malformed', () => {
+    expect(splitSelectorList('.a),:is(.b,.c),.d')).toEqual([
+      '.a)',
+      ':is(.b,.c)',
+      '.d',
+    ]);
+  });
+});
+
+describe('malformed fragments do not drop their valid neighbours', () => {
+  it('keeps a mask rule that follows a fragment with a stray closer', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const c = compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
+      preset: 'balanced',
       rules: [
-        {
-          target: { type: 'selector', selector: '.policy-mask' },
-          action: 'mask',
-        },
+        { target: { type: 'selector', selector: '.a),.b' }, action: 'mask' },
       ],
     });
+    expect(c.maskTextSelector).toContain('.b');
+    expect(c.maskTextSelector).not.toContain('.a)');
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('.a)'));
+    warn.mockRestore();
+  });
+});
 
-    expect(getPrivacyAction(document.querySelector('#invalid'), privacy)).toBe(
-      'mask',
+describe('resolvePrivacyContext', () => {
+  it('joins manual selector with compiled blockSelector', () => {
+    const { blockSelector } = resolvePrivacyContext({
+      privacyPolicy: { version: 1, preset: 'balanced' },
+      blockSelector: '.manual',
+    });
+    expect(blockSelector).toContain('.manual');
+    expect(blockSelector).toContain('[data-privacy="block"]');
+  });
+
+  /**
+   * `finalizeAttribute` reads the *compiled policy's* `unmaskTextSelector`,
+   * so the record()-level option has to be written back onto the policy or it
+   * would only ever affect text masking.
+   */
+  it('writes the merged unmask selector back onto the compiled policy', () => {
+    const { privacy, unmaskTextSelector } = resolvePrivacyContext({
+      privacyPolicy: { version: 1, preset: 'balanced' },
+      unmaskTextSelector: '.mine',
+    });
+    expect(privacy.unmaskTextSelector).toBe(unmaskTextSelector);
+    expect(privacy.unmaskTextSelector).toContain('.mine');
+    expect(privacy.unmaskTextSelector).toContain('[data-privacy="unmask"]');
+  });
+
+  it('leaves the compiled policy untouched when nothing was merged in', () => {
+    const compiled = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+    expect(resolvePrivacyContext({ privacy: compiled }).privacy).toBe(compiled);
+  });
+});
+
+/**
+ * The `record()`-level selector options used to be concatenated onto the
+ * compiled policy without ever being probed. One malformed selector then made
+ * every downstream `matches()` throw, and the runtime catch-to-mask starred
+ * the entire page. They now go through the same drop-and-warn validation as
+ * policy rule selectors.
+ */
+describe('merge helpers validate the record()-level selector', () => {
+  const balanced = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+
+  afterEach(() => {
+    document.body.innerHTML = '';
+    vi.restoreAllMocks();
+  });
+
+  it.each([
+    ['maskTextSelector', balanced.maskTextSelector],
+    ['unmaskTextSelector', balanced.unmaskTextSelector],
+    ['blockSelector', balanced.blockSelector],
+  ])('%s drops an invalid manual half with a warning', (_name, compiled) => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const merged = mergeSelectors(':::garbage', compiled);
+    expect(merged).not.toContain(':::garbage');
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining('dropping invalid selector'),
     );
-    expect(getPrivacyAction(document.querySelector('#tie'), privacy)).toBe(
-      'mask',
+  });
+
+  /**
+   * A malformed fragment used to take the whole comma-separated list with
+   * it, silently un-masking everything its valid siblings covered -- a
+   * fail-open, and the opposite of what the guide promises. Validation now
+   * falls back to fragment by fragment.
+   */
+  it('keeps the valid half of a partly-malformed manual selector', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const merged = mergeSelectors(
+      '.pii, .broken:has-typo(',
+      balanced.maskTextSelector,
+    )!;
+    expect(merged).toContain('.pii');
+    expect(merged).not.toContain('has-typo');
+    expect(merged).toContain('.rr-mask');
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining('.broken:has-typo('),
     );
+
+    document.body.innerHTML = '<div class="pii">x</div>';
+    expect(document.querySelector('div')!.matches(merged)).toBe(true);
   });
 
-  it('maps exclude policy rules to rrweb blocking', () => {
-    document.body.innerHTML =
-      '<section class="private">Excluded by policy</section>';
-    const privacyPolicy = {
-      version: 1 as const,
-      preset: 'custom' as const,
+  it('names only the dropped fragments in the warning', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    mergeSelectors(':::garbage,.valid', balanced.maskTextSelector);
+    const message = warn.mock.calls[0][0] as string;
+    expect(message).toContain(':::garbage');
+    expect(message).not.toContain('.valid');
+  });
+
+  it('drops a whole list only when every fragment is malformed', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const merged = mergeSelectors(
+      ':::a,:::b',
+      balanced.maskTextSelector,
+    ) as string;
+    expect(merged).toBe(balanced.maskTextSelector);
+    expect(warn).toHaveBeenCalled();
+  });
+
+  it('keeps surviving fragments of a policy rule too, not just the manual half', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const compiled = compilePrivacyPolicy({
+      version: 1,
+      preset: 'minimal',
       rules: [
         {
-          target: { type: 'selector' as const, selector: '.private' },
-          action: 'exclude' as const,
+          target: { type: 'selector', selector: '.pii, .broken:has-typo(' },
+          action: 'mask',
         },
       ],
-    };
-    const privacy = compilePrivacyPolicy(privacyPolicy);
-    const payload = JSON.stringify(snapshot(document, { privacyPolicy }));
+    });
+    expect(compiled.maskTextSelector).toBe('.pii');
+    expect(warn).toHaveBeenCalled();
+  });
 
-    expect(privacy.blockSelector).toContain('.private');
-    expect(payload).not.toContain('Excluded by policy');
+  /**
+   * `record()` merges the policy's selectors into the options it hands to
+   * `snapshot()`, which compiles the same policy and merges a second time.
+   * Without deduplication every fragment would be repeated on each pass.
+   */
+  it('is idempotent: re-merging an already-merged selector adds nothing', () => {
+    const once = mergeSelectors(null, balanced.unmaskTextSelector);
+    const twice = mergeSelectors(once, balanced.unmaskTextSelector);
+    expect(twice).toBe(once);
+    expect(mergeSelectors(twice, balanced.unmaskTextSelector)).toBe(once);
   });
 
-  it('preserves structural attributes unless they are explicitly targeted', () => {
-    document.body.innerHTML = `
-      <input class="private layout" type="text" data-secret="account-123" value="Private value" />`;
-    const payload = JSON.stringify(
-      snapshot(document, {
-        privacyPolicy: {
-          version: 1,
-          preset: 'custom',
-          rules: [
-            {
-              target: { type: 'selector', selector: '.private' },
-              action: 'mask',
-            },
-            {
-              target: {
-                type: 'selector',
-                selector: '.private',
-                attributes: ['data-secret'],
-              },
-              action: 'mask',
-            },
-          ],
-        },
-      }),
-    );
+  it('deduplicates a fragment the manual half repeats from the policy', () => {
+    const merged = mergeSelectors('.rr-mask,.mine', balanced.maskTextSelector);
+    expect(merged!.split(',').filter((p) => p === '.rr-mask')).toHaveLength(1);
+    expect(merged).toContain('.mine');
+  });
+
+  /**
+   * Regression: the splitter used to honor a backslash escape only inside
+   * quotes, so `.a\,b` was torn into `.a\` and `b`. The stray `b` then
+   * collided in the dedupe `Set` with the independently supplied `b`
+   * selector and silently swallowed it -- a dropped mask selector, i.e. a
+   * fail-open. Both must survive the merge and still match.
+   */
+  it('an escaped comma does not swallow an unrelated selector in the dedupe', () => {
+    const minimal = compilePrivacyPolicy(undefined);
+    const merged = mergeSelectors('.a\\,b,b', minimal.maskTextSelector)!;
 
-    expect(payload).toContain('private layout');
-    expect(payload).toContain('"type":"text"');
-    expect(payload).not.toContain('account-123');
-    expect(payload).not.toContain('Private value');
+    document.body.innerHTML = '<div class="a,b">x</div><b>y</b>';
+    const commaClassEl = document.querySelector('div')!;
+    const bEl = document.querySelector('b')!;
+
+    expect(commaClassEl.matches(merged)).toBe(true);
+    expect(bEl.matches(merged)).toBe(true);
   });
 
-  it('does not allow protected inputs to be unmasked', () => {
-    const input = document.createElement('input');
-    input.type = 'password';
-    input.className = 'record';
-    const privacy = compilePrivacyPolicy({
+  it('keeps both halves when they arrive from different merge sources', () => {
+    // the escaped-comma selector comes in as the record()-level option, the
+    // colliding `b` from a policy rule
+    const policy = compilePrivacyPolicy({
       version: 1,
-      preset: 'custom',
-      rules: [
-        {
-          target: { type: 'selector', selector: '.record' },
-          action: 'allow',
-        },
-      ],
+      preset: 'minimal',
+      rules: [{ target: { type: 'selector', selector: 'b' }, action: 'mask' }],
     });
+    const merged = mergeSelectors('.a\\,b', policy.maskTextSelector)!;
 
-    expect(
-      maskInputWithPrivacy('secret', input, privacy, false, () => 'secret'),
-    ).toBe('xxxxxx');
+    document.body.innerHTML = '<div class="a,b">x</div><b>y</b>';
+    expect(document.querySelector('div')!.matches(merged)).toBe(true);
+    expect(document.querySelector('b')!.matches(merged)).toBe(true);
+  });
 
-    input.type = 'text';
-    input.setAttribute('data-rr-is-password', 'true');
-    expect(
-      maskInputWithPrivacy('visible', input, privacy, false, () => 'visible'),
-    ).toBe('xxxxxxx');
+  it('does not tear a selector whose commas are nested', () => {
+    // a naive split(',') would produce ':is(.a' and '.b)' -- rejoining
+    // deduplicated halves of those would corrupt the selector
+    const merged = mergeSelectors(
+      ':is(.a,.b),[data-x="p,q"]',
+      balanced.maskTextSelector,
+    );
+    expect(merged).toContain(':is(.a,.b)');
+    expect(merged).toContain('[data-x="p,q"]');
+    expect(() => document.querySelector(merged!)).not.toThrow();
+  });
 
-    input.type = 'password';
-    input.removeAttribute('data-rr-is-password');
-    input.setAttribute('data-privacy', 'allow');
-    expect(
-      maskInputWithPrivacy(
-        'protected',
-        input,
-        compilePrivacyPolicy(undefined),
-        false,
-        () => 'protected',
-      ),
-    ).toBe('xxxxxxxxx');
+  it('a malformed record()-level maskTextSelector no longer stars the page', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    document.body.innerHTML =
+      '<p>keep this text</p><p class="valid">masked text</p>';
+
+    const out = JSON.stringify(
+      snapshot(document, {
+        privacyPolicy: { version: 1, preset: 'balanced' },
+        maskTextSelector: mergeSelectors(
+          ':::garbage,.valid',
+          balanced.maskTextSelector,
+        ),
+      }),
+    );
+
+    // the malformed fragment neither throws the page into catch-to-mask...
+    expect(out).toContain('keep this text');
+    // ...nor takes its valid sibling down with it
+    expect(out).not.toContain('masked text');
+    expect(warn).toHaveBeenCalled();
   });
+});
 
-  it('removes sensitive URL values while retaining routing context', () => {
-    expect(
-      sanitizeUrl(
-        'https://example.com/account?tab=billing&token=secret#profile',
-        balanced(),
-      ),
-    ).toBe('https://example.com/account?tab=billing&token=*');
+describe('detectSensitiveValue', () => {
+  const withDetectors = compilePrivacyPolicy({
+    version: 1,
+    preset: 'minimal',
+    detectors: {
+      email: true,
+      phone: true,
+      paymentCard: true,
+      ssn: true,
+      ipAddress: true,
+    },
+  });
 
+  it('detects a Luhn-valid card adjacent to other digits (review regression)', () => {
     expect(
-      sanitizeUrl(
-        'https://example.com/account?tab=billing',
-        compilePrivacyPolicy({ version: 1, preset: 'strict' }),
+      detectSensitiveValue(
+        'call 5551234567 4111 1111 1111 1111 now',
+        withDetectors,
       ),
-    ).toBe('https://example.com/account?tab=*');
+    ).toBe(true);
   });
 
-  it('inherits rules across a shadow-root boundary', () => {
-    const host = document.createElement('div');
-    host.className = 'private';
-    const shadow = host.attachShadow({ mode: 'open' });
-    const child = document.createElement('span');
-    shadow.appendChild(child);
-    document.body.appendChild(host);
+  it('detects email, ssn, ip; passes clean prose', () => {
+    expect(detectSensitiveValue('contact bob@example.com', withDetectors)).toBe(
+      true,
+    );
+    expect(detectSensitiveValue('ssn 123-45-6789', withDetectors)).toBe(true);
+    expect(detectSensitiveValue('host 192.168.0.1', withDetectors)).toBe(true);
+    expect(detectSensitiveValue('the quick brown fox', withDetectors)).toBe(
+      false,
+    );
+  });
 
+  it('rejects UUIDs and version strings as cards/ssns (false-positive guard)', () => {
     expect(
-      getPrivacyAction(
-        child,
-        compilePrivacyPolicy({
-          version: 1,
-          preset: 'custom',
-          rules: [
-            {
-              target: { type: 'selector', selector: '.private' },
-              action: 'mask',
-            },
-          ],
-        }),
+      detectSensitiveValue(
+        'id 550e8400-e29b-41d4-a716-446655440000',
+        withDetectors,
       ),
-    ).toBe('mask');
+    ).toBe(false);
+    expect(detectSensitiveValue('v1.2.3.4000 build', withDetectors)).toBe(
+      false,
+    );
   });
 
-  it('masks CSS text, inline style, and stylesheet snapshots', () => {
-    document.body.innerHTML = `
-      <style>.hero { content: "person@example.com"; }</style>
-      <div style="--owner: person@example.com"></div>`;
-
-    const balancedPayload = JSON.stringify(
-      snapshot(document, {
-        privacyPolicy: applyPrivacyDetectors({
-          version: 1,
-          preset: 'balanced',
-        }),
-      }),
+  it('detects regardless of preset (works under minimal)', () => {
+    expect(withDetectors.preset).toBe('minimal');
+    expect(detectSensitiveValue('4111 1111 1111 1111', withDetectors)).toBe(
+      true,
     );
-    expect(balancedPayload).not.toContain('person@example.com');
-    expect(balancedPayload).toContain('xxxxxx@xxxxxxx.xxx');
+  });
 
-    const strictPayload = JSON.stringify(
-      snapshot(document, {
-        privacyPolicy: { version: 1, preset: 'strict' },
-      }),
-    );
-    expect(strictPayload).not.toContain('person@example.com');
+  it('no detectors configured -> never detects', () => {
+    const none = compilePrivacyPolicy({ version: 1, preset: 'strict' });
+    expect(detectSensitiveValue('bob@example.com', none)).toBe(false);
   });
 
-  it('applies policy before a snapshot is serialized', () => {
-    document.body.innerHTML = `
-      <p title="person@example.com">Contact person@example.com</p>
-      <input type="text" value="private input" />
-      <input type="password" class="record" value="secret-password" />
-      <a href="https://example.com/?token=secret">Account</a>`;
+  it('fails closed on absurdly long input instead of scanning it', () => {
+    const clean = 'a'.repeat(10_001);
+    expect(detectSensitiveValue(clean, withDetectors)).toBe(true);
+  });
 
-    const serialized = snapshot(document, {
-      privacyPolicy: applyPrivacyDetectors({
-        version: 1,
-        preset: 'balanced',
-        rules: [
-          {
-            target: { type: 'selector', selector: '.record' },
-            action: 'allow',
-          },
-        ],
-      }),
+  it('per-detector toggles work', () => {
+    const emailOff = buildDetectors({
+      email: false,
+      phone: false,
+      paymentCard: true,
+      ssn: false,
+      ipAddress: false,
     });
-    const payload = JSON.stringify(serialized);
-
-    expect(payload).not.toContain('person@example.com');
-    expect(payload).not.toContain('private input');
-    expect(payload).not.toContain('secret-password');
-    expect(payload).not.toContain('token=secret');
-    expect(payload).toContain('Contact xxxxxx@xxxxxxx.xxx');
-    expect(payload).toContain('token=*');
+    expect(emailOff.some((d) => d.name === 'email')).toBe(false);
+    expect(emailOff.some((d) => d.name === 'payment-card')).toBe(true);
   });
 
