diff --git a/.agent/context/20260913T065500Z-privy-browser-buffer.md b/.agent/context/20260913T065500Z-privy-browser-buffer.md
new file mode 100644
index 0000000..d38ab62
--- /dev/null
+++ b/.agent/context/20260913T065500Z-privy-browser-buffer.md
@@ -0,0 +1,88 @@
+# Session Context: Privy browser Buffer
+
+## Date/time
+
+- UTC: 2026-09-13T06:55:00Z
+
+## User goal
+
+Fix the Privy approval failure that displays `Buffer is not defined` after the
+user approves an Arc Testnet USDC transfer.
+
+## Original prompt/request
+
+The user supplied screenshots of the Privy approval and failure dialogs and
+asked to fix the issue.
+
+## Assumptions
+
+- The failure is in the browser bundle after approval; the backend settlement
+  and retry behavior must remain unchanged.
+- Existing unrelated backend work in another worktree must remain untouched.
+
+## Plan
+
+1. Reproduce the missing browser-global dependency from the installed Privy
+   transaction path.
+2. Install the existing `buffer` package as an explicit web dependency and
+   initialize it before Privy's lazy-loaded wallet code runs.
+3. Build and run focused web checks.
+
+## Key decisions
+
+- Apply one entry-point polyfill because the installed Privy client contains
+  transaction paths that reference the global Node `Buffer` in the browser.
+- Do not alter wallet selection, transaction parameters, settlement state, or
+  retry behavior.
+
+## Files/components touched
+
+- `apps/web/src/main.tsx`: initialize the browser `Buffer` global before Privy.
+- `apps/web/package.json` and lockfile: make the polyfill a direct dependency.
+
+## Commands/checks
+
+- `pnpm --filter @oneshot/web typecheck` - PASS.
+- `pnpm --filter @oneshot/web test` - PASS, 17 files / 93 tests.
+- `pnpm --filter @oneshot/web build` - PASS; generated entry contains the
+  `globalThis.Buffer` initialization.
+- `pnpm --filter @oneshot/web test:browser` - PASS, 8 Chromium tests; includes
+  an assertion that the browser global is installed.
+- `pnpm lint` - PASS.
+- `pnpm format:check` - PASS.
+- `git diff --check` - PASS.
+- Local Node is v22.23.2 while the repository requests v24.19.0.
+
+## External-doc findings
+
+- None; the installed dependency and observed runtime error establish the
+  compatibility issue.
+
+## Unresolved questions
+
+- A final live Privy approval requires the deployed frontend and the user's
+  wallet session; local checks cover bundle availability and existing wallet
+  behavior.
+
+## Git and PR state
+
+- Branch: `fix/privy-browser-buffer`
+- Base: `origin/develop` at `5e1c9e9210ef22416ee8b62713e9a3e597bb4577`
+- Implementation commit: `4721961d7e55047d120e2d4e51dc3a40b4d520bb`
+- PR: [#126](https://github.com/SWOFART/OneShot/pull/126), draft
+- CI: repository policy, Markdown/Mermaid, and Cloudflare Workers build passed;
+  frontend browser acceptance and ESLint/TypeScript were pending at this snapshot.
+- Production frontend: Cloudflare Worker version
+  `935dfd2b-8fba-4875-964e-7f609c472378`; the public page returned HTTP 200 and
+  its entry bundle contained the `globalThis.Buffer` initialization.
+
+## Review gates
+
+- Gate A: NOT RUN under the user's standing explicit instruction to continue
+  without FreePi; no PASS is claimed.
+- Gate B: NOT RUN
+
+## Handoff/next steps
+
+1. Wait for remaining PR checks and have the user retry one approved testnet
+   transfer; agents do not merge.
diff --git a/apps/web/browser/p5.spec.ts b/apps/web/browser/p5.spec.ts
index e1691d7..2471bf5 100644
--- a/apps/web/browser/p5.spec.ts
+++ b/apps/web/browser/p5.spec.ts
@@ -104,6 +104,7 @@ async function unlockWorkspace(page: Page): Promise<void> {
 test.describe('resumable job workspace', () => {
   test('keeps the public landing separate from the authenticated cabinet', async ({ page }) => {
     await page.goto('/');
+    expect(await page.evaluate(() => typeof globalThis.Buffer)).toBe('function');
     await expect(
       page.getByRole('heading', { name: 'Resume the job, not the payment.' }),
     ).toBeVisible();
diff --git a/apps/web/package.json b/apps/web/package.json
index 60cb15c..27d8c3a 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -20,6 +20,7 @@
     "@oneshot/recovery-ui": "workspace:*",
     "@oneshot/settlement-ui": "workspace:*",
     "@privy-io/react-auth": "3.6.1",
+    "buffer": "6.0.3",
     "viem": "2.36.0",
     "react": "19.2.8",
     "react-dom": "19.2.8"
diff --git a/apps/web/src/main.tsx b/apps/web/src/main.tsx
index 68b5a2a..9df6f8b 100644
--- a/apps/web/src/main.tsx
+++ b/apps/web/src/main.tsx
@@ -1,8 +1,11 @@
+import { Buffer } from 'buffer';
 import { lazy, StrictMode, Suspense } from 'react';
 import { createRoot } from 'react-dom/client';
 import { App } from './App.js';
 import { WorkspaceLoading } from './components/WorkspaceLoading.js';
 
+globalThis.Buffer ??= Buffer;
+
 const DEFAULT_PRIVY_APP_ID = 'cmtqbf5zo013w0cky3r0jqjca';
 const appId =
   import.meta.env.MODE === 'test'
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5bcb582..3e5874c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -110,6 +110,9 @@ importers:
       '@privy-io/react-auth':
         specifier: 3.6.1
         version: 3.6.1(@types/react@19.2.18)(encoding@0.1.13)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@6.0.3)(use-sync-external-store@1.4.0(react@19.2.8))(zod@3.25.76)
+      buffer:
+        specifier: 6.0.3
+        version: 6.0.3
       react:
         specifier: 19.2.8
         version: 19.2.8