diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 08c657b6..783d1755 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -203,8 +203,23 @@ jobs:
           command: check
           comment: 'false'
 
+      # `pawl guard` reads `Pawl-Accept:` trailers from the commits between the
+      # base and HEAD, which is how a deliberately accepted regression (a
+      # changed measurement definition, say) is authorized. actions/checkout
+      # fetches refs/pull/N/merge at depth 1, so HEAD is a grafted merge commit
+      # with no parents: the only commit in range is the merge commit GitHub
+      # generated, whose message carries no trailer, and an authorized
+      # regression is reported as unauthorized. Deepening past this PR's own
+      # commits puts them back in range.
       - name: Anti-regression baseline guard
         if: github.event_name == 'pull_request'
+        env:
+          PR_COMMITS: ${{ github.event.pull_request.commits }}
+          MERGE_REF: refs/pull/${{ github.event.pull_request.number }}/merge
         run: |
+          set -euo pipefail
+          if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+            git fetch --deepen="$((PR_COMMITS + 1))" origin "$MERGE_REF"
+          fi
           git fetch --depth=1 origin "$GITHUB_BASE_REF"
           pawl guard FETCH_HEAD
diff --git a/packages/devkit/README.md b/packages/devkit/README.md
index d589586b..cff4647d 100644
--- a/packages/devkit/README.md
+++ b/packages/devkit/README.md
@@ -41,7 +41,8 @@ await session.close()
 | `fileTypes` | — | 在内置 `wx*`、`dd*` 文件类型之外追加模板、样式和视图脚本扩展名 |
 | `simulatorDir` | — | 提供后启用 `/simulator` 静态资源路由 |
 | `containerDir` | 包内置容器 | 覆盖 H5 容器静态资源目录 |
-| `outputDir` | 系统临时目录中的项目哈希路径 | 覆盖编译产物目录 |
+| `outputDir` | 系统临时目录中的项目哈希路径 | 最终编译产物目录，与 `outputRoot` 互斥 |
+| `outputRoot` | — | 产物目录的父目录；devkit 在其下按 `sha1(resolve(projectPath)).slice(0, 12)` 建子目录，与 `outputDir` 互斥、同传会报错 |
 | `watch` | `true` | 是否监听文件并自动重新编译 |
 | `autoReload` | `true` | watcher 编译成功后是否刷新预览；纯样式改动会走样式热更新 |
 | `onRebuild` | — | 重新编译成功后的回调，参数包含 `changedPaths`、`styleOnly`，显式 `session.rebuild()` 还会带 `explicit: true` |
diff --git a/packages/devkit/src/index.ts b/packages/devkit/src/index.ts
index ddcd79ae..2d2884cb 100644
--- a/packages/devkit/src/index.ts
+++ b/packages/devkit/src/index.ts
@@ -137,7 +137,16 @@ export interface OpenProjectOptions {
 	fileTypes?: { template?: string[]; style?: string[]; viewScript?: string[] }
 	simulatorDir?: string
 	containerDir?: string
+	/** Final artifact directory, verbatim. Mutually exclusive with `outputRoot`. */
 	outputDir?: string
+	/**
+	 * Parent directory for artifacts. devkit derives the actual output
+	 * directory as `outputRoot/sha1(resolve(projectPath)).slice(0, 12)`, keyed
+	 * by the resolved project path — so two different projects never collide
+	 * under the same root even when they report the same appid. Mutually
+	 * exclusive with `outputDir`; passing both is rejected.
+	 */
+	outputRoot?: string
 	/** When false, skip the chokidar file-watcher / auto-rebuild loop. Default true. */
 	watch?: boolean
 	/**
@@ -242,6 +251,7 @@ export async function openProject(opts: OpenProjectOptions): Promise<ProjectSess
 		simulatorDir,
 		containerDir: overrideContainerDir,
 		outputDir,
+		outputRoot,
 		watch = true,
 		autoReload = true,
 		onRebuild,
@@ -252,11 +262,18 @@ export async function openProject(opts: OpenProjectOptions): Promise<ProjectSess
 	const projectPath = path.resolve(rawProjectPath)
 	const buildOptions = { sourcemap, fileTypes }
 
+	if (outputDir !== undefined && outputRoot !== undefined) {
+		throw new Error('[devkit] openProject: pass either "outputDir" or "outputRoot", not both')
+	}
+
 	const resolvedPort = port === 0 ? await getRandomPort() : port
 
 	const containerDir = overrideContainerDir ?? path.join(__dirname, '..', 'fe', 'dimina-fe-container')
 	const resolvedOutputDir = outputDir
-		?? path.join(os.tmpdir(), 'dimina-kit', createHash('sha1').update(projectPath).digest('hex').slice(0, 12))
+		?? path.join(
+			outputRoot ?? path.join(os.tmpdir(), 'dimina-kit'),
+			createHash('sha1').update(projectPath).digest('hex').slice(0, 12),
+		)
 	fs.mkdirSync(resolvedOutputDir, { recursive: true })
 
 	// Compilation runs in a long-lived forked worker — the worker chdirs in
diff --git a/packages/devkit/src/open-project-output-root.test.ts b/packages/devkit/src/open-project-output-root.test.ts
new file mode 100644
index 00000000..02dee314
--- /dev/null
+++ b/packages/devkit/src/open-project-output-root.test.ts
@@ -0,0 +1,212 @@
+import { EventEmitter } from 'node:events'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { createHash } from 'node:crypto'
+import { PassThrough } from 'node:stream'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import * as devkit from './index.js'
+
+/**
+ * Contract: `openProject()` gains an optional `outputRoot`.
+ *
+ *  - When `outputRoot` is passed (and `outputDir` is not), the artifact
+ *    directory is `path.join(outputRoot, sha1(path.resolve(projectPath)).slice(0, 12))`
+ *    — keyed by the RESOLVED project path, so two different project paths
+ *    never collide under the same root even when their `project.config.json`
+ *    reports the same appid.
+ *  - Passing `outputDir` still selects the final directory verbatim — that
+ *    existing contract is unchanged by the new option.
+ *  - Passing both `outputDir` AND `outputRoot` together is ambiguous and must
+ *    reject, with both option names named in the error.
+ *
+ * Harness copied from open-project-rebuild.test.ts: fake fork + fake fe +
+ * fake chokidar, `watch: false` throughout so no watcher mock is exercised.
+ */
+
+const mocks = vi.hoisted(() => ({
+	fork: vi.fn(),
+	feStart: vi.fn(),
+	watch: vi.fn(),
+}))
+
+vi.mock('node:child_process', async (importOriginal) => {
+	const actual = await importOriginal<typeof import('node:child_process')>()
+	return { ...actual, fork: mocks.fork, default: { ...actual, fork: mocks.fork } }
+})
+vi.mock('child_process', async (importOriginal) => {
+	const actual = await importOriginal<typeof import('node:child_process')>()
+	return { ...actual, fork: mocks.fork, default: { ...actual, fork: mocks.fork } }
+})
+vi.mock('../fe/index.js', () => ({ start: mocks.feStart }))
+vi.mock('chokidar', () => ({
+	default: { watch: mocks.watch },
+	watch: mocks.watch,
+}))
+
+class FakeChild extends EventEmitter {
+	stdout = new PassThrough()
+	stderr = new PassThrough()
+	connected = true
+	pid = 7171
+	send = vi.fn((msg: unknown): boolean => {
+		const m = msg as Record<string, unknown>
+		if (m && m.cmd === 'build') {
+			const outputDir = String(m.outputDir ?? '')
+			queueMicrotask(() => this.emit('message', {
+				type: 'result',
+				appInfo: { appId: 'outputroot_app', name: 'outputroot-app', path: outputDir },
+			}))
+		}
+		return true
+	})
+
+	kill = vi.fn((): boolean => {
+		this.connected = false
+		queueMicrotask(() => this.emit('exit', null, 'SIGTERM'))
+		return true
+	})
+}
+
+interface FakeFe {
+	server: { close: ReturnType<typeof vi.fn>, closeAllConnections: ReturnType<typeof vi.fn> }
+	reload: ReturnType<typeof vi.fn>
+}
+
+function makeFakeFe(): FakeFe {
+	const server = {
+		close: vi.fn((cb?: () => void) => { cb?.(); return server }),
+		closeAllConnections: vi.fn(),
+	}
+	return { server, reload: vi.fn() }
+}
+
+const children: FakeChild[] = []
+const feInstances: FakeFe[] = []
+const cleanupRoots: string[] = []
+
+beforeEach(() => {
+	children.length = 0
+	feInstances.length = 0
+	mocks.fork.mockReset()
+	mocks.fork.mockImplementation(() => {
+		const child = new FakeChild()
+		children.push(child)
+		return child
+	})
+	mocks.feStart.mockReset()
+	mocks.feStart.mockImplementation(async () => {
+		const fe = makeFakeFe()
+		feInstances.push(fe)
+		return fe
+	})
+	mocks.watch.mockReset()
+})
+
+afterEach(() => {
+	for (const root of cleanupRoots.splice(0)) {
+		fs.rmSync(root, { recursive: true, force: true })
+	}
+})
+
+function makeFixture(appid = 'outputroot_app'): string {
+	const root = fs.mkdtempSync(path.join(os.tmpdir(), 'devkit-outputroot-'))
+	cleanupRoots.push(root)
+	fs.writeFileSync(
+		path.join(root, 'project.config.json'),
+		JSON.stringify({ appid, projectname: 'outputroot-app' }),
+	)
+	return root
+}
+
+function lastBuildOutputDir(child: FakeChild): string {
+	const buildCalls = child.send.mock.calls.filter((c) => {
+		const m = c[0] as Record<string, unknown>
+		return m?.cmd === 'build'
+	})
+	const msg = buildCalls[buildCalls.length - 1]?.[0] as Record<string, unknown> | undefined
+	return String(msg?.outputDir ?? '')
+}
+
+function expectedSubdir(projectPath: string): string {
+	return createHash('sha1').update(path.resolve(projectPath)).digest('hex').slice(0, 12)
+}
+
+describe('openProject({ outputRoot }): artifact directory derived from outputRoot + hashed project path', () => {
+	it('places artifacts under outputRoot/sha1(resolvedProjectPath).slice(0, 12)', async () => {
+		const root = makeFixture()
+		const outputRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'devkit-outputroot-target-'))
+		cleanupRoots.push(outputRoot)
+
+		const session = await devkit.openProject({
+			projectPath: root,
+			watch: false,
+			outputRoot,
+		} as devkit.OpenProjectOptions & { outputRoot: string })
+
+		const expected = path.join(outputRoot, expectedSubdir(root))
+		expect(
+			lastBuildOutputDir(children[0]!),
+			'outputRoot must be honored the same way the tmpdir default is today (index.ts:258) instead of being silently ignored',
+		).toBe(expected)
+
+		await session.close()
+	}, 15_000)
+
+	it('two different project paths sharing the same appid land in different subdirectories under outputRoot', async () => {
+		const rootA = makeFixture('same_appid')
+		const rootB = makeFixture('same_appid')
+		const outputRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'devkit-outputroot-collide-'))
+		cleanupRoots.push(outputRoot)
+
+		const sessionA = await devkit.openProject({
+			projectPath: rootA,
+			watch: false,
+			outputRoot,
+		} as devkit.OpenProjectOptions & { outputRoot: string })
+		const dirA = lastBuildOutputDir(children[0]!)
+
+		const sessionB = await devkit.openProject({
+			projectPath: rootB,
+			watch: false,
+			outputRoot,
+		} as devkit.OpenProjectOptions & { outputRoot: string })
+		const dirB = lastBuildOutputDir(children[1]!)
+
+		expect(dirA.startsWith(outputRoot), 'project A must build under the requested outputRoot').toBe(true)
+		expect(dirB.startsWith(outputRoot), 'project B must build under the requested outputRoot').toBe(true)
+		expect(
+			dirA,
+			'same appid, different project paths — the two builds must not be keyed onto the same output directory',
+		).not.toBe(dirB)
+
+		await sessionA.close()
+		await sessionB.close()
+	}, 15_000)
+
+	it('rejects when both outputDir and outputRoot are passed, naming both options in the error', async () => {
+		const root = makeFixture()
+		const outputDir = path.join(root, '.out')
+		const outputRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'devkit-outputroot-conflict-'))
+		cleanupRoots.push(outputRoot)
+
+		await expect(
+			devkit.openProject({
+				projectPath: root,
+				watch: false,
+				outputDir,
+				outputRoot,
+			} as devkit.OpenProjectOptions & { outputRoot: string }),
+			'passing both options is ambiguous about which one wins and must fail loudly instead of silently picking outputDir',
+		).rejects.toThrow(/outputDir/i)
+
+		await expect(
+			devkit.openProject({
+				projectPath: root,
+				watch: false,
+				outputDir,
+				outputRoot,
+			} as devkit.OpenProjectOptions & { outputRoot: string }),
+		).rejects.toThrow(/outputRoot/i)
+	}, 15_000)
+})
diff --git a/packages/devtools/docs/host-migration.md b/packages/devtools/docs/host-migration.md
index 469377f7..88ec6ded 100644
--- a/packages/devtools/docs/host-migration.md
+++ b/packages/devtools/docs/host-migration.md
@@ -125,7 +125,7 @@ launch({
 