-  it('masks every form value attribute in strict mode', () => {
-    document.body.innerHTML = `
-      <input type="radio" value="private-radio-value" />
-      <select><option value="private-option-value">Private option</option></select>`;
-    const payload = JSON.stringify(
-      snapshot(document, {
-        privacyPolicy: { version: 1, preset: 'strict' },
-      }),
+  it('detects spaced phone format (fix regression)', () => {
+    expect(detectSensitiveValue('call 555 123 4567 now', withDetectors)).toBe(
+      true,
     );
+  });
 
-    expect(payload).not.toContain('private-radio-value');
-    expect(payload).not.toContain('private-option-value');
-    expect(payload).not.toContain('Private option');
+  it('detects dashed phone format (fix regression)', () => {
+    expect(detectSensitiveValue('555-123-4567', withDetectors)).toBe(true);
   });
 
-  it('supports coarse masking of final source attributes', () => {
-    document.body.innerHTML = `
-      <div class="customer-name" style="--owner: person@example.com" title="person@example.com"></div>
-      <input value="private synthesized value" />`;
-    const payload = JSON.stringify(
-      snapshot(document, { maskAllElementAttributes: true }),
-    );
+  it('detects parenthesized area code format (fix regression)', () => {
+    expect(detectSensitiveValue('(555) 123-4567', withDetectors)).toBe(true);
+  });
 
-    expect(payload).not.toContain('customer-name');
-    expect(payload).not.toContain('person@example.com');
-    expect(payload).not.toContain('private synthesized value');
+  it('detects parenthesized area code with country code (fix regression)', () => {
+    expect(detectSensitiveValue('+1 (555) 123-4567', withDetectors)).toBe(true);
   });
+});
 
-  it('lets a callback mask final attributes but never override policy', () => {
-    document.body.innerHTML = `
-      <div data-owner="person@example.com" title="person@example.com"></div>`;
-    const payload = JSON.stringify(
-      snapshot(document, {
-        privacyPolicy: applyPrivacyDetectors({
-          version: 1,
-          preset: 'balanced',
-        }),
-        maskAttributeFn: (name, value) =>
-          name === 'data-owner' ? '[OWNER]' : value,
-      }),
+describe('sanitizeUrl v2', () => {
+  const strict = compilePrivacyPolicy({ version: 1, preset: 'strict' });
+  const balanced = compilePrivacyPolicy({ version: 1, preset: 'balanced' });
+  const minimal = compilePrivacyPolicy(undefined);
+  it('strips userinfo credentials', () => {
+    expect(
+      sanitizeUrl('https://alice:hunter2@api.example.com/x', balanced),
+    ).toBe('https://api.example.com/x');
+  });
+  it('masks blocked query parameters, case-insensitively', () => {
+    expect(sanitizeUrl('https://a.com/?Token=abc&ok=1', balanced)).toBe(
+      'https://a.com/?Token=*&ok=1',
     );
+  });
+  it('strict masks all params unless allowlisted', () => {
+    const allow = compilePrivacyPolicy({
+      version: 1,
+      preset: 'strict',
+      url: { allowedQueryParameters: ['page'] },
+    });
+    expect(sanitizeUrl('https://a.com/?page=2&q=x', strict)).toBe(
+      'https://a.com/?page=*&q=*',
+    );
+    expect(sanitizeUrl('https://a.com/?page=2&q=x', allow)).toBe(
+      'https://a.com/?page=2&q=*',
+    );
+  });
+  it('removes hash unless disabled; minimal passes through untouched', () => {
+    expect(sanitizeUrl('https://a.com/x#frag', balanced)).toBe(
+      'https://a.com/x',
+    );
+    expect(sanitizeUrl('https://alice:pw@a.com/?token=x#f', minimal)).toBe(
+      'https://alice:pw@a.com/?token=x#f',
+    );
+  });
+  it('unparseable value under non-minimal fails closed by dropping the attribute', () => {
+    expect(sanitizeUrl('http://[broken', balanced)).toBeNull();
+  });
+  it('empty in, empty out -- never resolved into a path', () => {
+    expect(sanitizeUrl('', balanced)).toBe('');
+    expect(sanitizeUrl('', strict)).toBe('');
+    expect(sanitizeUrl('', minimal)).toBe('');
+  });
+});
+
+/**
+ * EXPERIMENTAL, open design question for upstream (see `sanitizeMetaUrl`'s
+ * doc comment): the Meta event's own `href` is scoped like `balanced`
+ * (blocked-list-only param masking) even under `strict`, while every DOM
+ * URL attribute keeps `strict`'s normal mask-everything-unless-allowlisted
+ * treatment. Without this, `strict` would star every query param on the
+ * page's own address, including ordinary routing state most apps put
+ * there.
+ */
+describe('sanitizeMetaUrl scopes the Meta href differently than DOM URL attributes', () => {
+  const strict = compilePrivacyPolicy({ version: 1, preset: 'strict' });
 
-    expect(payload).toContain('[OWNER]');
-    expect(payload).not.toContain('person@example.com');
-    expect(payload).toContain('xxxxxx@xxxxxxx.xxx');
+  it('keeps a non-blocked param under strict', () => {
+    expect(sanitizeMetaUrl('https://a.com/?page=2', strict)).toBe(
+      'https://a.com/?page=2',
+    );
   });
 
-  it('fails closed when an attribute callback throws', () => {
-    document.body.innerHTML = '<div title="private-title"></div>';
-    const payload = JSON.stringify(
-      snapshot(document, {
-        maskAttributeFn: () => {
-          throw new Error('boom');
-        },
-      }),
+  it('still masks a blocked-list param under strict', () => {
+    expect(sanitizeMetaUrl('https://a.com/?token=x', strict)).toBe(
+      'https://a.com/?token=*',
     );
+  });
 
-    expect(payload).not.toContain('private-title');
+  it('is strictly narrower than plain sanitizeUrl under strict, never broader', () => {
+    const metaOut = sanitizeMetaUrl('https://a.com/?page=2&token=x', strict);
+    const domOut = sanitizeUrl('https://a.com/?page=2&token=x', strict);
+    expect(metaOut).toBe('https://a.com/?page=2&token=*');
+    // The DOM path masks `page` too -- strict masks everything unless
+    // explicitly allowlisted, and no allowlist was configured here.
+    expect(domOut).toBe('https://a.com/?page=*&token=*');
   });
 
-  it('suppresses full-snapshot canvas pixels while region masking is configured', () => {
-    const canvas = document.createElement('canvas');
-    (canvas as HTMLCanvasElement & { __context?: string }).__context = '2d';
-    canvas.getContext = (() => ({
-      getImageData: () => ({ data: new Uint8ClampedArray([255, 0, 0, 255]) }),
-    })) as unknown as typeof canvas.getContext;
-    canvas.toDataURL = () => 'data:image/webp;base64,unmasked-pixels';
-    document.body.appendChild(canvas);
+  it('a DOM URL attribute is unaffected: strict still masks every param', () => {
+    expect(sanitizeUrl('https://a.com/?page=2&q=x', strict)).toBe(
+      'https://a.com/?page=*&q=*',
+    );
+  });
+});
 
-    const unprotected = JSON.stringify(
-      snapshot(document, {
-        recordCanvas: true,
-        canvasMaskingConfigured: () => false,
+describe('resolveTextValue: exemptScript', () => {
+  const script = document.createElement('script');
+  it('exempts SCRIPT text from masking when exemptScript is true (the snapshot path)', () => {
+    expect(
+      resolveTextValue({
+        value: 'secret',
+        parent: script,
+        needsMask: true,
+        maskTextFn: undefined,
+        privacy: undefined,
+        exemptScript: true,
       }),
-    );
-    const protectedSnapshot = JSON.stringify(
-      snapshot(document, {
-        recordCanvas: true,
-        canvasMaskingConfigured: () => true,
+    ).toBe('secret');
+  });
+
+  it('masks SCRIPT text like any other node when exemptScript is false (the mutation path)', () => {
+    expect(
+      resolveTextValue({
+        value: 'secret',
+        parent: script,
+        needsMask: true,
+        maskTextFn: undefined,
+        privacy: undefined,
+        exemptScript: false,
       }),
+    ).toBe('******');
+  });
+});
+
+describe('resolveUnmaskTextSelector', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
+  });
+
+  it('finds a target hidden inside an open shadow root', () => {
+    document.body.innerHTML = '<div id="host"></div>';
+    const host = document.querySelector('#host') as HTMLElement;
+    host.attachShadow({ mode: 'open' }).innerHTML =
+      '<p class="rr-unmask">x</p>';
+    expect(resolveUnmaskTextSelector(document, '.rr-unmask')).toBe(
+      '.rr-unmask',
     );
+  });
 
-    expect(unprotected).toContain('rr_dataURL');
-    expect(protectedSnapshot).not.toContain('rr_dataURL');
+  it('resolves to null when the selector matches nowhere, including inside shadow roots', () => {
+    document.body.innerHTML = '<div id="host"></div>';
+    const host = document.querySelector('#host') as HTMLElement;
+    host.attachShadow({ mode: 'open' }).innerHTML = '<p>x</p>';
+    expect(resolveUnmaskTextSelector(document, '.rr-unmask')).toBeNull();
+  });
+});
+
+describe('needMaskingText accepts the legacy selector string', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
   });
 
-  it('does not throw when a form control shadows HTMLFormElement.tagName', () => {
-    const form = document.createElement('form');
-    const input = document.createElement('input');
-    input.setAttribute('name', 'tagName');
-    const text = document.createTextNode('visible email person@example.com');
-    form.appendChild(input);
-    form.appendChild(text);
-    document.body.appendChild(form);
+  const target = (html: string): Node => {
+    document.body.innerHTML = html;
+    return document.querySelector('#t')!;
+  };
 
-    expect(() =>
-      maskTextWithPrivacy(
-        'visible email person@example.com',
-        form,
-        balanced(),
-        false,
+  it('masks through a raw selector string, as the split pair does', () => {
+    const node = target('<div class="secret"><span id="t">x</span></div>');
+    expect(needMaskingText(node, 'rr-mask', '.secret', null, true)).toBe(true);
+    expect(
+      needMaskingText(
+        node,
+        'rr-mask',
+        splitMaskAllSelector('.secret'),
+        null,
+        true,
       ),
-    ).not.toThrow();
-    expect(() => snapshot(document)).not.toThrow();
+    ).toBe(true);
   });
 
-  it('walks ancestors when getRootNode has been monkey-patched', () => {
-    const originalGetRootNode = Node.prototype.getRootNode;
-    Node.prototype.getRootNode = function () {
-      throw new Error('getRootNode was hijacked by framework');
-    };
-    try {
-      document.body.innerHTML =
-        '<main data-privacy="mask"><span id="target">secret</span></main>';
-      const target = document.querySelector('#target')!;
-      const privacy = compilePrivacyPolicy({
-        version: 1,
-        preset: 'balanced',
-        rules: [
-          {
-            target: { type: 'selector', selector: '[data-privacy="mask"]' },
-            action: 'mask',
-          },
-        ],
-      });
-      expect(() => getPrivacyAction(target, privacy)).not.toThrow();
-      expect(getPrivacyAction(target, privacy)).toBe('mask');
-      expect(() => snapshot(document)).not.toThrow();
-    } finally {
-      Node.prototype.getRootNode = originalGetRootNode;
-    }
+  it("honors a raw '*' mask-everything string", () => {
+    const node = target('<div><span id="t">x</span></div>');
+    expect(needMaskingText(node, 'rr-mask', '*', null, true)).toBe(true);
   });
 
-  it('keeps the legacy path unchanged when no policy is supplied', () => {
-    document.body.innerHTML =
-      '<p>Visible text</p><input type="hidden" value="legacy-hidden-value">';
-    const payload = JSON.stringify(snapshot(document));
-    expect(payload).toContain('Visible text');
-    expect(payload).toContain('legacy-hidden-value');
+  it("still splits '*' out of a raw list so an unmask ancestor can win", () => {
+    const node = target('<div class="ok"><span id="t">x</span></div>');
+    expect(needMaskingText(node, 'rr-mask', '*', '.ok', true)).toBe(false);
+  });
+
+  it('treats a null/undefined selector as "none configured", not as a throw', () => {
+    const node = target('<div><span id="t">x</span></div>');
+    expect(needMaskingText(node, 'rr-mask', null, null, true)).toBe(false);
     expect(
-      maskInputWithPrivacy(
-        'legacy value',
-        document.createElement('input'),
-        undefined,
+      needMaskingText(
+        node,
+        'rr-mask',
+        undefined as unknown as null,
+        null,
         true,
       ),
-    ).toBe('************');
+    ).toBe(false);
+  });
+});
+
+/**
+ * The pre-2.0 signature was
+ * `(node, maskTextClass, maskTextSelector, checkAncestors)`. Adding
+ * `unmaskTextSelector` in the fourth slot shifted an unmigrated caller's
+ * boolean into it and left `checkAncestors` `undefined` -- which fails
+ * *open*: the ancestor walk stops at the node, so a `.rr-mask` ancestor no
+ * longer masks. The boolean is shape-detected and shifted back instead.
+ */
+describe('needMaskingText accepts the legacy 4-arg positional call', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
+  });
+
+  const target = (html: string): Node => {
+    document.body.innerHTML = html;
+    return document.querySelector('#t')!;
+  };
+
+  const legacy = (
+    node: Node,
+    checkAncestors: boolean,
+    maskTextSelector: string | null = null,
+  ): boolean =>
+    needMaskingText(
+      node,
+      'rr-mask',
+      maskTextSelector,
+      checkAncestors as unknown as null,
+    );
+
+  it('still masks under a .rr-mask ancestor with checkAncestors true', () => {
+    const node = target('<div class="rr-mask"><span id="t">x</span></div>');
+    expect(legacy(node, true)).toBe(true);
+  });
+
+  it('does not walk to that ancestor when the legacy call passed false', () => {
+    const node = target('<div class="rr-mask"><span id="t">x</span></div>');
+    expect(legacy(node, false)).toBe(false);
+  });
+
+  it('still matches on the node itself with checkAncestors false', () => {
+    const node = target('<div><span id="t" class="rr-mask">x</span></div>');
+    expect(legacy(node, false)).toBe(true);
+  });
+
+  it('honors a legacy selector string alongside the shifted boolean', () => {
+    const node = target('<div class="secret"><span id="t">x</span></div>');
+    expect(legacy(node, true, '.secret')).toBe(true);
+    expect(legacy(node, false, '.secret')).toBe(false);
+  });
+
+  it('never reads the shifted boolean as an unmask selector', () => {
+    // '*' masks everything; a legacy caller supplies no unmask escape, so the
+    // shifted `true` must not open one.
+    const node = target('<div><span id="t">x</span></div>');
+    expect(legacy(node, true, '*')).toBe(true);
+  });
+
+  it('leaves the new signature untouched', () => {
+    const node = target('<div class="rr-mask"><span id="t">x</span></div>');
+    expect(needMaskingText(node, 'rr-mask', null, null, true)).toBe(true);
+    expect(needMaskingText(node, 'rr-mask', null, null, false)).toBe(false);
+    // an unmask ancestor still wins over the class when the walk is on
+    const unmasked = target(
+      '<div class="rr-mask"><span class="ok"><b id="t">x</b></span></div>',
+    );
+    expect(needMaskingText(unmasked, 'rr-mask', null, '.ok', true)).toBe(false);
+  });
+});
+
+/**
+ * `needMaskingText`'s catch-all fails closed to masking (see the
+ * `merge helpers validate the record()-level selector` note above for why an
+ * ancestor `matches()` can throw at all). The one-time warning tells an
+ * embedder their custom selector is broken instead of silently masking
+ * forever with no signal.
+ */
+describe('needMaskingText warns once when the mask decision throws', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
+    vi.restoreAllMocks();
+  });
+
+  it('fails closed to masking and warns exactly once across repeated throws', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    document.body.innerHTML = '<div><span id="t">x</span></div>';
+    const node = document.querySelector('#t')!;
+    expect(needMaskingText(node, 'rr-mask', ':::garbage', null, true)).toBe(
+      true,
+    );
+    expect(needMaskingText(node, 'rr-mask', ':::garbage', null, true)).toBe(
+      true,
+    );
+    const throwWarnings = warn.mock.calls.filter(([msg]) =>
+      String(msg).includes('privacy mask decision threw'),
+    );
+    expect(throwWarnings).toHaveLength(1);
+    expect(throwWarnings[0][0]).toContain('failing closed to masking');
   });
 });
diff --git a/packages/rrweb-snapshot/test/snapshot.test.ts b/packages/rrweb-snapshot/test/snapshot.test.ts
index 27f1aa03bb..cc9c562b5d 100644
--- a/packages/rrweb-snapshot/test/snapshot.test.ts
+++ b/packages/rrweb-snapshot/test/snapshot.test.ts
@@ -18,7 +18,7 @@ const serializeNode = (node: Node): serializedNodeWithId | null => {
     blockClass: 'blockblock',
     blockSelector: null,
     maskTextClass: 'maskmask',
-    maskTextSelector: null,
+    maskTextSelector: { maskAll: false, selector: null },
     skipChild: false,
     inlineStylesheet: true,
     maskTextFn: undefined,
diff --git a/packages/rrweb-snapshot/test/utils.test.ts b/packages/rrweb-snapshot/test/utils.test.ts
index f4b68245cc..4b417c0a36 100644
--- a/packages/rrweb-snapshot/test/utils.test.ts
+++ b/packages/rrweb-snapshot/test/utils.test.ts
@@ -7,10 +7,16 @@ import {
   extractFileExtension,
   fixSafariColons,
   isNodeMetaEqual,
+  isProtectedInput,
   stringifyStylesheet,
 } from '../src/utils';
 import { NodeType } from '@rrweb/types';
 import type { serializedNode, serializedNodeWithId } from '@rrweb/types';
+// `@rrweb/utils` has no test infrastructure of its own (no vitest config /
+// test dir), so `untaintedTagName` -- shared, package-level shadowing
+// hardening added for Task 9 -- is covered here instead, importing it the
+// same way rrweb-snapshot's own source does.
+import { untaintedTagName } from '@rrweb/utils';
 
