diff --git a/.gitignore b/.gitignore
index a42a178..88e6968 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,4 +29,8 @@ node_modules/
 # JS test artifacts (Vitest)
 coverage/
 junit-js.xml
+
+# E2E artifacts (Playwright)
+test-results/
+playwright-report/
 .env
diff --git a/README.md b/README.md
index c155f0f..4f3caf8 100644
--- a/README.md
+++ b/README.md
@@ -155,6 +155,39 @@ editor remains):
   editor's built-in styles, and optionally block users from importing styles
   bundled inside an `.elpx`. A dedicated _Styles_ admin page lists and manages
   them.
+* **Package iframe security mode** (`iframemode`, default **Secure**): in _Secure_
+  mode the eXeLearning package runs in a sandboxed, **opaque-origin** iframe so its
+  JavaScript cannot read or modify the surrounding Moodle page, its cookies or the
+  session; SCORM scoring is relayed to Moodle over a validated `postMessage` bridge,
+  and the package is served via `tokenpluginfile.php` so its assets load without the
+  session cookie (which an opaque iframe never sends). The package only receives a
+  read-only file token — never the `sesskey` — so Secure is strictly safer than
+  Legacy. _Legacy_ keeps the previous same-origin behaviour as an opt-in fallback.
+  Secure mode is **never silently downgraded**: where it cannot render (e.g. a host
+  whose service worker can't serve an opaque iframe, such as a PHP-WASM playground), a
+  "blocked by security configuration" notice is shown instead of falling back to
+  Legacy. See
+  [DEC-0059](./research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md)
+  and [DEC-0060](./research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md).
+
+### External embeds (YouTube/Vimeo/PDF) in Secure mode
+
+The opaque-origin sandbox also blanks **embedded YouTube/Vimeo players and PDFs** (the
+sandbox flag propagates to the nested player iframe, and browsers block their PDF viewer
+without `allow-same-origin`). So that authors can still use external media in Secure mode
+**without a separate subdomain**, those embeds are **promoted to the Moodle page and
+rendered inline**: a shim baked into the package (`js/exe_embed_shim.js`, self-activating
+only in the opaque origin) replaces each whitelisted-video / `.pdf` iframe with a
+placeholder and reports its geometry to the parent; a relay on the activity page
+(`js/exe_embed_relay.js`) validates + rebuilds the canonical URL and overlays the real
+player exactly over the placeholder. Local package PDFs always render; any `https` `.pdf`
+renders; a same-origin `.pdf` must belong to the package (served as `application/pdf`).
+This is independent of, and does not affect, the SCORM bridge. See
+[DEC-0061](./research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md).
+
+The mechanism has unit tests (`npm run test:js` — Vitest, incl. a SCORM-coexistence
+guard) and a cross-browser end-to-end test in Firefox (`npm run test:e2e:embed` —
+Playwright, loads the real shim/relay against an opaque-origin harness).
 
 ## Embedded editor management
 
@@ -191,10 +224,18 @@ attempts, and delete attempts from the teacher report (the grade is
 recalculated). Completion can require a passing grade (SCORM-style, see
 [DEC-0010](./research/decisiones/adr/DEC-0010-finalizacion-estilo-scorm.md)).
 
-Grading runtime uses a SCORM 1.2 bridge: a small `window.API` shim installed by
-`view.php` accepts `LMSSetValue` calls from the iDevice's bundled pipwerks
-wrapper and forwards them to `track.php`, which calls Moodle's `grade_update()`.
-xAPI support via `core_xapi` is on the roadmap.
+Grading runtime uses a SCORM 1.2 bridge whose isolation depends on the **package
+iframe security mode**
+([DEC-0059](./research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md)).
+In the default **Secure** mode the package runs in an opaque-origin sandboxed iframe
+served via `tokenpluginfile.php` (so its assets load without the session cookie): a
+`window.API` shim lives _inside_ the iframe and posts buffered scores to the Moodle page
+over a validated `postMessage` channel; the page (which holds the `sesskey`) forwards
+them to `track.php`, which calls Moodle's `grade_update()`. In **Legacy** mode the shim
+is installed by `view.php` in the same-origin parent and the iDevice's bundled pipwerks
+wrapper reaches it directly. See
+[DEC-0060](./research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md) for the
+secure serving + CSP hardening. xAPI support via `core_xapi` is on the roadmap.
 
 ## Web services (Mobile API)
 
diff --git a/assets/scorm/SCORM_API_wrapper.js b/assets/scorm/SCORM_API_wrapper.js
index 6ea6c37..34134b0 100644
--- a/assets/scorm/SCORM_API_wrapper.js
+++ b/assets/scorm/SCORM_API_wrapper.js
@@ -133,12 +133,35 @@ pipwerks.SCORM.API.get = function () {
     find = pipwerks.SCORM.API.find,
     trace = pipwerks.UTILS.trace;
 
-  if (win.parent && win.parent != win) {
-    API = find(win.parent);
+  // Check the CURRENT window's frame hierarchy first (standard pipwerks order). In
+  // the secure (opaque-origin) package mode the SCORM API is provided locally by the
+  // in-iframe bridge shim (js/scorm_bridge_shim.js, DEC-0059) as window.API, and the
+  // Moodle parent is a cross-origin/opaque frame that throws SecurityError on access.
+  // Starting at win.parent (as the prior build did) made init() throw there and the
+  // connection never went active, so no score was ever saved in secure mode. find(win)
+  // returns the local API when present and otherwise walks up same-origin ancestors,
+  // which keeps the legacy same-origin mode (API hosted by the Moodle parent) working.
+  // Every cross-origin hop is wrapped so an opaque ancestor can never abort lookup.
+  try {
+    API = find(win);
+  } catch (e) {
+    trace("API.get: find(window) threw: " + e);
+  }
+
+  if (!API && win.parent && win.parent != win) {
+    try {
+      API = find(win.parent);
+    } catch (e) {
+      trace("API.get: find(parent) blocked (cross-origin): " + e);
+    }
   }
 
-  if (!API && win.top.opener) {
-    API = find(win.top.opener);
+  try {
+    if (!API && win.top && win.top.opener) {
+      API = find(win.top.opener);
+    }
+  } catch (e) {
+    trace("API.get: find(opener) blocked: " + e);
   }
 
   if (API) {
diff --git a/blueprint.json b/blueprint.json
index 69272c8..0eccbb9 100644
--- a/blueprint.json
+++ b/blueprint.json
@@ -39,7 +39,9 @@
     },
     {
       "step": "setConfigs",
+      "comment": "iframemode is forced to legacy here (DEC-0060): the Playground's PHP-WASM service worker cannot serve an opaque-origin iframe, so the secure mode would only show the 'blocked by security configuration' notice. Legacy (same-origin) lets the demo render the package so the preview is useful. Real Moodle keeps the secure default and is unaffected by this Playground-only override.",
       "configs": [
+        { "name": "iframemode",   "value": "legacy",        "plugin": "exelearning" },
         { "name": "editormode",   "value": "embedded",      "plugin": "exelearning" },
         { "name": "display",      "value": "1",             "plugin": "exelearning" },
         { "name": "printintro",   "value": "1",             "plugin": "exelearning" },
diff --git a/classes/admin/admin_setting_stylesbuiltins.php b/classes/admin/admin_setting_stylesbuiltins.php
index 70584f7..ecb5f70 100644
--- a/classes/admin/admin_setting_stylesbuiltins.php
+++ b/classes/admin/admin_setting_stylesbuiltins.php
@@ -111,9 +111,10 @@ public function output_html($data, $query = '') {
                 : get_string('stylesenable', 'mod_exelearning');
             $toggleaction = $isenabled ? 'disablebuiltin' : 'enablebuiltin';
 
-            $togglelink = $this->action_link(
+            $togglelink = styles_action_button::link(
                 $baseurl,
                 $toggleaction,
+                'id',
                 $id,
                 $togglelabel,
                 $isenabled ? 'btn-secondary' : 'btn-success'
@@ -145,33 +146,4 @@ public function output_html($data, $query = '') {
             $query
         );
     }
-
-    /**
-     * Build a single toggle action as a sesskey-protected link styled as a button.
-     *
-     * Rendered as a link rather than an inline <form>: this setting is shown inside the
-     * admin settings page, which already wraps every setting in one <form>. A nested
-     * <form> is invalid HTML and leaks its own action/sesskey hidden fields into the
-     * outer form's submission, so the page's "Save changes" posts action=disablebuiltin
-     * instead of action=save-settings and silently saves nothing. styles.php accepts the
-     * toggle over GET (optional_param + confirm_sesskey), the same pattern Moodle core
-     * uses to enable/disable plugins.
-     *
-     * @param \moodle_url $baseurl
-     * @param string $action
-     * @param string $id
-     * @param string $label
-     * @param string $btnclass
-     * @return string
-     */
-    private function action_link(
-        \moodle_url $baseurl,
-        string $action,
-        string $id,
-        string $label,
-        string $btnclass
-    ): string {
-        $url = new \moodle_url($baseurl, ['action' => $action, 'id' => $id, 'sesskey' => sesskey()]);
-        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
-    }
 }
diff --git a/classes/admin/admin_setting_stylesuploaded.php b/classes/admin/admin_setting_stylesuploaded.php
index e98f495..12aa068 100644
--- a/classes/admin/admin_setting_stylesuploaded.php
+++ b/classes/admin/admin_setting_stylesuploaded.php
@@ -110,16 +110,18 @@ public function output_html($data, $query = '') {
                 : get_string('stylesenable', 'mod_exelearning');
             $toggleaction = $enabled ? 'disable' : 'enable';
 
-            $togglelink = $this->action_link(
+            $togglelink = styles_action_button::link(
                 $baseurl,
                 $toggleaction,
+                'slug',
                 $slug,
                 $togglelabel,
                 $enabled ? 'btn-secondary' : 'btn-success'
             );
-            $deletelink = $this->action_link(
+            $deletelink = styles_action_button::link(
                 $baseurl,
                 'delete',
+                'slug',
                 $slug,
                 get_string('stylesdelete', 'mod_exelearning'),
                 'btn-danger'
@@ -152,33 +154,4 @@ public function output_html($data, $query = '') {
             $query
         );
     }
-
-    /**
-     * Build a single action as a sesskey-protected link styled as a button.
-     *
-     * Rendered as a link rather than an inline <form>: this setting appears inside the
-     * admin settings page, which already wraps every setting in one <form>. A nested
-     * <form> is invalid HTML and leaks its action/sesskey hidden fields into the outer
-     * form's submission, so the page's "Save changes" posts the nested action (e.g.
-     * delete) instead of action=save-settings and silently saves nothing. styles.php
-     * accepts these actions over GET (optional_param + confirm_sesskey); the destructive
-     * delete is confirmed server-side there, so a prefetch cannot destroy data.
-     *
-     * @param \moodle_url $baseurl
-     * @param string $action
-     * @param string $slug
-     * @param string $label
-     * @param string $btnclass
-     * @return string
-     */
-    private function action_link(
-        \moodle_url $baseurl,
-        string $action,
-        string $slug,
-        string $label,
-        string $btnclass
-    ): string {
-        $url = new \moodle_url($baseurl, ['action' => $action, 'slug' => $slug, 'sesskey' => sesskey()]);
-        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
-    }
 }
diff --git a/classes/admin/styles_action_button.php b/classes/admin/styles_action_button.php
new file mode 100644
index 0000000..5a6c5a3
--- /dev/null
+++ b/classes/admin/styles_action_button.php
@@ -0,0 +1,63 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Shared renderer for the styles-management admin action buttons.
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace mod_exelearning\admin;
+
+/**
+ * Builds a styles-management action (enable/disable/delete) as a sesskey-protected link
+ * styled as a button.
+ *
+ * Shared by admin_setting_stylesbuiltins and admin_setting_stylesuploaded, which render
+ * the action as a link rather than an inline <form>: these settings appear inside the
+ * admin settings page, which already wraps every setting in one <form>. A nested <form>
+ * is invalid HTML and leaks its action/sesskey hidden fields into the outer form's
+ * submission, so the page's "Save changes" posts the nested action (e.g. delete) instead
+ * of action=save-settings and silently saves nothing. styles.php accepts these actions
+ * over GET (optional_param + confirm_sesskey); the destructive delete is confirmed
+ * server-side there, so a prefetch cannot destroy data.
+ */
+final class styles_action_button {
+    /**
+     * Build a single action as a sesskey-protected link styled as a button.
+     *
+     * @param \moodle_url $baseurl  The styles.php base URL.
+     * @param string $action        The action (enable/disable/enablebuiltin/disablebuiltin/delete).
+     * @param string $idkey         The query parameter name carrying the identifier ('id' or 'slug').
+     * @param string $idval         The identifier value.
+     * @param string $label         The button label.
+     * @param string $btnclass      The Bootstrap button modifier class (e.g. 'btn-danger').
+     * @return string
+     */
+    public static function link(
+        \moodle_url $baseurl,
+        string $action,
+        string $idkey,
+        string $idval,
+        string $label,
+        string $btnclass
+    ): string {
+        $url = new \moodle_url($baseurl, ['action' => $action, $idkey => $idval, 'sesskey' => sesskey()]);
+        return \html_writer::link($url, $label, ['class' => 'btn btn-sm ' . $btnclass, 'role' => 'button']);
+    }
+}
diff --git a/classes/local/package_manager.php b/classes/local/package_manager.php
index c084dff..93fe75e 100644
--- a/classes/local/package_manager.php
+++ b/classes/local/package_manager.php
@@ -240,25 +240,42 @@ public static function extract_stored(int $contextid, int $revision): void {
             1
         );
 
-        // 5) If the package (web export) does not include libs/SCORM_API_wrapper.js,
-        // inject it from the plugin's assets/ directory. eXeLearning v4 only bundles
-        // this wrapper in the SCORM export; without it, gradable iDevices display
-        // "this page is not part of a SCORM package".
-        foreach (['SCORM_API_wrapper.js', 'SCOFunctions.js'] as $shimname) {
+        // 5) Ensure the SCORM client assets live under libs/ of the extracted package.
+        // The vendored pipwerks wrapper + SCOFunctions are copied only when the export
+        // does not already bundle them: eXeLearning v4 bundles them in the SCORM export
+        // but not in the web/elpx export, and without them gradable iDevices show "this
+        // page is not part of a SCORM package". A bundled copy is never overwritten
+        // ($refresh = false). The bridge client (scorm_tracker + exe_scorm_bridge) powers
+        // the secure opaque-origin iframe mode (DEC-0059); it runs INSIDE the iframe so it
+        // must be served from the package, and being plugin-owned it is refreshed on every
+        // extract so a shim update reaches existing packages ($refresh = true).
+        $clientassets = [
+            ['SCORM_API_wrapper.js', __DIR__ . '/../../assets/scorm/SCORM_API_wrapper.js', false],
+            ['SCOFunctions.js', __DIR__ . '/../../assets/scorm/SCOFunctions.js', false],
+            ['scorm_tracker.js', __DIR__ . '/../../js/scorm_tracker.js', true],
+            ['exe_scorm_bridge.js', __DIR__ . '/../../js/scorm_bridge_shim.js', true],
+            // External-embed shim: promotes whitelisted/PDF iframes to the parent in
+            // secure mode (dormant otherwise). Plugin-owned, refreshed on every extract.
+            ['exe_embed_shim.js', __DIR__ . '/../../js/exe_embed_shim.js', true],
+        ];
+        foreach ($clientassets as $asset) {
+            [$destname, $assetpath, $refresh] = $asset;
+            if (!is_file($assetpath)) {
+                continue;
+            }
             $present = $fs->get_file(
                 $context->id,
                 'mod_exelearning',
                 'content',
                 (int) $data->revision,
                 '/libs/',
-                $shimname
+                $destname
             );
             if ($present) {
-                continue;
-            }
-            $assetpath = __DIR__ . '/../../assets/scorm/' . $shimname;
-            if (!is_file($assetpath)) {
-                continue;
+                if (!$refresh) {
+                    continue;
+                }
+                $present->delete();
             }
             $fs->create_file_from_pathname([
                 'contextid' => $context->id,
@@ -266,7 +283,7 @@ public static function extract_stored(int $contextid, int $revision): void {
                 'filearea'  => 'content',
                 'itemid'    => (int) $data->revision,
                 'filepath'  => '/libs/',
-                'filename'  => $shimname,
+                'filename'  => $destname,
             ], $assetpath);
         }
 
diff --git a/classes/local/scorm/scorm_injector.php b/classes/local/scorm/scorm_injector.php
index 7a477ce..259ba6a 100644
--- a/classes/local/scorm/scorm_injector.php
+++ b/classes/local/scorm/scorm_injector.php
@@ -33,15 +33,24 @@
  */
 final class scorm_injector {
     /**
-     * Injects SCORM wrapper script tags into the <head> of index.html and all
+     * Injects the SCORM client script tags into the <head> of index.html and all
      * html/<slug>.html pages of the extracted package.
      *
+     * Two independent, idempotent blocks are injected:
+     *  - The bridge client (libs/scorm_tracker.js + libs/exe_scorm_bridge.js) at the
+     *    TOP of <head>, so its in-memory storage polyfill and local window.API are in
+     *    place before any package script runs. It self-activates only in the secure
+     *    opaque-origin iframe mode and is dormant otherwise (DEC-0059).
+     *  - The pipwerks SCORM wrapper (libs/SCORM_API_wrapper.js + libs/SCOFunctions.js)
+     *    plus an init kick, just before </head>, used by both iframe modes.
+     *
      * @param int $contextid
      * @param int $revision
      */
     public static function inject(int $contextid, int $revision): void {
         $fs = get_file_storage();
         $marker = '<!-- mod_exelearning:scorm-loader -->';
+        $bridgemarker = '<!-- mod_exelearning:scorm-bridge -->';
         // After loading the wrapper, force `pipwerks.SCORM.init()` so that
         // connection.isActive=true and subsequent `set()` calls DO reach
         // window.parent.API.LMSSetValue. eXeLearning only invokes init() in the
@@ -57,14 +66,7 @@ public static function inject(int $contextid, int $revision): void {
                 "        }, 50);\n" .
                 "      })();\n" .
                 "    </script>\n";
-        $tags = $marker .
-                "\n    <script src=\"libs/SCORM_API_wrapper.js\"></script>" .
-                "\n    <script src=\"libs/SCOFunctions.js\"></script>" .
-                $initscript;
-        $tagshtml = $marker .
-                "\n    <script src=\"../libs/SCORM_API_wrapper.js\"></script>" .
-                "\n    <script src=\"../libs/SCOFunctions.js\"></script>" .
-                $initscript;
+        $embedmarker = '<!-- mod_exelearning:embed-shim -->';
 
         // Iterate over all HTML files in the filearea.
         $files = $fs->get_area_files(
@@ -84,14 +86,55 @@ public static function inject(int $contextid, int $revision): void {
                 continue;
             }
             $html = $file->get_content();
-            if ($html === '' || strpos($html, $marker) !== false) {
+            if ($html === '') {
                 continue;
             }
+            // Relative prefix to the package's libs/ dir: root pages use 'libs/', nested
+            // html/<slug>.html pages climb one level with '../libs/'.
             $path = $file->get_filepath();
-            $payload = ($path === '/') ? $tags : $tagshtml;
-            // Insert just before </head> (case-insensitive).
-            $newhtml = preg_replace('~</head>~i', $payload . '</head>', $html, 1);
-            if ($newhtml === null || $newhtml === $html) {
+            $libs = ($path === '/') ? 'libs/' : '../libs/';
+            $newhtml = $html;
+            $changed = false;
+
+            // Script payloads, built once per file from $libs. The bridge client
+            // (scorm_tracker.js before exe_scorm_bridge.js: the shim calls
+            // window.exeScormTracker.createScormApi) and the external-embed shim both go
+            // at the TOP of <head>; the pipwerks SCORM wrapper + init kick go just before
+            // </head>. No host list is baked for the embed shim: it promotes any candidate
+            // and the parent relay is the authoritative gate (open vs strict, DEC-0061).
+            $bridge = $bridgemarker .
+                    "\n    <script src=\"{$libs}scorm_tracker.js\"></script>" .
+                    "\n    <script src=\"{$libs}exe_scorm_bridge.js\"></script>\n";
+            $embed = $embedmarker .
+                    "\n    <script src=\"{$libs}exe_embed_shim.js\"></script>\n";
+            $scorm = $marker .
+                    "\n    <script src=\"{$libs}SCORM_API_wrapper.js\"></script>" .
+                    "\n    <script src=\"{$libs}SCOFunctions.js\"></script>" .
+                    $initscript;
+
+            // Idempotent <head> insertions, applied in order so each one matches against
+            // the HTML already modified by the previous (e.g. the embed insert sees the
+            // bridge-modified <head>). Each fires at most once, guarded by its own marker.
+            // Entry = [marker, payload, anchor regex, top?]: top appends the payload AFTER
+            // the matched <head> tag, otherwise it is prepended BEFORE the matched </head>.
+            $inserts = [
+                [$bridgemarker, $bridge, '~<head[^>]*>~i', true],
+                [$embedmarker, $embed, '~<head[^>]*>~i', true],
+                [$marker, $scorm, '~</head>~i', false],
+            ];
+            foreach ($inserts as [$mk, $payload, $regex, $top]) {
+                if (strpos($newhtml, $mk) !== false) {
+                    continue;
+                }
+                $replacement = $top ? '$0' . $payload : $payload . '$0';
+                $replaced = preg_replace($regex, $replacement, $newhtml, 1);
+                if ($replaced !== null && $replaced !== $newhtml) {
+                    $newhtml = $replaced;
+                    $changed = true;
+                }
+            }
+
+            if (!$changed) {
                 continue;
             }
             // Replace content in the filearea: delete and recreate.
diff --git a/classes/local/ui/player_iframe.php b/classes/local/ui/player_iframe.php
new file mode 100644
index 0000000..e6320e8
--- /dev/null
+++ b/classes/local/ui/player_iframe.php
@@ -0,0 +1,239 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Package iframe security mode and sandbox policy (DEC-0059).
+ *
+ * @package    mod_exelearning
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+namespace mod_exelearning\local\ui;
+
+/**
+ * Resolves the configured package iframe mode and the sandbox tokens it implies.
+ *
+ * A single site-wide admin setting (mod_exelearning/iframemode) selects how the
+ * arbitrary author HTML/JS of an `.elpx` package is embedded in view.php:
+ *
+ *  - secure (default): the iframe drops allow-same-origin, so the package runs in
+ *    an opaque origin and cannot read or modify Moodle's DOM, cookies or session.
+ *    SCORM scoring is relayed to the parent over a validated postMessage bridge
+ *    (js/scorm_bridge_shim.js in the iframe, js/scorm_bridge_relay.js in the
+ *    parent), and the parent keeps the sesskey and performs the track.php request.
+ *  - legacy: the historical same-origin sandbox, kept only as a compatibility
+ *    fallback for packages that misbehave under an opaque origin.
+ *
+ * Centralised here so the token policy is unit-testable without rendering view.php.
+ * See research ADR DEC-0059 (advances the Tier 2 roadmap of DEC-0019).
+ */
+final class player_iframe {
+    /** @var string Secure mode: opaque-origin iframe + postMessage SCORM bridge. */
+    public const MODE_SECURE = 'secure';
+
+    /** @var string Legacy mode: historical same-origin iframe. */
+    public const MODE_LEGACY = 'legacy';
+
+    /** @var string Open embeds: promote any cross-origin https iframe (DEC-0061). */
+    public const EMBED_OPEN = 'open';
+
+    /** @var string Strict embeds: only the maintained host allowlist. */
+    public const EMBED_STRICT = 'strict';
+
+    /**
+     * Default host whitelist for external video embeds promoted to the parent page.
+     *
+     * In secure mode the package is opaque, so cross-origin players (YouTube/Vimeo)
+     * load blank. Iframes whose src host is on this list are replaced by a placeholder
+     * in the package (js/exe_embed_shim.js) and rendered as a real player by the parent
+     * (js/exe_embed_relay.js). PDFs are handled separately (by .pdf extension) and need
+     * no host entry.
+     *
+     * @var string[]
+     */
+    public const DEFAULT_EMBED_HOSTS = [
+        'www.youtube.com',
+        'youtube.com',
+        'www.youtube-nocookie.com',
+        'youtube-nocookie.com',
+        'player.vimeo.com',
+        'vimeo.com',
+        'www.dailymotion.com',
+        'dailymotion.com',
+        'geo.dailymotion.com',
+        'mediateca.educa.madrid.org',
+    ];
+
+    /**
+     * Resolve the configured iframe mode, defaulting to secure for any unset or
+     * unrecognised value (fail safe: an invalid config must not weaken isolation).
+     *
+     * @return string self::MODE_SECURE or self::MODE_LEGACY.
+     */
+    public static function resolve_mode(): string {
+        $mode = get_config('mod_exelearning', 'iframemode');
+        return ($mode === self::MODE_LEGACY) ? self::MODE_LEGACY : self::MODE_SECURE;
+    }
+
+    /**
+     * Whether the configured mode isolates the package (opaque origin + bridge).
+     *
+     * @return bool True in secure mode.
+     */
+    public static function is_secure(): bool {
+        return self::resolve_mode() === self::MODE_SECURE;
+    }
+
+    /**
+     * Sandbox token list for a given mode.
+     *
+     * Both modes deliberately OMIT allow-top-navigation (a package must never be
+     * able to change the parent URL) and allow-modals (alert/confirm/prompt are UX
+     * traps). Secure mode additionally OMITS allow-same-origin (forcing an opaque
+     * origin so the package cannot reach Moodle's DOM/cookies/session) and
+     * allow-popups-to-escape-sandbox (an escaped popup would reopen at Moodle's real
+     * origin without the sandbox). allow-scripts/allow-popups/allow-forms are kept
+     * in both modes because eXeLearning v4 iDevices need jQuery + scripts, popups
+     * (interactive-video, hidden-image) and forms (quick-questions, form,
+     * scrambled-list). See research ADR DEC-0059 / DEC-0019 / AN-008.
+     *
+     * @param string $mode self::MODE_SECURE or self::MODE_LEGACY.
+     * @return string Space-separated sandbox token list.
+     */
+    public static function sandbox_tokens(string $mode): string {
+        if ($mode === self::MODE_LEGACY) {
+            return 'allow-scripts allow-same-origin allow-popups allow-forms allow-popups-to-escape-sandbox';
+        }
+        return 'allow-scripts allow-popups allow-forms';
+    }
+
+    /**
+     * Resolve the external-embed policy (DEC-0061). Default 'open' promotes any
+     * cross-origin https iframe (the player is sandboxed + cross-origin, so SOP isolates
+     * it from Moodle); 'strict' restricts to the maintained host allowlist. An
+     * unrecognised (tampered) value fails to 'strict' (toward the more restrictive),
+     * while an unset value keeps the intended 'open' default.
+     *
+     * @return string self::EMBED_OPEN or self::EMBED_STRICT.
+     */
+    public static function embed_mode(): string {
+        $value = get_config('mod_exelearning', 'embedmode');
+        if ($value === false || $value === null || $value === '') {
+            return self::EMBED_OPEN;
+        }
+        return $value === self::EMBED_OPEN ? self::EMBED_OPEN : self::EMBED_STRICT;
+    }
+
+    /**
+     * Normalized host whitelist for external video embeds (lowercase, de-duplicated).
+     * Only consulted by the relay in 'strict' mode.
+     *
+     * @return string[]
+     */
+    public static function embed_whitelist(): array {
+        $clean = [];
+        foreach (self::DEFAULT_EMBED_HOSTS as $host) {
+            $host = strtolower(trim((string) $host));
+            if ($host !== '') {
+                $clean[$host] = true;
+            }
+        }
+        return array_keys($clean);
+    }
+
+    /**
+     * Permissions-Policy header value for the embedded package (DEC-0060).
+     *
+     * Denies hardware/sensor features the package never needs. `fullscreen` is
+     * intentionally NOT denied: the iframe grants it via its allow= attribute and
+     * iDevices use it. Emitted by exelearning_pluginfile() in secure mode.
+     *
+     * @return string The Permissions-Policy header value.
+     */
+    public static function permissions_policy(): string {
+        return 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), '
+            . 'bluetooth=(), hid=(), magnetometer=(), accelerometer=(), gyroscope=(), '
+            . 'midi=(), display-capture=()';
+    }
+
+    /**
+     * Content-Security-Policy header value for the embedded package (DEC-0060).
+     *
+     * Tuned to harden without breaking eXeLearning, which relies on inline and eval'd
+     * scripts: object-src and base-uri are closed, framing is restricted to Moodle
+     * (frame-ancestors 'self'), and connect-src is limited to this site so the file
+     * token carried in the URL cannot be exfiltrated to a third-party host via
+     * fetch/XHR/beacon. External script/style/img/media/frame over https: is still
+     * allowed so MathJax, YouTube and author embeds keep working (a stricter,
+     * exfil-proof profile that also blocks those is left as a future admin toggle).
+     *
+     * @param string $siteorigin The scheme://host[:port] origin of this Moodle site.
+     * @return string The Content-Security-Policy header value.
+     */
+    public static function content_security_policy(string $siteorigin): string {
+        return "default-src 'self' $siteorigin; "
+            . "script-src 'self' $siteorigin 'unsafe-inline' 'unsafe-eval' https:; "
+            . "style-src 'self' $siteorigin 'unsafe-inline'; "
+            . "img-src 'self' $siteorigin data: blob: https:; "
+            . "media-src 'self' $siteorigin data: blob: https:; "
+            . "font-src 'self' $siteorigin data:; "
+            . "connect-src 'self' $siteorigin; "
+            . "frame-src 'self' $siteorigin https:; "
+            . "object-src 'none'; base-uri 'none'; form-action 'self' $siteorigin; "
+            . "frame-ancestors 'self'; "
+            // Keep the document opaque even if opened outside the iframe (e.g. the token
+            // URL opened in a new tab); tokens mirror the secure iframe sandbox.
+            . "sandbox allow-scripts allow-popups allow-forms";
+    }
+
+    /**
+     * Defense-in-depth response headers for a served package file (DEC-0060).
+     *
+     * In secure mode EVERY served file gets Referrer-Policy: no-referrer and
+     * X-Content-Type-Options: nosniff. The per-user file token lives in the URL path, so
+     * even a CSS/JS subresource that pulls a cross-origin image must not leak it via the
+     * Referer header; and nosniff forces each file to be interpreted by its declared
+     * Content-Type, so a package cannot smuggle executable HTML behind, e.g., a .pdf path
+     * (the promoted PDF player is unsandboxed). The document-level Content-Security-Policy
+     * and Permissions-Policy are added only for an HTML document (subresources ignore
+     * them). Returns an empty array in legacy mode, so the caller (exelearning_pluginfile)
+     * is just a header-emitting loop. Keeping the decision and the values here makes them
+     * unit-testable (the pluginfile callback that emits them exits via send_stored_file
+     * and cannot be unit-tested directly).
+     *
+     * @param string $filename The served file name (only *.html(?) get CSP/Permissions-Policy).
+     * @param string $wwwroot This Moodle site's $CFG->wwwroot (origin is derived from it).
+     * @return array Map of header name => value (empty when no headers apply).
+     */
+    public static function content_headers(string $filename, string $wwwroot): array {
+        if (!self::is_secure()) {
+            return [];
+        }
+        // Apply to every served package file (the token rides in the URL for all of them).
+        $headers = [
+            'Referrer-Policy' => 'no-referrer',
+            'X-Content-Type-Options' => 'nosniff',
+        ];
+        // CSP + Permissions-Policy are document-level and only meaningful on an HTML page.
+        if (preg_match('~\.html?$~i', $filename)) {
+            $siteorigin = preg_replace('~^(https?://[^/]+).*~i', '$1', $wwwroot);
+            $headers['Permissions-Policy'] = self::permissions_policy();
+            $headers['Content-Security-Policy'] = self::content_security_policy($siteorigin);
+        }
+        return $headers;
+    }
+}
diff --git a/docs/tracking-architecture.md b/docs/tracking-architecture.md
index 0dddb2d..aca73dc 100644
--- a/docs/tracking-architecture.md
+++ b/docs/tracking-architecture.md
@@ -13,6 +13,14 @@
 > ingestor}`. The overall (`itemnumber=0`) is taken from the package statement and validated
 > server-side, because per-iDevice `answered` statements carry no weight.
 >
+> **Secure iframe (DEC-0065):** in the default opaque-origin secure mode (DEC-0059/DEC-0060) the same
+> xAPI-primary path applies, but the trust gate changes. The emitter's `event.origin` is the opaque
+> string `"null"`, so `js/xapi_listener.js` trusts a statement by **window identity**
+> (`event.source === the package iframe's contentWindow`) instead of origin — exactly like the SCORM
+> bridge relay. The SCORM channel is kept inert by the **parent-side relay**
+> (`js/scorm_bridge_relay.js` `disableTracking`), not the baked-in shim, so it holds even for packages
+> extracted before the flag existed. Legacy (same-origin) mode keeps the `event.origin` check.
+>
 > **Kill switch:** the site-admin setting *Use xAPI grading when the package supports it*
 > (`exelearning/xapiprimaryenabled`, default on; helper `exelearning_xapi_primary_enabled()`) turns the
 > whole xAPI channel off without a code change — `view.php` then keeps the SCORM shim live and skips the
diff --git a/docs/xapi-integration-plan.md b/docs/xapi-integration-plan.md
index ac3eee1..237d46f 100644
--- a/docs/xapi-integration-plan.md
+++ b/docs/xapi-integration-plan.md
@@ -76,11 +76,18 @@ Implemented as an **inline IIFE** (the `js/scorm_tracker.js` / DEC-0056 pattern)
 client JS is injected synchronously and needs no AMD build).
 
 - Listen to `window` `message` events; accept **only** `event.data.type === 'exe-xapi-statement'`.
-- **Validate `event.origin`** against the iframe `pluginfile.php`/wwwroot origin; drop `'*'` /
-  mismatched senders (defense in depth even though `config_injector` sets `parentOrigin` — RIE-013).
+- **Trust gate, mode-dependent (DEC-0065).** *Legacy (same-origin):* validate `event.origin` against
+  the wwwroot origin; drop `'*'` / mismatched senders (RIE-013). *Secure (opaque-origin, the default —
+  DEC-0059/DEC-0060):* the emitter's `event.origin` is the string `"null"`, so trust by **window
+  identity** (`event.source === the package iframe's contentWindow`) instead — the same anchor the
+  SCORM bridge relay uses. `view.php` selects the mode via `iframeid` (secure) vs `allowedOrigin`
+  (legacy).
 - De-dup by `statement.id` within the page session.
 - Forward to `xapi_track.php` with `sesskey`, `cmid`, and the page-load `registration`.
 - Never read or expose PII in JS.
+- In **secure mode** the parallel SCORM bridge is kept **inert** (so the package is graded once) by the
+  parent-side relay (`js/scorm_bridge_relay.js` `disableTracking`), not the baked-in shim — robust even
+  for packages extracted before the flag existed (DEC-0065).
 
 ## 4. Server endpoint (`xapi_track.php`) — *as shipped (DEC-0064)*
 
diff --git a/docs/xapi-qa-checklist.md b/docs/xapi-qa-checklist.md
index 46b4706..d15c7d7 100644
--- a/docs/xapi-qa-checklist.md
+++ b/docs/xapi-qa-checklist.md
@@ -1,4 +1,4 @@
-# xAPI ingestion — manual QA checklist (DEC-0064)
+# xAPI ingestion — manual QA checklist (DEC-0064, DEC-0065)
 
 > Unit/integration tests (`tests/local/xapi/*`, `tests/js/xapi_listener.test.js`) cover the
 > validation, grading parity and the listener resend. This checklist is the **manual, real-package**
@@ -24,7 +24,9 @@
 - **Attempts** — `exelearning_attempt`: `itemnumber>0` = per-iDevice, `itemnumber=0` = overall.
 - **Audit** — `exelearning_tracking_events`: one row per `statement.id` with `verb` + `registration`.
 - **Channel check** — view source / Network: an XAPI package POSTs to **`xapi_track.php`** and the
-  SCORM shim is inert (no `track.php` POSTs); a LEGACY package POSTs to **`track.php`** only.
+  SCORM shim is inert (no `track.php` POSTs); a LEGACY package POSTs to **`track.php`** only. In
+  **secure** iframe mode (DEC-0065) the package iframe is opaque and the SCORM **bridge relay**
+  suppresses the `track.php` POST, so an XAPI package still shows only `xapi_track.php`.
 
