@@ -1809,15 +1809,23 @@ it.effect("closing a tab with an unsaved-changes guard still closes it", () =>
 it.effect("a tab whose renderer crashes stays open instead of vanishing", () =>
   Effect.scoped(
     Effect.gen(function* () {
-      const { broker, tabId } = yield* ready;
-      contexts[0]!.page.emit("crash");
+      const { browser, broker, tabId } = yield* ready;
+      const url = "https://example.com/app";
+      contexts[0]!.page.commit(url);
+      yield* Effect.promise(() => contexts[0]!.page.emitAsync("crash"));
       const status = yield* broker.invoke<PreviewAutomationStatus>({
         scope,
         tabId,
         operation: "status",
         input: {},
       });
       expect(status.tabId).toBe(tabId);
+      expect(status.loadError).toEqual({ url, code: -2, description: "Page crashed" });
+      // The crashed page cannot load anything again, so Reload goes to the page that replaced it.
+      const viewer = yield* browser.attachViewer(viewerInput(tabId, true));
+      yield* viewer.input({ type: "takeControl" });
+      yield* viewer.input({ type: "reload" });
+      expect(contexts[1]!.page.goto).toHaveBeenCalledWith(url, expect.anything());
     }),
   ).pipe(Effect.provide(layer)),
 );
 
@@ -377,6 +377,8 @@ interface ServerTab {
   desktopResize: PromiseWithResolvers<void>;
   loading: boolean;
   loadError: PreviewAutomationLoadError | undefined;
+  /** The renderer crash this page died of, or the one the page it replaced died of. */
+  crash: PreviewAutomationLoadError | undefined;
   closing: boolean;
   recording: Recording | null;
   initialNavigation: Promise<void> | null;
@@ -586,6 +588,34 @@ const make = Effect.gen(function* () {
     },
   });
 
+  // Playwright cannot reload a crashed page, so a fresh page takes over its tab.
+  const reopenCrashedTab = async (tab: ServerTab) => {
+    if (tab.desktop) return dropTab(tab, true);
+    if (tabs.get(tabKey(tab.threadId, tab.tabId)) !== tab) return;
+    tab.crash = {
+      url: ServerBrowserPage.withoutDataPayload(tab.page.url()).slice(0, 2048),
+      code: -2,
+      description: "Page crashed",
+    };
+    // The session must name the crash before a new page reads it, or it would load the URL again.
+    await runPromise(
+      manager
+        .reportStatus({
+          threadId: tab.threadId,
+          tabId: tab.tabId,
+          serverControlled: true,
+          navStatus: { _tag: "LoadFailed", title: "", ...tab.crash },
+          canGoBack: false,
+          canGoForward: false,
+        })
+        .pipe(Effect.ignore),
+    );
+    dropTab(tab, false, true);
+    // A context that is still closing would take the new page down with it.
+    if (tab.isolatedContext) await tab.page.context().close().catch(constVoid);
+    await runPromise(findTab(tab.threadId, tab.tabId).pipe(Effect.ignore));
+  };
+
   const dialogStatus = (tab: ServerTab) =>
     tab.dialog
       ? {
@@ -638,6 +668,8 @@ const make = Effect.gen(function* () {
       .send("Page.getNavigationHistory")
       .catch(() => null)
       .then((history) => {
+        // A status the dead page still had in flight must not replace the crash.
+        if (tab.crash) return;
         const index = history?.currentIndex ?? 0;
         const count = history?.entries.length ?? 0;
         runFork(
@@ -832,15 +864,16 @@ const make = Effect.gen(function* () {
     clearTimeout(timeout);
   };
 
