diff --git a/vaults/1password.mdx b/vaults/1password.mdx
index 0ef01083..24dd87f4 100644
--- a/vaults/1password.mdx
+++ b/vaults/1password.mdx
@@ -588,9 +588,13 @@ doesn't report which approved login belongs to which website;
 1Password resolves a single-entry request without exactly one matching login,
 the item returns to `pending_authorization`, `state.status_reason` explains why,
 and you can invoke `1pw_create_access_request` on the same item again.
-approved references stay encrypted and are only usable by `1pw_fill`. `ready`
-means an approval was recorded, not that 1Password will honor it
-indefinitely.
+for items backed by a connected `credential_account`, approved references stay
+encrypted and are only usable by `1pw_fill`. a `ready` stored-token item also
+returns them in `state.access_request.resolved` as `{ entryId, reference }`, the
+shape 1Password's status check returns, so you can fill them with the
+1Password extension in another browser using the same access token and
+integration key. list responses omit `resolved`. `ready` means an approval was
+recorded, not that 1Password will honor it indefinitely.
 
 #### How long a grant lasts
 
@@ -614,6 +618,10 @@ navigate it to the page with the username and password form,
 not a page that asks the user to choose a sign-in method. then invoke `1pw_fill` with
 the browser's session id and the exact current top-level `page_url`. the url
 must match exactly one open page and share the origin of an approved entry.
+when several open pages have that url, for example one tab per task, pass the
+page's CDP target id as `target_id`, such as `tab.target_id` from a
+`playwright.execute` response. KERNEL brings that page to the front of its
+window before filling.
 when more than one approved entry has that origin, pass its `entry_id` from
 `state.access_request.entries`. the extension selects the fields, fills them,
 and submits the form; you can't supply selectors or values.
@@ -713,7 +721,7 @@ defaults to 30,000.
 | `200` `fill_submitted` | the extension filled and submitted the form | check the page; website authentication isn't verified |
 | `200` `fill_failed` | the extension reported `fillFailed`, `noExistingCredentials`, or `authenticationFailed` | `1pw_fill` can submit the form, so never retry automatically. check the page first before retrying. |
 | `200` `fill_unknown` | the form might have been filled or submitted, but the outcome is inconclusive. `error_code` is `autosubmitFailed` when the extension submitted but couldn't confirm the fill finished | `1pw_fill` can submit the form, so never retry automatically. check the page first before retrying. |
-| `400` `page_not_found` or `ambiguous_page` | `page_url` matched no page or more than one | fix the url or close duplicate tabs |
+| `400` `page_not_found` or `ambiguous_page` | `page_url` matched no page or more than one, or `target_id` isn't an open page at `page_url` | fix the url, or pass `target_id` to choose among duplicate tabs |
 | `400` `invalid_request` | the fill request was rejected as invalid | check `browser_id`, `page_url`, and `timeout_ms` before trying again |
 | `403` `destination_denied` | the page is outside every approved login origin | navigate to a requested website |
 | `409` `agentic_mode_unavailable` | the 1Password extension couldn't take control of the page; nothing was filled | `1pw_fill` can submit the form, so never retry automatically. check the page first before retrying. |