 ## Scenarios
 
@@ -41,12 +43,15 @@
 | 9 | **Kill switch off** | Uncheck *Use xAPI grading…*; reload an XAPI activity | The package now grades via **SCORM** (`track.php`), the xAPI listener is **not** injected, and a direct POST to `xapi_track.php` returns `{ok:true,disabled:true}` without grading. Re-check the box → back to xAPI. |
 | 10 | **Idempotency** | Re-deliver the same statement (e.g. duplicate `postMessage`, or replay the POST) | Exactly one audit row and one attempt row; the grade is not applied twice (`duplicate:true`). |
 | 11 | **Registration hardening** | Craft a direct `xapi_track.php` POST with an over-long / non-alphanumeric `context.registration` and no body registration | No 500: the token is sanitised + capped to 40 chars; the attempt/audit store the bounded value. |
-| 12 | **Origin rejection** | (If reproducible) deliver a statement from a mismatched/`'*'` origin | Dropped by the listener; never reaches `xapi_track.php`. |
+| 12 | **Origin / window-identity rejection** | Deliver a statement from a window that is not the package iframe — legacy: a mismatched/`'*'` origin; secure: a different `event.source` (e.g. another frame) | Dropped by the listener; never reaches `xapi_track.php`. |
+| 13 | **xAPI grading in secure iframe mode (DEC-0065)** | *Site admin ▸ … ▸ eXeLearning ▸ iframe security mode* = **secure** (default). Run the XAPI package; a student grades an interaction | Grades land via `xapi_track.php` exactly like legacy; the SCORM **bridge relay** forwards no score (no `track.php` POST); per-iDevice/overall columns correct. The opaque iframe's `event.origin` is `"null"` yet statements are accepted (window identity = `event.source` is the package iframe). |
+| 14 | **Kill switch flipped during an open session (known limitation, DEC-0065/DEC-0064)** | Open an XAPI activity as a student; while it stays open, an admin **unchecks** *Use xAPI grading…*; the student answers **without reloading** | That already-open page grades **neither** channel until reloaded (SCORM suppressed client-side, xAPI ignored server-side); after a reload it grades via SCORM. Pre-existing since DEC-0064 — the kill switch takes effect on the **next** page load, so flip it outside activity hours. |
 
 ## Sign-off
 
 - [ ] Scenarios 1–4 (core grading + the answered-only edge) pass.
 - [ ] Scenarios 5–9 (resilience, attempts, preview, grading off, kill switch) pass.
-- [ ] Scenarios 10–12 (idempotency, input hardening, origin) pass.
+- [ ] Scenarios 10–12 (idempotency, input hardening, origin/window-identity) pass.
+- [ ] Scenarios 13–14 (secure-mode xAPI grading; kill-switch-mid-session limitation understood) pass.
 - [ ] Gradebook totals and activity completion are correct for at least one PERITEM and one OVERALL run.
 - [ ] `exelearning_tracking_events` monitoring query returns 0 for a clean run (no orphaned `answered`).
diff --git a/js/exe_embed_relay.js b/js/exe_embed_relay.js
new file mode 100644
index 0000000..ed2832d
--- /dev/null
+++ b/js/exe_embed_relay.js
@@ -0,0 +1,510 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Parent-side external-embed relay for the secure (opaque-origin) package mode.
+ *
+ * Companion to js/exe_embed_shim.js (baked into the package, runs INSIDE the iframe).
+ * In secure mode the package is opaque, so cross-origin players (YouTube, Vimeo) and
+ * PDFs render blank. The shim replaces each candidate iframe with a placeholder and
+ * postMessages its geometry here; this relay (the trusted half) validates each URL and
+ * overlays the real player inline over the placeholder.
+ *
+ * Trust model (DEC-0061): the promoted player is rendered cross-origin and SANDBOXED, so
+ * the same-origin policy isolates it from this LMS page (it cannot read the DOM, cookies,
+ * session or file token). Two modes:
+ *  - 'open' (default): promote any iframe whose src is https AND cross-origin to the LMS
+ *    (rejecting same-origin, sub/superdomains of the LMS, IP/loopback/local hosts and
+ *    userinfo). No host list. The host is irrelevant to escape; the residual is
+ *    phishing/tracking, bounded to the content's own box (the overlay is clamped).
+ *  - 'strict': only a maintained host allowlist with per-provider canonical-URL
+ *    reconstruction (the pre-DEC-0061 behaviour), for high-security deployments.
+ * "Any https .pdf" is always allowed (same-origin only for this package's own files).
+ *
+ * Messages are authenticated by window identity (event.source === a known CONTENT
+ * iframe, never a promoted player); the opaque origin has no useful event.origin.
+ *
+ * Exposed two ways from a single body: window.exeEmbedRelay (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-0061.
+ *
+ * CANONICAL SOURCE for the eXeLearning embedder family. wp-exelearning
+ * (assets/js/exe-embed-relay.js) and omeka-s-exelearning (asset/js/exe-embed-relay.js)
+ * mirror this logic (only the export wrapper differs: they are auto-running IIFEs).
+ * Keep the three in sync; tools/check-embed-sync.mjs fails if they drift.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Build a host lookup map from a whitelist array (lowercased). Used by 'strict' mode.
+     *
+     * @param {string[]} list
+     * @returns {Object}
+     */
+    function buildWhitelist(list) {
+        var map = {};
+        (list || []).forEach(function (host) {
+            map[String(host).toLowerCase()] = true;
+        });
+        return map;
+    }
+
+    /**
+     * Directory portion of the content iframe src (everything up to the last '/').
+     *
+     * @param {string} src
+     * @returns {string}
+     */
+    function contentDir(src) {
+        try {
+            return new URL(src, window.location.href).href.replace(/[^/]*([?#].*)?$/, '');
+        } catch (e) {
+            return '';
+        }
+    }
+
+    /**
+     * Long hex token shared by the content URL and its assets (null when there is
+     * none, e.g. content URLs that use numeric ids).
+     *
+     * @param {string} src
+     * @returns {?string}
+     */
+    function packageId(src) {
+        var match = String(src).match(/[a-f0-9]{12,}/i);
+        return match ? match[0] : null;
+    }
+
+    /**
+     * Whether a same-origin URL is one of this package's own extracted files: under
+     * the content's own directory, or carrying the package hash as a path segment.
+     *
+     * @param {URL} url
+     * @param {string} contentSrc
+     * @returns {boolean}
+     */
+    function isSameOriginPackageFile(url, contentSrc) {
+        var dir = contentDir(contentSrc);
+        if (dir && url.href.indexOf(dir) === 0) {
+            return true;
+        }
+        var id = packageId(contentSrc);
+        return !!(id && url.pathname.indexOf('/' + id + '/') !== -1);
+    }
+
+    /**
+     * Whether a host is an IP literal (v4/v6) or a loopback/local name. Such hosts are
+     * cross-origin to the LMS yet target the machine/internal network, so they are
+     * rejected even though SOP would isolate them.
+     *
+     * @param {string} host  Lowercased URL.hostname.
+     * @returns {boolean}
+     */
+    function isIpOrLocalHost(host) {
+        if (!host) { return true; }
+        if (host === 'localhost' || /\.localhost$/.test(host) || /\.local$/.test(host)) { return true; }
+        if (host.charAt(0) === '[' || host.indexOf(':') !== -1) { return true; }  // IPv6 (bracketed).
+        if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) { return true; }                 // Any IPv4 literal.
+        return false;
+    }
+
+    /**
+     * Lowercase a hostname and strip a single trailing dot. 'lms.example.org.' (the
+     * FQDN-root form) resolves to the same vhost as 'lms.example.org' but compares
+     * unequal as a raw string, so without this it would slip past the same-origin /
+     * related-to-LMS gate below and be promoted as a cross-origin player.
+     *
+     * @param {string} host
+     * @returns {string}
+     */
+    function normalizeHost(host) {
+        return (host || '').toLowerCase().replace(/\.$/, '');
+    }
+
+    /**
+     * Whether a host equals, is a subdomain of, or is a superdomain of the LMS host
+     * (dotted boundary so 'evil-lms.example' does not match 'lms.example'). Such hosts
+     * may share the LMS cookies, so they are rejected. Both sides are normalised so the
+     * trailing-dot FQDN-root form cannot evade the comparison.
+     *
+     * @param {string} host
+     * @param {string} lmsHost
+     * @returns {boolean}
+     */
+    function isRelatedToLms(host, lmsHost) {
+        host = normalizeHost(host);
+        lmsHost = normalizeHost(lmsHost);
+        if (!lmsHost) { return false; }
+        return host === lmsHost || host.endsWith('.' + lmsHost) || lmsHost.endsWith('.' + host);
+    }
+
+    /**
+     * The structural invariant: an https URL cross-origin to the LMS and not pointing at
+     * a sub/superdomain, an IP/loopback/local host, or carrying userinfo. This is the
+     * only attacker-influenced gate in 'open' mode, and it is what makes the sandboxed
+     * player's allow-same-origin safe (the embed keeps ITS OWN origin, isolated by SOP).
+     *
+     * @param {URL} url
+     * @returns {boolean}
+     */
+    function isCrossOriginHttps(url) {
+        if (url.protocol !== 'https:') { return false; }
+        if (url.username || url.password) { return false; }
+        if (url.origin === window.location.origin) { return false; }
+        var host = normalizeHost(url.hostname);
+        if (isIpOrLocalHost(host)) { return false; }
+        var lmshost = (window.location && window.location.hostname) ? window.location.hostname : '';
+        if (isRelatedToLms(host, lmshost)) { return false; }
+        return true;
+    }
+
+    /**
+     * Validate an embed URL. Returns {url, kind ('video'|'pdf'), sameorigin?} or null.
+     *
+     * @param {string} raw         The reported (absolute) embed URL.
+     * @param {string} contentSrc  The src of the content iframe that reported it.
+     * @param {Object} opts        {strict: boolean, whitelist: Object}.
+     * @returns {?Object}
+     */
+    function validate(raw, contentSrc, opts) {
+        opts = opts || {};
+        var url;
+        try {
+            // Parse as an ABSOLUTE URL (the shim always reports absolute). No base:
+            // a relative/scheme-relative value would otherwise inherit the LMS origin
+            // and pass as same-origin -- here it throws and is rejected instead.
+            url = new URL(raw);
+        } catch (e) {
+            return null;
+        }
+        if (url.username || url.password) {
+            return null; // Reject userinfo, e.g. https://evil.com@youtube.com/.
+        }
+        var host = url.hostname.toLowerCase();
+
+        // PDFs: any cross-origin https .pdf, or a same-origin file that belongs to this
+        // package (served as application/pdf + nosniff, never executable HTML).
+        if (/\.pdf$/i.test(url.pathname)) {
+            if (url.origin === window.location.origin) {
+                return isSameOriginPackageFile(url, contentSrc) ? { url: url.href, kind: 'pdf', sameorigin: true } : null;
+            }
+            return isCrossOriginHttps(url) ? { url: url.href, kind: 'pdf' } : null;
+        }
+
+        // Strict mode: maintained host allowlist + per-provider canonical reconstruction.
+        if (opts.strict) {
+            var whitelist = opts.whitelist || {};
+            if (whitelist[host] && url.protocol === 'https:') {
+                var m;
+                if (host.indexOf('youtube') !== -1) {
+                    m = url.pathname.match(/^\/embed\/([A-Za-z0-9_-]{6,})$/);
+                    return m ? { url: 'https://www.youtube-nocookie.com/embed/' + m[1], kind: 'video' } : null;
+                }
+                if (host.indexOf('vimeo') !== -1) {
+                    m = url.pathname.match(/^\/video\/([0-9]+)$/);
+                    return m ? { url: 'https://player.vimeo.com/video/' + m[1], kind: 'video' } : null;
+                }
+                if (host.indexOf('dailymotion') !== -1) {
+                    m = url.pathname.match(/^\/embed\/video\/([A-Za-z0-9]{5,})$/);
+                    return m ? { url: 'https://www.dailymotion.com/embed/video/' + m[1], kind: 'video' } : null;
+                }
+                if (host === 'mediateca.educa.madrid.org') {
+                    m = url.pathname.match(/^\/video\/([A-Za-z0-9]{8,})(?:\/fs)?$/);
+                    return m ? { url: 'https://mediateca.educa.madrid.org/video/' + m[1] + '/fs', kind: 'video' } : null;
+                }
+            }
+            return null;
+        }
+
+        // Open mode (default): any cross-origin https iframe is a video embed.
+        return isCrossOriginHttps(url) ? { url: url.href, kind: 'video' } : null;
+    }
+
+    /**
+     * Create the player iframe for a validated embed. The video player gets allow-same-origin
+     * (so the cross-origin provider keeps its own origin and renders) while omitting
+     * allow-top-navigation/allow-modals, so a hostile embed cannot redirect the LMS tab or
+     * spam dialogs. A same-origin package PDF is served as application/pdf + nosniff (never
+     * executable HTML) and is left unsandboxed so the browser's built-in viewer renders it; a
+     * CROSS-ORIGIN PDF URL comes from the untrusted package, so it is sandboxed WITHOUT
+     * allow-top-navigation (a server can serve scripted HTML at a .pdf path, which unsandboxed
+     * could top-navigate the parent tab to a phishing page).
+     *
+     * @param {Object} result {url, kind, sameorigin?} from validate().
+     * @returns {HTMLIFrameElement}
+     */
+    function makePlayer(result) {
+        var frame = document.createElement('iframe');
+        frame.style.cssText = 'position:absolute;border:0;pointer-events:auto;';
+        // Mark as a player so it is never mistaken for a content source (message auth).
+        frame.setAttribute('data-exe-embed-player', '1');
+        if (result.kind === 'video') {
+            frame.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups allow-forms allow-presentation');
+            frame.setAttribute('allow', 'autoplay; encrypted-media; fullscreen; picture-in-picture; clipboard-write');
+            frame.setAttribute('allowfullscreen', '');
+            frame.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+        } else if (result.sameorigin) {
+            // Same-origin PDF that belongs to THIS package: served application/pdf + nosniff
+            // (never executable HTML, so it cannot script or navigate), left unsandboxed so the
+            // browser's built-in viewer renders it (it shows the broken-document icon inside a
+            // sandbox). The load guard still removes it if it redirects to the LMS origin.
+            frame.setAttribute('allow', 'fullscreen');
+            frame.setAttribute('referrerpolicy', 'no-referrer');
+        } else {
+            // Cross-origin PDF whose URL is controlled by the untrusted package. A server can
+            // serve scripted HTML at a ".pdf" path; unsandboxed, that frame could top-navigate
+            // the Moodle tab to a phishing page on a click (a package must never change the
+            // parent URL). Sandbox it WITHOUT allow-top-navigation/allow-scripts; allow-same-
+            // origin keeps the provider's own origin (SOP-isolated from the LMS). Trade-off: a
+            // genuine cross-origin PDF may render the broken-document icon under the sandbox --
+            // accepted, since local package PDFs (the common case) take the branch above and
+            // blocking the tab-redirect vector matters more than inlining a remote PDF.
+            frame.setAttribute('sandbox', 'allow-same-origin');
+            frame.setAttribute('allow', 'fullscreen');
+            frame.setAttribute('referrerpolicy', 'no-referrer');
+        }
+        frame.src = result.url;
+        // Tag with the URL it renders so sync() can detect when a reused embed id (the
+        // shim restarts its counter per page) now points at a different URL.
+        frame.setAttribute('data-exe-embed-src', result.url);
+        return frame;
+    }
+
+    /**
+     * Create a relay instance.
+     *
+     * @param {Object} config {mode: 'open'|'strict', whitelist: string[]}
+     * @returns {Object}
+     */
+    function createRelay(config) {
+        config = config || {};
+        var strict = config.mode === 'strict';
+        var whitelist = buildWhitelist(config.whitelist);
+        var overlays = [];
+
+        function findOverlay(iframe) {
+            for (var i = 0; i < overlays.length; i++) {
+                if (overlays[i].iframe === iframe) {
+                    return overlays[i];
+                }
+            }
+            return null;
+        }
+
+        // Resolve the CONTENT iframe a message came from. Promoted players are excluded
+        // (data-exe-embed-player): a sandboxed player with allow-same-origin could
+        // otherwise postMessage a forged 'sync' and impersonate a content source.
+        function frameForSource(source) {
+            var frames = document.getElementsByTagName('iframe');
+            for (var i = 0; i < frames.length; i++) {
+                if (frames[i].getAttribute('data-exe-embed-player')) {
+                    continue;
+                }
+                if (frames[i].contentWindow === source) {
+                    return frames[i];
+                }
+            }
+            return null;
+        }
+
+        function overlayFor(iframe) {
+            var entry = findOverlay(iframe);
+            if (entry) {
+                return entry;
+            }
+            var el = document.createElement('div');
+            el.className = 'exe-embed-overlay';
+            el.style.cssText = 'position:absolute;overflow:hidden;pointer-events:none;z-index:2147483646;';
+            document.body.appendChild(el);
+            entry = { iframe: iframe, el: el, players: {} };
+            overlays.push(entry);
+            return entry;
+        }
+
+        function positionOverlay(entry, rect) {
+            rect = rect || entry.iframe.getBoundingClientRect();
+            var scrollX = window.pageXOffset || document.documentElement.scrollLeft || 0;
+            var scrollY = window.pageYOffset || document.documentElement.scrollTop || 0;
+            entry.el.style.left = (rect.left + scrollX) + 'px';
+            entry.el.style.top = (rect.top + scrollY) + 'px';
+            entry.el.style.width = rect.width + 'px';
+            entry.el.style.height = rect.height + 'px';
+        }
+
+        // D1: if a promoted embed lands SAME-ORIGIN to the LMS (e.g. a cross-origin URL
+        // that 30x-redirects to this origin), with allow-same-origin it would become
+        // scriptable against this page -> remove it. A genuine cross-origin player throws
+        // on contentWindow.document (expected, kept). Not armed for same-origin package
+        // PDFs (intentionally same-origin, served as application/pdf).
+        function armSameOriginGuard(entry, id, player) {
+            player.addEventListener('load', function () {
+                try {
+                    if (player.contentWindow && player.contentWindow.document) {
+                        if (player.parentNode) { player.parentNode.removeChild(player); }
+                        if (entry.players[id] === player) { delete entry.players[id]; }
+                    }
+                } catch (e) { /* cross-origin: expected, keep the player */ }
+            });
+        }
+
+        function sync(entry, embeds, contentSrc) {
+            // The content iframe's box is invariant across this sync pass (the loop only
+            // mutates the overlay and its players), so read it once and reuse it for the
+            // overlay position and every player clamp -- avoids a forced reflow per embed.
+            var rect = entry.iframe.getBoundingClientRect();
+            positionOverlay(entry, rect);
+            var seen = {};
+            embeds.forEach(function (embed) {
+                if (!embed || typeof embed.id !== 'string') {
+                    return;
+                }
+                if (!isFinite(embed.x) || !isFinite(embed.y) || !isFinite(embed.w) || !isFinite(embed.h)) {
+                    return;
+                }
+                var result = validate(embed.url, contentSrc, { strict: strict, whitelist: whitelist });
+                if (!result) {
+                    return;
+                }
+                seen[embed.id] = true;
+                var player = entry.players[embed.id];
+                // After the content navigates, the shim reuses ids (exe-embed-1, ...) for
+                // the new page's embeds. If this id now renders a different URL, drop the
+                // stale player so the previous page's video does not linger here.
+                if (player && player.getAttribute('data-exe-embed-src') !== result.url) {
+                    player.parentNode.removeChild(player);
+                    delete entry.players[embed.id];
+                    player = null;
+                }
+                if (!player) {
+                    player = makePlayer(result);
+                    entry.el.appendChild(player);
+                    entry.players[embed.id] = player;
+                    if (!result.sameorigin) {
+                        armSameOriginGuard(entry, embed.id, player);
+                    }
+                }
+                // Defence in depth against clickjacking: the overlay is clamped to the
+                // content iframe's box and clips with overflow:hidden, so a player can
+                // never cover host UI outside the iframe. Cap the player size to the
+                // overlay too (the content reports geometry, the parent owns rendering).
+                // Reuses the iframe rect read once at the top of this pass.
+                player.style.left = embed.x + 'px';
+                player.style.top = embed.y + 'px';
+                player.style.width = Math.min(embed.w, rect.width) + 'px';
+                player.style.height = Math.min(embed.h, rect.height) + 'px';
+            });
+            Object.keys(entry.players).forEach(function (id) {
+                if (!seen[id]) {
+                    entry.players[id].parentNode.removeChild(entry.players[id]);
+                    delete entry.players[id];
+                }
+            });
+        }
+
+        function onMessage(event) {
+            var data = event.data;
+            if (!data || data.type !== 'exe-embed' || data.action !== 'sync' || !Array.isArray(data.embeds)) {
+                return;
+            }
+            var iframe = frameForSource(event.source);
+            if (!iframe) {
+                return;
+            }
+            sync(overlayFor(iframe), data.embeds, iframe.src);
+        }
+
+        // Browser-only glue below (window listeners, reflow on scroll/resize, pinging
+        // the content iframes). Exercised by the Playwright/Firefox e2e
+        // (tests/e2e/embed.spec.cjs), not the happy-dom unit tests.
+        /* v8 ignore start */
+        function pingAll() {
+            var frames = document.getElementsByTagName('iframe');
+            for (var i = 0; i < frames.length; i++) {
+                if (frames[i].getAttribute('data-exe-embed-player')) {
+                    continue;
+                }
+                try {
+                    frames[i].contentWindow.postMessage({ type: 'exe-embed', action: 'request' }, '*');
+                } catch (e) {
+                    // Cross-origin player iframes reject this; harmless.
+                }
+            }
+        }
+
+        var scheduled = false;
+        function scheduleReflow() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            window.requestAnimationFrame(function () {
+                scheduled = false;
+                for (var i = 0; i < overlays.length; i++) {
+                    positionOverlay(overlays[i]);
+                }
+            });
+        }
+        /* v8 ignore stop */
+
+        return {
+            onMessage: onMessage,
+            sync: sync,
+            validate: function (raw, contentSrc) {
+                return validate(raw, contentSrc, { strict: strict, whitelist: whitelist });
+            },
+            /* v8 ignore start */
+            init: function () {
+                window.addEventListener('message', onMessage);
+                window.addEventListener('resize', scheduleReflow);
+                window.addEventListener('scroll', scheduleReflow, true);
+                window.addEventListener('load', pingAll);
+                pingAll();
+                window.setTimeout(pingAll, 500);
+                return this;
+            }
+            /* v8 ignore stop */
+        };
+    }
+
+    /**
+     * Bootstrap: create a relay from config and start listening.
+     *
+     * @param {Object} config {mode: 'open'|'strict', whitelist: string[]}
+     * @returns {Object}
+     */
+    /* v8 ignore next 3 */
+    function init(config) {
+        return createRelay(config).init();
+    }
+
+    var exp = {
+        buildWhitelist: buildWhitelist,
+        contentDir: contentDir,
+        packageId: packageId,
+        isSameOriginPackageFile: isSameOriginPackageFile,
+        isIpOrLocalHost: isIpOrLocalHost,
+        normalizeHost: normalizeHost,
+        isRelatedToLms: isRelatedToLms,
+        isCrossOriginHttps: isCrossOriginHttps,
+        validate: validate,
+        makePlayer: makePlayer,
+        createRelay: createRelay,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap (view.php) consumes window.exeEmbedRelay.
+    if (typeof window !== 'undefined') { window.exeEmbedRelay = exp; }
+})();
diff --git a/js/exe_embed_shim.js b/js/exe_embed_shim.js
new file mode 100644
index 0000000..b17fa9d
--- /dev/null
+++ b/js/exe_embed_shim.js
@@ -0,0 +1,269 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * In-iframe external-embed shim for the secure (opaque-origin) package mode.
+ *
+ * Baked into the package (libs/exe_embed_shim.js) and loaded from the <head> of every
+ * page, alongside the SCORM bridge. In secure mode the package runs in an opaque-origin
+ * sandbox, so the sandbox flag propagates to nested iframes and cross-origin players
+ * (YouTube, Vimeo) plus PDFs render blank. This shim replaces each cross-origin (https)
+ * or .pdf iframe with a same-size placeholder and reports its geometry to the parent,
+ * which validates it and overlays the real player inline (see js/exe_embed_relay.js). It
+ * self-activates ONLY in the opaque origin (so the same baked file stays dormant in
+ * legacy same-origin mode, where external players already render inline and the relay is
+ * not loaded).
+ *
+ * There is no host list here: the shim promotes any cross-origin https (or .pdf) iframe
+ * as a candidate and the parent relay is the authoritative gate (open vs strict mode,
+ * DEC-0061). postMessage targetOrigin is '*' because the opaque origin has no stable
+ * value; the parent authenticates messages by event.source instead.
+ *
+ * Exposed two ways from a single body: window.exeEmbedShim (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-0059.
+ *
+ * CANONICAL SOURCE for the eXeLearning embedder family. wp-exelearning
+ * (assets/js/exe-embed-shim.js) and omeka-s-exelearning (asset/js/exe-embed-shim.js)
+ * mirror this logic (only the export wrapper differs: they are auto-running IIFEs).
+ * Keep the three in sync; tools/check-embed-sync.mjs fails if they drift.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Whether this document runs in an opaque origin (secure sandbox). In an opaque
+     * origin document.cookie throws and window.origin is "null".
+     *
+     * @returns {boolean}
+     */
+    function isOpaqueOrigin() {
+        try {
+            void document.cookie;
+            return window.origin === 'null';
+        } catch (e) {
+            return true;
+        }
+    }
+
+    /**
+     * Whether a URL path ends in .pdf (PDFs also fail under the opaque sandbox).
+     *
+     * @param {string} url
+     * @returns {boolean}
+     */
+    function isPdfUrl(url) {
+        try {
+            return /\.pdf$/i.test(new URL(url, window.location.href).pathname);
+        } catch (e) {
+            return false;
+        }
+    }
+
+    /**
+     * Whether a src resolves to an https URL on a host other than this document's own
+     * (served) host -- i.e. a cross-origin external embed. The opaque document is still
+     * served from the platform, so window.location.hostname is the platform host and the
+     * comparison is reliable. The parent relay re-validates authoritatively (DEC-0061);
+     * this is only a candidate filter so same-origin content iframes are left untouched.
+     *
+     * @param {string} src
+     * @returns {boolean}
+     */
+    function isCrossOriginHttps(src) {
+        try {
+            var u = new URL(src, window.location.href);
+            // Strip a single trailing dot so the LMS host in its FQDN-root form
+            // ('host.') counts as same-host and is not reported as a candidate.
+            var host = u.hostname.toLowerCase().replace(/\.$/, '');
+            var here = window.location.hostname.toLowerCase().replace(/\.$/, '');
+            return u.protocol === 'https:' && host !== here;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    /**
+     * Whether an iframe src should be promoted to the parent: any cross-origin https
+     * embed or a .pdf (both render blank under the opaque sandbox). No host list -- the
+     * parent relay decides what actually renders (open vs strict mode).
+     *
+     * @param {string} src
+     * @returns {boolean}
+     */
+    function isPromotable(src) {
+        return isCrossOriginHttps(src) || isPdfUrl(src);
+    }
+
+    /**
+     * Render a width/height attribute value as a CSS length.
+     *
+     * @param {?string} value
+     * @param {string} fallback
+     * @returns {string}
+     */
+    function cssSize(value, fallback) {
+        if (!value) {
+            return fallback;
+        }
+        return /^[0-9]+$/.test(String(value)) ? value + 'px' : String(value);
+    }
+
+    /**
+     * Replace whitelisted/PDF iframes with placeholders that reserve their box and
+     * carry the embed id + url. Returns the created placeholder elements.
+     *
+     * @param {Document|Element} root A document or a container element to scan.
+     * @param {Object} counter {n:int} mutable id counter (kept across calls).
+     * @returns {Element[]}
+     */
+    function promote(root, counter) {
+        var created = [];
+        var maker = root.ownerDocument || root;
+        var frames = root.querySelectorAll('iframe[src]');
+        for (var i = 0; i < frames.length; i++) {
+            var frame = frames[i];
+            if (frame.getAttribute('data-exe-embed-id')) {
+                continue;
+            }
+            var src = frame.getAttribute('src');
+            if (!isPromotable(src)) {
+                continue;
+            }
+            var rect = frame.getBoundingClientRect ? frame.getBoundingClientRect() : { width: 0, height: 0 };
+            var placeholder = maker.createElement('div');
+            counter.n += 1;
+            placeholder.setAttribute('data-exe-embed-id', 'exe-embed-' + counter.n);
+            // Report an ABSOLUTE url: the shim runs inside the content, so resolve the
+            // (possibly relative) src against the content location. The parent relay
+            // cannot — it would resolve a relative url against the host page instead.
+            var absoluteUrl = src;
+            try {
+                absoluteUrl = new URL(src, window.location.href).href;
+            } catch (e) {
+                absoluteUrl = src;
+            }
+            placeholder.setAttribute('data-exe-embed-url', absoluteUrl);
+            placeholder.className = frame.className;
+            placeholder.style.display = 'block';
+            placeholder.style.maxWidth = '100%';
+            placeholder.style.width = cssSize(frame.getAttribute('width'), (rect.width || 0) + 'px');
+            placeholder.style.height = cssSize(frame.getAttribute('height'), (rect.height || 0) + 'px');
+            placeholder.style.background = '#000';
+            frame.parentNode.replaceChild(placeholder, frame);
+            created.push(placeholder);
+        }
+        return created;
+    }
+
+    /**
+     * Collect the geometry of every placeholder in the document.
+     *
+     * @param {Document} doc
+     * @returns {Object[]}
+     */
+    function collect(doc) {
+        var embeds = [];
+        var nodes = doc.querySelectorAll('[data-exe-embed-id]');
+        for (var i = 0; i < nodes.length; i++) {
+            var node = nodes[i];
+            var rect = node.getBoundingClientRect();
+            embeds.push({
+                id: node.getAttribute('data-exe-embed-id'),
+                url: node.getAttribute('data-exe-embed-url'),
+                x: rect.left,
+                y: rect.top,
+                w: rect.width,
+                h: rect.height
+            });
+        }
+        return embeds;
+    }
+
+    /**
+     * Bootstrap inside the package iframe (no-op outside the secure opaque origin).
+     * Browser-only glue (requires a framed, opaque-origin window); exercised by the
+     * Playwright/Firefox e2e (tests/e2e/embed.spec.cjs), not the happy-dom unit tests.
+     */
+    /* v8 ignore start */
+    function init() {
+        if (window.parent === window || !isOpaqueOrigin()) {
+            return;
+        }
+        var counter = { n: 0 };
+        var scheduled = false;
+
+        function report() {
+            window.parent.postMessage({ type: 'exe-embed', action: 'sync', embeds: collect(document) }, '*');
+        }
+        function schedule() {
+            if (scheduled) {
+                return;
+            }
+            scheduled = true;
+            window.requestAnimationFrame(function () {
+                scheduled = false;
+                report();
+            });
+        }
+        function run() {
+            promote(document, counter);
+            report();
+        }
+
+        run();
+        if (window.MutationObserver) {
+            new MutationObserver(function () {
+                promote(document, counter);
+                schedule();
+            }).observe(document.documentElement, { childList: true, subtree: true });
+        }
+        window.addEventListener('scroll', schedule, true);
+        window.addEventListener('resize', schedule);
+        window.addEventListener('load', report);
+        window.addEventListener('message', function (event) {
+            if (event.source !== window.parent) {
+                return;
+            }
+            var data = event.data;
+            if (data && data.type === 'exe-embed' && data.action === 'request') {
+                run();
+            }
+        });
+    }
+    /* v8 ignore stop */
+
+    var exp = {
+        isOpaqueOrigin: isOpaqueOrigin,
+        isPdfUrl: isPdfUrl,
+        isCrossOriginHttps: isCrossOriginHttps,
+        isPromotable: isPromotable,
+        promote: promote,
+        collect: collect,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap consumes window.exeEmbedShim; auto-run inside the iframe.
+    if (typeof window !== 'undefined') {
+        window.exeEmbedShim = exp;
+        if (typeof document !== 'undefined') {
+            if (document.readyState === 'loading') {
+                document.addEventListener('DOMContentLoaded', init);
+            } else {
+                init();
+            }
+        }
+    }
+})();
diff --git a/js/scorm_bridge_relay.js b/js/scorm_bridge_relay.js
new file mode 100644
index 0000000..c444a5a
--- /dev/null
+++ b/js/scorm_bridge_relay.js
@@ -0,0 +1,253 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Parent-side SCORM bridge relay for the secure (opaque-origin) package mode.
+ *
+ * Injected inline by view.php (secure mode only) so its message listener is in place
+ * before the package iframe loads. It is the trusted half of the bridge: the iframe
+ * runs in an opaque origin and CANNOT reach this page, so the only thing it can do is
+ * postMessage buffered SCORM scores here. This relay validates every message and, for
+ * accepted ones, performs the authenticated track.php request (keeping the sesskey on
+ * this trusted side) plus a sendBeacon flush on pagehide.
+ *
+ * Validation (defence in depth — track.php re-validates and clamps server-side):
+ *   - event.source === iframe.contentWindow (window identity, the primary anchor:
+ *     no other window can forge it, and an opaque origin has no useful event.origin);
+ *   - type === 'scorm' and action in the closed list {ready, track};
+ *   - a per-view nonce on 'track' messages;
+ *   - the payload shape (cmi is an object).
+ * Unknown or invalid messages are ignored silently.
+ *
+ * Exposed two ways from a single body: window.exeScormBridge (browser bootstrap) and
+ * module.exports (Vitest). See research ADR DEC-0059.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Whether a payload is a child -> parent score message (shape only).
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for {type:'scorm', action:'track', cmi:{...}}.
+     */
+    function isTrackMessage(data) {
+        return !!data && data.type === 'scorm' && data.action === 'track'
+            && !!data.cmi && typeof data.cmi === 'object';
+    }
+
+    /**
+     * Whether a payload is the child's readiness announcement.
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for {type:'scorm', action:'ready'}.
+     */
+    function isReadyMessage(data) {
+        return !!data && data.type === 'scorm' && data.action === 'ready';
+    }
+
+    /**
+     * Whether a 'track' message should be accepted: correct shape AND matching nonce.
+     * Pure, so it can be unit-tested without a DOM. The caller is still responsible
+     * for the window-identity check (which cannot be expressed on data alone).
+     *
+     * @param {*} data The event.data value.
+     * @param {string} expectednonce The per-view nonce handed to the iframe.
+     * @returns {boolean} True when the message is a valid, authenticated track message.
+     */
+    function acceptTrack(data, expectednonce) {
+        // The !!expectednonce guard means an empty/undefined expected nonce can never
+        // authenticate: otherwise a forged message that simply omits the field would
+        // satisfy undefined === undefined and collapse the nonce factor.
+        return isTrackMessage(data) && !!expectednonce && data.exelearningBridge === expectednonce;
+    }
+
+    /**
+     * Create a relay bound to a config + (injectable) environment.
+     *
+     * @param {Object} config {iframeid, cmid, trackurl, session, nonce, blockedid,
+     *     disableTracking}.
+     * @param {Object} [deps] {document, window, fetch, sendBeacon} for testing.
+     * @returns {Object} {init, onMessage, flushBeacon, postTrack, acceptTrack}.
+     */
+    function createRelay(config, deps) {
+        config = config || {};
+        deps = deps || {};
+        var doc = deps.document || (typeof document !== 'undefined' ? document : null);
+        var win = deps.window || (typeof window !== 'undefined' ? window : null);
+        var fetchImpl = deps.fetch || (win && win.fetch ? win.fetch.bind(win) : null);
+        var beacon = deps.sendBeacon
+            || (win && win.navigator && win.navigator.sendBeacon
+                ? win.navigator.sendBeacon.bind(win.navigator) : null);
+
+        var iframeid = config.iframeid;
+        var trackurl = config.trackurl;
+        var cmid = config.cmid;
+        var session = config.session;
+        var nonce = config.nonce;
+        var blockedid = config.blockedid;
+        // xAPI-primary (DEC-0065): keep the bridge fully live (handshake, window.API,
+        // watchdog) but forward NO SCORM score, because the package is graded
+        // via xAPI. The decision lives here, on the trusted parent, not in the baked-in
+        // shim — so it holds even for a package whose shim predates this flag.
+        var disabletracking = config.disableTracking === true;
+        var watchdogms = config.watchdogms || 8000;
+        var gracems = config.gracems || 2500;
+        var latest = null;
+        var watchdog = null;
+        var sawready = false;
+
+        function iframe() { return doc ? doc.getElementById(iframeid) : null; }
+
+        // Watchdog: if the in-iframe shim never announces 'ready' (e.g. an opaque-origin
+        // iframe the environment cannot serve, like a PHP-WASM service-worker host that
+        // does not control opaque subframes, so the token URL falls through to a 404),
+        // reveal the "blocked by security configuration" notice instead of silently
+        // degrading to the weaker same-origin mode (DEC-0060).
+        function showBlocked() {
+            var b = (doc && blockedid) ? doc.getElementById(blockedid) : null;
+            if (b) { b.style.display = ''; }
+            var fr = iframe();
+            if (fr) { fr.style.display = 'none'; }
+        }
+        // Decide between two timing signals so the notice never sits behind a long blank
+        // wait. The iframe element fires 'load' even when its navigation ended in an error
+        // page (e.g. the 404 above), so once it has loaded we only grant a short grace for
+        // the shim to handshake; if 'load' never fires we still fall back to watchdogms.
+        function armBlockedTimer(ms) {
+            if (!win || !win.setTimeout) { return null; }
+            return win.setTimeout(function () { if (!sawready) { showBlocked(); } }, ms);
+        }
+        function startWatchdog() {
+            if (!win || !win.setTimeout || !blockedid) { return; }
+            watchdog = armBlockedTimer(watchdogms);
+            // Faster, load-driven path. The iframe may not be parsed yet when this relay
+            // runs inline (it is injected before the iframe element), so attach now if it
+            // exists, otherwise once the DOM is ready.
+            var onload = function () { if (!sawready) { armBlockedTimer(gracems); } };
+            var attach = function () {
+                var fr = iframe();
+                if (fr && fr.addEventListener) { fr.addEventListener('load', onload, false); return true; }
+                return false;
+            };
+            if (!attach() && doc && doc.addEventListener) {
+                doc.addEventListener('DOMContentLoaded', attach, false);
+            }
+        }
+        function clearWatchdog() {
+            sawready = true;
+            if (watchdog && win && win.clearTimeout) { win.clearTimeout(watchdog); watchdog = null; }
+        }
+
+        function buildBody(cmi, itemscores) {
+            // Mirror the legacy track.php payload, but identity (cmid in the query,
+            // sesskey, mode) lives on this trusted parent — only the CMI buffer and
+            // per-iDevice scores come from the iframe.
+            return JSON.stringify({
+                id: cmid,
+                session: session,
+                cmi: cmi,
+                itemscores: itemscores || {}
+            });
+        }
+
+        function postTrack(cmi, itemscores) {
+            var body = buildBody(cmi, itemscores);
+            latest = body;
+            if (!fetchImpl) { return; }
+            try {
+                fetchImpl(trackurl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: body,
+                    credentials: 'same-origin',
+                    keepalive: true
+                }).catch(function () { /* parent retries on the next commit / pagehide beacon. */ });
+            } catch (e) { /* ignore */ }
+        }
+
+        function flushBeacon() {
+            if (!latest || !beacon) { return; }
+            try { beacon(trackurl, new Blob([latest], { type: 'application/json' })); } catch (e) { /* ignore */ }
+        }
+
+        function onMessage(e) {
+            var fr = iframe();
+            // Window identity (primary anchor). The explicit contentWindow check rejects
+            // the degenerate null === null match if the frame is present but not navigable.
+            if (!fr || !fr.contentWindow || e.source !== fr.contentWindow) { return; }
+            var data = e.data;
+            if (isReadyMessage(data)) {
+                clearWatchdog();   // The iframe is alive; secure mode rendered.
+                try {
+                    fr.contentWindow.postMessage({
+                        type: 'scorm',
+                        action: 'config',
+                        nonce: nonce
+                    }, '*');
+                } catch (e2) { /* ignore */ }
+                return;
+            }
+            if (!acceptTrack(data, nonce)) { return; }              // type + action + nonce + shape.
+            // xAPI-primary: validate the message but suppress the SCORM POST. The shim
+            // cannot reach track.php itself (opaque origin, no sesskey), so this is the
+            // single authoritative drop point — no double grading with the xAPI channel.
+            if (disabletracking) { return; }
+            postTrack(data.cmi, data.itemscores);
+        }
+
+        function init() {
+            if (win && win.addEventListener) {
+                win.addEventListener('message', onMessage, false);
+                win.addEventListener('pagehide', flushBeacon, false);
+            }
+            startWatchdog();
+        }
+
+        return {
+            init: init,
+            onMessage: onMessage,
+            flushBeacon: flushBeacon,
+            postTrack: postTrack,
+            acceptTrack: acceptTrack,
+            startWatchdog: startWatchdog,
+            showBlocked: showBlocked
+        };
+    }
+
+    /**
+     * Bootstrap: create a relay from config and start listening.
+     *
+     * @param {Object} config See createRelay.
+     * @returns {Object} The relay instance.
+     */
+    function init(config) {
+        var relay = createRelay(config);
+        relay.init();
+        return relay;
+    }
+
+    var exp = {
+        isTrackMessage: isTrackMessage,
+        isReadyMessage: isReadyMessage,
+        acceptTrack: acceptTrack,
+        createRelay: createRelay,
+        init: init
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser bootstrap (view.php) consumes window.exeScormBridge.
+    if (typeof window !== 'undefined') { window.exeScormBridge = exp; }
+})();
diff --git a/js/scorm_bridge_shim.js b/js/scorm_bridge_shim.js
new file mode 100644
index 0000000..956b3e3
--- /dev/null
+++ b/js/scorm_bridge_shim.js
@@ -0,0 +1,245 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * In-iframe SCORM bridge shim for the secure (opaque-origin) package mode.
+ *
+ * This script is baked into every extracted package (copied to libs/ and injected
+ * at the top of <head> by \mod_exelearning\local\scorm\scorm_injector) and runs
+ * INSIDE the package iframe. It self-activates only when the iframe is a sandboxed,
+ * opaque-origin document (secure mode, view.php drops allow-same-origin); in the
+ * legacy same-origin mode it stays dormant so eXeLearning's pipwerks walks up to
+ * the window.API hosted by the Moodle parent, exactly as before.
+ *
+ * When active it:
+ *   1. Installs an in-memory localStorage/sessionStorage polyfill, because an
+ *      opaque-origin document throws SecurityError on real web storage and several
+ *      shipped engine scripts (libs/exe_atools, exe_export.js, the checklist iDevice,
+ *      edicuatex) touch it. The polyfill keeps them working for the session.
+ *   2. Defines a local window.API (the SCORM 1.2 surface from js/scorm_tracker.js)
+ *      whose buffered scores are posted to the Moodle parent over postMessage instead
+ *      of being XHR'd here. The parent (js/scorm_bridge_relay.js) holds the sesskey
+ *      and performs the authenticated track.php request; this iframe never sees it.
+ *   3. Performs a handshake: it announces 'ready' and the parent replies with a nonce
+ *      that authenticates subsequent score messages. Teacher-mode visibility is NOT
+ *      handled here: the package hides teacher content by default and the host appends
+ *      ?exe-teacher=1 to the iframe src to reveal the selector (read from the package's
+ *      own location.search, which works even under the opaque origin).
+ *
+ * Exposed two ways from a single body: window.exeScormBridgeShim (browser, with an
+ * auto-boot that is a no-op outside an opaque sandbox) and module.exports (Vitest).
+ * See research ADR DEC-0059.
+ */
+(function () {
+    'use strict';
+
+    /**
+     * Build an in-memory Storage-like object (getItem/setItem/removeItem/clear/key
+     * + length), used to shadow the native web storage that throws in an opaque
+     * origin. Values are coerced to strings, matching the Storage contract.
+     *
+     * @returns {Object} A minimal in-memory Storage implementation.
+     */
+    function createMemoryStorage() {
+        var store = {};
+        var api = {
+            getItem: function (k) {
+                k = String(k);
+                return Object.prototype.hasOwnProperty.call(store, k) ? store[k] : null;
+            },
+            setItem: function (k, v) { store[String(k)] = String(v); },
+            removeItem: function (k) { delete store[String(k)]; },
+            clear: function () { store = {}; },
+            key: function (i) {
+                var keys = Object.keys(store);
+                return (i >= 0 && i < keys.length) ? keys[i] : null;
+            }
+        };
+        Object.defineProperty(api, 'length', { get: function () { return Object.keys(store).length; } });
+        return api;
+    }
+
+    /**
+     * Detect whether the current window is a sandboxed, opaque-origin document
+     * (secure mode). Opaque origins serialize to the string "null"; as a secondary
+     * probe, web storage access throws a SecurityError (ONLY that — a QuotaExceededError
+     * or a disabled-storage policy in a real same-origin iframe must not count). Either
+     * signal means "activate".
+     *
+     * @param {Window} win The window to test (default: the global window).
+     * @returns {boolean} True when running in an opaque sandbox.
+     */
+    function isSandboxedOpaque(win) {
+        win = win || (typeof window !== 'undefined' ? window : null);
+        if (!win) { return false; }
+        try {
+            if (win.origin === 'null' || (win.location && win.location.origin === 'null')) { return true; }
+        } catch (e) { return true; }
+        try {
+            var probe = '__exeprobe__';
+            win.localStorage.setItem(probe, '1');
+            win.localStorage.removeItem(probe);
+        } catch (e2) {
+            // Only an opaque origin denies web storage with a SecurityError. A
+            // QuotaExceededError (storage full) or a browser/policy that blocks first-party
+            // storage in a REAL same-origin iframe also throws here; treating those as
+            // "opaque" would activate the shim in legacy mode (where no parent relay listens),
+            // so buffered scores would post into a postMessage void and be silently lost.
+            return !!(e2 && e2.name === 'SecurityError');
+        }
+        return false;
+    }
+
+    /**
+     * Replace win.localStorage/win.sessionStorage with in-memory polyfills so package
+     * scripts that touch web storage do not throw in an opaque origin. Best effort:
+     * if the property cannot be redefined, content storage access may still throw, but
+     * grading (which never relies on web storage) is unaffected.
+     *
+     * @param {Window} win The window to patch.
+     */
+    function installStoragePolyfill(win) {
+        var names = ['localStorage', 'sessionStorage'];
+        for (var i = 0; i < names.length; i++) {
+            var name = names[i];
+            var mem = createMemoryStorage();
+            try {
+                Object.defineProperty(win, name, {
+                    configurable: true,
+                    get: (function (m) { return function () { return m; }; })(mem)
+                });
+            } catch (e) {
+                try { win[name] = mem; } catch (e2) { /* give up; see docblock. */ }
+            }
+        }
+    }
+
+    /**
+     * Whether a postMessage payload is a recognised parent -> child control message.
+     *
+     * @param {*} data The event.data value.
+     * @returns {boolean} True for a {type:'scorm', action:'config'|'ack'} message.
+     */
+    function isParentMessage(data) {
+        return !!data && data.type === 'scorm' && (data.action === 'config' || data.action === 'ack');
+    }
+
+    /**
+     * Wire the local window.API to the Moodle parent over postMessage. Requires
+     * win.exeScormTracker (js/scorm_tracker.js) to be loaded first.
+     *
+     * @param {Window} win The (opaque-origin) iframe window.
+     * @returns {Object|null} Handles for testing, or null if the tracker is missing.
+     */
+    function activate(win) {
+        var tracker = win.exeScormTracker;
+        if (!tracker) { return null; }
+
+        var parentwin = win.parent;
+        var nonce = null;
+        var ready = false;
+        var queue = [];
+
+        function postToParent(msg) {
+            try {
+                if (parentwin && parentwin.postMessage) { parentwin.postMessage(msg, '*'); }
+            } catch (e) { /* ignore */ }
+        }
+
+        // Bridge transport handed to the shared tracker: forward buffered scores to
+        // the parent. Identity (cmid, sesskey) lives in the parent; only the CMI
+        // buffer + per-iDevice scores cross the bridge, and track.php re-validates
+        // and clamps them server-side. Fire-and-forget; queued until the handshake
+        // delivers the nonce.
+        function transport(data) {
+            var msg = {
+                exelearningBridge: nonce,
+                type: 'scorm',
+                action: 'track',
+                cmi: data.cmi,
+                itemscores: data.itemscores
+            };
+            if (ready) { postToParent(msg); } else { queue.push(msg); }
+            return true;
+        }
+
+        var instance = tracker.createScormApi({
+            transport: transport,
+            // Resolve per-iDevice objectids from THIS document (same frame), not the
+            // parent's iframe element.
+            getScoringDocument: function () { return win.document; },
+            // No beforeunload flush here: postMessage is async and may not reach the
+            // parent during unload. The parent's pagehide sendBeacon (relay) is the
+            // reliable unload safety net instead.
+            bindUnload: false
+        });
+        win.API = instance.api;
+
+        function onMessage(e) {
+            if (e.source !== parentwin) { return; }   // Only trust the hosting Moodle frame.
+            var data = e.data;
+            if (!isParentMessage(data)) { return; }
+            if (data.action === 'config') {
+                nonce = data.nonce;
+                ready = true;
+                while (queue.length) {
+                    var m = queue.shift();
+                    m.exelearningBridge = nonce;
+                    postToParent(m);
+                }
+            }
+        }
+
+        if (win.addEventListener) { win.addEventListener('message', onMessage, false); }
+        // Announce readiness; the parent replies with the nonce.
+        postToParent({ exelearningBridge: null, type: 'scorm', action: 'ready' });
+
+        return {
+            api: instance.api,
+            transport: transport,
+            onMessage: onMessage
+        };
+    }
+
+    /**
+     * Boot the shim: activate only inside an opaque sandbox. No-op otherwise (legacy
+     * same-origin mode, or any non-sandboxed context such as the test runner).
+     *
+     * @param {Window} win The window to boot in (default: the global window).
+     * @returns {Object|null} The activate() handles when activated, else null.
+     */
+    function boot(win) {
+        win = win || (typeof window !== 'undefined' ? window : null);
+        if (!win || !isSandboxedOpaque(win)) { return null; }
+        installStoragePolyfill(win);
+        return activate(win);
+    }
+
+    var exp = {
+        createMemoryStorage: createMemoryStorage,
+        isSandboxedOpaque: isSandboxedOpaque,
+        installStoragePolyfill: installStoragePolyfill,
+        isParentMessage: isParentMessage,
+        activate: activate,
+        boot: boot
+    };
+    // Test runner (Vitest/Node) consumes module.exports.
+    if (typeof module !== 'undefined' && module.exports) { module.exports = exp; }
+    // Browser: expose for inspection and auto-boot (no-op outside an opaque sandbox).
+    if (typeof window !== 'undefined') {
+        window.exeScormBridgeShim = exp;
+        boot(window);
+    }
+})();
diff --git a/js/scorm_tracker.js b/js/scorm_tracker.js
index 46d2595..3c83d89 100644
--- a/js/scorm_tracker.js
+++ b/js/scorm_tracker.js
@@ -133,6 +133,12 @@
      *   - cmid, trackurl, session: identity and endpoint.
      *   - getScoringDocument(): returns the iframe content document (default: reads
      *     #exelearningobject) for objectid resolution.
+     *   - transport(data, sync): optional sink for the buffered scores. When provided
+     *     it REPLACES the direct XHR (secure mode: js/scorm_bridge_shim.js posts the
+     *     data to the Moodle parent, which owns the authenticated request). It gets
+     *     {cmi, itemscores} and a sync flag, and returns false to signal failure
+     *     (keeps the buffer dirty for retry). When absent, the XHR path below runs
+     *     (legacy same-origin mode and the unit tests).
      *   - xhrFactory(): returns an XMLHttpRequest-like object (default: real XHR).
      *   - setTimeout / clearTimeout: timer functions (default: globals).
      *   - bindUnload: wire a beforeunload synchronous flush (default: true in a browser).
@@ -148,6 +154,7 @@
         var setTimeoutFn = config.setTimeout || (typeof setTimeout !== 'undefined' ? setTimeout : null);
         var clearTimeoutFn = config.clearTimeout || (typeof clearTimeout !== 'undefined' ? clearTimeout : null);
         var xhrFactory = config.xhrFactory || function () { return new XMLHttpRequest(); };
+        var transport = config.transport || null;
         var getScoringDocument = config.getScoringDocument || function () {
             var fr = (typeof document !== 'undefined') && document.getElementById('exelearningobject');
             return fr && fr.contentDocument;
@@ -168,7 +175,19 @@
             // xAPI-primary packages keep window.API alive but never POST (DEC-0064).
             if (disableTracking) { dirty = false; return true; }
             if (!dirty) { return true; }
-            var snapshot = JSON.stringify(cmi);
+            // Bridge transport (secure mode): hand the buffered CMI + per-iDevice
+            // scores to the injected sink instead of doing the XHR here. The sink
+            // (js/scorm_bridge_shim.js) posts them to the Moodle parent, which owns
+            // the authenticated track.php request, retry and the pagehide beacon.
+            // Fire-and-forget: clear dirty once the message leaves; a thrown/false
+            // result keeps it dirty so the next autocommit re-sends it.
+            if (transport) {
+                try {
+                    var accepted = transport({ cmi: cmi, itemscores: itemScores }, sync === true);
+                    if (accepted !== false) { dirty = false; return true; }
+                    return false;
+                } catch (te) { errCode = '101'; return false; }
+            }
             var payload = buildPayload(cmid, session, cmi, itemScores);
             try {
                 var xhr = xhrFactory();
@@ -186,6 +205,9 @@
                 // and only if no newer value was buffered meanwhile. On failure dirty
                 // stays set so the next autocommit / beforeunload re-sends it (a failed
                 // autocommit must never silently drop a grade write to the gradebook).
+                // Snapshot the buffer here (this path only) — captured synchronously
+                // before xhr.send() below, so the onload comparison value is unchanged.
+                var snapshot = JSON.stringify(cmi);
                 xhr.onload = function () {
                     if (xhr.status >= 200 && xhr.status < 300
                             && JSON.stringify(cmi) === snapshot) {
diff --git a/js/xapi_listener.js b/js/xapi_listener.js
index a9b5818..842d0a0 100644
--- a/js/xapi_listener.js
+++ b/js/xapi_listener.js
@@ -97,6 +97,17 @@
         var mode = config.mode || 'grading';
         var allowed = config.allowedOrigin
             || ((typeof window !== 'undefined' && window.location) ? window.location.origin : '');
+        // Trust gate. Legacy (same-origin) trusts a statement by event.origin === host
+        // origin (RIE-013). Secure mode (DEC-0065) serves the package in an opaque origin
+        // where event.origin is the string "null", so origin can never authenticate; there
+        // the anchor is WINDOW IDENTITY — event.source === the package iframe's
+        // contentWindow, exactly like the SCORM bridge relay (js/scorm_bridge_relay.js).
+        // Setting iframeid (or, for tests, expectedSource) selects window-identity mode;
+        // otherwise the origin check is used.
+        var iframeid = config.iframeid || null;
+        var injectedsource = config.expectedSource;   // explicit window (tests) or null/undefined
+        var usewindowidentity = !!(iframeid || (injectedsource !== undefined && injectedsource !== null));
+        var docref = config.document || (typeof document !== 'undefined' ? document : null);
         var xhrFactory = config.xhrFactory || function () { return new XMLHttpRequest(); };
         // Bounded resend so a transient non-2xx / network blip does not silently lose a
         // grade-bearing statement — js/scorm_tracker.js self-heals the same way (a failed
@@ -153,9 +164,34 @@
             }, retryDelay * (attempt + 1));
         }
 
