screenshotWithAccessibilityLabels fails on some sites (Unable to adopt element handle from a different document)

Summary

On at least one public website (URL redacted), Playwriter's accessibility helpers behave inconsistently:

• accessibilitySnapshot({ page }) returns an empty string (0 chars)
• screenshotWithAccessibilityLabels({ page }) throws: page.evaluate: Unable to adopt element handle from a different document

A regular Playwright screenshot works fine (await page.screenshot(...)) and getCleanHTML({ locator: page.locator("body") }) returns a large/expected DOM, so the page is loaded/rendered.

Reproduction (MCP execute)

1. Enable the Playwriter extension on any tab (icon turns green).
2. Run:

const TARGET_URL = "https://<redacted>";

await page.goto(TARGET_URL, { waitUntil: "domcontentloaded" });
await waitForPageLoad({ page, timeout: 15000 });

const a11y = await accessibilitySnapshot({ page });
console.log("a11y chars:", a11y.length);

await screenshotWithAccessibilityLabels({ page });

Also reproducible on a fresh page (to avoid cross-session interference):

const TARGET_URL = "https://<redacted>";

state.myPage = await context.newPage();
await state.myPage.goto(TARGET_URL, { waitUntil: "domcontentloaded" });
await waitForPageLoad({ page: state.myPage, timeout: 15000 });

const a11y = await accessibilitySnapshot({ page: state.myPage });
console.log("a11y chars:", a11y.length);

await screenshotWithAccessibilityLabels({ page: state.myPage });

Expected

• accessibilitySnapshot returns a non-empty tree
• screenshotWithAccessibilityLabels returns a screenshot + snapshot without throwing

Actual

• accessibilitySnapshot returns "" (0 chars)
• screenshotWithAccessibilityLabels throws:

page.evaluate: Unable to adopt element handle from a different document
    at showAriaRefLabels (.../node_modules/playwriter/dist/aria-snapshot.js:657:35)
    at async screenshotWithAccessibilityLabels (.../node_modules/playwriter/dist/aria-snapshot.js:902:38)

Notes / Clues

• In the relay log, the exception happens after a bunch of DOM.resolveNode calls that return { object: { subtype: "null", value: null } } for some nodes right before the crash.
• I am intentionally not posting the exact URL publicly. I can share it on request (or provide a redacted log excerpt).

Environment

• playwriter: 0.0.56 (via npx -y playwriter@latest)
• OS: Linux x64
• Node: v25.4.0 (as reported by playwriter)
• Browser.getVersion via CDP session reports:
  • product: Chrome/Extension-Bridge
  • revision: 1.0.0