 describe('utils', () => {
   describe('isNodeMetaEqual()', () => {
@@ -326,4 +332,100 @@ describe('utils', () => {
       );
     });
   });
+
+  describe('untaintedTagName()', () => {
+    it('returns the real tag name even when a named form control shadows `tagName`', () => {
+      // Real browsers make named form controls reachable as own properties
+      // on their <form> (so `<form><input name="tagName">` makes
+      // `form.tagName` resolve to the <input>, not the string `'FORM'`).
+      // jsdom doesn't implement that quirk, so we reproduce the same shape
+      // of shadowing directly: an own `tagName` property that hides the
+      // inherited `Element.prototype` getter.
+      document.body.innerHTML = '<form><input name="tagName"></form>';
+      const form = document.querySelector('form')!;
+      const input = document.querySelector('input')!;
+      Object.defineProperty(form, 'tagName', {
+        value: input,
+        configurable: true,
+      });
+      // sanity check: the shadowing actually took effect
+      expect(typeof form.tagName).not.toBe('string');
+      expect(untaintedTagName(form)).toBe('FORM');
+    });
+
+    it('returns an uppercased tag name for an ordinary element', () => {
+      const div = document.createElement('div');
+      expect(untaintedTagName(div)).toBe('DIV');
+    });
+
+    it('returns an empty string for null/undefined', () => {
+      expect(untaintedTagName(null)).toBe('');
+      expect(untaintedTagName(undefined)).toBe('');
+    });
+  });
+
+  describe('isProtectedInput()', () => {
+    it('protects a hidden input', () => {
+      const input = document.createElement('input');
+      input.type = 'hidden';
+      expect(isProtectedInput(input)).toBe(true);
+    });
+
+    it('protects an input a mutation observer marked as a former password field', () => {
+      const input = document.createElement('input');
+      input.type = 'text';
+      input.setAttribute('data-rr-is-password', 'true');
+      expect(isProtectedInput(input)).toBe(true);
+    });
+
+    it('does not protect an ordinary text input', () => {
+      const input = document.createElement('input');
+      input.type = 'text';
+      expect(isProtectedInput(input)).toBe(false);
+    });
+
+    it('protects by the autocomplete attribute even when the IDL getter reports it empty', () => {
+      // Browsers expose the *parsed* autofill value through the IDL property,
+      // which is '' when the token order is invalid. The attribute still says
+      // cc-number, and that is what a masking decision must read.
+      const input = document.createElement('input');
+      input.type = 'text';
+      input.setAttribute('autocomplete', 'cc-number shipping');
+      Object.defineProperty(input, 'autocomplete', { get: () => '' });
+      expect(isProtectedInput(input)).toBe(true);
+    });
+
+    it('fails closed when the type getter throws', () => {
+      // A proxied or cross-realm element can throw "Illegal invocation" on
+      // property access; a masking decision must not propagate that.
+      const input = document.createElement('input');
+      Object.defineProperty(input, 'type', {
+        get: () => {
+          throw new TypeError('Illegal invocation');
+        },
+      });
+      expect(isProtectedInput(input)).toBe(true);
+    });
+
+    it('fails closed when the autocomplete getter throws', () => {
+      const input = document.createElement('input');
+      input.type = 'text';
+      Object.defineProperty(input, 'autocomplete', {
+        get: () => {
+          throw new TypeError('Illegal invocation');
+        },
+      });
+      input.getAttribute = () => {
+        throw new TypeError('Illegal invocation');
+      };
+      expect(isProtectedInput(input)).toBe(true);
+    });
+
+    it('protects a multi-token autocomplete that carries a protected token', () => {
+      const input = document.createElement('input');
+      input.type = 'text';
+      input.setAttribute('autocomplete', 'section-pay shipping cc-number');
+      expect(isProtectedInput(input)).toBe(true);
+    });
+  });
 });
diff --git a/packages/rrweb/src/index.ts b/packages/rrweb/src/index.ts
index 3ae4ae05aa..0ce40746c8 100644
--- a/packages/rrweb/src/index.ts
+++ b/packages/rrweb/src/index.ts
@@ -26,13 +26,11 @@ export type { recordOptions, ReplayPlugin } from './types';
 export type {
   PrivacyAction,
   PrivacyDetectorOptions,
-  PrivacyMaskStyle,
   PrivacyPolicy,
   PrivacyPreset,
   PrivacyRule,
   PrivacyTarget,
   PrivacyUrlOptions,
-  SensitiveDataKind,
 } from 'rrweb-snapshot';
 
 const { addCustomEvent } = record;
diff --git a/packages/rrweb/src/record/index.ts b/packages/rrweb/src/record/index.ts
index f62862244f..61bd55844f 100644
--- a/packages/rrweb/src/record/index.ts
+++ b/packages/rrweb/src/record/index.ts
@@ -4,8 +4,9 @@ import {
   type MaskInputOptions,
   createMirror,
   compilePrivacyPolicy,
-  mergeBlockSelectors,
-  sanitizeUrl,
+  type CompiledPrivacyPolicy,
+  resolvePrivacyContext,
+  sanitizeMetaUrl,
 } from 'rrweb-snapshot';
 import { initObservers, mutationBuffers } from './observer';
 import {
@@ -30,12 +31,16 @@ import {
   type scrollCallback,
   type canvasMutationParam,
   type adoptedStyleSheetParam,
+  type SamplingStrategy,
 } from '@rrweb/types';
 import type { CrossOriginIframeMessageEventContent } from '../types';
 import { IframeManager } from './iframe-manager';
 import { ShadowDomManager } from './shadow-dom-manager';
 import { CanvasManager } from './observers/canvas/canvas-manager';
-import { isCanvasMaskingConfigured } from './observers/canvas/canvas-mask';
+import {
+  isCanvasMaskingConfigured,
+  resolveCanvasSampling,
+} from './observers/canvas/canvas-mask';
 import { StylesheetManager } from './stylesheet-manager';
 import ProcessedNodeManager from './processed-node-manager';
 import {
@@ -51,6 +56,8 @@ let takeFullSnapshot!: (isCheckout?: boolean) => void;
 let canvasManager!: CanvasManager;
 let recording = false;
 
+let warnedStrictDisablesCanvas = false;
+
 // Multiple tools (i.e. MooTools, Prototype.js) override Array.from and drop support for the 2nd parameter
 // Try to pull a clean implementation from a newly created iframe
 try {
@@ -74,11 +81,12 @@ function record<T = eventWithTime>(
     checkoutEveryNms,
     checkoutEveryNth,
     blockClass = 'rr-block',
-    blockSelector: legacyBlockSelector = null,
+    blockSelector: manualBlockSelector = null,
     ignoreClass = 'rr-ignore',
     ignoreSelector = null,
     maskTextClass = 'rr-mask',
-    maskTextSelector = null,
+    maskTextSelector: manualMaskTextSelector = null,
+    unmaskTextSelector: manualUnmaskTextSelector = null,
     inlineStylesheet = true,
     maskAllInputs,
     maskInputOptions: _maskInputOptions,
@@ -89,7 +97,7 @@ function record<T = eventWithTime>(
     maskAttributeFn,
     hooks,
     packFn,
-    sampling = {},
+    sampling: requestedSampling = {},
     dataURLOptions = {},
     canvasMasking,
     mousemoveWait,
@@ -116,16 +124,46 @@ function record<T = eventWithTime>(
         : policy,
     privacyPolicy,
   );
-  const privacy = compilePrivacyPolicy(portablePrivacyPolicy);
-  const blockSelector = mergeBlockSelectors(legacyBlockSelector, privacy);
-  // Strict remains fail-closed for the whole canvas. Region providers are
-  // available to balanced/custom/legacy policies, where the application owns
-  // the completeness of those regions.
-  const recordCanvas =
-    requestedRecordCanvas && privacy?.policy.preset !== 'strict';
+  let compiledPrivacy: CompiledPrivacyPolicy;
+  try {
+    compiledPrivacy = compilePrivacyPolicy(portablePrivacyPolicy);
+  } catch (error) {
+    if (portablePrivacyPolicy !== privacyPolicy) {
+      console.error(
+        '[rrweb] plugin-transformed privacy policy failed to compile; using the user policy',
+        error,
+      );
+      compiledPrivacy = compilePrivacyPolicy(privacyPolicy);
+    } else {
+      throw error;
+    }
+  }
+  const { privacy, blockSelector, maskTextSelector } = resolvePrivacyContext({
+    privacy: compiledPrivacy,
+    blockSelector: manualBlockSelector,
+    maskTextSelector: manualMaskTextSelector,
+    unmaskTextSelector: manualUnmaskTextSelector,
+  });
+  // Strict stays fail-closed for the whole canvas; region providers apply
+  // only to balanced/minimal, where the application owns region completeness.
+  const recordCanvas = requestedRecordCanvas && !privacy.blockMedia;
+  if (
+    requestedRecordCanvas &&
+    privacy.blockMedia &&
+    !warnedStrictDisablesCanvas
+  ) {
+    warnedStrictDisablesCanvas = true;
+    console.warn(
+      "privacyPolicy preset 'strict' disables canvas recording; recordCanvas ignored",
+    );
+  }
   const canvasMaskingConfigured = canvasMasking
     ? () => isCanvasMaskingConfigured(canvasMasking)
     : undefined;
+  const sampling: SamplingStrategy = {
+    ...requestedSampling,
+    canvas: resolveCanvasSampling(requestedSampling.canvas, canvasMasking),
+  };
 
   registerErrorHandler(errorHandler);
 
@@ -298,7 +336,6 @@ function record<T = eventWithTime>(
   const stylesheetManager = new StylesheetManager({
     mutationCb: wrappedMutationEmit,
     adoptedStyleSheetCb: wrappedAdoptedStyleSheetEmit,
-    privacy,
   });
 
   const iframeManager = new IframeManager({
@@ -374,7 +411,12 @@ function record<T = eventWithTime>(
       {
         type: EventType.Meta,
         data: {
-          href: sanitizeUrl(window.location.href, privacy),
+          // Meta's `href` is a required string; '' is the inert fallback for
+          // an unparseable URL, which `sanitizeMetaUrl` otherwise drops
+          // (null). `sanitizeMetaUrl` masks only blocked-list params, even
+          // under `strict` -- see its doc comment for why the Meta event's
+          // own URL is scoped differently than a DOM URL attribute.
+          href: sanitizeMetaUrl(window.location.href, privacy) ?? '',
           width: getWindowWidth(),
           height: getWindowHeight(),
         },
@@ -405,7 +447,7 @@ function record<T = eventWithTime>(
       recordCanvas,
       canvasMaskingConfigured,
       inlineImages,
-      privacyPolicy: portablePrivacyPolicy,
+      privacy,
       onSerialize: (n) => {
         if (isSerializedIframe(n, mirror)) {
           iframeManager.addIframe(n as HTMLIFrameElement);
diff --git a/packages/rrweb/src/record/mutation.ts b/packages/rrweb/src/record/mutation.ts
index 4aa072069c..b1b56e2856 100644
--- a/packages/rrweb/src/record/mutation.ts
+++ b/packages/rrweb/src/record/mutation.ts
@@ -5,12 +5,14 @@ import {
   ignoreAttribute,
   isShadowRoot,
   needMaskingText,
-  maskAttributeWithPrivacy,
-  protectSerializedAttribute,
-  getPrivacyAction,
-  maskInputWithPrivacy,
-  maskInputValue,
-  maskTextWithPrivacy,
+  splitMaskAllSelector,
+  type MaskTextSelector,
+  maskInput,
+  finalizeAttributes,
+  resolveTextValue,
+  resolveUnmaskTextSelector,
+  FORM_VALUE_TAGS,
+  isProtectedTypeLike,
   Mirror,
   isNativeShadowDom,
   getInputType,
@@ -39,6 +41,10 @@ import {
 } from '../utils';
 import dom from '@rrweb/utils';
 
+type attributeCursorWithGenerated = attributeCursor & {
+  generatedAttributes?: Set<string>;
+};
+
 type DoubleLinkedListNode = {
   previous: DoubleLinkedListNode | null;
   next: DoubleLinkedListNode | null;
@@ -147,9 +153,8 @@ export default class MutationBuffer {
   private locked = false;
 
   private texts: textCursor[] = [];
-  private attributes: attributeCursor[] = [];
-  private attributeMap = new WeakMap<Node, attributeCursor>();
-  private generatedAttributes = new WeakMap<Node, Set<string>>();
+  private attributes: attributeCursorWithGenerated[] = [];
+  private attributeMap = new WeakMap<Node, attributeCursorWithGenerated>();
   private removes: removedNodeMutation[] = [];
   private mapRemoves: Node[] = [];
 
@@ -182,6 +187,32 @@ export default class MutationBuffer {
   private blockSelector: observerParam['blockSelector'];
   private maskTextClass: observerParam['maskTextClass'];
   private maskTextSelector: observerParam['maskTextSelector'];
+  /** Backing store for the `effectiveUnmaskTextSelector` getter below. */
+  private unmaskProbe: { probed: boolean; value: string | null } = {
+    probed: false,
+    value: null,
+  };
+  /** Derived lazily and invalidated (never assigned) per flush: `emit()` also runs outside `processMutations`, via `unfreeze()`/`unlock()`. */
+  private get effectiveUnmaskTextSelector(): string | null {
+    if (!this.unmaskProbe.probed) {
+      this.unmaskProbe.value = resolveUnmaskTextSelector(
+        this.doc,
+        this.privacy?.unmaskTextSelector ?? null,
+      );
+      this.unmaskProbe.probed = true;
+    }
+    return this.unmaskProbe.value;
+  }
+  /** Backing store for the `splitMaskTextSelector` getter below. */
+  private splitMaskTextSelectorCache: MaskTextSelector | null = null;
+  /** Always derived, never assigned: an unset field would fail open to "no mask selectors". */
+  private get splitMaskTextSelector(): MaskTextSelector {
+    return (this.splitMaskTextSelectorCache ??= splitMaskAllSelector(
+      this.maskTextSelector,
+    ));
+  }
+  /** `needMaskingText` results memoised for one synchronous flush; not shared across flushes. */
+  private maskDecisionCache = new Map<Node, boolean>();
   private inlineStylesheet: observerParam['inlineStylesheet'];
   private maskInputOptions: observerParam['maskInputOptions'];
   private maskTextFn: observerParam['maskTextFn'];
@@ -237,6 +268,9 @@ export default class MutationBuffer {
       // just a type trick, the runtime result is correct
       this[key] = options[key] as never;
     });
+    // Everything derived from the options above is re-derived on next use.
+    this.splitMaskTextSelectorCache = null;
+    this.unmaskProbe.probed = false;
   }
 
   public freeze() {
@@ -271,8 +305,30 @@ export default class MutationBuffer {
   }
 
   public processMutations = (mutations: mutationRecord[]) => {
-    mutations.forEach(this.processMutation); // adds mutations to the buffer
-    this.emit(); // clears buffer if not locked/frozen
+    this.unmaskProbe.probed = false;
+    this.maskDecisionCache.clear();
+    try {
+      mutations.forEach(this.processMutation); // adds mutations to the buffer
+      this.emit(); // clears buffer if not locked/frozen
+    } finally {
+      this.maskDecisionCache.clear();
+      this.unmaskProbe.probed = false;
+    }
+  };
+
+  private needMaskingTextForCharacterData = (node: Node): boolean => {
+    const key: Node = dom.parentElement(node) || node;
+    const cached = this.maskDecisionCache.get(key);
+    if (cached !== undefined) return cached;
+    const decision = needMaskingText(
+      node,
+      this.maskTextClass,
+      this.splitMaskTextSelector,
+      this.effectiveUnmaskTextSelector,
+      true, // checkAncestors
+    );
+    this.maskDecisionCache.set(key, decision);
+    return decision;
   };
 