+        // Resolve the only window allowed to deliver statements in window-identity mode.
+        // Lazy (per message): view.php injects this listener inline BEFORE the iframe
+        // element exists, but the element is present by the time the package emits.
+        function expectedSource() {
+            if (injectedsource !== undefined && injectedsource !== null) { return injectedsource; }
+            if (iframeid && docref) {
+                var el = docref.getElementById(iframeid);
+                return el ? el.contentWindow : null;
+            }
+            return null;
+        }
+
+        // Whether an event may be forwarded: window identity in secure mode (the opaque
+        // "null" origin is ignored), or an exact host origin in legacy mode. event.source
+        // is set by the browser to the posting window and cannot be forged by page script,
+        // so it is a sound anchor when the origin is unusable (DEC-0065).
+        function isTrusted(event) {
+            if (!event) { return false; }
+            if (usewindowidentity) {
+                var src = expectedSource();
+                return !!src && event.source === src;
+            }
+            return isTrustedOrigin(event.origin, allowed);
+        }
+
         // Validate, de-dup and forward a single message. Returns true when forwarded.
         function handleMessage(event) {
-            if (!event || !isTrustedOrigin(event.origin, allowed)) { return false; }
+            if (!isTrusted(event)) { return false; }
             if (!isStatementMessage(event.data)) { return false; }
             var statement = event.data.statement;
             var id = statement.id;
diff --git a/lang/ca/exelearning.php b/lang/ca/exelearning.php
index b6194ab..8e5145a 100644
--- a/lang/ca/exelearning.php
+++ b/lang/ca/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editor incrustat';
 $string['embeddednotinstalledadmin'] = 'Els fitxers de l\'editor integrat no estan instal·lats. Podeu instal·lar-lo des de la configuració del connector.';
 $string['embeddednotinstalledcontactadmin'] = 'Els fitxers de l\'editor integrat no estan instal·lats. Contacteu amb l\'administrador del lloc per instal·lar-lo.';
+$string['embedmode'] = '~Política d\'insercions externes';
+$string['embedmode_desc'] = '~En el mode segur, els vídeos i PDF externs es mostren promocionant-los a un reproductor aïllat i d\'origen creuat a la pàgina de l\'activitat, que el navegador manté aïllat de Moodle sigui quin sigui el proveïdor. «Obre» (recomanat) permet qualsevol proveïdor https d\'origen creuat, de manera que YouTube, Vimeo, Dailymotion, EducaMadrid i qualsevol altre lloc funcionen sense necessitat de mantenir cap llista. «Estricte» només permet una llista integrada de proveïdors coneguts; useu-lo quan no es confiï que els autors de contingut no insereixin pàgines de pesca (phishing) o de seguiment. Tots dos modes rebutgen les URL del mateix origen, d\'IP/bucle local i amb informació d\'usuari.';
+$string['embedmode_open'] = '~Obre (qualsevol proveïdor https d\'origen creuat)';
+$string['embedmode_strict'] = '~Estricte (només la llista integrada de proveïdors)';
 $string['err_grademinmax'] = '~La qualificació mínima no pot ser superior a la màxima.';
 $string['err_gradepassrange'] = '~La qualificació per aprovar ha d\'estar entre la qualificació mínima i la màxima.';
 $string['err_nocontentxml'] = '~El fitxer pujat no és un paquet eXeLearning vàlid: ha de ser un .elpx o un .zip que contingui content.xml a l\'arxiu.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~La qualificació global mínima necessària per aprovar. Quan s\'habilita la condició de finalització «Requereix qualificació per aprovar», l\'activitat es marca com a completada (a l\'estil SCORM) quan l\'estudiant assoleix aquesta qualificació. Deixeu-ho a 0 per desactivar la finalització basada en l\'aprovat.';
 $string['gradesetchangedwarning'] = '~El contingut qualificable d\'aquesta activitat ha canviat i alguns estudiants ja tenen intents. Les qualificacions existents es conserven tal com estaven i no es recalculen amb el nou contingut. Si els canvis fan que aquestes qualificacions siguin enganyoses, elimineu els intents afectats per recalcular-les.';
 $string['gradingheading'] = '~Qualificació';
+$string['iframemode'] = '~Mode de seguretat de l\'iframe del paquet';
+$string['iframemode_desc'] = '~Controla com s\'incrusta el paquet eXeLearning a la pàgina de l\'activitat. «Segur» (recomanat) executa el paquet en un iframe aïllat d\'origen opac, de manera que el seu JavaScript no pot llegir ni modificar la pàgina de Moodle circumdant, les seves galetes ni la sessió; la puntuació SCORM es transmet a Moodle a través d\'un canal postMessage validat. «Heretat» manté el comportament anterior del mateix origen i només s\'hauria d\'usar si un paquet concret funciona malament en el mode segur (per exemple, perquè depèn de l\'emmagatzematge del navegador que no està disponible per a un iframe aïllat).';
+$string['iframemode_legacy'] = '~Heretat (mateix origen)';
+$string['iframemode_secure'] = '~Segur (aïllat, en entorn de proves)';
 $string['installstale'] = 'La instal·lació pot haver fallat. Torneu-ho a provar.';
 $string['intro'] = '~Descripció';
 $string['invalidaction'] = 'Acció no vàlida: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Desant...';
 $string['savingwait'] = 'Si us plau, espereu mentre es desa l\'arxiu.';
 $string['search:activity'] = '~Recurs eXeLearning - informació de l\'activitat';
+$string['securemodeblocked'] = '~Aquest contingut no es pot mostrar amb la configuració de seguretat actual. Contacteu amb l\'administrador del lloc.';
 $string['stillworking'] = 'Encara s\'està processant...';
 $string['stylesblockimport'] = '~Bloca els estils importats per l\'usuari';
 $string['stylesblockimport_desc'] = '~Quan està activat, l\'editor integrat amaga la pestanya «Estils importats» i rebutja instal·lar un estil inclòs en un projecte .elpx importat. L\'usuari només podrà triar de la llista aprovada per l\'administrador. Equival al comportament d\'eXeLearning ONLINE_THEMES_INSTALL=false.';
diff --git a/lang/en/exelearning.php b/lang/en/exelearning.php
index 9910bd6..cfb145b 100644
--- a/lang/en/exelearning.php
+++ b/lang/en/exelearning.php
@@ -96,6 +96,10 @@
 $string['embeddededitorstatus'] = 'Embedded editor';
 $string['embeddednotinstalledadmin'] = 'The embedded editor files are not installed. You can install it from the plugin settings.';
 $string['embeddednotinstalledcontactadmin'] = 'The embedded editor files are not installed. Please contact your site administrator to install it.';
+$string['embedmode'] = 'External embed policy';
+$string['embedmode_desc'] = 'In secure mode, external videos and PDFs are shown by promoting them to a sandboxed, cross-origin player on the activity page, which the browser keeps isolated from Moodle whatever the provider. "Open" (recommended) allows any cross-origin https provider, so YouTube, Vimeo, Dailymotion, EducaMadrid and any other site work without a maintained list. "Strict" only allows a built-in list of well-known providers; use it where content authors are not trusted not to embed phishing or tracking pages. Both modes reject same-origin, IP/loopback and userinfo URLs.';
+$string['embedmode_open'] = 'Open (any cross-origin https provider)';
+$string['embedmode_strict'] = 'Strict (built-in provider list only)';
 $string['err_grademinmax'] = 'The minimum grade cannot be greater than the maximum grade.';
 $string['err_gradepassrange'] = 'The grade to pass must be between the minimum and maximum grade.';
 $string['err_nocontentxml'] = 'The uploaded file is not a valid eXeLearning package: it must be an .elpx or a .zip whose archive contains content.xml.';
@@ -246,6 +250,10 @@
 $string['gradepass_help']  = 'The minimum overall grade required to pass. When the "Require passing grade" completion condition is enabled, the activity is marked complete (SCORM-style) once the student reaches this grade. Leave at 0 to disable pass-based completion.';
 $string['gradesetchangedwarning'] = 'The gradable content of this activity changed and some students already have attempts. Existing grades are kept as they were and are not recalculated against the new content. If the changes make those grades misleading, delete the affected attempts to recalculate them.';
 $string['gradingheading'] = 'Grading';
+$string['iframemode'] = 'Package iframe security mode';
+$string['iframemode_desc'] = 'Controls how the eXeLearning package is embedded in the activity page. "Secure" (recommended) runs the package in a sandboxed, opaque-origin iframe so its JavaScript cannot read or change the surrounding Moodle page, its cookies or the session; SCORM scoring is relayed to Moodle through a validated postMessage channel. "Legacy" keeps the previous same-origin behaviour and should only be used if a specific package misbehaves under the secure mode (for example because it relies on browser storage that is not available to a sandboxed iframe).';
+$string['iframemode_legacy'] = 'Legacy (same-origin)';
+$string['iframemode_secure'] = 'Secure (sandboxed, isolated)';
 $string['installstale'] = 'Installation may have failed. Please try again.';
 $string['intro']         = 'Description';
 $string['invalidaction'] = 'Invalid action: {$a}';
@@ -347,6 +355,7 @@
 $string['saving'] = 'Saving...';
 $string['savingwait'] = 'Please wait while the file is being saved.';
 $string['search:activity'] = 'eXeLearning resource - activity information';
+$string['securemodeblocked'] = 'This content cannot be displayed with the current security configuration. Please contact the site administrator.';
 $string['stillworking'] = 'Still working...';
 $string['stylesblockimport'] = 'Block user-imported styles';
 $string['stylesblockimport_desc'] = 'When enabled, the embedded editor hides the "User styles" tab and refuses to install a style bundled inside an imported .elpx project. Users may only choose from the admin-approved list above. This mirrors the eXeLearning ONLINE_THEMES_INSTALL=false behavior.';
diff --git a/lang/es/exelearning.php b/lang/es/exelearning.php
index c25d263..ae6677d 100644
--- a/lang/es/exelearning.php
+++ b/lang/es/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editor embebido';
 $string['embeddednotinstalledadmin'] = 'Los archivos del editor integrado no están instalados. Puede instalarlo desde la configuración del plugin.';
 $string['embeddednotinstalledcontactadmin'] = 'Los archivos del editor integrado no están instalados. Contacte con el administrador del sitio para instalarlo.';
+$string['embedmode'] = '~Política de inserciones externas';
+$string['embedmode_desc'] = '~En el modo seguro, los vídeos y PDF externos se muestran promocionándolos a un reproductor aislado y de origen cruzado en la página de la actividad, que el navegador mantiene aislado de Moodle sea cual sea el proveedor. «Abrir» (recomendado) permite cualquier proveedor https de origen cruzado, de modo que YouTube, Vimeo, Dailymotion, EducaMadrid y cualquier otro sitio funcionan sin necesidad de mantener una lista. «Estricto» solo permite una lista integrada de proveedores conocidos; úselo cuando no se confíe en que los autores de contenido no inserten páginas de phishing o de seguimiento. Ambos modos rechazan las URL de mismo origen, de IP/bucle local y con información de usuario.';
+$string['embedmode_open'] = '~Abrir (cualquier proveedor https de origen cruzado)';
+$string['embedmode_strict'] = '~Estricto (solo la lista integrada de proveedores)';
 $string['err_grademinmax'] = '~La calificación mínima no puede ser mayor que la calificación máxima.';
 $string['err_gradepassrange'] = '~La calificación para aprobar debe estar entre la calificación mínima y la máxima.';
 $string['err_nocontentxml'] = '~El archivo subido no es un paquete eXeLearning válido: debe ser un .elpx o un .zip cuyo archivo contenga content.xml.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~La calificación global mínima necesaria para aprobar. Cuando se habilita la condición de finalización «Requiere calificación para aprobar», la actividad se marca como completada (al estilo SCORM) cuando el estudiante alcanza esta calificación. Déjelo en 0 para desactivar la finalización basada en aprobado.';
 $string['gradesetchangedwarning'] = '~El contenido calificable de esta actividad ha cambiado y algunos estudiantes ya tienen intentos. Las calificaciones existentes se conservan tal cual y no se recalculan con el nuevo contenido. Si los cambios hacen que esas calificaciones sean engañosas, elimine los intentos afectados para recalcularlas.';
 $string['gradingheading'] = '~Calificación';
+$string['iframemode'] = '~Modo de seguridad del iframe del paquete';
+$string['iframemode_desc'] = '~Controla cómo se inserta el paquete eXeLearning en la página de la actividad. «Seguro» (recomendado) ejecuta el paquete en un iframe aislado de origen opaco, de modo que su JavaScript no puede leer ni modificar la página de Moodle circundante, sus cookies ni la sesión; la puntuación SCORM se transmite a Moodle a través de un canal postMessage validado. «Heredado» mantiene el comportamiento anterior de mismo origen y solo debería usarse si un paquete concreto funciona mal en el modo seguro (por ejemplo, porque depende del almacenamiento del navegador que no está disponible para un iframe aislado).';
+$string['iframemode_legacy'] = '~Heredado (mismo origen)';
+$string['iframemode_secure'] = '~Seguro (aislado, en entorno de pruebas)';
 $string['installstale'] = 'La instalación puede haber fallado. Inténtelo de nuevo.';
 $string['intro'] = '~Descripción';
 $string['invalidaction'] = 'Acción no válida: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Guardando...';
 $string['savingwait'] = 'Por favor, espere mientras se guarda el archivo.';
 $string['search:activity'] = 'Recurso eXeLearning - información de la actividad';
+$string['securemodeblocked'] = '~Este contenido no se puede mostrar con la configuración de seguridad actual. Contacte con el administrador del sitio.';
 $string['stillworking'] = 'Sigue en proceso...';
 $string['stylesblockimport'] = 'Bloquear estilos importados por el usuario';
 $string['stylesblockimport_desc'] = 'Cuando está activado, el editor integrado oculta la pestaña «Estilos importados» y rechaza instalar un estilo incluido en un proyecto .elpx importado. El usuario sólo podrá elegir entre la lista aprobada por el administrador. Equivale al comportamiento de eXeLearning ONLINE_THEMES_INSTALL=false.';
diff --git a/lang/eu/exelearning.php b/lang/eu/exelearning.php
index b44df00..f553125 100644
--- a/lang/eu/exelearning.php
+++ b/lang/eu/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editore txertatua';
 $string['embeddednotinstalledadmin'] = 'Editore txertatuaren fitxategiak ez daude instalatuta. Pluginaren ezarpenetan instala dezakezu.';
 $string['embeddednotinstalledcontactadmin'] = 'Editore txertatuaren fitxategiak ez daude instalatuta. Jarri harremanetan guneko administratzailearekin instalatzeko.';
+$string['embedmode'] = '~Kanpoko txertaketen politika';
+$string['embedmode_desc'] = '~Modu seguruan, kanpoko bideoak eta PDFak jardueraren orrian jatorri gurutzatuko erreproduzitzaile isolatu batera sustatuz erakusten dira, eta nabigatzaileak Moodletik isolatuta mantentzen du, hornitzailea edozein dela ere. «Ireki» (gomendatua) jatorri gurutzatuko edozein https hornitzaile onartzen du, hala nola YouTube, Vimeo, Dailymotion, EducaMadrid eta beste edozein gune funtzionatzen dute zerrenda bat mantendu beharrik gabe. «Zorrotza»k hornitzaile ezagunen barneko zerrenda bat soilik onartzen du; erabili eduki-egileek phishing edo jarraipen-orriak ez txertatzeko konfiantzarik ez dagoenean. Bi moduek baztertu egiten dituzte jatorri bereko, IP/atzeranzko begizta eta erabiltzaile-informazioa duten URLak.';
+$string['embedmode_open'] = '~Ireki (jatorri gurutzatuko edozein https hornitzaile)';
+$string['embedmode_strict'] = '~Zorrotza (hornitzaileen barneko zerrenda soilik)';
 $string['err_grademinmax'] = '~Gutxieneko kalifikazioa ezin da gehienezkoa baino handiagoa izan.';
 $string['err_gradepassrange'] = '~Gainditzeko kalifikazioa gutxieneko eta gehienezko kalifikazioaren artean egon behar da.';
 $string['err_nocontentxml'] = '~Igotako fitxategia ez da baliozko eXeLearning pakete bat: .elpx bat edo content.xml duen .zip bat izan behar du.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~Gainditzeko behar den gutxieneko kalifikazio orokorra. «Gainditze-kalifikazioa behar da» osatze-baldintza gaituta dagoenean, jarduera osatutzat markatzen da (SCORM estiloan) ikasleak kalifikazio hau lortzen duenean. Utzi 0 balioan gainditzean oinarritutako osatzea desgaitzeko.';
 $string['gradesetchangedwarning'] = '~Jarduera honen eduki kalifikagarria aldatu da eta ikasle batzuek jada saiakerak dituzte. Lehendik dauden kalifikazioak zeuden bezala gordetzen dira eta ez dira eduki berriarekin birkalkulatzen. Aldaketek kalifikazio horiek engainagarri bihurtzen badituzte, ezabatu eragindako saiakerak birkalkulatzeko.';
 $string['gradingheading'] = '~Kalifikazioa';
+$string['iframemode'] = '~Paketearen iframearen segurtasun-modua';
+$string['iframemode_desc'] = '~eXeLearning paketea jardueraren orrian nola txertatzen den kontrolatzen du. «Segurua» (gomendatua) paketea jatorri opakuko iframe isolatu batean exekutatzen du, eta horrela bere JavaScriptak ezin du inguruko Moodle orria, bere cookieak edo saioa irakurri edo aldatu; SCORM puntuazioa balidatutako postMessage kanal baten bidez bidaltzen zaio Moodleri. «Aurrekoa»k jatorri bereko aurreko portaera mantentzen du eta pakete jakin batek modu seguruan gaizki funtzionatzen badu soilik erabili beharko litzateke (adibidez, iframe isolatu batentzat erabilgarri ez dagoen nabigatzailearen biltegiratzean oinarritzen delako).';
+$string['iframemode_legacy'] = '~Aurrekoa (jatorri berekoa)';
+$string['iframemode_secure'] = '~Segurua (isolatua, proba-ingurunean)';
 $string['installstale'] = 'Baliteke instalazioak huts egin izana. Saiatu berriro.';
 $string['intro'] = '~Deskribapena';
 $string['invalidaction'] = 'Ekintza baliogabea: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Gordetzen...';
 $string['savingwait'] = 'Mesedez, itxaron fitxategia gordetzen den bitartean.';
 $string['search:activity'] = '~eXeLearning baliabidea - jardueraren informazioa';
+$string['securemodeblocked'] = '~Eduki hau ezin da bistaratu uneko segurtasun-konfigurazioarekin. Jarri harremanetan guneko administratzailearekin.';
 $string['stillworking'] = 'Oraindik lanean...';
 $string['stylesblockimport'] = '~Blokeatu erabiltzaileak inportatutako estiloak';
 $string['stylesblockimport_desc'] = '~Gaituta dagoenean, editore txertatuak «Inportatutako estiloak» fitxa ezkutatzen du eta inportatutako .elpx proiektu batean sartutako estilo bat instalatzeari uko egiten dio. Erabiltzaileak administratzaileak onartutako zerrendatik soilik aukeratu ahal izango du. eXeLearning-en ONLINE_THEMES_INSTALL=false jokabidearen baliokidea da.';
diff --git a/lang/gl/exelearning.php b/lang/gl/exelearning.php
index 927f1b0..020484e 100644
--- a/lang/gl/exelearning.php
+++ b/lang/gl/exelearning.php
@@ -100,6 +100,10 @@
 $string['embeddededitorstatus'] = 'Editor embebido';
 $string['embeddednotinstalledadmin'] = 'Os ficheiros do editor integrado non están instalados. Pode instalalo desde a configuración do complemento.';
 $string['embeddednotinstalledcontactadmin'] = 'Os ficheiros do editor integrado non están instalados. Contacte co administrador do sitio para instalalo.';
+$string['embedmode'] = '~Política de insercións externas';
+$string['embedmode_desc'] = '~No modo seguro, os vídeos e PDF externos amósanse promocionándoos a un reprodutor illado e de orixe cruzada na páxina da actividade, que o navegador mantén illado de Moodle sexa cal sexa o provedor. «Abrir» (recomendado) permite calquera provedor https de orixe cruzada, de xeito que YouTube, Vimeo, Dailymotion, EducaMadrid e calquera outro sitio funcionan sen necesidade de manter unha lista. «Estrito» só permite unha lista integrada de provedores coñecidos; úseo cando non se confíe en que os autores de contido non inseran páxinas de phishing ou de seguimento. Ambos os modos rexeitan os URL de mesma orixe, de IP/bucle local e con información de usuario.';
+$string['embedmode_open'] = '~Abrir (calquera provedor https de orixe cruzada)';
+$string['embedmode_strict'] = '~Estrito (só a lista integrada de provedores)';
 $string['err_grademinmax'] = '~A cualificación mínima non pode ser maior que a máxima.';
 $string['err_gradepassrange'] = '~A cualificación para aprobar debe estar entre a cualificación mínima e a máxima.';
 $string['err_nocontentxml'] = '~O ficheiro subido non é un paquete eXeLearning válido: debe ser un .elpx ou un .zip cuxo arquivo conteña content.xml.';
@@ -250,6 +254,10 @@
 $string['gradepass_help'] = '~A cualificación global mínima necesaria para aprobar. Cando se habilita a condición de finalización «Require cualificación para aprobar», a actividade márcase como completada (ao estilo SCORM) cando o estudante alcanza esta cualificación. Déixeo en 0 para desactivar a finalización baseada no aprobado.';
 $string['gradesetchangedwarning'] = '~O contido cualificable desta actividade cambiou e algúns estudantes xa teñen intentos. As cualificacións existentes consérvanse tal cal e non se recalculan co novo contido. Se os cambios fan que esas cualificacións sexan enganosas, elimine os intentos afectados para recalculalas.';
 $string['gradingheading'] = '~Cualificación';
+$string['iframemode'] = '~Modo de seguridade do iframe do paquete';
+$string['iframemode_desc'] = '~Controla como se insire o paquete eXeLearning na páxina da actividade. «Seguro» (recomendado) executa o paquete nun iframe illado de orixe opaca, de xeito que o seu JavaScript non pode ler nin modificar a páxina de Moodle circundante, as súas cookies nin a sesión; a puntuación SCORM transmítese a Moodle a través dunha canle postMessage validada. «Herdado» mantén o comportamento anterior de mesma orixe e só debería usarse se un paquete concreto funciona mal no modo seguro (por exemplo, porque depende do almacenamento do navegador que non está dispoñible para un iframe illado).';
+$string['iframemode_legacy'] = '~Herdado (mesma orixe)';
+$string['iframemode_secure'] = '~Seguro (illado, en entorno de probas)';
 $string['installstale'] = 'A instalación pode fallar. Ténteo de novo.';
 $string['intro'] = '~Descrición';
 $string['invalidaction'] = 'Acción non válida: {$a}';
@@ -351,6 +359,7 @@
 $string['saving'] = 'Gardando...';
 $string['savingwait'] = 'Por favor, agarde mentres se garda o ficheiro.';
 $string['search:activity'] = '~Recurso eXeLearning - información da actividade';
+$string['securemodeblocked'] = '~Este contido non se pode amosar coa configuración de seguridade actual. Contacte co administrador do sitio.';
 $string['stillworking'] = 'Segue en proceso...';
 $string['stylesblockimport'] = '~Bloquear os estilos importados polo usuario';
 $string['stylesblockimport_desc'] = '~Cando está activado, o editor integrado oculta a lapela «Estilos importados» e rexeita instalar un estilo incluído nun proxecto .elpx importado. O usuario só poderá elixir da lista aprobada polo administrador. Equivale ao comportamento de eXeLearning ONLINE_THEMES_INSTALL=false.';
diff --git a/lib.php b/lib.php
index 5bd9e19..323ac7a 100644
--- a/lib.php
+++ b/lib.php
@@ -568,6 +568,15 @@ function exelearning_pluginfile($course, $cm, $context, $filearea, $args, $force
     // must render, not be downloaded). Same flag used by mod_scorm.
     $options['dontforcesvgdownload'] = true;
 