 ### 8. `window.autoShow` 开关
 
-`WorkbenchAppConfig.window` 的 `autoShow?: boolean`（默认 `true`）控制 `ready-to-show` 是否自动显示主窗口。要先过登录门再显示窗口的宿主设 `autoShow: false`，自己在登录通过后 show：
+`WorkbenchAppConfig.window` 的 `autoShow?: boolean`（默认 `true`）控制 `ready-to-show` 是否自动显示**项目列表窗口**。要先过登录门再显示窗口的宿主设 `autoShow: false`，自己在登录通过后 show：
 
 ```ts
 launch({
@@ -143,7 +143,26 @@ launch({
 
 宿主在 test 下独占 reveal，无需写防御性 `on('show', hide)` re-hide——窗口按宿主自己的节奏 show 后常规 `waitForFunction` 即可。
 
-### 9. e2e 识别主窗口（用 `window.devtools` 标识）
+`window.autoShow` **只管列表窗口**。项目窗口有自己的开关 `projectWindow.autoShow`（同样默认 `true`）：登录门把列表窗口藏起来时，之后打开的项目窗口照常显示，不再跟着一起隐藏。要接管项目窗口的显示时机才设 `projectWindow: { autoShow: false }`，然后自己在 `setupProjectWindow(instance, opened)` 里 `opened.window.show()`。
+
+### 9. 项目窗口的宿主注册用 `setupProjectWindow`
+
+`onSetup(instance)` 只在启动时跑一次，`instance.context` 是**项目列表窗口**的 context——它不持有会话和视图，在它上面做的项目相关注册进不了任何项目窗口。项目级注册改用 `setupProjectWindow`，每打开一个项目窗口调用一次：
+
+```ts
+launch({
+  async setupProjectWindow(instance, opened) {
+    // opened: { path, name?, window, context } —— context 是这个项目窗口自己的
+    await opened.context.views.hostToolbar.loadFile(toolbarHtml)
+  },
+})
+```
+
+- `opened` 的形状（`ProjectWindowRef`）与 `onBeforeClose` 收到的 `closing` 一致，一进一出对称；
+- hook 被 await，且**能否决这次打开**：抛错时框架拆掉这个半成品窗口（销毁 window、dispose context、从 `projectWindows()` 里摘掉），并把原始错误抛给发起打开的一方——这点和 `onBeforeClose` 不同，后者的错误只记日志；
+- `onSetup` 还没跑完时到达的打开请求（渲染进程可以抢在宿主扩展就绪前触发打开）会先排队等它，不会拿到一个宿主尚未扩展的窗口。
+
+### 10. e2e 识别主窗口（用 `window.devtools` 标识）
 
 写 Playwright e2e 选主窗口用框架已注入的 `window.devtools`（主窗口 preload 暴露的 IPC bridge，见 `preload/windows/main.ts`）作稳定选择契约——它是**主窗口独有**的（host-toolbar 暴露的是 `window.diminaHostToolbar`），与展示名解耦、抗时序、抗 WCV 增多。不要用 `electronApp.firstWindow()`（依赖创建顺序，`autoShow:false` 下会抢到 host-toolbar WCV）或 `url().endsWith('index.html')` / title（依赖 renderer 入口路径、会被 `appName` / `brandingProvider` 改写）。e2e 选主窗口：
 
diff --git a/packages/devtools/docs/library-integration.md b/packages/devtools/docs/library-integration.md
index c5febe72..6056d532 100644
--- a/packages/devtools/docs/library-integration.md
+++ b/packages/devtools/docs/library-integration.md
@@ -66,10 +66,12 @@ launch({
 | --- | --- |
 | `rendererDir` | 覆盖内置 renderer 目录 |
 | `modules` | 按 `projects`、`session`、`simulator`、`popover`、`settings` 开关内置 IPC 模块组 |
-| `window` | 主窗口尺寸和 `autoShow` 设置 |
+| `window` | 项目列表窗口的尺寸和 `autoShow` 设置 |
+| `projectWindow` | 项目窗口的 `autoShow` 设置，默认 `true`，与 `window` 互不影响 |
 | `icon` | 窗口或任务栏图标 |
 | `menuBuilder` | 安装宿主菜单；参数是主窗口和窄化后的 `MenuContext` |
-| `onSetup` | 窗口与 context 建好后注册宿主扩展，可返回 Promise |
+| `onSetup` | 项目列表窗口与 context 建好后注册应用级宿主扩展，可返回 Promise |
+| `setupProjectWindow` | 每打开一个项目窗口调用一次，拿到这个窗口自己的 context 做项目级注册；抛错等于本次打开失败 |
 | `onBeforeClose` | 有活动会话时，在自动关闭会话前运行宿主清理，可返回 Promise |
 | `onBeforeOpenProject` | 任何打开项目副作用发生前执行；抛错会拒绝本次打开并保留当前会话 |
 | `editorViewConfig` | 覆盖 VS Code 工作台 bundle，或提供 web extensions 目录 |
@@ -157,6 +159,26 @@ onSetup(instance) {
 
 这些注册都归当前 context 所有，并在 context 销毁时清理。`registerTrustedWindow()` 返回的对象也可以提前 `dispose()`。
 
+### 项目级注册用 `setupProjectWindow`
+
+`onSetup(instance)` 里的 `instance.context` 永远是项目列表窗口的 context，它不持有任何会话和视图。要给具体某个项目窗口注册东西（面板、host toolbar、按 context 分的 IPC 状态），用 `setupProjectWindow`：
+
+```ts
+launch({
+  onSetup(instance) {
+    // 应用级：整个进程注册一次就够
+    instance.registerSimulatorApi('share', params => share(params))
+  },
+  async setupProjectWindow(instance, opened) {
+    // 项目级：opened.context 是这个项目窗口自己的 context
+    await opened.context.views.hostToolbar.loadFile(toolbarHtml)
+    console.log('打开了', opened.path, opened.name)
+  },
+})
+```
+
+`opened` 的形状是 `ProjectWindowRef`（`path`、`name?`、`window`、`context`），和 `onBeforeClose` 收到的 `closing` 一致。hook 会被 await，抛错等于这次打开失败：框架拆掉这个半成品窗口，原样把错误抛给发起打开的一方。`onSetup` 尚未完成时到达的打开请求会先等它，不会拿到一个宿主还没扩展完的窗口。
+
 ### Simulator 自定义 API
 
 `registerSimulatorApi(name, handler)` 让小程序代码通过 `wx.<name>()` 调用 handler。handler 可以同步返回或返回 Promise；参数和返回值必须能通过 Electron IPC 序列化。返回的 disposer 只删除本次注册，如果同名 API 后来已被覆盖，不会误删新 handler。
diff --git a/packages/devtools/e2e/appdata-edit.spec.ts b/packages/devtools/e2e/appdata-edit.spec.ts
index c55d2dc4..594be29b 100644
--- a/packages/devtools/e2e/appdata-edit.spec.ts
+++ b/packages/devtools/e2e/appdata-edit.spec.ts
@@ -7,18 +7,18 @@ test.describe('AppData Panel Edit Write-Back', () => {
 
   useSharedProject(test, DEMO_APP_DIR)
 
-  test('editing a value in the tree round-trips through service→render setData and re-renders from the pushed snapshot', async ({ mainWindow }) => {
-    await mainWindow.getByRole('tab', { name: 'AppData' }).click()
+  test('editing a value in the tree round-trips through service→render setData and re-renders from the pushed snapshot', async ({ workbench }) => {
+    await workbench.getByRole('tab', { name: 'AppData' }).click()
 
     // Pages sidebar lists the running page; the demo app's first page is
     // pages/index/index and its bridge auto-activates (useActiveBridgeId
     // follows the simulator's active page path), so the data tree for it is
     // already the visible one once data arrives.
-    const pages = mainWindow.getByTestId('appdata-pages')
+    const pages = workbench.getByTestId('appdata-pages')
     await expect(pages).toBeVisible({ timeout: 30_000 })
     await expect(pages).toContainText('pages/index/index', { timeout: 30_000 })
 
-    const tree = mainWindow.getByTestId('appdata-tree')
+    const tree = workbench.getByTestId('appdata-tree')
     await expect(tree).toBeVisible({ timeout: 30_000 })
 
     // The root row starts expanded but its children start collapsed; open
diff --git a/packages/devtools/e2e/automator-compat.spec.ts b/packages/devtools/e2e/automator-compat.spec.ts
index 049acea3..3fdc5cc4 100644
--- a/packages/devtools/e2e/automator-compat.spec.ts
+++ b/packages/devtools/e2e/automator-compat.spec.ts
@@ -117,7 +117,9 @@ test.describe('miniprogram-automator protocol compatibility', () => {
   // The following tests open a project first
   test.describe('with project open', () => {
     test.beforeAll(async () => {
-      await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 8000 })
+      // Return value not captured — the rest of this block drives the app
+      // purely over the automation-protocol WebSocket, never a Page object.
+      await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 8000 })
       await waitForSimulatorWebview(electronApp)
 
       // NATIVE-HOST readiness gate. The page DOM is no longer in a same-document
@@ -149,7 +151,7 @@ test.describe('miniprogram-automator protocol compatibility', () => {
     })
 
     test.afterAll(async () => {
-      await closeProject(mainWindow).catch(() => {})
+      await closeProject(electronApp).catch(() => {})
     })
 
     test('App.getPageStack returns stack', async () => {
@@ -269,7 +271,10 @@ test.describe('npm miniprogram-automator package', () => {
       100,
     ) as number
 
-    await openProjectInUI(smokeMainWindow, DEMO_APP_DIR, { waitMs: 8000 })
+    // Return value not captured — this block hands off to the npm
+    // `miniprogram-automator` package's own `automator.connect(wsEndpoint)`,
+    // never a Page object of ours.
+    await openProjectInUI(smokeElectronApp, DEMO_APP_DIR, { waitMs: 8000 })
     await waitForSimulatorWebview(smokeElectronApp)
     await new Promise((r) => setTimeout(r, 2000))
 
@@ -282,7 +287,7 @@ test.describe('npm miniprogram-automator package', () => {
     if (miniProgram) {
       miniProgram.disconnect()
     }
-    await closeProject(smokeMainWindow).catch(() => {})
+    await closeProject(smokeElectronApp).catch(() => {})
     await smokeElectronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/automator-label-semantics.spec.ts b/packages/devtools/e2e/automator-label-semantics.spec.ts
index bac15d28..eeaccc2e 100644
--- a/packages/devtools/e2e/automator-label-semantics.spec.ts
+++ b/packages/devtools/e2e/automator-label-semantics.spec.ts
@@ -248,7 +248,11 @@ test.beforeAll(async () => {
     100,
   ) as number
 
-  await openProjectInUI(mainWindow, PROBE_APP_DIR, { waitMs: 8000 })
+  // Return value not captured — everything after this drives the probe purely
+  // through the automation-protocol WebSocket (`miniProgram`/`page`) or scans
+  // `electronApp`'s webContents by URL marker (`trustedClick`), never the
+  // workbench window's own Page.
+  await openProjectInUI(electronApp, PROBE_APP_DIR, { waitMs: 8000 })
   await waitForSimulatorWebview(electronApp)
 
   miniProgram = await automator.connect({ wsEndpoint: `ws://127.0.0.1:${autoPort}` })
@@ -268,7 +272,7 @@ test.beforeAll(async () => {
 
 test.afterAll(async () => {
   miniProgram?.disconnect()
-  await closeProject(mainWindow).catch(() => {})
+  await closeProject(electronApp).catch(() => {})
   await electronApp?.close().catch(() => {})
 })
 
diff --git a/packages/devtools/e2e/automator/automator.ts b/packages/devtools/e2e/automator/automator.ts
index 349fa79e..457f1da6 100644
--- a/packages/devtools/e2e/automator/automator.ts
+++ b/packages/devtools/e2e/automator/automator.ts
@@ -12,7 +12,7 @@ import fs from 'fs'
 import path from 'path'
 import { fileURLToPath } from 'url'
 import { MiniProgram } from './mini-program'
-import { openProjectInUI, waitForSimulatorWebview } from '../helpers'
+import { findMainWindow, openProjectInUI, waitForSimulatorWebview } from '../helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
@@ -73,9 +73,10 @@ export class Automator {
       },
     })
 
-    // Wait for the main window
-    const mainWindow = await electronApp.firstWindow()
-    await mainWindow.waitForLoadState('domcontentloaded')
+    // Wait for the project-list window before we can move it off-screen and
+    // open a project into its own workbench window.
+    const listWindow = await findMainWindow(electronApp)
+    await listWindow.waitForLoadState('domcontentloaded')
 
     // Move off-screen so it doesn't steal focus
     await electronApp.evaluate(async ({ BrowserWindow }) => {
@@ -92,8 +93,8 @@ export class Automator {
       }
     })
 
-    // Open the project
-    await openProjectInUI(mainWindow, projectPath, {
+    // Open the project — this opens (and returns) the project's own workbench window.
+    const workbench = await openProjectInUI(electronApp, projectPath, {
       waitMs: compileWaitMs,
     })
 
@@ -101,18 +102,18 @@ export class Automator {
       await waitForSimulatorWebview(electronApp)
     }
 
-    return new MiniProgram(electronApp, mainWindow, projectPath)
+    return new MiniProgram(electronApp, workbench, projectPath)
   }
 
   /**
    * Connect to an already-running devtools instance.
-   * Requires electronApp and mainWindow from Playwright fixtures.
+   * Requires electronApp and the project's workbench window from Playwright fixtures.
    */
   static connect(
     electronApp: ElectronApplication,
-    mainWindow: PwPage,
+    workbench: PwPage,
     projectPath: string,
   ): MiniProgram {
-    return new MiniProgram(electronApp, mainWindow, projectPath)
+    return new MiniProgram(electronApp, workbench, projectPath)
   }
 }
diff --git a/packages/devtools/e2e/automator/element.ts b/packages/devtools/e2e/automator/element.ts
index 44ea4220..ba86bba7 100644
--- a/packages/devtools/e2e/automator/element.ts
+++ b/packages/devtools/e2e/automator/element.ts
@@ -26,18 +26,19 @@ function inIframe(expression: string): string {
 
 export class Element {
   readonly electronApp: ElectronApplication
-  readonly mainWindow: PwPage
+  /** The project's own workbench window (each open project gets one). */
+  readonly workbench: PwPage
   readonly selector: string
   readonly index: number
 
   constructor(
     electronApp: ElectronApplication,
-    mainWindow: PwPage,
+    workbench: PwPage,
     selector: string,
     index: number,
   ) {
     this.electronApp = electronApp
-    this.mainWindow = mainWindow
+    this.workbench = workbench
     this.selector = selector
     this.index = index
   }
@@ -238,7 +239,7 @@ export class Element {
     )
     if (!exists) return null
     const combinedSelector = `${this.selector} ${childSelector}`
-    return new Element(this.electronApp, this.mainWindow, combinedSelector, 0)
+    return new Element(this.electronApp, this.workbench, combinedSelector, 0)
   }
 
   /** Find all child elements matching a selector. */
@@ -254,7 +255,7 @@ export class Element {
     const combinedSelector = `${this.selector} ${childSelector}`
     const elements: Element[] = []
     for (let i = 0; i < count; i++) {
-      elements.push(new Element(this.electronApp, this.mainWindow, combinedSelector, i))
+      elements.push(new Element(this.electronApp, this.workbench, combinedSelector, i))
     }
     return elements
   }
diff --git a/packages/devtools/e2e/automator/mini-program.ts b/packages/devtools/e2e/automator/mini-program.ts
index d8eb9525..7e05caaf 100644
--- a/packages/devtools/e2e/automator/mini-program.ts
+++ b/packages/devtools/e2e/automator/mini-program.ts
@@ -20,16 +20,17 @@ import {
 
 export class MiniProgram {
   readonly electronApp: ElectronApplication
-  readonly mainWindow: PwPage
+  /** The project's own workbench window (each open project gets one). */
+  readonly workbench: PwPage
   readonly projectPath: string
 
   constructor(
     electronApp: ElectronApplication,
-    mainWindow: PwPage,
+    workbench: PwPage,
     projectPath: string,
   ) {
     this.electronApp = electronApp
-    this.mainWindow = mainWindow
+    this.workbench = workbench
     this.projectPath = projectPath
   }
 
@@ -51,7 +52,7 @@ export class MiniProgram {
   /** Get the current active page. */
   async currentPage(): Promise<Page> {
     const pagePath = await this.currentPagePath()
-    return new Page(this.electronApp, this.mainWindow, pagePath)
+    return new Page(this.electronApp, this.workbench, pagePath)
   }
 
   /**
@@ -179,7 +180,7 @@ export class MiniProgram {
     )
 
     // Final settle for late wx:for / setData renders inside the new page
-    await this.mainWindow.waitForTimeout(500)
+    await this.workbench.waitForTimeout(500)
     return this.currentPage()
   }
 
@@ -215,7 +216,7 @@ export class MiniProgram {
     )
 
     // Wait for content to render
-    await this.mainWindow.waitForTimeout(2000)
+    await this.workbench.waitForTimeout(2000)
     return this.currentPage()
   }
 
@@ -227,7 +228,7 @@ export class MiniProgram {
   /** Navigate back by going to history.back(). */
   async navigateBack(): Promise<Page> {
     await evalInSimulator(this.electronApp, `history.back()`)
-    await this.mainWindow.waitForTimeout(1500)
+    await this.workbench.waitForTimeout(1500)
     return this.currentPage()
   }
 
@@ -325,7 +326,7 @@ export class MiniProgram {
 
   /** Invoke a devtools IPC handler from the renderer process. */
   async ipcInvoke<T = unknown>(channel: string, ...args: unknown[]): Promise<T> {
-    return ipcInvoke<T>(this.mainWindow, channel, ...args)
+    return ipcInvoke<T>(this.workbench, channel, ...args)
   }
 
   // ── Screenshot ──────────────────────────────────────────────────────
@@ -346,12 +347,12 @@ export class MiniProgram {
 
   /** Wait for a specific amount of time. */
   async waitFor(ms: number): Promise<void> {
-    await this.mainWindow.waitForTimeout(ms)
+    await this.workbench.waitForTimeout(ms)
   }
 
   /** Close the mini program and the devtools app. */
   async close(): Promise<void> {
-    await closeProject(this.mainWindow).catch(() => {})
+    await closeProject(this.electronApp, { projectDir: this.projectPath }).catch(() => {})
     await this.electronApp.close().catch(() => {})
   }
 }
diff --git a/packages/devtools/e2e/automator/page.ts b/packages/devtools/e2e/automator/page.ts
index e58f18e0..8c2bbc05 100644
--- a/packages/devtools/e2e/automator/page.ts
+++ b/packages/devtools/e2e/automator/page.ts
@@ -30,16 +30,17 @@ function inIframe(expression: string): string {
 
 export class Page {
   readonly electronApp: ElectronApplication
-  readonly mainWindow: PwPage
+  /** The project's own workbench window (each open project gets one). */
+  readonly workbench: PwPage
   readonly path: string
 
   constructor(
     electronApp: ElectronApplication,
-    mainWindow: PwPage,
+    workbench: PwPage,
     path: string,
   ) {
     this.electronApp = electronApp
-    this.mainWindow = mainWindow
+    this.workbench = workbench
     this.path = path
   }
 
@@ -56,7 +57,7 @@ export class Page {
       inIframe(`return _doc.querySelector('${escaped}') !== null`),
     )
     if (!exists) return null
-    return new Element(this.electronApp, this.mainWindow, selector, 0)
+    return new Element(this.electronApp, this.workbench, selector, 0)
   }
 
   /**
@@ -70,7 +71,7 @@ export class Page {
     )
     const elements: Element[] = []
     for (let i = 0; i < count; i++) {
-      elements.push(new Element(this.electronApp, this.mainWindow, selector, i))
+      elements.push(new Element(this.electronApp, this.workbench, selector, i))
     }
     return elements
   }
@@ -129,7 +130,7 @@ export class Page {
   async waitFor(predicate: () => Promise<boolean>): Promise<void>
   async waitFor(arg: number | string | (() => Promise<boolean>)): Promise<void> {
     if (typeof arg === 'number') {
-      await this.mainWindow.waitForTimeout(arg)
+      await this.workbench.waitForTimeout(arg)
     } else if (typeof arg === 'string') {
       await this.waitForSelector(arg)
     } else {
@@ -149,7 +150,7 @@ export class Page {
       timeout,
       300,
     )
-    return new Element(this.electronApp, this.mainWindow, selector, 0)
+    return new Element(this.electronApp, this.workbench, selector, 0)
   }
 
   // ── Evaluate in iframe ──────────────────────────────────────────────
diff --git a/packages/devtools/e2e/broken-project.spec.ts b/packages/devtools/e2e/broken-project.spec.ts
index d70a8668..db6ba96d 100644
--- a/packages/devtools/e2e/broken-project.spec.ts
+++ b/packages/devtools/e2e/broken-project.spec.ts
@@ -2,7 +2,7 @@ import fs from 'fs'
 import os from 'os'
 import path from 'path'
 import { test, expect } from './fixtures'
-import { ipcInvoke, closeProject, DEMO_APP_DIR } from './helpers'
+import { ipcInvoke, DEMO_APP_DIR } from './helpers'
 import { ProjectChannel } from '../src/shared/ipc-channels'
 
 interface OpenProjectResult {
@@ -123,7 +123,11 @@ test.describe('devkit dev server does not serve HTML for missing asset paths', (
         `server returned HTML SPA fallback (status=${res.status}) for a JSON asset path; first 80 chars: ${JSON.stringify(body.slice(0, 80))}`,
       ).toBe(false)
     } finally {
-      await closeProject(mainWindow)
+      // These tests drive `ProjectChannel.Open` directly, so the session lives
+      // in the list window's own WorkbenchContext (no real workbench window is
+      // ever spawned) — close it via the same channel rather than
+      // `closeProject`, which only tears down real workbench BrowserWindows.
+      await ipcInvoke(mainWindow, ProjectChannel.Close).catch(() => {})
     }
   })
 
@@ -143,7 +147,11 @@ test.describe('devkit dev server does not serve HTML for missing asset paths', (
       const looksLikeHtml = /^\s*<!doctype\s+html/i.test(body) || /^\s*<html/i.test(body)
       expect(looksLikeHtml && res.status === 200).toBe(false)
     } finally {
-      await closeProject(mainWindow)
+      // These tests drive `ProjectChannel.Open` directly, so the session lives
+      // in the list window's own WorkbenchContext (no real workbench window is
+      // ever spawned) — close it via the same channel rather than
+      // `closeProject`, which only tears down real workbench BrowserWindows.
+      await ipcInvoke(mainWindow, ProjectChannel.Close).catch(() => {})
     }
   })
 })
diff --git a/packages/devtools/e2e/console-filter-live.spec.ts b/packages/devtools/e2e/console-filter-live.spec.ts
index e395c04a..78e52696 100644
--- a/packages/devtools/e2e/console-filter-live.spec.ts
+++ b/packages/devtools/e2e/console-filter-live.spec.ts
@@ -243,7 +243,10 @@ test.describe('Right-panel Console [service] de-noise filter (live)', () => {
       10000, 100,
     )
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    // No workbench Page is kept: every project-scoped assertion below reaches
+    // the right-panel front-end / service host through electronApp.evaluate
+    // by webContents URL, never through a Playwright Page.
+    await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
     await pollUntil(
       () => evalInSimulator<boolean>(electronApp, `(() => !!document.querySelector('.device-shell-root'))()`).catch(() => false),
@@ -279,7 +282,7 @@ test.describe('Right-panel Console [service] de-noise filter (live)', () => {
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/console-filter-reset.spec.ts b/packages/devtools/e2e/console-filter-reset.spec.ts
index 1a6826d3..4ba9dd57 100644
--- a/packages/devtools/e2e/console-filter-reset.spec.ts
+++ b/packages/devtools/e2e/console-filter-reset.spec.ts
@@ -52,9 +52,9 @@ test.describe('Console filter box is cleared on fresh project open', () => {
 
   useSharedProject(test, DEMO_APP_DIR)
 
-  test('stale console.textFilter is removed and the box is emptied', async ({ mainWindow, electronApp }) => {
+  test('stale console.textFilter is removed and the box is emptied', async ({ workbench, electronApp }) => {
     // Open the Console panel so the embedded Chrome DevTools front-end is mounted.
-    const consoleTab = mainWindow.getByRole('tab', { name: 'Console' })
+    const consoleTab = workbench.getByRole('tab', { name: 'Console' })
     await consoleTab.click()
     await expect(consoleTab).toHaveAttribute('data-active', 'true')
 
diff --git a/packages/devtools/e2e/devtools-panel.spec.ts b/packages/devtools/e2e/devtools-panel.spec.ts
index fc3deb78..bd2db596 100644
--- a/packages/devtools/e2e/devtools-panel.spec.ts
+++ b/packages/devtools/e2e/devtools-panel.spec.ts
@@ -9,14 +9,14 @@ test.describe('Simulator Panel', () => {
 
   useSharedProject(test, DEMO_APP_DIR)
 
-  test('toolbar has compile and simulator toggle buttons', async ({ mainWindow }) => {
-    expect(await findButtonByText(mainWindow, '普通编译')).toBe(true)
-    await expect(mainWindow.getByRole('group', { name: '面板可见性' })).toBeVisible()
-    await expect(mainWindow.getByTestId('layout-toolbar-toggle-simulator')).toBeVisible()
+  test('toolbar has compile and simulator toggle buttons', async ({ workbench }) => {
+    expect(await findButtonByText(workbench, '普通编译')).toBe(true)
+    await expect(workbench.getByRole('group', { name: '面板可见性' })).toBeVisible()
+    await expect(workbench.getByTestId('layout-toolbar-toggle-simulator')).toBeVisible()
   })
 
-  test('toolbar has built-in right panel tabs', async ({ mainWindow }) => {
-    const tabLabels = await mainWindow.evaluate(() => {
+  test('toolbar has built-in right panel tabs', async ({ workbench }) => {
+    const tabLabels = await workbench.evaluate(() => {
       const buttons = document.querySelectorAll('button')
       const labels: string[] = []
       buttons.forEach((btn) => {
@@ -31,22 +31,22 @@ test.describe('Simulator Panel', () => {
     expect(tabLabels).toEqual(expect.arrayContaining(['WXML', 'AppData', 'Storage']))
   })
 
-  test('can toggle simulator panel visibility', async ({ mainWindow }) => {
+  test('can toggle simulator panel visibility', async ({ workbench }) => {
     // Under native-host (now the default runtime) the simulator is a
     // main-process WebContentsView, NOT a renderer `<webview>` — SimulatorPanel
     // deliberately skips the `<webview>` (Electron forbids nesting webviews, so
     // DeviceShell's per-page render-host webviews can only attach to a top-level
-    // WCV). So `mainWindow.locator('webview')` is 0 in BOTH states and can't
+    // WCV). So `workbench.locator('webview')` is 0 in BOTH states and can't
     // gate visibility.
     //
-    // The observable visibility signal in the main-window DOM is the
+    // The observable visibility signal in the workbench DOM is the
     // SimulatorPanel itself: its device-picker `<select>` (the only `<select>`
     // carrying the device options, e.g. `iPhone SE`) mounts when the simulator
     // cell is in the compiled layout and unmounts when the cell is pruned. The
     // toolbar toggle flips `layoutStore.simulatorVisible`, which the layout
     // compile pass turns into the cell being present/absent (collapseInvisibleCells).
-    const deviceSelect = mainWindow.locator('select:has(option[value="iPhone SE"])')
-    const toggle = mainWindow.getByTestId('layout-toolbar-toggle-simulator')
+    const deviceSelect = workbench.locator('select:has(option[value="iPhone SE"])')
+    const toggle = workbench.getByTestId('layout-toolbar-toggle-simulator')
 
     await expect(deviceSelect).toHaveCount(1)
 
@@ -57,8 +57,8 @@ test.describe('Simulator Panel', () => {
     await expect(deviceSelect).toHaveCount(1)
   })
 
-  test('right panel tabs are rendered in the main window', async ({ mainWindow }) => {
-    const tabLabels = await mainWindow.evaluate(() => {
+  test('right panel tabs are rendered in the workbench window', async ({ workbench }) => {
+    const tabLabels = await workbench.evaluate(() => {
       const buttons = document.querySelectorAll('button')
       const labels: string[] = []
       buttons.forEach((btn) => {
diff --git a/packages/devtools/e2e/devtools-tab-order.spec.ts b/packages/devtools/e2e/devtools-tab-order.spec.ts
index 050521ff..520763a5 100644
--- a/packages/devtools/e2e/devtools-tab-order.spec.ts
+++ b/packages/devtools/e2e/devtools-tab-order.spec.ts
@@ -38,9 +38,9 @@ test.describe('Right-panel DevTools tab bar (default order, Sources kept)', () =
 
   useSharedProject(test, DEMO_APP_DIR)
 
-  test('Elements / Console / Sources / Network all visible; Network click selects Network', async ({ mainWindow, electronApp }) => {
+  test('Elements / Console / Sources / Network all visible; Network click selects Network', async ({ workbench, electronApp }) => {
     // Open the Console panel so the embedded Chrome DevTools front-end is mounted.
-    const consoleTab = mainWindow.getByRole('tab', { name: 'Console' })
+    const consoleTab = workbench.getByRole('tab', { name: 'Console' })
     await consoleTab.click()
     await expect(consoleTab).toHaveAttribute('data-active', 'true')
 
diff --git a/packages/devtools/e2e/dialog-zorder.spec.ts b/packages/devtools/e2e/dialog-zorder.spec.ts
index 3a3f7531..dcd483fe 100644
--- a/packages/devtools/e2e/dialog-zorder.spec.ts
+++ b/packages/devtools/e2e/dialog-zorder.spec.ts
@@ -1,7 +1,7 @@
 import { test, expect, _electron, type ElectronApplication, type Page } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { DEMO_APP_DIR, openProjectInUI, pollUntil, findMainWindow } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, pollUntil } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const TOOLBAR_FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
@@ -24,7 +24,30 @@ test.describe('Dialog overlay z-order (real Electron): update dialog stays above
   test.describe.configure({ mode: 'serial' })
 
   let electronApp: ElectronApplication
-  let mainWindow: Page
+  let workbench: Page
+
+  /**
+   * `instance.context` (dialog-zorder-entry.js's `onSetup`) is the
+   * PROJECT-LIST window's own context — the simulator/host-toolbar this spec
+   * checks z-order against only exist on an OPEN project's own window (the
+   * list window never runs a mini-app), so every check below reaches the
+   * workbench window's context through `instance.projectWindows()`, not
+   * `instance.context`.
+   */
+  interface DialogZorderInstance {