   public emit = () => {
@@ -307,7 +363,9 @@ export default class MutationBuffer {
       }
       let cssCaptured = false;
       if (n.nodeType === Node.TEXT_NODE) {
-        const parentTag = (parent as Element).tagName;
+        // `parent` can be an arbitrary element (e.g. a <form>), whose
+        // `tagName` may be shadowed by a same-named descendant control.
+        const parentTag = dom.untaintedTagName(parent as Element | null);
         if (parentTag === 'TEXTAREA') {
           // genTextAreaValueMutation already called via parent
           return;
@@ -332,13 +390,17 @@ export default class MutationBuffer {
         blockClass: this.blockClass,
         blockSelector: this.blockSelector,
         maskTextClass: this.maskTextClass,
-        maskTextSelector: this.maskTextSelector,
+        maskTextSelector: this.splitMaskTextSelector,
+        unmaskTextSelector: this.effectiveUnmaskTextSelector,
+        unresolvedUnmaskTextSelector: this.privacy?.unmaskTextSelector ?? null,
         skipChild: true,
         newlyAddedElement: true,
         inlineStylesheet: this.inlineStylesheet,
         maskInputOptions: this.maskInputOptions,
         maskTextFn: this.maskTextFn,
         maskInputFn: this.maskInputFn,
+        maskAllElementAttributes: this.maskAllElementAttributes,
+        maskAttributeFn: this.maskAttributeFn,
         privacy: this.privacy,
         slimDOMOptions: this.slimDOMOptions,
         dataURLOptions: this.dataURLOptions,
@@ -469,7 +531,7 @@ export default class MutationBuffer {
         .map((text) => {
           const n = text.node;
           const parent = dom.parentNode(n);
-          if (parent && (parent as Element).tagName === 'TEXTAREA') {
+          if (dom.untaintedTagName(parent as Element | null) === 'TEXTAREA') {
             // the node is being ignored as it isn't in the mirror, so shift mutation to attributes on parent textarea
             this.genTextAreaValueMutation(parent as HTMLTextAreaElement);
           }
@@ -485,19 +547,7 @@ export default class MutationBuffer {
       attributes: this.attributes
         .map((attribute) => {
           const { attributes } = attribute;
-          const styleAction = getPrivacyAction(
-            attribute.node as Element,
-            this.privacy,
-            'style',
-            true,
-          );
-          if (
-            !this.maskAllElementAttributes &&
-            !this.maskAttributeFn &&
-            styleAction !== 'mask' &&
-            styleAction !== 'exclude' &&
-            typeof attributes.style === 'string'
-          ) {
+          if (typeof attributes.style === 'string') {
             const diffAsStr = JSON.stringify(attribute.styleDiff);
             const unchangedAsStr = JSON.stringify(attribute._unchangedStyles);
             // check if the style diff is actually shorter than the regular string based mutation
@@ -513,23 +563,13 @@ export default class MutationBuffer {
               }
             }
           }
-          if (this.maskAllElementAttributes || this.maskAttributeFn) {
-            for (const [name, value] of Object.entries(attributes)) {
-              if (typeof value === 'string' || value === null) {
-                attributes[name] = protectSerializedAttribute({
-                  element: attribute.node as Element,
-                  name,
-                  value,
-                  privacy: this.privacy,
-                  maskAllElementAttributes: this.maskAllElementAttributes,
-                  maskAttributeFn: this.maskAttributeFn,
-                  isGenerated: this.generatedAttributes
-                    .get(attribute.node)
-                    ?.has(name),
-                });
-              }
-            }
-          }
+          finalizeAttributes(attributes, {
+            element: attribute.node as Element,
+            privacy: this.privacy,
+            maskAllElementAttributes: this.maskAllElementAttributes,
+            maskAttributeFn: this.maskAttributeFn,
+            generatedAttributes: attribute.generatedAttributes,
+          });
           return {
             id: this.mirror.getId(attribute.node),
             attributes: attributes,
@@ -555,8 +595,7 @@ export default class MutationBuffer {
     // reset
     this.texts = [];
     this.attributes = [];
-    this.attributeMap = new WeakMap<Node, attributeCursor>();
-    this.generatedAttributes = new WeakMap<Node, Set<string>>();
+    this.attributeMap = new WeakMap<Node, attributeCursorWithGenerated>();
     this.removes = [];
     this.addedSet = new Set<Node>();
     this.movedSet = new Set<Node>();
@@ -584,29 +623,17 @@ export default class MutationBuffer {
       (cn) => dom.textContent(cn) || '',
     ).join('');
     const type = getInputType(textarea);
-    if (this.privacy) {
-      const legacyMask = Boolean(
-        this.maskInputOptions.textarea ||
-          (type &&
-            this.maskInputOptions[type as keyof typeof this.maskInputOptions]),
-      );
-      item.attributes.value = maskInputWithPrivacy(
-        value,
-        textarea,
-        this.privacy,
-        legacyMask,
-        this.maskInputFn,
-      );
-    } else {
-      item.attributes.value = maskInputValue({
-        element: textarea,
-        maskInputOptions: this.maskInputOptions,
-        tagName: textarea.tagName,
-        type,
-        value,
-        maskInputFn: this.maskInputFn,
-      });
-    }
+    // callers reach this only after matching `.tagName` to 'TEXTAREA' via
+    // `untaintedTagName`, so a raw `textarea.tagName` read here is safe.
+    item.attributes.value = maskInput({
+      element: textarea,
+      maskInputOptions: this.maskInputOptions,
+      tagName: textarea.tagName,
+      type,
+      value,
+      maskInputFn: this.maskInputFn,
+      privacy: this.privacy,
+    });
   };
 
   private processMutation = (m: mutationRecord) => {
@@ -622,30 +649,16 @@ export default class MutationBuffer {
           value !== m.oldValue
         ) {
           this.texts.push({
-            value:
-              value && this.privacy
-                ? maskTextWithPrivacy(
-                    value,
-                    closestElementOfNode(m.target),
-                    this.privacy,
-                    needMaskingText(
-                      m.target,
-                      this.maskTextClass,
-                      this.maskTextSelector,
-                      true, // checkAncestors
-                    ),
-                    this.maskTextFn,
-                  )
-                : needMaskingText(
-                    m.target,
-                    this.maskTextClass,
-                    this.maskTextSelector,
-                    true, // checkAncestors
-                  ) && value
-                ? this.maskTextFn
-                  ? this.maskTextFn(value, closestElementOfNode(m.target))
-                  : value.replace(/[\S]/g, '*')
-                : value,
+            value: value
+              ? resolveTextValue({
+                  value,
+                  parent: closestElementOfNode(m.target),
+                  needsMask: this.needMaskingTextForCharacterData(m.target),
+                  maskTextFn: this.maskTextFn,
+                  privacy: this.privacy,
+                  exemptScript: false,
+                })
+              : value,
             node: m.target,
           });
         }
@@ -656,36 +669,27 @@ export default class MutationBuffer {
         let attributeName = m.attributeName as string;
         let value = (m.target as HTMLElement).getAttribute(attributeName);
 
-        if (attributeName === 'value') {
+        // `value` means "input value" on FORM_VALUE_TAGS and on any element
+        // whose own `type`/`autocomplete` declares a credential -- a
+        // component library's `<ion-input type="password">` is not an INPUT
+        // but discloses one just the same. Everywhere else `value` is an
+        // ordinary attribute and falls through to `finalizeAttribute`.
+        const targetTagName = dom.untaintedTagName(target);
+        if (
+          attributeName === 'value' &&
+          (FORM_VALUE_TAGS.has(targetTagName) || isProtectedTypeLike(target))
+        ) {
           const type = getInputType(target);
 
-          if (this.privacy) {
-            const legacyMask = Boolean(
-              this.maskInputOptions[
-                target.tagName.toLowerCase() as keyof typeof this.maskInputOptions
-              ] ||
-                (type &&
-                  this.maskInputOptions[
-                    type as keyof typeof this.maskInputOptions
-                  ]),
-            );
-            value = maskInputWithPrivacy(
-              value || '',
-              target,
-              this.privacy,
-              legacyMask,
-              this.maskInputFn,
-            );
-          } else {
-            value = maskInputValue({
-              element: target,
-              maskInputOptions: this.maskInputOptions,
-              tagName: target.tagName,
-              type,
-              value,
-              maskInputFn: this.maskInputFn,
-            });
-          }
+          value = maskInput({
+            element: target,
+            maskInputOptions: this.maskInputOptions,
+            tagName: targetTagName,
+            type,
+            value: value || '',
+            maskInputFn: this.maskInputFn,
+            privacy: this.privacy,
+          });
         }
         if (
           isBlocked(m.target, this.blockClass, this.blockSelector, false) ||
@@ -696,7 +700,7 @@ export default class MutationBuffer {
 
         let item = this.attributeMap.get(m.target);
         if (
-          target.tagName === 'IFRAME' &&
+          targetTagName === 'IFRAME' &&
           attributeName === 'src' &&
           !this.keepIframeSrcFn(value as string)
         ) {
@@ -723,28 +727,21 @@ export default class MutationBuffer {
         // This is used to ensure we do not unmask value when using e.g. a "Show password" type button
         if (
           attributeName === 'type' &&
-          target.tagName === 'INPUT' &&
+          targetTagName === 'INPUT' &&
           (m.oldValue || '').toLowerCase() === 'password'
         ) {
           target.setAttribute('data-rr-is-password', 'true');
         }
 
-        if (!ignoreAttribute(target.tagName, attributeName, value)) {
+        if (!ignoreAttribute(targetTagName, attributeName, value)) {
+          item.generatedAttributes?.delete(attributeName);
           // overwrite attribute if the mutations was triggered in same time
-          const transformed = transformAttribute(
+          item.attributes[attributeName] = transformAttribute(
             this.doc,
-            toLowerCase(target.tagName),
+            toLowerCase(targetTagName),
             toLowerCase(attributeName),
             value,
           );
-          item.attributes[attributeName] = this.privacy
-            ? maskAttributeWithPrivacy(
-                target,
-                attributeName,
-                transformed,
-                this.privacy,
-              )
-            : transformed;
           if (attributeName === 'style') {
             if (!this.unattachedDoc) {
               try {
@@ -768,21 +765,9 @@ export default class MutationBuffer {
                 newPriority !== old.style.getPropertyPriority(pname)
               ) {
                 if (newPriority === '') {
-                  item.styleDiff[pname] = this.privacy
-                    ? maskTextWithPrivacy(newValue, target, this.privacy, false)
-                    : newValue;
+                  item.styleDiff[pname] = newValue;
                 } else {
-                  item.styleDiff[pname] = [
-                    this.privacy
-                      ? maskTextWithPrivacy(
-                          newValue,
-                          target,
-                          this.privacy,
-                          false,
-                        )
-                      : newValue,
-                    newPriority,
-                  ];
+                  item.styleDiff[pname] = [newValue, newPriority];
                 }
               } else {
                 // for checking
@@ -795,18 +780,13 @@ export default class MutationBuffer {
                 item.styleDiff[pname] = false; // delete
               }
             }
-          } else if (attributeName === 'open' && target.tagName === 'DIALOG') {
+          } else if (attributeName === 'open' && targetTagName === 'DIALOG') {
             if (target.matches('dialog:modal')) {
               item.attributes['rr_open_mode'] = 'modal';
             } else {
               item.attributes['rr_open_mode'] = 'non-modal';
             }
-            let generated = this.generatedAttributes.get(m.target);
-            if (!generated) {
-              generated = new Set();
-              this.generatedAttributes.set(m.target, generated);
-            }
-            generated.add('rr_open_mode');
+            (item.generatedAttributes ||= new Set()).add('rr_open_mode');
           }
         }
         break;
@@ -818,7 +798,7 @@ export default class MutationBuffer {
         if (isBlocked(m.target, this.blockClass, this.blockSelector, true))
           return;
 
-        if ((m.target as Element).tagName === 'TEXTAREA') {
+        if (dom.untaintedTagName(m.target as Element) === 'TEXTAREA') {
           // children would be ignored in genAdds as they aren't in the mirror
           this.genTextAreaValueMutation(m.target as HTMLTextAreaElement);
           return; // any removedNodes won't have been in mirror either
diff --git a/packages/rrweb/src/record/observer.ts b/packages/rrweb/src/record/observer.ts
index 99e476b1ee..02010d0d1f 100644
--- a/packages/rrweb/src/record/observer.ts
+++ b/packages/rrweb/src/record/observer.ts
@@ -1,10 +1,8 @@
 import {
-  type MaskInputOptions,
-  maskInputWithPrivacy,
-  maskTextWithPrivacy,
-  shouldMaskInputWithPrivacy,
+  maskInput,
   Mirror,
   getInputType,
+  isEventIgnored,
   toLowerCase,
 } from 'rrweb-snapshot';
 import type { FontFaceSet } from 'css-font-loading-module';
@@ -391,9 +389,9 @@ function initInputObserver({
   ignoreSelector,
   maskInputOptions,
   maskInputFn,
-  privacy,
   sampling,
   userTriggeredOnInput,
+  privacy,
 }: observerParam): listenerHandler {
   function eventHandler(event: Event) {
     let target = getEventTarget(event) as HTMLElement | null;
@@ -422,6 +420,9 @@ function initInputObserver({
     ) {
       return;
     }
+    if (isEventIgnored(target, privacy)) {
+      return;
+    }
     let text = (target as HTMLInputElement).value;
     let isChecked = false;
     const type: Lowercase<string> = getInputType(target) || '';
@@ -429,19 +430,15 @@ function initInputObserver({
     if (type === 'radio' || type === 'checkbox') {
       isChecked = (target as HTMLInputElement).checked;
     } else {
-      const legacyMask = Boolean(
-        maskInputOptions[tagName.toLowerCase() as keyof MaskInputOptions] ||
-          maskInputOptions[type as keyof MaskInputOptions],
-      );
-      if (shouldMaskInputWithPrivacy(target, privacy, legacyMask)) {
-        text = maskInputWithPrivacy(
-          text,
-          target,
-          privacy,
-          legacyMask,
-          maskInputFn,
-        );
-      }
+      text = maskInput({
+        element: target,
+        maskInputOptions,
+        tagName,
+        type,
+        value: text,
+        maskInputFn,
+        privacy,
+      });
     }
     cbWithDedup(
       target,
@@ -456,7 +453,7 @@ function initInputObserver({
       doc
         .querySelectorAll(`input[type="radio"][name="${name}"]`)
         .forEach((el) => {
-          if (el !== target) {
+          if (el !== target && !isEventIgnored(el, privacy)) {
             const text = (el as HTMLInputElement).value;
             cbWithDedup(
               el,
@@ -594,29 +591,8 @@ function getIdAndStyleId(
   };
 }
 