-  const dropTab = (tab: ServerTab, closeSession: boolean) => {
+  const dropTab = (tab: ServerTab, closeSession: boolean, reopening = false) => {
     const key = tabKey(tab.threadId, tab.tabId);
     if (tabs.get(key) !== tab) return;
     tabs.delete(key);
     tab.closing = true;
     tab.viewerAttached?.resolve();
     clearAbortedNavigation(tab);
     // A desktop page outlives the connection unless its session closed with it.
-    const end = tab.desktop && !closeSession && sessionOpen(tab) ? "reconnect" : "gone";
+    const end =
+      (tab.desktop || reopening) && !closeSession && sessionOpen(tab) ? "reconnect" : "gone";
     for (const viewer of tab.viewers) viewer.push({ _tag: end });
     void tab.control.close().catch(constVoid);
     if (tab.desktop) void tab.desktop.close().catch(constVoid);
@@ -855,7 +888,8 @@ const make = Effect.gen(function* () {
       const forceClose = setTimeout(() => void page.close().catch(constVoid), PAGE_CLOSE_GRACE_MS);
       void closed.then(() => clearTimeout(forceClose));
       void page
-        .close({ runBeforeUnload: tab.dialog === null })
+        // A crashed page never answers `beforeunload`, so that close would not finish.
+        .close({ runBeforeUnload: tab.dialog === null && tab.crash === undefined })
         .catch(() => page.close())
         .catch(constVoid);
       if (tab.isolatedContext) void closed.then(() => page.context().close()).catch(constVoid);
@@ -1009,6 +1043,15 @@ const make = Effect.gen(function* () {
       desktopResize: Promise.withResolvers<void>(),
       loading: false,
       loadError: undefined,
+      // The page a crash left behind is blank; the session still names what crashed.
+      crash:
+        !desktop && !adopted && snapshot.navStatus._tag === "LoadFailed"
+          ? {
+              url: snapshot.navStatus.url,
+              code: snapshot.navStatus.code,
+              description: snapshot.navStatus.description,
+            }
+          : undefined,
       closing: false,
       recording: null,
       recordingStart: null,
@@ -1060,6 +1103,7 @@ const make = Effect.gen(function* () {
       clearAbortedNavigation(tab);
       tab.loading = true;
       tab.loadError = undefined;
+      tab.crash = undefined;
       if (stoppedInitialRequest) {
         tab.stoppedGeneration = tab.navigationGeneration;
         settleStoppedNavigation(tab, tab.navigationGeneration);
@@ -1158,14 +1202,13 @@ const make = Effect.gen(function* () {
     updateFileChooserInterception(tab);
     // Popups become tabs and keep `window.opener`, so sign-in popups can report back.
     page.on("popup", (popup) => void adoptPopup(tab, popup));
-    // Playwright cannot reload a crashed page, so it must leave the tab list.
     const key = tabKey(tab.threadId, tab.tabId);
     if (closedPendingTabs.delete(key)) {
       await control.close().catch(constVoid);
       throw new ServerBrowserTabNotFoundError({ threadId: tab.threadId, tabId: tab.tabId });
     }
     page.on("close", () => dropTab(tab, true));
-    page.on("crash", () => dropTab(tab, true));
+    page.on("crash", () => reopenCrashedTab(tab));
     tabs.set(key, tab);
     reportLiveTabs();
     // A desktop page navigates on its own and can finish loading before these listeners attach.
@@ -1828,6 +1871,7 @@ const make = Effect.gen(function* () {
   };
 
   const loadErrorOf = (tab: ServerTab): PreviewAutomationLoadError | undefined => {
+    if (tab.crash) return tab.crash;
     if (!tab.page.url().startsWith("chrome-error://")) return undefined;
     // A desktop failure from before CDP attached is superseded by any navigation we observe.
     if (tab.loadError || !tab.desktop || tab.navigationGeneration > 0) return tab.loadError;
@@ -2908,6 +2952,10 @@ const make = Effect.gen(function* () {
       }
       case "reload":
         tab.pendingInitialRequestUrl = null;
+        if (tab.crash) {
+          tab.control.trackUntilHandoff(tab.page.goto(tab.crash.url, VIEWER_NAVIGATION_OPTIONS));
+          return;
+        }
         if (message.ignoreCache === true) {
           await session.send("Page.reload", { ignoreCache: true });
           return;
 
@@ -99,6 +99,9 @@ export class ServerBrowserContexts {
         "--disable-gpu",
         "--force-device-scale-factor=2",
         "--disable-blink-features=AutomationControlled",
+        // The headless shell binds no BadgeService for service workers and would kill the
+        // renderer of any site whose worker calls navigator.setAppBadge.
+        "--disable-kill-after-bad-ipc",
       ],
       ignoreDefaultArgs: ["--enable-automation"],
       headless: true,