+    projectWindows(): Array<{
+      context: {
+        views: {
+          hostToolbar: { loadFile(p: string): Promise<void> }
+          getSimulatorWebContentsId(): number | null
+          getHostToolbarWebContentsId(): number | null
+          showUpdateDialog(info: { version: string; downloadUrl: string }): void
+          getUpdateDialogWebContentsId(): number | null
+          markOverlayReady(id: number): void
+        }
+      }
+    }>
+  }
 
   test.beforeAll(async () => {
     const entryPath = path.resolve(__dirname, 'dialog-zorder-entry.js')
@@ -32,25 +55,19 @@ test.describe('Dialog overlay z-order (real Electron): update dialog stays above
       args: [entryPath],
       env: { ...process.env, NODE_ENV: 'test' },
     })
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
+    workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
 
     // Give the host-toolbar a live, sized strip so it actually attaches to
     // the window's contentView — the occlusion bug required an ACTUAL native
     // view mounted above the main window's renderer, not just a placeholder
     // waiting for content.
     await electronApp.evaluate((_electronMods, file) => {
-      const g = globalThis as unknown as {
-        __e2eDialogZorderInstance: {
-          context: { views: { hostToolbar: { loadFile(p: string): Promise<void> } } }
-        }
-      }
-      return g.__e2eDialogZorderInstance.context.views.hostToolbar.loadFile(file)
+      const g = globalThis as unknown as { __e2eDialogZorderInstance: DialogZorderInstance }
+      return g.__e2eDialogZorderInstance.projectWindows()[0].context.views.hostToolbar.loadFile(file)
     }, path.join(TOOLBAR_FIXTURES, 'toolbar-64.html'))
 
     await pollUntil(
-      () => mainWindow.evaluate(() => {
+      () => workbench.evaluate(() => {
         const el = document.querySelector('[data-area="host-toolbar"]')
         return el ? Math.round(el.getBoundingClientRect().height) : -1
       }),
@@ -69,34 +86,20 @@ test.describe('Dialog overlay z-order (real Electron): update dialog stays above
 
   test('showUpdateDialog attaches its WCV above the live simulator and host-toolbar WCVs', async () => {
     const simulatorWcId = await electronApp.evaluate(() => {
-      const g = globalThis as unknown as {
-        __e2eDialogZorderInstance: { context: { views: { getSimulatorWebContentsId(): number | null } } }
-      }
-      return g.__e2eDialogZorderInstance.context.views.getSimulatorWebContentsId()
+      const g = globalThis as unknown as { __e2eDialogZorderInstance: DialogZorderInstance }
+      return g.__e2eDialogZorderInstance.projectWindows()[0].context.views.getSimulatorWebContentsId()
     })
     expect(simulatorWcId, 'simulator WCV must be live before the z-order check is meaningful').not.toBeNull()
 
     const toolbarWcId = await electronApp.evaluate(() => {
-      const g = globalThis as unknown as {
-        __e2eDialogZorderInstance: { context: { views: { getHostToolbarWebContentsId(): number | null } } }
-      }
-      return g.__e2eDialogZorderInstance.context.views.getHostToolbarWebContentsId()
+      const g = globalThis as unknown as { __e2eDialogZorderInstance: DialogZorderInstance }
+      return g.__e2eDialogZorderInstance.projectWindows()[0].context.views.getHostToolbarWebContentsId()
     })
     expect(toolbarWcId, 'host-toolbar WCV must be live before the z-order check is meaningful').not.toBeNull()
 
     const dialogWcId = await electronApp.evaluate(() => {
-      const g = globalThis as unknown as {
-        __e2eDialogZorderInstance: {
-          context: {
-            views: {
-              showUpdateDialog(info: { version: string; downloadUrl: string }): void
-              getUpdateDialogWebContentsId(): number | null
-              markOverlayReady(id: number): void
-            }
-          }
-        }
-      }
-      const views = g.__e2eDialogZorderInstance.context.views
+      const g = globalThis as unknown as { __e2eDialogZorderInstance: DialogZorderInstance }
+      const views = g.__e2eDialogZorderInstance.projectWindows()[0].context.views
       views.showUpdateDialog({ version: '2.0.0', downloadUrl: 'https://example.com/2.0.0.dmg' })
       const id = views.getUpdateDialogWebContentsId()
       if (id !== null) views.markOverlayReady(id)
diff --git a/packages/devtools/e2e/disk-sync.spec.ts b/packages/devtools/e2e/disk-sync.spec.ts
index 7dcaa485..b0e3cc49 100644
--- a/packages/devtools/e2e/disk-sync.spec.ts
+++ b/packages/devtools/e2e/disk-sync.spec.ts
@@ -72,9 +72,9 @@ test.describe('fs-core disk↔editor sync (embedded workbench)', () => {
   // the first test pays the attach+ready wait.
   useSharedProject(test, DEMO_APP_DIR, { openOptions: { waitMs: 60_000 }, openTimeoutMs: 120_000 })
   let workbenchReady = false
-  test.beforeEach(async ({ mainWindow, electronApp }) => {
+  test.beforeEach(async ({ workbench, electronApp }) => {
     if (workbenchReady) return
-    const status = await attachWorkbenchAndWaitReady(mainWindow, electronApp)
+    const status = await attachWorkbenchAndWaitReady(workbench, electronApp)
     expect(status, 'workbench must reach a ready status before driving the sync engine').toMatch(
       /workbench-ready|exthost-alive/,
     )
diff --git a/packages/devtools/e2e/dock-consolidation-smoke.spec.ts b/packages/devtools/e2e/dock-consolidation-smoke.spec.ts
index 49426849..b8ef54b1 100644
--- a/packages/devtools/e2e/dock-consolidation-smoke.spec.ts
+++ b/packages/devtools/e2e/dock-consolidation-smoke.spec.ts
@@ -11,12 +11,12 @@
 import { test, expect, _electron, type ElectronApplication, type Page as PwPage } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -29,30 +29,28 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   // Offscreen + blur so the smoke never steals focus.
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
 test('the sole dock layout renders (no flag, no FrameTree)', async () => {
   // DockView groups exist; the legacy FrameTree sim splitter does NOT.
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
-  const groupCount = await mainWindow.locator('[data-deck-group]').count()
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  const groupCount = await workbench.locator('[data-deck-group]').count()
   expect(groupCount, 'at least one dock group must render').toBeGreaterThanOrEqual(1)
 
   // No legacy FrameTree markers (the old path is deleted).
-  expect(await mainWindow.locator('[data-splitter="sim"]').count()).toBe(0)
-  expect(await mainWindow.locator('[data-area="native-simulator"]').count()).toBeGreaterThanOrEqual(0)
+  expect(await workbench.locator('[data-splitter="sim"]').count()).toBe(0)
+  expect(await workbench.locator('[data-area="native-simulator"]').count()).toBeGreaterThanOrEqual(0)
 })
 
 test('the five debug tabs surface as deck tabs; simulator + editor are tabless structural panels', async () => {
@@ -61,7 +59,7 @@ test('the five debug tabs surface as deck tabs; simulator + editor are tabless s
   // STRUCTURAL panels (`hideTab:true`): they own their own region and draw their
   // own chrome, so the dock renders NO tab for them — they are present as
   // tabless `[data-deck-panel-body]` bodies instead.
-  const tabIds = await mainWindow.evaluate(() =>
+  const tabIds = await workbench.evaluate(() =>
     Array.from(document.querySelectorAll('[data-deck-tab]')).map(
       (el) => el.getAttribute('data-deck-tab'),
     ),
@@ -71,7 +69,7 @@ test('the five debug tabs surface as deck tabs; simulator + editor are tabless s
   }
   for (const id of ['simulator', 'editor']) {
     expect(tabIds, `structural panel '${id}' must NOT render a deck tab (hideTab)`).not.toContain(id)
-    const bodyCount = await mainWindow.locator(`[data-deck-panel-body="${id}"]`).count()
+    const bodyCount = await workbench.locator(`[data-deck-panel-body="${id}"]`).count()
     expect(bodyCount, `structural panel '${id}' must be mounted as a tabless dock body`).toBeGreaterThanOrEqual(1)
   }
 })
@@ -82,15 +80,15 @@ test('simulator chrome (device picker + page-path bar) renders in the dock — n
   // `[data-area="native-simulator"]` (the WCV anchor) AND the chrome around it.
   // The simulator panel is the active leaf in the default tree, so its body is
   // mounted.
-  await mainWindow.waitForSelector('[data-deck-panel-body="simulator"]', { timeout: 10000 })
-  const region = mainWindow.locator('[data-area="native-simulator"]')
+  await workbench.waitForSelector('[data-deck-panel-body="simulator"]', { timeout: 10000 })
+  const region = workbench.locator('[data-area="native-simulator"]')
   expect(await region.count(), 'the simulator WCV anchor region must render').toBeGreaterThanOrEqual(1)
 })
 
 test('the simulator native WCV follows its slot (non-zero live bounds)', async () => {
   // The simulator slot must publish a non-zero rect to main, and the simulator
   // WebContentsView must be live (it loads simulator.html).
-  const slotRect = await mainWindow.evaluate(() => {
+  const slotRect = await workbench.evaluate(() => {
     const el = document.querySelector('[data-area="native-simulator"]')
     if (!el) return null
     const r = el.getBoundingClientRect()
@@ -114,16 +112,16 @@ test('the simulator native WCV follows its slot (non-zero live bounds)', async (
 test('switching a debug tab keeps the dock alive and mounts the new body (data refresh seam)', async () => {
   // Activate the WXML tab, then the Storage tab. Each activation mounts that
   // panel body (DockDebugTab fires the per-tab refresh on activation — M3).
-  const wxmlTab = mainWindow.locator('[data-deck-tab="wxml"]').first()
+  const wxmlTab = workbench.locator('[data-deck-tab="wxml"]').first()
   await wxmlTab.click()
-  await mainWindow.waitForSelector('[data-deck-panel-body="wxml"]', { timeout: 8000 })
+  await workbench.waitForSelector('[data-deck-panel-body="wxml"]', { timeout: 8000 })
 
-  const storageTab = mainWindow.locator('[data-deck-tab="storage"]').first()
+  const storageTab = workbench.locator('[data-deck-tab="storage"]').first()
   await storageTab.click()
-  await mainWindow.waitForSelector('[data-deck-panel-body="storage"]', { timeout: 8000 })
+  await workbench.waitForSelector('[data-deck-panel-body="storage"]', { timeout: 8000 })
 
   // The dock is still mounted after the switches.
-  expect(await mainWindow.locator('[data-deck-group]').count()).toBeGreaterThanOrEqual(1)
+  expect(await workbench.locator('[data-deck-group]').count()).toBeGreaterThanOrEqual(1)
 })
 
 test('changing the device re-pins the simulator width live (device-width fidelity)', async () => {
@@ -131,14 +129,14 @@ test('changing the device re-pins the simulator width live (device-width fidelit
   // width only at mount, so DockableLayout re-pins via setConstraint on a device
   // change. Switch the device <select> in SimulatorPanel's chrome and assert the
   // simulator region width tracks the new device width.
-  const before = await mainWindow.evaluate(() => {
+  const before = await workbench.evaluate(() => {
     const el = document.querySelector('[data-area="native-simulator"]')
     return el ? el.getBoundingClientRect().width : 0
   })
   expect(before, 'simulator region must have a width before the device change').toBeGreaterThan(0)
 
   // Pick a different device option in the first <select> inside the simulator body.
-  const changed = await mainWindow.evaluate(() => {
+  const changed = await workbench.evaluate(() => {
     const body = document.querySelector('[data-deck-panel-body="simulator"]')
     const select = body?.querySelector('select') as HTMLSelectElement | null
     if (!select || select.options.length < 2) return null
@@ -153,8 +151,8 @@ test('changing the device re-pins the simulator width live (device-width fidelit
   // The region width must settle to a (different) positive value — the constraint
   // re-pin flowed through. We assert it stays positive and finite; an exact px
   // match depends on device metadata, so we assert it changed OR stayed valid.
-  await mainWindow.waitForTimeout(500)
-  const after = await mainWindow.evaluate(() => {
+  await workbench.waitForTimeout(500)
+  const after = await workbench.evaluate(() => {
     const el = document.querySelector('[data-area="native-simulator"]')
     return el ? el.getBoundingClientRect().width : 0
   })
@@ -169,7 +167,7 @@ test('the drop seam rejects re-docking a structural panel — no-op, no tree mut
   // within-group tab reordering is covered by dock-tab-reorder.spec.ts.)
 
   // Snapshot editor's enclosing group id + the total group count BEFORE the drop.
-  const before = await mainWindow.evaluate(() => ({
+  const before = await workbench.evaluate(() => ({
     editorGroupId: document
       .querySelector('[data-deck-panel-body="editor"]')
       ?.closest('[data-deck-group]')
@@ -178,7 +176,7 @@ test('the drop seam rejects re-docking a structural panel — no-op, no tree mut
   }))
   expect(before.editorGroupId, 'editor must start mounted inside a dock group').not.toBeNull()
 
-  const seamReached = await mainWindow.evaluate(() => {
+  const seamReached = await workbench.evaluate(() => {
     const groups = Array.from(document.querySelectorAll('[data-deck-group]')) as Array<
       HTMLElement & { __deckHandleDrop?: (panelId: string, zone: string) => void }
     >
@@ -188,11 +186,11 @@ test('the drop seam rejects re-docking a structural panel — no-op, no tree mut
     return true
   })
   expect(seamReached, 'the __deckHandleDrop seam must be reachable on a group').toBe(true)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 5000 })
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 5000 })
 
   // The rejected drop changed NOTHING: editor sits in the same group and the
   // group count is unchanged (no split spawned a new group).
-  const after = await mainWindow.evaluate(() => ({
+  const after = await workbench.evaluate(() => ({
     editorGroupId: document
       .querySelector('[data-deck-panel-body="editor"]')
       ?.closest('[data-deck-group]')
diff --git a/packages/devtools/e2e/dock-devtools-position-preset.spec.ts b/packages/devtools/e2e/dock-devtools-position-preset.spec.ts
index 5010677a..1a93a3c5 100644
--- a/packages/devtools/e2e/dock-devtools-position-preset.spec.ts
+++ b/packages/devtools/e2e/dock-devtools-position-preset.spec.ts
@@ -42,12 +42,12 @@ import {
 } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -61,18 +61,16 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -97,10 +95,10 @@ async function editorWidth(page: PwPage): Promise<number> {
 const MIN_HEALTHY_EDITOR_WIDTH = 50
 
 test('[needs-real-electron] Bug #3: rightOfSimulator -> belowSimulator does not collapse the editor width', async () => {
-  await clickPreset(mainWindow, 'rightOfSimulator')
-  await clickPreset(mainWindow, 'belowSimulator')
+  await clickPreset(workbench, 'rightOfSimulator')
+  await clickPreset(workbench, 'belowSimulator')
 
-  const w = await editorWidth(mainWindow)
+  const w = await editorWidth(workbench)
   expect(
     w,
     `editor width after rightOfSimulator->belowSimulator must stay healthy (got ${w}px — a collapse to a few px is Bug #3)`,
@@ -108,18 +106,18 @@ test('[needs-real-electron] Bug #3: rightOfSimulator -> belowSimulator does not
 })
 
 test('[regress] inEditor -> belowSimulator keeps the editor visible (no root child-count change; must stay healthy)', async () => {
-  await clickPreset(mainWindow, 'inEditor')
-  await clickPreset(mainWindow, 'belowSimulator')
+  await clickPreset(workbench, 'inEditor')
+  await clickPreset(workbench, 'belowSimulator')
 
-  const w = await editorWidth(mainWindow)
+  const w = await editorWidth(workbench)
   expect(w).toBeGreaterThan(MIN_HEALTHY_EDITOR_WIDTH)
 })
 
 test('[regress] inEditor <-> rightOfSimulator keeps the editor visible in both directions (neither pins a nested split)', async () => {
-  await clickPreset(mainWindow, 'inEditor')
-  await clickPreset(mainWindow, 'rightOfSimulator')
-  expect(await editorWidth(mainWindow)).toBeGreaterThan(MIN_HEALTHY_EDITOR_WIDTH)
+  await clickPreset(workbench, 'inEditor')
+  await clickPreset(workbench, 'rightOfSimulator')
+  expect(await editorWidth(workbench)).toBeGreaterThan(MIN_HEALTHY_EDITOR_WIDTH)
 
-  await clickPreset(mainWindow, 'inEditor')
-  expect(await editorWidth(mainWindow)).toBeGreaterThan(MIN_HEALTHY_EDITOR_WIDTH)
+  await clickPreset(workbench, 'inEditor')
+  expect(await editorWidth(workbench)).toBeGreaterThan(MIN_HEALTHY_EDITOR_WIDTH)
 })
diff --git a/packages/devtools/e2e/dock-keepalive-and-collapse.spec.ts b/packages/devtools/e2e/dock-keepalive-and-collapse.spec.ts
index 3f1cb38b..73b01b84 100644
--- a/packages/devtools/e2e/dock-keepalive-and-collapse.spec.ts
+++ b/packages/devtools/e2e/dock-keepalive-and-collapse.spec.ts
@@ -32,12 +32,12 @@ import {
 } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -51,19 +51,17 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   // Offscreen + blur so the spec never steals focus.
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -134,10 +132,10 @@ test('A3: a kept-alive debug body is NOT remounted across a tab switch (DOM iden
   // build a brand-new element and lose the imperatively-set attribute; (2) a
   // scrollTop on the first scrollable descendant. Both must survive A→B→A iff
   // the body was kept alive (display:none) rather than unmounted.
-  await activateTab(mainWindow, 'wxml')
+  await activateTab(workbench, 'wxml')
 
   const stamp = `keepalive-${Date.now()}`
-  const stamped = await mainWindow.evaluate((mark) => {
+  const stamped = await workbench.evaluate((mark) => {
     const body = document.querySelector('[data-deck-panel-body="wxml"]') as HTMLElement | null
     if (!body) return { ok: false, reason: 'no wxml body' }
 
@@ -174,8 +172,8 @@ test('A3: a kept-alive debug body is NOT remounted across a tab switch (DOM iden
 
   // Switch AWAY to storage, then assert wxml stayed MOUNTED but hidden (the
   // keepalive contract: inactive body is display:none, NOT removed).
-  await activateTab(mainWindow, 'storage')
-  const wxmlHiddenButMounted = await mainWindow.evaluate(() => {
+  await activateTab(workbench, 'storage')
+  const wxmlHiddenButMounted = await workbench.evaluate(() => {
     const body = document.querySelector('[data-deck-panel-body="wxml"]') as HTMLElement | null
     if (!body) return { mounted: false, display: null as string | null }
     return { mounted: true, display: getComputedStyle(body).display }
@@ -185,8 +183,8 @@ test('A3: a kept-alive debug body is NOT remounted across a tab switch (DOM iden
 
   // Switch BACK to wxml and assert the stamped element + scroll survived — i.e.
   // the body was the SAME instance, never remounted.
-  await activateTab(mainWindow, 'wxml')
-  const survived = await mainWindow.evaluate((mark) => {
+  await activateTab(workbench, 'wxml')
+  const survived = await workbench.evaluate((mark) => {
     const body = document.querySelector('[data-deck-panel-body="wxml"]') as HTMLElement | null
     if (!body) return { ok: false, markFound: false, scrollTop: null as number | null, hadScrollProbe: false }
     const marked = body.querySelector(`[data-e2e-keepalive-mark="${mark}"]`)
@@ -225,10 +223,10 @@ test('B1: the simulator native WCV collapses (detaches, kept alive) when the sim
   // main maps the zero-area rect to COLLAPSE, `removeChildView`-ing the WCV from
   // the contentView tree (detach) while keeping its WebContents alive. So the
   // collapse is observed as `alive && bounds === null`.
-  const toggle = mainWindow.locator('[data-testid="layout-toolbar-toggle-simulator"]')
+  const toggle = workbench.locator('[data-testid="layout-toolbar-toggle-simulator"]')
 
   // Baseline: the simulator WCV is attached with live, non-zero bounds.
-  await mainWindow.waitForTimeout(500)
+  await workbench.waitForTimeout(500)
   const active = await simulatorView(electronApp)
   expect(active.alive, 'simulator WebContents must be alive while shown').toBe(true)
   expect(active.bounds, 'shown simulator WCV must be ATTACHED with live bounds').not.toBeNull()
@@ -239,7 +237,7 @@ test('B1: the simulator native WCV collapses (detaches, kept alive) when the sim
 
   // Hide the simulator via the real toolbar toggle → detach-but-keep-alive.
   await toggle.click()
-  await mainWindow.waitForTimeout(800)
+  await workbench.waitForTimeout(800)
 
   const collapsed = await simulatorView(electronApp)
   expect(
@@ -254,7 +252,7 @@ test('B1: the simulator native WCV collapses (detaches, kept alive) when the sim
   // Show the simulator again → the slot re-mounts → the anchor re-publishes a
   // non-zero rect → main re-attaches the WCV and restores its bounds.
   await toggle.click()
-  await mainWindow.waitForTimeout(800)
+  await workbench.waitForTimeout(800)
 
   const restored = await simulatorView(electronApp)
   expect(restored.alive, 'simulator WebContents must still be alive after being shown again').toBe(true)
diff --git a/packages/devtools/e2e/dock-real-drag.spec.ts b/packages/devtools/e2e/dock-real-drag.spec.ts
index 80a94a2c..df18be16 100644
--- a/packages/devtools/e2e/dock-real-drag.spec.ts
+++ b/packages/devtools/e2e/dock-real-drag.spec.ts
@@ -47,13 +47,12 @@ import {
   DEMO_APP_DIR,
   installConsoleCollector,
   readConsoleErrors,
-  findMainWindow,
 } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -67,20 +66,18 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   await installConsoleCollector(electronApp)
   // Offscreen + blur so the drag test never steals focus.
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -282,14 +279,14 @@ test('CENTER over a locked editor group: indicator shows center, but a reorder-o
   // of wxml onto the editor group must be REJECTED (no churn), even though the
   // geometry-driven hover indicator still paints `center` (the gate is at drop
   // time, not hover time). Drives both PanelCapabilities gates with real geometry.
-  const before = await dockFingerprint(mainWindow)
+  const before = await dockFingerprint(workbench)
   const wxmlGroupBefore = before.groupOf['wxml']
   const editorGroupBefore = before.groupOf['editor']
   expect(wxmlGroupBefore, 'wxml must be docked before the drag').toBeTruthy()
   expect(editorGroupBefore, 'editor must be docked before the drag').toBeTruthy()
   expect(wxmlGroupBefore, 'wxml and editor start in DIFFERENT groups').not.toBe(editorGroupBefore)
 
-  const r = await realDragTab(mainWindow, 'wxml', 'editor', 0.5, 0.5)
+  const r = await realDragTab(workbench, 'wxml', 'editor', 0.5, 0.5)
   expect(r.error, `drag must not throw: ${r.error}`).toBeNull()
   expect(r.ok, 'drag sequence must run').toBe(true)
   // The live indicator paints `center` while hovering the interior (presentation
@@ -297,8 +294,8 @@ test('CENTER over a locked editor group: indicator shows center, but a reorder-o
   expect(r.indicatorSeen, 'a drop-zone indicator must appear during dragover').toBe(true)
   expect(r.zoneAtHover, 'interior hover must compute the center zone').toBe('center')
 
-  await mainWindow.waitForTimeout(300)
-  const after = await dockFingerprint(mainWindow)
+  await workbench.waitForTimeout(300)
+  const after = await dockFingerprint(workbench)
 
   // The drop is rejected on BOTH gates: wxml stays in its own group, never joins
   // editor, and the overall group membership is unchanged.
@@ -313,20 +310,20 @@ test('LEFT band over a locked editor group: indicator shows left, but a reorder-
   // draggable:false). So an edge (far-left band) drop of console onto the editor
   // group is REJECTED: no new split, console stays put. The hover indicator still
   // paints `left` (geometry-only presentation).
-  const before = await dockFingerprint(mainWindow)
+  const before = await dockFingerprint(workbench)
   const consoleGroupBefore = before.groupOf['console']
   expect(consoleGroupBefore, 'console must be docked before the drag').toBeTruthy()
   const splitsBefore = before.splits.length
 
   // Drop console onto the far-left 5% band of the group that owns editor.
-  const r = await realDragTab(mainWindow, 'console', 'editor', 0.05, 0.5)
+  const r = await realDragTab(workbench, 'console', 'editor', 0.05, 0.5)
   expect(r.error, `drag must not throw: ${r.error}`).toBeNull()
   // The indicator paints `left` over the left band (presentation is geometry-only).
   expect(r.indicatorSeen, 'a drop-zone indicator must appear during dragover').toBe(true)
   expect(r.zoneAtHover, 'far-left hover must compute the left zone').toBe('left')
 
-  await mainWindow.waitForTimeout(300)
-  const after = await dockFingerprint(mainWindow)
+  await workbench.waitForTimeout(300)
+  const after = await dockFingerprint(workbench)
 
   // The edge drop is rejected: no split is introduced and console stays in its
   // original group (it never tears out toward the editor region).
@@ -337,7 +334,7 @@ test('LEFT band over a locked editor group: indicator shows left, but a reorder-
 })
 
 test('self-drop center of a reorder-only debug tab stays WITHIN its own group (never leaves, never crashes)', async () => {
-  const before = await dockFingerprint(mainWindow)
+  const before = await dockFingerprint(workbench)
   // Pick a real DRAGGABLE source: a debug tab (the source must own a
   // `[data-deck-tab]`). The structural simulator/editor panels are tabless
   // (hideTab) and draggable:false, so they can never be a drag source.
@@ -349,11 +346,11 @@ test('self-drop center of a reorder-only debug tab stays WITHIN its own group (n
   // A center drop onto its OWN group is the one motion `reorder-only` permits — it
   // REORDERS within the group (it never leaves). The exact resulting index is
   // pointer-derived; the invariant is: same group, same membership set, no crash.
-  const r = await realDragTab(mainWindow, selfPanel, selfPanel, 0.5, 0.5)
+  const r = await realDragTab(workbench, selfPanel, selfPanel, 0.5, 0.5)
   expect(r.error, `self-drop must not throw: ${r.error}`).toBeNull()
 
-  await mainWindow.waitForTimeout(200)
-  const after = await dockFingerprint(mainWindow)
+  await workbench.waitForTimeout(200)
+  const after = await dockFingerprint(workbench)
   // The panel stays in its own group (reorder-only never tears out).
   expect(after.groupOf[selfPanel], 'self-center drop keeps the panel in its own group').toBe(selfGroupBefore)
   // Group membership (as a SET) is unchanged — only the within-group ORDER may shift.
@@ -373,19 +370,19 @@ test('native anchor: the simulator (draggable:false) cannot be torn out — a dr
   // its live WCV bounds are unchanged.
   const beforeBounds = await simulatorBounds(electronApp)
   expect(beforeBounds, 'simulator WCV must have live bounds').not.toBeNull()
-  const before = await dockFingerprint(mainWindow)
+  const before = await dockFingerprint(workbench)
   const simGroupBefore = before.groupOf['simulator']
   expect(simGroupBefore, 'simulator must be docked').toBeTruthy()
 
   // The simulator has no `[data-deck-tab]`, so realDragTab cannot pick it up — the
   // gesture fails to even start, which IS the contract (a draggable:false panel
   // can never be lifted).
-  const r = await realDragTab(mainWindow, 'simulator', 'editor', 0.5, 0.95)
+  const r = await realDragTab(workbench, 'simulator', 'editor', 0.5, 0.95)
   expect(r.ok, 'a draggable:false panel cannot start a drag (no source tab)').toBe(false)
   expect(r.error, 'the absent tab is the reason the drag never starts').toMatch(/no source tab simulator/)
 
-  await mainWindow.waitForTimeout(300)
-  const after = await dockFingerprint(mainWindow)
+  await workbench.waitForTimeout(300)