+    // Defense-in-depth headers for the embedded package HTML document, in secure mode
+    // only (DEC-0060). The decision + values live in player_iframe::content_headers()
+    // (unit tested); here we just emit them. send_stored_file() neither emits nor strips
+    // these, and header(..., true) only replaces same-named headers, so they survive.
+    $secureheaders = \mod_exelearning\local\ui\player_iframe::content_headers($file->get_filename(), $CFG->wwwroot);
+    foreach ($secureheaders as $hname => $hval) {
+        @header($hname . ': ' . $hval);
+    }
+
     // Reasonable cache-control: a revision bump automatically invalidates the URL.
     $lifetime = $CFG->filelifetime ?? 86400;
     send_stored_file($file, $lifetime, 0, $forcedownload, $options);
diff --git a/package-lock.json b/package-lock.json
index da74de4..914e102 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,7 @@
       "version": "1.0.0",
       "license": "GPL-3.0-or-later",
       "devDependencies": {
+        "@playwright/test": "^1.58.2",
         "@vitest/coverage-v8": "^4.1.8",
         "happy-dom": "^20.10.2",
         "vitest": "^4.1.8"
@@ -165,6 +166,22 @@
         "url": "https://github.com/sponsors/Boshen"
       }
     },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm64": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
@@ -1219,6 +1236,53 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/postcss": {
       "version": "8.5.15",
       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
diff --git a/package.json b/package.json
index 08e6a68..5e8881c 100644
--- a/package.json
+++ b/package.json
@@ -2,13 +2,15 @@
   "name": "mod_exelearning",
   "version": "1.0.0",
   "private": true,
-  "description": "JavaScript unit tests (Vitest) for the mod_exelearning SCORM tracker.",
+  "description": "JavaScript unit tests (Vitest) + Firefox e2e (Playwright) for mod_exelearning.",
   "license": "GPL-3.0-or-later",
   "scripts": {
     "test:js": "vitest run",
-    "test:js:coverage": "vitest run --coverage"
+    "test:js:coverage": "vitest run --coverage",
+    "test:e2e:embed": "playwright test -c playwright-embed.config.cjs"
   },
   "devDependencies": {
+    "@playwright/test": "^1.58.2",
     "@vitest/coverage-v8": "^4.1.8",
     "happy-dom": "^20.10.2",
     "vitest": "^4.1.8"
diff --git a/playwright-embed.config.cjs b/playwright-embed.config.cjs
new file mode 100644
index 0000000..475d4b5
--- /dev/null
+++ b/playwright-embed.config.cjs
@@ -0,0 +1,25 @@
+// Playwright config for the cross-browser external-embed e2e (DEC-0061), separate from
+// any Moodle/Behat setup. Serves the plugin root over a static server so the harness
+// can load the real js/exe_embed_*.js and an opaque-origin sandboxed content iframe,
+// then runs the check in Firefox (proves the promote-to-parent mechanism is not
+// Chromium-specific). Run with: npx playwright test -c playwright-embed.config.cjs
+const { defineConfig, devices } = require('@playwright/test');
+
+const PORT = 8126;
+
+module.exports = defineConfig({
+    testDir: 'tests/e2e',
+    testMatch: 'embed.spec.cjs',
+    timeout: 30000,
+    fullyParallel: false,
+    use: { baseURL: 'http://localhost:' + PORT },
+    webServer: {
+        command: 'python3 -m http.server ' + PORT,
+        port: PORT,
+        reuseExistingServer: false,
+        timeout: 30000,
+    },
+    projects: [
+        { name: 'firefox', use: { ...devices['Desktop Firefox'] } },
+    ],
+});
diff --git a/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md b/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md
new file mode 100644
index 0000000..dafc460
--- /dev/null
+++ b/research/analisis/notas/AN-015-comparativa-soluciones-video-embeds.md
@@ -0,0 +1,194 @@
+---
+id: AN-015
+titulo: "Comparativa: soluciones de embeds de vídeo (YouTube/Vimeo) en contenido no confiable — mod_exelearning vs procomún vs eXeLearning vs el paper"
+fecha: 2026-06-19
+fuentes:
+  - REPO-005
+  - REPO-010
+  - REPO-011
+relacionados:
+  - DEC-0061
+  - DEC-0059
+  - DEC-0060
+  - AN-008
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Resumen
+
+Cuatro implementaciones/análisis del MISMO problema —reproducir vídeo de terceros (YouTube/Vimeo)
+incrustado en un paquete `.elpx` **no confiable** que se sirve en un **iframe de origen opaco**— se
+comparan aquí. La conclusión clave: **las cuatro coinciden en el núcleo** y se diferencian sólo en
+**la capa** en la que actúan, el **canal de confianza** y **quién impone el sandbox del player**.
+
+Núcleo compartido por todas: el `.elpx` corre en origen opaco (`sandbox` SIN `allow-same-origin`,
+`origin="null"`); el flag se **propaga** a los iframes anidados, así que un YouTube/Vimeo anidado de
+forma ingenua **sale en blanco**; la solución es **promote-to-parent**: el player real se monta en el
+**padre confiable** (origen real del proveedor, cross-origin al host → aislado por el SOP), nunca
+reintroduciendo `allow-same-origin` para el host; y como `event.origin` del frame opaco es la cadena
+inútil `"null"`, el mensaje se autentica por **identidad de ventana** (`event.source === iframe.contentWindow`).
+El paper lo nombra literalmente «el modelo de confianza que Moodle ya usa para incrustar YouTube».
+
+**Veredicto (depende del rol):** no hay un ganador único.
+- Para la **pureza del canal de seguridad**, **eXeLearning** gana: sólo cruza `{provider, videoId}`
+  (nunca la URL del autor), el padre reconstruye la URL canónica desde una plantilla fija, y el
+  handshake va con **identidad de ventana + nonce por vista + un MessagePort transferido** que un
+  sub-frame hostil anidado no puede obtener. Un id malicioso ni siquiera puede plantillarse en una URL
+  viva. **Pero** su asimetría: el sandbox/CSP del player vive **entero en el host** y el productor **no
+  puede imponerlo** → como garantía para un host arbitrario es **condicional**.
+- Para un **host desplegado que debe defenderse de paquetes arbitrarios** (nuestro caso),
+  **mod_exelearning** es el más fuerte en conjunto: **posee e impone** el sandbox del player, trata
+  como hostiles **tanto la URL como la geometría**, añade guardas D1/D2, y es el **mejor validado** de
+  los cuatro (Vitest + e2e Playwright real en sandbox opaco + anti-drift). Además la mayor **fidelidad
+  visual** (overlay inline, indistinguible de un embed normal).
+- **procomún** es el **más simple** (click→modal, sin sincronía de geometría) pero el de **menos
+  defensa en profundidad** (sin canonicalización de Vimeo, UI muerta en thumbnails, PDF sin sandbox).
+- **El paper** aporta el **principio** (SoK) que las tres implementaciones materializan.
+
+## El problema común
+
+DEC-0059/DEC-0060 sirven el paquete en origen opaco para cerrar RIE-001 (que el paquete alcance la
+sesión/sesskey del padre). Efecto colateral (el «dilema central» del paper, `:249`): los flags
+`sandbox` se propagan a los iframes anidados → el player de YouTube/Vimeo hereda el origen opaco,
+pierde el suyo (cookies/storage) y queda en blanco. Las tres implementaciones responden con
+**promote-to-parent** + aislamiento por SOP del player en el origen real del proveedor.
+
+## Hechos citados
+
+### mod_exelearning (DEC-0061) — consumidor, overlay inline
+
+- **Shim en el contenido** `js/exe_embed_shim.js` (horneado como `libs/exe_embed_shim.js` por
+  `package_manager.php:256-259`, inyectado al inicio del `<head>` por `scorm_injector.php:108-123`),
+  se auto-activa **sólo** en origen opaco; sustituye cada `iframe[src]` cross-origin-https-o-`.pdf` por
+  un placeholder y postMessea `{id, url ABSOLUTA, x, y, w, h}` al padre con `targetOrigin '*'`.
+- **Relay en el padre** `js/exe_embed_relay.js` (inline en `view.php:516-531`, sólo en `$securemode`):
+  autentica por identidad de ventana (`frameForSource` exige un iframe de **contenido**, nunca un
+  player promovido — `relay.js:297-308`), **valida** cada URL (`validate()`/`isCrossOriginHttps`,
+  `relay.js:162-233`: https, sin userinfo, cross-origin, no IP/loopback/`.local`, no dominio relacionado
+  con el LMS) y **superpone** el player real sobre la geometría del placeholder.
+- **Sandbox del player** (`relay.js:251`): `allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation` — **omite `allow-top-navigation` y `allow-modals`**. El `allow-same-origin` aquí
+  es **seguro** porque el `src` del player es cross-origin (proveedor) → el SOP lo aísla del host; NO es
+  el `allow-same-origin` prohibido del iframe de contenido.
+- **Guardas:** **D1** redirect-laundering (`armSameOriginGuard`, `relay.js:339-348`: elimina el player
+  si aterriza same-origin al LMS), **D2** forged-message (players excluidos de `frameForSource`),
+  clamp de geometría anti-clickjacking (`Math.min(embed.w, rect.width)`, overflow:hidden).
+- **YouTube:** OPEN promociona verbatim; STRICT reconstruye `youtube-nocookie.com/embed/{id}` +
+  `referrerpolicy=strict-origin-when-cross-origin` (evita el Error 153). **Vimeo:** STRICT reconstruye
+  `player.vimeo.com/video/{id}`. Modos `mod_exelearning/embedmode` OPEN (invariante https+cross-origin,
+  sin allowlist) vs STRICT (allowlist `DEFAULT_EMBED_HOSTS` + rebuild canónico), `player_iframe.php:133-139`.
+- **Limitación:** interactive-video (control del player por la API del autor) **roto** en opaco; un
+  puente de control YT se prototipó y **se revirtió por frágil**. Local `<video>` funciona.
+- **Validación:** Vitest + **e2e Playwright en Firefox en sandbox opaco real** (`tests/e2e/embed.spec.cjs`)
+  + `tools/check-embed-sync.mjs` (anti-drift entre mod/wp/omeka).
+
+### procomún (ADR-0026/0027) — consumidor, click→modal
+
+- Mismo modelo, **simplificado a click→modal**: shim `apps/api/static/elpx/embed-shim.js` (fachada +
+  postMessage), relay `use-elpx-embed-relay.ts:34-54` (identidad de ventana), `classifyEmbed`
+  (`elpx-embed-policy.ts:94-125`: rechaza userinfo, https-only, invariante video cross-origin), modal
+  `EmbedModal.tsx`.
+- Opacidad reforzada por **sandbox attr Y directiva CSP `sandbox`** en la respuesta
+  (`elpx-content.ts:224-225`) → aguanta en pestaña nueva.
+- Sandbox del player `EmbedModal.tsx:44`: `allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation` (sin top-nav). **YouTube** → `youtube-nocookie` (`elpx-embed-policy.ts:64-78`).
+  **Vimeo: SIN rama de canonicalización** → sólo open-mode genérico, sin reescritura de privacidad.
+- **Costes/defectos:** open-mode sin allowlist; player con `allow-same-origin` seguro **sólo** por la
+  invariante cross-origin; **UI muerta** (fachada en thumbnails que no monta modal); PDF **sin sandbox**;
+  requiere `ACAO: *` + `crossorigin=anonymous` en los `<script>` del paquete. Sin sincronía de geometría
+  (más simple, menos superficie). Interactive-video roto (igual que mod).
+
+### eXeLearning (rama `fix/opaque-iframe-external-media`) — productor, canal mínimo
+
+- **Lado productor:** el exportador **hornea un runtime en cada export** (`exe_media_policy.js` +
+  `exe_media_bridge.js`, inyectados por `PageRenderer.ts:305-308`), que se auto-ejecuta y detecta
+  contexto opaco (`exe_media_bridge.js:66-96`).
+- **Canal de confianza más limpio:** el hijo transmite **sólo `{provider, videoId}`** (nunca una URL)
+  por un **MessageChannel con capability**; el padre **reconstruye** `youtube-nocookie/player.vimeo`
+  canónico desde plantilla fija (`canonicalEmbedUrl`, `exe_media_policy.js:74-82`) y revalida el id
+  (`^[A-Za-z0-9_-]{11}$` / `^[0-9]{6,12}$`). Handshake gated por **identidad de ventana + nonce por
+  vista + MessagePort transferido** (`exe-media-host.js:298-335`) → un sub-frame hostil anidado **no
+  tiene el port** y no puede inyectar comandos.
+- **Player en el padre** vía **YouTube IFrame API / Vimeo Player.js SDK**. Click→modal `<dialog>`.
+  Degradación grácil (aviso + abrir-en-pestaña al watchdog ~8s), nunca un frame en blanco.
+- **El único que preserva interactive-video** (timing de preguntas) bajo origen opaco: hide/show del
+  modal en vez de espejado de geometría (`interactive-video.js:664-707`). (Vimeo sólo en
+  interactive-video, no en quick-questions-video, que es YouTube-only.)
+- **Asimetría estructural (cons):** el sandbox/CSP del player vive **entero en el host** y el productor
+  **NO puede imponerlo** (`external-media-bridge.md:122-138`); un host descuidado podría cargar el
+  player sin CSP/sin negar top-nav. **Requiere que el host coopere** (vendorizar `exe-media-host.js`,
+  cargar los SDK, fijar `frame-src`). Sin cooperación → sólo abrir-en-pestaña, no reproducción inline.
+
+### El paper (SoK) — principio
+
+- Marco: el peligro es JS de autor en el **mismo origen** que la sesión LMS. Mitigación = origen opaco
+  + CSP `sandbox` en la respuesta + bridge `postMessage` validado por **identidad de ventana** (no por
+  `event.origin`, contrastando con el origen-trust **roto de H5P**), `:297`.
+- Vídeo (`:295,299,303`): promote-to-parent + SOP; invariante **sin allowlist** `https+cross-origin`
+  cubre YouTube/Vimeo/Dailymotion; modo estricto y **oEmbed server-side** como alternativas
+  conservadoras. Variante fachada+modal citada como más simple, mismo modelo.
+- Defensa en profundidad: CSP de respuesta `connect-src 'self'` (cierra exfil), `object-src 'none'`,
+  `frame-ancestors 'self'`; residuo acotado = pixel GET que exfiltra el token de fichero de **sólo
+  lectura** (no el `sesskey`) vía `img/media/frame-src https:`; perfil CSP estricto opcional lo cierra.
+
+## Comparativa por dimensiones
+
+| Dimensión | mod_exelearning | procomún | eXeLearning | El paper |
+|---|---|---|---|---|
+| **Rol / capa** | Consumidor (player) | Consumidor (player) | Productor (export) | Principio (SoK) |
+| **UI de reproducción** | Overlay **inline** (geometría sincronizada) | Click→**modal** | Click→**modal `<dialog>`** | Ambas; recomienda modal por simple |
+| **Qué cruza el límite** | URL absoluta + geometría (ambas no confiadas) | URL absoluta + geometría | **Sólo `{provider, videoId}`** | URL (no confiada) |
+| **Auth del mensaje** | Identidad de ventana + exclusión de players (D2) | Identidad de ventana | Identidad de ventana + **nonce + MessagePort** | Identidad de ventana |
+| **Sandbox del player** | **Lo impone el consumidor** (sin top-nav/modals) | Lo impone el consumidor | **Lo impone el host** (productor no puede) | Lo impone el host |
+| **YouTube** | OPEN verbatim / STRICT → nocookie | → nocookie | → nocookie (sólo id) | nocookie/allowlist o invariante |
+| **Vimeo** | STRICT → `player.vimeo/video/{id}` | **Sin canonicalización** | → `player.vimeo/video/{id}` (sólo id) | igual que YouTube |
+| **interactive-video** | **Roto** (puente revertido) | Roto | **Funciona** (único) | Sacrificado por aislamiento |
+| **Guardas extra** | **D1 redirect-guard, D2, clamp** | — | nonce + port + enum cerrado | CSP respuesta |
+| **Complejidad** | Alta (mejor validada) | **Baja** | Media (si controlas el productor) | n/a |
+| **Validación** | Vitest + e2e Firefox opaco + anti-drift | menor | runtime propio | adversarial 7/7 (Chromium) |
+
+## [INTERPRETACION] — ¿Qué es mejor?
+
+«Mejor» **depende del rol**, y comparar de frente confunde un **diseño de canal** (eXeLearning) con un
+**sandbox impuesto** (mod/procomún):
+
+- Como **host de Moodle que recibe paquetes de autores arbitrarios**, lo correcto es que **el player
+  imponga su propio sandbox** sin depender de que el paquete coopere. Ahí **mod_exelearning es la
+  referencia**: es el mejor diseño para defender contenido arbitrario, impone el sandbox que el productor
+  no puede, y es el mejor validado. procomún es el mismo modelo más simple pero con menos defensa.
+- El **canal** de eXeLearning es **superior** (sólo cruza un id, reconstrucción desde plantilla, nonce +
+  MessagePort): elimina toda la clase de **URL-laundering** que mod cubre con D1. Conviene **adoptar esa
+  disciplina** para proveedores reconocidos, manteniendo D1 como cinturón para el camino genérico OPEN.
+- La **fidelidad** se reparte: eXeLearning es el único que conserva **interactive-video**; mod tiene la
+  mejor fidelidad **visual** (inline). No son excluyentes: mod aporta el **sandbox impuesto**,
+  eXeLearning aporta la **fidelidad de cue-points** — son **complementarios**.
+
+## Recomendación para mod_exelearning
+
+1. **Mantener** el relay promote-to-parent (`js/exe_embed_relay.js`) como **frontera de seguridad
+   canónica** para YouTube/Vimeo: es el diseño correcto para un host y el mejor validado.
+2. **Estrechar el canal** adoptando la disciplina de eXeLearning «cruza sólo `{provider, videoId}` y
+   reconstruye en el padre desde plantilla fija» para los proveedores reconocidos (reduce la superficie
+   a validar la forma del id y elimina la clase URL-laundering). **Mantener D1** para el camino genérico
+   OPEN.
+3. **interactive-video:** NO re-bridgear el control de YouTube dentro de mod (se revirtió por frágil).
+   En su lugar, cuando el paquete venga de eXeLearning actual, dejar que **el propio bridge de
+   eXeLearning** (`exe_media_bridge.js` + un `exe-media-host.js` vendorizado) maneje los cue-points
+   —el único enfoque que preserva el timing bajo origen opaco— **pero** con el relay de mod imponiendo
+   el sandbox/CSP del player que eXeLearning no puede imponer. Complementarios.
+4. **Vimeo:** añadir/confirmar la rama de canonicalización (procomún carece de ella) para paridad de
+   privacidad (`player.vimeo.com/video/{id}`).
+5. **Despliegues de alta seguridad:** ofrecer el **perfil CSP estricto opcional** del paper (§6.3) que
+   cierra el residuo de exfil por pixel GET del token de sólo lectura (off por defecto para no romper
+   imágenes externas/MathJax/CDN).
+
+## [PENDIENTE]
+
+- ADR de seguimiento si se decide la integración complementaria con el bridge productor de eXeLearning
+  para interactive-video (fidelidad de cue-points + sandbox impuesto por mod).
+- Toggle CSP estricto (cierre del residuo de confidencialidad; eco de `anexos-tecnicos.md:181`).
+- Validación cross-engine del **camino de promoción de embeds** específicamente (el aislamiento opaco se
+  confirmó en 3 motores; el e2e de promoción es Firefox/Chromium).
+- procomún: cerrar la **UI muerta** de thumbnails y el **PDF sin sandbox** si se toma como referencia.
diff --git a/research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md b/research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md
new file mode 100644
index 0000000..30bb3ab
--- /dev/null
+++ b/research/decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md
@@ -0,0 +1,216 @@
+---
+id: DEC-0059
+titulo: "Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2"
+estado: Aceptada
+fecha: 2026-06-13
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-002
+  - REPO-004
+  - REPO-005
+experimentos: []
+relacionados:
+  - RIE-001
+  - AN-008
+  - DEC-0019
+  - DEC-0017
+  - DEC-0042
+  - TAREA-017
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+`DEC-0019` cerró la investigación de RIE-001 (XSS cross-component desde un `.elpx`
+malicioso) y dejó dos tiers documentados pero **sin implementar por decisión del
+usuario**. Su roadmap fijaba explícitamente que el aislamiento real (Tier 2) iría en
+**"su propio ADR"**: `M6 — reescribir el bridge a postMessage → M7 — origen opaco`.
+
+Esta ADR es ese ADR. El usuario priorizó implementar el **bridge seguro** completo
+(no sólo el endurecimiento Tier 1), configurable y con valor por defecto seguro, tras
+confirmar que es la única alternativa que cumple los objetivos de aislamiento (el
+contenido NO puede leer ni modificar el DOM/cookies/sesión/JS del marco padre de
+Moodle). **No supersede a DEC-0019**: la implementa/avanza.
+
+El problema de fondo (ya documentado en DEC-0019) es que el SCORM era 100%
+same-origin, con **tres dependencias duras** que hacían que quitar `allow-same-origin`
+matase el tracking en silencio:
+
+1. el **padre** inyectaba `window.API` y el hijo (pipwerks) lo buscaba recorriendo
+   `window.parent`;
+2. el **padre** leía `iframe.contentDocument` para mapear el `objectid` de cada
+   iDevice (DEC-0017);
+3. el **teacher-mode hider** inyectaba `<style>` en el `contentDocument`.
+
+## Problema
+
+¿Cómo aislar el contenido `.elpx` (HTML/JS arbitrario del autor) del marco Moodle
+**sin romper** el scoring SCORM ni la detección por `objectid`, dentro del modelo de
+Moodle (un único `$CFG->wwwroot`, sin origen separado en core), de forma configurable
+y compatible hacia atrás?
+
+## Hechos verificados (con cita)
+
+1. **El pipwerks empaquetado descubre el `window.API` de su PROPIA ventana antes de
+   subir al padre.** `assets/scorm/SCORM_API_wrapper.js:71-106`: en `find(win)` el
+   bucle `while ((!win.API && !win.API_1484_11) && win.parent && win.parent != win)`
+   parte de `win = window`; si `window.API` existe en el iframe, el bucle no se
+   ejecuta y devuelve el API local. → **Inyectar el shim `window.API` DENTRO del
+   iframe hace que pipwerks lo use sin tocar el padre.** Es el linchpin que vuelve
+   viable el origen opaco.
+2. **`LMSGetValue` ya responde de una caché `cmi{}` local** (`js/scorm_tracker.js`,
+   `LMSGetValue: function (k) { return cmi[k] || ''; }`). El contrato síncrono de
+   pipwerks se satisface sin red, así que un relevo **asíncrono por `postMessage`**
+   para las escrituras (`LMSSetValue`/`Commit`/`Finish`) es suficiente; no hace falta
+   round-trip síncrono al padre.
+3. **El almacenamiento web lanza `SecurityError` en un documento de origen opaco**, y
+   el motor exportado de eXeLearning lo usa de forma incondicional en código que viaja
+   en TODO export: `public/libs/exe_atools/exe_atools.js` (barra de accesibilidad),
+   `public/app/common/exe_export.js`, el iDevice `checklist`
+   (`.../checklist/export/checklist.js`) y `edicuatex`. Sus guardas `typeof
+   localStorage` NO protegen (en origen opaco el acceso al getter, no el `typeof`,
+   es lo que lanza). → **El shim debe instalar un polyfill de `localStorage`/
+   `sessionStorage` en memoria** antes de que corra el contenido, o esos scripts
+   rompen. (Verificación de uso: `rg "localStorage|sessionStorage"` sobre
+   `/Users/ernesto/Downloads/git/exelearning`.)
+4. **Comparación con core (re-verificada, coherente con DEC-0019):**
+   - `core_h5p` valida `postMessage` por `event.source === window.parent` + un token
+     de contexto (`event.data.context === 'h5p'`), pero **sin** validar `event.origin`
+     y con contenido **curado** (`public/h5p/js/embed.js:38-46`). Patrón de
+     acción/contexto reutilizable, modelo de amenaza distinto.
+   - `mod_scorm`: iframe **sin `sandbox`**, mismo origen, el SCO recorre `window.parent`
+     (`public/mod/scorm/player.php`, `loadSCO.php` findAPI). Más débil.
+   - `mod_lti`: usa `allow=` (Permissions-Policy) + `X-Frame-Options`, no `sandbox`.
+   - SimplePie es el **único** uso de `sandbox` en core (`allow-scripts
+     allow-same-origin` para feeds). → **No existe precedente en core de un iframe
+     sandbox de origen opaco con bridge**; se adopta el patrón de **identidad de
+     ventana** de `wp-franer` (iframe sin `allow-same-origin`, validación por
+     `event.source === iframe.contentWindow`, credenciales sólo en el padre) más la
+     **lista cerrada de acciones + token de contexto** estilo H5P.
+
+## Opciones consideradas
+
+1. **A — No hacer nada (statu quo).** Mantiene RIE-001 abierto; no cumple los
+   objetivos. Rechazada.
+2. **B — Sólo `sandbox="allow-scripts"` (sin same-origin) sin bridge.** Rompe el
+   tracking (las 3 dependencias lanzan `SecurityError`). Inviable sin M6.
+3. **C — Bridge `postMessage` + origen opaco (M6+M7 Route A).** Elegida.
+4. **D — Configurable (modo global) sobre C.** Adoptada como parte de C: ajuste
+   `iframemode` (secure|legacy), default secure.
+5. **E — Origen separado / subdominio (M7 Route B) o CSP de red completa (M3).**
+   Route B requiere infra fuera de core (descartada para esta issue); M3 queda como
+   follow-up opcional complementario, no bloqueante.
+
+## Decisión
+
+Implementar **C + D**: bridge SCORM por `postMessage` con el iframe en **origen
+opaco**, **configurable** mediante un único ajuste global de administración
+`mod_exelearning/iframemode` (`secure` por defecto | `legacy` de respaldo). Sin campo
+por actividad (no se toca BD/upgrade/backup).
+
+### Arquitectura
+
+- **`\mod_exelearning\local\ui\player_iframe`** (`classes/local/ui/player_iframe.php`):
+  resuelve el modo (fail-safe a `secure` ante valor inválido) y centraliza la lista de
+  tokens del `sandbox` por modo (testeable sin renderizar `view.php`).
+- **Modo `secure`** (`view.php`): el `sandbox` es `allow-scripts allow-popups
+  allow-forms` (sin `allow-same-origin` ni `allow-popups-to-escape-sandbox`; sigue sin
+  `allow-top-navigation` ni `allow-modals`). El padre NO inyecta `window.API`; inyecta
+  inline el **relevo** `js/scorm_bridge_relay.js` y le pasa `{iframeid, cmid, trackurl
+  (con sesskey+mode), session, nonce, teachermodevisible}`. El `sesskey` NUNCA cruza el
+  bridge.
+- **Shim en el iframe** (`js/scorm_bridge_shim.js`, copiado a `libs/exe_scorm_bridge.js`
+  e inyectado al inicio de `<head>` por `scorm_injector`): se autoactiva sólo en origen
+  opaco (`window.origin === 'null'`), instala el polyfill de storage, define
+  `window.API` local reutilizando `js/scorm_tracker.js` (con la nueva opción
+  `transport`), resuelve `objectid` de SU propio documento y postMessea los deltas al
+  padre. Oculta el teacher-mode localmente con el flag del handshake.
+- **`js/scorm_tracker.js`**: nueva opción `transport(data, sync)` que, cuando está
+  presente, sustituye al XHR directo (el modo legacy y los tests siguen usando el XHR).
+- **Modo `legacy`**: idéntico a hoy (same-origin, `window.API` en el padre, hider por
+  `contentDocument`). El shim baked queda dormido (origen no opaco).
+- **Permissions-Policy** (DEC-0019 M2, limpio): se mantiene como follow-up recomendado
+  para `exelearning_pluginfile()` (no incluido aún en este cambio para acotar el PR).
+
+### Protocolo del bridge
+
+```
+hijo→padre:  { exelearningBridge:<nonce>, type:'scorm', action:'ready'|'track',
+               cmi:{...}, itemscores:{ <objectid>:{scorepct,weighted,title} } }
+padre→hijo:  { exelearningBridge:<nonce>, type:'scorm', action:'config'|'ack',
+               teachermodevisible:0|1 }
+```
+
+Handshake: el iframe carga → el shim postMessea `ready` → el padre valida
+`event.source === iframe.contentWindow`, responde `config` con el `nonce` + el flag de
+teacher-mode → los `track` posteriores llevan el `nonce` y el padre revalida `source`.
+Validación del padre (defensa en profundidad; `track.php` revalida y clampa
+server-side): identidad de ventana (ancla primaria) + `type==='scorm'` + `action` en
+lista cerrada + `nonce` + forma del payload (`cmi` objeto). Mensajes desconocidos o
+inválidos se ignoran en silencio. El flush al cerrar pestaña lo hace el **padre** con
+`navigator.sendBeacon` en `pagehide` (same-origin, fiable), no un XHR síncrono.
+
+## Consecuencias
+
+- **Positivas:** RIE-001 pasa a `mitigado` por defecto. El contenido no puede leer
+  `parent.document`/`document.cookie`/sesión ni forjar peticiones con el `sesskey`
+  (que se queda en el padre). El ruteo por `objectid` (DEC-0017) y el guard de
+  form/scrambled (DEC-0042) se preservan. El flush por `sendBeacon` es más fiable que
+  el XHR síncrono en `beforeunload`.
+- **Negativas / coste:** mayor superficie JS (shim + relevo, ambos con tests Vitest);
+  el almacenamiento web del contenido pasa a ser por-sesión (no persiste entre
+  recargas) en modo seguro; al quitar `allow-popups-to-escape-sandbox` se pierde el
+  `window.print()` del popup de la rúbrica (regresión conocida de DEC-0019 M1). El
+  modo `legacy` cubre cualquier paquete que falle bajo origen opaco.
+- **Cambios que dispara:** RIE-001 → `mitigado`; abre TAREA-017 (implementación) y deja
+  como follow-up opcional M2 (Permissions-Policy) y M3 (CSP de red con toggle).
+
+## Riesgos
+
+- **RIE-001** — pasa a `mitigado` (modo seguro por defecto). Residuo aceptado:
+  organizaciones que activen `legacy` por compatibilidad vuelven al riesgo same-origin.
+- **Compatibilidad de origen opaco:** verificar en Chrome y Firefox reales que el
+  polyfill (`Object.defineProperty(window,'localStorage',…)`) sustituye el getter
+  nativo (la configurabilidad varía entre motores; el shim degrada con try/catch).
+- **Behat de grading `@javascript`:** el escenario que usa `window.API.LMSSetValue`
+  asume el API en el padre; en `secure` vive en el iframe → adaptar o apoyarse en el
+  paso server-side `the following eXeLearning SCORM scores exist` (mode-agnóstico).
+
+## Limitación conocida (entornos PHP-WASM / service worker)
+
+Los playgrounds PHP-WASM (p. ej. el Moodle Playground en GitHub Pages) sirven
+`pluginfile.php` mediante un **service worker**. Un service worker **NO controla
+iframes de origen opaco** (sandbox sin `allow-same-origin`), así que en modo `secure`
+la petición del iframe a `content/<rev>/index.html` no la intercepta el SW, cae al
+hosting estático y devuelve 404 (verificado por HAR: `_fetchedViaServiceWorker:false`,
+`server: GitHub.com`, `x-cache: HIT`). Además ese 404 lo cachea el CDN, así que tras
+un intento en `secure` el modo `legacy` puede seguir mostrando el 404 cacheado en la
+misma pestaña hasta recargar en limpio. **Mitigación:** el `blueprint.json` del
+Playground fuerza `iframemode=legacy`. En un Moodle real `pluginfile.php` es un
+endpoint de servidor y el iframe de origen opaco lo carga con normalidad, así que el
+modo `secure` por defecto funciona; la limitación es exclusiva de los hosts WASM/SW.
+
+## Validación
+
+- `php -l` limpio; **phpcs `--standard=moodle` 0/0** sobre los ficheros tocados.
+- **Vitest 40/40 verde** (`make test-js`): 16 del tracker (sin regresión por
+  `transport`) + 24 nuevos en `tests/js/scorm_bridge.test.js` (shim: polyfill de
+  storage, detección de origen opaco, handshake, cola pre-nonce, identidad de fuente,
+  ocultado teacher-mode; relevo: validadores puros, identidad de ventana, nonce, forma,
+  cuerpo a `track.php`, `sendBeacon`).
+- **PHPUnit** `tests/player_iframe_test.php` (`@covers \mod_exelearning\local\ui\
+  player_iframe`): default secure, fail-safe ante valor inválido, legacy respetado,
+  tokens del sandbox por modo (sin `allow-same-origin`/`allow-top-navigation`/
+  `allow-modals` en secure). Se ejecuta en contenedor/CI (PHPUnit no corre en host).
+- **Behat** (CI): grading e2e en modo secure + escenarios de report (mode-agnósticos).
+
+## Seguimiento
+
+- **TAREA-017**: implementación del bridge seguro (esta ADR).
+- Follow-up opcional: **M2** Permissions-Policy y **M3** CSP de red estricta-con-toggle
+  en `exelearning_pluginfile()` (DEC-0019); **M8** sandboxing de JS en cliente
+  (TAREA-013) sigue pendiente como capa extra.
diff --git a/research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md b/research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md
new file mode 100644
index 0000000..c1f9997
--- /dev/null
+++ b/research/decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md
@@ -0,0 +1,152 @@
+---
+id: DEC-0060
+titulo: "Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-0059)"
+estado: Aceptada
+fecha: 2026-06-13
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-002
+  - REPO-004
+relacionados:
+  - DEC-0059
+  - DEC-0019
+  - RIE-001
+  - AN-008
+  - DEC-0017
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+DEC-0059 implementó el modo `secure` (iframe de origen opaco + bridge SCORM por
+postMessage) sirviendo el contenido por `pluginfile.php` normal (Ruta A de DEC-0019).
+La verificación en navegador (Chrome DevTools, Moodle real en `:80`) **refutó esa
+Ruta A**: el `index.html` cargaba pero **todos los subrecursos (CSS/JS, incluido el
+shim) daban 404**, dejando el contenido sin estilos y el SCORM sin `window.API`.
+
+## Problema (causa raíz verificada)
+
+La cookie de sesión de Moodle es **`SameSite=Lax`** por defecto
+(`lib/classes/session/manager.php:513-518`). Un documento de **origen opaco** (iframe
+`sandbox` sin `allow-same-origin`) tiene "site for cookies" nulo, así que **no envía
+la cookie de sesión en sus peticiones de subrecursos**. Como `exelearning_pluginfile()`
+exige `require_login()`, esos subrecursos se rechazan (302/403) → 404 efectivo. El
+`index.html` sí carga porque su navegación la inicia el padre (lleva cookie Lax). →
+**Aislar contenido same-origin autenticado del padre con solo el atributo `sandbox` es
+imposible:** con `allow-same-origin` el contenido alcanza el padre (RIE-001); sin él,
+no carga sus assets. (Por eso el core nunca usa origen opaco para contenido
+autenticado; `wp-franer` puede porque inyecta el contenido inline con `srcdoc`, inviable
+para un paquete eXeLearning multi-fichero.)
+
+## Investigación de alternativas (con evidencia)
+
+| Vía | ¿Aísla del padre? | ¿Carga assets/SCORM? | ¿En-plugin? | Veredicto |
+|---|---|---|---|---|
+| Legacy (same-origin) | No | Sí | Sí | RIE-001 abierto (fuga de sesskey/DOM) |
+| **A · Token + opaco + bridge** | **Sí** | **Sí** | **Sí** | **Elegida** |
+| B · Origen separado (subdominio) | Sí (real) | Sí | No (infra) | Fuera de alcance |
+| C · Sandbox JS en cliente (M8) | — | No (rompe el contenido) | Sí | Inviable |
+
+- **Token (Opción A):** `make_pluginfile_url(..., $includetoken=true)` genera
+  `/tokenpluginfile.php/<token>/…` con `get_user_key('core_files', $userid)`. El token
+  va en la **ruta**, así que los subrecursos relativos del iframe opaco lo arrastran y
+  cargan **sin cookie de sesión**. `tokenpluginfile.php` valida el token
+  (`require_user_key_login('core_files')`) y **sigue ejecutando** las comprobaciones de
+  capacidad del callback (`exelearning_pluginfile` → `require_capability('mod/
+  exelearning:view')`). El token es de **solo lectura de ficheros**: NO da poder de
+  `sesskey` (ni acciones ni forms). **Precedente en core:** el propio H5P usa
+  `includetoken` cuando va embebido (`h5p/classes/player.php:429`). Requiere
+  `slasharguments` (token en ruta); on por defecto.
+- **Origen separado (B):** no hay mecanismo en core; la URL está fijada a
+  `$CFG->wwwroot` (`lib/classes/url.php:747,754`). Exigiría reverse-proxy + un eTLD+1
+  distinto para que la cookie no llegue al contenido. Aislamiento máximo, pero infra
+  fuera del plugin. Documentado como futuro.
+- **M8 (sandbox JS):** inviable. El contenido exportado necesita DOM real + jQuery +
+  Bootstrap + bucle de eventos; ShadowRealm/Worker no tienen DOM y un shim WASM (+100KB)
+  lo haría inmanejable. El único acceso cross-frame es la API SCORM (ya intermediada).
+
+## Decisión
+
+Implementar la **Opción A endurecida** como modo `secure` (default), corrigiendo el
+mecanismo de servido de la Ruta A de DEC-0059 (el resto de DEC-0059 —ajuste
+`iframemode`, bridge postMessage, sandbox sin same-origin/popups-to-escape— sigue
+vigente):
+
+1. **Servir el iframe por `tokenpluginfile`** (token `core_files` de **TTL corto**,
+   redondeado a la hora para reutilizarse; `view.php`). Los assets cargan sin cookie;
+   el iframe sigue opaco (el contenido no puede tocar DOM/cookies/sesskey del padre).
+2. **CSP + Permissions-Policy** desde `exelearning_pluginfile()` (solo modo secure,
+   solo el documento HTML; `send_stored_file` no las borra). Endurece sin romper
+   eXeLearning (que necesita inline + eval): `object-src 'none'`, `base-uri 'none'`,
+   `frame-ancestors 'self'`, y `connect-src` acotado a este sitio (corta exfiltración
+   del token por fetch/XHR). `\mod_exelearning\local\ui\player_iframe`.
+3. **NO degradar en silencio a legacy.** Si secure no puede renderizar (slasharguments
+   off, o un host con service worker que no sirve iframes opacos —p. ej. el Playground
+   PHP-WASM), el shim nunca emite `ready` y el **watchdog del relay** muestra el aviso
+   "configuración de seguridad impide mostrar este contenido; contacte al admin"
+   (`securemodeblocked`), en vez de caer a same-origin. El admin elige legacy de forma
+   explícita si lo desea. El watchdog usa **dos señales** para no dejar el aviso detrás
+   de una espera larga en blanco: en cuanto el elemento iframe dispara `load` (que ocurre
+   **también** cuando la navegación acaba en una página de error —el 404 del host con SW—)
+   concede solo una **gracia corta** (~2,5 s) para el handshake; si `load` nunca llega,
+   cae a un tope mayor (8 s). Así el aviso aparece justo tras el fallo de carga, no tras
+   una ventana de varios segundos en la que el contenido "parecía" cargar.
+4. **Self-heal del bridge:** los paquetes extraídos antes de DEC-0060 no tienen el shim
+   en `libs/`; `view.php` los re-extrae una vez (idempotente) para que secure funcione
+   sin re-subir.
+
+## Consecuencias
+
+- Positivas: el modo seguro **funciona de verdad** en Moodle real (verificado en
+  navegador) y aísla el contenido del padre. RIE-001 mitigado por defecto. El contenido
+  recibe un token de **solo-lectura de ficheros** en vez del `sesskey` → estrictamente
+  más seguro que legacy. No hay degradación silenciosa de seguridad.
+- Negativas / coste: el token (aunque de solo lectura y TTL corto) queda visible en la
+  URL del contenido; el CSP `connect-src` corta su exfiltración por fetch, pero un
+  `<img>/<script>` a `https:` externo podría sacarlo (mitigado por el TTL; un perfil CSP
+  estricto que lo cierre del todo rompería MathJax/YouTube → toggle futuro). El
+  Playground (y cualquier host con SW) **no puede** servir secure y muestra el aviso.
+- Dispara: corrige la Ruta A de DEC-0059; RIE-001 → mitigado. Futuro: Ruta B
+  (subdominio/infra) para aislamiento máximo; toggle CSP estricto.
+
+## Riesgos
+
+- **RIE-001 — mitigado** (modo seguro por defecto, funcional). Residuo: token de
+  ficheros expuesto al contenido (acotado por CSP + TTL); legacy opt-in reabre el
+  riesgo same-origin.
+- **Compatibilidad:** `slasharguments` debe estar on (default); si no, el watchdog
+  muestra el aviso. Hosts con service worker (Playground) no pueden secure.
+
+## Validación
+
+- **Chrome DevTools en Moodle real (`:80`):** iframe opaco + servido por
+  `tokenpluginfile` (origen `null`, `SecurityError` al leer `contentWindow` desde el
+  padre); CSS/JS cargan; el shim emite `ready`; el relay valida e `init` no lanza;
+  **`track.php` responde `{ok:true, rawscore:100, peritem:{1:100}}`** (guarda la nota);
+  el watchdog NO salta cuando secure funciona y el contenido renderiza con estilos.
+- **Chrome DevTools en el Playground PHP-WASM (confirmación empírica 2026-06-13):** el
+  iframe se construye en secure (sandbox `allow-scripts allow-popups allow-forms`, origen
+  opaco — `SecurityError` al leer `contentWindow`), pero la petición
+  `tokenpluginfile.php/<token>/<ctx>/mod_exelearning/content/1/index.html` devuelve **404**
+  (el service worker no controla subframes opacos, así que la URL cae a GitHub Pages). El
+  shim nunca emite `ready` → el watchdog **sí** muestra el aviso `securemodeblocked` y
+  oculta el iframe. El token **no** ayuda aquí: el bloqueo es el SW, no la cookie. Esto
+  confirma la "Limitación conocida": el Playground no puede servir secure y avisa (no
+  cae a legacy). La sensación de "funciona sin aviso" era el retardo del watchdog (ahora
+  ligado al `load`) más que el aviso quedaba bajo el pliegue.
+- **phpcs `--standard=moodle` 0/0**; **Vitest 52/52** (shim, relay, watchdog —incluida la
+  ruta rápida por `load`—, storage); PHPUnit `player_iframe_test` (modo, tokens sandbox,
+  CSP, Permissions-Policy) en contenedor/CI. PHPUnit/Behat completos en CI.
+
+## Seguimiento
+
+- Toggle de admin para un CSP estricto (cerrar exfiltración del token por img/script a
+  costa de contenido externo).
+- Ruta B (subdominio dedicado eTLD+1 + reverse-proxy) como aislamiento máximo, fuera del
+  plugin (DEC-0019 M7 Route B).
+- Confirmar en CI la matriz PHPUnit/Behat y, si procede, un escenario Behat de grading
+  en modo secure (entrando al frame del paquete).
diff --git a/research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md b/research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md
new file mode 100644
index 0000000..f9e51e6
--- /dev/null
+++ b/research/decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md
@@ -0,0 +1,272 @@
+---
+id: DEC-0061
+titulo: "Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio"
+estado: Aceptada
+fecha: 2026-06-14
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - RIE-001
+relacionados:
+  - DEC-0059
+  - DEC-0060
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+El modo seguro ([[DEC-0059]] + [[DEC-0060]]) sirve el `.elpx` en un iframe de **origen opaco**
+(`sandbox` sin `allow-same-origin`, servido por `tokenpluginfile`), de modo que el HTML/JS no
+confiable del autor no puede leer la sesión/DOM de Moodle. El precio es que **el contenido externo
+embebido deja de funcionar**:
+
+- **YouTube/Vimeo salen EN BLANCO.** La flag de sandbox se **propaga al iframe anidado** del player,
+  que pierde su origen `youtube.com`/`vimeo.com` y no arranca. Verificado empíricamente y por la
+  especificación HTML; no hay primitiva de navegador (credentialless, fenced frames, COEP/COOP,
+  `referrerpolicy`…) que lo arregle desde dentro del sandbox.
+- **Los PDF tampoco renderizan.** Chrome bloquea su visor (PDFium) en un iframe sandboxed sin
+  `allow-same-origin`. Afecta a PDF remotos **y** a los empaquetados en el `.elpx`.
+
+Cómo lo resuelven otros: Moodle (filter/media) y la mayoría de plugins **embeben YouTube directo, sin
+sandbox**, confiando en el autor; H5P no ejecuta JS de autor. La única vía "clásica" para aislar +
+embeber sería servir el contenido desde un **origen separado (subdominio)** → iframe cross-origin sin
+sandbox opaco. **erseco descartó el subdominio** (requisito: el plugin debe funcionar *standalone*) y
+descartó degradar a `legacy` para los vídeos ("hay que encontrar la forma de que se vean").
+
+## Decisión
+
+**Promote-to-parent con overlay inline.** El contenido sigue aislado en el sandbox opaco; un **shim**
+inyectado en el paquete detecta los iframes de hosts en **lista blanca** (vídeo) o con ruta `.pdf`,
+los sustituye por un **placeholder** del mismo tamaño y **reporta su geometría** al padre por
+`postMessage`. Un **relay** en la página de Moodle (contexto de confianza) **valida + reconstruye** la
+URL y **superpone el reproductor real** —que él renderiza en su propio contexto, con origen real, así
+que funciona— **en el sitio exacto** del placeholder, sincronizado con el scroll. El player es
+cross-origin (o un PDF del paquete servido como `application/pdf`) y no puede tocar el host; la lista
+blanca + la validación estricta impiden que el contenido haga al padre cargar una URL arbitraria.
+
+| Pieza | Cambio |
+|---|---|
+| `js/exe_embed_shim.js` (nuevo) | Corre DENTRO del iframe. Se **auto-activa solo en origen opaco** (`isOpaqueOrigin()`: `document.cookie` lanza / `window.origin==='null'`), así que el mismo fichero horneado queda **dormido en modo legacy**. Reemplaza iframes whitelisted/`.pdf` por un placeholder (`data-exe-embed-id` + url **absoluta**, resuelta contra la ubicación del contenido, mismo w/h) y reporta `{id,url,x,y,w,h}` en load/scroll/resize/mutation (rAF). Dual-export `window.exeEmbedShim` + `module.exports` (Vitest). |
+| `js/exe_embed_relay.js` (nuevo) | Corre en el padre. Valida cada URL reportada: `new URL()`, rechaza userinfo (`@`), host exacto contra la lista, exige patrón de id (`/embed/{id}` YT, `/video/{id}` Vimeo) y **reconstruye** la URL canónica (nunca pasa la del contenido tal cual). Crea/posiciona un `<iframe>` player overlay clampado al iframe de contenido. Autentica por `event.source === iframe.contentWindow` (el origen opaco no da `event.origin` útil). |
+| `classes/local/package_manager.php` | Copia `js/exe_embed_shim.js` a `libs/exe_embed_shim.js` del paquete (plugin-owned, refrescado en cada extracción). |
+| `classes/local/scorm/scorm_injector.php` | Hornea `<script>window.__exeEmbedWhitelist=…</script>` + `<script src="libs/exe_embed_shim.js">` al inicio del `<head>` de **todo** HTML del paquete (marker `embed-shim`, idempotente). Independiente del bridge SCORM (reusa la misma iteración de extracción, [[DEC-0054]]). |
+| `classes/local/ui/player_iframe.php` | `embed_whitelist()` + `DEFAULT_EMBED_HOSTS` (YouTube/Vimeo). La CSP ya permitía `frame-src 'self' $siteorigin https:`. |
+| `view.php` | Inyecta el relay **inline** en el bloque `if ($securemode)` (independiente de SCORM, para todo paquete seguro), igual que el relay del bridge, para que su listener esté instalado antes de que cargue el iframe. |
+
+Decisiones de diseño confirmadas por erseco:
+
+1. **UX = overlay inline, NO modal/lightbox** ("aunque tengamos el riesgo debería ser inline"). El
+   player se ve en su sitio y se reproduce ahí; con scroll el overlay sigue al hueco.
+2. **PDFs = los locales del paquete siempre + cualquier `https` `.pdf`** (regla por extensión, sin
+   lista blanca de host para PDF). **Invariante de seguridad:** un `.pdf` *same-origin* solo se
+   renderiza si pertenece a este paquete (su path está bajo el directorio del contenido **o** contiene
+   el hash del paquete como segmento). Como `tokenpluginfile` sirve los ficheros del paquete por
+   extensión (`application/pdf`) con `X-Content-Type-Options: nosniff`, un `.pdf` del paquete nunca es
+   HTML ejecutable; y una URL same-origin ajena (p.ej. `/admin/x.pdf`) se rechaza.
+3. **`referrerpolicy`** del player: `strict-origin-when-cross-origin` para vídeo (evita YouTube Error
+   153), `no-referrer` para PDF. El iframe de CONTENIDO mantiene su `no-referrer`.
+4. **Solo en secure.** En legacy el contenido es same-origin, el shim queda dormido y los players ya
+   van inline.
+
+Lista blanca por defecto: `www.youtube.com`, `youtube.com`, `www.youtube-nocookie.com`,
+`youtube-nocookie.com`, `player.vimeo.com`, `vimeo.com`.
+
+## Consecuencias
+
+- El modo seguro deja de **degradar la UX** del contenido que abre recursos externos: YouTube, Vimeo y
+  PDF (remotos y empaquetados) se ven inline sin sacrificar el aislamiento ni exigir un subdominio.
+- Las imágenes y el vídeo HTML5 externos ya cargaban por CSP (`img-src/media-src … https:`); esto solo
+  añade los casos que el sandbox rompía (iframes de player + PDF).
+- La feature pertenece a la **familia eXeLearning**: el mismo JS (shim + relay, misma lógica) está en
+  wp-exelearning (PR #56) y omeka-s-exelearning (PR #21). Diferencia de cableado: **mod hornea** el
+  shim en la extracción y **inlina** el relay en `view.php`; wp/omeka lo inyectan a la hora de servir.
+- El bridge SCORM ([[DEC-0059]]) no se ve afectado: usa otro tipo de mensaje (`scorm` vs `exe-embed`)
+  y su relay sigue independiente.
+
+## Riesgos
+
+- **Clickjacking del overlay (aceptado por erseco).** El player se superpone al área del contenido.
+  Mitigaciones: el overlay lo **controla el padre** (el contenido solo reporta geometría + URL, no
+  inyecta nada), se **clampa a los límites del iframe de contenido** (no puede cubrir la toolbar/UI de
+  Moodle) y el player es **cross-origin** (no puede leer ni clicar el host). Geometría absurda
+  (no finita) se descarta.
+- **Render de URL arbitraria por el padre** → contenida por la lista blanca de host + reconstrucción
+  de URL + rechazo de userinfo/patrón (salvaguarda de RIE-001, familia del modo seguro). Para PDF, la
+  apertura es a un visor (no ejecuta como la página) y el caso same-origin queda atado a ficheros del
+  propio paquete.
+- **`targetOrigin: '*'`** en el `postMessage` del shim: aceptable porque no viaja ningún secreto y el
+  padre autentica por `event.source` (el origen opaco no ofrece `event.origin` usable).
+
+## Validación
+
+- **Vitest** `tests/js/exe_embed.test.js` (14 tests): el validador acepta `youtube.com/embed/{id}`,
+  `youtube-nocookie`, `player.vimeo.com/video/{id}` y **reconstruye** la URL canónica; **rechaza**
+  `youtube.com.evil.com`, `evil.com@youtube.com`, esquema no-https, id inválido; PDF cross-origin
+  `https` se acepta, PDF same-origin solo si es del paquete (dir/hash), `/admin/x.pdf` se rechaza; el
+  shim produce placeholder para video/PDF y deja intacto un iframe no permitido.
+- **Regresión SCORM (que no se rompa la puntuación)** — el modo seguro ahora carga **a la vez** el
+  bridge SCORM y el shim/relay de embeds; deben convivir:
+  - Vitest `tests/js/embed_scorm_coexistence.test.js` (4 tests): los 5 globals (tracker + shim/relay
+    SCORM + shim/relay embed) quedan definidos y distintos (sin pisarse); el relay SCORM **sigue
+    aceptando** un mensaje `track` (`acceptTrack` con nonce correcto) con los módulos de embed
+    cargados, y rechaza el nonce erróneo; ambos canales se ignoran mutuamente (`scorm` vs `exe-embed`).
+  - PHPUnit en el contenedor vivo (`make test` / `phpunit-docker.sh`): **119 tests OK** sobre
+    `track_test` (endpoint que **guarda la puntuación**), `scorm_injector_test` (mi cambio: hornea
+    bridge + embed, idempotente), `grades_test`/`lib_grades_test`/`gradeitems_test`/`grademodel_test`.
+- **PHPUnit** `tests/local/scorm/scorm_injector_test.php`: asserts de que el marker `embed-shim`, el
+  global `__exeEmbedWhitelist` y `libs/exe_embed_shim.js` se hornean en `index.html` y en las páginas
+  anidadas (`../libs/…`), idempotente, **sin perder** el bridge SCORM ni el wrapper pipwerks.
+- **`phpcs --standard=moodle`** 0/0 sobre `player_iframe.php`, `package_manager.php`,
+  `scorm_injector.php`, `view.php` y los tests.
+- **Verificación en vivo** (contenedor `mod_exelearning_3-moodle-1`, `iframemode=secure`):
+  - **Embeds**: una actividad desde `research/fixtures/elpx/external-embeds-demo.elpx` renderiza
+    **4 players inline** (YouTube, Vimeo, PDF remoto y **PDF local del paquete**) sobre el iframe de
+    contenido opaco (servido por `tokenpluginfile`); el iframe `example.com` NO se promueve.
+  - **SCORM scoring (lo más importante)**: respondido un iDevice calificable, el endpoint real
+    `track.php` devuelve `{"ok":true,"attempt":1,"rawscore":100,"status":"completed","peritem":{"1":100,"2":100}}`;
+    quedan 3 filas en `exelearning_attempt` (overall + 2 ítems), el gradebook marca `finalgrade=100` en
+    ambos ítems, el informe de intentos lista el intento y la actividad pasa a "Hecho: recibir
+    calificación". **El shim de embeds NO rompe el scoring** (es independiente del bridge).
+- **Bug encontrado y corregido en la prueba en navegador**: mod sirve los assets del paquete con URLs
+  **relativas** (a diferencia del proxy de wp/omeka que reescribe a absolutas), así que el shim debe
+  **reportar la URL ABSOLUTA** (resuelta contra la ubicación del contenido) — el relay del padre no
+  puede resolver una relativa (la resolvería contra la página host). Fix en el shim de los 3 plugins +
+  test de regresión Vitest (`exe_embed.test.js`: una src relativa se reporta absoluta).
+- **Fixtures**: `research/fixtures/elpx/{youtube-embed,vimeo-embed,external-embeds-demo}.elpx` (el
+  último con PDF remoto + PDF local empaquetado + imagen/vídeo remotos + un iframe no-whitelist).
+
+## Actualización (2026-06-14): re-validación con export real, proveedores, tokens y fix de navegación
+
+### Re-validación de la NECESIDAD con un export real
+Las fixtures sintéticas iniciales (`index.html` a mano) no eran representativas. Con un **export real
+de eXeLearning** (`research/fixtures/elpx/remote-embeds.elpx`: `index.html` + `html/{vimeo,
+mediatecamadrid,remote-pdf}-embed.html`) se repitió el experimento de control en mod (secure):
+- shim **activado** → el vídeo de YouTube renderiza y reproduce;
+- shim **desactivado** (control) → caja en **blanco**.
+
+Causa confirmada en 4 ejes: (1) **no es CSP** — `frame-src 'self' … https:` permite YouTube
+(`player_iframe.php:171`), sin error CSP en consola; (2) es la **propagación del origen opaco** al
+iframe anidado del player; (3) por especificación un contexto de navegación anidado no puede tener
+*menos* restricciones que su padre; (4) lo único que lo "arregla" es `allow-same-origin`, que rompe el
+aislamiento. **No hay alternativa más simple que preserve la seguridad: el overlay promote-to-parent es
+la solución mínima.** (La duda razonable de erseco quedó así verificada, no asumida.)
+
+### Proveedores añadidos
+**Dailymotion** (`www/geo.dailymotion.com`, embed `/embed/video/{id}`) y **EducaMadrid / Mediateca de
+Madrid** (`mediateca.educa.madrid.org`, embed `/video/{id}/fs`), cada uno con validador por proveedor
+que **reconstruye** la URL canónica (nunca pasa la del contenido tal cual). Verificado en vivo
+(EducaMadrid renderiza inline en mod y omeka).
+
+### Alineación de tokens del sandbox (los 3) + fix de CSP oculto
+Token seguro canónico = `allow-scripts allow-popups allow-forms` (los iDevices de eXe usan
+formularios). wp/omeka **no tenían `allow-forms`** ni en el atributo del iframe ni — más grave — en la
+**directiva CSP `sandbox`** del contenido servido (`class-content-proxy.php`, `ContentController.php`,
+hardcodeadas). Sin `allow-forms` en la CSP, el envío de formularios se bloquea aunque el iframe lo
+permita (el sandbox efectivo es la *intersección* de ambos). Corregido en los dos + tests. Legacy
+alineado a `…allow-forms allow-popups-to-escape-sandbox`.
+
+### Bug de navegación entre páginas (reportado por erseco) + fix
+Al paginar contenido eXe multi-página, el embed de la página anterior **quedaba pegado** en la nueva
+(p.ej. YouTube persistía en la página de Vimeo, reescalado a su caja). Causa: el shim **reinicia su
+contador de id por página**, así que el primer embed de cada página reusa `exe-embed-1`; el relay
+reutilizaba el player existente y solo lo reposicionaba, **sin actualizar su `src`**. Reproducido en
+vivo (la altura cambiaba a la de Vimeo pero el `src` seguía en YouTube). Fix: cada player se etiqueta
+con `data-exe-embed-src`; en `sync()` se **reemplaza** cuando un id reusado apunta a otra URL. Test de
+regresión Vitest + verificado en vivo en los 3 (mod: youtube→vimeo→mediateca→pdf cambian limpiamente;
+wp y omeka, idem; el atributo del fix presente en el relevo servido).
+
+### Anti-drift
+La lógica de shim/relay es idéntica en los 3 (solo cambia el envoltorio de export). mod es la **fuente
+canónica** (`js/exe_embed_{shim,relay}.js`); wp/omeka llevan cabecera "MIRROR". `tools/check-embed-sync.mjs`
+normaliza y compara la lógica + whitelist + tokens de las 3 copias y sale ≠0 si divergen (herramienta
+de mantenimiento local, no gate CI cross-repo: no hay infra compartida).
+
+### Limitación conocida: iDevice de vídeo interactivo con fuente remota
+El iDevice **vídeo interactivo** con fuentes remotas (YouTube/EducaMadrid) usa la **YouTube
+IFrame Player API** (`new YT.Player` + `getCurrentTime`/`pauseVideo`/`seekTo`, 8 llamadas de
+control en `idevices/interactive-video/interactive-video.js`) para pausar el vídeo y mostrar
+preguntas cronometradas. En modo seguro esto **no funciona**: (1) en origen opaco el player
+de YouTube no renderiza dentro del iframe; (2) promoverlo al padre (promote-to-parent) lo
+**desacopla del control** del iDevice, que vive en el hijo opaco → sin pausa/seek/tiempo, las
+preguntas no disparan.
+
+Se prototipó un **bridge de control YT** en el embedder (un `window.YT` falso en el hijo que
+proxyea a un player real en el padre). Verificado en vivo: el vídeo **reproduce** y la
+pregunta **aparece y se responde** en el segundo configurado. Pero **reconstruir el layout
+del iDevice desde el padre — portada/`Inicio`, `float:left` de `#player` al activar
+(`interactive-video.css` `.active #player{float:left}`), la posición de cada slide — es
+frágil** (el vídeo aterriza mal y el solapamiento vídeo/pregunta no cuadra). **Decisión
+(erseco): NO mantener el bridge en el embedder** (revertido, no commiteado).
+
+- **Estado en secure:** vídeo interactivo con fuente **remota** → usar **modo legacy**. Con
+  fuente **local** (archivo del paquete, HTML5 `<video>`) funciona en secure (corre en el
+  marco, sin player cross-origin).
+- **Arreglo correcto (pendiente upstream):** está en el **iDevice de eXeLearning**, que conoce
+  su propio layout: detectar origen opaco (`window.origin==='null'`) y o bien **degradar** (embed
+  simple → lo promociona el shim existente, sin interactividad) o **conducir él mismo** un relay
+  del padre. Más simple y robusto que parchear en los 3 embedders.
+
+## Actualización (2026-06-14b): invariante estructural — embeds sin lista blanca (open por defecto)
+
+### Reversión razonada del "sin whitelist no es seguro"
+La actualización anterior concluyó "sin lista blanca no es seguro" por analogía con Moodle media / WP
+oEmbed. **Esa conclusión era incorrecta para ESTE modelo de amenaza y se corrige.** Moodle/WP embeben
+en páginas de CONFIANZA same-origin; aquí el contenido es NO confiable + opaco, y el player promovido es
+**cross-origin y sandboxeado**, así que la SOP lo aísla del LMS **independientemente del host**. El host
+es irrelevante para el ESCAPE; la lista blanca solo mitigaba **phishing/tracking** (marginal: el
+contenido sandboxed ya puede mostrar HTML falso, hacer POST de formulario cross-origin y cargar img de
+tracking). Lo propone el artículo de seguridad (§6.3) y lo confirma una revisión adversaria (agente
+Plan, read-only): **"SÍ, con condiciones"**.
+
+### Decisión: invariante estructural + modo `open` por defecto
+- Ajuste `mod_exelearning/embedmode`: **`open` (def.)** promueve cualquier iframe `src` **https +
+  cross-origin al LMS**; **`strict`** mantiene la lista blanca + reconstrucción por proveedor (para
+  despliegues donde ni el autor es de fiar). Fail-safe a `strict` ante valor inválido; default real
+  `open`. Esto **obvia** la idea de "whitelist configurable por admin".
+- `validate()` (relay) exige: parsear URL **absoluta** (NO resolver relativas contra el LMS — heredarían
+  su origen); `https:`; sin userinfo (`url.username/password`); cross-origin (`url.origin !==
+  window.location.origin`); no subdominio/superdominio del host del LMS (límite por punto en ambos
+  sentidos); no IP/IPv6/loopback/`localhost`/`.local`; host no vacío. PDF: cualquier https cross-origin
+  o fichero same-origin del paquete.
+- El shim promueve cualquier https cross-origin (+ `.pdf`) como candidato; el **relay** es la puerta
+  autoritativa (ya no hay lista de hosts en el shim).
+
+### Condiciones de seguridad (todas implementadas + verificadas)
+- **Player de vídeo SANDBOXEADO**: `sandbox="allow-scripts allow-same-origin allow-popups allow-forms
+  allow-presentation"` (SIN `allow-top-navigation` ni `allow-modals`). `allow-same-origin` va en el
+  iframe **cross-origin** (el proveedor conserva SU origen, no el del LMS) → renderiza y la SOP lo
+  aísla; es lo que permite sandboxearlo y **bloquear el top-navigation** (un sitio arbitrario no puede
+  redirigir la pestaña). **NO** es el `allow-same-origin` prohibido del iframe de CONTENIDO (cuyo src ES
+  el origen del LMS). Verificado en vivo: YouTube, Vimeo y EducaMadrid/JWPlayer renderizan bajo él.
+- **D1 (redirect-laundering)**: guard `load` que elimina el player si aterriza **same-origin** al LMS
+  (un `src` cross-origin que haga 30x al origen del LMS sería, con `allow-same-origin`, scriptable).
+- **D2 (impersonación)**: los players se marcan `data-exe-embed-player` y `frameForSource`/`pingAll` los
+  excluyen → un player sandboxeado no puede forjar un mensaje `sync` y hacerse pasar por contenido.
+- **PDF SIN sandbox**: el visor PDF del navegador **no funciona dentro de un iframe sandbox** (icono de
+  error; verificado), así que se deja **sin sandbox** (y por tanto sin `allow-same-origin`) como antes
+  de DEC-0061 (los PDF ya eran "cualquier https .pdf"). El guard D1 sigue aplicando a PDFs cross-origin.
+  Residual documentado: un servidor que sirva HTML en una ruta `.pdf` podría ejecutar scripts ahí
+  (pre-existente, bajo). **pdf.js** (que eXe empaqueta) NO es viable en el contenido opaco (su `fetch`
