Limits
What Diwall does badly, and what it does not do at all. Written here rather than discovered against a production system at two in the morning.
Diwall does not suffer from missing features so much as from limits of use. Knowing where they are is what lets you place it correctly — and it is also how they get pushed back, one at a time.
Where it fits, and where it does not
| Task | Suitable |
|---|---|
| Visual validation after a deployment | yes |
| Diagnosing a broken rendering | yes |
| Navigation and form filling, up to ~30 s | yes |
| Delegating a repetitive check | yes |
| Server operation of several minutes | no — see below |
| Bulk mutation | no — an API call is better |
| Anything requiring rollback | no — Diwall cannot undo |
The last line deserves emphasis: Diwall has no undo. It executes the list you wrote. A badly written scenario does real damage, at machine speed, and nothing in the tool will stop it.
Long operations
An operation lasting minutes fits badly. The timeout can be raised, but the
pattern stays one invocation and one final capture — you see the end, not the
middle. interval_capture gives you intermediate frames; it is a filmstrip,
not a live view.
Worse, a timeout on a slow mutating action does not mean it failed. The server keeps working after the client stops waiting. Retrying “cleanly” has already produced a second identical clone.
What perception does not reach
Inside an iframe, there is no numbering. Set-of-Mark stops at the frame border. The two iframe actions cross it, but you supply the inner CSS selector yourself — and if the frame is cross-origin, you will not get it from the page.
A closed shadow root stays closed. --shadow-dom traverses open ones;
closed ones are closed by design, and no flag changes that.
Elements with no semantic representation — a clickable image, a canvas, a graphical zone — have nothing for the accessibility tree to expose. That is where a vision model becomes necessary rather than optional.
Where the honest answer is “not always”
WAF detection is keyword-based. It can flag a page that is not blocked.
It is reported as a count, never as a verdict, and --ignorer-waf exists for
when you have confirmed it is wrong.
Pixel comparison has a noise floor of about 0.19 %. Two renders of an unchanged page differ by that much. Any real change smaller than the floor is invisible to it.
A local vision model returns less than a hosted one. On a case where nothing had changed, it once returned an empty string rather than an explicit sentence — the verdict was right, the explanation absent, and nothing in the documentation covered that case at the time.
Set-of-Mark numbers are per capture. They are not stable across sessions,
and a page that mutates between capture and click can move them. Since v1.24.0
the resolver is hybrid and reports the drift in boussole.respect.som_derive_detectee
instead of clicking the wrong element silently — but pinning a number still
requires capturing Set-of-Mark inside the same scenario first.
Two limits that are choices, not gaps
These will not be fixed, because fixing them would break something worth more.
Your first run fails until the guide is read. Deliberate. It is the answer to a documented security incident, and removing it would restore the incident. What the lock asks of an agent →
Declared identity closes doors. --stealth exists and is yours to use; the
default stays honest. What that costs is measured below rather than asserted.
What declared identity costs, measured
On 27 June 2026, an ordinary purchase search across francophone commercial
sites — not a synthetic panel assembled to make a point. Diwall v1.14.0,
before --stealth existed.
| Outcome | Sites | Share of the panel |
|---|---|---|
| Blocked, HTTP 403 (WAF) | 9 | 39 % |
| Timeout, no HTTP response | 6 | 26 % |
| 404, guessed URL wrong | 5 | 22 % |
| Accessible, content returned | 2 | 8.7 % |
23 sites were targeted; 22 results were recorded. The outcome of the twenty-third was never written down, and the list of URLs was not kept either, so it cannot be recovered. The shares above are shares of the panel targeted, which is why they stop at 95.7 % rather than 100. We would rather publish the gap than round it away.
The two sites that answered were server-rendered with no WAF in front of them. The blocked ones were large retailers and refurbished-goods marketplaces.
What no flag in this project changes
Diwall does not defeat TLS fingerprinting (JA3/JA4), and it does not defeat behavioural analysis by a commercial anti-bot service.
--stealth clears basic browser fingerprint checks — 31 checks passed with
it, against 18 without on a public benchmark — and that is the whole of its
claim. A persistent 403 after that means deep fingerprinting, and nothing here
will move it.
Saying so costs nothing. Discovering it during a task costs an evening.
And what it does not claim
Diwall is no more careful than the scenario you give it. It does not verify your intent, it does not guess what you meant, and it does not stop before something irreversible.
Everything else on this site describes what it perceives. This page is about what it cannot — and both are needed to decide whether to give a browser to an agent.