-function stylesheetOwnerElement(
-  sheet: CSSStyleSheet | null | undefined,
-): HTMLElement | null {
-  const owner = sheet?.ownerNode;
-  return owner instanceof Element ? (owner as HTMLElement) : null;
-}
-
-function maskCssForRecord(
-  value: string,
-  sheet: CSSStyleSheet | null | undefined,
-  privacy: observerParam['privacy'],
-): string {
-  if (!value || !privacy) return value;
-  return maskTextWithPrivacy(
-    value,
-    stylesheetOwnerElement(sheet),
-    privacy,
-    false,
-  );
-}
-
 function initStyleSheetObserver(
-  { styleSheetRuleCb, mirror, stylesheetManager, privacy }: observerParam,
+  { styleSheetRuleCb, mirror, stylesheetManager }: observerParam,
   { win }: { win: IWindow },
 ): listenerHandler {
   if (!win.CSSStyleSheet || !win.CSSStyleSheet.prototype) {
@@ -647,7 +623,7 @@ function initStyleSheetObserver(
           styleSheetRuleCb({
             id,
             styleId,
-            adds: [{ rule: maskCssForRecord(rule, thisArg, privacy), index }],
+            adds: [{ rule, index }],
           });
         }
         return target.apply(thisArg, argumentsList);
@@ -727,7 +703,7 @@ function initStyleSheetObserver(
             styleSheetRuleCb({
               id,
               styleId,
-              replace: maskCssForRecord(text, thisArg, privacy),
+              replace: text,
             });
           }
           return target.apply(thisArg, argumentsList);
@@ -759,7 +735,7 @@ function initStyleSheetObserver(
             styleSheetRuleCb({
               id,
               styleId,
-              replaceSync: maskCssForRecord(text, thisArg, privacy),
+              replaceSync: text,
             });
           }
           return target.apply(thisArg, argumentsList);
@@ -827,11 +803,7 @@ function initStyleSheetObserver(
                 styleId,
                 adds: [
                   {
-                    rule: maskCssForRecord(
-                      rule,
-                      thisArg.parentStyleSheet,
-                      privacy,
-                    ),
+                    rule,
                     index: [
                       ...getNestedCSSRulePositions(thisArg),
                       index || 0, // defaults to 0
@@ -962,7 +934,6 @@ function initStyleDeclarationObserver(
     mirror,
     ignoreCSSAttributes,
     stylesheetManager,
-    privacy,
   }: observerParam,
   { win }: { win: IWindow },
 ): listenerHandler {
@@ -992,11 +963,7 @@ function initStyleDeclarationObserver(
             styleId,
             set: {
               property,
-              value: maskCssForRecord(
-                value,
-                thisArg.parentRule?.parentStyleSheet,
-                privacy,
-              ),
+              value,
               priority,
             },
             // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
diff --git a/packages/rrweb/src/record/observers/canvas/canvas-manager.ts b/packages/rrweb/src/record/observers/canvas/canvas-manager.ts
index 94e149aa8c..aaeb5d5e62 100644
--- a/packages/rrweb/src/record/observers/canvas/canvas-manager.ts
+++ b/packages/rrweb/src/record/observers/canvas/canvas-manager.ts
@@ -18,7 +18,11 @@ import initCanvasContextObserver from './canvas';
 import initCanvasWebGLMutationObserver from './webgl';
 import ImageBitmapDataURLWorker from '../../workers/image-bitmap-data-url-worker?worker&inline';
 import type { ImageBitmapDataURLRequestWorker } from '../../workers/image-bitmap-data-url-worker';
-import { computeFrameMaskRegions, SKIP_FRAME } from './canvas-mask';
+import {
+  computeFrameMaskRegions,
+  resolveFrameDisplaySize,
+  SKIP_FRAME,
+} from './canvas-mask';
 
 export type RafStamps = { latestId: number; invokeId: number | null };
 
@@ -38,12 +42,25 @@ export class CanvasManager {
   private locked = false;
   private resetFrameDedup?: () => void;
 
+  /** Shadow roots FPS canvas discovery searches directly, kept in sync by the shadow-DOM manager. */
+  private trackedShadowRoots = new Set<ShadowRoot>();
+
   public reset() {
     this.pendingCanvasMutations.clear();
     this.resetObservers && this.resetObservers();
     this.resetFrameDedup = undefined;
   }
 
+  /** Called by the shadow-DOM manager when it starts observing a shadow root. */
+  public addShadowRoot(shadowRoot: ShadowRoot) {
+    this.trackedShadowRoots.add(shadowRoot);
+  }
+
+  /** Called by the shadow-DOM manager when it stops observing a shadow root. */
+  public removeShadowRoot(shadowRoot: ShadowRoot) {
+    this.trackedShadowRoots.delete(shadowRoot);
+  }
+
   /** Start a new canvas frame epoch after a DOM full snapshot. */
   public onFullSnapshot() {
     this.resetFrameDedup?.();
@@ -190,21 +207,19 @@ export class CanvasManager {
     let lastSnapshotTime = 0;
     const getCanvas = (): HTMLCanvasElement[] => {
       const matchedCanvas: HTMLCanvasElement[] = [];
-      const search = (root: ParentNode) => {
+      const collect = (root: ParentNode) => {
         try {
           root.querySelectorAll('canvas').forEach((canvas) => {
             if (!isBlocked(canvas, blockClass, blockSelector, true)) {
               matchedCanvas.push(canvas);
             }
           });
-          root.querySelectorAll('*').forEach((element) => {
-            if (element.shadowRoot) search(element.shadowRoot);
-          });
         } catch {
           // A broken custom DOM implementation must not cancel future frames.
         }
       };
-      search(win.document);
+      collect(win.document);
+      this.trackedShadowRoots.forEach((root) => collect(root));
       return matchedCanvas;
     };
 
@@ -257,15 +272,21 @@ export class CanvasManager {
                 context.clear(context.COLOR_BUFFER_BIT);
               }
             }
-            const displayWidth = canvas.clientWidth || canvas.width;
-            const displayHeight = canvas.clientHeight || canvas.height;
+            const displaySize = resolveFrameDisplaySize(
+              options.canvasMasking,
+              canvas,
+            );
+            if (displaySize === SKIP_FRAME) {
+              snapshotInProgressMap.set(id, false);
+              return;
+            }
             const maskRegions = computeFrameMaskRegions(
               options.canvasMasking,
               canvas,
               canvas.width,
               canvas.height,
-              displayWidth,
-              displayHeight,
+              displaySize.width,
+              displaySize.height,
             );
             if (maskRegions === SKIP_FRAME) {
               snapshotInProgressMap.set(id, false);
diff --git a/packages/rrweb/src/record/observers/canvas/canvas-mask.ts b/packages/rrweb/src/record/observers/canvas/canvas-mask.ts
index 5c000c1c6b..61eb987afb 100644
--- a/packages/rrweb/src/record/observers/canvas/canvas-mask.ts
+++ b/packages/rrweb/src/record/observers/canvas/canvas-mask.ts
@@ -7,10 +7,7 @@ export type FrameMaskResult =
   | typeof SKIP_FRAME
   | undefined;
 
-/**
- * Compute and scale application-provided regions before any canvas pixels
- * cross into the encoding worker. Any ambiguous result fails closed.
- */
+/** Computes and scales application-provided regions before any canvas pixels cross into the encoding worker. */
 export function computeFrameMaskRegions(
   masking: CanvasMasking | undefined,
   canvas: HTMLCanvasElement,
@@ -39,7 +36,6 @@ export function computeFrameMaskRegions(
   return regions
     .filter((region) => region.width > 0 && region.height > 0)
     .map((region) => {
-      // Round outward so fractional scaling never leaves a sliver exposed.
       const left = Math.floor(region.x * scaleX);
       const top = Math.floor(region.y * scaleY);
       return {
@@ -51,6 +47,59 @@ export function computeFrameMaskRegions(
     });
 }
 
+/**
+ * The content box in layout CSS pixels. `clientWidth`/`clientHeight` are used
+ * rather than `getBoundingClientRect()`: the rect is post-transform, so a
+ * canvas under `transform: scale(k)` would scale regions by 1/k and leave part
+ * of the secret visible. Client dimensions are the padding box, so only the
+ * padding is subtracted.
+ */
+export function getCanvasContentBoxSize(
+  canvas: HTMLCanvasElement,
+): { width: number; height: number } | null {
+  let rect: { width: number; height: number };
+  try {
+    rect = { width: canvas.clientWidth, height: canvas.clientHeight };
+  } catch {
+    return null;
+  }
+  if (!rect || !Number.isFinite(rect.width) || !Number.isFinite(rect.height))
+    return null;
+
+  let style: CSSStyleDeclaration;
+  try {
+    style = getComputedStyle(canvas);
+  } catch {
+    return null;
+  }
+  if (!style) return null;
+
+  const px = (value: string): number => {
+    const parsed = parseFloat(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+  };
+
+  const width = rect.width - px(style.paddingLeft) - px(style.paddingRight);
+  const height = rect.height - px(style.paddingTop) - px(style.paddingBottom);
+
+  if (!(width > 0) || !(height > 0)) return null;
+
+  return { width, height };
+}
+
+export function resolveFrameDisplaySize(
+  masking: CanvasMasking | undefined,
+  canvas: HTMLCanvasElement,
+): { width: number; height: number } | typeof SKIP_FRAME {
+  if (!isCanvasMaskingConfigured(masking)) {
+    return {
+      width: canvas.clientWidth || canvas.width,
+      height: canvas.clientHeight || canvas.height,
+    };
+  }
+  return getCanvasContentBoxSize(canvas) ?? SKIP_FRAME;
+}
+
 export function isCanvasMaskingConfigured(
   masking: CanvasMasking | undefined,
 ): boolean {
@@ -76,3 +125,23 @@ function isValidRegion(region: unknown): region is CanvasMaskRegion {
     height >= 0
   );
 }
+
+/**
+ * A canvas masking provider, merely by being supplied, forces numeric FPS
+ * sampling: only that capture path can redact pixels. The decision keys on
+ * presence, not on `isConfigured()`, because the capture mode is fixed at
+ * `record()` while `isConfigured()` is re-read every frame; a provider that
+ * answered false at setup and true later would otherwise leave the
+ * mutation-mode command stream running with no masking path at all.
+ */
+export function resolveCanvasSampling(
+  requestedSampling: number | 'all' | undefined,
+  canvasMasking: CanvasMasking | undefined,
+): number | 'all' | undefined {
+  if (!canvasMasking) return requestedSampling;
+  if (typeof requestedSampling === 'number') return requestedSampling;
+  console.warn(
+    '[rrweb] canvasMasking requires FPS canvas capture; forcing sampling.canvas = 4',
+  );
+  return 4;
+}
diff --git a/packages/rrweb/src/record/shadow-dom-manager.ts b/packages/rrweb/src/record/shadow-dom-manager.ts
index 6ffd9941c6..c9ace11991 100644
--- a/packages/rrweb/src/record/shadow-dom-manager.ts
+++ b/packages/rrweb/src/record/shadow-dom-manager.ts
@@ -28,6 +28,8 @@ export class ShadowDomManager {
   private bypassOptions: BypassOptions;
   private mirror: Mirror;
   private restoreHandlers: (() => void)[] = [];
+  /** Iterable (unlike the `shadowDoms` WeakSet), so the canvas manager can be told when observation stops. */
+  private canvasTrackedShadowRoots = new Set<ShadowRoot>();
 
   constructor(options: {
     mutationCb: mutationCallBack;
@@ -53,6 +55,8 @@ export class ShadowDomManager {
     if (!isNativeShadowDom(shadowRoot)) return;
     if (this.shadowDoms.has(shadowRoot)) return;
     this.shadowDoms.add(shadowRoot);
+    this.canvasTrackedShadowRoots.add(shadowRoot);
+    this.bypassOptions.canvasManager.addShadowRoot(shadowRoot);
     const [observer] = initMutationObserver(
       {
         ...this.bypassOptions,
@@ -153,5 +157,9 @@ export class ShadowDomManager {
     });
     this.restoreHandlers = [];
     this.shadowDoms = new WeakSet();
+    this.canvasTrackedShadowRoots.forEach((shadowRoot) => {
+      this.bypassOptions.canvasManager.removeShadowRoot(shadowRoot);
+    });
+    this.canvasTrackedShadowRoots = new Set();
   }
 }
diff --git a/packages/rrweb/src/record/stylesheet-manager.ts b/packages/rrweb/src/record/stylesheet-manager.ts
index 258c16548e..796fec8064 100644
--- a/packages/rrweb/src/record/stylesheet-manager.ts
+++ b/packages/rrweb/src/record/stylesheet-manager.ts
@@ -1,8 +1,4 @@
-import {
-  maskTextWithPrivacy,
-  stringifyRule,
-  type CompiledPrivacyPolicy,
-} from 'rrweb-snapshot';
+import { stringifyRule } from 'rrweb-snapshot';
 import type {
   elementNode,
   serializedNodeWithId,
@@ -17,17 +13,14 @@ export class StylesheetManager {
   private trackedLinkElements: WeakSet<HTMLLinkElement> = new WeakSet();
   private mutationCb: mutationCallBack;
   private adoptedStyleSheetCb: adoptedStyleSheetCallback;
-  private privacy: CompiledPrivacyPolicy | undefined;
   public styleMirror = new StyleSheetMirror();
 
   constructor(options: {
     mutationCb: mutationCallBack;
     adoptedStyleSheetCb: adoptedStyleSheetCallback;
-    privacy?: CompiledPrivacyPolicy;
   }) {
     this.mutationCb = options.mutationCb;
     this.adoptedStyleSheetCb = options.adoptedStyleSheetCb;
-    this.privacy = options.privacy;
   }
 
   public attachLinkElement(
@@ -77,7 +70,7 @@ export class StylesheetManager {
           rules: Array.from(
             sheet.cssRules || sheet.rules || [],
             (r, index) => ({
-              rule: this.maskAdoptedRule(stringifyRule(r, sheet.href), sheet),
+              rule: stringifyRule(r, sheet.href),
               index,
             }),
           ),
@@ -94,17 +87,6 @@ export class StylesheetManager {
     this.trackedLinkElements = new WeakSet();
   }
 
-  private maskAdoptedRule(rule: string, sheet: CSSStyleSheet): string {
-    if (!rule || !this.privacy) return rule;
-    const owner = sheet.ownerNode;
-    return maskTextWithPrivacy(
-      rule,
-      owner instanceof Element ? (owner as HTMLElement) : null,
-      this.privacy,
-      false,
-    );
-  }
-
   // TODO: take snapshot on stylesheet reload by applying event listener
   private trackStylesheetInLinkElement(_linkEl: HTMLLinkElement) {
     // linkEl.addEventListener('load', () => {
diff --git a/packages/rrweb/src/types.ts b/packages/rrweb/src/types.ts
index 2bd58ed581..de62fa2aa5 100644
--- a/packages/rrweb/src/types.ts
+++ b/packages/rrweb/src/types.ts
@@ -55,6 +55,8 @@ export type recordOptions<T> = {
   ignoreSelector?: string;
   maskTextClass?: maskTextClass;
   maskTextSelector?: string;
+  /** A CSS selector whose matched elements are never text- or attribute-masked; merged with any `privacyPolicy` unmask/allow selectors. Input values are unaffected -- `maskInput` never reads it. */
+  unmaskTextSelector?: string | null;
   maskAllInputs?: boolean;
   maskInputOptions?: MaskInputOptions;
   maskInputFn?: MaskInputFn;
@@ -65,7 +67,7 @@ export type recordOptions<T> = {
   maskAttributeFn?: MaskAttributeFn;
   /**
    * Opt-in, versioned privacy policy. Existing masking options continue to
-   * provide the legacy baseline and are compiled alongside this policy.
+   * provide the manual baseline and are compiled alongside this policy.
    */
   privacyPolicy?: PrivacyPolicy;
   slimDOMOptions?: SlimDOMOptions | 'all' | true;
diff --git a/packages/rrweb/test/record.test.ts b/packages/rrweb/test/record.test.ts
index 4c243d31ef..0ae689b510 100644
--- a/packages/rrweb/test/record.test.ts
+++ b/packages/rrweb/test/record.test.ts
@@ -11,6 +11,7 @@ import {
   IncrementalSource,
   styleSheetRuleData,
   selectionData,
+  attributes,
 } from '@rrweb/types';
 import {
   assertSnapshot,
@@ -125,12 +126,17 @@ describe('record', function (this: ISuite) {
     await ctx.page.setContent(`
       <p id="contact" data-privacy="mask" title="initial@example.com">initial@example.com</p>
       <input id="name" data-privacy="mask" type="text" value="Initial Name" />
-      <input id="password" data-privacy="allow" type="password" value="secret" />
+      <input id="password" data-privacy="unmask" type="password" value="secret" />
+      <div data-privacy="block"><p>excluded text</p></div>
+      <p data-privacy="unmask">visible text</p>
     `);
     await ctx.page.evaluate(() => {
       const { record } = (window as unknown as IWindow).rrweb;
       record({
         emit: (window as unknown as IWindow).emit,
+        // `data-privacy` selectors are part of the v2 presets; a recording
+        // with no policy at all stays on minimal semantics by design.
+        privacyPolicy: { version: 1, preset: 'balanced' },
       });
 
       const contact = document.querySelector('#contact')!;
@@ -149,7 +155,10 @@ describe('record', function (this: ISuite) {
     expect(payload).not.toContain('Initial Name');
     expect(payload).not.toContain('Changed Name');
     expect(payload).not.toContain('secret');
-    expect(payload).toContain('xxxxxxx@xxxxxxx.xxx');
+    expect(payload).not.toContain('excluded text');
+    expect(payload).toContain('visible text');
+    // v2 masking is shape-free: stars only, no `xxxx@xxxx.xxx` shape mask.
+    expect(payload).toContain('*'.repeat('changed@example.com'.length));
   });
 
   it('applies detector plugins to the initial full snapshot', async () => {
@@ -168,7 +177,7 @@ describe('record', function (this: ISuite) {
             applyPrivacyPolicy(policy) {
               const portable = (policy as { version: 1; preset: string }) || {
                 version: 1,
-                preset: 'legacy',
+                preset: 'minimal',
               };
               return {
                 ...portable,
@@ -190,9 +199,10 @@ describe('record', function (this: ISuite) {
 