+  desde origen `null` está bloqueado por CORS, incl. `tokenpluginfile`); queda como mejora futura para
+  PDFs locales servida desde el padre.
+- **Sin backstop CSP en el padre**: una directiva `frame-src` en la página completa de Moodle podría
+  romper iframes propios de Moodle, así que no se añade; el guard D1 + el sandbox son los controles.
+
+### Verificación
+- Vitest `tests/js/exe_embed.test.js` reescrito (open + strict + helpers IP/subdominio + sandbox del
+  player + D2 forged-message). Suite JS **92/92**. `tools/check-embed-sync.mjs` con invariantes
+  estructurales, **0 drift**.
+- En vivo (mod localhost:80, modo `open`): YouTube/Vimeo/EducaMadrid/PDF renderizan, el player lleva el
+  sandbox correcto (`data-exe-embed-player`), y navegar entre páginas cambia el player (fix de nav).
+
+## Seguimiento
+
+- UI de admin para editar la lista blanca (hoy constante; configurable por filtro/ajuste como
+  seguimiento, igual que en wp/omeka).
+- Paridad mantenida con wp-exelearning (PR #56) y omeka-s-exelearning (PR #21): el JS shim/relay es la
+  misma lógica en los tres.
+- Independiente de TAREA-015 (xAPI) y TAREA-016 (origen por URL): el origen separado por URL sigue
+  siendo una alternativa válida para quien lo quiera, pero ya no es **necesaria** para ver vídeos/PDF.
diff --git a/research/decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md b/research/decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md
new file mode 100644
index 0000000..bea9743
--- /dev/null
+++ b/research/decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md
@@ -0,0 +1,144 @@
+---
+id: DEC-0062
+titulo: "Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local"
+estado: Aceptada
+fecha: 2026-06-14
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-002
+experimentos: []
+relacionados:
+  - DEC-0059
+  - DEC-0060
+  - DEC-0017
+  - DEC-0042
+  - RIE-001
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+`DEC-0059` implementó el bridge SCORM por `postMessage` con el iframe en **origen
+opaco** (modo `secure`, por defecto). Su pieza clave ("el linchpin") era inyectar un
+`window.API` (shim) DENTRO del iframe para que el pipwerks empaquetado lo descubriese
+**sin tocar el padre** cross-origin.
+
+Al verificar en vivo (`localhost:80`, modo `secure`) que la puntuación SCORM se
+guardaba, erseco reportó que **NO se guardaba**: contestar una pregunta y pulsar
+"Guardar la puntuación" no creaba ningún intento en `exelearning_attempt` ni llegaba
+ninguna petición a `track.php`. En modo `legacy` sí se guardaba. La "verificación"
+previa de DEC-0059 había usado un POST directo a `track.php` que **saltaba el bridge**,
+enmascarando el fallo.
+
+## Problema
+
+¿Por qué en modo `secure` el SCO nunca persiste la nota, si el shim sí inyecta
+`window.API` en el iframe y el handshake del bridge (`ready`→`config`) funciona?
+
+## Hechos verificados (con cita)
+
+Diagnóstico en vivo instrumentando el shim del iframe opaco (no observable desde fuera)
+y emitiendo el estado de pipwerks por `postMessage` al padre. Resultados decisivos sobre
+una actividad evaluable real en modo `secure`:
+
+1. **El shim funciona:** `window.API === shim` (`apiIsShim:true`), el handshake llega
+   (sin "secure blocked"), `pipwerks` cargó (`typeof === 'object'`).
+2. **Pero la conexión nunca se activa:** `pipwerks.SCORM.connection.isActive === false`,
+   `pipwerks.SCORM.version === null`, `pipwerks.SCORM.API.isFound === false`,
+   `pipwerks.SCORM.API.handle == null`, y `LMSInitialize` **nunca se llamó** (contador
+   0). Por tanto `LMSSetValue`/`LMSCommit` del guardado son no-ops silenciosos → 0 filas.
+3. **Causa raíz — `get()` lanza `SecurityError` y nunca mira la ventana local.**
+   Forzando `pipwerks.SCORM.API.get()` desde el shim:
+   `"SecurityError: Failed to read a named property 'API' from 'Window': Blocked a frame
+   with origin \"null\" from accessing a cross-origin frame."`
+   El `get()` vendado (`assets/scorm/SCORM_API_wrapper.js:130-150`, **modificado**
+   respecto al pipwerks estándar) arrancaba directamente en el **padre** y **omitía la
+   ventana actual**:
+   ```js
+   if (win.parent && win.parent != win) { API = find(win.parent); }  // ← sin find(win)
+   if (!API && win.top.opener) { API = find(win.top.opener); }
+   ```
+   - En `legacy` el padre es same-origin (Moodle, con `window.API`) → funciona.
+   - En `secure` el padre es opaco/cross-origin → `find(win.parent)` accede a
+     `parent.API` y lanza `SecurityError` → `init()` revienta (lo traga su `catch`) →
+     `isActive` se queda en `false` → nada se guarda.
+4. **El "linchpin" de DEC-0059 verificó la función equivocada.** DEC-0059 §"Hechos
+   verificados" (1) cita `find(win)` (`SCORM_API_wrapper.js:71-106`), que sí parte de la
+   ventana actual. Pero el punto de entrada real es `getHandle()`→`get()`, y **este
+   `get()` no llamaba a `find(window)`**. La premisa "pipwerks descubre el `window.API`
+   local antes de subir" era cierta para `find()` pero **falsa para `get()`**, que es
+   quien decide. El origen opaco del modo `secure` nunca fue alcanzable.
+5. **No hay doble pipwerks.** El export de eXeLearning sólo **usa** `pipwerks.SCORM.get/
+   set` (`libs/common.js:945,1175`); el único `pipwerks` es el vendado por mod
+   (`var pipwerks = {}`), inyectado por `scorm_injector`. Descartado como causa.
+
+## Causa raíz
+
+El `get()` vendado de pipwerks fue alterado en algún momento para mirar **sólo el
+padre** y saltarse la ventana actual. Eso es exactamente incompatible con la
+arquitectura de DEC-0059, que provee el API **localmente** en un iframe cuyo padre es
+**inalcanzable** por opaco.
+
+## Decisión
+
+Restaurar en `assets/scorm/SCORM_API_wrapper.js` el orden estándar de pipwerks en
+`get()`: **mirar primero la ventana actual** (`find(win)`) y sólo después subir al padre
+/ opener, **envolviendo cada salto cross-origin en `try/catch`** para que un ancestro
+opaco no pueda abortar la búsqueda nunca más.
+
+```js
+try { API = find(win); } catch (e) { trace(...); }                       // ventana local primero
+if (!API && win.parent && win.parent != win) {
+  try { API = find(win.parent); } catch (e) { trace(...); }              // fallback same-origin (legacy)
+}
+try { if (!API && win.top && win.top.opener) { API = find(win.top.opener); } } catch (e) { trace(...); }
+```
+
+- **`secure`:** `find(win)` encuentra el `window.API` del shim de inmediato (el bucle de
+  `find` no sube porque `win.API` existe) → `init()` activa la conexión → el guardado
+  fluye shim → `postMessage('track')` → relevo → `track.php` → BD.
+- **`legacy`:** sin API local, `find(win)` **sube** al padre same-origin y devuelve su
+  `window.API`, idéntico al comportamiento previo (equivalencia probada en test).
+
+Cambio mínimo y acotado a `get()`; no se toca `find()`, ni el shim, ni el relevo, ni el
+inyector, ni BD/upgrade.
+
+## Consecuencias
+
+- **Positiva:** el modo `secure` por defecto (DEC-0059/DEC-0060) **por fin guarda la
+  nota SCORM** de extremo a extremo; el "linchpin" que DEC-0059 daba por hecho ahora se
+  cumple de verdad. El aislamiento de RIE-001 se mantiene intacto (el `sesskey` sigue en
+  el padre; el contenido sigue sin alcanzarlo).
+- **Endurecimiento:** `get()` ya no puede lanzar por un ancestro opaco; degrada a `null`
+  con traza, como manda el contrato de pipwerks.
+- **Sin regresión en `legacy`:** la búsqueda sigue resolviendo al `window.API` del padre
+  same-origin (sube por `find`), verificado por test unitario.
+
+## Validación
+
+- **Vivo (`localhost:80`, modo `secure`):** tras contestar + "Guardar la puntuación", se
+  escriben las filas reales en `exelearning_attempt` (`rawscore=100.00`,
+  `status=completed`/`passed`) y el bridge emite `track` (`hasCmi:true`). Antes del fix:
+  0 filas, 0 `track`.
+- **Vitest** `tests/js/scorm_api_wrapper.test.js` (nuevo, 6 casos, verde): `get()`
+  devuelve el API **local** y no el del padre (regresión del bug); `get()` no lanza con
+  padre opaco y encuentra el local; `get()` devuelve `null` sin lanzar cuando no hay API
+  y el padre es opaco; `get()` sigue subiendo a un padre same-origin sin API local
+  (legacy); `init()` activa la conexión vía API local con padre opaco; `set()` llega al
+  API local una vez activa (la nota se guarda). Suite JS completa **87/87**.
+- **phpcs/PHPUnit/Behat**: el fix es JS vendado (sin PHP); se confirma en CI.
+
+## Seguimiento
+
+- **Test de regresión vendado:** este ADR introduce el primer test Vitest sobre
+  `assets/scorm/*` (declarado "fuera de alcance" en `vitest.config`), justificado por ser
+  crítico para la nota. No cuenta para cobertura (`include: ['js/**']`); es guardia de
+  comportamiento.
+- **Lección para DEC-0059:** verificar el **punto de entrada real** (`getHandle`/`get`),
+  no sólo la función auxiliar (`find`), antes de declarar un linchpin.
+- Posible follow-up: un Behat `@javascript` de grading que corra en modo `secure` real
+  (no sólo el paso server-side) habría cazado esto antes; queda recomendado.
diff --git a/research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md b/research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md
new file mode 100644
index 0000000..7d01304
--- /dev/null
+++ b/research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md
@@ -0,0 +1,160 @@
+---
+id: DEC-0065
+titulo: "xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-0064 al modo seguro de DEC-0059)"
+estado: Aceptada
+fecha: 2026-06-19
+agentes:
+  - erseco
+  - claude-code
+fuentes:
+  - REPO-005
+  - FTE-011
+relacionados:
+  - DEC-0064
+  - DEC-0059
+  - DEC-0060
+  - DEC-0062
+  - DEC-0063
+  - DEC-0019
+  - DEC-0007
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Contexto
+
+`DEC-0064` implementó la ingesta xAPI (**xAPI-primary**) asumiendo que el iframe del paquete se
+sirve **same-origin** por `pluginfile.php`: el listener `js/xapi_listener.js` confía un statement
+sólo si `event.origin === origen del host` (RIE-013, su cabecera lo dice literalmente).
+
+`DEC-0059`/`DEC-0060` introdujeron el **modo seguro** (por defecto): el paquete corre en un iframe
+de **origen opaco** (sandbox sin `allow-same-origin`, servido por `tokenpluginfile`). En un origen
+opaco, el `event.origin` de los postMessage del paquete es la **cadena `"null"`**, que nunca
+coincide con el origen del host.
+
+Al fusionar `main` (DEC-0064) en la rama del modo seguro —**ambos por defecto**— la configuración
+por defecto pasa a ser **secure + xAPI-primary**. Con el listener tal cual, en modo seguro
+**descarta todos los statements** y la nota xAPI **se pierde en silencio**. En el merge inicial se
+gateó xAPI a legacy como medida conservadora; este ADR registra la **solución definitiva**.
+**Extiende** (no supersede) `DEC-0064` al modo seguro de `DEC-0059`.
+
+## Problema
+
+¿Cómo recibir y calificar los statements xAPI cuando el paquete corre en un iframe de **origen
+opaco**, sin reintroducir el acoplamiento same-origin que el modo seguro elimina (`RIE-001`) y sin
+**doble conteo** con el canal SCORM del bridge?
+
+## Opciones consideradas
+
+1. **Gatear xAPI a legacy (status quo del merge).** En secure calificar siempre por el bridge SCORM.
+   - ✔ Simple; no rompe nada.  ✘ xAPI-primary (recomendado, por defecto) **no surte efecto en la
+     configuración por defecto**; el canal moderno queda inactivo justo donde más se usa.
+2. **Relajar el listener a aceptar `event.origin === "null"`.**
+   - ✘ **Inseguro**: cualquier iframe opaco de la página (p.ej. un embed promovido sandboxeado,
+     `DEC-0061`) tiene origen `"null"`; `"null"` **no identifica** al emisor. Descartada.
+3. **Validar por identidad de ventana (elegida).** El listener confía un statement cuando
+   `event.source === contentWindow del iframe del paquete`, **exactamente como** el relay del bridge
+   SCORM (`DEC-0059`). El navegador fija `event.source` a la ventana emisora y el script de la página
+   **no puede falsificarlo**; el origen opaco **no la anonimiza** (sólo afecta a `event.origin` y al
+   acceso DOM same-origin). En modo legacy se conserva la validación por origen.
+
+## Evidencia
+
+- **Contrato del emisor** (`REPO-005` @ `e3b1bd13`, `FTE-011`): el emisor hace
+  `root.parent.postMessage({type:'exe-xapi-statement', statement}, parentOrigin||'*')` **síncrono**
+  desde la ventana top-level del iframe — **sin Worker, sin MessageChannel, sin frame hijo dinámico**.
+  En nuestro empotrado (iframe **hijo directo** de `view.php`) el padre recibe el mensaje con
+  `event.source === iframe.contentWindow`. El `parentOrigin` lo fija `config_injector` al origen del
+  host; el `targetOrigin` constriñe al **receptor**, no a `event.origin`.
+- **Origen opaco** (`DEC-0060`): el sandbox sin `allow-same-origin` serializa el origen a la cadena
+  `"null"`, no al host; sólo afecta a `event.origin` y al DOM same-origin, **no** a `event.source`
+  (comportamiento del navegador, del que el relay SCORM ya depende —`DEC-0062`).
+- **Precedente en el repo**: `js/scorm_bridge_relay.js` ancla en `e.source !== fr.contentWindow`
+  («an opaque origin has no useful event.origin»).
+- **Confianza cero del servidor** (`DEC-0063`/`DEC-0064`): `xapi_track.php` exige `sesskey` +
+  capability y atribuye la nota a `$USER` ignorando el actor; el paquete opaco **no tiene sesskey** y
+  no puede llamar al endpoint directamente. Identidad de ventana = **sin nonce**, pero el modelo de
+  confianza es **idéntico a legacy** (que confía en todo script same-origin) porque el contenido se
+  **autocalifica** y el servidor **acota**.
+
+## Decisión
+
+1. **Listener con doble puerta de confianza.** `js/xapi_listener.js` admite dos modos: **origen**
+   (legacy, `allowedOrigin`) e **identidad de ventana** (secure, `iframeid` →
+   `document.getElementById(iframeid).contentWindow`, resuelto **perezosamente por mensaje** porque
+   el listener se inyecta **antes** de existir el elemento iframe). En identidad de ventana se
+   **ignora** `event.origin` (el `"null"` opaco) y el ancla es `event.source`.
+2. **xAPI-primary en ambos modos.** `view.php`:
+   `$emitsxapi = exelearning_xapi_primary_enabled() && exelearning_package_emits_xapi(...)` (se quita
+   el gateo `!$securemode`). En secure inyecta el listener con `iframeid`; en legacy con
+   `allowedOrigin`. Comparte `$sessiontoken` como `registration` (`DEC-0007`).
+3. **SCORM inerte por el padre, no por el shim.** Para evitar doble conteo, en secure el **relay**
+   (`js/scorm_bridge_relay.js`, parámetro `disableTracking`) **valida pero no reenvía** el POST SCORM
+   cuando hay xAPI-primary. La decisión vive en el **padre** (código fresco inyectado en cada carga),
+   **no** en el shim **horneado** en el paquete: así es robusta aunque el shim sea de una versión
+   previa al flag. El shim **no puede alcanzar `track.php`** por sí mismo (origen opaco, sin sesskey),
+   así que suprimir el reenvío en el relay es **autoritativo**. En legacy, el `disableTracking` del
+   propio `scorm_tracker.js` (`DEC-0064`) cumple el mismo rol.
+4. **Sin degradación de seguridad real.** El statement es **autorreportado** en ambos modos; el
+   servidor valida y acota (`DEC-0063`). Identidad de ventana iguala a legacy en confianza, pero
+   conserva el **aislamiento de sesión** del modo seguro: el paquete sigue sin ver el `sesskey`, y el
+   padre (que lo tiene) reenvía **sólo** statements del propio iframe.
+
+### Componentes entregados
+
+`js/xapi_listener.js` (modo identidad de ventana: `iframeid`/`expectedSource`, resolución perezosa,
+función `isTrusted`; conserva el modo origen), `js/scorm_bridge_relay.js` (parámetro `disableTracking`
+que suprime el POST tras validar), `view.php` (`$emitsxapi` sin gateo; relay con
+`disableTracking => $emitsxapi`; listener con `iframeid` en secure o `allowedOrigin` en legacy, vía el
+helper `$emitinlinemodule`). Tests Vitest: del listener por identidad de ventana (acepta sólo el
+`contentWindow` del iframe aunque el origen sea `"null"`; rechaza cualquier otra ventana aunque alegue
+el origen del host; resolución perezosa) y del relay inerte (un `track` válido no hace POST, pero
+`ready` sigue haciendo handshake y el beacon de `pagehide` no envía nada).
+
+## Consecuencias
+
+- **Positivas:** xAPI-primary funciona en la **config por defecto** (secure); un **único canal** por
+  paquete en ambos modos (cero doble conteo); reusa el patrón de **identidad de ventana** ya
+  verificado del bridge SCORM; **no toca el shim horneado** (robusto ante paquetes ya extraídos).
+- **Negativas / coste:** identidad de ventana **no lleva nonce** (el emisor es código upstream que no
+  lo conoce), pero es equivalente en confianza a legacy; el `event.origin` `"null"` se **ignora**
+  deliberadamente en secure.
+- **Dispara:** revierte el gateo a legacy del merge inicial; actualiza `docs/tracking-architecture.md`
+  y `docs/xapi-integration-plan.md`.
+
+## Riesgos
+
+- **RIE (bajo).** Un script malicioso **dentro** del paquete podría postear un `exe-xapi-statement`
+  falso (no hay nonce). **Mitigado**: es exactamente lo que ya puede hacer en legacy (mismo origen) y
+  en SCORM (el `set()` de pipwerks); el servidor **acota** (lista blanca de verbos, `objectid`
+  registrado, `scaled∈[0,1]`, idempotencia por `statement.id`, nota a `$USER`). El modo seguro sigue
+  impidiendo lo único que importa: **alcanzar la sesión/sesskey del padre** (`RIE-001`).
+- **RIE (muy bajo).** Un embed promovido (`DEC-0061`) que intentara suplantar: su `event.source` es
+  la ventana del **player**, no la del iframe del paquete → **rechazado** por identidad de ventana.
+- **Limitación heredada de `DEC-0064` (no introducida aquí): el kill switch surte efecto en la
+  PRÓXIMA carga, no en sesiones en curso.** `$emitsxapi` (y por tanto `disableTracking`) se hornea en
+  el HTML al cargar la página, mientras `xapi_track.php` consulta `exelearning_xapi_primary_enabled()`
+  en cada request. Si un admin **apaga** xapiprimaryenabled con una página ya abierta, esa página
+  suprime SCORM (estado horneado) pero el servidor ignora el xAPI (estado nuevo) → esa vista **no
+  califica hasta recargar** (al recargar, `$emitsxapi=false` → SCORM califica normal). Es **simétrico
+  a `DEC-0064`** (mismo patrón en legacy) y este ADR sólo lo extiende a secure de forma **consistente**;
+  no se corrige aquí porque las soluciones (consultar el ajuste por AJAX, o que `xapi_track.php` honre
+  un token de página) o bien debilitan el kill switch o bien requieren estado de servidor por página
+  —una decisión de producto separada sobre la semántica del kill switch de `DEC-0064`—. Mitigación
+  operativa: cambiar el ajuste fuera de horario de actividad. Documentado en `docs/xapi-qa-checklist.md`.
+
+## Validación
+
+`phpcs --standard=moodle` 0/0 (view.php y plugin completo); Vitest **114/114** (nuevos: identidad de
+ventana del listener + relay `disableTracking`); `php -l view.php` OK. **Pendiente (fase viva):** e2e
+en Moodle real capturando un `postMessage` real del emisor desde el iframe opaco → columna del
+gradebook (Behat/Playwright entrando al frame; el modo seguro **no** se prueba en el Playground
+PHP-WASM, que no sirve iframes opacos —`DEC-0060`).
+
+## Seguimiento
+
+- Mantiene **fuera de alcance** (eco de `DEC-0064`): handler `core_xapi` + eventos, cmi5, LRS externo,
+  y el `'*'` como destino de confianza.
+- Si un futuro emisor upstream adoptara un canal con **nonce/handshake**, el modo identidad de ventana
+  podría endurecerse a nonce, como el bridge SCORM.
diff --git a/research/docs/indices/adrs.yaml b/research/docs/indices/adrs.yaml
index 107ac41..28fa1b5 100644
--- a/research/docs/indices/adrs.yaml
+++ b/research/docs/indices/adrs.yaml
@@ -58,5 +58,10 @@ items:
   - id: 'DEC-0056', titulo: 'Tests JS del tracker SCORM con Vitest; extracción del shim de view.php a js/scorm_tracker.js (fuente única, inyección inline)', estado: 'Aceptada', fecha: '2026-06-12', ruta: 'decisiones/adr/DEC-0056-tests-js-tracker-scorm-vitest.md'
   - id: 'DEC-0057', titulo: 'Extracción de paquete no-destructiva: validar la nueva revisión antes de podar la anterior (issue 73)', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0057-extraccion-no-destructiva.md'
   - id: 'DEC-0058', titulo: 'Build de release reproducible: fijar el editor al tag homónimo (semver-match), no a la rama main', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0058-fijar-editor-tag-en-release.md'
+  - id: 'DEC-0059', titulo: 'Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): implementación de RIE-001 Tier 2', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md'
+  - id: 'DEC-0060', titulo: 'Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige la Ruta A de DEC-0059)', estado: 'Aceptada', fecha: '2026-06-13', ruta: 'decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md'
+  - id: 'DEC-0061', titulo: 'Embeds externos en modo seguro: promover YouTube/Vimeo/PDF al padre (overlay inline) — standalone, sin subdominio', estado: 'Aceptada', fecha: '2026-06-14', ruta: 'decisiones/adr/DEC-0061-embeds-externos-promote-to-parent.md'
+  - id: 'DEC-0062', titulo: 'Fix: el bridge SCORM seguro nunca guardaba nota porque el get() de pipwerks no miraba la ventana local', estado: 'Aceptada', fecha: '2026-06-14', ruta: 'decisiones/adr/DEC-0062-fix-pipwerks-get-api-local-origen-opaco.md'
   - id: 'DEC-0063', titulo: 'Reglas de validación canónica del endpoint xAPI y política de versión (1.0.3 con tolerancia a 2.0)', estado: 'Propuesta', fecha: '2026-06-17', ruta: 'decisiones/adr/DEC-0063-validacion-canonica-endpoint-xapi-y-version.md'
   - id: 'DEC-0064', titulo: 'Implementación de la ingesta xAPI (TAREA-015): xAPI-primary para paquetes nuevos, SCORM inerte, overall desde el statement de paquete, siempre activo', estado: 'Aceptada', fecha: '2026-06-18', ruta: 'decisiones/adr/DEC-0064-implementacion-ingesta-xapi.md'
+  - id: 'DEC-0065', titulo: 'xAPI sobre el bridge seguro: el listener confía por identidad de ventana en el iframe opaco (extiende DEC-0064 al modo seguro)', estado: 'Aceptada', fecha: '2026-06-19', ruta: 'decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md'
diff --git a/research/docs/indices/diario.yaml b/research/docs/indices/diario.yaml
index 2d67564..a68d297 100644
--- a/research/docs/indices/diario.yaml
+++ b/research/docs/indices/diario.yaml
@@ -20,9 +20,13 @@ items:
   - ruta: 'tareas/diario/2026-06-10-geogebra-issue-29.yaml', fecha: '2026-06-10'
   - ruta: 'tareas/diario/2026-06-12-tests-js-tracker-scorm.yaml', fecha: '2026-06-12'
   - ruta: 'tareas/diario/2026-06-13-reconciliacion-stable-y-behat.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml', fecha: '2026-06-13'
+  - ruta: 'tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml', fecha: '2026-06-13'
   - ruta: 'tareas/diario/2026-06-17-adr-validacion-xapi-y-2.0.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-decisiones-endpoint-y-roadmap.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-investigacion-adl-xapi.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-limpieza-fixtures.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-17-limpieza-research.yaml', fecha: '2026-06-17'
   - ruta: 'tareas/diario/2026-06-18-impl-xapi-ingesta.yaml', fecha: '2026-06-18'
+  - ruta: 'tareas/diario/2026-06-19-xapi-secure-bridge.yaml', fecha: '2026-06-19'
diff --git a/research/docs/indices/notas.yaml b/research/docs/indices/notas.yaml
index bf5fe21..d318e1c 100644
--- a/research/docs/indices/notas.yaml
+++ b/research/docs/indices/notas.yaml
@@ -14,3 +14,4 @@ items:
   - id: 'AN-012', titulo: 'Mapeo de statements xAPI (exe_xapi.js) sobre la tubería de tracking existente', estado: None, fecha: '2026-06-04', ruta: 'analisis/notas/AN-012-mapeo-xapi-a-tuberia-existente.md'
   - id: 'AN-013', titulo: 'Reuso de tests Behat de plugins hermanos (mod_scorm, mod_h5pactivity, mod_exescorm, mod_exeweb) en mod_exelearning', estado: None, fecha: '2026-06-13', ruta: 'analisis/notas/AN-013-reuso-behat-plugins-hermanos.md'
   - id: 'AN-014', titulo: 'Qué aporta el ecosistema ADL/xAPI (cmi5launch, Moodle-PHP-Libs, xAPI-Spec, xAPI.js) a la integración xAPI de mod_exelearning', estado: None, fecha: '2026-06-17', ruta: 'analisis/notas/AN-014-ecosistema-adl-xapi-mejoras-spec.md'
+  - id: 'AN-015', titulo: 'Comparativa: soluciones de embeds de vídeo (YouTube/Vimeo) en contenido no confiable — mod_exelearning vs procomún vs eXeLearning vs el paper', estado: None, fecha: '2026-06-19', ruta: 'analisis/notas/AN-015-comparativa-soluciones-video-embeds.md'
diff --git a/research/docs/indices/repos.yaml b/research/docs/indices/repos.yaml
index b61e20c..9d957fa 100644
--- a/research/docs/indices/repos.yaml
+++ b/research/docs/indices/repos.yaml
@@ -9,3 +9,5 @@ items:
   - id: 'REPO-007', titulo: 'tool_migratehvp2h5p — migración oficial mod_hvp → mod_h5pactivity (Moodle HQ)', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-007-tool-migratehvp2h5p.md'
   - id: 'REPO-008', titulo: 'Moodle-mod_cmi5launch (ADL) — módulo de referencia de ingesta xAPI/cmi5 → gradebook', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-008-moodle-mod-cmi5launch.md'
   - id: 'REPO-009', titulo: 'Moodle-PHP-Libs (ADL) — vendor-bundle de Composer, DESCARTADO como dependencia', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-009-moodle-php-libs.md'
+  - id: 'REPO-010', titulo: 'Procomún — plataforma de recursos educativos que abre .elpx de forma segura', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-010-procomun.md'
+  - id: 'REPO-011', titulo: 'Paper de seguridad — contenido no confiable en LMS (SoK origen opaco + promote-to-parent)', estado: None, fecha: None, ruta: 'fuentes/repositorios/REPO-011-paper-seguridad-lms.md'
diff --git a/research/fixtures/elpx/external-embeds-demo.elpx b/research/fixtures/elpx/external-embeds-demo.elpx
new file mode 100644
index 0000000..042c2fb
Binary files /dev/null and b/research/fixtures/elpx/external-embeds-demo.elpx differ
diff --git a/research/fixtures/elpx/remote-embeds.elpx b/research/fixtures/elpx/remote-embeds.elpx
new file mode 100644
index 0000000..918af30
Binary files /dev/null and b/research/fixtures/elpx/remote-embeds.elpx differ
diff --git a/research/fixtures/elpx/vimeo-embed.elpx b/research/fixtures/elpx/vimeo-embed.elpx
new file mode 100644
index 0000000..1f19931
Binary files /dev/null and b/research/fixtures/elpx/vimeo-embed.elpx differ
diff --git a/research/fixtures/elpx/youtube-embed.elpx b/research/fixtures/elpx/youtube-embed.elpx
new file mode 100644
index 0000000..273cf30
Binary files /dev/null and b/research/fixtures/elpx/youtube-embed.elpx differ
diff --git a/research/fuentes/repositorios/REPO-010-procomun.md b/research/fuentes/repositorios/REPO-010-procomun.md
new file mode 100644
index 0000000..c426b55
--- /dev/null
+++ b/research/fuentes/repositorios/REPO-010-procomun.md
@@ -0,0 +1,43 @@
+---
+id: REPO-010
+titulo: "Procomún — plataforma de recursos educativos que abre .elpx de forma segura"
+tipo: lms-consumer
+ruta_local: /Users/ernesto/Downloads/git/procomun
+rama_consultada: fix/apertura-segura-elpx
+commit_consultado: "18b8d1a4 (clon local 2026-06-19)"
+fecha_consulta: 2026-06-19
+licencia: "[PENDIENTE: confirmar]"
+rol_para_mod_exelearning: "Consumidor/player hermano: renderiza paquetes .elpx no confiables con origen opaco y promociona los embeds de vídeo/PDF al padre (mismo modelo de seguridad que DEC-0061, variante click→modal). Punto de comparación de la solución de embeds."
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Hechos
+
+- **Rol:** plataforma (Astro/React + API) que cataloga y previsualiza recursos `.elpx`. Como
+  `mod_exelearning`, es un **consumidor** de paquetes no confiables (no el productor).
+- **Apertura segura del `.elpx` (ADR-0026/0027):** sirve el contenido del autor en un iframe cuyo
+  `sandbox` **omite `allow-same-origin`** (origen opaco, `origin="null"`); además repite el sandbox
+  como **directiva CSP `sandbox`** en la respuesta HTTP (`elpx-content.ts:224-225`), así que la
+  opacidad aguanta aunque se abra en pestaña nueva. CSP también fija `frame-src 'self' https:`,
+  `frame-ancestors 'self'`, `connect-src 'self'`.
+- **Embeds promote-to-parent (variante click→modal):** la opacidad se propaga a los iframes anidados
+  → YouTube/Vimeo/PDF salen en blanco. Solución = un **shim** en el contenido
+  (`apps/api/static/elpx/embed-shim.js`) que detecta origen opaco, sustituye cada embed por una
+  fachada y postMessea `{url, geometría}` al padre; un **relay** en el padre
+  (`use-elpx-embed-relay.ts`) autentica por **identidad de ventana** (`event.source === contentWindow`,
+  no por `event.origin` que es `"null"`), valida la URL (`classifyEmbed`, `elpx-embed-policy.ts`:
+  https + sin userinfo + cross-origin) y abre un **modal/lightbox** (`EmbedModal.tsx`) con el player
+  real en el origen del proveedor (SOP lo aísla del host).
+- **YouTube:** canonicaliza a `youtube-nocookie` (`elpx-embed-policy.ts:64-78`). **Vimeo: SIN rama
+  de canonicalización** (sólo funciona por promoción genérica open-mode, sin reescritura de privacidad).
+- **Trampas/limitaciones:** el modo open no tiene allowlist (cualquier https cross-origin se promociona);
+  el player del modal mantiene `allow-same-origin` (seguro **sólo** porque la URL está garantizada
+  cross-origin); PDF sin sandbox (visor nativo); fachada en thumbnails que no monta modal (UI muerta);
+  requiere `Access-Control-Allow-Origin: *` + `crossorigin=anonymous` en los `<script>` del paquete;
+  interactive-video roto (misma limitación que DEC-0061).
+- **Documentación propia:** `docs/negocio/decisiones/0026-apertura-segura-elpx.md`,
+  `0027-reproduccion-segura-embeds-elpx.md`. Commits `cda2d108`, `34aadfab`, `18b8d1a4`.
+
+Comparado en detalle en **AN-015**.
diff --git a/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md b/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md
new file mode 100644
index 0000000..1f6a379
--- /dev/null
+++ b/research/fuentes/repositorios/REPO-011-paper-seguridad-lms.md
@@ -0,0 +1,42 @@
+---
+id: REPO-011
+titulo: "Paper de seguridad — contenido no confiable en LMS (SoK / principio de origen opaco + promote-to-parent)"
+tipo: paper
+ruta_local: /Users/ernesto/Downloads/git/lms-untrusted-content-security-paper
+rama_consultada: main
+commit_consultado: "bb8fbc1 (clon local 2026-06-19)"
+fecha_consulta: 2026-06-19
+licencia: "CC-BY + MIT (dual)"
+rol_para_mod_exelearning: "Marco teórico (SoK) del problema que DEC-0059/0061 implementan: ejecutar JS de autor no confiable en el MISMO origen que la sesión LMS es el peligro; la mitigación es origen opaco + CSP sandbox + bridge postMessage validado. Nombra el modelo promote-to-parent para vídeo."
+herramienta_ia:
+  interfaz: claude-code
+  modelo: claude-opus-4-8
+---
+
+## Hechos
+
+- **Tesis central:** el peligro no es «JavaScript» sino ejecutar JS de **autor no confiable** en el
+  **mismo origen** que la sesión autenticada del LMS. Mitigación: renderizar el recurso entero
+  (`.elpx`/SCORM/`mod_page`) en un **iframe de origen opaco** (`sandbox allow-scripts` SIN
+  `allow-same-origin` → `origin=null`) + directiva **CSP `sandbox`** en la respuesta + **bridge
+  `postMessage` validado** para el estado.
+- **Dilema central (§6.2, `:249`):** el origen opaco **rompe los embeds de terceros** (YouTube/Vimeo)
+  porque los flags `sandbox` **se propagan** a los iframes anidados (el player hereda el origen opaco
+  y pierde el suyo → blanco).
+- **Solución de vídeo (§6.2/§6.3, `:295,297,299,303`):** **promote-to-parent** — el relay del padre
+  (fuera del sandbox) valida el mensaje por **identidad de ventana** (`event.source === iframe.contentWindow`,
+  NO `event.origin` que es `"null"`; contrasta con el origen-trust roto de H5P), revalida la URL
+  (https + cross-origin), y monta el player real en el padre, donde el SOP lo aísla — «**el modelo de
+  confianza que Moodle ya usa para incrustar YouTube**» (`:299`). Invariante **sin allowlist**
+  (`https + cross-origin al LMS`, `:303`) que cubre YouTube/Vimeo/Dailymotion; alternativas
+  conservadoras = modo estricto (allowlist) y oEmbed server-side.
+- **Defensa en profundidad:** CSP de respuesta con `connect-src 'self'` (cierra el exfil principal),
+  `object-src 'none'`, `frame-ancestors 'self'`, `base-uri 'none'`; residuo acotado = pixel GET que
+  exfiltra el token de fichero de **sólo lectura** (no el `sesskey`, confinado al padre) vía
+  `img/media/frame-src https:`; un perfil CSP estricto opcional lo cierra.
+- Variante **fachada+modal** citada como más simple (sin sincronía de geometría), mismo modelo de
+  seguridad (`:297`).
+- Fuentes: `seguridad-html-js-recursos-educativos.md` (ES) + `security-html-js-educational-resources.en.md`
+  (EN) + `anexos-tecnicos.md`. Verificación adversarial del bridge 7/7 (`:280`).
+
+Es el marco del que parten DEC-0059/DEC-0060/DEC-0061. Comparado en **AN-015**.
diff --git a/research/status.yaml b/research/status.yaml
index 2d3099a..938a23c 100644
--- a/research/status.yaml
+++ b/research/status.yaml
@@ -398,6 +398,52 @@ decisiones_bloqueantes:
       las vías (el editor pasa de irrecuperable a recuperable). Resuelve RIE-019. Promueve maturity
       BETA->STABLE (consecuencia, no decisión aparte; version sentinel intacto, DEC-0030). 263 tests
       verdes (make test). Tests nuevos: 6 en package_manager_extract_test, 2 en lib_test.
+  DEC-0059:
+    titulo: "Bridge SCORM por postMessage + iframe de origen opaco (modo seguro configurable): RIE-001 Tier 2"
+    estado: Aceptada
+    ruta: decisiones/adr/DEC-0059-bridge-scorm-postmessage-origen-opaco.md
+    fecha: 2026-06-13
+    relacionados: [DEC-0019, RIE-001, AN-008, DEC-0017, DEC-0042]
+    notas: >-
+      Implementa el Tier 2 que DEC-0019 dejó para "su propio ADR" (no lo supersede). Ajuste
+      global mod_exelearning/iframemode (secure por defecto | legacy de respaldo,
+      \mod_exelearning\local\ui\player_iframe, fail-safe a secure). Modo secure: iframe sandbox
+      sin allow-same-origin (origen opaco) ni allow-popups-to-escape-sandbox; el shim window.API
+      vive DENTRO del iframe (js/scorm_bridge_shim.js, copiado a libs/exe_scorm_bridge.js e
+      inyectado por scorm_injector al inicio de <head>), reutiliza js/scorm_tracker.js vía nueva
+      opción transport, resuelve objectid en su propio DOM y postMessea los deltas al relevo del
+      padre (js/scorm_bridge_relay.js), que valida por identidad de ventana + nonce + acción
+      cerrada y hace el POST a track.php (sesskey sólo en el padre; flush por sendBeacon en
+      pagehide). Polyfill de localStorage/sessionStorage en el shim (origen opaco lanza
+      SecurityError; lo usan exe_atools/exe_export/checklist/edicuatex). Linchpin: pipwerks find()
+      mira window.API local primero (SCORM_API_wrapper.js:71-106). Legacy = comportamiento actual
+      byte-a-byte. phpcs 0/0; Vitest 40/40 (24 nuevos); PHPUnit player_iframe_test + Behat en CI.
+      RIE-001 -> mitigado. OJO: su Ruta A (servir el iframe opaco por pluginfile normal) fue
+      REFUTADA en verificación y corregida por DEC-0060.
+  DEC-0060:
+    titulo: "Modo iframe seguro funcional: servir el contenido opaco por tokenpluginfile + CSP + watchdog (corrige Ruta A de DEC-0059)"
+    estado: Aceptada
+    ruta: decisiones/adr/DEC-0060-iframe-seguro-tokenpluginfile.md
+    fecha: 2026-06-13
+    relacionados: [DEC-0059, DEC-0019, RIE-001, AN-008, DEC-0017]
+    notas: >-
+      Verificado en navegador (Chrome DevTools, Moodle real :80): la Ruta A de DEC-0059 (iframe
+      opaco servido por pluginfile normal) NO carga los subrecursos: un documento de origen opaco
+      no envía la cookie SameSite=Lax (session/manager.php:513-518) y pluginfile exige login -> CSS/
+      JS/shim 404. Corrección: servir el iframe por tokenpluginfile (make_pluginfile_url includetoken;
+      token core_files de TTL corto en la RUTA, lo arrastran los subrecursos relativos -> cargan sin
+      cookie). tokenpluginfile valida el token y SIGUE aplicando require_capability (solo lectura de
+      ficheros, no sesskey -> más seguro que legacy). Precedente: H5P usa includetoken embebido
+      (h5p/classes/player.php:429). + CSP/Permissions-Policy desde exelearning_pluginfile (object-src
+      none, base-uri none, frame-ancestors self, connect-src acotado anti-exfiltración del token;
+      mantiene unsafe-inline/eval que exe necesita). + NO degradar en silencio a legacy: watchdog del
+      relay muestra aviso securemodeblocked si el iframe no emite ready (slasharguments off, o host con
+      service worker como el Playground PHP-WASM que no sirve iframes opacos). + self-heal del bridge en
+      view.php para paquetes ya extraídos. Investigado y descartado: origen separado/subdominio (B, no
+      hay mecanismo en core, requiere infra) y sandbox JS en cliente (M8, inviable: el contenido
+      necesita DOM real+jQuery). Evidencia: track.php responde {ok:true,rawscore:100,peritem:{1:100}}.
+      phpcs 0/0; Vitest 42/42; PHPUnit player_iframe_test (modo+sandbox+CSP). Residuo: token visible
+      en URL (acotado CSP+TTL); legacy opt-in reabre same-origin. Futuro: toggle CSP estricto, Ruta B.
 tareas:
   TAREA-001:
     fecha: 2026-05-28
@@ -596,17 +642,62 @@ tareas:
       create_file_from_url + gating por contenthash + curl_security_helper + ajuste admin
       allowexternalurl opt-in) + botón 'Actualizar ahora' + tests/backup/upgrade. Fase 2
       (opcional): updatefreq + db/tasks.php + token para el REST de eXeLearning v4.
+  TAREA-017:
+    fecha: 2026-06-13
+    titulo: "RIE-001 Tier 2: implementar el bridge SCORM por postMessage + iframe de origen opaco (modo seguro)"
+    estado: Done
+    agente: claude-code
+    relacionados:
+      - RIE-001
+      - DEC-0059
+      - DEC-0019
+      - DEC-0017
+    notas: >-
+      Implementado el modo seguro configurable (iframemode secure|legacy, default secure).
+      Ficheros: classes/local/ui/player_iframe.php (modo + tokens sandbox), settings.php
+      (admin_setting_configselect), lang/en/exelearning.php (4 strings), view.php (rama
+      secure/legacy + sandbox por modo + teacher-mode por bridge), js/scorm_tracker.js (opción
+      transport), js/scorm_bridge_shim.js + js/scorm_bridge_relay.js (nuevos),
+      classes/local/scorm/scorm_injector.php (inyección del bridge), classes/local/package_manager.php
+      (copia de scorm_tracker.js + exe_scorm_bridge.js a libs/). Tests: tests/player_iframe_test.php,
+      tests/js/scorm_bridge.test.js. Verificado phpcs 0/0 + Vitest 40/40 + php -l; PHPUnit/Behat en
+      CI/contenedor. Follow-up opcional: M2/M3 (Permissions-Policy/CSP).
+  TAREA-018:
+    fecha: 2026-06-13
+    titulo: "Corregir la Ruta A: servir el iframe seguro por tokenpluginfile + CSP + watchdog (DEC-0060)"
+    estado: Done
+    agente: claude-code
+    relacionados:
+      - RIE-001
+      - DEC-0060
+      - DEC-0059
+    notas: >-
+      Verificación en navegador (Chrome DevTools, Moodle real :80) refutó la Ruta A de DEC-0059
+      (subrecursos del iframe opaco 404 por cookie SameSite=Lax). Corregido: view.php sirve el iframe
+      por tokenpluginfile (get_user_key core_files TTL corto en la ruta) sin fallback silencioso a
+      legacy; exelearning_pluginfile emite CSP + Permissions-Policy (player_iframe::content_security_policy
+      / permissions_policy) en modo secure; js/scorm_bridge_relay.js añade watchdog que muestra el aviso
+      securemodeblocked si el iframe no emite ready; view.php self-heal del bridge para paquetes ya
+      extraídos; blueprint.json deja iframemode en secure (el Playground muestra el aviso, no legacy).
+      Tests: ampliado player_iframe_test (CSP/Permissions-Policy) y scorm_bridge.test.js (watchdog),
+      Vitest 42/42, phpcs 0/0. Evidencia track.php {ok:true,rawscore:100,peritem:{1:100}}.
 riesgos:
   RIE-001:
     titulo: "XSS cross-component desde paquete eXeLearning malicioso"
     severidad: media
     probabilidad: baja
-    estado: aceptado
-    aceptacion: >-
-      ACEPTADO 2026-06-17 (erseco): riesgo media/baja aceptado con la mitigación v1 (sandbox del iframe).
-      El hardening Tier 1/2 (DEC-0019) lo implementa la rama feature/secure-iframe-scorm-bridge
-      (DEC-0059..0062), NO como bloqueante. TAREA-013 (sandboxing JS) queda cubierta ahí; no se crea ficha aparte.
+    estado: mitigado
     mitigacion: >-
+      MITIGADO (2026-06-13, DEC-0059 + DEC-0060): el modo seguro por defecto (iframemode=secure)
+      sirve el paquete en un iframe de ORIGEN OPACO (sin allow-same-origin) por tokenpluginfile
+      (DEC-0060 corrige la Ruta A: el opaco no envía la cookie SameSite, así que los assets se
+      sirven por token en la URL, no por cookie) y releva el scoring SCORM por un canal postMessage
+      validado (identidad de ventana + nonce + acción cerrada), con el sesskey sólo en el padre; el
+      contenido ya no puede leer DOM/cookies/sesión ni forjar peticiones (solo recibe un token de
+      lectura de ficheros, acotado por CSP+TTL). Sin degradación silenciosa a legacy: watchdog que
+      avisa si secure no puede renderizar. Verificado en navegador (track.php guarda la nota).
+      legacy queda como respaldo opt-in (vuelve al riesgo same-origin). Contexto previo (DEC-0019,
+      sin implementar entonces):
       v1 VIGENTE: sandbox del iframe sin allow-top-navigation / allow-modals (AN-008).
       Investigación TAREA-012 completada en DEC-0019 (2026-06-02): core NO aísla (mod_scorm
       sin sandbox; core_h5p curado), mod_exelearning ya es el mejor aislado de los tres, y
@@ -621,7 +712,10 @@ riesgos:
       - DEC-0003
       - DEC-0004
       - DEC-0019
+      - DEC-0059
+      - DEC-0060
       - TAREA-012
+      - TAREA-017
   RIE-007:
     titulo: "suspend_data N (índice local de página) tratado como itemnumber → mis-ruteo y colisión de notas"
     severidad: alta
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml b/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml
new file mode 100644
index 0000000..90ce2a3
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-playground-watchdog.yaml
@@ -0,0 +1,26 @@
+fecha: 2026-06-13
+sesion: secure-iframe-playground-watchdog
+agente: claude-code
+resumen: >-
+  A petición de erseco ("parece que funciona en el Playground y no muestra el aviso"),
+  se reabrió la URL del Playground PHP-WASM con Chrome DevTools para confirmar
+  empíricamente el comportamiento del modo secure y entender por qué parecía no avisar.
+  Conclusión: secure SÍ avisa en el Playground; lo que ocurría es que el aviso aparecía
+  tras el retardo del watchdog (8 s) y quedaba bajo el pliegue, dando la sensación de
+  que "cargaba" durante esos segundos. Se confirma la limitación conocida (el SW no
+  sirve iframes opacos) y se mejora el watchdog para que el aviso salga justo tras el
+  fallo de carga.
+acciones:
+  - "Verificación empírica (Playground, recorrido recursivo del DOM por los iframes anidados site-frame>remote-frame): el iframe del paquete se construye en secure (src=tokenpluginfile.php/<token>/15/mod_exelearning/content/1/index.html, sandbox='allow-scripts allow-popups allow-forms', origen opaco -> SecurityError al leer contentWindow); el relay está presente (exeScormBridge=object); el aviso securemodeblocked queda VISIBLE y el iframe oculto (display:none) -> el watchdog SÍ saltó."
+  - "Red (Chrome DevTools): la petición tokenpluginfile.php/.../content/1/index.html devuelve 404 en el Playground (el service worker no controla subframes opacos; la URL cae a GitHub Pages estático). El token NO ayuda aquí: el bloqueo es el SW, no la cookie. Coherente con la limitación documentada en DEC-0060."
+  - "Diagnóstico de la 'sensación de que funciona': el watchdog era un temporizador plano de 8 s y el aviso quedaba a top~734 (bajo el pliegue). Durante esos 8 s el iframe estaba en blanco sin aviso -> parecía cargar."
+  - "Mejora (js/scorm_bridge_relay.js): el watchdog ahora usa dos señales. Engancha el evento 'load' del elemento iframe (que dispara también con la página de error 404) y concede solo una gracia corta (gracems, 2,5 s) para el handshake; si 'load' nunca llega cae al tope plano (watchdogms, 8 s). El listener se adjunta al iframe si ya existe o en DOMContentLoaded (el relay se inyecta inline antes del elemento iframe)."
+  - "Tests (tests/js/scorm_bridge.test.js): dos casos nuevos para la ruta rápida -- el aviso sale por el temporizador de gracia tras 'load' (no por el plano), y no se arma la gracia si el iframe ya está ready. Vitest 52/52. Los tests previos del watchdog usan un iframe sin addEventListener, así que siguen ejercitando la ruta plana."
+verificacion_navegador:
+  - "Playground (https://ateeducacion.github.io/moodle-playground/?blueprint-url=...&branch=feature/secure-iframe-scorm-bridge): /mod/exelearning/view.php?id=1 -> iframe secure opaco, tokenpluginfile 404, aviso securemodeblocked visible ('This content cannot be displayed with the current security configuration. Please contact the administrator'), iframe display:none."
+pendientes:
+  - "Re-verificar en el Playground tras pushear (el proxy/CDN puede cachear el blueprint y el zip de la rama unos minutos) para ver el aviso aparecer ya tras el 'load' del 404 (~2,5 s) en vez de a los 8 s."
+relacionados:
+  - DEC-0060
+  - DEC-0059
+  - RIE-001
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml b/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml
new file mode 100644
index 0000000..95a3721
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-scorm-bridge.yaml
@@ -0,0 +1,45 @@
+fecha: 2026-06-13
+sesion: secure-iframe-scorm-bridge
+agente: claude-code
+resumen: >-
+  Implementación de RIE-001 Tier 2 (DEC-0059): bridge SCORM por postMessage + iframe de
+  origen opaco, como modo seguro configurable y por defecto, con legacy de respaldo.
+  DEC-0019 había dejado este Tier 2 para "su propio ADR" sin implementarlo; el usuario
+  priorizó hacerlo tras confirmar que es la única alternativa que cumple los objetivos de
+  aislamiento (el contenido del .elpx NO puede leer ni modificar DOM/cookies/sesión/JS del
+  marco padre). Linchpin verificado: el pipwerks empaquetado (SCORM_API_wrapper.js:71-106)
+  mira window.API de la propia ventana antes de subir a parent, así que inyectar el shim
+  window.API DENTRO del iframe lo descubre sin tocar el padre; y LMSGetValue ya responde de
+  caché local, así que un relevo asíncrono por postMessage basta. Riesgo de compatibilidad
+  cazado: el motor exportado usa localStorage (exe_atools en todo export, exe_export,
+  checklist, edicuatex) y en origen opaco lanza SecurityError -> el shim instala un polyfill
+  en memoria. Decisiones de diseño confirmadas con el usuario (AskUserQuestion): bridge
+  seguro completo, ajuste global default seguro (sin campo por actividad -> sin tocar BD),
+  nombre iframemode (select secure|legacy).
+acciones:
+  - "player_iframe (classes/local/ui/player_iframe.php): nuevo helper que resuelve el modo (fail-safe a secure ante valor inválido) y centraliza los tokens del sandbox por modo, testeable sin renderizar view.php."
+  - "settings.php: admin_setting_configselect mod_exelearning/iframemode (secure|legacy, default secure). lang/en/exelearning.php: iframemode + _desc + _legacy + _secure (orden alfabético estricto, sin código)."
+  - "view.php: rama por modo. secure = relevo inline (js/scorm_bridge_relay.js) con {iframeid,cmid,trackurl,session,nonce,teachermodevisible}, sin window.API en el padre; sandbox via player_iframe::sandbox_tokens(); teacher-mode por bridge (no por contentDocument). legacy = comportamiento actual byte-a-byte."
+  - "js/scorm_tracker.js: nueva opción transport(data,sync) que sustituye al XHR cuando está presente (legacy y los tests siguen con XHR; sin regresión). js/scorm_bridge_shim.js (iframe): detección de origen opaco, polyfill de localStorage/sessionStorage, window.API local vía exeScormTracker, objectid de su propio DOM, handshake + cola pre-nonce, ocultado teacher-mode local. js/scorm_bridge_relay.js (padre): validación por identidad de ventana + acción cerrada + nonce + forma, POST a track.php (sesskey sólo en el padre), sendBeacon en pagehide."
+  - "scorm_injector.php: inyecta el bridge (scorm_tracker.js + exe_scorm_bridge.js) al INICIO de <head> (polyfill+API antes de cualquier script del paquete), idempotente y separado del wrapper pipwerks. package_manager.php: copia scorm_tracker.js + exe_scorm_bridge.js a libs/ del paquete (plugin-owned: refresh en cada extract; los assets pipwerks siguen sin sobrescribir un bundle propio del export)."
+  - "Tests: tests/player_iframe_test.php (@covers player_iframe: default secure, fail-safe, legacy, tokens por modo) y tests/js/scorm_bridge.test.js (24 casos: polyfill, origen opaco, handshake, identidad de fuente/ventana, nonce, forma, cuerpo a track.php, sendBeacon)."
+  - "status.yaml (append): DEC-0059 + TAREA-017; RIE-001 estado identificado -> mitigado (+DEC-0059/TAREA-017 en relacionados). ADR research/decisiones/adr/DEC-0059-... (advances DEC-0019, no lo supersede)."
+evidencia:
+  - "assets/scorm/SCORM_API_wrapper.js:71-106 (pipwerks find() mira window.API local primero)"
+  - "js/scorm_tracker.js (LMSGetValue de caché local; nueva opción transport en send())"
+  - "rg localStorage/sessionStorage en /Users/ernesto/Downloads/git/exelearning (exe_atools, exe_export.js, checklist.js, edicuatex)"
+  - "public/h5p/js/embed.js:38-46 (core_h5p valida source+context, no origin); mod/scorm/player.php + loadSCO.php (sin sandbox, parent-walk)"
+  - "phpcs --standard=moodle 0/0 sobre los 7 ficheros PHP tocados; php -l limpio"
+  - "Vitest 40/40 (npx vitest run): 16 tracker + 24 bridge"
+pendientes:
+  - "CI/contenedor manda: ejecutar PHPUnit (player_iframe_test + suite completa, sin regresión en scorm_injector/package_manager) y Behat de grading en modo secure (adaptar el escenario @javascript que usa window.API, que ahora vive en el iframe, o apoyarse en el paso server-side 'the following eXeLearning SCORM scores exist')."
+  - "Verificar en Chrome y Firefox reales que el polyfill sustituye el getter nativo de localStorage en origen opaco y que la nota llega al gradebook sin SecurityError; togglear a legacy y confirmar paridad con el comportamiento actual."
+  - "Follow-up opcional (DEC-0019): M2 Permissions-Policy + M3 CSP de red estricta-con-toggle en exelearning_pluginfile(); M8 sandboxing de JS en cliente (TAREA-013)."
+relacionados:
+  - DEC-0059
+  - DEC-0019
+  - DEC-0017
+  - DEC-0042
+  - RIE-001
+  - AN-008
+  - TAREA-017
diff --git a/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml b/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml
new file mode 100644
index 0000000..5689666
--- /dev/null
+++ b/research/tareas/diario/2026-06-13-secure-iframe-tokenpluginfile.yaml
@@ -0,0 +1,34 @@
+fecha: 2026-06-13
+sesion: secure-iframe-tokenpluginfile-fix
+agente: claude-code
+resumen: >-
+  Corrección de la Ruta A de DEC-0059 tras verificar en navegador (Chrome DevTools,
+  Moodle real en :80) que el modo secure NO cargaba los subrecursos del paquete. Causa
+  raíz: un iframe de origen opaco (sandbox sin allow-same-origin) no envía la cookie de
+  sesión SameSite=Lax a sus subrecursos, y pluginfile.php exige login -> CSS/JS/shim 404
+  (el index.html sí carga porque la navegación la inicia el padre). Investigadas y
+  documentadas las vías (token, subdominio/B, sandbox JS/M8); elegida e implementada la
+  Opción A endurecida (DEC-0060). Verificado end-to-end que track.php guarda la nota.
+acciones:
+  - "Token serving (view.php): en modo secure el iframe se sirve por tokenpluginfile (get_user_key core_files de TTL corto redondeado a la hora, token en la RUTA -> los subrecursos relativos lo arrastran y cargan sin cookie). tokenpluginfile valida el token y exelearning_pluginfile SIGUE aplicando require_capability(mod/exelearning:view) -> solo lectura de ficheros, no sesskey. Precedente: H5P usa includetoken embebido (h5p/classes/player.php:429)."
+  - "CSP + Permissions-Policy (lib.php exelearning_pluginfile + player_iframe::content_security_policy/permissions_policy): solo modo secure, solo el documento HTML (send_stored_file no las borra). object-src none, base-uri none, frame-ancestors self, connect-src acotado a este sitio (corta exfiltración del token por fetch); mantiene unsafe-inline/eval que eXeLearning necesita."
+  - "Sin degradación silenciosa a legacy (petición de erseco): quitado el fallback slasharguments->legacy. Watchdog en el relay (js/scorm_bridge_relay.js): si el iframe no emite ready (slasharguments off, o host con service worker que no sirve iframes opacos como el Playground PHP-WASM) muestra el aviso securemodeblocked y oculta el iframe. view.php renderiza el aviso oculto (lang securemodeblocked) que el watchdog revela."
+  - "Self-heal del bridge (view.php): los paquetes extraídos antes de DEC-0060 no tienen libs/exe_scorm_bridge.js; se re-extrae una vez (idempotente) para que secure funcione sin re-subir."
+  - "blueprint.json: iframemode se deja en secure (NO se fuerza legacy); el Playground muestra el aviso securemodeblocked en vez de caer a legacy (coherente con 'no caer en legacy por defecto')."
+  - "Tests: player_iframe_test (CSP/Permissions-Policy), scorm_bridge.test.js (watchdog). Vitest 42/42. phpcs --standard=moodle 0/0."
+verificacion_navegador:
+  - "iframe opaco servido por http://localhost/tokenpluginfile.php/<token>/16/mod_exelearning/content/1/index.html; sandbox='allow-scripts allow-popups allow-forms'; lectura de contentWindow desde el padre da SecurityError (origen opaco confirmado)."
+  - "El shim emite {type:scorm,action:ready} al padre (capturado con listener inyectado) -> shim activo en el iframe."
+  - "relay presente (window.exeScormBridge=object); init/acceptTrack/onMessage OK; el relay responde 'config' al 'ready' sin lanzar."
+  - "POST directo a track.php (camino del relay, con sesskey real) -> {ok:true,attempt:1,rawscore:100,status:completed,peritem:{1:100}} -> la nota se guarda."
+  - "Tras purgar cachés (lang string nueva), el contenido renderiza con estilos y el watchdog NO salta (secure funciona)."
+pendientes:
+  - "CI manda: PHPUnit matriz + Behat (idealmente un escenario de grading en secure entrando al frame). El click sintético no entra en el iframe opaco, así que el e2e de scoring por UI se confirma a mano o en Behat."
+  - "Futuro: toggle de admin para CSP estricto (cerrar exfiltración del token por img/script externos) y Ruta B (subdominio eTLD+1 + reverse-proxy) para aislamiento máximo."
+relacionados:
+  - DEC-0060
+  - DEC-0059
+  - DEC-0019
+  - RIE-001
+  - TAREA-018
+  - AN-008
diff --git a/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml b/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml
new file mode 100644
index 0000000..0c7d73b
--- /dev/null
+++ b/research/tareas/diario/2026-06-19-xapi-secure-bridge.yaml
@@ -0,0 +1,45 @@
+fecha: 2026-06-19
+sesion: xapi-bridge-seguro-identidad-ventana
+agente: claude-code
+resumen: >-
+  Tras fusionar main (DEC-0064, ingesta xAPI) en la rama del modo iframe seguro
+  (DEC-0059/0060), la configuración por defecto pasa a ser secure + xAPI-primary, y ahí el
+  listener xAPI no recibía nada: en el iframe de origen opaco event.origin es la cadena "null"
+  y el listener confiaba sólo por event.origin === host. El merge inicial gateó xAPI a legacy
+  como medida conservadora. Esta sesión implementa la solución definitiva (DEC-0065): el
+  listener confía un statement por IDENTIDAD DE VENTANA (event.source === contentWindow del
+  iframe del paquete) en modo seguro —el mismo ancla que ya usa el relay del bridge SCORM,
+  imposible de falsificar y no anonimizado por el origen opaco— y conserva la validación por
+  origen en legacy. Para que no haya doble conteo, el POST SCORM se suprime en el PADRE (relay,
+  flag disableTracking), no en el shim horneado, así que es robusto aunque el paquete sea
+  previo al flag. Confirmado el contrato del emisor (research): postMessage síncrono a
+  root.parent, sin Worker/MessageChannel/frame hijo, así que event.source es la ventana real
+  del iframe.
+acciones:
+  - "DEC-0065 (Aceptada): xAPI sobre el bridge seguro por identidad de ventana; extiende DEC-0064 al modo seguro de DEC-0059 (no lo supersede). Registra las tres opciones (gatear a legacy = status quo del merge; aceptar origin 'null' = inseguro; identidad de ventana = elegida), la evidencia del contrato del emisor y del comportamiento del origen opaco, y la propiedad de que la identidad de ventana iguala a legacy en confianza (el contenido se autocalifica y el servidor acota) sin perder el aislamiento de sesión del modo seguro."
+  - "js/xapi_listener.js: añadido el modo identidad de ventana (config.iframeid o config.expectedSource para tests; resolución perezosa de document.getElementById(iframeid).contentWindow por mensaje, porque el listener se inyecta antes de existir el elemento; función isTrusted que ignora event.origin en secure). Conserva isTrustedOrigin para legacy. Superficie de export sin cambios."
+  - "js/scorm_bridge_relay.js: nuevo parámetro disableTracking; en onMessage se valida el track (identidad de ventana + nonce + forma) pero se omite postTrack cuando está activo. latest queda null, así que flushBeacon es no-op. Handshake (ready->config con nonce/teachermode) y watchdog intactos: el iframe sigue renderizando y window.API existe para que los iDevices emitan xAPI."
+  - "view.php: $emitsxapi pierde el gateo !$securemode (xAPI-primary en ambos modos); el relay seguro recibe disableTracking => $emitsxapi; el bloque del listener xAPI se reescribe usando $emitinlinemodule con iframeid (secure) o allowedOrigin (legacy). Comentarios actualizados (incl. corregido el comentario legacy que decía que disableTracking 'sólo es true en legacy')."
+  - "Tests (Vitest): xapi_listener.test.js con un describe nuevo de identidad de ventana (reenvía con origen 'null' si source === iframe; rechaza cualquier otra ventana aunque alegue el host; rechaza sin source; resolución perezosa cuando el elemento aparece después). scorm_bridge.test.js con un test de disableTracking (un track válido no hace fetch, ready sigue handshakeando, el beacon no envía nada). Total 114/114 (antes 109)."
+  - "Docs (inglés): docs/tracking-architecture.md (bloque 'Secure iframe (DEC-0065)') y docs/xapi-integration-plan.md (puerta de confianza dependiente del modo + nota de SCORM inerte por el relay). Índices research actualizados (adrs.yaml, diario.yaml)."
+evidencia:
+  - "research/decisiones/adr/DEC-0065-xapi-bridge-seguro-identidad-ventana.md"
+  - "js/xapi_listener.js (isTrusted/expectedSource, modo identidad de ventana)"
+  - "js/scorm_bridge_relay.js (disableTracking suprime postTrack tras validar)"
+  - "js/scorm_bridge_relay.js:27-28 ('an opaque origin has no useful event.origin' — precedente del ancla)"
+  - "view.php (emitsxapi sin gateo; relay disableTracking; listener iframeid/allowedOrigin)"
+  - "tests/js/xapi_listener.test.js + tests/js/scorm_bridge.test.js (114/114)"
+  - "exelearning/exelearning:public/app/common/xapi/exe_xapi.js@e3b1bd13 (postMessage síncrono a root.parent)"
+pendientes:
+  - "Verificación e2e en vivo (Behat/Playwright entrando al frame) en Moodle real: postMessage del emisor desde el iframe opaco -> columna del gradebook. El Playground PHP-WASM no sirve iframes opacos (DEC-0060), así que el modo seguro no se prueba allí."
+  - "Si un futuro emisor upstream adopta nonce/handshake, endurecer la identidad de ventana a nonce como el bridge SCORM."
+  - "Diferido (eco DEC-0064): handler core_xapi + eventos para analítica/LRS."
+relacionados:
+  - DEC-0065
+  - DEC-0064
+  - DEC-0059
+  - DEC-0060
+  - DEC-0062
+  - DEC-0063
+  - DEC-0007
+  - RIE-001
diff --git a/settings.php b/settings.php
index 05dafaa..0e09de4 100644
--- a/settings.php
+++ b/settings.php
@@ -54,6 +54,45 @@
 }
 