+  const after = await dockFingerprint(workbench)
   // The simulator stays in its group and the tree is unchanged.
   expect(after.groupOf['simulator'], 'simulator never leaves its group').toBe(simGroupBefore)
   expect(after.groupOf, 'a failed simulator drag must not churn the tree').toEqual(before.groupOf)
diff --git a/packages/devtools/e2e/dock-resize-sync-regressions.spec.ts b/packages/devtools/e2e/dock-resize-sync-regressions.spec.ts
index e5fa932d..94eca698 100644
--- a/packages/devtools/e2e/dock-resize-sync-regressions.spec.ts
+++ b/packages/devtools/e2e/dock-resize-sync-regressions.spec.ts
@@ -52,12 +52,12 @@ import {
 } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -71,19 +71,17 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   // Offscreen + blur so the spec never steals focus (real pointer drags below).
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -185,10 +183,10 @@ function topShare(sizes: number[]): number {
 test('[needs-real-electron] R1: a sub-0.5% real splitter drag PERSISTS to the model (v3 normalizes it above FLEX_RATIO_TOLERANCE)', async () => {
   // col-main is the column split [editor | debug], both flexible. Reset to a
   // clean 50/50 so the small drag's flexible delta is unambiguous.
-  await applyLayout(mainWindow, 'col-main', [50, 50])
-  await mainWindow.waitForTimeout(300)
+  await applyLayout(workbench, 'col-main', [50, 50])
+  await workbench.waitForTimeout(300)
 
-  const before = await splitInfo(mainWindow, 'col-main')
+  const before = await splitInfo(workbench, 'col-main')
   expect(before, 'col-main must render with a resize handle').not.toBeNull()
   expect(before!.handle, 'col-main must expose a [data-deck-resize-handle]').not.toBeNull()
   expect(before!.axis).toBe('h')
@@ -202,10 +200,10 @@ test('[needs-real-electron] R1: a sub-0.5% real splitter drag PERSISTS to the mo
   const dy = 3 // observed: container ~908px → 0.5% ≈ 4.5px, so 3px is sub-0.5%
   expect(dy, `the drag (${dy}px) must be under 0.5% of the container (${halfPctPx.toFixed(2)}px) to exercise the epsilon`).toBeLessThan(halfPctPx)
 
-  await dragHandle(mainWindow, 'col-main', [{ dx: 0, dy }])
-  await mainWindow.waitForTimeout(400)
+  await dragHandle(workbench, 'col-main', [{ dx: 0, dy }])
+  await workbench.waitForTimeout(400)
 
-  const after = await splitInfo(mainWindow, 'col-main')
+  const after = await splitInfo(workbench, 'col-main')
 
   // SANITY: the real pointer drag DID move the VISIBLE split — rrp committed the
   // small move (so this is a genuine completed user drag, not a no-op gesture).
@@ -255,7 +253,7 @@ test('[needs-real-electron] R2: a fixed-px split does NOT corrupt the flexible c
   // is also 100 ⇒ 100==100 within `FLEX_RATIO_TOLERANCE` ⇒ the echo (and any
   // ratio-preserving spontaneous re-measure) is SKIPPED ⇒ the raw seed weight 1
   // is never overwritten.
-  const root = await mainWindow.evaluate(() => {
+  const root = await workbench.evaluate(() => {
     const s = document.querySelector('[data-deck-split="dock-root"]')
     if (!s) return null
     return {
@@ -311,18 +309,18 @@ test('[needs-real-electron] R3: a drag that returns to origin does NOT freeze la
   // (≈)its origin (net-zero change), but with no gate flag there is nothing left
   // armed — so a later programmatic `setSizes` syncs the visible split
   // immediately.
-  await applyLayout(mainWindow, 'col-main', [50, 50])
-  await mainWindow.waitForTimeout(300)
+  await applyLayout(workbench, 'col-main', [50, 50])
+  await workbench.waitForTimeout(300)
 
-  const before = await splitInfo(mainWindow, 'col-main')
+  const before = await splitInfo(workbench, 'col-main')
   expect(before!.handle, 'col-main must expose a handle').not.toBeNull()
   const beforeTop = before!.sizes[0]!
 
   // Real pointer drag AWAY (+80px) then BACK to the exact origin, then release.
-  await dragHandle(mainWindow, 'col-main', [{ dx: 0, dy: 80 }, { dx: 0, dy: 0 }])
-  await mainWindow.waitForTimeout(400)
+  await dragHandle(workbench, 'col-main', [{ dx: 0, dy: 80 }, { dx: 0, dy: 0 }])
+  await workbench.waitForTimeout(400)
 
-  const afterDrag = await splitInfo(mainWindow, 'col-main')
+  const afterDrag = await splitInfo(workbench, 'col-main')
   // The drag returned to origin: the visible split is back where it started.
   expect(
     Math.abs(afterDrag!.sizes[0]! - beforeTop),
@@ -330,10 +328,10 @@ test('[needs-real-electron] R3: a drag that returns to origin does NOT freeze la
   ).toBeLessThanOrEqual(4)
 
   // Now drive a PROGRAMMATIC setSizes to a dramatically different ratio.
-  await applyLayout(mainWindow, 'col-main', [10, 90])
-  await mainWindow.waitForTimeout(500)
+  await applyLayout(workbench, 'col-main', [10, 90])
+  await workbench.waitForTimeout(500)
 
-  const afterProg = await splitInfo(mainWindow, 'col-main')
+  const afterProg = await splitInfo(workbench, 'col-main')
   // The model + mirror update regardless (setSizes mutates the model).
   expect(afterProg!.sizesAttr, 'the programmatic setSizes lands in the model').toBe('10,90')
 
diff --git a/packages/devtools/e2e/dock-resize-sync-regressions2.spec.ts b/packages/devtools/e2e/dock-resize-sync-regressions2.spec.ts
index e983f121..2fa34ab4 100644
--- a/packages/devtools/e2e/dock-resize-sync-regressions2.spec.ts
+++ b/packages/devtools/e2e/dock-resize-sync-regressions2.spec.ts
@@ -42,12 +42,12 @@ import {
 import path from 'path'
 import fs from 'fs'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 const SPEC_USERDATA = 'dock-resize-sync-regressions2'
 
@@ -66,19 +66,17 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   // Offscreen + blur so the spec never steals focus.
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -140,11 +138,11 @@ test('[needs-real-electron] R-KB: a keyboard (Arrow-key) resize persists to the
 
   // Reset to a clean, symmetric [50,50] via the programmatic seam so the start
   // state is deterministic and the keyboard move is unambiguous.
-  const reset = await applyLayout(mainWindow, split, [50, 50])
+  const reset = await applyLayout(workbench, split, [50, 50])
   expect(reset, 'the col-main write-back seam must be reachable to seed [50,50]').toBe(true)
-  await mainWindow.waitForTimeout(400)
+  await workbench.waitForTimeout(400)
 
-  const before = await panelSizes(mainWindow, split)
+  const before = await panelSizes(workbench, split)
   expect(before, `the ${split} split must render with two flexible panels`).not.toBeNull()
   expect(before!.axis).toBe('h')
   expect(before!.sizes.length, 'col-main must have exactly two stacked panels').toBe(2)
@@ -158,7 +156,7 @@ test('[needs-real-electron] R-KB: a keyboard (Arrow-key) resize persists to the
   // SEPARATOR (rrp's listener reads `e.currentTarget`). For a vertical split
   // ArrowUp shrinks the top panel by 5% per press. We press several times so
   // the move is well above measurement noise.
-  const kb = await mainWindow.evaluate((id) => {
+  const kb = await workbench.evaluate((id) => {
     const splitEl = document.querySelector(`[data-deck-split="${id}"]`)
     if (!splitEl) return { ok: false, why: 'no split element', role: null, tabIndex: null }
     const handle = splitEl.querySelector('[data-deck-resize-handle]') as HTMLElement | null
@@ -184,9 +182,9 @@ test('[needs-real-electron] R-KB: a keyboard (Arrow-key) resize persists to the
   expect(kb.role, 'rrp resize handle must be role="separator" (keyboard-operable)').toBe('separator')
   expect(kb.tabIndex, 'rrp resize handle must be focusable (tabIndex 0)').toBe(0)
 
-  await mainWindow.waitForTimeout(500)
+  await workbench.waitForTimeout(500)
 
-  const after = await panelSizes(mainWindow, split)
+  const after = await panelSizes(workbench, split)
   expect(after, 'col-main must still render after the keyboard resize').not.toBeNull()
   expect(after!.sizes.length).toBe(2)
 
@@ -260,14 +258,14 @@ test.fixme(
     // whose flexible ratios are unchanged, so v3 SKIPS its write-back.
     const split = 'dock-root'
 
-    const rootBefore = await panelSizes(mainWindow, split)
+    const rootBefore = await panelSizes(workbench, split)
     expect(rootBefore, 'the root split must render').not.toBeNull()
     expect(rootBefore!.sizes.length, 'root split has two children (sim | main)').toBe(2)
     const weightsBefore = rootBefore!.sizesAttr
     expect(weightsBefore, 'root split must mirror its raw weights').toBeTruthy()
 
     // Locate the root split's DIRECT resize handle and its midpoint.
-    const handleBox = await mainWindow.evaluate(() => {
+    const handleBox = await workbench.evaluate(() => {
       const splitEl = document.querySelector('[data-deck-split="dock-root"]')
       if (!splitEl) return null
       const handle = splitEl.querySelector('[data-deck-resize-handle]') as HTMLElement | null
@@ -283,19 +281,19 @@ test.fixme(
     // exactly what rrp listens to (pointerdown/move/up + setPointerCapture).
     const cx = handleBox!.x
     const cy = handleBox!.y
-    await mainWindow.mouse.move(cx, cy)
-    await mainWindow.mouse.down()
-    for (const dx of [15, 30, 45, 60]) await mainWindow.mouse.move(cx + dx, cy, { steps: 4 })
-    await mainWindow.waitForTimeout(50)
-    for (const dx of [45, 30, 15, 0]) await mainWindow.mouse.move(cx + dx, cy, { steps: 4 })
-    await mainWindow.mouse.up()
-    await mainWindow.waitForTimeout(300)
+    await workbench.mouse.move(cx, cy)
+    await workbench.mouse.down()
+    for (const dx of [15, 30, 45, 60]) await workbench.mouse.move(cx + dx, cy, { steps: 4 })
+    await workbench.waitForTimeout(50)
+    for (const dx of [45, 30, 15, 0]) await workbench.mouse.move(cx + dx, cy, { steps: 4 })
+    await workbench.mouse.up()
+    await workbench.waitForTimeout(300)
 
-    const weightsAfterDrag = (await panelSizes(mainWindow, split))!.sizesAttr
+    const weightsAfterDrag = (await panelSizes(workbench, split))!.sizesAttr
 
     // Trigger a SPONTANEOUS re-measure WITHOUT any user resize: change the device
     // so the fixed-px sim leaf re-pins → the root re-measures → `onLayoutChanged`.
-    const changed = await mainWindow.evaluate(() => {
+    const changed = await workbench.evaluate(() => {
       const body = document.querySelector('[data-deck-panel-body="simulator"]')
       const select = body?.querySelector('select') as HTMLSelectElement | null
       if (!select || select.options.length < 2) return null
@@ -306,9 +304,9 @@ test.fixme(
       return { from: cur, to: next, label: select.options[next]!.textContent }
     })
     expect(changed, 'the device <select> must exist with >1 option to trigger a re-measure').not.toBeNull()
-    await mainWindow.waitForTimeout(600)
+    await workbench.waitForTimeout(600)
 
-    const weightsAfterDevice = (await panelSizes(mainWindow, split))!.sizesAttr
+    const weightsAfterDevice = (await panelSizes(workbench, split))!.sizesAttr
 
     // R-LEAK (v3): a re-measure is NOT a user resize, so the root's raw weights
     // must be UNCHANGED. v3's basis-normalized compare skips the ratio-preserving
diff --git a/packages/devtools/e2e/dock-resize-sync.spec.ts b/packages/devtools/e2e/dock-resize-sync.spec.ts
index 51e07cd7..950e5479 100644
--- a/packages/devtools/e2e/dock-resize-sync.spec.ts
+++ b/packages/devtools/e2e/dock-resize-sync.spec.ts
@@ -43,12 +43,12 @@ import {
 } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -62,19 +62,17 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   // Offscreen + blur so the spec never steals focus.
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-group]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-group]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -133,7 +131,7 @@ test('[needs-real-electron] M1: a programmatic setSizes moves the VISIBLE split
   // assert the visible heights follow.
   const split = 'col-main'
 
-  const before = await panelSizes(mainWindow, split)
+  const before = await panelSizes(workbench, split)
   expect(before, `the ${split} split must render with two flexible panels`).not.toBeNull()
   expect(before!.axis).toBe('h')
   expect(before!.sizes.length, 'col-main must have exactly two stacked panels').toBe(2)
@@ -143,13 +141,13 @@ test('[needs-real-electron] M1: a programmatic setSizes moves the VISIBLE split
 
   // Drive a PROGRAMMATIC setSizes to invert the ratio dramatically: shrink the
   // editor (top) to a small share, grow the debug group (bottom).
-  const applied = await applyLayout(mainWindow, split, [10, 90])
+  const applied = await applyLayout(workbench, split, [10, 90])
   expect(applied, 'the __deckApplyLayout write-back seam must be reachable on col-main').toBe(true)
-  await mainWindow.waitForTimeout(400)
+  await workbench.waitForTimeout(400)
 
   // The model + mirror update on HEAD already — assert them so a regression that
   // breaks the model write itself is also caught.
-  const after = await panelSizes(mainWindow, split)
+  const after = await panelSizes(workbench, split)
   expect(after, 'col-main must still render after setSizes').not.toBeNull()
   expect(after!.sizesAttr, 'data-deck-sizes must mirror the new model weights').toBe('10,90')
 
@@ -189,14 +187,14 @@ test('[regress] M1-regress: a user resize round-trips view→model (write-back n
   const split = 'col-main'
 
   // Restore to a known starting ratio first.
-  await applyLayout(mainWindow, split, [60, 40])
-  await mainWindow.waitForTimeout(300)
+  await applyLayout(workbench, split, [60, 40])
+  await workbench.waitForTimeout(300)
 
-  const applied = await applyLayout(mainWindow, split, [40, 60])
+  const applied = await applyLayout(workbench, split, [40, 60])
   expect(applied).toBe(true)
-  await mainWindow.waitForTimeout(400)
+  await workbench.waitForTimeout(400)
 
-  const after = await panelSizes(mainWindow, split)
+  const after = await panelSizes(workbench, split)
   // The user write-back lands in the model/mirror (true on HEAD; must stay true).
   expect(after!.sizesAttr, 'the user write-back must land in the model/mirror').toBe('40,60')
 })
@@ -208,10 +206,10 @@ test('[regress] M1-regress: a user resize round-trips view→model (write-back n
 test('[needs-real-electron] M1: the visible split settles at the user-written ratio (RED on HEAD)', async () => {
   const split = 'col-main'
 
-  await applyLayout(mainWindow, split, [40, 60])
-  await mainWindow.waitForTimeout(400)
+  await applyLayout(workbench, split, [40, 60])
+  await workbench.waitForTimeout(400)
 
-  const after = await panelSizes(mainWindow, split)
+  const after = await panelSizes(workbench, split)
   expect(after!.sizesAttr).toBe('40,60')
 
   const top = after!.sizes[0]!
@@ -234,7 +232,7 @@ test('[needs-real-electron] M1-fixed-px: a programmatic setSizes on flexible wei
   // weights must leave the simulator at its EXACT pixel width — the constraint is
   // not absorbed into the flexible percentage pool. Real pixels only: jsdom can't
   // convert the px lock without a measured container (see the unit spec header).
-  const simBefore = await mainWindow.evaluate(() => {
+  const simBefore = await workbench.evaluate(() => {
     const el = document.querySelector('[data-area="native-simulator"]')
     return el ? Math.round(el.getBoundingClientRect().width) : 0
   })
@@ -243,7 +241,7 @@ test('[needs-real-electron] M1-fixed-px: a programmatic setSizes on flexible wei
   // The root split holds [g-sim(fixed) | col-main(flexible)]. Drive a setSizes that
   // changes the FLEXIBLE sibling's weight; the fixed sim slot weight is carried
   // through unchanged by setSizes. We pass a full-length weights array.
-  const rootInfo = await mainWindow.evaluate(() => {
+  const rootInfo = await workbench.evaluate(() => {
     const split = document.querySelector('[data-deck-split="dock-root"]')
     return split ? { sizes: split.getAttribute('data-deck-sizes') } : null
   })
@@ -252,13 +250,13 @@ test('[needs-real-electron] M1-fixed-px: a programmatic setSizes on flexible wei
   expect(rootWeights.length, 'root split has two children (sim | main)').toBe(2)
 
   // Keep child0 (sim) weight, change child1 (main) weight.
-  const applied = await applyLayout(mainWindow, 'dock-root', [rootWeights[0]!, rootWeights[1]! * 2])
+  const applied = await applyLayout(workbench, 'dock-root', [rootWeights[0]!, rootWeights[1]! * 2])
   expect(applied).toBe(true)
-  await mainWindow.waitForTimeout(400)
+  await workbench.waitForTimeout(400)
 
   // [needs-real-electron] the simulator's pinned pixel width is UNCHANGED — the
   // fixed-px constraint was not disturbed by the flexible-weights setSizes.
-  const simAfter = await mainWindow.evaluate(() => {
+  const simAfter = await workbench.evaluate(() => {
     const el = document.querySelector('[data-area="native-simulator"]')
     return el ? Math.round(el.getBoundingClientRect().width) : 0
   })
diff --git a/packages/devtools/e2e/dock-separator-drag.spec.ts b/packages/devtools/e2e/dock-separator-drag.spec.ts
index 2cdd4905..f8d49327 100644
--- a/packages/devtools/e2e/dock-separator-drag.spec.ts
+++ b/packages/devtools/e2e/dock-separator-drag.spec.ts
@@ -19,12 +19,12 @@ import {
 import path from 'path'
 import { rmSync } from 'fs'
 import { fileURLToPath } from 'url'
-import { openProjectInUI, closeProject, DEMO_APP_DIR, findMainWindow } from './helpers'
+import { openProjectInUI, closeProject, DEMO_APP_DIR } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -42,18 +42,16 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-resize-handle]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-resize-handle]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -73,7 +71,7 @@ async function groupRectOf(page: PwPage, panelId: string): Promise<{ x: number;
 }
 
 test('the resize handle has a real grab area (not 0px)', async () => {
-  const handles = await mainWindow.evaluate(() =>
+  const handles = await workbench.evaluate(() =>
     Array.from(document.querySelectorAll('[data-deck-resize-handle]')).map((s) => {
       const r = s.getBoundingClientRect()
       return { w: Math.round(r.width), h: Math.round(r.height), aria: s.getAttribute('aria-orientation') }
@@ -91,21 +89,21 @@ test('dragging the editor/debug separator resizes the split (real pointer)', asy
   // The horizontal separator splits editor (top) and debug (bottom) — both
   // flexible, no native overlay over the handle.
   const hHandleCenter = (): Promise<{ cx: number; cy: number } | null> =>
-    mainWindow.evaluate(() => {
+    workbench.evaluate(() => {
       const h = document.querySelector('[data-deck-resize-handle][aria-orientation="horizontal"]') as HTMLElement | null
       if (!h) return null
       const r = h.getBoundingClientRect()
       return { cx: r.left + r.width / 2, cy: r.top + r.height / 2 }
     })
-  const editorH = async (): Promise<number> => (await groupRectOf(mainWindow, 'editor'))!.h
+  const editorH = async (): Promise<number> => (await groupRectOf(workbench, 'editor'))!.h
   const drag = async (dy: number): Promise<void> => {
     const h = await hHandleCenter()
     expect(h, 'a horizontal editor/debug separator must exist').not.toBeNull()
-    await mainWindow.mouse.move(h!.cx, h!.cy)
-    await mainWindow.mouse.down()
-    await mainWindow.mouse.move(h!.cx, h!.cy + dy, { steps: 10 })
-    await mainWindow.mouse.up()
-    await mainWindow.waitForTimeout(300)
+    await workbench.mouse.move(h!.cx, h!.cy)
+    await workbench.mouse.down()
+    await workbench.mouse.move(h!.cx, h!.cy + dy, { steps: 10 })
+    await workbench.mouse.up()
+    await workbench.waitForTimeout(300)
   }
 
   // Position-INDEPENDENT (the e2e userDataDir persists the prior run's split):
@@ -125,13 +123,13 @@ test('dragging the editor/debug separator resizes the split (real pointer)', asy
 test('the simulator column resizes via its left/right separator and floors at the device width (minPx)', async () => {
   // Width of the group containing the (tabless) simulator panel.
   const simWidth = (): Promise<number | null> =>
-    mainWindow.evaluate(() => {
+    workbench.evaluate(() => {
       const body = document.querySelector('[data-deck-panel-body="simulator"]')
       const g = body?.closest('[data-deck-group]') as HTMLElement | null
       return g ? Math.round(g.getBoundingClientRect().width) : null
     })
   const vHandleCenter = (): Promise<{ cx: number; cy: number } | null> =>
-    mainWindow.evaluate(() => {
+    workbench.evaluate(() => {
       const h = document.querySelector('[data-deck-resize-handle][aria-orientation="vertical"]') as HTMLElement | null
       if (!h) return null
       const r = h.getBoundingClientRect()
@@ -145,22 +143,22 @@ test('the simulator column resizes via its left/right separator and floors at th
   // Drag the vertical separator RIGHT → the simulator column grows.
   const h1 = await vHandleCenter()
   expect(h1, 'a vertical simulator│right separator must exist').not.toBeNull()
-  await mainWindow.mouse.move(h1!.cx, h1!.cy)
-  await mainWindow.mouse.down()
-  await mainWindow.mouse.move(h1!.cx + 160, h1!.cy, { steps: 10 })
-  await mainWindow.mouse.up()
-  await mainWindow.waitForTimeout(300)
+  await workbench.mouse.move(h1!.cx, h1!.cy)
+  await workbench.mouse.down()
+  await workbench.mouse.move(h1!.cx + 160, h1!.cy, { steps: 10 })
+  await workbench.mouse.up()
+  await workbench.waitForTimeout(300)
   const wider = await simWidth()
   expect(wider!, `column should widen (start ${start}, wider ${wider})`).toBeGreaterThan(start! + 60)
 
   // Drag the separator FAR LEFT → the column shrinks but FLOORS at the device
   // width (the minPx constraint); it must not collapse toward 0.
   const h2 = await vHandleCenter()
-  await mainWindow.mouse.move(h2!.cx, h2!.cy)
-  await mainWindow.mouse.down()
-  await mainWindow.mouse.move(h2!.cx - 700, h2!.cy, { steps: 14 })
-  await mainWindow.mouse.up()
-  await mainWindow.waitForTimeout(300)
+  await workbench.mouse.move(h2!.cx, h2!.cy)
+  await workbench.mouse.down()
+  await workbench.mouse.move(h2!.cx - 700, h2!.cy, { steps: 14 })
+  await workbench.mouse.up()
+  await workbench.waitForTimeout(300)
   const floored = await simWidth()
   // It shrank from the widened state (draggable narrower)…
   expect(floored!, `column shrank from the widened state (wider ${wider}, floored ${floored})`).toBeLessThan(wider! - 40)
diff --git a/packages/devtools/e2e/dock-tab-reorder.spec.ts b/packages/devtools/e2e/dock-tab-reorder.spec.ts
index 8a619929..91804037 100644
--- a/packages/devtools/e2e/dock-tab-reorder.spec.ts
+++ b/packages/devtools/e2e/dock-tab-reorder.spec.ts
@@ -28,13 +28,12 @@ import {
   DEMO_APP_DIR,
   installConsoleCollector,
   readConsoleErrors,
-  findMainWindow,
 } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 let electronApp: ElectronApplication
-let mainWindow: PwPage
+let workbench: PwPage
 
 test.beforeAll(async () => {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -48,19 +47,17 @@ test.beforeAll(async () => {
     args: [appPath, `--user-data-dir=${userDataDir}`],
     env: { ...process.env, NODE_ENV: 'test' },
   })
-  mainWindow = await findMainWindow(electronApp)
-  await mainWindow.waitForLoadState('domcontentloaded')
   await installConsoleCollector(electronApp)
   await electronApp.evaluate(async ({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows()[0]
     if (win) { win.setPosition(-2000, -2000); win.blur() }
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await mainWindow.waitForSelector('[data-deck-tab="storage"]', { timeout: 15000 })
+  workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await workbench.waitForSelector('[data-deck-tab="storage"]', { timeout: 15000 })
 })
 
 test.afterAll(async () => {
-  try { await closeProject(mainWindow) } catch { /* best effort */ }
+  try { await closeProject(electronApp) } catch { /* best effort */ }
   await electronApp.close()
 })
 
@@ -131,7 +128,7 @@ async function realReorderTab(
 test('debug tab reorders within its own strip on a drag-drop (real gesture)', async () => {
   // Order-INDEPENDENT: the e2e userDataDir persists the dock tree across runs, so
   // we don't assume the pristine default order — we capture whatever it is now.
-  const before = await tabOrderOfGroupOwning(mainWindow, 'storage')
+  const before = await tabOrderOfGroupOwning(workbench, 'storage')
   // The five debug panels are co-located in one group.
   expect([...before].sort()).toEqual(['appdata', 'compile', 'console', 'storage', 'wxml'])
 
@@ -139,11 +136,11 @@ test('debug tab reorders within its own strip on a drag-drop (real gesture)', as
   // last tab → it should move to the END of the strip.
   const first = before[0]
   const last = before[before.length - 1]
-  const res = await realReorderTab(mainWindow, first, last, 0.9)
+  const res = await realReorderTab(workbench, first, last, 0.9)
   expect(res.error, 'reorder gesture threw').toBeNull()
   expect(res.ok).toBe(true)
 
-  const after = await tabOrderOfGroupOwning(mainWindow, 'storage')
+  const after = await tabOrderOfGroupOwning(workbench, 'storage')
   // Same five panels, still ONE group, but the dragged tab moved to the end.
   expect([...after].sort()).toEqual([...before].sort())
   expect(after).toEqual([...before.slice(1), first])
@@ -155,7 +152,7 @@ test('a debug tab cannot be torn OUT of its group into another region', async ()
   // must be a no-op — the panel stays in the debug group; the editor group is
   // not joined/split. (Drives the GOAL-B "never leave the group" guard with real
   // geometry, complementing the jsdom seam tests.)
-  const groupsBefore = await mainWindow.evaluate(() =>
+  const groupsBefore = await workbench.evaluate(() =>
     Array.from(document.querySelectorAll('[data-deck-group]')).map((g) => ({
       id: g.getAttribute('data-deck-group'),
       // Include non-tab panels (hideTab: simulator/editor) via their body/native slot.
@@ -171,7 +168,7 @@ test('a debug tab cannot be torn OUT of its group into another region', async ()
   )
 
   // Drop 'storage' onto the center of the editor group's body.
-  await mainWindow.evaluate(async () => {
+  await workbench.evaluate(async () => {
     const tab = document.querySelector('[data-deck-tab="storage"]') as HTMLElement
     // editor has no tab (hideTab) — locate its group via the panel body.
     const editorBody = document.querySelector('[data-deck-panel-body="editor"]') as HTMLElement
@@ -196,7 +193,7 @@ test('a debug tab cannot be torn OUT of its group into another region', async ()
     await flush()
   })
 
-  const groupsAfter = await mainWindow.evaluate(() =>
+  const groupsAfter = await workbench.evaluate(() =>
     Array.from(document.querySelectorAll('[data-deck-group]')).map((g) => ({
       id: g.getAttribute('data-deck-group'),
       // Include non-tab panels (hideTab: simulator/editor) via their body/native slot.
@@ -240,20 +237,20 @@ test('a debug tab cannot be torn OUT of its group into another region', async ()
 
 test('simulator + editor render NO tab (hideTab), but their panels still exist', async () => {
   // The two structural panels draw their own chrome — no engine tab header.
-  expect(await mainWindow.locator('[data-deck-tab="simulator"]').count()).toBe(0)
-  expect(await mainWindow.locator('[data-deck-tab="editor"]').count()).toBe(0)
+  expect(await workbench.locator('[data-deck-tab="simulator"]').count()).toBe(0)
+  expect(await workbench.locator('[data-deck-tab="editor"]').count()).toBe(0)
   // …yet their bodies are still mounted (the panels render, just tabless).
-  expect(await mainWindow.locator('[data-deck-panel-body="editor"]').count()).toBeGreaterThan(0)
+  expect(await workbench.locator('[data-deck-panel-body="editor"]').count()).toBeGreaterThan(0)