     const payload = JSON.stringify(ctx.events);
     expect(payload).not.toContain('person@example.com');
-    expect(payload).toContain('xxxxxx@xxxxxxx.xxx');
+    // v2: masking is shape-free, star-only (no digit/letter-preserving mask).
+    expect(payload).toContain('*'.repeat('person@example.com'.length));
     expect(payload).not.toContain('Visible Name');
-    expect(payload).toContain('xxxxxxx xxxx');
+    expect(payload).toContain('*'.repeat('Visible Name'.length));
   });
 
   it('applies final attribute masking to snapshots and mutations', async () => {
@@ -219,8 +229,60 @@ describe('record', function (this: ISuite) {
     const payload = JSON.stringify(ctx.events);
     expect(payload).not.toContain('initial@example.com');
     expect(payload).not.toContain('changed@example.com');
-    expect(payload).not.toContain('background-color');
     expect(payload).toContain('[MASKED]');
+    // CSS carried as an attribute is exempt from every masking path, so
+    // `maskAttributeFn` is never consulted for `style`.
+    expect(payload).toContain('background-color');
+  });
+
+  it('masks attributes of nodes added after recording starts', async () => {
+    await ctx.page.setContent(`<div id="root"></div>`);
+    await ctx.page.evaluate(() => {
+      const { record } = (window as unknown as IWindow).rrweb;
+      record({
+        emit: (window as unknown as IWindow).emit,
+        maskAllElementAttributes: true,
+      });
+
+      const added = document.createElement('div');
+      added.setAttribute('data-user', 'bob@x.com');
+      document.querySelector('#root')!.appendChild(added);
+    });
+    await waitForRAF(ctx.page);
+
+    const payload = JSON.stringify(ctx.events);
+    expect(payload).not.toContain('bob@x.com');
+    expect(payload).toContain('*'.repeat('bob@x.com'.length));
+  });
+
+  it('leaves the value attribute of non-form elements unmasked', async () => {
+    await ctx.page.setContent(`<ol><li id="item" value="3">three</li></ol>`);
+    await ctx.page.evaluate(() => {
+      const { record } = (window as unknown as IWindow).rrweb;
+      record({
+        emit: (window as unknown as IWindow).emit,
+        privacyPolicy: { version: 1, preset: 'balanced' },
+      });
+
+      document.querySelector('#item')!.setAttribute('value', '7');
+    });
+    await waitForRAF(ctx.page);
+
+    const attributeMutations = ctx.events
+      .filter(
+        (e) =>
+          e.type === EventType.IncrementalSnapshot &&
+          (e.data as { source: IncrementalSource }).source ===
+            IncrementalSource.Mutation,
+      )
+      .flatMap(
+        (e) =>
+          (e.data as unknown as { attributes: { attributes: attributes }[] })
+            .attributes,
+      );
+    expect(attributeMutations.some((m) => m.attributes.value === '7')).toBe(
+      true,
+    );
   });
 
   it('can checkout full snapshot by count', async () => {
diff --git a/packages/rrweb/test/record/canvas-mask.test.ts b/packages/rrweb/test/record/canvas-mask.test.ts
index 23dbf1cb51..a5762e7abc 100644
--- a/packages/rrweb/test/record/canvas-mask.test.ts
+++ b/packages/rrweb/test/record/canvas-mask.test.ts
@@ -1,8 +1,14 @@
-import { describe, expect, it } from 'vitest';
+/**
+ * @vitest-environment jsdom
+ */
+import { describe, expect, it, vi } from 'vitest';
 import type { CanvasMaskRegion, CanvasMasking } from '@rrweb/types';
 import {
   computeFrameMaskRegions,
+  getCanvasContentBoxSize,
   isCanvasMaskingConfigured,
+  resolveCanvasSampling,
+  resolveFrameDisplaySize,
   SKIP_FRAME,
 } from '../../src/record/observers/canvas/canvas-mask';
 