 if ($ADMIN->fulltree) {
+    // Package iframe security mode (DEC-0059): isolate the arbitrary author HTML/JS
+    // of an .elpx package in a sandboxed, opaque-origin iframe and relay SCORM
+    // scoring over a validated postMessage bridge. Defaults to the secure mode;
+    // 'legacy' restores the previous same-origin behaviour as a compatibility
+    // fallback. The default is also applied by player_iframe::resolve_mode() so an
+    // unset/invalid value never weakens isolation.
+    $settings->add(new admin_setting_configselect(
+        'mod_exelearning/iframemode',
+        get_string('iframemode', 'mod_exelearning'),
+        get_string('iframemode_desc', 'mod_exelearning'),
+        \mod_exelearning\local\ui\player_iframe::MODE_SECURE,
+        [
+            \mod_exelearning\local\ui\player_iframe::MODE_SECURE =>
+                get_string('iframemode_secure', 'mod_exelearning'),
+            \mod_exelearning\local\ui\player_iframe::MODE_LEGACY =>
+                get_string('iframemode_legacy', 'mod_exelearning'),
+        ]
+    ));
+
+    // External-embed policy (DEC-0061). In secure mode external videos/PDFs are
+    // promoted to the parent and rendered as a sandboxed, cross-origin player, which
+    // SOP isolates from Moodle regardless of the host. 'open' (default) promotes any
+    // cross-origin https iframe (supports any provider, no maintenance); 'strict'
+    // restricts to the maintained host allowlist for deployments where even the
+    // content author is not trusted not to embed phishing/tracking. The relay
+    // enforces the structural invariant (https + cross-origin) in both modes.
+    $settings->add(new admin_setting_configselect(
+        'mod_exelearning/embedmode',
+        get_string('embedmode', 'mod_exelearning'),
+        get_string('embedmode_desc', 'mod_exelearning'),
+        \mod_exelearning\local\ui\player_iframe::EMBED_OPEN,
+        [
+            \mod_exelearning\local\ui\player_iframe::EMBED_OPEN =>
+                get_string('embedmode_open', 'mod_exelearning'),
+            \mod_exelearning\local\ui\player_iframe::EMBED_STRICT =>
+                get_string('embedmode_strict', 'mod_exelearning'),
+        ]
+    ));
+
     // Embedded editor management (install / update / repair / uninstall).
     $settings->add(new admin_setting_heading(
         'mod_exelearning/embeddededitorheading',
diff --git a/tests/e2e/embed.spec.cjs b/tests/e2e/embed.spec.cjs
new file mode 100644
index 0000000..e085980
--- /dev/null
+++ b/tests/e2e/embed.spec.cjs
@@ -0,0 +1,45 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Cross-browser e2e for the secure-mode external-embed mechanism (DEC-0061), run in
+// Firefox via playwright-embed.config.cjs. It loads the REAL shim + relay against a
+// self-contained harness (no Moodle needed): an opaque-origin sandboxed iframe whose
+// content has cross-origin video iframes, a RELATIVE local PDF and an arbitrary
+// cross-origin iframe. In open mode (the default) the shim promotes every cross-origin /
+// PDF iframe to an inline parent overlay; the video players are sandboxed.
+
+const { test, expect } = require('@playwright/test');
+
+test('promotes every cross-origin/PDF iframe to a sandboxed inline player (open mode, Firefox)', async ({ page }) => {
+    await page.goto('/tests/e2e/embed/parent.html');
+
+    const players = page.locator('.exe-embed-overlay iframe');
+    await expect.poll(() => players.count(), { timeout: 15000 }).toBe(4);
+
+    const srcs = await players.evaluateAll((els) => els.map((e) => e.src));
+
+    // Open mode: cross-origin https iframes are promoted VERBATIM (no host list, no rebuild).
+    expect(srcs.some((s) => /^https:\/\/www\.youtube-nocookie\.com\/embed\/aqz-KE-bpKQ\b/.test(s))).toBe(true);
+    expect(srcs.some((s) => /^https:\/\/www\.dailymotion\.com\/embed\/video\/x8abc12$/.test(s))).toBe(true);
+    // An arbitrary cross-origin provider is promoted too (the structural invariant).
+    expect(srcs.some((s) => /^https:\/\/example\.com\//.test(s))).toBe(true);
+    // The relative local PDF is reported absolute and rendered (the relative-URL fix).
+    expect(srcs.some((s) => /\/local\.pdf$/.test(s))).toBe(true);
+
+    // The promoted video players are sandboxed (allow-same-origin to render, but no
+    // top-navigation so an arbitrary embed cannot redirect the tab).
+    const sandboxes = await players.evaluateAll((els) => els.map((e) => e.getAttribute('sandbox') || ''));
+    expect(sandboxes.some((s) => s.includes('allow-same-origin') && !s.includes('allow-top-navigation'))).toBe(true);
+});
diff --git a/tests/e2e/embed/content.html b/tests/e2e/embed/content.html
new file mode 100644
index 0000000..ad82b73
--- /dev/null
+++ b/tests/e2e/embed/content.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<!--
+  E2E harness — the "content" half (runs in the opaque sandbox). Mirrors what an .elpx
+  exports: cross-origin video iframes, a RELATIVE local PDF, and an arbitrary cross-origin
+  iframe (promoted in open mode — there is no host list). Loads the real in-iframe shim
+  (js/exe_embed_shim.js); the parent relay is the authoritative gate (DEC-0061).
+-->
+<html><head><meta charset="utf-8"></head><body>
+<iframe id="yt" src="https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ" width="480" height="270"></iframe>
+<iframe id="dm" src="https://www.dailymotion.com/embed/video/x8abc12" width="480" height="270"></iframe>
+<iframe id="pdf" src="local.pdf" width="400" height="300"></iframe>
+<iframe id="ext" src="https://example.com/" width="200" height="120"></iframe>
+<script src="/js/exe_embed_shim.js"></script>
+</body></html>
diff --git a/tests/e2e/embed/local.pdf b/tests/e2e/embed/local.pdf
new file mode 100644
index 0000000..314e46d
Binary files /dev/null and b/tests/e2e/embed/local.pdf differ
diff --git a/tests/e2e/embed/parent.html b/tests/e2e/embed/parent.html
new file mode 100644
index 0000000..f2b2884
--- /dev/null
+++ b/tests/e2e/embed/parent.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<!--
+  E2E harness — the "parent" half (the trusted host page).
+  Loads the real parent relay (js/exe_embed_relay.js) and embeds the content in an
+  opaque-origin sandboxed iframe (sandbox="allow-scripts", no allow-same-origin),
+  exactly like the player iframe in secure mode.
+-->
+<html><head><meta charset="utf-8">
+<script>
+window.ExeEmbedRelayConfig = { whitelist: [
+    'www.youtube.com', 'youtube.com', 'www.youtube-nocookie.com',
+    'youtube-nocookie.com', 'player.vimeo.com', 'vimeo.com',
+    'www.dailymotion.com', 'dailymotion.com', 'geo.dailymotion.com',
+    'mediateca.educa.madrid.org'
+] };
+</script>
+<style>#wrap{position:relative;width:520px;height:760px}#content{width:100%;height:100%;border:0}</style>
+</head><body>
+<div id="wrap">
+    <iframe id="content" sandbox="allow-scripts" src="content.html"></iframe>
+</div>
+<script src="/js/exe_embed_relay.js"></script>
+<!-- mod's relay is dual-export and does not auto-run; view.php bootstraps it the same way. -->
+<script>window.exeEmbedRelay.init(window.ExeEmbedRelayConfig);</script>
+</body></html>
diff --git a/tests/js/embed_scorm_coexistence.test.js b/tests/js/embed_scorm_coexistence.test.js
new file mode 100644
index 0000000..e7cc0e1
--- /dev/null
+++ b/tests/js/embed_scorm_coexistence.test.js
@@ -0,0 +1,69 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Regression guard (DEC-0061 + DEC-0059): in secure mode the package now loads BOTH
+// the SCORM bridge (scoring) AND the external-embed shim/relay. They must coexist —
+// the embed feature must not break SCORM score saving. Side-effect imports in the
+// same load order as production (tracker → scorm shim → scorm relay → embed shim →
+// embed relay). globals (describe/it/expect) come from vitest.config.mjs.
+import '../../js/scorm_tracker.js';
+import '../../js/scorm_bridge_shim.js';
+import '../../js/scorm_bridge_relay.js';
+import '../../js/exe_embed_shim.js';
+import '../../js/exe_embed_relay.js';
+
+const scormRelay = window.exeScormBridge;
+const embedRelay = window.exeEmbedRelay;
+
+describe('embed feature does not break the SCORM bridge', () => {
+    it('keeps every bridge + embed global defined and distinct (no clobbering)', () => {
+        expect(window.exeScormTracker).toBeTruthy();
+        expect(window.exeScormBridgeShim).toBeTruthy();
+        expect(window.exeScormBridge).toBeTruthy();
+        expect(window.exeEmbedShim).toBeTruthy();
+        expect(window.exeEmbedRelay).toBeTruthy();
+        expect(window.exeScormBridge).not.toBe(window.exeEmbedRelay);
+        expect(window.exeScormBridgeShim).not.toBe(window.exeEmbedShim);
+    });
+
+    it('still accepts a SCORM track message (scoring path) with the embed modules loaded', () => {
+        const track = {
+            type: 'scorm',
+            action: 'track',
+            cmi: { 'cmi.core.score.raw': '80' },
+            exelearningBridge: 'N1',
+        };
+        expect(scormRelay.isTrackMessage(track)).toBe(true);
+        expect(scormRelay.acceptTrack(track, 'N1')).toBe(true);
+        // Wrong nonce is still rejected (the embed code did not weaken validation).
+        expect(scormRelay.acceptTrack(track, 'OTHER')).toBe(false);
+    });
+
+    it('the two bridges ignore each other’s message types', () => {
+        // The SCORM relay never treats an embed message as a score.
+        expect(scormRelay.isTrackMessage({ type: 'exe-embed', action: 'sync', embeds: [] })).toBe(false);
+        // The embed relay still validates a real embed URL (its own channel works).
+        // Open mode (default): any cross-origin https iframe is accepted verbatim.
+        const ok = embedRelay.validate('https://www.youtube.com/embed/abc123', 'http://x/content/1/index.html');
+        expect(ok).toEqual({ url: 'https://www.youtube.com/embed/abc123', kind: 'video' });
+    });
+
+    it('the embed relay does not act on a SCORM track message (no overlay created)', () => {
+        const r = embedRelay.createRelay({ whitelist: ['www.youtube.com'] });
+        const before = document.querySelectorAll('.exe-embed-overlay').length;
+        r.onMessage({ source: {}, data: { type: 'scorm', action: 'track', cmi: {}, exelearningBridge: 'N1' } });
+        expect(document.querySelectorAll('.exe-embed-overlay').length).toBe(before);
+    });
+});
diff --git a/tests/js/exe_embed.test.js b/tests/js/exe_embed.test.js
new file mode 100644
index 0000000..8e30095
--- /dev/null
+++ b/tests/js/exe_embed.test.js
@@ -0,0 +1,339 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Unit tests for the secure-mode external-embed shim + relay (DEC-0061). The shim
+// (in-iframe) promotes any cross-origin https / .pdf iframe; the relay (parent) is the
+// authoritative gate: in 'open' mode the structural invariant (https + cross-origin to
+// the LMS), in 'strict' mode the maintained host allowlist. Side-effect imports expose
+// the API on window.* (and module.exports); globals come from vitest.config.mjs.
+import '../../js/exe_embed_shim.js';
+import '../../js/exe_embed_relay.js';
+
+const shim = window.exeEmbedShim;
+const relay = window.exeEmbedRelay;
+
+const HOSTS = [
+    'www.youtube.com', 'youtube.com', 'www.youtube-nocookie.com',
+    'youtube-nocookie.com', 'player.vimeo.com', 'vimeo.com',
+    'www.dailymotion.com', 'dailymotion.com', 'geo.dailymotion.com',
+    'mediateca.educa.madrid.org',
+];
+const STRICT = { strict: true, whitelist: relay.buildWhitelist(HOSTS) };
+const ORIGIN = window.location.origin;       // happy-dom default (the "LMS" origin here).
+const CONTENT_SRC = ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/index.html';
+
+describe('exe_embed_relay validate() — open mode (default): structural invariant', () => {
+    it('accepts any cross-origin https video iframe verbatim (no host list, no reconstruction)', () => {
+        expect(relay.validate('https://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC))
+            .toEqual({ url: 'https://www.youtube.com/embed/aqz-KE-bpKQ', kind: 'video' });
+        expect(relay.validate('https://some-new-provider.example/player/42', CONTENT_SRC))
+            .toEqual({ url: 'https://some-new-provider.example/player/42', kind: 'video' });
+    });
+
+    it('rejects same-origin (the LMS itself)', () => {
+        expect(relay.validate(ORIGIN + '/course/view.php?id=2', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects non-https', () => {
+        expect(relay.validate('http://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects userinfo (https://evil.com@youtube.com/...)', () => {
+        expect(relay.validate('https://evil.com@www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects IP-literal and loopback/local hosts', () => {
+        expect(relay.validate('https://1.2.3.4/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://[2001:db8::1]/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://localhost/player', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('https://intranet.local/player', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects non-http(s) schemes (data:/javascript:/blob:)', () => {
+        expect(relay.validate('data:text/html,<h1>x</h1>', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('javascript:alert(1)', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('blob:https://x.test/uuid', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects a relative URL (the shim must report absolute)', () => {
+        expect(relay.validate('files/local.pdf', CONTENT_SRC)).toBeNull();
+        expect(relay.validate('/admin/secret', CONTENT_SRC)).toBeNull();
+    });
+});
+
+describe('exe_embed_relay validate() — PDFs (always allowed by structure)', () => {
+    it('accepts any cross-origin https PDF (no sameorigin flag)', () => {
+        expect(relay.validate('https://example.com/docs/report.pdf', CONTENT_SRC))
+            .toEqual({ url: 'https://example.com/docs/report.pdf', kind: 'pdf' });
+    });
+
+    it('accepts a same-origin PDF under the content directory (flagged sameorigin)', () => {
+        const pdf = ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/files/local.pdf';
+        expect(relay.validate(pdf, CONTENT_SRC)).toEqual({ url: pdf, kind: 'pdf', sameorigin: true });
+    });
+
+    it('rejects a same-origin PDF outside the package (e.g. an admin route)', () => {
+        expect(relay.validate(ORIGIN + '/admin/secret.pdf', CONTENT_SRC)).toBeNull();
+    });
+
+    it('rejects an http PDF', () => {
+        expect(relay.validate('http://example.com/x.pdf', CONTENT_SRC)).toBeNull();
+    });
+});
+
+describe('exe_embed_relay validate() — strict mode (opt-in allowlist)', () => {
+    it('rebuilds the canonical youtube-nocookie URL from a youtube.com embed', () => {
+        expect(relay.validate('https://www.youtube.com/embed/aqz-KE-bpKQ', CONTENT_SRC, STRICT))
+            .toEqual({ url: 'https://www.youtube-nocookie.com/embed/aqz-KE-bpKQ', kind: 'video' });
+    });
+
+    it('rebuilds the canonical Vimeo / Dailymotion / EducaMadrid URLs', () => {
+        expect(relay.validate('https://player.vimeo.com/video/76979871', CONTENT_SRC, STRICT).url)
+            .toBe('https://player.vimeo.com/video/76979871');
+        expect(relay.validate('https://www.dailymotion.com/embed/video/x8abc12', CONTENT_SRC, STRICT).url)
+            .toBe('https://www.dailymotion.com/embed/video/x8abc12');
+        expect(relay.validate('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh', CONTENT_SRC, STRICT).url)
+            .toBe('https://mediateca.educa.madrid.org/video/u555bvi3bk5wsabh/fs');
+    });
+
+    it('rejects a non-whitelisted cross-origin https host (unlike open mode)', () => {
+        expect(relay.validate('https://some-new-provider.example/player/42', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://example.com/', CONTENT_SRC, STRICT)).toBeNull();
+    });
+
+    it('rejects look-alike hosts and malformed ids', () => {
+        expect(relay.validate('https://www.youtube.com.evil.com/embed/aqz-KE-bpKQ', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://www.youtube.com/embed/', CONTENT_SRC, STRICT)).toBeNull();
+        expect(relay.validate('https://player.vimeo.com/video/not-a-number', CONTENT_SRC, STRICT)).toBeNull();
+    });
+
+    it('still accepts cross-origin PDFs in strict mode', () => {
+        expect(relay.validate('https://example.com/x.pdf', CONTENT_SRC, STRICT))
+            .toEqual({ url: 'https://example.com/x.pdf', kind: 'pdf' });
+    });
+});
+
+describe('exe_embed_relay structural helpers', () => {
+    it('isIpOrLocalHost flags IP literals and loopback/local names', () => {
+        ['1.2.3.4', '255.0.0.1', '[::1]', '[2001:db8::1]', 'localhost', 'x.localhost', 'host.local', ''].forEach(
+            (h) => expect(relay.isIpOrLocalHost(h)).toBe(true)
+        );
+        ['youtube.com', 'player.vimeo.com', 'example.org'].forEach(
+            (h) => expect(relay.isIpOrLocalHost(h)).toBe(false)
+        );
+    });
+
+    it('isRelatedToLms flags the LMS host, its subdomains and superdomains (dotted boundary)', () => {
+        expect(relay.isRelatedToLms('lms.example.org', 'lms.example.org')).toBe(true);   // equal
+        expect(relay.isRelatedToLms('cdn.lms.example.org', 'lms.example.org')).toBe(true); // subdomain
+        expect(relay.isRelatedToLms('example.org', 'lms.example.org')).toBe(true);        // superdomain
+        expect(relay.isRelatedToLms('evil-lms.example.org', 'lms.example.org')).toBe(false); // look-alike
+        expect(relay.isRelatedToLms('youtube.com', 'lms.example.org')).toBe(false);
+    });
+
+    it('isRelatedToLms normalises the trailing-dot FQDN-root form (no host. bypass)', () => {
+        // 'lms.example.org.' resolves to the same vhost but compares unequal as a raw
+        // string; without normalisation it would slip past the related-to-LMS gate and
+        // be promoted as a cross-origin player with allow-same-origin.
+        expect(relay.isRelatedToLms('lms.example.org.', 'lms.example.org')).toBe(true);   // dotted host
+        expect(relay.isRelatedToLms('lms.example.org', 'lms.example.org.')).toBe(true);   // dotted lmsHost
+        expect(relay.isRelatedToLms('cdn.lms.example.org.', 'lms.example.org')).toBe(true); // dotted subdomain
+        expect(relay.normalizeHost('LMS.Example.ORG.')).toBe('lms.example.org');
+    });
+});
+
+describe('exe_embed_shim promotion decisions', () => {
+    it('isPdfUrl detects .pdf paths (ignoring the query)', () => {
+        expect(shim.isPdfUrl('https://x.test/a/b.pdf')).toBe(true);
+        expect(shim.isPdfUrl('https://x.test/a/b.pdf?download=1')).toBe(true);
+        expect(shim.isPdfUrl('https://x.test/a/b.html')).toBe(false);
+    });
+
+    it('isPromotable: any cross-origin https or .pdf yes; same-origin / http no', () => {
+        expect(shim.isPromotable('https://www.youtube.com/embed/x12345')).toBe(true);
+        expect(shim.isPromotable('https://anything.example/player')).toBe(true);
+        expect(shim.isPromotable('https://files.test/manual.pdf')).toBe(true);
+        expect(shim.isPromotable('files/local.pdf')).toBe(true);              // relative .pdf
+        expect(shim.isPromotable(ORIGIN + '/course/view.php')).toBe(false);   // same-origin, not pdf
+        expect(shim.isPromotable('http://www.youtube.com/embed/x')).toBe(false); // not https
+    });
+
+    it('promote() replaces cross-origin/PDF iframes and leaves same-origin ones', () => {
+        // Scan a DETACHED container so happy-dom never navigates the iframe srcs.
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe id="yt" src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>' +
+            '<iframe id="pdf" src="https://example.com/x.pdf" width="600" height="400"></iframe>' +
+            '<iframe id="same" src="' + ORIGIN + '/local/page.html" width="320" height="120"></iframe>';
+
+        const created = shim.promote(root, { n: 0 });
+
+        expect(created.length).toBe(2);
+        expect(root.querySelector('#same')).not.toBeNull();   // same-origin survives
+        expect(root.querySelector('#yt')).toBeNull();
+        expect(root.querySelector('#pdf')).toBeNull();
+
+        const ph = created[0];
+        expect(ph.getAttribute('data-exe-embed-id')).toBe('exe-embed-1');
+        expect(ph.getAttribute('data-exe-embed-url')).toContain('youtube.com');
+        expect(ph.style.width).toBe('560px');
+        expect(ph.style.height).toBe('315px');
+    });
+
+    it('reports a RELATIVE src as an absolute URL (the parent relay cannot resolve relatives)', () => {
+        const root = document.createElement('div');
+        root.innerHTML = '<iframe id="lpdf" src="files/local-sample.pdf" width="600" height="400"></iframe>';
+
+        const created = shim.promote(root, { n: 0 });
+
+        expect(created.length).toBe(1);
+        const reported = created[0].getAttribute('data-exe-embed-url');
+        expect(reported).toMatch(/^https?:\/\//);
+        expect(reported).toMatch(/files\/local-sample\.pdf$/);
+    });
+});
+
+describe('exe_embed_relay makePlayer() — sandboxed players', () => {
+    it('video player is sandboxed with allow-same-origin but NOT top-navigation/modals', () => {
+        const frame = relay.makePlayer({ url: 'https://www.youtube.com/embed/abc123', kind: 'video' });
+        const sb = frame.getAttribute('sandbox');
+        expect(sb).toContain('allow-scripts');
+        expect(sb).toContain('allow-same-origin');   // cross-origin src keeps its own origin; renders.
+        expect(sb).not.toContain('allow-top-navigation');
+        expect(sb).not.toContain('allow-modals');
+        expect(frame.getAttribute('data-exe-embed-player')).toBe('1'); // excluded from message auth
+        expect(frame.getAttribute('allow')).toContain('autoplay');
+        expect(frame.getAttribute('referrerpolicy')).toBe('strict-origin-when-cross-origin');
+    });
+
+    it('cross-origin PDF player is sandboxed WITHOUT top-navigation/scripts (cannot redirect the tab)', () => {
+        // A server can serve scripted HTML at a .pdf path; the sandbox stops it top-navigating
+        // the Moodle tab. allow-same-origin keeps the provider origin (SOP-isolated).
+        const frame = relay.makePlayer({ url: 'https://files.test/manual.pdf', kind: 'pdf' });
+        const sb = frame.getAttribute('sandbox');
+        expect(sb).not.toBeNull();
+        expect(sb).toContain('allow-same-origin');
+        expect(sb).not.toContain('allow-top-navigation');
+        expect(sb).not.toContain('allow-scripts');
+        expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer');
+    });
+
+    it('same-origin package PDF is left unsandboxed (served application/pdf, the viewer needs it)', () => {
+        const frame = relay.makePlayer({ url: ORIGIN + '/pluginfile.php/5/mod_exelearning/content/3/files/local.pdf', kind: 'pdf', sameorigin: true });
+        expect(frame.hasAttribute('sandbox')).toBe(false);
+        expect(frame.getAttribute('referrerpolicy')).toBe('no-referrer');
+    });
+});
+
+describe('exe_embed_relay createRelay() overlays players from messages', () => {
+    let iframe;
+    beforeEach(() => {
+        document.body.innerHTML = '';
+        iframe = document.createElement('iframe');
+        document.body.appendChild(iframe);
+    });
+
+    it('creates an inline overlay player for a valid embed and removes it when no longer reported', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'e1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/www\.youtube\.com\/embed\/abc123$/);   // verbatim in open mode
+
+        r.onMessage({ source: iframe.contentWindow, data: { type: 'exe-embed', action: 'sync', embeds: [] } });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('replaces the player when a reused embed id navigates to a different URL (no lingering video)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'exe-embed-1', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 480, h: 270 }],
+            },
+        });
+        expect(document.querySelector('.exe-embed-overlay iframe').src).toMatch(/www\.youtube\.com\/embed\/abc123$/);
+
+        r.onMessage({
+            source: iframe.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'exe-embed-1', url: 'https://player.vimeo.com/video/12345', x: 0, y: 0, w: 425, h: 350 }],
+            },
+        });
+        const players = document.querySelectorAll('.exe-embed-overlay iframe');
+        expect(players.length).toBe(1);
+        expect(players[0].src).toMatch(/player\.vimeo\.com\/video\/12345$/);
+        expect(players[0].src).not.toMatch(/youtube/);
+    });
+
+    it('never treats a promoted player as a content source (forged-message defence)', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        // A sandboxed player with allow-same-origin must not be able to impersonate the
+        // content iframe and inject embeds: tag an iframe like a player and verify a
+        // message from it is ignored.
+        const player = document.createElement('iframe');
+        player.setAttribute('data-exe-embed-player', '1');
+        document.body.appendChild(player);
+        r.onMessage({
+            source: player.contentWindow,
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'x', url: 'https://evil.example/phish', x: 0, y: 0, w: 100, h: 100 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('ignores a message whose source is not a known content iframe', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({
+            source: {},
+            data: {
+                type: 'exe-embed', action: 'sync',
+                embeds: [{ id: 'x', url: 'https://www.youtube.com/embed/abc123', x: 0, y: 0, w: 1, h: 1 }],
+            },
+        });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+
+    it('ignores non-embed messages', () => {
+        const r = relay.createRelay({ mode: 'open' });
+        r.onMessage({ source: iframe.contentWindow, data: { type: 'scorm', action: 'track', cmi: {} } });
+        expect(document.querySelectorAll('.exe-embed-overlay iframe').length).toBe(0);
+    });
+});
+
+describe('exe_embed_shim collect() geometry report', () => {
+    it('reports id + (absolute) url + numeric geometry for each placeholder', () => {
+        const root = document.createElement('div');
+        root.innerHTML =
+            '<iframe src="https://www.youtube.com/embed/aqz-KE-bpKQ" width="560" height="315"></iframe>';
+        shim.promote(root, { n: 0 });
+
+        const embeds = shim.collect(root);
+        expect(embeds.length).toBe(1);
+        expect(embeds[0].id).toMatch(/^exe-embed-/);
+        expect(embeds[0].url).toContain('youtube.com');
+        ['x', 'y', 'w', 'h'].forEach((k) => expect(typeof embeds[0][k]).toBe('number'));
+    });
+});
diff --git a/tests/js/scorm_api_wrapper.test.js b/tests/js/scorm_api_wrapper.test.js
new file mode 100644
index 0000000..11bc552
--- /dev/null
+++ b/tests/js/scorm_api_wrapper.test.js
@@ -0,0 +1,166 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Regression coverage for the vendored pipwerks wrapper (assets/scorm/SCORM_API_wrapper.js).
+//
+// The wrapper is normally "out of scope" for these JS suites, but its API lookup is
+// grade-critical: it is what eXeLearning's content calls to record SCORM scores, and a
+// defect there silently lost EVERY score in the secure (opaque-origin) iframe mode
+// (DEC-0059/DEC-0061). The vendored get() had been altered to look only in window.parent
+// and skip the current window. In secure mode the SCORM API is provided LOCALLY by the
+// in-iframe bridge shim (js/scorm_bridge_shim.js) as window.API, and the Moodle parent is
+// a cross-origin/opaque frame whose property access throws SecurityError. So the altered
+// get() reached straight into the opaque parent, threw, init() never activated the
+// connection, and LMSSetValue/LMSCommit became no-ops -> no attempt rows were written.
+//
+// These tests lock in the corrected behaviour: check the current window first, fall back
+// to a same-origin ancestor (legacy mode), and never let an opaque ancestor abort lookup.
+//
+// The wrapper is a classic browser script (top-level `var pipwerks = {}`, no module
+// exports), so it is loaded via new Function() with a fully controllable `window`, letting
+// each test model a specific frame topology (local API, opaque parent, same-origin parent).
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const wrapperSrc = fs.readFileSync(
+    path.join(here, '../../assets/scorm/SCORM_API_wrapper.js'),
+    'utf8'
+);
+
+/**
+ * Load a fresh pipwerks instance bound to the given fake window. find()/get() read the
+ * `window` free variable, which we supply as the factory argument, so the wrapper sees
+ * exactly the frame topology the test sets up. A fresh instance per call avoids shared
+ * state (pipwerks.SCORM.version, connection.isActive) leaking between tests.
+ *
+ * @param {Object} win The fake window (must carry a console for trace()).
+ * @returns {Object} The wrapper's pipwerks namespace.
+ */
+function loadPipwerks(win) {
+    win.console = win.console || globalThis.console;
+    const factory = new Function('window', 'document', wrapperSrc + '\n;return pipwerks;');
+    return factory(win, win.document || {});
+}
+
+/**
+ * A minimal SCORM 1.2 API surface. Records LMSInitialize/LMSSetValue/LMSCommit calls so a
+ * test can assert the save path was actually driven. LMSGetLastError returns "0" so
+ * pipwerks treats the session as healthy.
+ *
+ * @param {string} tag An identity marker so tests can assert WHICH API was returned.
+ * @returns {Object}
+ */
+function makeApi(tag) {
+    const calls = [];
+    return {
+        tag,
+        calls,
+        LMSInitialize: (v) => { calls.push(['LMSInitialize', v]); return 'true'; },
+        LMSFinish: (v) => { calls.push(['LMSFinish', v]); return 'true'; },
+        LMSGetValue: (k) => { calls.push(['LMSGetValue', k]); return ''; },
+        LMSSetValue: (k, v) => { calls.push(['LMSSetValue', k, v]); return 'true'; },
+        LMSCommit: (v) => { calls.push(['LMSCommit', v]); return 'true'; },
+        LMSGetLastError: () => '0',
+        LMSGetErrorString: () => '',
+        LMSGetDiagnostic: () => '',
+    };
+}
+
+/** A frame whose .API / .API_1484_11 access throws, mimicking an opaque cross-origin parent. */
+function makeOpaqueFrame() {
+    const frame = {};
+    const blow = () => { throw new Error('SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.'); };
+    Object.defineProperty(frame, 'API', { get: blow });
+    Object.defineProperty(frame, 'API_1484_11', { get: blow });
+    return frame;
+}
+
+describe('vendored pipwerks API.get (secure-mode regression)', () => {
+    it('returns the LOCAL window.API, not the parent\'s (current window checked first)', () => {
+        // Secure mode: the bridge shim put window.API in THIS frame; the parent also has a
+        // (different) API. The old build returned the parent's; we must return the local one.
+        const localApi = makeApi('local');
+        const parent = { API: makeApi('parent') };
+        parent.parent = parent;                       // stops the upward walk at the parent
+        const win = { API: localApi, parent, document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        expect(pipwerks.SCORM.API.get()).toBe(localApi);
+    });
+
+    it('does not throw when the parent frame is opaque/cross-origin, and finds the local API', () => {
+        // The exact failure mode: reaching into the opaque parent threw SecurityError.
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        let got;
+        expect(() => { got = pipwerks.SCORM.API.get(); }).not.toThrow();
+        expect(got).toBe(localApi);
+    });
+
+    it('returns null (never throws) when no API is reachable and the parent is opaque', () => {
+        const win = { parent: makeOpaqueFrame(), document: {} };   // no local API
+
+        const pipwerks = loadPipwerks(win);
+
+        let got = 'unset';
+        expect(() => { got = pipwerks.SCORM.API.get(); }).not.toThrow();
+        expect(got == null).toBe(true);
+    });
+
+    it('still walks up to a same-origin parent when there is no local API (legacy mode)', () => {
+        // Legacy same-origin mode: no local API, the Moodle parent hosts window.API.
+        const parentApi = makeApi('parent');
+        const parent = { API: parentApi };
+        parent.parent = parent;                       // stops the walk
+        const win = { parent, document: {} };
+
+        const pipwerks = loadPipwerks(win);
+
+        expect(pipwerks.SCORM.API.get()).toBe(parentApi);
+    });
+});
+
+describe('vendored pipwerks init (secure bridge end to end)', () => {
+    it('activates the connection through a LOCAL API even with an opaque parent', () => {
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+        const ok = pipwerks.SCORM.init();             // init === connection.initialize
+
+        expect(ok).toBe(true);
+        expect(pipwerks.SCORM.connection.isActive).toBe(true);
+        expect(localApi.calls.some((c) => c[0] === 'LMSInitialize')).toBe(true);
+    });
+
+    it('set() reaches the local API once the connection is active (the score actually saves)', () => {
+        const localApi = makeApi('local');
+        const win = { API: localApi, parent: makeOpaqueFrame(), document: {} };
+
+        const pipwerks = loadPipwerks(win);
+        pipwerks.SCORM.init();
+        const saved = pipwerks.SCORM.set('cmi.core.score.raw', '100');
+
+        expect(saved).toBe(true);
+        expect(localApi.calls).toContainEqual(['LMSSetValue', 'cmi.core.score.raw', '100']);
+    });
+});
diff --git a/tests/js/scorm_bridge.test.js b/tests/js/scorm_bridge.test.js
new file mode 100644
index 0000000..bbf5715
--- /dev/null
+++ b/tests/js/scorm_bridge.test.js
@@ -0,0 +1,437 @@
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+// Side-effect imports: each module exposes its API on a window.* global (and on
+// module.exports). scorm_tracker must load before the shim (the shim calls
+// window.exeScormTracker). globals (describe/it/expect/vi) come from vitest.config.mjs.
+import '../../js/scorm_tracker.js';
+import '../../js/scorm_bridge_shim.js';
+import '../../js/scorm_bridge_relay.js';
+
+const shim = window.exeScormBridgeShim;
+const relay = window.exeScormBridge;
+
+/**
+ * Build a fake iframe window for the shim: captures messages posted to the parent
+ * and the registered 'message' listener so a test can drive the handshake. Uses the
+ * real (happy-dom) document so the shared tracker's objectid resolution works.
+ */
+function makeFakeWin(overrides = {}) {
+    const postedToParent = [];
+    const listeners = {};
+    const win = {
+        exeScormTracker: window.exeScormTracker,
+        parent: { postMessage: (msg) => postedToParent.push(msg) },
+        origin: 'null',
+        document,
+        addEventListener: (type, fn) => { (listeners[type] = listeners[type] || []).push(fn); },
+        postedToParent,
+        listeners,
+        ...overrides,
+    };
+    return win;
+}
+
+/** Deliver a message to the shim's registered onMessage listener. */
+function deliver(win, event) {
+    (win.listeners.message || []).forEach((fn) => fn(event));
+}
+
+describe('shim createMemoryStorage', () => {
+    it('behaves like a string-coercing in-memory Storage', () => {
+        const s = shim.createMemoryStorage();
+        expect(s.getItem('missing')).toBeNull();
+        s.setItem('a', 1);
+        expect(s.getItem('a')).toBe('1');     // coerced to string
+        expect(s.length).toBe(1);
+        expect(s.key(0)).toBe('a');
+        s.removeItem('a');
+        expect(s.getItem('a')).toBeNull();
+        expect(s.length).toBe(0);
+        s.setItem('b', 'x');
+        s.clear();
+        expect(s.length).toBe(0);
+    });
+});
+
+describe('shim isSandboxedOpaque', () => {
+    it('is true when the origin serializes to "null"', () => {
+        expect(shim.isSandboxedOpaque({ origin: 'null' })).toBe(true);
+    });
+
+    it('is true when web storage access throws a SecurityError (opaque origin)', () => {
+        const win = {
+            origin: 'https://moodle.test',
+            get localStorage() { throw new DOMException('blocked', 'SecurityError'); },
+        };
+        expect(shim.isSandboxedOpaque(win)).toBe(true);
+    });
+
+    it('is FALSE when storage throws a non-SecurityError in a real same-origin iframe (legacy, not opaque)', () => {
+        // A QuotaExceededError (or a disabled-storage policy) must NOT be mistaken for an
+        // opaque origin, or the shim would wrongly activate in legacy mode and lose grades.
+        const quota = { origin: 'https://moodle.test', get localStorage() { throw new DOMException('full', 'QuotaExceededError'); } };
+        expect(shim.isSandboxedOpaque(quota)).toBe(false);
+        const generic = { origin: 'https://moodle.test', get localStorage() { throw new Error('nope'); } };
+        expect(shim.isSandboxedOpaque(generic)).toBe(false);
+    });
+
+    it('is false for a same-origin window with working storage', () => {
+        const win = { origin: 'https://moodle.test', localStorage: shim.createMemoryStorage() };
+        expect(shim.isSandboxedOpaque(win)).toBe(false);
+    });
+});
+
+describe('shim installStoragePolyfill', () => {
+    it('replaces storage with in-memory implementations', () => {
+        const win = {};
+        shim.installStoragePolyfill(win);
+        win.localStorage.setItem('k', 'v');
+        expect(win.localStorage.getItem('k')).toBe('v');
+        win.sessionStorage.setItem('s', '1');
+        expect(win.sessionStorage.getItem('s')).toBe('1');
+    });
+});
+
+describe('shim isParentMessage', () => {
+    it('accepts config/ack and rejects everything else', () => {
+        expect(shim.isParentMessage({ type: 'scorm', action: 'config' })).toBe(true);
+        expect(shim.isParentMessage({ type: 'scorm', action: 'ack' })).toBe(true);
+        expect(shim.isParentMessage({ type: 'scorm', action: 'track' })).toBe(false);
+        expect(shim.isParentMessage({ type: 'other', action: 'config' })).toBe(false);
+        expect(shim.isParentMessage(null)).toBe(false);
+    });
+});
+
+describe('shim activate (handshake + transport)', () => {
+    it('announces ready, then defines window.API', () => {
+        const win = makeFakeWin();
+        const handles = shim.activate(win);
+        expect(handles).not.toBeNull();
+        expect(win.API).toBe(handles.api);
+        expect(win.postedToParent[0]).toEqual({ exelearningBridge: null, type: 'scorm', action: 'ready' });
+    });
+
+    it('queues scores until config arrives, then flushes them stamped with the nonce', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        // Score before the handshake completes: must be queued, not posted yet.
+        win.API.LMSSetValue('cmi.core.score.raw', '80');
+        win.API.LMSCommit();
+        expect(win.postedToParent.filter((m) => m.action === 'track')).toHaveLength(0);
+        // Parent replies with the nonce -> queued track message is flushed.
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N1' } });
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks).toHaveLength(1);
+        expect(tracks[0].exelearningBridge).toBe('N1');
+        expect(tracks[0].cmi['cmi.core.score.raw']).toBe('80');
+    });
+
+    it('posts scores immediately once ready', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N2' } });
+        win.API.LMSSetValue('cmi.core.lesson_status', 'completed');
+        win.API.LMSCommit();
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks).toHaveLength(1);
+        expect(tracks[0].exelearningBridge).toBe('N2');
+        expect(tracks[0].cmi['cmi.core.lesson_status']).toBe('completed');
+    });
+
+    it('ignores messages whose source is not the parent window', () => {
+        const win = makeFakeWin();
+        shim.activate(win);
+        win.API.LMSSetValue('cmi.core.score.raw', '50');
+        win.API.LMSCommit();
+        // A config from a foreign window must not unblock the queue.
+        deliver(win, { source: { other: true }, data: { type: 'scorm', action: 'config', nonce: 'EVIL' } });
+        expect(win.postedToParent.filter((m) => m.action === 'track')).toHaveLength(0);
+    });
+});
+
+describe('shim boot', () => {
+    it('activates in an opaque sandbox', () => {
+        const win = makeFakeWin({ origin: 'null' });
+        const handles = shim.boot(win);
+        expect(handles).not.toBeNull();
+        expect(win.API).toBeDefined();
+        // Storage was polyfilled.
+        win.localStorage.setItem('k', 'v');
+        expect(win.localStorage.getItem('k')).toBe('v');
+    });
+
+    it('stays dormant (no window.API) outside an opaque sandbox', () => {
+        const win = makeFakeWin({ origin: 'https://moodle.test', localStorage: shim.createMemoryStorage(), API: undefined });
+        const handles = shim.boot(win);
+        expect(handles).toBeNull();
+        expect(win.API).toBeUndefined();
+    });
+});
+
+describe('relay pure validators', () => {
+    it('isTrackMessage requires the scorm/track shape with a cmi object', () => {
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'track', cmi: {} })).toBe(true);
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'track' })).toBe(false);
+        expect(relay.isTrackMessage({ type: 'scorm', action: 'ready' })).toBe(false);
+        expect(relay.isTrackMessage(null)).toBe(false);
+    });
+
+    it('isReadyMessage matches only the readiness announcement', () => {
+        expect(relay.isReadyMessage({ type: 'scorm', action: 'ready' })).toBe(true);
+        expect(relay.isReadyMessage({ type: 'scorm', action: 'track', cmi: {} })).toBe(false);
+    });
+
+    it('acceptTrack requires both a valid shape and the matching nonce', () => {
+        const msg = { type: 'scorm', action: 'track', cmi: {}, exelearningBridge: 'N' };
+        expect(relay.acceptTrack(msg, 'N')).toBe(true);
+        expect(relay.acceptTrack(msg, 'OTHER')).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: undefined }, 'N')).toBe(false);
+    });
+
+    it('acceptTrack never authenticates against a falsy expected nonce (no undefined===undefined)', () => {
+        // A relay constructed without a nonce must reject even a perfectly-shaped message
+        // that omits the field, rather than collapsing the nonce factor.
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {} }, undefined)).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: undefined }, undefined)).toBe(false);
+        expect(relay.acceptTrack({ type: 'scorm', action: 'track', cmi: {}, exelearningBridge: '' }, '')).toBe(false);
+    });
+});
+
+describe('relay createRelay (message handling)', () => {
+    function setup() {
+        const cw = { postMessage: vi.fn() };
+        const iframe = { contentWindow: cw };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const fetchCalls = [];
+        const fetchImpl = (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; };
+        const beaconCalls = [];
+        const sendBeacon = (url, blob) => { beaconCalls.push({ url, blob }); return true; };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N' },
+            { document: doc, window: { addEventListener: () => {} }, fetch: fetchImpl, sendBeacon }
+        );
+        return { r, cw, fetchCalls, beaconCalls };
+    }
+
+    it('replies to ready (from the iframe) with the config + nonce', () => {
+        const { r, cw } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        expect(cw.postMessage).toHaveBeenCalledTimes(1);
+        expect(cw.postMessage.mock.calls[0][0]).toMatchObject({ type: 'scorm', action: 'config', nonce: 'N' });
+    });
+
+    it('forwards a valid track message to track.php with the trusted identity', () => {
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({
+            source: cw,
+            data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '80' }, itemscores: { 'ide-a': { scorepct: 80 } } },
+        });
+        expect(fetchCalls).toHaveLength(1);
+        expect(fetchCalls[0].url).toBe('/track.php?id=42');
+        const body = JSON.parse(fetchCalls[0].opts.body);
+        expect(body).toEqual({ id: 42, session: 'tok', cmi: { 'cmi.core.score.raw': '80' }, itemscores: { 'ide-a': { scorepct: 80 } } });
+    });
+
+    it('ignores a track message from a window other than the iframe', () => {
+        const { r, fetchCalls } = setup();
+        r.onMessage({ source: { foreign: true }, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('ignores a message when the iframe has no contentWindow (no null===null match)', () => {
+        const fetchCalls = [];
+        const iframe = { contentWindow: null };   // present element, not navigable.
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N' },
+            { document: doc, window: { addEventListener: () => {} }, fetch: (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; } }
+        );
+        // event.source === null would equal a null contentWindow without the guard.
+        r.onMessage({ source: null, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('ignores a track message with the wrong nonce or a bad shape', () => {
+        const { r, cw, fetchCalls } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'WRONG', cmi: {} } });
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N' } }); // no cmi
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'evil', exelearningBridge: 'N', cmi: {} } });
+        expect(fetchCalls).toHaveLength(0);
+    });
+
+    it('flushBeacon sends the last forwarded payload on unload', () => {
+        const { r, cw, beaconCalls } = setup();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '90' }, itemscores: {} } });
+        r.flushBeacon();
+        expect(beaconCalls).toHaveLength(1);
+        expect(beaconCalls[0].url).toBe('/track.php?id=42');
+    });
+
+    it('xAPI-primary (disableTracking): a valid track message is accepted but POSTs nothing, while ready still handshakes', () => {
+        const cw = { postMessage: vi.fn() };
+        const iframe = { contentWindow: cw };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : null) };
+        const fetchCalls = [];
+        const beaconCalls = [];
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', cmid: 42, trackurl: '/track.php?id=42', session: 'tok', nonce: 'N', disableTracking: true },
+            {
+                document: doc,
+                window: { addEventListener: () => {} },
+                fetch: (url, opts) => { fetchCalls.push({ url, opts }); return { catch: () => {} }; },
+                sendBeacon: (url, blob) => { beaconCalls.push({ url, blob }); return true; },
+            }
+        );
+        // A perfectly valid, authenticated SCORM score is dropped: the package is graded via xAPI.
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'track', exelearningBridge: 'N', cmi: { 'cmi.core.score.raw': '100' }, itemscores: {} } });
+        expect(fetchCalls).toHaveLength(0);
+        // The handshake still runs, so window.API exists and the iDevices can emit xAPI.
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        expect(cw.postMessage).toHaveBeenCalledTimes(1);
+        // And the unload beacon has nothing to flush (no score was ever buffered).
+        r.flushBeacon();
+        expect(beaconCalls).toHaveLength(0);
+    });
+});
+
+describe('relay watchdog (no silent legacy fallback)', () => {
+    function setupWatchdog() {
+        const cw = { postMessage: () => {} };
+        const iframe = { contentWindow: cw, style: { display: '' } };
+        const blocked = { style: { display: 'none' } };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : (id === 'blk' ? blocked : null)) };
+        let timerFn = null;
+        const win = {
+            addEventListener: () => {},
+            setTimeout: (fn) => { timerFn = fn; return 1; },
+            clearTimeout: () => { timerFn = null; },
+        };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', nonce: 'N', blockedid: 'blk', watchdogms: 5 },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        return { r, cw, iframe, blocked, fire: () => timerFn && timerFn() };
+    }
+
+    it('reveals the blocked notice and hides the iframe when ready never arrives', () => {
+        const { r, iframe, blocked, fire } = setupWatchdog();
+        r.startWatchdog();
+        fire();
+        expect(blocked.style.display).toBe('');
+        expect(iframe.style.display).toBe('none');
+    });
+
+    it('is cleared when the iframe signals ready (secure mode rendered)', () => {
+        const { r, cw, blocked, fire } = setupWatchdog();
+        r.startWatchdog();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        fire(); // no-op: watchdog was cleared.
+        expect(blocked.style.display).toBe('none');
+    });
+
+    // Fast path: an iframe element fires 'load' even when its navigation ended in an
+    // error page (e.g. an opaque token URL that 404s on a service-worker host that does
+    // not control opaque subframes). The relay then only grants a short grace before the
+    // notice, so it never sits behind the long flat watchdog (DEC-0060 / Playground).
+    function setupLoadWatchdog() {
+        let loadHandler = null;
+        const timers = [];
+        const cw = { postMessage: () => {} };
+        const iframe = {
+            contentWindow: cw,
+            style: { display: '' },
+            addEventListener: (type, fn) => { if (type === 'load') { loadHandler = fn; } },
+        };
+        const blocked = { style: { display: 'none' } };
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? iframe : (id === 'blk' ? blocked : null)) };
+        const win = {
+            addEventListener: () => {},
+            setTimeout: (fn) => { timers.push(fn); return timers.length; },
+            clearTimeout: () => {},
+        };
+        const r = relay.createRelay(
+            { iframeid: 'exelearningobject', nonce: 'N', blockedid: 'blk', watchdogms: 100000, gracems: 5 },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        return { r, cw, iframe, blocked, timers, load: () => loadHandler && loadHandler() };
+    }
+
+    it('reveals the notice on the short grace timer after the iframe loads, not the long watchdog', () => {
+        const { r, iframe, blocked, timers, load } = setupLoadWatchdog();
+        r.startWatchdog();
+        expect(timers).toHaveLength(1);   // only the flat watchdog so far.
+        load();                            // iframe finished loading (e.g. the 404 page).
+        expect(timers).toHaveLength(2);   // a short grace timer was armed.
+        timers[1]();                       // fire ONLY the grace timer (not the long one).
+        expect(blocked.style.display).toBe('');
+        expect(iframe.style.display).toBe('none');
+    });
+
+    it('does not arm the grace timer when the iframe is already ready before it loads', () => {
+        const { r, cw, blocked, timers, load } = setupLoadWatchdog();
+        r.startWatchdog();
+        r.onMessage({ source: cw, data: { type: 'scorm', action: 'ready' } });
+        load();                            // ready already seen -> no grace timer.
+        expect(timers).toHaveLength(1);
+        timers.forEach((fn) => fn());      // even firing everything leaves it hidden.
+        expect(blocked.style.display).toBe('none');
+    });
+});
+
+describe('shim extra branches (coverage)', () => {
+    it('treats a window whose origin read throws as opaque', () => {
+        const win = { get origin() { throw new Error('blocked'); } };
+        expect(shim.isSandboxedOpaque(win)).toBe(true);
+    });
+
+    it('installStoragePolyfill never throws even when storage cannot be redefined', () => {
+        const win = Object.preventExtensions({});
+        expect(() => shim.installStoragePolyfill(win)).not.toThrow();
+    });
+
+    it('resolves per-iDevice scores from its own document on suspend_data', () => {
+        document.body.innerHTML = '<div class="idevice_node" id="ide-x"></div>';
+        const win = makeFakeWin();
+        shim.activate(win);
+        deliver(win, { source: win.parent, data: { type: 'scorm', action: 'config', nonce: 'N' } });
+        win.API.LMSSetValue('cmi.suspend_data', '1. "Q"; Score: 60%; Weight: 30%');
+        win.API.LMSCommit();
+        const tracks = win.postedToParent.filter((m) => m.action === 'track');
+        expect(tracks.length).toBeGreaterThan(0);
+        expect(tracks[tracks.length - 1].itemscores).toEqual({ 'ide-x': { scorepct: 60, weighted: 30, title: 'Q' } });
+    });
+});
+
+describe('relay init wiring (coverage)', () => {
+    it('init registers message + pagehide listeners (and starts the watchdog)', () => {
+        const events = {};
+        const win = { addEventListener: (t, fn) => { events[t] = fn; }, setTimeout: () => 1, clearTimeout: () => {} };
+        const doc = { getElementById: () => null };
+        const r = relay.createRelay(
+            { iframeid: 'x', nonce: 'N', blockedid: 'blk' },
+            { document: doc, window: win, fetch: () => ({ catch: () => {} }) }
+        );
+        r.init();
+        expect(typeof events.message).toBe('function');
+        expect(typeof events.pagehide).toBe('function');
+    });
+
+    it('bootstrap init() creates a relay and starts it', () => {
+        const r = relay.init({ iframeid: 'x', nonce: 'N' });
+        expect(typeof r.onMessage).toBe('function');
+        expect(typeof r.postTrack).toBe('function');
+    });
+});
diff --git a/tests/js/scorm_tracker.test.js b/tests/js/scorm_tracker.test.js
index 65a2de8..0b0faff 100644
--- a/tests/js/scorm_tracker.test.js
+++ b/tests/js/scorm_tracker.test.js
@@ -253,3 +253,34 @@ describe('createScormApi state machine', () => {
         expect(xhr.calls.length).toBe(0);
     });
 });
+
+describe('createScormApi transport (bridge mode)', () => {
+    function cfg(transport) {
+        // No-op timers so the only send() is the explicit LMSCommit (no stray autocommit).
+        return { transport, bindUnload: false, getScoringDocument: () => document, setTimeout: () => 0, clearTimeout: () => {} };
+    }
+
+    it('clears dirty when the transport accepts the payload (no XHR)', () => {
+        let calls = 0;
+        const { api } = createScormApi(cfg(() => { calls++; return true; }));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('true');
+        expect(calls).toBe(1);
+        // Not dirty anymore: a second commit sends nothing.
+        expect(api.LMSCommit()).toBe('true');
+        expect(calls).toBe(1);
+    });
+
+    it('keeps dirty (Commit -> "false") when the transport rejects', () => {
+        const { api } = createScormApi(cfg(() => false));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('false');
+    });
+
+    it('reports error 101 when the transport throws', () => {
+        const { api } = createScormApi(cfg(() => { throw new Error('boom'); }));
+        api.LMSSetValue('cmi.core.score.raw', '50');
+        expect(api.LMSCommit()).toBe('false');
+        expect(api.LMSGetLastError()).toBe('101');
+    });
+});
diff --git a/tests/js/xapi_listener.test.js b/tests/js/xapi_listener.test.js
index 9e3116e..d81333a 100644
--- a/tests/js/xapi_listener.test.js
+++ b/tests/js/xapi_listener.test.js
@@ -128,6 +128,84 @@ describe('xapi_listener createListener().handleMessage', () => {
     });
 });
 
