[macOS][Codex Desktop][In-app Browser] Multiple TinyMCE iframes emit MutationObserver non-Node errors

What version is affected?

• ChatGPT/Codex Desktop: 26.803.41515 (build 6321)
• Browser plugin: 26.803.41515
• macOS 26.5.2, arm64

What issue are you seeing?

A localhost response form that mounts eight TinyMCE editors produces seven identical uncaught exceptions in the Codex in-app Browser:

Uncaught TypeError: Failed to execute 'observe' on 'MutationObserver':
parameter 1 is not of type 'Node'.

The editors still render, but the console is polluted and Browser-based production-readiness checks report false failures.

The same authenticated route was loaded twice in connected Chrome. All eight editor iframes rendered and both Chrome runs had a clean console.

A single-editor version of the form produces no exception in the in-app Browser. The 8-editor / 7-error pattern suggests iframe instrumentation is failing for each additional child frame.

Steps to reproduce

1. Start a localhost page that mounts eight TinyMCE iframe editors simultaneously.
2. Open it with the Codex in-app Browser.
3. Wait for all editors to initialize without running locator queries.
4. Read Browser console errors.
5. Observe seven identical MutationObserver.observe() non-Node exceptions.
6. Load the same page in connected Chrome and observe eight editor iframes with no console errors.

Source-level evidence

• The application route itself creates no MutationObserver.
• TinyMCE 7.3.0 and @tinymce/tinymce-svelte 3.0.0 contain no MutationObserver occurrence.
• The installed Browser bundle contains one observer, in the injected Playwright script's _setupGlobalListenersRemovalDetection():

new MutationObserver(callback).observe(this.document, { childList: true })

The Browser logger exposes only level, message, and timestamp, so it does not provide a source URL or stack trace. The bundle is a generated proprietary cache artifact with no source map or regression tests, so it was not patched locally.

Expected behavior

Multiple iframe editors should initialize without instrumentation-originated page console exceptions. Genuine page-originated observer exceptions should remain visible.

Suggested fix and regression coverage

• Resolve the observer target from the iframe's current document and use that frame's MutationObserver constructor.
• Verify the frame is still attached and the target is a live Node in that realm before observing.
• Skip/retry when the iframe document is being replaced, and disconnect when it detaches.
• Cover one iframe, eight simultaneous iframes, dynamic attachment, document replacement, and rapid detachment.