@@ -114,3 +120,226 @@ describe('canvas privacy masking', () => {
     ).toBe(true);
   });
 });
+
+describe('canvas content-box region scaling', () => {
+  it('uses the content box, not clientWidth, so padding does not skew the scale', () => {
+    const canvasEl = document.createElement('canvas');
+    canvasEl.width = 100;
+    canvasEl.height = 100;
+    canvasEl.style.padding = '20px';
+    document.body.appendChild(canvasEl);
+
+    // jsdom performs no layout, so getBoundingClientRect/clientWidth are
+    // stubbed to reflect what a real browser would report: a 100x100
+    // backing store padded by 20px on every side renders in a 140x140
+    // border box, while clientWidth (border box minus border) is also 140.
+    canvasEl.getBoundingClientRect = () =>
+      ({ width: 140, height: 140 } as DOMRect);
+    Object.defineProperty(canvasEl, 'clientWidth', { value: 140 });
+    Object.defineProperty(canvasEl, 'clientHeight', { value: 140 });
+
+    const contentBox = getCanvasContentBoxSize(canvasEl);
+    expect(contentBox).toEqual({ width: 100, height: 100 });
+
+    // Regions expressed in content-box CSS pixels must come back unscaled
+    // (scale 1) once the content box is used, even though naively using
+    // clientWidth (140) would have shrunk every coordinate incorrectly.
+    expect(
+      computeFrameMaskRegions(
+        { maskRegions: () => [region] },
+        canvasEl,
+        canvasEl.width,
+        canvasEl.height,
+        contentBox!.width,
+        contentBox!.height,
+      ),
+    ).toEqual([region]);
+
+    document.body.removeChild(canvasEl);
+  });
+
+  it('scales from layout dimensions, so a CSS transform cannot shrink the mask', () => {
+    // A canvas under transform: scale(2) reports a 280x280 bounding rect but
+    // its layout (client) box is still 140x140. Regions are authored in
+    // layout CSS pixels; scaling them by the transformed rect would paint
+    // them at half size and leave the other half of the secret visible.
+    const canvasEl = document.createElement('canvas');
+    canvasEl.width = 100;
+    canvasEl.height = 100;
+    canvasEl.style.padding = '20px';
+    document.body.appendChild(canvasEl);
+    canvasEl.getBoundingClientRect = () =>
+      ({ width: 280, height: 280 } as DOMRect);
+    Object.defineProperty(canvasEl, 'clientWidth', { value: 140 });
+    Object.defineProperty(canvasEl, 'clientHeight', { value: 140 });
+
+    expect(getCanvasContentBoxSize(canvasEl)).toEqual({
+      width: 100,
+      height: 100,
+    });
+    document.body.removeChild(canvasEl);
+  });
+
+  it('reports no content box (fail closed) when the content box has zero area', () => {
+    const canvasEl = document.createElement('canvas');
+    canvasEl.width = 100;
+    canvasEl.height = 100;
+    canvasEl.getBoundingClientRect = () => ({ width: 0, height: 0 } as DOMRect);
+    document.body.appendChild(canvasEl);
+
+    expect(getCanvasContentBoxSize(canvasEl)).toBeNull();
+
+    document.body.removeChild(canvasEl);
+  });
+});
+
+/** `record()` passes the provider itself; the coercion keys on its presence. */
+const resolveFor = (
+  requested: number | 'all' | undefined,
+  masking: CanvasMasking | undefined,
+) => resolveCanvasSampling(requested, masking);
+
+const provider = (over: Partial<CanvasMasking> = {}): CanvasMasking => ({
+  maskRegions: () => [],
+  ...over,
+});
+
+describe('canvas fail-closed', () => {
+  it('forces numeric sampling when masking configured', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(resolveCanvasSampling('all', true)).toBe(4);
+    expect(resolveCanvasSampling(undefined, true)).toBe(4);
+    expect(resolveCanvasSampling(15, true)).toBe(15);
+    expect(resolveCanvasSampling('all', false)).toBe('all');
+    warn.mockRestore();
+  });
+
+  it('warns once per forced resolution so silent bypass is never possible', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    resolveCanvasSampling('all', true);
+    expect(warn).toHaveBeenCalledWith(
+      '[rrweb] canvasMasking requires FPS canvas capture; forcing sampling.canvas = 4',
+    );
+    warn.mockRestore();
+  });
+
+  it('does not warn when a numeric sampling is already provided', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    resolveCanvasSampling(30, true);
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+});
+
+describe('canvas sampling keys on provider presence', () => {
+  it('coerces for a provider with no isConfigured switch', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(resolveFor('all', provider())).toBe(4);
+    warn.mockRestore();
+  });
+
+  it('coerces for a provider whose isConfigured() is true', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(resolveFor('all', provider({ isConfigured: () => true }))).toBe(4);
+    warn.mockRestore();
+  });
+
+  /**
+   * The capture mode is picked once at `record()`, but `isConfigured()` is
+   * re-read on every frame and snapshot. A provider that answers false at
+   * setup and true later would leave the mutation-mode command stream, which
+   * has no masking path at all, running unmasked. So the mere presence of a
+   * provider forces the FPS path; `isConfigured()` only decides, per frame,
+   * whether that path masks or skips.
+   */
+  it('coerces for a provider whose isConfigured() is false at record() time', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const masking = provider({ isConfigured: () => false });
+    expect(resolveFor('all', masking)).toBe(4);
+    expect(resolveFor(undefined, masking)).toBe(4);
+    warn.mockRestore();
+  });
+
+  it('still coerces when the isConfigured switch itself throws (fail closed)', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(
+      resolveFor(
+        'all',
+        provider({
+          isConfigured: () => {
+            throw new Error('boom');
+          },
+        }),
+      ),
+    ).toBe(4);
+    warn.mockRestore();
+  });
+
+  it('leaves sampling alone with no canvasMasking at all', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    expect(resolveFor('all', undefined)).toBe('all');
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+});
+
+/**
+ * The frame loop used to measure the content box whenever a `canvasMasking`
+ * object was merely *present*. A provider whose `isConfigured()` returns false
+ * masks nothing, so the measurement was unused -- and on a canvas that cannot
+ * be measured (zero content box) the frame was dropped anyway, losing capture
+ * for no privacy gain.
+ */
+describe('resolveFrameDisplaySize', () => {
+  const canvasOf = (width: number, height: number) => {
+    const canvas = document.createElement('canvas');
+    canvas.width = width;
+    canvas.height = height;
+    return canvas;
+  };
+
+  it('uses cheap client dimensions, and does not measure, with no provider', () => {
+    const canvas = canvasOf(300, 150);
+    const rect = vi.spyOn(canvas, 'getBoundingClientRect');
+    expect(resolveFrameDisplaySize(undefined, canvas)).toEqual({
+      width: 300,
+      height: 150,
+    });
+    expect(rect).not.toHaveBeenCalled();
+  });
+
+  it('captures the frame from client dimensions when isConfigured() is false', () => {
+    const canvas = canvasOf(300, 150);
+    const rect = vi.spyOn(canvas, 'getBoundingClientRect');
+    const style = vi.spyOn(window, 'getComputedStyle');
+
+    const size = resolveFrameDisplaySize(
+      { maskRegions: () => [], isConfigured: () => false },
+      canvas,
+    );
+
+    // not SKIP_FRAME: the frame is still captured, unmeasurable or not
+    expect(size).toEqual({ width: 300, height: 150 });
+    expect(rect).not.toHaveBeenCalled();
+    expect(style).not.toHaveBeenCalled();
+    style.mockRestore();
+  });
+
+  it('measures the content box when masking is in force', () => {
+    const canvas = canvasOf(300, 150);
+    Object.defineProperty(canvas, 'clientWidth', { value: 200 });
+    Object.defineProperty(canvas, 'clientHeight', { value: 100 });
+    expect(resolveFrameDisplaySize({ maskRegions: () => [] }, canvas)).toEqual({
+      width: 200,
+      height: 100,
+    });
+  });
+
+  /** Fail closed: a wrong scale would leave mask regions off their target. */
+  it('skips the frame when masking is in force but the box is unmeasurable', () => {
+    const canvas = canvasOf(300, 150);
+    expect(resolveFrameDisplaySize({ maskRegions: () => [] }, canvas)).toBe(
+      SKIP_FRAME,
+    );
+  });
+});
diff --git a/packages/rrweb/test/record/privacy.test.ts b/packages/rrweb/test/record/privacy.test.ts
new file mode 100644
index 0000000000..c7d645e0ac
--- /dev/null
+++ b/packages/rrweb/test/record/privacy.test.ts
@@ -0,0 +1,855 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import record from '../../src/record';
+import {
+  EventType,
+  IncrementalSource,
+  type RecordPlugin,
+  type eventWithTime,
+} from '@rrweb/types';
+
+describe('record() privacy policy plugin fallback', () => {
+  it('a plugin returning a malformed policy falls back to the user policy instead of throwing', () => {
+    const badPlugin: RecordPlugin = {
+      name: 'bad@1',
+      applyPrivacyPolicy: () => ({ nonsense: true } as never),
+    };
+
+    let stop: (() => void) | undefined;
+    expect(() => {
+      stop = record({ emit: () => {}, plugins: [badPlugin] });
+    }).not.toThrow();
+    stop?.();
+  });
+
+  it('still throws when the user supplies their own invalid policy directly (no plugin involved)', () => {
+    expect(() => {
+      record({
+        emit: () => {},
+        // @ts-expect-error intentionally invalid for this test
+        privacyPolicy: { nonsense: true },
+      });
+    }).toThrow();
+  });
+});
+
+describe('record() and a <form> whose tagName is shadowed', () => {
+  it('records an attribute mutation on the form without throwing', async () => {
+    // Real browsers make a named form control reachable as an own property
+    // on its <form> (`<form><input name="tagName">` makes `form.tagName`
+    // resolve to the <input>, not the string `'FORM'`). jsdom doesn't
+    // implement that quirk, so the shadowing is reproduced directly here,
+    // the same way packages/rrweb-snapshot/test/utils.test.ts does for
+    // `untaintedTagName` itself.
+    document.body.innerHTML = '<form><input name="tagName"></form>';
+    const form = document.querySelector('form')!;
+    const input = document.querySelector('input')!;
+    Object.defineProperty(form, 'tagName', {
+      value: input,
+      configurable: true,
+    });
+    // sanity check: the shadowing actually took effect
+    expect(typeof form.tagName).not.toBe('string');
+
+    const events: eventWithTime[] = [];
+    let uncaught: unknown;
+    const onError = (e: ErrorEvent) => {
+      uncaught = e.error ?? e.message;
+    };
+    window.addEventListener('error', onError);
+
+    const stop = record({ emit: (event) => events.push(event) });
+    try {
+      form.setAttribute('data-x', 'mutated');
+      // MutationObserver callbacks run as a microtask; give it a couple of
+      // ticks (a macrotask is enough to also drain any queued microtasks).
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+      window.removeEventListener('error', onError);
+    }
+
+    expect(uncaught).toBeUndefined();
+    const mutationEmitted = events.some(
+      (event) =>
+        event.type === EventType.IncrementalSnapshot &&
+        event.data.source === IncrementalSource.Mutation &&
+        event.data.attributes.some(
+          (a) =>
+            'data-x' in a.attributes && a.attributes['data-x'] === 'mutated',
+        ),
+    );
+    expect(mutationEmitted).toBe(true);
+  });
+});
+
+describe('record() privacy detectors on live updates', () => {
+  const withEmailDetector = {
+    version: 1,
+    preset: 'minimal',
+    detectors: { email: true },
+  } as const;
+
+  it('masks a characterData mutation whose new text trips a detector', async () => {
+    document.body.innerHTML = '<p>hello</p>';
+    const textNode = document.querySelector('p')!.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+    });
+    try {
+      textNode.data = 'contact bob@example.com';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const textMutations = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+    expect(textMutations.length).toBeGreaterThan(0);
+    expect(JSON.stringify(textMutations)).not.toContain('bob@example.com');
+  });
+
+  it('leaves a characterData mutation with clean text untouched under minimal', async () => {
+    document.body.innerHTML = '<p>hello</p>';
+    const textNode = document.querySelector('p')!.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+    });
+    try {
+      textNode.data = 'still plain text';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const textMutations = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+    expect(JSON.stringify(textMutations)).toContain('still plain text');
+  });
+
+  it('never scans <style> text mutations, even with detectors on', async () => {
+    document.body.innerHTML = '<style>body{color:red}</style>';
+    const textNode = document.querySelector('style')!.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+    });
+    try {
+      // an email-shaped token inside CSS content must never star the sheet
+      textNode.data = '/* bob@example.com */ body{color:blue}';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const textMutations = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+    expect(JSON.stringify(textMutations)).toContain('body{color:blue}');
+  });
+
+  /** The masked values the recorder emitted, in order. */
+  async function recordInputValues(
+    markup: string,
+    drive: (input: HTMLInputElement) => void,
+    options: { unmaskTextSelector?: string } = {},
+  ): Promise<string[]> {
+    document.body.innerHTML = markup;
+    const input = document.querySelector('input')!;
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: withEmailDetector,
+      ...options,
+    });
+    try {
+      drive(input);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    return events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Input
+        ? [event.data.text]
+        : [],
+    );
+  }
+
+  it('occludes a typed value at every keystroke length', async () => {
+    // The leak this replaced: scanning per input event recorded every prefix
+    // shorter than the first Luhn-valid length verbatim, so the full card
+    // number was reconstructable even though the final value came out masked.
+    const card = '4111111111111111';
+    const values = await recordInputValues('<input type="text">', (input) => {
+      for (let i = 1; i <= card.length; i++) {
+        input.value = card.slice(0, i);
+        input.dispatchEvent(new Event('input', { bubbles: true }));
+      }
+    });
+    expect(values.length).toBe(card.length);
+    values.forEach((value, i) => expect(value).toBe('*'.repeat(i + 1)));
+  });
+
+  it('occludes a pasted value, matched or not', async () => {
+    const values = await recordInputValues('<input type="text">', (input) => {
+      input.value = 'bob@example.com';
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+      input.value = 'nothing sensitive here';
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+    });
+    expect(values).toEqual([
+      '*'.repeat('bob@example.com'.length),
+      '*'.repeat('nothing sensitive here'.length),
+    ]);
+  });
+
+  it('no unmask escape reveals an input value while detectors are on', async () => {
+    const values = await recordInputValues(
+      '<input class="rr-unmask" type="text">',
+      (input) => {
+        input.value = 'Visible Name';
+        input.dispatchEvent(new Event('input', { bubbles: true }));
+      },
+      { unmaskTextSelector: '.rr-unmask' },
+    );
+    expect(values).toEqual(['*'.repeat('Visible Name'.length)]);
+  });
+});
+
+/**
+ * The mutation path used to decide "is this `value` an input value?" purely by
+ * tag name, so a component library's `<ion-input type="password">` -- a custom
+ * element, not an INPUT -- recorded its credential raw on every mutation,
+ * while the same element masked correctly in a full snapshot. The gate now
+ * also asks the element's own `type`/`autocomplete`, but stays
+ * `password`-specific so the tags that merely have a `.type` string
+ * (`<li type="disc">`, `<ol type="1">`) are not swept back in.
+ */
+describe('record() value mutations on a custom element that declares a credential', () => {
+  class IonInput extends HTMLElement {
+    get type(): string | null {
+      return this.getAttribute('type');
+    }
+    get autocomplete(): string | null {
+      return this.getAttribute('autocomplete');
+    }
+  }
+  if (!customElements.get('ion-input'))
+    customElements.define('ion-input', IonInput);
+
+  afterEach(() => {
+    document.body.innerHTML = '';
+  });
+
+  /** Every `value`/`type` attribute the recorder emitted, in order. */
+  async function recordAttributeMutations(
+    markup: string,
+    drive: (el: HTMLElement) => void,
+    privacyPolicy?: Record<string, unknown>,
+  ): Promise<string[]> {
+    document.body.innerHTML = markup;
+    const el = document.querySelector('#t') as HTMLElement;
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      ...(privacyPolicy ? { privacyPolicy: privacyPolicy as never } : {}),
+    });
+    try {
+      drive(el);
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    return events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.attributes.flatMap((a) =>
+            ['value', 'type'].flatMap((name) =>
+              typeof a.attributes[name] === 'string'
+                ? [a.attributes[name] as string]
+                : [],
+            ),
+          )
+        : [],
+    );
+  }
+
+  it('masks a value mutation on <ion-input type="password">', async () => {
+    const values = await recordAttributeMutations(
+      '<ion-input id="t" type="password" value="old"></ion-input>',
+      (el) => el.setAttribute('value', 'hunter2'),
+    );
+    expect(values).toContain('*******');
+    expect(values).not.toContain('hunter2');
+  });
+
+  /**
+   * The gate also opens for a protected autocomplete token, which is what
+   * carries the value to `maskInput` under a managed preset. Under `minimal`
+   * it still records raw -- `maskInputOptions` has never keyed off
+   * `autocomplete`, so that matches pre-v2 behavior rather than regressing
+   * it; `isProtectedInput`'s unconditional protection remains INPUT-scoped.
+   */
+  it('masks one declared by a protected autocomplete token under balanced', async () => {
+    const values = await recordAttributeMutations(
+      '<ion-input id="t" autocomplete="cc-number" value="old"></ion-input>',
+      (el) => el.setAttribute('value', '4111111111111111'),
+      { version: 1, preset: 'balanced' },
+    );
+    expect(values).not.toContain('4111111111111111');
+  });
+
+  it("leaves a plain custom element's value alone", async () => {
+    const values = await recordAttributeMutations(
+      '<ion-input id="t" type="text" value="old"></ion-input>',
+      (el) => el.setAttribute('value', 'plain text'),
+    );
+    expect(values).toContain('plain text');
+  });
+
+  it('does not re-mask <li value> under balanced', async () => {
+    const values = await recordAttributeMutations(
+      '<ol><li id="t" value="3">x</li></ol>',
+      (el) => el.setAttribute('value', '7'),
+      { version: 1, preset: 'balanced' },
+    );
+    expect(values).toContain('7');
+  });
+
+  it('leaves <ol type="1"> unaffected', async () => {
+    const values = await recordAttributeMutations(
+      '<ol id="t" type="1"><li>x</li></ol>',
+      (el) => el.setAttribute('type', 'a'),
+      { version: 1, preset: 'balanced' },
+    );
+    expect(values).toContain('a');
+  });
+});
+
+/**
+ * `rr_open_mode` is written by the recorder itself when a <dialog> opens, and
+ * carries a "generated, exempt from masking" flag for that flush. If the page
+ * then writes an attribute of the same literal name, the flag no longer
+ * describes the value being recorded and must be cleared, or page data would
+ * ride the exemption out unmasked.
+ */
+describe('record() generated-attribute flag vs. a real page write', () => {
+  /**
+   * jsdom's selector engine has no `:modal` pseudo-class and throws on it, so
+   * the one call the <dialog> branch makes is shimmed on the element itself.
+   * Everything else delegates to the real implementation.
+   */
+  function shimModalMatches(el: Element) {
+    const real = Element.prototype.matches;
+    el.matches = ((selector: string) =>
+      selector === 'dialog:modal'
+        ? false
+        : real.call(el, selector)) as Element['matches'];
+  }
+
+  function attributeMutations(events: eventWithTime[]) {
+    return events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.attributes
+        : [],
+    );
+  }
+
+  it('exempts the recorder-written rr_open_mode', async () => {
+    document.body.innerHTML = '<dialog>hi</dialog>';
+    const dialog = document.querySelector('dialog')!;
+    shimModalMatches(dialog);
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      maskAllElementAttributes: true,
+    });
+    try {
+      dialog.setAttribute('open', '');
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const written = attributeMutations(events).map(
+      (a) => a.attributes.rr_open_mode,
+    );
+    expect(written).toContain('non-modal');
+  });
+
+  it('does not exempt a page write of the same attribute name in that flush', async () => {
+    document.body.innerHTML = '<dialog>hi</dialog>';
+    const dialog = document.querySelector('dialog')!;
+    shimModalMatches(dialog);
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      maskAllElementAttributes: true,
+    });
+    try {
+      dialog.setAttribute('open', '');
+      dialog.setAttribute('rr_open_mode', 'page-authored');
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+
+    const written = attributeMutations(events).map(
+      (a) => a.attributes.rr_open_mode,
+    );
+    expect(written).toContain('*'.repeat('page-authored'.length));
+    expect(JSON.stringify(written)).not.toContain('page-authored');
+  });
+});
+
+describe('record() unmaskTextSelector reaches masked attributes', () => {
+  async function titlesAfterMutation(
+    html: string,
+    options: Parameters<typeof record>[0],
+  ) {
+    document.body.innerHTML = html;
+    const events: eventWithTime[] = [];
+    const stop = record({ ...options, emit: (event) => events.push(event) });
+    try {
+      document.querySelectorAll('img').forEach((img, index) => {
+        img.setAttribute('title', `updated-${index}`);
+      });
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    return events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.attributes.map((a) => a.attributes.title)
+        : [],
+    );
+  }
+
+  it('keeps a masked attribute inside a record()-level unmask subtree', async () => {
+    const titles = await titlesAfterMutation(
+      '<div class="support-widget"><img title="a"></div>',
+      {
+        privacyPolicy: { version: 1, preset: 'balanced' },
+        unmaskTextSelector: '.support-widget',
+      },
+    );
+    expect(titles).toContain('updated-0');
+  });
+
+  it('still masks the same attribute with no unmask subtree', async () => {
+    const titles = await titlesAfterMutation('<img title="a">', {
+      privacyPolicy: { version: 1, preset: 'balanced' },
+      unmaskTextSelector: '.support-widget',
+    });
+    expect(titles).toContain('*'.repeat('updated-0'.length));
+    expect(titles).not.toContain('updated-0');
+  });
+
+  it('the vendor unmask class keeps working alongside it', async () => {
+    const titles = await titlesAfterMutation(
+      '<div class="rr-unmask"><img title="a"></div>',
+      { privacyPolicy: { version: 1, preset: 'balanced' } },
+    );
+    expect(titles).toContain('updated-0');
+  });
+});
+
+describe('record() per-flush mask-decision memoisation', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    document.body.innerHTML = '';
+  });
+
+  const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+  const textMutationsIn = (events: eventWithTime[]) =>
+    events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts
+        : [],
+    );
+
+  /**
+   * Counts only the ancestor-walk probes: `needMaskingText` is the sole caller
+   * that passes the compiled unmask selector to `Element.prototype.matches`
+   * (`finalizeAttribute`'s unmask check goes through `closest`). One walk over
+   * this document touches the mutated node's parent, `<body>` and `<html>`, so
+   * an uncached flush of N text mutations under one parent would be N times
+   * whatever a single one costs.
+   */
+  function countUnmaskWalkProbes() {
+    const original = Element.prototype.matches;
+    let calls = 0;
+    vi.spyOn(Element.prototype, 'matches').mockImplementation(function (
+      this: Element,
+      selector: string,
+    ) {
+      // `.rr-unmask` identifies the compiled unmask selector unambiguously:
+      // the mask selector carries `[data-privacy="unmask"]` too, inside the
+      // `:not()` that makes an unrecognized value fail closed.
+      if (selector.includes('.rr-unmask')) calls += 1;
+      return original.call(this, selector);
+    });
+    return () => calls;
+  }
+
+  it('walks the ancestor chain once for many text mutations sharing a parent', async () => {
+    // The `.rr-unmask` target keeps `resolveUnmaskTextSelector` from nulling
+    // the selector for the flush -- with no match anywhere the walk would
+    // short-circuit and there would be nothing to memoise.
+    document.body.innerHTML =
+      '<div class="rr-unmask">keep</div><div id="host"></div>';
+    const host = document.getElementById('host')!;
+    const nodes: Text[] = [];
+    for (let index = 0; index < 10; index += 1) {
+      const text = document.createTextNode(`t${index}`);
+      host.appendChild(text);
+      nodes.push(text);
+    }
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: { version: 1, preset: 'balanced' },
+    });
+    // Spy only after the initial full snapshot, which legitimately walks every
+    // node; this test is about the mutation flush.
+    const probes = countUnmaskWalkProbes();
+    try {
+      nodes.forEach((node, index) => {
+        node.data = `updated-${index}`;
+      });
+      await flush();
+    } finally {
+      stop?.();
+    }
+
+    // All ten mutations were seen...
+    expect(textMutationsIn(events)).toHaveLength(10);
+    // ...but the shared parent's chain was walked for the first one only.
+    // Three levels (#host, body, html), not thirty.
+    expect(probes()).toBeGreaterThan(0);
+    expect(probes()).toBeLessThan(10);
+  });
+
+  it('does not carry a decision across flushes: a later .rr-mask still masks', async () => {
+    document.body.innerHTML =
+      '<div class="rr-unmask">keep</div><div id="host">before</div>';
+    const host = document.getElementById('host')!;
+    const textNode = host.firstChild as Text;
+
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: { version: 1, preset: 'balanced' },
+    });
+    try {
+      textNode.data = 'first-plain';
+      await flush();
+      host.classList.add('rr-mask');
+      await flush();
+      textNode.data = 'second-secret';
+      await flush();
+    } finally {
+      stop?.();
+    }
+
+    const values = textMutationsIn(events).map((text) => text.value);
+    expect(values).toContain('first-plain');
+    expect(values).not.toContain('second-secret');
+    expect(values).toContain('*'.repeat('second-secret'.length));
+  });
+});
+
+/**
+ * `strict` blocks media unconditionally, so an explicit `recordCanvas: true`
+ * is silently downgraded to off. That silent downgrade previously had no
+ * signal at all; a caller who explicitly opted into canvas recording
+ * deserves a one-time warning rather than a canvas that quietly never
+ * records.
+ */
+describe('record() warns once when strict disables an explicit recordCanvas', () => {
+  it('warns once and still leaves canvas recording off', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    try {
+      const stop1 = record({
+        emit: () => {},
+        recordCanvas: true,
+        privacyPolicy: { version: 1, preset: 'strict' },
+      });
+      stop1?.();
+      const stop2 = record({
+        emit: () => {},
+        recordCanvas: true,
+        privacyPolicy: { version: 1, preset: 'strict' },
+      });
+      stop2?.();
+
+      const strictWarnings = warn.mock.calls.filter(([msg]) =>
+        String(msg).includes(
+          "privacyPolicy preset 'strict' disables canvas recording",
+        ),
+      );
+      expect(strictWarnings).toHaveLength(1);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+
+  it('does not warn when recordCanvas was never requested', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    try {
+      const stop = record({
+        emit: () => {},
+        privacyPolicy: { version: 1, preset: 'strict' },
+      });
+      stop?.();
+      const strictWarnings = warn.mock.calls.filter(([msg]) =>
+        String(msg).includes(
+          "privacyPolicy preset 'strict' disables canvas recording",
+        ),
+      );
+      expect(strictWarnings).toHaveLength(0);
+    } finally {
+      warn.mockRestore();
+    }
+  });
+});
+
+/**
+ * `data-privacy="ignore"` is `mask` plus event silence: the subtree's content
+ * masks like `mask`, and no input events are emitted for it at all — absence,
+ * not stars. The nearest `data-privacy` annotation decides, so a descendant
+ * `unmask` re-enables events; the legacy `.rr-ignore` control stays what it
+ * always was, per-element and events-only.
+ */
+describe('record() input events under data-privacy="ignore"', () => {
+  afterEach(() => {
+    document.body.innerHTML = '';
+  });
+
+  async function recordedInputEvents(
+    markup: string,
+    options: Parameters<typeof record>[0] = {},
+  ): Promise<eventWithTime[]> {
+    document.body.innerHTML = markup;
+    const events: eventWithTime[] = [];
+    const stop = record({ emit: (event) => events.push(event), ...options });
+    try {
+      const input = document.querySelector('#t') as HTMLInputElement;
+      input.value = 'typed secret';
+      input.dispatchEvent(new Event('input', { bubbles: true }));
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    return events.filter(
+      (event) =>
+        event.type === EventType.IncrementalSnapshot &&
+        event.data.source === IncrementalSource.Input,
+    );
+  }
+
+  const balanced = {
+    privacyPolicy: { version: 1, preset: 'balanced' },
+  } as Parameters<typeof record>[0];
+
+  it('emits no input events at all inside an ignore subtree', async () => {
+    const inputs = await recordedInputEvents(
+      '<div data-privacy="ignore"><input id="t"></div>',
+      balanced,
+    );
+    expect(inputs).toHaveLength(0);
+  });
+
+  it('same-element ignore + .rr-unmask resolves to ignore: still silent', async () => {
+    const inputs = await recordedInputEvents(
+      '<input id="t" class="rr-unmask" data-privacy="ignore">',
+      balanced,
+    );
+    expect(inputs).toHaveLength(0);
+  });
+
+  it('a descendant unmask inside ignore re-enables input events', async () => {
+    const inputs = await recordedInputEvents(
+      '<div data-privacy="ignore"><div data-privacy="unmask"><input id="t"></div></div>',
+      balanced,
+    );
+    expect(inputs.length).toBeGreaterThan(0);
+  });
+
+  it('does nothing under minimal, where data-privacy is off', async () => {
+    const inputs = await recordedInputEvents(
+      '<div data-privacy="ignore"><input id="t"></div>',
+    );
+    expect(inputs.length).toBeGreaterThan(0);
+  });
+
+  /**
+   * A vendorCompat ignore token is events-only: the vendor's own recorder
+   * suppresses input events from the annotated element and records its
+   * content normally, and compat reproduces exactly that — unlike
+   * `data-privacy="ignore"`, which is mask plus silence.
+   */
+  it('a vendorCompat ignore token suppresses events, for its vendor only', async () => {
+    const sentryCompat = {
+      privacyPolicy: {
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['sentry'],
+      },
+    } as Parameters<typeof record>[0];
+    const underSentry = await recordedInputEvents(
+      '<input id="t" class="sentry-ignore">',
+      sentryCompat,
+    );
+    expect(underSentry).toHaveLength(0);
+    // The same markup under another vendor's compat is not suppressed.
+    const underPosthog = await recordedInputEvents(
+      '<input id="t" class="sentry-ignore">',
+      {
+        privacyPolicy: {
+          version: 1,
+          preset: 'balanced',
+          vendorCompat: ['posthog'],
+        },
+      } as Parameters<typeof record>[0],
+    );
+    expect(underPosthog.length).toBeGreaterThan(0);
+    const phToken = await recordedInputEvents(
+      '<input id="t" class="ph-ignore-input">',
+      {
+        privacyPolicy: {
+          version: 1,
+          preset: 'balanced',
+          vendorCompat: ['posthog'],
+        },
+      } as Parameters<typeof record>[0],
+    );
+    expect(phToken).toHaveLength(0);
+  });
+
+  it('a vendorCompat ignore token does not mask: content is still recorded', async () => {
+    document.body.innerHTML =
+      '<p id="t" class="sentry-ignore">annotated text</p>';
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: {
+        version: 1,
+        preset: 'balanced',
+        vendorCompat: ['sentry'],
+      },
+    });
+    try {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    const serialized = JSON.stringify(
+      events.filter((event) => event.type === EventType.FullSnapshot),
+    );
+    expect(serialized).toContain('annotated text');
+  });
+
+  it('legacy .rr-ignore suppresses events on the element itself only', async () => {
+    const onSelf = await recordedInputEvents(
+      '<input id="t" class="rr-ignore">',
+      balanced,
+    );
+    expect(onSelf).toHaveLength(0);
+    const onAncestor = await recordedInputEvents(
+      '<div class="rr-ignore"><input id="t"></div>',
+      balanced,
+    );
+    expect(onAncestor.length).toBeGreaterThan(0);
+  });
+
+  it('a characterData mutation under ignore arrives masked', async () => {
+    document.body.innerHTML =
+      '<div data-privacy="ignore"><p id="t">before text</p></div>';
+    const events: eventWithTime[] = [];
+    const stop = record({ ...balanced, emit: (event) => events.push(event) });
+    try {
+      const text = document.querySelector('#t')!.firstChild as Text;
+      text.data = 'secret after';
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      stop?.();
+    }
+    const texts = events.flatMap((event) =>
+      event.type === EventType.IncrementalSnapshot &&
+      event.data.source === IncrementalSource.Mutation
+        ? event.data.texts.map((t) => t.value)
+        : [],
+    );
+    expect(texts).toContain('****** *****');
+    expect(texts).not.toContain('secret after');
+  });
+});
+
+/**
+ * EXPERIMENTAL, open design question for upstream: the Meta event's own
+ * `href` is scoped like `balanced` (blocked-list-only param masking) even
+ * under `strict`, while a DOM URL attribute keeps `strict`'s normal
+ * mask-everything-unless-allowlisted treatment. See `sanitizeMetaUrl`'s doc
+ * comment in `rrweb-snapshot/src/privacy.ts`.
+ */
+describe('record() Meta event href under strict', () => {
+  function metaHref(events: eventWithTime[]): string | undefined {
+    const meta = events.find((event) => event.type === EventType.Meta);
+    return meta && meta.type === EventType.Meta ? meta.data.href : undefined;
+  }
+
+  it('keeps a non-blocked query param', () => {
+    const originalPushState = window.history.pushState.bind(window.history);
+    originalPushState(null, '', '/path?page=2');
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: { version: 1, preset: 'strict' },
+    });
+    stop?.();
+    expect(metaHref(events)).toContain('page=2');
+  });
+
+  it('still masks a blocked-list query param', () => {
+    const originalPushState = window.history.pushState.bind(window.history);
+    originalPushState(null, '', '/path?token=secret');
+    const events: eventWithTime[] = [];
+    const stop = record({
+      emit: (event) => events.push(event),
+      privacyPolicy: { version: 1, preset: 'strict' },
+    });
+    stop?.();
+    expect(metaHref(events)).toContain('token=*');
+    expect(metaHref(events)).not.toContain('secret');
+  });
+});
diff --git a/packages/rrweb/test/record/style-mutation.test.ts b/packages/rrweb/test/record/style-mutation.test.ts
new file mode 100644
index 0000000000..3e34d5780c
--- /dev/null
+++ b/packages/rrweb/test/record/style-mutation.test.ts
@@ -0,0 +1,78 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import type * as puppeteer from 'puppeteer';
+import { vi } from 'vitest';
+import type { eventWithTime, listenerHandler } from '@rrweb/types';
+import type { recordOptions } from '../../src/types';
+import { launchPuppeteer, waitForRAF } from '../utils';
+
+interface IWindow extends Window {
+  rrweb: {
+    record: (
+      options: recordOptions<eventWithTime>,
+    ) => listenerHandler | undefined;
+  };
+  emit: (e: eventWithTime) => undefined;
+}
+
+describe('style text mutations', () => {
+  vi.setConfig({ testTimeout: 10_000 });
+
+  let browser: puppeteer.Browser;
+  let page: puppeteer.Page;
+  let code: string;
+  let events: eventWithTime[] = [];
+
+  beforeAll(async () => {
+    browser = await launchPuppeteer();
+    code = fs.readFileSync(
+      path.resolve(__dirname, '../../dist/rrweb.umd.cjs'),
+      'utf8',
+    );
+  });
+
+  beforeEach(async () => {
+    page = await browser.newPage();
+    await page.goto('about:blank');
+    await page.setContent(
+      '<style id="sheet">body{color:red}</style><p id="text">secret</p>',
+    );
+    await page.evaluate(code);
+    events = [];
+    await page.exposeFunction('emit', (e: eventWithTime) => {
+      events.push(e);
+    });
+  });
+
+  afterEach(async () => {
+    await page.close();
+  });
+
+  afterAll(async () => {
+    await browser.close();
+  });
+
+  it('records <style> text mutations verbatim under strict, still masking page text', async () => {
+    await page.evaluate(() => {
+      const { record } = (window as unknown as IWindow).rrweb;
+      record({
+        emit: (window as unknown as IWindow).emit,
+        privacyPolicy: { version: 1, preset: 'strict' },
+      });
+
+      // mutate the existing text nodes in place -> characterData mutations
+      (
+        document.querySelector('#sheet') as HTMLStyleElement
+      ).firstChild!.textContent = '.a{color:blue}';
+      (document.querySelector('#text') as HTMLElement).firstChild!.textContent =
+        'changed secret';
+    });
+    await waitForRAF(page);
+
+    const payload = JSON.stringify(events);
+    // CSS is never masked, on any path
+    expect(payload).toContain('.a{color:blue}');
+    // ... while ordinary text still is
+    expect(payload).not.toContain('changed secret');
+  });
+});
diff --git a/packages/rrweb/test/record/stylesheet-manager.test.ts b/packages/rrweb/test/record/stylesheet-manager.test.ts
index cb984bed67..ec033ad7ee 100644
--- a/packages/rrweb/test/record/stylesheet-manager.test.ts
+++ b/packages/rrweb/test/record/stylesheet-manager.test.ts
@@ -2,11 +2,10 @@
  * @vitest-environment jsdom
  */
 import { describe, expect, it } from 'vitest';
-import { applyPrivacyDetectors, compilePrivacyPolicy } from 'rrweb-snapshot';
 import { StylesheetManager } from '../../src/record/stylesheet-manager';
 