+describe('xapi_listener window-identity mode (secure / opaque origin, DEC-0065)', () => {
+    let xhr;
+    const frameWin = { name: 'package-iframe' };   // sentinel for the iframe's contentWindow.
+
+    function secureListener(extra = {}) {
+        return createListener({
+            cmid: 42,
+            trackurl: '/mod/exelearning/xapi_track.php?id=42&sesskey=abc',
+            registration: 'tok',
+            mode: 'grading',
+            expectedSource: frameWin,     // window-identity mode without a real DOM iframe.
+            xhrFactory: () => xhr,
+            ...extra,
+        });
+    }
+
+    beforeEach(() => { xhr = makeXhr(); });
+
+    it('forwards a statement from the package iframe even though the origin is the opaque "null"', () => {
+        const listener = secureListener();
+        const ok = listener.handleMessage(
+            { origin: 'null', source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s1') } });
+        expect(ok).toBe(true);
+        expect(xhr.calls.find((c) => c.method).url).toContain('xapi_track.php');
+    });
+
+    it('drops a statement from any other window, even one claiming the trusted host origin', () => {
+        const listener = secureListener();
+        expect(listener.handleMessage(
+            { origin: 'null', source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('s2') } })).toBe(false);
+        expect(listener.handleMessage(
+            { origin: HOST, source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('s3') } })).toBe(false);
+        expect(xhr.calls.length).toBe(0);
+    });
+
+    it('drops a message that carries no source', () => {
+        const listener = secureListener();
+        expect(listener.handleMessage(
+            { origin: 'null', data: { type: 'exe-xapi-statement', statement: answered('s4') } })).toBe(false);
+        expect(xhr.calls.length).toBe(0);
+    });
+
+    it('resolves the iframe by id lazily, so injection before the element exists still works', () => {
+        let frame = null;   // element not in the DOM yet (relay is injected before the iframe).
+        const doc = { getElementById: (id) => (id === 'exelearningobject' ? frame : null) };
+        const listener = createListener({
+            cmid: 42, trackurl: '/x', registration: 'tok',
+            iframeid: 'exelearningobject', document: doc, xhrFactory: () => xhr,
+        });
+        // No element -> no trusted source -> dropped (and not marked seen).
+        expect(listener.handleMessage(
+            { source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s5') } })).toBe(false);
+        // The element appears at load time -> the same source window is now trusted.
+        frame = { contentWindow: frameWin };
+        expect(listener.handleMessage(
+            { source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('s6') } })).toBe(true);
+    });
+
+    it('window identity wins when both iframeid and allowedOrigin are set: origin is never consulted in secure mode', () => {
+        // Defensive: secure mode must NOT fall back to the origin check even if a future
+        // refactor leaves allowedOrigin in the config. event.source is the only anchor.
+        const listener = createListener({
+            cmid: 42, trackurl: '/x', registration: 'tok',
+            iframeid: 'exelearningobject',     // selects window-identity mode...
+            allowedOrigin: HOST,               // ...and this must be ignored, not consulted.
+            document: { getElementById: () => ({ contentWindow: frameWin }) },
+            xhrFactory: () => xhr,
+        });
+        // A message from a DIFFERENT window is rejected even though it carries the trusted host origin.
+        expect(listener.handleMessage(
+            { origin: HOST, source: { other: true }, data: { type: 'exe-xapi-statement', statement: answered('p1') } })).toBe(false);
+        // Only the real iframe window is accepted.
+        expect(listener.handleMessage(
+            { origin: HOST, source: frameWin, data: { type: 'exe-xapi-statement', statement: answered('p2') } })).toBe(true);
+        expect(xhr.calls.length).toBeGreaterThan(0);
+    });
+});
+
 /**
  * XHR factory whose instances expose resolve(status)/fail() so a test can drive the
  * async onload/onerror callbacks deterministically.
diff --git a/tests/lib_extract_test.php b/tests/lib_extract_test.php
index 2575401..1183737 100644
--- a/tests/lib_extract_test.php
+++ b/tests/lib_extract_test.php
@@ -75,6 +75,48 @@ public function test_create_instance_extracts_package_and_injects_scorm_loader()
         $html = $index->get_content();
         $this->assertStringContainsString('<!-- mod_exelearning:scorm-loader -->', $html);
         $this->assertStringContainsString('libs/SCORM_API_wrapper.js', $html);
+
+        // The secure-mode bridge client was shipped under libs/ and injected at the top
+        // of <head> (DEC-0060).
+        foreach (['scorm_tracker.js', 'exe_scorm_bridge.js'] as $bridgefile) {
+            $f = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', $bridgefile);
+            $this->assertInstanceOf(\stored_file::class, $f);
+        }
+        $this->assertStringContainsString('<!-- mod_exelearning:scorm-bridge -->', $html);
+        $this->assertStringContainsString('libs/exe_scorm_bridge.js', $html);
+    }
+
+    /**
+     * Re-extracting the same revision refreshes the plugin-owned bridge client
+     * (scorm_tracker.js / exe_scorm_bridge.js) under libs/ — exercises the $present +
+     * refresh delete-and-recreate branch of package_manager::extract_stored() (DEC-0060).
+     * Idempotent: it must not error and the files must remain.
+     */
+    public function test_reextract_refreshes_bridge_client(): void {
+        global $DB;
+        $this->resetAfterTest();
+        $this->setAdminUser();
+
+        $course = $this->getDataGenerator()->create_course();
+        $instance = $this->getDataGenerator()->get_plugin_generator('mod_exelearning')
+            ->create_instance(['course' => $course->id]);
+        $cm = get_coursemodule_from_instance('exelearning', $instance->id);
+        $context = \context_module::instance($cm->id);
+        $revision = (int) $DB->get_field('exelearning', 'revision', ['id' => $instance->id]);
+        $fs = get_file_storage();
+
+        // Present after the first extract.
+        $before = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', 'exe_scorm_bridge.js');
+        $this->assertInstanceOf(\stored_file::class, $before);
+
+        // Re-extract the same revision: the bridge files are already present, so the
+        // refresh branch deletes and recreates them. Must stay present and not error.
+        exelearning_extract_stored_package($context->id, $revision);
+
+        foreach (['scorm_tracker.js', 'exe_scorm_bridge.js'] as $bridgefile) {
+            $f = $fs->get_file($context->id, 'mod_exelearning', 'content', $revision, '/libs/', $bridgefile);
+            $this->assertInstanceOf(\stored_file::class, $f);
+        }
     }
 
