Native hit-testing accumulated ancestor offsets (`parent_x + rect.x`) onto each box's layout `rect`, but layout already stores absolute document coordinates (a child's content origin is `parent.rect.{x,y}`, and the renderer paints at `rect + scroll` without accumulation). The accumulation therefore inflated the hit position of nested elements — negligible near the top of a shallow page, but large deep in a real document — so clicks on links never landed on them. Hit-testing also early-returned when the point fell outside a box, so a child laid out beyond an `overflow: visible` ancestor (flex/grid overflow, absolutely-positioned descendants) was unreachable. - Move `hit_test_any_element` / `find_ancestor_anchor` into a shared `we_browser::hit_test` module so the browser shell and the e2e harness run the identical hit-test path. Read `rect` directly (absolute) and descend into children regardless of whether the point is inside the parent, while a box that clips its overflow (`hidden`/`scroll`/`auto`) still confines its subtree. - Apply the same absolute-coordinate fix to `hit_test_form_control` and `chrome_box_content_x` in the browser shell. - Add `assert_link_at <selector> <href-substr>` to the e2e scenario DSL: it finds an element's rendered center and runs the production hit-test + ancestor-anchor walk, the same path a real click takes — offline-verifiable link clickability the harness previously could not express. - Cover the fix with unit tests (absolute coords, overflow descent, clipping) and a `link_hit_test` scenario; assert blocket.se listing links resolve. Remaining blocket category-grid / fixed-header link failures are layout positioning bugs, tracked separately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>