 describe('StylesheetManager privacy', () => {
-  it('masks PII in newly adopted stylesheet rules', () => {
+  it('records adopted stylesheet rules unmodified even under a strict privacy policy', () => {
     document.documentElement.innerHTML = '<head></head><body></body>';
     const style = document.createElement('style');
     style.textContent = '.x { content: "person@example.com"; }';
@@ -14,19 +13,19 @@ describe('StylesheetManager privacy', () => {
     expect(style.sheet?.cssRules.length).toBeGreaterThan(0);
 
     const emitted: unknown[] = [];
+    // CSS is never masked, on any path: StylesheetManager has no privacy
+    // hook at all, so adopted-sheet rules pass through verbatim regardless
+    // of the caller's privacyPolicy (e.g. { version: 1, preset: 'strict' }).
     const manager = new StylesheetManager({
       mutationCb: () => undefined,
       adoptedStyleSheetCb: (data) => {
         emitted.push(data);
       },
-      privacy: compilePrivacyPolicy(
-        applyPrivacyDetectors({ version: 1, preset: 'balanced' }),
-      ),
     });
     manager.adoptStyleSheets([style.sheet!], 1);
 
     const payload = JSON.stringify(emitted);
-    expect(payload).not.toContain('person@example.com');
-    expect(payload).toContain('xxxxxx@xxxxxxx.xxx');
+    expect(payload).toContain('person@example.com');
+    expect(payload).not.toContain('xxxxxx@xxxxxxx.xxx');
   });
 });
diff --git a/packages/types/src/index.ts b/packages/types/src/index.ts
index 9859ba5a04..35a519f37c 100644
--- a/packages/types/src/index.ts
+++ b/packages/types/src/index.ts
@@ -311,6 +311,113 @@ export interface ICrossOriginIframeMirror {
   reset(iframe?: HTMLIFrameElement): void;
 }
 
+/** A versioned, portable Privacy at Capture policy; mirrors `rrweb-snapshot`'s internal `PrivacyPolicy`, the source of truth. */
+export type PrivacyPolicy = {
+  version: 1;
+  preset: PrivacyPreset;
+  rules?: PrivacyRule[];
+  detectors?: PrivacyDetectorOptions;
+  url?: PrivacyUrlOptions;
+  /** Opt in to recognizing other session-replay tools' privacy classes/attributes; off by default. `true` recognizes every verified vendor; an array recognizes only the named ones. */
+  vendorCompat?: boolean | VendorCompatId[];
+};
+
+/** A vendor whose mask/block conventions `vendorCompat` can recognize; see guide.md's "Vendor class recognition" table. */
+export type VendorCompatId =
+  | 'mixpanel'
+  | 'fullstory'
+  | 'amplitude'
+  | 'posthog'
+  | 'sentry'
+  | 'datadog'
+  | 'newrelic'
+  | 'highlight'
+  | 'logrocket'
+  | 'hotjar'
+  | 'clarity'
+  | 'smartlook'
+  | 'openreplay'
+  | 'contentsquare'
+  | 'heap'
+  | 'mouseflow'
+  | 'luckyorange'
+  | 'inspectlet'
+  | 'dynatrace'
+  | 'userback'
+  | 'zipy'
+  | 'quantummetric'
+  | 'glassbox'
+  | 'sessionstack'
+  | 'sessionrewind';
+
+export type PrivacyPreset = 'strict' | 'balanced' | 'minimal';
+
+export type PrivacyAction = 'mask' | 'block' | 'unmask';
+
+export type PrivacyRule = {
+  target: PrivacyTarget;
+  action: PrivacyAction;
+};
+
+export type PrivacyTarget = {
+  type: 'selector';
+  /** A CSS selector. Rules also apply to descendants of the matched node. */
+  selector: string;
+};
+
+/** Explicit opt-in flags for built-in heuristic detectors; presets do not enable these. */
+export type PrivacyDetectorOptions = Partial<{
+  email: boolean;
+  phone: boolean;
+  paymentCard: boolean;
+  ssn: boolean;
+  ipAddress: boolean;
+}>;
+
+export type PrivacyUrlOptions = {
+  /** Query parameter names whose values are always removed. */
+  blockedQueryParameters?: string[];
+  /** When supplied, all query parameter values except these are removed. */
+  allowedQueryParameters?: string[];
+  removeHash?: boolean;
+};
+
+export type CompiledDetector = {
+  name: string;
+  test: (value: string) => boolean;
+};
+
+/** Runtime form of a compiled policy, shared by snapshot and incremental observers. */
+export type CompiledPrivacyPolicy = {
+  preset: PrivacyPreset;
+  /** 'mask' rules + the fail-closed [data-privacy] token + .rr-mask (+ compat classes, + '*' under strict) */
+  maskTextSelector: string | null;
+  /** 'unmask' rules + [data-privacy="unmask"] + .rr-unmask (native-only; vendorCompat never adds unmask tokens) */
+  unmaskTextSelector: string | null;
+  /** 'block' rules + [data-privacy="block"] + .rr-block (+ compat classes) */
+  blockSelector: string | null;
+  /** [data-privacy="ignore"] under balanced/strict: content is masked through the fail-closed mask token, and input events from the subtree are suppressed */
+  ignoreSelector: string | null;
+  /** vendorCompat input-ignore tokens: input events from a matching element are suppressed, and nothing else changes — no masking implied, unlike `data-privacy="ignore"`. Matched on the element itself, mirroring the vendors' own input observers. */
+  ignoreEventsSelector: string | null;
+  /** true under balanced/strict, and whenever any heuristic detector is active. */
+  maskAllInputs: boolean;
+  /** ['title','placeholder','aria-label'] under balanced/strict, else empty */
+  maskedAttributes: Set<string>;
+  /** true when the policy has nothing to say about attributes; lets `finalizeAttribute` return its input untouched. */
+  attributePolicyInert: boolean;
+  /** true under strict; the `strict` preset alias every media gate reads */
+  blockMedia: boolean;
+  /** true under balanced/strict; the managed preset alias */
+  sanitizeUrls: boolean;
+  /** precomputed, lowercased */
+  blockedQueryParameters: Set<string>;
+  allowedQueryParameters: Set<string> | null;
+  removeHash: boolean;
+  /** Populated by an opt-in detector plugin; [] otherwise. */
+  detectors: CompiledDetector[];
+};
+
 export type RecordPlugin<TOptions = unknown> = {
   name: string;
   observer?: (
@@ -608,17 +715,14 @@ export type CanvasMaskRegion = {
 
 /** Runtime canvas adapter for applications whose sensitive pixels are not DOM nodes. */
 export type CanvasMasking = {
-  /**
-   * Return rectangles to paint black, `[]` to capture the frame unchanged, or
-   * `null`/`undefined` when a safe answer cannot be produced. Unanswerable
-   * frames are skipped rather than captured without masking.
-   */
+  /** Rectangles to paint black, `[]` to capture unchanged, or `null`/`undefined` to skip an unanswerable frame rather than capture it unmasked. */
   maskRegions: (
     canvas: HTMLCanvasElement,
   ) => CanvasMaskRegion[] | null | undefined;
   /**
-   * Optional dynamic switch. When omitted, supplying `canvasMasking` means it
-   * is configured. Throwing is treated as configured so snapshots fail closed.
+   * Optional dynamic switch, re-read on every frame and snapshot; omitting it means supplying `canvasMasking` alone counts as configured, and a throw counts as configured too (fail closed).
+   *
+   * Supplying `canvasMasking` at all fixes the FPS capture path at `record()`; this switch only decides, per frame, whether that path masks or captures unchanged. It may change over the session.
    */
   isConfigured?: () => boolean;
 };
diff --git a/packages/utils/src/index.ts b/packages/utils/src/index.ts
index f181da34f8..d5fbdaa633 100644
--- a/packages/utils/src/index.ts
+++ b/packages/utils/src/index.ts
@@ -247,6 +247,15 @@ export function querySelectorAll(
   return getUntaintedAccessor('Element', n, 'querySelectorAll')(selectors);
 }
 
+/** Reads `tagName` through the untainted accessor, defeating shadowing by a same-named form control (e.g. `<form><input name="tagName">`). */
+export function untaintedTagName(element: Element | null | undefined): string {
+  if (!element) return '';
+  const tagName: unknown = element.tagName;
+  if (typeof tagName === 'string') return tagName.toUpperCase();
+  if (!(element instanceof Element)) return '';
+  return getUntaintedAccessor('Element', element, 'tagName').toUpperCase();
+}
+
 export function mutationObserverCtor(): [
   (typeof MutationObserver)['prototype']['constructor'],
   () => void,
@@ -325,6 +334,7 @@ export default {
   shadowRoot,
   querySelector,
   querySelectorAll,
+  untaintedTagName,
   nowTimestamp,
   mutationObserverCtor,
   patch,