     /**
diff --git a/tests/local/scorm/scorm_injector_test.php b/tests/local/scorm/scorm_injector_test.php
index 6459697..e60330c 100644
--- a/tests/local/scorm/scorm_injector_test.php
+++ b/tests/local/scorm/scorm_injector_test.php
@@ -84,9 +84,14 @@ public function test_inject_rewrites_html_with_relative_paths_and_is_idempotent(
         $this->assertStringContainsString('<script src="libs/SCORM_API_wrapper.js"></script>', $index);
         $this->assertStringContainsString('pipwerks.SCORM.init()', $index);
 
+        // The external-embed shim is baked too (no host list: the parent relay gates).
+        $this->assertStringContainsString('<!-- mod_exelearning:embed-shim -->', $index);
+        $this->assertStringContainsString('<script src="libs/exe_embed_shim.js"></script>', $index);
+
         // Nested page: relative path climbs one level (../libs/...).
         $page = $fs->get_file($contextid, 'mod_exelearning', 'content', $revision, '/html/', 'page.html')->get_content();
         $this->assertStringContainsString('<script src="../libs/SCORM_API_wrapper.js"></script>', $page);
+        $this->assertStringContainsString('<script src="../libs/exe_embed_shim.js"></script>', $page);
 
         // Non-HTML asset is untouched.
         $css = $fs->get_file($contextid, 'mod_exelearning', 'content', $revision, '/css/', 'style.css')->get_content();
diff --git a/tests/player_iframe_test.php b/tests/player_iframe_test.php
new file mode 100644
index 0000000..ab55b4d
--- /dev/null
+++ b/tests/player_iframe_test.php
@@ -0,0 +1,167 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace mod_exelearning;
+
+use advanced_testcase;
+use mod_exelearning\local\ui\player_iframe;
+
+/**
+ * Tests for the package iframe security mode + sandbox policy (DEC-0059).
+ *
+ * @package    mod_exelearning
+ * @category   test
+ * @copyright  2026 ATE (Área de Tecnología Educativa)
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @covers     \mod_exelearning\local\ui\player_iframe
+ */
+final class player_iframe_test extends advanced_testcase {
+    /**
+     * The default (no config set) must be the secure, isolated mode.
+     */
+    public function test_default_mode_is_secure(): void {
+        $this->resetAfterTest();
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * An unset/invalid config must fail safe to secure, never weakening isolation.
+     */
+    public function test_invalid_mode_falls_back_to_secure(): void {
+        $this->resetAfterTest();
+        set_config('iframemode', 'not-a-real-mode', 'mod_exelearning');
+        $this->assertSame(player_iframe::MODE_SECURE, player_iframe::resolve_mode());
+        $this->assertTrue(player_iframe::is_secure());
+    }
+
+    /**
+     * The legacy fallback is honoured when explicitly configured.
+     */
+    public function test_legacy_mode_is_respected(): void {
+        $this->resetAfterTest();
+        set_config('iframemode', player_iframe::MODE_LEGACY, 'mod_exelearning');
+        $this->assertSame(player_iframe::MODE_LEGACY, player_iframe::resolve_mode());
+        $this->assertFalse(player_iframe::is_secure());
+    }
+
+    /**
+     * Secure mode runs in an opaque origin: it MUST drop allow-same-origin and
+     * allow-popups-to-escape-sandbox, and MUST keep the scripts/popups/forms the
+     * iDevices need. It must never grant top navigation or modals.
+     */
+    public function test_secure_sandbox_tokens(): void {
+        $tokens = player_iframe::sandbox_tokens(player_iframe::MODE_SECURE);
+        $list = explode(' ', $tokens);
+
+        $this->assertContains('allow-scripts', $list);
+        $this->assertContains('allow-popups', $list);
+        $this->assertContains('allow-forms', $list);
+
+        $this->assertNotContains('allow-same-origin', $list);
+        $this->assertNotContains('allow-popups-to-escape-sandbox', $list);
+        $this->assertNotContains('allow-top-navigation', $list);
+        $this->assertNotContains('allow-top-navigation-by-user-activation', $list);
+        $this->assertNotContains('allow-modals', $list);
+    }
+
+    /**
+     * Legacy mode keeps the historical same-origin tokens (incl. allow-same-origin
+     * and allow-popups-to-escape-sandbox) but still never grants top navigation or
+     * modals.
+     */
+    public function test_legacy_sandbox_tokens(): void {
+        $tokens = player_iframe::sandbox_tokens(player_iframe::MODE_LEGACY);
+        $list = explode(' ', $tokens);
+
+        $this->assertContains('allow-scripts', $list);
+        $this->assertContains('allow-same-origin', $list);
+        $this->assertContains('allow-popups', $list);
+        $this->assertContains('allow-forms', $list);
+        $this->assertContains('allow-popups-to-escape-sandbox', $list);
+
+        $this->assertNotContains('allow-top-navigation', $list);
+        $this->assertNotContains('allow-modals', $list);
+    }
+
+    /**
+     * Permissions-Policy denies sensors/hardware but never fullscreen (the iframe
+     * grants it and iDevices use it).
+     */
+    public function test_permissions_policy(): void {
+        $pp = player_iframe::permissions_policy();
+        $this->assertStringContainsString('camera=()', $pp);
+        $this->assertStringContainsString('microphone=()', $pp);
+        $this->assertStringContainsString('geolocation=()', $pp);
+        $this->assertStringNotContainsString('fullscreen', $pp);
+    }
+
+    /**
+     * The CSP hardens object/base/framing and pins connect-src to this site (so the
+     * file token cannot be fetch-exfiltrated), while keeping the inline/eval scripts
+     * eXeLearning needs. The passed site origin must appear in the source lists.
+     */
+    public function test_content_security_policy(): void {
+        $origin = 'https://moodle.example.net';
+        $csp = player_iframe::content_security_policy($origin);
+
+        $this->assertStringContainsString("object-src 'none'", $csp);
+        $this->assertStringContainsString("base-uri 'none'", $csp);
+        $this->assertStringContainsString("frame-ancestors 'self'", $csp);
+        // A sandbox directive keeps the document opaque even when opened outside the
+        // iframe (e.g. the token URL opened in a new tab), so author JS cannot run as
+        // Moodle's origin. Tokens mirror the secure iframe sandbox.
+        $this->assertStringContainsString('sandbox allow-scripts allow-popups allow-forms', $csp);
+        $this->assertStringContainsString("connect-src 'self' $origin;", $csp);
+        // Inline + eval'd scripts are required by the eXeLearning engine.
+        $this->assertStringContainsString("'unsafe-inline'", $csp);
+        $this->assertStringContainsString("'unsafe-eval'", $csp);
+        // The connect-src must NOT open to the bare `https:` wildcard (any host) — that
+        // would let the file token be exfiltrated. The explicit site origin
+        // (https://host) is fine; the negative lookahead excludes `https://...`.
+        $this->assertDoesNotMatchRegularExpression('~connect-src[^;]*\bhttps:(?!//)~', $csp);
+    }
+
+    /**
+     * content_headers() emits Referrer-Policy + nosniff on every secure-mode file and adds
+     * the document-level CSP + Permissions-Policy for an HTML document, deriving the CSP
+     * origin from $CFG->wwwroot (path stripped). Legacy mode emits nothing.
+     */
+    public function test_content_headers(): void {
+        $this->resetAfterTest();
+
+        // Secure (default) + HTML document: all four headers, origin stripped from wwwroot.
+        $headers = player_iframe::content_headers('index.html', 'https://moodle.example.net/sub');
+        $this->assertArrayHasKey('Content-Security-Policy', $headers);
+        $this->assertArrayHasKey('Permissions-Policy', $headers);
+        $this->assertSame('no-referrer', $headers['Referrer-Policy']);
+        $this->assertSame('nosniff', $headers['X-Content-Type-Options']);
+        $this->assertStringContainsString("'self' https://moodle.example.net;", $headers['Content-Security-Policy']);
+        $this->assertStringNotContainsString('/sub', $headers['Content-Security-Policy']);
+
+        // Secure + non-HTML subresource: the per-file token-protection headers still apply
+        // (the token rides in the URL of CSS/JS too), but not the document-level CSP.
+        $sub = player_iframe::content_headers('libs/base.css', 'https://moodle.example.net');
+        $this->assertSame('no-referrer', $sub['Referrer-Policy']);
+        $this->assertSame('nosniff', $sub['X-Content-Type-Options']);
+        $this->assertArrayNotHasKey('Content-Security-Policy', $sub);
+        $this->assertArrayNotHasKey('Permissions-Policy', $sub);
+
+        // Legacy mode: no headers regardless of file type.
+        set_config('iframemode', player_iframe::MODE_LEGACY, 'mod_exelearning');
+        $this->assertSame([], player_iframe::content_headers('index.html', 'https://moodle.example.net'));
+    }
+}
diff --git a/tools/check-embed-sync.mjs b/tools/check-embed-sync.mjs
new file mode 100644
index 0000000..1bfadc1
--- /dev/null
+++ b/tools/check-embed-sync.mjs
@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+// Maintenance helper: verify the external-embed shim/relay logic stays in sync across
+// the three eXeLearning embedders. mod_exelearning is the CANONICAL source; wp-exelearning
+// and omeka-s-exelearning mirror it -- only the export wrapper differs (mod is dual-export
+// for Vitest; wp/omeka are auto-running IIFEs). This is NOT a CI gate (there is no shared
+// infra across the three repos); it is a local check to run before/after touching the
+// embedder. Exits non-zero when a copy has drifted (a required invariant is missing).
+//
+// Usage (mirror paths via flags or WP_EXE_DIR / OMEKA_EXE_DIR env vars):
+//   node tools/check-embed-sync.mjs --wp /path/to/wp-exelearning --omeka /path/to/omeka-s-exelearning
+// With no mirror paths it only sanity-checks the canonical mod files and prints how to
+// point it at the mirrors.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MOD_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Parse --wp / --omeka flags, falling back to env vars. */
+function resolveMirrors() {
+    const args = process.argv.slice(2);
+    const get = (flag) => {
+        const i = args.indexOf(flag);
+        return i !== -1 && args[i + 1] ? args[i + 1] : null;
+    };
+    return {
+        wp: get('--wp') || process.env.WP_EXE_DIR || null,
+        omeka: get('--omeka') || process.env.OMEKA_EXE_DIR || null,
+    };
+}
+
+// Logic invariants every RELAY copy must contain (normalised: whitespace + quote style
+// are ignored, so tabs-vs-spaces and the IIFE wrapper do not count as drift).
+const RELAY_INVARIANTS = [
+    'isCrossOriginHttps',                  // open-mode structural invariant (DEC-0061)
+    'normalizeHost',                       // trailing-dot FQDN-root normalisation (no host. bypass)
+    'url.origin === window.location.origin', // cross-origin gate (rejects same-origin)
+    'allow-scripts allow-same-origin allow-popups allow-forms allow-presentation', // video sandbox
+    'data-exe-embed-player',              // forged-message defence (D2)
+    'data-exe-embed-src',                 // the page-navigation (id-reuse) fix
+    'Math.min(embed.w, rect.width)',      // overlay clamp (clickjacking defence)
+    'youtube-nocookie.com/embed/',        // strict-mode per-provider reconstruction
+];
+
+// Logic invariants every SHIM copy must contain.
+const SHIM_INVARIANTS = [
+    'isCrossOriginHttps',                 // promote any cross-origin https iframe
+    'data-exe-embed-id',
+    'data-exe-embed-url',
+    '.pdf$',                              // the PDF detector (promote PDFs too)
+];
+
+// Host + token + setting invariants every sandbox PHP must contain.
+const PHP_INVARIANTS = [
+    'www.dailymotion.com',
+    'mediateca.educa.madrid.org',
+    'allow-scripts allow-popups allow-forms', // secure tokens (normalised, order matters)
+    'embedmode',                          // the open/strict embed policy setting (DEC-0061)
+];
+
+const FILES = {
+    relay: { mod: 'js/exe_embed_relay.js', wp: 'assets/js/exe-embed-relay.js', omeka: 'asset/js/exe-embed-relay.js', invariants: RELAY_INVARIANTS },
+    shim: { mod: 'js/exe_embed_shim.js', wp: 'assets/js/exe-embed-shim.js', omeka: 'asset/js/exe-embed-shim.js', invariants: SHIM_INVARIANTS },
+    php: { mod: 'classes/local/ui/player_iframe.php', wp: 'includes/class-iframe-sandbox.php', omeka: 'src/Service/IframeSandbox.php', invariants: PHP_INVARIANTS },
+};
+
+const norm = (s) => s.replace(/\s+/g, '').replace(/'/g, '"');
+
+function check(label, absPath, invariants) {
+    if (!fs.existsSync(absPath)) {
+        return { label, path: absPath, missing: ['<file not found>'] };
+    }
+    const body = norm(fs.readFileSync(absPath, 'utf8'));
+    const missing = invariants.filter((inv) => body.indexOf(norm(inv)) === -1);
+    return { label, path: absPath, missing };
+}
+
+function main() {
+    const mirrors = resolveMirrors();
+    const roots = { mod: MOD_ROOT, wp: mirrors.wp, omeka: mirrors.omeka };
+    const results = [];
+
+    for (const [kind, spec] of Object.entries(FILES)) {
+        for (const repo of ['mod', 'wp', 'omeka']) {
+            if (!roots[repo]) { continue; }
+            results.push(check(`${repo}:${kind}`, path.join(roots[repo], spec[repo]), spec.invariants));
+        }
+    }
+
+    let drift = 0;
+    for (const r of results) {
+        if (r.missing.length) {
+            drift++;
+            console.error(`DRIFT  ${r.label}  (${r.path})`);
+            r.missing.forEach((m) => console.error(`         missing: ${m}`));
+        } else {
+            console.log(`ok     ${r.label}`);
+        }
+    }
+
+    if (!mirrors.wp || !mirrors.omeka) {
+        console.log('\nNote: pass --wp <dir> --omeka <dir> (or set WP_EXE_DIR / OMEKA_EXE_DIR)');
+        console.log('to also check the wp-exelearning and omeka-s-exelearning mirrors.');
+    }
+    if (drift) {
+        console.error(`\n${drift} file(s) drifted from the canonical embedder logic.`);
+        process.exit(1);
+    }
+    console.log('\nNo drift detected.');
+}
+
+main();
diff --git a/view.php b/view.php
index e76f3df..2cffb9b 100644
--- a/view.php
+++ b/view.php
@@ -103,6 +103,23 @@
             'index.html'
         );
     }
+    // Self-heal the secure-mode bridge client (DEC-0060) into packages extracted
+    // before it existed: if index.html is present but libs/exe_scorm_bridge.js is not,
+    // re-extract once so the bridge scripts are copied and injected. Idempotent and
+    // bounded (only fires until the file exists).
+    if ($mainfile) {
+        $hasbridge = $fs->get_file(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            (int) $exelearning->revision,
+            '/libs/',
+            'exe_scorm_bridge.js'
+        );
+        if (!$hasbridge) {
+            exelearning_extract_stored_package($context->id, (int) $exelearning->revision);
+        }
+    }
     // Self-heal grade-item detection, but only when this package revision has
     // not been scanned yet (gradesyncrev marker). This used to fire whenever the
     // activity had no gradable grade item, which for a content-only package
@@ -217,20 +234,52 @@
         );
     }
 } else {
-    $iframeurl = moodle_url::make_pluginfile_url(
-        $context->id,
-        'mod_exelearning',
-        'content',
-        (int) $exelearning->revision,
-        '/',
-        'index.html'
-    );
+    // Resolve the iframe security mode once (DEC-0060, corrects DEC-0059's Route A).
+    // Secure mode serves the package through tokenpluginfile.php so the opaque-origin
+    // iframe's subresources (CSS/JS/images) carry a per-user file token in the URL and
+    // load WITHOUT the SameSite session cookie (an opaque document never sends it).
+    // Secure mode is NOT silently downgraded to legacy: if it cannot render (e.g.
+    // slasharguments off, or a service-worker host that cannot serve an opaque iframe)
+    // the in-iframe shim never signals ready and the parent relay shows a
+    // "blocked by security configuration" notice (client-side watchdog), so an admin
+    // fixes it rather than the activity quietly running in the weaker same-origin mode.
+    $iframemode = \mod_exelearning\local\ui\player_iframe::resolve_mode();
+    $securemode = ($iframemode === \mod_exelearning\local\ui\player_iframe::MODE_SECURE);
+    if ($securemode) {
+        // Short-lived core_files key, rounded to the hour so it is reused (not
+        // regenerated per request). It only authorises file reads and
+        // exelearning_pluginfile() still enforces mod/exelearning:view, so the token
+        // grants strictly less than the same-origin sesskey it replaces.
+        $filetoken = get_user_key(
+            'core_files',
+            $USER->id,
+            null,
+            null,
+            (intdiv(time(), HOURSECS) + 2) * HOURSECS
+        );
+        $iframeurl = new moodle_url(
+            '/tokenpluginfile.php/' . $filetoken . '/' . $context->id .
+            '/mod_exelearning/content/' . (int) $exelearning->revision . '/index.html'
+        );
+    } else {
+        $iframeurl = moodle_url::make_pluginfile_url(
+            $context->id,
+            'mod_exelearning',
+            'content',
+            (int) $exelearning->revision,
+            '/',
+            'index.html'
+        );
+    }
     // Make the in-package teacher-layer selector available via the package's own URL
     // parameter (eXeLearning core hides teacher content by default and exposes a
-    // selector to show it with ?exe-teacher=1; see upstream exelearning#1772). This
-    // replaces the former CSS injection that hid the selector (mod_exeweb parity): the
-    // plugin no longer mutates the package. The per-activity teachermodevisible setting
-    // alone controls it — when on, the selector is offered to every viewer; no role gate.
+    // selector to show it with ?exe-teacher=1; see upstream exelearning#1772). It works
+    // in secure mode too: the parameter rides in the iframe src and the package reads
+    // its own location.search even under the opaque origin, so no host CSS injection is
+    // needed. This replaces the former CSS injection that hid the selector (mod_exeweb
+    // parity): the plugin no longer mutates the package. The per-activity
+    // teachermodevisible setting alone controls it — when on, the selector is offered to
+    // every viewer; no role gate.
     if (!empty($exelearning->teachermodevisible)) {
         $iframeurl->param('exe-teacher', '1');
     }
@@ -387,72 +436,137 @@
             );
         }
     }
-    // SCORM 1.2 shim: injects window.API into the parent window of the iframe.
-    // pipwerks SCORM (used by eXeLearning v4 iDevices) calls `findAPI()`,
-    // walking `window.parent` looking for an `API` object with `LMSInitialize`.
-    // If not found, the iDevice shows "This page is not part of a SCORM package".
-    // Minimal viable implementation: buffers CMI pairs and sends them to
-    // track.php on LMSCommit/LMSFinish.
+    // SCORM 1.2 client. eXeLearning v4 iDevices use pipwerks SCORM, which calls
+    // findAPI() looking for an `API` object with LMSInitialize. How that API is
+    // provided depends on the configured iframe security mode (DEC-0059). In secure
+    // mode (the default) the package runs in an opaque-origin sandboxed iframe and
+    // CANNOT reach this page: window.API lives INSIDE the iframe (baked bridge shim,
+    // libs/exe_scorm_bridge.js) and scoring is relayed here over a validated postMessage
+    // channel, with this parent only forwarding it to track.php so the sesskey stays on
+    // the trusted side. In legacy mode the package is same-origin, window.API is injected
+    // here in the parent, and the iframe's pipwerks walks window.parent to find it.
     // One page-load token groups all of this view's commits into a single attempt,
     // shared by whichever channel grades (DEC-0007).
     $sessiontoken = random_string(20);
-    // Channel choice (DEC-0064): a package that bundles the upstream xAPI emitter grades
-    // via xAPI; the SCORM shim stays alive (so pipwerks finds window.API and the iDevices
-    // still run and emit their statements) but inert (it never POSTs to track.php). A
-    // legacy package without the emitter keeps SCORM grading exactly as before. The
-    // site-wide master switch (exelearning_xapi_primary_enabled) can force every package
-    // back onto SCORM without a code change.
+    // Channel choice (DEC-0064, extended to secure mode by DEC-0065): a package that
+    // bundles the upstream xAPI emitter is graded via xAPI in BOTH iframe modes; the SCORM
+    // shim stays alive (so pipwerks finds window.API and the iDevices run and emit their
+    // statements) but inert, so the two channels never double-count. In legacy mode the
+    // SCORM tracker runs in this parent with disableTracking and the xAPI listener trusts a
+    // statement by event.origin === host origin (same-origin). In secure mode the package
+    // is opaque (event.origin is "null"), so the bridge relay drops the SCORM POST and the
+    // xAPI listener trusts a statement by window identity (event.source === the iframe),
+    // mirroring the SCORM bridge relay.
+    // A legacy package without the emitter keeps SCORM grading exactly as before. The
+    // site-wide master switch (exelearning_xapi_primary_enabled) forces every package back
+    // onto SCORM without a code change.
     $emitsxapi = exelearning_xapi_primary_enabled()
             && exelearning_package_emits_xapi($context->id, (int) $exelearning->revision);
-
     $trackurl = (new moodle_url(
         '/mod/exelearning/track.php',
         ['id' => $cm->id, 'sesskey' => sesskey(), 'mode' => $mode]
     ))->out(false);
-    // The tracker logic is a single source of truth in js/scorm_tracker.js, also
-    // unit-tested with Vitest (tests/js/scorm_tracker.test.js). It is injected inline
-    // (not as an AMD module) so window.API is defined synchronously before the package
-    // iframe's pipwerks findAPI() runs — an async AMD load would race the SCO and break
-    // grading. Config (cmid, track URL, per-page attempt token) is passed as JSON to the
-    // createScormApi() factory instead of string-substituted placeholders.
-    $scormcfg = json_encode(
-        [
+
+    // Emit an inline <script> that loads a bundled js/ module and boots it. Centralises
+    // the HTML-hardening JSON flags, the js/ path and the "\n(function () { ... })();"
+    // boot wrapper shared by the SCORM and embed clients below (so a fourth client, or a
+    // change to the hardening flags, has a single home). %s in $boot is replaced by the
+    // encoded config. Injected inline so each listener is installed before the iframe
+    // loads — an async AMD load would race the SCO/embeds.
+    $emitinlinemodule = function (string $jsfile, array $cfg, string $boot): void {
+        $json = json_encode($cfg, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+        $js = file_get_contents(__DIR__ . '/js/' . $jsfile);
+        echo html_writer::tag('script', $js . "\n(function () { " . sprintf($boot, $json) . " })();");
+    };
+
+    // Both $iframemode and $securemode were resolved above so the SCORM client, the
+    // sandbox tokens and the content URL all agree.
+    if ($securemode) {
+        // Parent-side bridge relay (js/scorm_bridge_relay.js, also unit-tested with
+        // Vitest). Injected inline so its message listener is installed before the
+        // iframe loads and emits its first message. It validates each message by
+        // window identity (event.source === iframe.contentWindow), a closed action
+        // list and a per-view nonce, then performs the authenticated track.php POST
+        // (and a sendBeacon flush on pagehide). The nonce and the per-page attempt token
+        // are handed to the in-iframe shim during the handshake; the sesskey is NEVER
+        // sent across the bridge. blockedid points at
+        // the hidden notice the relay reveals (watchdog) if the iframe never signals
+        // ready, i.e. the secure mode could not render here.
+        $emitinlinemodule('scorm_bridge_relay.js', [
+            'iframeid' => 'exelearningobject',
             'cmid' => (int) $cm->id,
             'trackurl' => $trackurl,
             'session' => $sessiontoken,
-            // Inert SCORM shim for xAPI-primary packages (DEC-0064).
+            'nonce' => random_string(32),
+            'blockedid' => 'exelearning-secure-blocked',
+            // Inert under xAPI-primary (DEC-0065): keep the bridge live (window.API,
+            // handshake, watchdog) but forward no SCORM score; the package is graded via
+            // the xAPI listener below.
             'disableTracking' => $emitsxapi,
-        ],
-        JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
-    );
-    $trackerjs = file_get_contents(__DIR__ . '/js/scorm_tracker.js');
-    $bootjs = "\n(function () { window.API = window.exeScormTracker.createScormApi($scormcfg).api; })();";
-    echo html_writer::tag('script', $trackerjs . $bootjs);
+        ], 'window.exeScormBridge.init(%s);');
+    } else {
+        // Legacy same-origin: host window.API in this parent window. The tracker logic
+        // is the single source of truth in js/scorm_tracker.js, also unit-tested with
+        // Vitest (tests/js/scorm_tracker.test.js). It is injected inline (not as an AMD
+        // module) so window.API is defined synchronously before the package iframe's
+        // pipwerks findAPI() runs — an async AMD load would race the SCO and break
+        // grading. Config (cmid, track URL, per-page attempt token) is passed as JSON
+        // to the createScormApi() factory instead of string-substituted placeholders.
+        // disableTracking makes the shim inert for an xAPI-primary package (DEC-0064):
+        // window.API still answers pipwerks so the iDevices run and emit statements, but
+        // it never POSTs to track.php, leaving xAPI as the sole grade channel. The secure
+        // bridge relay above is made inert the same way (DEC-0065); see $emitsxapi.
+        $emitinlinemodule('scorm_tracker.js', [
+            'cmid' => (int) $cm->id,
+            'trackurl' => $trackurl,
+            'session' => $sessiontoken,
+            'disableTracking' => $emitsxapi,
+        ], 'window.API = window.exeScormTracker.createScormApi(%s).api;');
+    }
+
+    // Parent-side external-embed relay (js/exe_embed_relay.js). Independent of SCORM:
+    // in secure mode every package is opaque, so whitelisted video iframes and PDFs are
+    // promoted to this page and overlaid inline as real players (the baked shim reports
+    // their geometry). Inlined like the SCORM relay so its listener is installed before
+    // the iframe loads. No-op in legacy mode (same-origin: external players already work
+    // inline and the in-iframe shim stays dormant).
+    if ($securemode) {
+        // The relay only consults the host whitelist in 'strict' mode; in the default
+        // 'open' mode any cross-origin https iframe is promoted, so don't build/ship it.
+        $embedmode = \mod_exelearning\local\ui\player_iframe::embed_mode();
+        $embedstrict = ($embedmode === \mod_exelearning\local\ui\player_iframe::EMBED_STRICT);
+        $emitinlinemodule('exe_embed_relay.js', [
+            'mode' => $embedmode,
+            'whitelist' => $embedstrict ? \mod_exelearning\local\ui\player_iframe::embed_whitelist() : [],
+        ], 'window.exeEmbedRelay.init(%s);');
+    }
 
-    // The xAPI listener (DEC-0064): for an xAPI-capable package, receive the emitter's
-    // exe-xapi-statement postMessages in this parent page, validate the origin and
-    // forward each to xapi_track.php. Same inline single-source-of-truth pattern as the
-    // SCORM tracker (js/xapi_listener.js, Vitest-tested). It shares $sessiontoken as the
-    // xAPI registration so every statement of this view maps to the same attempt.
+    // The xAPI listener (DEC-0064; secure mode added by DEC-0065): for an xAPI-capable
+    // package, receive the emitter's exe-xapi-statement postMessages in this parent page
+    // and forward each to xapi_track.php (the sesskey stays on this trusted side). Same
+    // inline single-source-of-truth pattern as the SCORM tracker (js/xapi_listener.js,
+    // Vitest-tested). It shares $sessiontoken as the xAPI registration so every statement
+    // of this view maps to the same attempt. The trust gate depends on the iframe mode:
+    // legacy is same-origin so a statement is trusted by event.origin === host origin;
+    // secure is opaque (event.origin is "null"), so it is trusted by window identity
+    // (event.source === the iframe), exactly like the SCORM bridge relay above.
     if ($emitsxapi) {
         $xapitrackurl = (new moodle_url(
             '/mod/exelearning/xapi_track.php',
             ['id' => $cm->id, 'sesskey' => sesskey(), 'mode' => $mode]
         ))->out(false);
-        $hostorigin = preg_replace('~^(https?://[^/]+).*~', '$1', $CFG->wwwroot);
-        $xapicfg = json_encode(
-            [
-                'cmid' => (int) $cm->id,
-                'trackurl' => $xapitrackurl,
-                'registration' => $sessiontoken,
-                'mode' => $mode,
-                'allowedOrigin' => $hostorigin,
-            ],
-            JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
-        );
-        $listenerjs = file_get_contents(__DIR__ . '/js/xapi_listener.js');
-        $listenerboot = "\n(function () { window.exeXapiListener.createListener($xapicfg).start(); })();";
-        echo html_writer::tag('script', $listenerjs . $listenerboot);
+        $xapicfg = [
+            'cmid' => (int) $cm->id,
+            'trackurl' => $xapitrackurl,
+            'registration' => $sessiontoken,
+            'mode' => $mode,
+        ];
+        if ($securemode) {
+            $xapicfg['iframeid'] = 'exelearningobject';
+        } else {
+            $xapicfg['allowedOrigin'] = preg_replace('~^(https?://[^/]+).*~', '$1', $CFG->wwwroot);
+        }
+        $emitinlinemodule('xapi_listener.js', $xapicfg, 'window.exeXapiListener.createListener(%s).start();');
     }
 
     // Fullscreen control (issue #13 #6, DEC-0024): a right-aligned button above the
@@ -475,16 +589,23 @@
     );
     $PAGE->requires->js_call_amd('mod_exelearning/fullscreen', 'init', ['exelearningobject']);
 
-    // Package iframe. Sandbox policy documented in AN-008:
-    // allow-scripts: eXeLearning v4 uses jQuery + iDevice JS.
-    // allow-same-origin: relative paths to pluginfile.php/.../content/<rev>/
-    // and future postMessage to the xAPI endpoint.
-    // allow-popups: interactive-video, hidden-image, etc.
-    // allow-forms: quick-questions, form, scrambled-list, etc.
-    // allow-popups-to-escape-sandbox: popups load without restrictions.
-    // Explicitly BLOCKED (not included):
-    // allow-top-navigation: a malicious package must not change the parent URL.
-    // allow-modals: no alert/confirm/prompt, they are UX interruptions.
+    // Hidden notice the relay's watchdog reveals if the secure-mode iframe never
+    // signals ready (e.g. an environment that cannot serve an opaque-origin iframe,
+    // such as a PHP-WASM service-worker host). Secure mode is never silently
+    // downgraded to the weaker same-origin mode (DEC-0060).
+    if ($securemode) {
+        echo html_writer::div(
+            get_string('securemodeblocked', 'mod_exelearning'),
+            'alert alert-warning',
+            ['id' => 'exelearning-secure-blocked', 'role' => 'alert', 'style' => 'display:none;']
+        );
+    }
+
+    // Package iframe. The sandbox token list depends on the configured iframe
+    // security mode (\mod_exelearning\local\ui\player_iframe, DEC-0059). Both modes
+    // omit allow-top-navigation (a package must not change the parent URL) and
+    // allow-modals; secure mode also omits allow-same-origin (opaque origin, so the
+    // package cannot reach this page) and allow-popups-to-escape-sandbox.
     echo html_writer::tag('iframe', '', [
         'src'    => $iframeurl->out(false),
         'name'   => 'exelearningobject',
@@ -493,14 +614,15 @@
         'width'  => '100%',
         'height' => '650',
         'allow'  => 'fullscreen',
-        'sandbox' => 'allow-scripts allow-same-origin allow-popups allow-forms allow-popups-to-escape-sandbox',
+        'sandbox' => \mod_exelearning\local\ui\player_iframe::sandbox_tokens($iframemode),
         'style'  => 'border: 1px solid var(--bs-border-color, #dee2e6); border-radius: .5rem;',
     ]);
 
     // Teacher-only content is hidden by default inside the eXeLearning package and
     // revealed via the ?exe-teacher=1 URL parameter appended to the iframe src above
-    // when the teachermodevisible setting is on. The plugin no longer injects CSS into
-    // the package to hide the teacher-layer selector (mod_exeweb parity retired).
+    // when the teachermodevisible setting is on (legacy and secure mode alike). The
+    // plugin no longer injects CSS into the package to hide the teacher-layer selector
+    // (mod_exeweb parity retired), and the SCORM bridge no longer carries the flag.
 }
 
 echo $OUTPUT->footer();
diff --git a/vitest.config.mjs b/vitest.config.mjs
index f160928..4fc803f 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -1,10 +1,10 @@
 import { defineConfig } from 'vitest/config';
 
-// Vitest config for the plugin's own JavaScript unit tests. Scope is deliberately
-// narrow: only the grade-critical SCORM tracker (js/scorm_tracker.js). UI glue
-// (amd/src/fullscreen.js, resize.js, editor_modal.js, ...) and the vendored pipwerks
-// wrappers (assets/scorm/*) are out of scope. The embedded editor (exelearning/) ships
-// its own Vitest suite and is not retested here.
+// Vitest config for the plugin's own JavaScript unit tests. Scope: the grade-critical
+// SCORM tracker (js/scorm_tracker.js), the secure-mode SCORM bridge (js/scorm_bridge_*)
+// and the external-embed shim/relay (js/exe_embed_*). UI glue (amd/src/*) and the
+// vendored pipwerks wrappers (assets/scorm/*) are out of scope. The embedded editor
+// (exelearning/) ships its own Vitest suite and is not retested here.
 export default defineConfig({
     test: {
         globals: true,