   // debug tabs still have their headers.
-  expect(await mainWindow.locator('[data-deck-tab="storage"]').count()).toBe(1)
+  expect(await workbench.locator('[data-deck-tab="storage"]').count()).toBe(1)
 })
 
 test('the active debug panel body fills its full height (no dead space below)', async () => {
   // Activate a DOM debug tab so its body is the visible one, then verify the
   // panel content stretches to the body height (the #51 flex-fill regression).
-  await mainWindow.click('[data-deck-tab="storage"]')
-  await mainWindow.waitForTimeout(200)
-  const fit = await mainWindow.evaluate(() => {
+  await workbench.click('[data-deck-tab="storage"]')
+  await workbench.waitForTimeout(200)
+  const fit = await workbench.evaluate(() => {
     const body = document.querySelector('[data-deck-panel-body="storage"]') as HTMLElement | null
     if (!body) return null
     const child = body.firstElementChild as HTMLElement | null
diff --git a/packages/devtools/e2e/editor-hot-reload.spec.ts b/packages/devtools/e2e/editor-hot-reload.spec.ts
index 40d99796..b0b0fdb7 100644
--- a/packages/devtools/e2e/editor-hot-reload.spec.ts
+++ b/packages/devtools/e2e/editor-hot-reload.spec.ts
@@ -81,11 +81,11 @@ async function waitForRenderText(
  * spec exercises the real user flow, not a filesystem shortcut.
  */
 async function saveViaMonacoPath(
-  mainWindow: import('@playwright/test').Page,
+  workbench: import('@playwright/test').Page,
   absPath: string,
   content: string,
 ): Promise<void> {
-  await ipcInvoke(mainWindow, ProjectFsChannel.WriteFile, absPath, content)
+  await ipcInvoke(workbench, ProjectFsChannel.WriteFile, absPath, content)
 }
 
 /**
@@ -94,7 +94,7 @@ async function saveViaMonacoPath(
  * fully-compiled output. Best-effort — never throws.
  */
 async function settleAfterRestore(
-  mainWindow: import('@playwright/test').Page,
+  workbench: import('@playwright/test').Page,
 ): Promise<void> {
   // The restore write itself triggers one watcher rebuild (~1-2s compile).
   // Wait for that rebuild to actually start (toolbar leaves the settled "完成"
@@ -102,7 +102,7 @@ async function settleAfterRestore(
   // then wait for it to settle back to "…完成". This replaces a blind 8s sleep
   // with condition-based waits — the common case finishes in ~2-3s.
   const compileStatus = () =>
-    mainWindow.evaluate(() => {
+    workbench.evaluate(() => {
       const els = document.querySelectorAll('[class*="truncate"]')
       for (const el of els) {
         const t = el.textContent || ''
@@ -134,8 +134,8 @@ const HOT_RELOAD_WINDOW_MS = 20_000
 test.describe('Editor hot reload (save → rebuild → simulator refresh)', () => {
   test.setTimeout(150_000)
 
-  test.beforeEach(async ({ mainWindow, electronApp }) => {
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 30000 })
+  test.beforeEach(async ({ electronApp }) => {
+    await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 30000 })
     // Baseline: the home page must actually be rendering before we mutate
     // sources — otherwise a missing marker would just mean "never rendered".
     const baseline = await waitForRenderText(
@@ -148,12 +148,12 @@ test.describe('Editor hot reload (save → rebuild → simulator refresh)', () =
     )
   })
 
-  test.afterEach(async ({ mainWindow }) => {
-    await closeProject(mainWindow)
+  test.afterEach(async ({ electronApp }) => {
+    await closeProject(electronApp)
   })
 
   test('saving index.wxml via the Monaco write path refreshes the simulator with the new text', async ({
-    mainWindow,
+    workbench,
     electronApp,
   }) => {
     const wxmlPath = path.join(DEMO_APP_DIR, 'pages', 'index', 'index.wxml')
@@ -164,7 +164,7 @@ test.describe('Editor hot reload (save → rebuild → simulator refresh)', () =
       const mutated = original.replace('DevTools 功能测试', `DevTools 功能测试 ${marker}`)
       expect(mutated, 'marker substitution target must exist in index.wxml').not.toBe(original)
 
-      await saveViaMonacoPath(mainWindow, wxmlPath, mutated)
+      await saveViaMonacoPath(workbench, wxmlPath, mutated)
       // Sanity: the Monaco write path actually landed on disk (this part has
       // always worked — the regression is strictly downstream).
       expect(fs.readFileSync(wxmlPath, 'utf8')).toContain(marker)
@@ -182,12 +182,12 @@ test.describe('Editor hot reload (save → rebuild → simulator refresh)', () =
       ).toContain(marker)
     } finally {
       fs.writeFileSync(wxmlPath, original, 'utf8')
-      await settleAfterRestore(mainWindow)
+      await settleAfterRestore(workbench)
     }
   })
 
   test('saving index.js data via the Monaco write path refreshes the simulator with the new data', async ({
-    mainWindow,
+    workbench,
     electronApp,
   }) => {
     const jsPath = path.join(DEMO_APP_DIR, 'pages', 'index', 'index.js')
@@ -200,7 +200,7 @@ test.describe('Editor hot reload (save → rebuild → simulator refresh)', () =
       const mutated = original.replace("'Storage 存储测试'", `'Storage ${marker}'`)
       expect(mutated, 'marker substitution target must exist in index.js').not.toBe(original)
 
-      await saveViaMonacoPath(mainWindow, jsPath, mutated)
+      await saveViaMonacoPath(workbench, jsPath, mutated)
       expect(fs.readFileSync(jsPath, 'utf8')).toContain(marker)
 
       const text = await waitForRenderText(
@@ -214,7 +214,7 @@ test.describe('Editor hot reload (save → rebuild → simulator refresh)', () =
       ).toContain(marker)
     } finally {
       fs.writeFileSync(jsPath, original, 'utf8')
-      await settleAfterRestore(mainWindow)
+      await settleAfterRestore(workbench)
     }
   })
 })
diff --git a/packages/devtools/e2e/editor-project-switch.spec.ts b/packages/devtools/e2e/editor-project-switch.spec.ts
index 15189711..5877c764 100644
--- a/packages/devtools/e2e/editor-project-switch.spec.ts
+++ b/packages/devtools/e2e/editor-project-switch.spec.ts
@@ -41,7 +41,7 @@ import path from 'path'
 import { fileURLToPath } from 'url'
 import type { ElectronApplication } from '@playwright/test'
 import { test, expect } from './fixtures'
-import { DEMO_APP_DIR, openProjectInUI, pollUntil } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil } from './helpers'
 import { runInWorkbench, attachWorkbenchAndWaitReady } from './workbench-probe'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -135,13 +135,39 @@ async function listWorkbenchTabPaths(electronApp: ElectronApplication): Promise<
 test.describe('embedded workbench: project switch discards stale restored tabs', () => {
   test.setTimeout(300_000)
 
+  // The spec ends on the tabbar app's window, and a workbench window left open
+  // outlives the file into later specs in the same worker: helpers that pick
+  // "the first simulator" or "the first workbench" would then read this
+  // project instead of theirs. Both projects are named because a failure
+  // partway through can leave either one — or both — still open; naming one
+  // that is already closed matches no window and does nothing.
+  //
+  // A close that fails is reported, not swallowed: `closeProject` only throws
+  // when a window it targeted is STILL open 30s later, which is precisely the
+  // leak this hook exists to prevent. Both are attempted before anything is
+  // raised, so a stuck demo-app window cannot leave the tabbar one behind too.
+  test.afterEach(async ({ electronApp }) => {
+    const failures: unknown[] = []
+    for (const projectDir of [DEMO_APP_DIR, TABBAR_APP_DIR]) {
+      try {
+        await closeProject(electronApp, { projectDir })
+      } catch (err) {
+        failures.push(err)
+      }
+    }
+    if (failures.length > 0) {
+      throw new Error(failures.map((err) => (err instanceof Error ? err.message : String(err))).join('; '))
+    }
+  })
+
   test('a tab persisted by the previous project must not strand a not-found editor after switching', async ({
-    mainWindow,
     electronApp,
   }) => {
-    // 1) Open the demo app and bring the embedded workbench up.
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 60_000 })
-    const status = await attachWorkbenchAndWaitReady(mainWindow, electronApp)
+    // 1) Open the demo app and bring the embedded workbench up. `openProjectInUI`
+    // opens its own workbench window (it never reuses/replaces another
+    // project's) and returns that window's Page directly.
+    const workbench1 = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 60_000 })
+    const status = await attachWorkbenchAndWaitReady(workbench1, electronApp)
     expect(status, 'workbench must reach a ready status for the first project').toMatch(
       /workbench-ready|exthost-alive/,
     )
@@ -185,13 +211,20 @@ test.describe('embedded workbench: project switch discards stale restored tabs',
       "the demo app's open tab must reach its own WORKSPACE-scope storage — otherwise the switch below proves nothing",
     ).toContain('storage-test')
 
-    // 4) Switch to a project that does NOT contain that file. This destroys the
-    // workbench WebContentsView and boots a fresh one, which restores whatever
-    // its own workspace id points at — a DIFFERENT bucket, because the id is
-    // derived from the miniapp rather than from the shared mirror root.
+    // 4) Switch to a project that does NOT contain that file. Under the
+    // per-project workbench window model, "switching" means closing the demo
+    // app's window (there is no more in-place replace) before opening the
+    // next one — otherwise both windows' embedded workbench WCVs would coexist
+    // and `runInWorkbench`'s app-wide first-match probe could hit either one,
+    // making every assertion below nondeterministic. Closing first also
+    // matches the docstring's premise: the OLD WebContentsView is destroyed
+    // and a fresh one boots, restoring whatever its own workspace id points at
+    // — a DIFFERENT bucket, because the id is derived from the miniapp rather
+    // than from the shared mirror root.
     const idBefore = await runInWorkbench<string | null>(electronApp, WORKSPACE_ID_EXPR)
-    await openProjectInUI(mainWindow, TABBAR_APP_DIR, { waitMs: 60_000 })
-    const status2 = await attachWorkbenchAndWaitReady(mainWindow, electronApp)
+    await closeProject(electronApp, { projectDir: DEMO_APP_DIR })
+    const workbench2 = await openProjectInUI(electronApp, TABBAR_APP_DIR, { waitMs: 60_000 })
+    const status2 = await attachWorkbenchAndWaitReady(workbench2, electronApp)
     expect(status2, 'workbench must reach a ready status after switching projects').toMatch(
       /workbench-ready|exthost-alive/,
     )
diff --git a/packages/devtools/e2e/editor-theme-boot-no-white-flash.spec.ts b/packages/devtools/e2e/editor-theme-boot-no-white-flash.spec.ts
index 10c224a7..5c2bd49c 100644
--- a/packages/devtools/e2e/editor-theme-boot-no-white-flash.spec.ts
+++ b/packages/devtools/e2e/editor-theme-boot-no-white-flash.spec.ts
@@ -72,11 +72,10 @@ test.describe('embedded workbench: no white flash on startup', () => {
   test.setTimeout(180_000)
 
   test('the served workbench page paints a themed backdrop before the bundle loads', async ({
-    mainWindow,
     electronApp,
   }) => {
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 60_000 })
-    const status = await attachWorkbenchAndWaitReady(mainWindow, electronApp)
+    const workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 60_000 })
+    const status = await attachWorkbenchAndWaitReady(workbench, electronApp)
     expect(status, 'workbench must reach a ready status').toMatch(/workbench-ready|exthost-alive/)
 
     // Fetch the workbench page the runtime actually serves and confirm it
diff --git a/packages/devtools/e2e/extension-host.spec.ts b/packages/devtools/e2e/extension-host.spec.ts
index d0cbd7a1..c4e9daba 100644
--- a/packages/devtools/e2e/extension-host.spec.ts
+++ b/packages/devtools/e2e/extension-host.spec.ts
@@ -1,7 +1,7 @@
 import { test, expect, _electron, type ElectronApplication, type Page } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil, evalInSimulator, ipcInvoke, findMainWindow } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil, evalInSimulator, ipcInvoke } from './helpers'
 import { SimulatorCustomApiChannel } from '../src/shared/ipc-channels'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -29,7 +29,7 @@ test.describe('Extension host (createWorkbenchApp onSetup)', () => {
   test.describe.configure({ mode: 'serial' })
 
   let electronApp: ElectronApplication
-  let mainWindow: Page
+  let workbench: Page
 
   test.beforeAll(async () => {
     const entryPath = path.resolve(__dirname, 'extension-host-entry.js')
@@ -40,19 +40,18 @@ test.describe('Extension host (createWorkbenchApp onSetup)', () => {
         NODE_ENV: 'test',
       },
     })
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
 
-    // The toolbar only renders once a project is open.
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
+    // The toolbar only renders once a project is open. `openProjectInUI` opens
+    // its own workbench window and returns that window's Page directly.
+    workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
   })
 
   test.afterAll(async () => {
     // Close the project first: this detaches the CDP debugger that
     // setupSimulatorStorage attached to the simulator <webview>. Leaving it
     // attached makes `electronApp.close()` hang past the hook timeout.
-    if (mainWindow && !mainWindow.isClosed()) {
-      await closeProject(mainWindow).catch(() => {})
+    if (workbench && !workbench.isClosed()) {
+      await closeProject(electronApp).catch(() => {})
     }
     // Hard cap on close() — never let a stuck Electron exit blow the hook
     // timeout; the OS reaps the orphan process either way.
@@ -68,7 +67,7 @@ test.describe('Extension host (createWorkbenchApp onSetup)', () => {
     // project-toolbar.tsx renders its main row at the fixed HEADER_H constant
     // (40px) and no longer fetches a height over IPC. A 72px reading means
     // the legacy config→IPC→renderer plumbing has come back.
-    const measure = () => mainWindow.evaluate(() => {
+    const measure = () => workbench.evaluate(() => {
       // The header is the toolbar row holding the "普通编译" compile button.
       const buttons = Array.from(document.querySelectorAll('button'))
       const compileBtn = buttons.find((b) => (b.textContent || '').includes('普通编译'))
@@ -133,7 +132,7 @@ test.describe('Extension host (createWorkbenchApp onSetup)', () => {
 
     const result = await pollUntil(
       () => ipcInvoke<unknown>(
-        mainWindow,
+        workbench,
         SimulatorCustomApiChannel.Invoke,
         'e2eEcho',
         { ping: 'e2e' },
diff --git a/packages/devtools/e2e/extension-panels.spec.ts b/packages/devtools/e2e/extension-panels.spec.ts
index 48f8893e..dc2bdc17 100644
--- a/packages/devtools/e2e/extension-panels.spec.ts
+++ b/packages/devtools/e2e/extension-panels.spec.ts
@@ -40,12 +40,12 @@ test.describe('Extension Panels Data Bridge', () => {
     })
   })
 
-  test('WXML panel renders in main window after tab switch', async ({ mainWindow }) => {
-    await mainWindow.getByRole('tab', { name: 'WXML' }).click()
+  test('WXML panel renders in the workbench window after tab switch', async ({ workbench }) => {
+    await workbench.getByRole('tab', { name: 'WXML' }).click()
     // The WXML panel has no manual refresh button (it's live): it seeds on
     // activation and stays reactive via the render-guest DOM observer. Wait for
     // the panel container, then poll for the tree.
-    await mainWindow.getByTestId('wxml-panel').waitFor({ timeout: 8000 })
+    await workbench.getByTestId('wxml-panel').waitFor({ timeout: 8000 })
 
     // Assert the tree actually renders (not the "等待小程序加载..." empty
     // state). demo-app index.wxml has a <view class="container">, which the
@@ -54,7 +54,7 @@ test.describe('Extension Panels Data Bridge', () => {
     // before the fix, the panel stayed in its empty state because no
     // SimulatorChannel.Wxml events ever reached React state.
     const text = await pollUntil(
-      () => mainWindow.evaluate(() => document.body.innerText),
+      () => workbench.evaluate(() => document.body.innerText),
       (value) => value.includes('container') && !value.includes('等待小程序加载'),
       15000
     )
@@ -63,11 +63,11 @@ test.describe('Extension Panels Data Bridge', () => {
     expect(text).not.toContain('等待小程序加载')
   })
 
-  test('Storage panel renders in main window after tab switch', async ({ mainWindow }) => {
-    await mainWindow.getByRole('tab', { name: 'Storage' }).click()
+  test('Storage panel renders in the workbench window after tab switch', async ({ workbench }) => {
+    await workbench.getByRole('tab', { name: 'Storage' }).click()
     // The Storage panel has no manual refresh button (it's live). Wait for the
     // panel container to mount.
-    await mainWindow.getByTestId('storage-panel').waitFor({ timeout: 8000 })
+    await workbench.getByTestId('storage-panel').waitFor({ timeout: 8000 })
 
     // Under native-host the Storage panel is sourced from the main-process
     // service-host `file://` store (serviceStorage), NOT the simulator
@@ -77,15 +77,15 @@ test.describe('Extension Panels Data Bridge', () => {
     // panel's own write path uses is what lands in the panel. A direct
     // `localStorage.setItem` in the simulator would never reach it.
     //
-    // We must drive `Set` through `mainWindow`'s IPC bridge (the renderer's
-    // sender) — the storage channels are sender-gated to the workbench
-    // policy, so an arbitrary main-process call would be rejected.
-    const prefix = await ipcInvoke<string>(mainWindow, SimulatorStorageChannel.GetActivePrefix)
+    // We must drive `Set` through the workbench window's IPC bridge (the
+    // renderer's sender) — the storage channels are sender-gated to the
+    // workbench policy, so an arbitrary main-process call would be rejected.
+    const prefix = await ipcInvoke<string>(workbench, SimulatorStorageChannel.GetActivePrefix)
     expect(prefix, 'active storage prefix should resolve under native-host').toBeTruthy()
     const key = `${prefix}e2e_storage_key`
 
     const set = await ipcInvoke<{ ok: boolean }>(
-      mainWindow,
+      workbench,
       SimulatorStorageChannel.Set,
       { key, value: 'e2e_storage_value' },
     )
@@ -96,16 +96,16 @@ test.describe('Extension Panels Data Bridge', () => {
     // Assert the key renders in the panel DOM — this catches a regression of
     // the panel never receiving service-host storage data after a tab switch.
     const text = await pollUntil(
-      () => mainWindow.evaluate(() => document.body.innerText),
+      () => workbench.evaluate(() => document.body.innerText),
       (value) => value.includes('e2e_storage_key'),
       15000,
     )
     expect(text).toContain('e2e_storage_key')
   })
 
-  test('AppData panel renders in main window after tab switch', async ({ mainWindow }) => {
-    await mainWindow.getByRole('tab', { name: 'AppData' }).click()
-    const panel = mainWindow.getByTestId('appdata-panel')
+  test('AppData panel renders in the workbench window after tab switch', async ({ workbench }) => {
+    await workbench.getByRole('tab', { name: 'AppData' }).click()
+    const panel = workbench.getByTestId('appdata-panel')
     await panel.waitFor({ timeout: 8000 })
     await expect(panel).toBeVisible()
   })
diff --git a/packages/devtools/e2e/failure-behaviors.spec.ts b/packages/devtools/e2e/failure-behaviors.spec.ts
index 7dc30d0c..4aedbc31 100644
--- a/packages/devtools/e2e/failure-behaviors.spec.ts
+++ b/packages/devtools/e2e/failure-behaviors.spec.ts
@@ -106,7 +106,7 @@ test.describe('launch page fallback (bridge-router resolveRootPagePath)', () =>
    * required because `DEMO_APP_DIR` is a per-worker copy reused by every
    * other spec in this worker.
    */
-  async function openWithGhostStartPage(ghostPage: string): Promise<{ restore(): Promise<void> }> {
+  async function openWithGhostStartPage(ghostPage: string): Promise<{ workbench: PwPage; restore(): Promise<void> }> {
     await addProject(mainWindow, DEMO_APP_DIR)
     const original = await ipcInvoke<CompileConfigLike>(mainWindow, ProjectChannel.GetCompileConfig, DEMO_APP_DIR)
     await ipcInvoke(mainWindow, ProjectChannel.SaveCompileConfig, DEMO_APP_DIR, {
@@ -114,11 +114,12 @@ test.describe('launch page fallback (bridge-router resolveRootPagePath)', () =>
       scene: original.scene ?? 1001,
       queryParams: original.queryParams ?? [],
     })
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20000 })
+    const workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20000 })
     return {
+      workbench,
       restore: async () => {
-        await ipcInvoke(mainWindow, ProjectChannel.SaveCompileConfig, DEMO_APP_DIR, original).catch(() => {})
-        await closeProject(mainWindow).catch(() => {})
+        await ipcInvoke(workbench, ProjectChannel.SaveCompileConfig, DEMO_APP_DIR, original).catch(() => {})
+        await closeProject(electronApp, { projectDir: DEMO_APP_DIR }).catch(() => {})
       },
     }
   }
@@ -183,7 +184,7 @@ test.describe('launch page fallback (bridge-router resolveRootPagePath)', () =>
       // SAME payload — a combination the real pipeline never actually
       // produces. This assertion pins that documented contract and is
       // expected to fail against current wiring (see spec file header).
-      const banner = mainWindow.locator('[data-testid="sim-fallback-banner"]')
+      const banner = session.workbench.locator('[data-testid="sim-fallback-banner"]')
       await banner.waitFor({ timeout: 15000 })
       const bannerText = await banner.innerText()
       expect(bannerText, 'banner must name the requested (missing) page').toContain(GHOST_PAGE)
@@ -198,11 +199,11 @@ test.describe('service-host crash surfaces a runtime error overlay', () => {
   test.setTimeout(60_000)
 
   test.afterEach(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
   })
 
   test('service-host render-process-gone shows [data-testid="sim-runtime-error"]', async () => {
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20000 })
+    const workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20000 })
     await waitSimulatorReady(electronApp)
 
     const crashed = await electronApp.evaluate(({ webContents }) => {
@@ -213,7 +214,7 @@ test.describe('service-host crash surfaces a runtime error overlay', () => {
     })
     expect(crashed, 'expected a live service-host webContents (service.html) to crash').toBe(true)
 
-    const overlay = mainWindow.locator('[data-testid="sim-runtime-error"]')
+    const overlay = workbench.locator('[data-testid="sim-runtime-error"]')
     await overlay.waitFor({ timeout: 15000 })
     const overlayText = await overlay.innerText()
     expect(overlayText, 'overlay must tell the user the app crashed').toContain('崩溃')
@@ -224,11 +225,11 @@ test.describe('navigateTo a page absent from the compiled manifest', () => {
   test.setTimeout(60_000)
 
   test.afterEach(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
   })
 
   test('rejects via its fail callback with a descriptive errMsg', async () => {
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20000 })
+    await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20000 })
     await waitSimulatorReady(electronApp)
 
     const ghostTarget = 'pages/e2e-ghost-nav-target/e2e-ghost-nav-target'
diff --git a/packages/devtools/e2e/fixtures.ts b/packages/devtools/e2e/fixtures.ts
index d1d9be7d..c68e5db4 100644
--- a/packages/devtools/e2e/fixtures.ts
+++ b/packages/devtools/e2e/fixtures.ts
@@ -3,7 +3,7 @@ import fs from 'fs'
 import path from 'path'
 import { fileURLToPath } from 'url'
 import { ProjectsChannel } from '../src/shared/ipc-channels'
-import { ipcInvoke, openProjectInUI, closeProject, resetSimulatorState, findMainWindow } from './helpers'
+import { ipcInvoke, openProjectInUI, closeProject, resetSimulatorState, findMainWindow, findWorkbenchWindow } from './helpers'
 import { armMaxListenersGuard, type MaxListenersGuard } from './resource-guards'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -27,6 +27,15 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url))
 export interface ElectronFixtures {
   electronApp: ElectronApplication
   mainWindow: Page
+  /**
+   * The window an open project lives in. Resolved lazily — only a spec that
+   * destructures it waits for one — so it pairs with `useSharedProject`,
+   * which opens the project in `beforeAll` and is what identifies the window:
+   * a project window an earlier spec left open is also a workbench window, so
+   * listing order alone would hand this spec the wrong project. A spec that
+   * opens its own project should use `openProjectInUI`'s return value.
+   */
+  workbench: Page
   /**
    * Auto fixture (leak gate): fails any test during which the Electron app's
    * stderr printed a MaxListenersExceededWarning — a leaked-listener class that
@@ -117,6 +126,15 @@ async function isHealthy(app: ElectronApplication, win: Page | undefined): Promi
   }
 }
 
+/**
+ * The project {@link useSharedProject} opened for the running describe block,
+ * or `null` outside one. The `workbench` fixture resolves its window by this
+ * path rather than by listing order: several project windows can be open at
+ * once and an earlier spec may still own one, so "the first workbench window"
+ * is not necessarily this spec's.
+ */
+let sharedProjectDir: string | null = null
+
 export const test = base.extend<ElectronFixtures, ElectronWorkerFixtures>({
   _workerElectron: [
     // eslint-disable-next-line no-empty-pattern
@@ -164,6 +182,15 @@ export const test = base.extend<ElectronFixtures, ElectronWorkerFixtures>({
     await use(win)
   },
 
+  workbench: async ({ _workerElectron }, use) => {
+    const win = await findWorkbenchWindow(
+      _workerElectron.app,
+      sharedProjectDir === null ? {} : { projectDir: sharedProjectDir },
+    )
+    await win.waitForLoadState('domcontentloaded')
+    await use(win)
+  },
+
   _maxListenersGate: [
     async ({ _workerElectron }, use) => {
       const seenBefore = _workerElectron.guard.warnings().length
@@ -183,8 +210,9 @@ export const test = base.extend<ElectronFixtures, ElectronWorkerFixtures>({
  *
  * Call this at the top of a `test.describe` block (or top-level of the file).
  * It registers `beforeAll`/`afterAll`/`afterEach` hooks against the passed
- * `test` object. Inside each test you can keep using the standard
- * `mainWindow` / `electronApp` fixtures — the project is already open.
+ * `test` object. Inside each test, use the `workbench` fixture for anything
+ * about the open project (simulator, panels, editor, toolbar) and `mainWindow`
+ * only for the project list itself — they are two different windows now.
  *
  * Between tests it clears `wx` storage and navigates the simulator back to
  * the configured home page. This is best-effort: a test that leaves the
@@ -201,8 +229,8 @@ export const test = base.extend<ElectronFixtures, ElectronWorkerFixtures>({
  * test.describe('My feature', () => {
  *   useSharedProject(test, DEMO_APP_DIR)
  *
- *   test('does a thing', async ({ mainWindow, electronApp }) => {
- *     // project is already open; just exercise it.
+ *   test('does a thing', async ({ workbench, electronApp }) => {
+ *     // project is already open in `workbench`; just exercise it.
  *   })
  * })
  * ```
@@ -229,11 +257,11 @@ export function useSharedProject(
   const { openOptions, openTimeoutMs } = options
 
