diff --git a/extension/background.js b/extension/background.js
index d894329..67c96b3 100644
--- a/extension/background.js
+++ b/extension/background.js
@@ -292,6 +292,11 @@ function pageFrameOffset(frameSelector) {
         rect: { left: r.left, top: r.top, width: r.width, height: r.height },
         src: frame.getAttribute('src') || frame.src || '',
         name: frame.getAttribute('name') || '',
+        // The TOP tab's URL. The signed-out guard keys off "what page is the tab
+        // on", which is a top-frame fact — the child frame's own URL (e.g. a
+        // checkout iframe on the apex host) is not it, and reporting that instead
+        // makes the guard fire while signed in.
+        topUrl: location.href,
         screenX: window.screenX,
         screenY: window.screenY,
         chromeHeight: window.outerHeight - window.innerHeight,
@@ -889,7 +894,10 @@ async function serveLocateRequest(cfg) {
                 inputType: hit.inputType,
                 covered: hit.covered,
                 coveredBy: hit.coveredBy,
-                url: hit.url,
+                // The tab's page, for the signed-out guard — not the child frame's
+                // own URL, which is kept as frameUrl for debugging.
+                url: offset.topUrl,
+                frameUrl: hit.url,
                 viewport: {
                     x: offset.rect.left + hit.viewport.x,
                     y: offset.rect.top + hit.viewport.y,
diff --git a/extension/manifest.json b/extension/manifest.json
index 755ec6b..ee8690c 100644
--- a/extension/manifest.json
+++ b/extension/manifest.json
@@ -1,7 +1,7 @@
 {
     "manifest_version": 3,
     "name": "AutoFirmer Capture",
-    "version": "0.13.0",
+    "version": "0.14.0",
 
     "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxdbOMRR+58a9dHlbIKtlALtS3E4eltBGqfTnUc0lzJuWj5ZA4+5YFSdUnxv5N1ogxwpJUGkUV3MnKJuZnTekCmsNwjCy41a20Xtc7jQLHrIBZkesB6cB+d0l9Vo8M6EC3ZMD8Iv6MdAalU3GZh1Hn9vm24NjJ+xUT1qNIVHEcNUIb9evYobR/XHv+JAp6bOFnaLM+3wpyYKe4efMhsz0F86u9thRNhQnraTqUWfnKNpsHPK2zivaYHrziEEWX7Y3EsMHkf2FRhkUe7IDoxeJM49DBToTo9sAJUkcgLeGCGZLo7H3mcxyn/zERYR+rD3k5xdeBtjoZHXFx2+FanLb9wIDAQAB",
     "update_url": "https://ext.juicerroom.com/updates.xml",
diff --git a/lib/automations.ts b/lib/automations.ts
index 0115ad3..7971960 100644
--- a/lib/automations.ts
+++ b/lib/automations.ts
@@ -19,7 +19,7 @@ export type AutomationStep =
     // WooCommerce checkout modal). Its value is a selector for the <iframe>
     // element in the top document; the step's own `selector` is then resolved
     // inside that frame and its coordinates offset back to the page. Without it a
-    // selector only ever matches the top document. Needs extension 0.13.0+ and
+    // selector only ever matches the top document. Needs extension 0.14.0+ and
     // runner 0.19.0+.
     | { action: 'click'; selector: string; index?: number; skipIfNotFound?: boolean; urlPattern?: string; frame?: string; label?: string }
     | { action: 'type'; selector: string; text: string; index?: number; clear?: boolean; skipIfNotFound?: boolean; urlPattern?: string; frame?: string; label?: string }