   // beforeAll/afterAll only receive worker-scoped fixtures, so we rely on
-  // _workerElectron and grab the firstWindow ourselves.
+  // _workerElectron and resolve windows ourselves.
   testObj.beforeAll(async ({ _workerElectron }) => {
     if (openTimeoutMs !== undefined) testObj.setTimeout(openTimeoutMs)
-    const win = await findMainWindow(_workerElectron.app)
-    await openProjectInUI(win, projectDir, openOptions)
+    sharedProjectDir = projectDir
+    await openProjectInUI(_workerElectron.app, projectDir, openOptions)
   })
 
   testObj.afterEach(async ({ electronApp }) => {
@@ -241,10 +269,8 @@ export function useSharedProject(
   })
 
   testObj.afterAll(async ({ _workerElectron }) => {
-    const win = await findMainWindow(_workerElectron.app).catch(() => undefined)
-    if (win && !win.isClosed()) {
-      await closeProject(win).catch(() => {})
-    }
+    sharedProjectDir = null
+    await closeProject(_workerElectron.app, { projectDir }).catch(() => {})
   })
 }
 
diff --git a/packages/devtools/e2e/helpers.ts b/packages/devtools/e2e/helpers.ts
index 8f7d2249..b278e209 100644
--- a/packages/devtools/e2e/helpers.ts
+++ b/packages/devtools/e2e/helpers.ts
@@ -3,7 +3,7 @@ import fs from 'fs'
 import os from 'os'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { ProjectsChannel, ProjectChannel, SimulatorChannel } from '../src/shared/ipc-channels'
+import { ProjectsChannel, SimulatorChannel } from '../src/shared/ipc-channels'
 import { DMB_PAGEFRAME_DOC_NAME } from '../src/shared/dmb-resource-url'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -75,19 +75,28 @@ export const RENDER_GUEST_URL_MARKER = DMB_PAGEFRAME_DOC_NAME
 const MAIN_WINDOW_URL_PATTERN = /entries\/main\//
 const HOST_SIDEBAR_DEFAULT_URL_PATTERN = /entries\/host-sidebar-default\//
 
+/**
+ * Matches a workbench window — the window a project opens into. Each open
+ * project gets its own, and the project-list window stays alive alongside
+ * them, so "the app's window" is never a single thing: a spec must say which
+ * one it means.
+ */
+const WORKBENCH_WINDOW_URL_PATTERN = /entries\/workbench\//
+
 /**
  * Resolve a specific app window by matching its URL, instead of trusting
  * `electronApp.firstWindow()` / `electronApp.windows()[0]` (which does not
  * reliably correlate with BrowserWindow creation order — see
  * `findMainWindow`'s doc comment).
  */
-async function findWindowByUrlPattern(
+async function findWindowBy(
   electronApp: ElectronApplication,
-  pattern: RegExp,
+  accepts: (win: Page) => boolean,
   label: string,
+  wanted: string,
   timeoutMs: number,
 ): Promise<Page> {
-  const immediate = electronApp.windows().find((win) => pattern.test(win.url()))
+  const immediate = electronApp.windows().find(accepts)
   if (immediate) return immediate
 
   const deadline = Date.now() + timeoutMs
@@ -95,16 +104,66 @@ async function findWindowByUrlPattern(
     await electronApp
       .waitForEvent('window', { timeout: Math.max(0, deadline - Date.now()) })
       .catch(() => undefined)
-    const match = electronApp.windows().find((win) => pattern.test(win.url()))
+    const match = electronApp.windows().find(accepts)
     if (match) return match
   }
 
   throw new Error(
-    `${label}: no window matching ${pattern} within ${timeoutMs}ms `
+    `${label}: no window matching ${wanted} within ${timeoutMs}ms `
     + `(open windows: ${electronApp.windows().map((win) => win.url()).join(', ') || 'none'})`,
   )
 }
 
+async function findWindowByUrlPattern(
+  electronApp: ElectronApplication,
+  pattern: RegExp,
+  label: string,
+  timeoutMs: number,
+): Promise<Page> {
+  return findWindowBy(electronApp, (win) => pattern.test(win.url()), label, String(pattern), timeoutMs)
+}
+
+/** The `path` a workbench window was booted with, or null for any other window. */
+function workbenchProjectDir(win: Page): string | null {
+  const url = win.url()
+  if (!WORKBENCH_WINDOW_URL_PATTERN.test(url)) return null
+  try {
+    return new URL(url).searchParams.get('path')
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Resolve the window a project is open in.
+ *
+ * Pass `projectDir` whenever the spec knows which project it means — several
+ * workbench windows can be open at once, and matching on the entry URL alone
+ * would hand back whichever one Playwright happens to list first. The window
+ * carries its project in the `path` query `openProjectWindow` boots it with.
+ */
+export async function findWorkbenchWindow(
+  electronApp: ElectronApplication,
+  { projectDir, timeoutMs = 30_000 }: { projectDir?: string; timeoutMs?: number } = {},
+): Promise<Page> {
+  return findWindowBy(
+    electronApp,
+    (win) => {
+      const dir = workbenchProjectDir(win)
+      if (dir === null) return false
+      return projectDir === undefined || dir === projectDir
+    },
+    'findWorkbenchWindow',
+    projectDir === undefined ? String(WORKBENCH_WINDOW_URL_PATTERN) : `a workbench window for ${projectDir}`,
+    timeoutMs,
+  )
+}
+
+/** Every workbench window currently open, in Playwright's listing order. */
+export function listWorkbenchWindows(electronApp: ElectronApplication): Page[] {
+  return electronApp.windows().filter((win) => workbenchProjectDir(win) !== null)
+}
+
 /**
  * Resolve the app's actual main window instead of trusting
  * `electronApp.firstWindow()` / `electronApp.windows()[0]`.
@@ -207,55 +266,104 @@ export async function refreshProjectList(mainWindow: Page): Promise<void> {
 }
 
 /**
- * Close the current project session via IPC and navigate back to the project list.
- * Safe to call when no project is open.
+ * Close an open project by closing the window it lives in — the user-driven
+ * path, and the one that proves the window teardown really disposes the
+ * session. Safe to call when no project is open.
+ *
+ * Without `projectDir` this closes every open workbench window, which is what
+ * a spec-level cleanup wants: whatever this file opened, leave nothing behind
+ * for the next spec sharing the worker's Electron process.
  */
-export async function closeProject(mainWindow: Page): Promise<void> {
-  await ipcInvoke(mainWindow, SimulatorChannel.Detach).catch(() => {})
-  await ipcInvoke(mainWindow, ProjectChannel.Close).catch(() => {})
-  // Trigger the navigate-back handler in the renderer (same event handleWindowClose sends)
-  await refreshProjectList(mainWindow).catch(() => {})
-  // Wait for the project list view to be visible again (the project card title=projectDir
-  // disappears once we leave the project view; project list shows project cards / empty state).
-  // We can't know the path from here, so poll for the absence of the toolbar text "普通编译".
-  await pollUntil(
-    () => mainWindow.evaluate(() => !document.body.innerText.includes('普通编译')),
-    (gone) => gone === true,
-    5000,
+export async function closeProject(
+  electronApp: ElectronApplication,
+  { projectDir }: { projectDir?: string } = {},
+): Promise<void> {
+  const targets = listWorkbenchWindows(electronApp)
+    .filter((win) => projectDir === undefined || workbenchProjectDir(win) === projectDir)
+  for (const win of targets) {
+    // The renderer detaches on its own as the window tears down; asking for it
+    // first keeps the simulator WCV from being torn off mid-frame. A window
+    // with no simulator attached rejects this, which is not a close failure.
+    await ipcInvoke(win, SimulatorChannel.Detach).catch(() => {})
+    // `BrowserWindow.close()`, not Playwright's `page.close()`: the app hangs
+    // every project teardown (session, editor server, IPC registrations, the
+    // floating DevTools window) off the window's `close` event, and
+    // `page.close()` closes the CDP target — Chromium destroys the window
+    // outright, emitting no `close`, so nothing is ever disposed. The window
+    // then vanishes from the page list exactly as if it had been closed
+    // properly, which makes the difference invisible from the test side.
+    await electronApp.evaluate(({ BrowserWindow }, url) => {
+      // A window that is already gone is fine and closes nothing; a main
+      // process that cannot be reached at all is a failure and propagates.
+      const target = BrowserWindow.getAllWindows()
+        .find((candidate) => candidate.webContents.getURL() === url)
+      target?.close()
+    }, win.url())
+  }
+  const stuck = await pollUntil(
+    async () => listWorkbenchWindows(electronApp).filter((win) => targets.includes(win)),
+    (remaining) => remaining.length === 0,
+    // Teardown now runs for real before the window goes away (compile session,
+    // editor http server, views), so this waits on work, not on a destroy.
+    30_000,
     100,
-  ).catch(() => {})
+  )
+  // `pollUntil` resolves with the last value instead of throwing on timeout,
+  // so the count has to be asserted here. A window still listed means teardown
+  // hung or the close was refused — the exact regression the close/reopen
+  // specs exist to catch, and silently tolerating it lets them pass against a
+  // project that never closed.
+  if (stuck.length > 0) {
+    const names = stuck.map((win) => workbenchProjectDir(win) ?? win.url()).join(', ')
+    throw new Error(`closeProject: ${stuck.length} workbench window(s) still open after 30s: ${names}`)
+  }
 }
 
 /**
- * Add a project and click its card to navigate to the project view.
+ * Add a project and click its card, then resolve the workbench window it
+ * opened into.
+ *
+ * Takes the app rather than a page because a project no longer opens *inside*
+ * the window that was clicked: the project list stays where it is and the
+ * project gets a window of its own. The returned page is that window — every
+ * assertion about the simulator, the panels, the editor or the toolbar belongs
+ * to it, not to the list window.
+ *
  * Waits for the simulator webview to attach AND first-page DOM to be ready
  * (compile complete signal) instead of a fixed timer.
  *
  * @param waitMs - hard cap on total wait time (default 15000).
  */
 export async function openProjectInUI(
-  mainWindow: Page,
+  electronApp: ElectronApplication,
   projectDir: string,
   { waitMs = 15000 }: { waitMs?: number } = {}
-): Promise<void> {
-  await addProject(mainWindow, projectDir)
-  await refreshProjectList(mainWindow)
-  const projectPathLabel = mainWindow.locator(`[title="${projectDir}"]`).first()
+): Promise<Page> {
+  const listWindow = await findMainWindow(electronApp)
+  await addProject(listWindow, projectDir)
+  await refreshProjectList(listWindow)
+  const projectPathLabel = listWindow.locator(`[title="${projectDir}"]`).first()
   await projectPathLabel.waitFor()
   await projectPathLabel.locator('..').click()
-  await mainWindow.waitForSelector('text=普通编译')
 
   const deadline = Date.now() + waitMs
 
+  const workbench = await findWorkbenchWindow(electronApp, {
+    projectDir,
+    timeoutMs: Math.max(1000, deadline - Date.now()),
+  })
+  await workbench.waitForLoadState('domcontentloaded')
+  await workbench.waitForSelector('text=普通编译')
+
   // 1) Wait for the simulator webview to attach.
-  await mainWindow.waitForSelector('webview', { timeout: Math.max(1000, deadline - Date.now()) })
+  await workbench.waitForSelector('webview', { timeout: Math.max(1000, deadline - Date.now()) })
     .catch(() => {})
 
   // 2) Wait for the renderer to report compile complete or the toolbar to leave the
   //    "正在刷新..." / "正在编译..." state. The status text lives in a `.truncate` span
   //    bound to setCompileStatus messages: '编译完成', '编译完成，已热更新', '刷新完成'.
   await pollUntil(
-    () => mainWindow.evaluate(() => {
+    () => workbench.evaluate(() => {
       const els = document.querySelectorAll('[class*="truncate"]')
       for (const el of els) {
         const t = el.textContent || ''
@@ -267,6 +375,8 @@ export async function openProjectInUI(
     Math.max(1000, deadline - Date.now()),
     300,
   ).catch(() => {})
+
+  return workbench
 }
 
 // ── Simulator helpers ──────────────────────────────────────────────────
diff --git a/packages/devtools/e2e/home-button-no-tabbar.spec.ts b/packages/devtools/e2e/home-button-no-tabbar.spec.ts
index b831fa29..3376d61f 100644
--- a/packages/devtools/e2e/home-button-no-tabbar.spec.ts
+++ b/packages/devtools/e2e/home-button-no-tabbar.spec.ts
@@ -133,14 +133,14 @@ async function pageStackLength(): Promise<number> {
  * leaks into the shared worker-scoped Electron instance other specs use.
  */
 async function openFixtureAt(startPage: string): Promise<void> {
-  await closeProject(mainWindow).catch(() => {})
+  await closeProject(electronApp).catch(() => {})
   await addProject(mainWindow, FIXTURE_DIR)
   await ipcInvoke(mainWindow, ProjectChannel.SaveCompileConfig, FIXTURE_DIR, {
     startPage,
     scene: DEFAULT_SCENE,
     queryParams: [],
   })
-  await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+  await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
   await waitForSimulatorWebview(electronApp)
   await pollUntil(
     () => evalInSimulator<boolean>(electronApp, `(() => !!document.querySelector('.device-shell-root'))()`).catch(() => false),
@@ -201,7 +201,7 @@ test.describe('native-host nav-bar home button (redirectTo/reLaunch branches)',
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/home-button.spec.ts b/packages/devtools/e2e/home-button.spec.ts
index eff2e91a..cdde5c5c 100644
--- a/packages/devtools/e2e/home-button.spec.ts
+++ b/packages/devtools/e2e/home-button.spec.ts
@@ -116,14 +116,14 @@ async function clickHomeButton(): Promise<boolean> {
  * leaks into the shared worker-scoped Electron instance other specs use.
  */
 async function openDemoAppAt(startPage: string): Promise<void> {
-  await closeProject(mainWindow).catch(() => {})
+  await closeProject(electronApp).catch(() => {})
   await addProject(mainWindow, DEMO_APP_DIR)
   await ipcInvoke(mainWindow, ProjectChannel.SaveCompileConfig, DEMO_APP_DIR, {
     startPage,
     scene: DEFAULT_SCENE,
     queryParams: [],
   })
-  await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20000 })
+  await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20000 })
   await waitForSimulatorWebview(electronApp)
   await pollUntil(
     () => evalInSimulator<boolean>(electronApp, `(() => !!document.querySelector('.device-shell-root'))()`).catch(() => false),
@@ -184,7 +184,7 @@ test.describe('native-host nav-bar home button (switchTab branch)', () => {
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/host-sidebar.spec.ts b/packages/devtools/e2e/host-sidebar.spec.ts
index 1e64f940..7d94f6fb 100644
--- a/packages/devtools/e2e/host-sidebar.spec.ts
+++ b/packages/devtools/e2e/host-sidebar.spec.ts
@@ -13,10 +13,9 @@ const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-sidebar')
  *
  * `[data-area="host-sidebar"]` (project-list-screen.tsx) mounts at app boot,
  * before any project is opened — the OPPOSITE screen-scoping from the toolbar
- * (which only mounts once a project is open). Entering a project unmounts
- * ProjectListScreen, whose placement publisher flushes an empty snapshot on
- * dispose — the same detach mechanism host-toolbar.spec.ts exercises on
- * project CLOSE, here exercised on project OPEN.
+ * (which only mounts once a project is open). A project opens in its own
+ * window, so the list page underneath never unmounts: the sidebar strip stays
+ * the list window's, which is the ownership the lifecycle test below pins.
  *
  * Electron e2e; runs on local macOS without extra setup (NODE_ENV=test,
  * off-screen windows).
@@ -161,44 +160,49 @@ test.describe('Host sidebar: session-resident width advertiser (R1, inline axis)
     expect(leaks).toEqual([])
   })
 
-  test('entering a project detaches the sidebar WCV; returning to the list re-attaches it', async () => {
-    /** Is the sidebar WCV currently among any window's contentView children? */
-    const sidebarAttached = () => electronApp.evaluate(({ BrowserWindow }) => {
+  test('the sidebar WCV stays owned by the list window across a project opening and closing', async () => {
+    /** The sidebar WCV's id and the entry html of the window hosting it, or
+     * null when no window has it as a contentView child. */
+    const sidebarHost = () => electronApp.evaluate(({ BrowserWindow }) => {
       const g = globalThis as unknown as {
         __e2eHostSidebarInstance: {
           context: { views: { hostSidebar: { webContents: { id: number; isDestroyed(): boolean } | null } } }
         }
       }
       const wc = g.__e2eHostSidebarInstance.context.views.hostSidebar.webContents
-      if (!wc || wc.isDestroyed()) return false
-      return BrowserWindow.getAllWindows().some((win) => {
+      if (!wc || wc.isDestroyed()) return null
+      for (const win of BrowserWindow.getAllWindows()) {
         const children = win.contentView.children as Array<{ webContents?: { id: number } }>
-        return children.some((v) => v.webContents?.id === wc.id)
-      })
+        if (children.some((v) => v.webContents?.id === wc.id)) {
+          return { wcId: wc.id, hostUrl: win.webContents.getURL() }
+        }
+      }
+      return null
     })
 
-    // Meaningfulness guard: the strip really is attached on the list page
-    // (from the 88px reload above) before we navigate away.
-    expect(await sidebarAttached()).toBe(true)
-
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
-
-    const detachedInProject = await pollUntil(
-      sidebarAttached,
-      (attached) => attached === false,
-      15_000,
-      300,
-    )
-    expect(detachedInProject).toBe(false)
-
-    await closeProject(mainWindow)
-
-    const reattachedOnList = await pollUntil(
-      sidebarAttached,
-      (attached) => attached === true,
-      15_000,
-      300,
-    )
-    expect(reattachedOnList).toBe(true)
+    // Meaningfulness guard: the strip really is attached to the list window
+    // (from the 88px reload above) before a project window exists.
+    const onList = await sidebarHost()
+    expect(onList?.hostUrl, 'the sidebar starts out inside the project-list window').toContain('entries/main')
+
+    await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
+
+    // The project now lives in its own window, so the list window keeps its
+    // sidebar rather than handing it over: the strip must never end up
+    // painting inside the workbench, and must not be rebuilt behind the
+    // project's back either — a rebuilt WCV would silently drop the host
+    // preload and the width the list page advertised. Both are absence
+    // claims, so they get a settling window first: a wrong re-parent or
+    // rebuild would land in the moments after the project window appears.
+    await new Promise((resolve) => setTimeout(resolve, 2_000))
+    const withProject = await sidebarHost()
+    expect(withProject?.hostUrl, 'a project window must not take the list window\'s sidebar').toContain('entries/main')
+    expect(withProject?.wcId, 'opening a project must not rebuild the sidebar WCV').toBe(onList?.wcId)
+
+    await closeProject(electronApp)
+
+    const afterClose = await pollUntil(sidebarHost, (host) => host !== null, 15_000, 300)
+    expect(afterClose?.hostUrl).toContain('entries/main')
+    expect(afterClose?.wcId, 'closing a project must not rebuild the sidebar WCV').toBe(onList?.wcId)
   })
 })
diff --git a/packages/devtools/e2e/host-toolbar-lifecycle.spec.ts b/packages/devtools/e2e/host-toolbar-lifecycle.spec.ts
index 746568c5..3832788e 100644
--- a/packages/devtools/e2e/host-toolbar-lifecycle.spec.ts
+++ b/packages/devtools/e2e/host-toolbar-lifecycle.spec.ts
@@ -1,31 +1,38 @@
-import { test, expect, _electron, type ElectronApplication, type Page } from '@playwright/test'
+import { test, expect, _electron, type ElectronApplication } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil, findMainWindow } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
 
 /**
  * The host-slot port channel over a REAL app lifetime: first load, renderer
- * crash + rebuild, close project → reopen, app quit.
+ * crash + rebuild, a project window closing + reopening, app quit.
+ *
+ * Every BrowserWindow owns its own `WorkbenchContext`/`ViewManager` (see
+ * host-toolbar.spec.ts), so "the toolbar" is not one instance here — a
+ * workbench window's toolbar is scoped to that window and is torn down with
+ * it, while the project-list window's toolbar is genuinely host-scoped: it
+ * is never touched by any project window's lifecycle. Each invariant below
+ * is driven against the scope it actually applies to:
+ *  - crash/rebuild and the no-growth cycle exercise a WORKBENCH window's
+ *    toolbar, since that is the instance whose webContents is torn down and
+ *    rebuilt by the operations under test;
+ *  - "closing a project doesn't disturb the host slot" is now about the LIST
+ *    window's toolbar — closing a project destroys the workbench window (and
+ *    its own toolbar) wholesale, so there is nothing on that side left to
+ *    assert non-disturbance about. What must not move is the list window's
+ *    own toolbar webContents id and live port across a project window's full
+ *    open → close → reopen cycle;
+ *  - quitting tears down the whole process either way.
  *
  * Why a live app and not more fakes: the channel releases each webContents
  * through a per-wc attachment whose `dispose()` calls `webContents.off(...)`,
  * sometimes on a wc that is mid-death (the crash path). Unit tests drive that
  * against a fake emitter; only a real run shows Electron accepts those calls
  * and that teardown neither throws nor leaves the channel wired to a document
- * that is gone. Asserted here:
- *  - a rebuilt slot delivers to the NEW document exactly once, and send() is
- *    gated to false in the window where the slot has no live view;
- *  - project teardown leaves the host-scoped toolbar and its live port alone
- *    (`disposeProjectViews` exempts it on purpose);
- *  - repeating one identical cycle grows nothing on the main side: neither the
- *    number of live webContents nor the channel listeners resting on them. The
- *    absolute baseline is not this channel's alone, so growth across two equal
- *    cycles is the assertion, not the count itself;
- *  - quitting runs the whole teardown without a native crash and without an
- *    unexpected error line from this subsystem.
+ * that is gone.
  *
  * What this spec does NOT prove, measured rather than assumed: deleting the
  * attachment release from the managed view keeps this spec fully green. On
@@ -36,6 +43,8 @@ const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
  * release is pinned by the unit tests instead.
  */
 
+type Scope = 'workbench' | 'list'
+
 type ToolbarWebContents = {
   id: number
   isDestroyed(): boolean
@@ -49,8 +58,11 @@ type ToolbarSurface = {
   webContents: ToolbarWebContents | null
 }
 type E2eGlobals = {
-  __e2eHostToolbarInstance: { context: { views: { hostToolbar: ToolbarSurface } } }
-  __e2eLifecyclePings?: Array<{ from?: string; tag?: string }>
+  __e2eHostToolbarInstance: {
+    context: { views: { hostToolbar: ToolbarSurface } }
+    projectWindows(): Array<{ context: { views: { hostToolbar: ToolbarSurface } } }>
+  }
+  __e2eLifecyclePings?: Record<Scope, Array<{ from?: string; tag?: string }>>
 }
 
 /**
@@ -64,7 +76,6 @@ test.describe('Host-slot port channel across the real app lifecycle', () => {
   test.setTimeout(240_000)
 
   let electronApp: ElectronApplication
-  let mainWindow: Page
   let appClosed = false
   const mainErrors: string[] = []
   /** Monotonic so every host→page envelope in this file is distinguishable. */
@@ -81,20 +92,7 @@ test.describe('Host-slot port channel across the real app lifecycle', () => {
     electronApp.on('console', (msg) => {
       if (msg.type() === 'error') mainErrors.push(msg.text())
     })
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
-
-    // Registered ONCE: the handler lives in the channel's main-side registry,
-    // which outlives every webContents here — only the slot's own dispose()
-    // sweeps it. Re-registering per test would double every ping.
-    await electronApp.evaluate(() => {
-      const g = globalThis as unknown as E2eGlobals
-      g.__e2eLifecyclePings = []
-      g.__e2eHostToolbarInstance.context.views.hostToolbar.onMessage('e2e:ping', (payload) => {
-        g.__e2eLifecyclePings!.push(payload as { from?: string; tag?: string })
-      })
-    })
+    await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
   })
 
   test.afterAll(async () => {
@@ -105,36 +103,50 @@ test.describe('Host-slot port channel across the real app lifecycle', () => {
     ])
   })
 
-  /** The slot's live webContents id, or null when there is no live view. */
-  const toolbarWcId = () =>
-    electronApp.evaluate(() => {
+  // Every helper below re-resolves the toolbar surface for `scope` inline,
+  // inside its own `electronApp.evaluate` callback: a function reference from
+  // this module cannot cross into the main process, only serializable data
+  // (the `scope` string) can.
+
+  /** The slot's live webContents id for `scope`, or null when there is no live view. */
+  const toolbarWcId = (scope: Scope) =>
+    electronApp.evaluate((_mods, s) => {
       const g = globalThis as unknown as E2eGlobals
-      const wc = g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents
+      const toolbar = s === 'workbench'
+        ? g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar
+        : g.__e2eHostToolbarInstance.context.views.hostToolbar
+      const wc = toolbar?.webContents
       return wc && !wc.isDestroyed() ? wc.id : null
-    })
+    }, scope)
 
-  const inToolbarPage = (code: string) =>
-    electronApp.evaluate(async (_mods, expr) => {
+  const inToolbarPage = (scope: Scope, code: string) =>
+    electronApp.evaluate((_mods, args) => {
       const g = globalThis as unknown as E2eGlobals
-      const wc = g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents
+      const toolbar = args.scope === 'workbench'
+        ? g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar
+        : g.__e2eHostToolbarInstance.context.views.hostToolbar
+      const wc = toolbar?.webContents
       if (!wc || wc.isDestroyed()) return null
-      return wc.executeJavaScript(expr)
-    }, code)
+      return wc.executeJavaScript(args.code)
+    }, { scope, code })
 
-  const send = (r: number) =>
-    electronApp.evaluate((_mods, n) => {
+  const send = (scope: Scope, r: number) =>
+    electronApp.evaluate((_mods, args) => {
       const g = globalThis as unknown as E2eGlobals
-      return g.__e2eHostToolbarInstance.context.views.hostToolbar.send('e2e:host', { round: n })
-    }, r)
-
-  const pings = () =>
-    electronApp.evaluate(() => {
+      const toolbar = args.scope === 'workbench'
+        ? g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar
+        : g.__e2eHostToolbarInstance.context.views.hostToolbar
+      return toolbar ? toolbar.send('e2e:host', { round: args.round }) : false
+    }, { scope, round: r })
+
+  const pings = (scope: Scope) =>
+    electronApp.evaluate((_mods, s) => {
       const g = globalThis as unknown as E2eGlobals
-      return g.__e2eLifecyclePings ?? []
-    })
+      return g.__e2eLifecyclePings?.[s] ?? []
+    }, scope)
 
-  const hostMsgs = async (): Promise<Array<{ round?: number }>> => {
-    const v = await inToolbarPage('Array.isArray(window.__hostMsgs) ? window.__hostMsgs : null')
+  const hostMsgs = async (scope: Scope): Promise<Array<{ round?: number }>> => {
+    const v = await inToolbarPage(scope, 'Array.isArray(window.__hostMsgs) ? window.__hostMsgs : null')
     return Array.isArray(v) ? (v as Array<{ round?: number }>) : []
   }
 
@@ -156,12 +168,37 @@ test.describe('Host-slot port channel across the real app lifecycle', () => {
       return { live: live.length, didFinishLoad, didStartNavigation }
     })
 
+  /**
+   * Wire the ping listener for `scope` exactly once per toolbar instance. A
+   * workbench window's toolbar is a fresh instance every time its window is
+   * (re)opened, so this cannot be a one-shot beforeAll registration the way a
+   * single persistent window allowed — it must re-register whenever `scope`
+   * resolves to a toolbar it has not seen yet, and stay a no-op for one it has
+   * (re-registering on an unchanged instance would double every ping).
+   */
+  async function ensurePingsRegistered(scope: Scope): Promise<void> {
+    await electronApp.evaluate((_mods, s) => {
+      const g = globalThis as unknown as E2eGlobals & { __e2eWiredToolbars?: WeakSet<object> }
+      g.__e2eLifecyclePings ??= { workbench: [], list: [] }
+      g.__e2eWiredToolbars ??= new WeakSet()
+      const toolbar = s === 'workbench'
+        ? g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar
+        : g.__e2eHostToolbarInstance.context.views.hostToolbar
+      if (toolbar && !g.__e2eWiredToolbars.has(toolbar)) {
+        g.__e2eWiredToolbars.add(toolbar)
+        toolbar.onMessage('e2e:ping', (payload) => {
+          g.__e2eLifecyclePings![s].push(payload as { from?: string; tag?: string })
+        })
+      }
+    }, scope)
+  }
+
   /** Prove the current document delivers, exactly once, for a fresh round. */
-  async function proveDelivery(): Promise<void> {
+  async function proveDelivery(scope: Scope): Promise<void> {
     const r = ++round
-    await pollUntil(() => send(r), (ok) => ok === true, 30_000, 300)
+    await pollUntil(() => send(scope, r), (ok) => ok === true, 30_000, 300)
     const got = await pollUntil(
-      hostMsgs,
+      () => hostMsgs(scope),
       (msgs) => msgs.some((m) => m?.round === r),
       15_000,
       300,
@@ -172,36 +209,40 @@ test.describe('Host-slot port channel across the real app lifecycle', () => {
     ).toHaveLength(1)
   }
 
-  /** Load the fixture into the slot and prove the round trip on that document. */
-  async function loadAndProveRoundTrip(): Promise<void> {
-    const before = (await pings()).length
-    await electronApp.evaluate((_mods, file) => {
+  /** Load the fixture into `scope`'s slot and prove the round trip on that document. */
+  async function loadAndProveRoundTrip(scope: Scope): Promise<void> {
+    await ensurePingsRegistered(scope)
+    const before = (await pings(scope)).length
+    await electronApp.evaluate((_mods, args) => {
       const g = globalThis as unknown as E2eGlobals
-      return g.__e2eHostToolbarInstance.context.views.hostToolbar.loadFile(file)
-    }, toolbarFixture)
+      const toolbar = args.scope === 'workbench'
+        ? g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar
+        : g.__e2eHostToolbarInstance.context.views.hostToolbar
+      return toolbar?.loadFile(args.file)
+    }, { scope, file: toolbarFixture })
 
     // page→host: the fixture sends at script-run time, before the handshake,
     // so this also exercises the preload's pending queue on every load.
-    const seen = await pollUntil(pings, (v) => v.length > before, 30_000, 300)
+    const seen = await pollUntil(() => pings(scope), (v) => v.length > before, 30_000, 300)
     expect(seen[seen.length - 1]?.from).toBe('page')
 
-    await proveDelivery()
+    await proveDelivery(scope)
   }
 
   test('a renderer crash tears the slot down; the rebuilt document owns the channel alone', async () => {
-    await loadAndProveRoundTrip()
-    const crashedId = await toolbarWcId()
+    await loadAndProveRoundTrip('workbench')
+    const crashedId = await toolbarWcId('workbench')
     expect(crashedId).not.toBeNull()
 
     await electronApp.evaluate(() => {
       const g = globalThis as unknown as E2eGlobals
-      g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents?.forcefullyCrashRenderer()
+      g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar.webContents?.forcefullyCrashRenderer()
     })
 
     // The manager destroys the broken view, so the slot reports no live wc and
     // send() is gated again instead of claiming delivery into a dead document.
-    await pollUntil(toolbarWcId, (id) => id === null, 30_000, 300)
-    expect(await send(++round)).toBe(false)
+    await pollUntil(() => toolbarWcId('workbench'), (id) => id === null, 30_000, 300)
+    expect(await send('workbench', ++round)).toBe(false)
 
     // The crashed wc is really gone — nothing can hand the channel back to it.
     const stillAlive = await electronApp.evaluate(
@@ -211,32 +252,38 @@ test.describe('Host-slot port channel across the real app lifecycle', () => {
     )
     expect(stillAlive).toBe(false)
 
-    await loadAndProveRoundTrip()
-    expect(await toolbarWcId(), 'the rebuild must be a different webContents').not.toBe(crashedId)
+    await loadAndProveRoundTrip('workbench')
+    expect(await toolbarWcId('workbench'), 'the rebuild must be a different webContents').not.toBe(crashedId)
   })
 
-  test('closing the project leaves the host-scoped slot and its live port untouched', async () => {
-    const idBefore = await toolbarWcId()
+  test('the list window\'s host-scoped toolbar and its live port survive a project window opening, closing, and reopening', async () => {
+    await loadAndProveRoundTrip('list')
+    const idBefore = await toolbarWcId('list')
     expect(idBefore).not.toBeNull()
 
-    await closeProject(mainWindow)
+    await closeProject(electronApp)
 
-    // disposeProjectViews exempts the host toolbar: same webContents, same
-    // document, same open port — no re-handshake needed.
-    expect(await toolbarWcId(), 'project teardown must not destroy the host toolbar').toBe(idBefore)
-    await proveDelivery()
+    // The workbench window this destroys owns its OWN toolbar and dies with
+    // it; the list window and its toolbar are a separate window nothing in
+    // the project lifecycle reaches.
+    expect(await toolbarWcId('list'), 'the host-scoped toolbar must not move when a project window closes').toBe(idBefore)
+    await proveDelivery('list')
 
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
-    expect(await toolbarWcId()).toBe(idBefore)
-    await proveDelivery()
+    await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
+    expect(await toolbarWcId('list')).toBe(idBefore)
+    await proveDelivery('list')
   })
 
   test('an identical load → close → reopen cycle adds no webContents and no channel listener', async () => {
     async function cycle(): Promise<void> {
-      await loadAndProveRoundTrip()
-      await closeProject(mainWindow)
-      await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
-      await proveDelivery()
+      await loadAndProveRoundTrip('workbench')
+      await closeProject(electronApp)
+      await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
+      // The reopened window builds a brand-new toolbar view holding the
+      // default document, so the round trip has to be re-established on it
+      // rather than measured on a recorder that only ever existed in the
+      // destroyed window's document.
+      await loadAndProveRoundTrip('workbench')
     }
 
     await cycle()
diff --git a/packages/devtools/e2e/host-toolbar-port.spec.ts b/packages/devtools/e2e/host-toolbar-port.spec.ts
index a3da0bf4..1c7bec42 100644
--- a/packages/devtools/e2e/host-toolbar-port.spec.ts
+++ b/packages/devtools/e2e/host-toolbar-port.spec.ts
@@ -1,7 +1,7 @@
 import { test, expect, _electron, type ElectronApplication, type Page } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil, findMainWindow } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
@@ -25,7 +25,7 @@ const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
  *    (the session preload runs there too — guard zero-footprint, R2 surface).
  *
  * Mirrors host-toolbar.spec.ts: boot `host-toolbar-entry.js`, open the demo
- * project, then drive `instance.context.views.hostToolbar` from the MAIN
+ * project, then drive the OPEN project's own `hostToolbar` from the MAIN
  * process via `electronApp.evaluate`.
  */
 
@@ -36,8 +36,12 @@ type ToolbarPortSurface = {
   onMessage(channel: string, handler: (payload: unknown) => void): { dispose(): void }
   webContents: { isDestroyed(): boolean; executeJavaScript(code: string): Promise<unknown> } | null
 }
+// `instance.context` is the PROJECT-LIST window's own context — every window
+// gets its own `WorkbenchContext`/`ViewManager`, so this spec (which drives
+// the OPEN project's toolbar) reaches it through `instance.projectWindows()`,
+// same as host-toolbar.spec.ts.
 type E2eGlobals = {
-  __e2eHostToolbarInstance: { context: { views: { hostToolbar: ToolbarPortSurface } } }
+  __e2eHostToolbarInstance: { projectWindows(): Array<{ context: { views: { hostToolbar: ToolbarPortSurface } } }> }
   __e2ePortPings?: unknown[]
 }
 
@@ -46,7 +50,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
   test.describe.configure({ mode: 'serial' })
 
   let electronApp: ElectronApplication
-  let mainWindow: Page
+  let workbench: Page
 
   test.beforeAll(async () => {
     const entryPath = path.resolve(__dirname, 'host-toolbar-entry.js')
@@ -57,18 +61,15 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
         NODE_ENV: 'test',
       },
     })
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
-
-    // The toolbar placeholder/anchor mounts with an open project; load toolbar
-    // content only after this so the R1 height loop and the R2 handshake both
-    // run against a mounted layout.
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
+    // The toolbar placeholder/anchor mounts with an open project; `openProjectInUI`
+    // opens its own workbench window and returns that window's Page directly,
+    // so the R1 height loop and the R2 handshake both run against a mounted layout.
+    workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
   })
 
   test.afterAll(async () => {
-    if (mainWindow && !mainWindow.isClosed()) {
-      await closeProject(mainWindow).catch(() => {})
+    if (workbench && !workbench.isClosed()) {
+      await closeProject(electronApp).catch(() => {})
     }
     await Promise.race([
       electronApp?.close().catch(() => {}),
@@ -87,7 +88,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
   const inToolbarPage = (code: string) =>
     electronApp.evaluate(async (_electronMods, expr) => {
       const g = globalThis as unknown as E2eGlobals
-      const wc = g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents
+      const wc = g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.webContents
       if (!wc || wc.isDestroyed()) return null
       return wc.executeJavaScript(expr)
     }, code)
@@ -96,7 +97,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
     // send() with no toolbar view at all: false, and it must not conjure one.
     const early = await electronApp.evaluate(() => {
       const g = globalThis as unknown as E2eGlobals
-      const toolbar = g.__e2eHostToolbarInstance.context.views.hostToolbar
+      const toolbar = g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar
       return { ok: toolbar.send('e2e:host', { too: 'early' }), created: toolbar.webContents !== null }
     })
     expect(early.ok).toBe(false)
@@ -107,7 +108,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
     await electronApp.evaluate(() => {
       const g = globalThis as unknown as E2eGlobals
       g.__e2ePortPings = []
-      g.__e2eHostToolbarInstance.context.views.hostToolbar.onMessage('e2e:ping', (payload) => {
+      g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.onMessage('e2e:ping', (payload) => {
         g.__e2ePortPings!.push(payload)
       })
     })
@@ -116,7 +117,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
     // so this delivery proves the preload pending queue end to end.
     await electronApp.evaluate((_electronMods, file) => {
       const g = globalThis as unknown as E2eGlobals
-      return g.__e2eHostToolbarInstance.context.views.hostToolbar.loadFile(file)
+      return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.loadFile(file)
     }, path.join(FIXTURES, 'toolbar-port.html'))
 
     const pings = await pollUntil(hostPings, (v) => v.length >= 1, 30_000, 300)
@@ -131,7 +132,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
     await pollUntil(
       () => electronApp.evaluate(() => {
         const g = globalThis as unknown as E2eGlobals
-        return g.__e2eHostToolbarInstance.context.views.hostToolbar.send('e2e:host', { round: 1 })
+        return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.send('e2e:host', { round: 1 })
       }),
       (ok) => ok === true,
       30_000,
@@ -168,7 +169,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
     await pollUntil(
       () => electronApp.evaluate(() => {
         const g = globalThis as unknown as E2eGlobals
-        return g.__e2eHostToolbarInstance.context.views.hostToolbar.send('e2e:host', { round: 2 })
+        return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.send('e2e:host', { round: 2 })
       }),
       (ok) => ok === true,
       30_000,
@@ -188,7 +189,7 @@ test.describe('Host toolbar: gated MessagePort narrow channel (R2)', () => {
     // guard must keep the R2 bridge out of every non-toolbar renderer. An
     // implementation that exposes unconditionally fails here (and trips the
     // /toolbar/i sweep in host-toolbar.spec.ts as well).
-    const leak = await mainWindow.evaluate(
+    const leak = await workbench.evaluate(
       () => typeof (window as unknown as { diminaHostToolbar?: unknown }).diminaHostToolbar,
     )
     expect(leak).toBe('undefined')
diff --git a/packages/devtools/e2e/host-toolbar-replay.spec.ts b/packages/devtools/e2e/host-toolbar-replay.spec.ts
index 3e7c199e..c94c4932 100644
--- a/packages/devtools/e2e/host-toolbar-replay.spec.ts
+++ b/packages/devtools/e2e/host-toolbar-replay.spec.ts
@@ -1,180 +1,101 @@
 import { test, expect, _electron, type ElectronApplication, type Page } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil, findMainWindow } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, pollUntil } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
 
 /**
- * Host-toolbar height REPLAY (downstream feedback bug, real app).
+ * Host-toolbar height RETENTION (real app).
  *
- * THE BUG THIS SPEC EXISTS FOR: the dynamic-height chain is push-only with no
- * replay anywhere — the toolbar WCV's size-advertiser deduplicates (a height
- * already reported is never re-sent), main does not retain the notified value,
- * and the main-window renderer's `HostToolbarHeightChanged` listener mounts
- * only with the project view. So a notify that fires while no project view is
- * mounted is PERMANENTLY lost and the toolbar strip stays collapsed at 0:
- *  - close project → reopen reproduces it 100% deterministically (the
- *    placeholder component is rebuilt at 0; the deduped advertiser never
- *    re-reports);
- *  - cold-starting on the project list races the advertise against project
- *    open.
+ * `views.getHostToolbarHeight()` keeps the last height a toolbar WCV
+ * advertised, independent of whether a renderer is currently listening for
+ * the push. The renderer's `[data-area="host-toolbar"]` placeholder PULLS
+ * this value on mount (the `view:host-toolbar:get-height` invoke) instead of
+ * relying solely on the push, because advertise and mount are two
+ * independent timelines within one window's boot: the toolbar WCV's
+ * size-advertiser deduplicates (a height already reported is never
+ * re-sent), so a push that lands before the placeholder has mounted — or
+ * before its height listener is wired up — needs a way to be recovered
+ * rather than lost the moment the dedupe kicks in.
  *
- * The fix contract: main RETAINS the last notified height (new
- * `views.getHostToolbarHeight()` getter) and the renderer PULLS it on mount
- * via the new `view:host-toolbar:get-height` invoke (subscribe-then-pull).
- * Companion unit pins: host-toolbar-height-retention.test.ts,
- * views-host-toolbar-get-height.test.ts,
- * project-runtime-host-toolbar-replay.test.tsx,
- * view-api-get-host-toolbar-height.test.ts.
+ * "Toolbar alive, placeholder gone" is not a reachable state: a workbench
+ * window's toolbar WCV and its placeholder are mounted by the same
+ * `ProjectRuntime`, in the same window, and the only way to unmount the
+ * placeholder is to destroy the window, which takes the toolbar with it. So
+ * the ordering this spec has to cover is the one inside a single window's own
+ * boot: load content into the toolbar, confirm the placeholder reflects it,
+ * and confirm main retained the same value the renderer pulled.
  *
  * Reuses `host-toolbar-entry.js` (stock `launch()` exposing the instance on
  * globalThis) and the host-toolbar fixtures. Electron e2e; runs on local
  * macOS without extra setup (NODE_ENV=test, off-screen windows).
- *
- * Guards that reopen/cold-start recovers the advertised height instead of
- * leaving the placeholder stuck at 0, via the retention getter.
  */
 
-/** Measured height of the main-window toolbar placeholder (CSS px, rounded). */
-const placeholderHeightOf = (mainWindow: Page) => () => mainWindow.evaluate(() => {
-  const el = document.querySelector('[data-area="host-toolbar"]')
-  return el ? Math.round(el.getBoundingClientRect().height) : -1
-})
-
-function launchApp(): Promise<ElectronApplication> {
-  const entryPath = path.resolve(__dirname, 'host-toolbar-entry.js')
-  return _electron.launch({
-    args: [entryPath],
-    env: {
-      ...process.env,
-      NODE_ENV: 'test',
-    },
-  })
-}
-
-async function loadToolbar64(electronApp: ElectronApplication): Promise<void> {
-  await electronApp.evaluate((_electronMods, file) => {
-    const g = globalThis as unknown as {
-      __e2eHostToolbarInstance: {
-        context: { views: { hostToolbar: { loadFile(p: string): Promise<void> } } }
+interface HostToolbarInstance {
+  projectWindows(): Array<{
+    context: {
+      views: {
+        hostToolbar: { loadFile(p: string): Promise<void> }
+        getHostToolbarHeight(): number
       }
     }
-    return g.__e2eHostToolbarInstance.context.views.hostToolbar.loadFile(file)
-  }, path.join(FIXTURES, 'toolbar-64.html'))
+  }>
 }
 
-test.describe('Host toolbar height replay: close project → reopen (deterministic repro)', () => {
-  test.setTimeout(180_000)
+test.describe('Host toolbar height retention', () => {
+  test.setTimeout(120_000)
   test.describe.configure({ mode: 'serial' })
 
   let electronApp: ElectronApplication
-  let mainWindow: Page
+  let workbench: Page
 
   test.beforeAll(async () => {
-    electronApp = await launchApp()
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
+    const entryPath = path.resolve(__dirname, 'host-toolbar-entry.js')
+    electronApp = await _electron.launch({
+      args: [entryPath],
+      env: {
+        ...process.env,
+        NODE_ENV: 'test',
+      },
+    })
+    workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
   })
 
   test.afterAll(async () => {
-    if (mainWindow && !mainWindow.isClosed()) {
-      await closeProject(mainWindow).catch(() => {})
-    }
     await Promise.race([
       electronApp?.close().catch(() => {}),
       new Promise((resolve) => setTimeout(resolve, 15_000)),
     ])
   })
 
-  test('the placeholder recovers the advertised 64px after close → reopen', async () => {
-    const placeholderHeight = placeholderHeightOf(mainWindow)
-
-    // Precondition (same flow as host-toolbar.spec.ts): with
-    // the project open, the advertise → notify → placeholder loop lands 64.
-    await loadToolbar64(electronApp)
-    const before = await pollUntil(placeholderHeight, (v) => v === 64, 30_000, 300)
-    expect(before, 'precondition: live advertise must drive the placeholder to 64').toBe(64)
-
-    // Close the project (the placeholder component unmounts) and reopen it
-    // (a FRESH placeholder mounts at 0). The toolbar WCV and its content
-    // survive the project session; its advertiser already reported 64 and
-    // deduplicates, so nothing will ever push again.
-    await closeProject(mainWindow)
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
-
-    // THE REPLAY ASSERTION: the freshly-mounted placeholder must recover the
-    // retained 64 by pulling it from main. Today nothing replays — this poll
-    // times out with the strip collapsed at 0 (the downstream bug).
-    const after = await pollUntil(placeholderHeight, (v) => v === 64, 15_000, 300)
-    expect(
-      after,
-      'after close → reopen the placeholder must replay the retained toolbar height (today it is stuck at 0 — the advertiser never re-reports)',
-    ).toBe(64)
-  })
-})
-
-test.describe('Host toolbar height replay: cold start (advertise before any project open)', () => {
-  test.setTimeout(180_000)
-  test.describe.configure({ mode: 'serial' })
-
-  let electronApp: ElectronApplication
-  let mainWindow: Page
-
-  test.beforeAll(async () => {
-    electronApp = await launchApp()
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
-    // Deliberately NO project open here — the advertise must land while the
-    // main window still shows the project list (no placeholder, no listener).
+  /** Measured height of the workbench window's toolbar placeholder (CSS px, rounded). */
+  const placeholderHeight = () => workbench.evaluate(() => {
+    const el = document.querySelector('[data-area="host-toolbar"]')
+    return el ? Math.round(el.getBoundingClientRect().height) : -1
   })
 
-  test.afterAll(async () => {
-    if (mainWindow && !mainWindow.isClosed()) {
-      await closeProject(mainWindow).catch(() => {})
-    }
-    await Promise.race([
-      electronApp?.close().catch(() => {}),
-      new Promise((resolve) => setTimeout(resolve, 15_000)),
-    ])
-  })
+  test('the advertised height reaches the placeholder and is retained for the window it belongs to', async () => {
+    await electronApp.evaluate((_electronMods, file) => {
+      const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+      return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.loadFile(file)
+    }, path.join(FIXTURES, 'toolbar-64.html'))
 
-  test('main retains the pre-open advertise and the first project view replays it', async () => {
-    await loadToolbar64(electronApp)
+    const height = await pollUntil(placeholderHeight, (v) => v === 64, 30_000, 300)
+    expect(height, 'the advertise → notify → placeholder loop must land 64').toBe(64)
 
-    // MAIN-SIDE RETENTION: poll the new getter from the main process. Returns
-    // a sentinel instead of throwing while the getter does not exist so the
-    // RED failure reads clearly.
+    // THE RETENTION ASSERTION: main keeps the same value the placeholder just
+    // pulled, scoped to the window whose toolbar advertised it.
     const retained = await pollUntil(
-      () => electronApp.evaluate((_electronMods) => {
-        const g = globalThis as unknown as {
-          __e2eHostToolbarInstance: {
-            context: { views: { getHostToolbarHeight?: () => number } }
-          }
-        }
-        const views = g.__e2eHostToolbarInstance.context.views
-        return typeof views.getHostToolbarHeight === 'function'
-          ? views.getHostToolbarHeight()
-          : ('MISSING-GETTER' as const)
+      () => electronApp.evaluate(() => {
+        const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+        return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.getHostToolbarHeight()
       }),
       (v) => v === 64,
-      20_000,
+      15_000,
       300,
     )
-    expect(
-      retained,
-      'views.getHostToolbarHeight() must retain the pre-open advertise (today the getter does not exist and the value is dropped)',
-    ).toBe(64)
-
-    // RENDERER REPLAY: opening the project mounts a fresh placeholder, which
-    // must pull the retained 64 (the advertiser deduplicated long ago).
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
-    const height = await pollUntil(placeholderHeightOf(mainWindow), (v) => v === 64, 15_000, 300)
-    expect(
-      height,
-      'the first project view after a cold-start advertise must replay the retained height',
-    ).toBe(64)
+    expect(retained, 'the retention getter must keep the last height advertised in this window').toBe(64)
   })
 })
diff --git a/packages/devtools/e2e/host-toolbar.spec.ts b/packages/devtools/e2e/host-toolbar.spec.ts
index 68a32589..f49506d0 100644
--- a/packages/devtools/e2e/host-toolbar.spec.ts
+++ b/packages/devtools/e2e/host-toolbar.spec.ts
@@ -1,7 +1,7 @@
 import { test, expect, _electron, type ElectronApplication, type Page } from '@playwright/test'
 import path from 'path'
 import { fileURLToPath } from 'url'
-import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil, findMainWindow } from './helpers'
+import { DEMO_APP_DIR, openProjectInUI, closeProject, pollUntil } from './helpers'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const FIXTURES = path.resolve(__dirname, 'fixtures', 'host-toolbar')
@@ -34,7 +34,7 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
   test.describe.configure({ mode: 'serial' })
 
   let electronApp: ElectronApplication
-  let mainWindow: Page
+  let workbench: Page
 
   test.beforeAll(async () => {
     const entryPath = path.resolve(__dirname, 'host-toolbar-entry.js')
@@ -45,18 +45,17 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
         NODE_ENV: 'test',
       },
     })
-    mainWindow = await findMainWindow(electronApp)
-    await mainWindow.waitForLoadState('domcontentloaded')
 
     // The host-toolbar placeholder (and its height listener) only mounts once
     // a project is open — load toolbar content only after this so the
-    // advertise → placeholder loop is deterministic.
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 20_000 })
+    // advertise → placeholder loop is deterministic. `openProjectInUI` opens
+    // its own workbench window and returns that window's Page directly.
+    workbench = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 20_000 })
   })
 
   test.afterAll(async () => {
-    if (mainWindow && !mainWindow.isClosed()) {
-      await closeProject(mainWindow).catch(() => {})
+    if (workbench && !workbench.isClosed()) {
+      await closeProject(electronApp).catch(() => {})
     }
     await Promise.race([
       electronApp?.close().catch(() => {}),
@@ -64,8 +63,32 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     ])
   })
 
-  /** Measured height of the main-window toolbar placeholder (CSS px, rounded). */
-  const placeholderHeight = () => mainWindow.evaluate(() => {
+  /**
+   * `instance.context` (exposed by host-toolbar-entry.js's `onSetup`) is the
+   * PROJECT-LIST window's own context — every window gets its own
+   * `WorkbenchContext`/`ViewManager`, so the list window's `hostToolbar` is a
+   * separate instance from the workbench window's. The `[data-area="host-
+   * toolbar"]` placeholder only mounts in the workbench renderer (ProjectRuntime),
+   * so driving/measuring the toolbar in this spec means reaching the OPEN
+   * project's own window via `instance.projectWindows()`, not `instance.context`.
+   */
+  type HostToolbarWebContents = { id: number; isDestroyed(): boolean } | null
+  interface HostToolbarInstance {
+    projectWindows(): Array<{
+      context: {
+        views: {
+          hostToolbar: {
+            loadFile(p: string): Promise<void>
+            setPreloadPath(p: string | null): void
+            webContents: (HostToolbarWebContents & { executeJavaScript(code: string): Promise<unknown> }) | null
+          }
+        }
+      }
+    }>
+  }
+
+  /** Measured height of the workbench window's toolbar placeholder (CSS px, rounded). */
+  const placeholderHeight = () => workbench.evaluate(() => {
     const el = document.querySelector('[data-area="host-toolbar"]')
     return el ? Math.round(el.getBoundingClientRect().height) : -1
   })
@@ -77,12 +100,8 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     // 64px placeholder). If the session registration / marker / guard chain
     // is mis-wired, the placeholder stays 0 here.
     await electronApp.evaluate((_electronMods, file) => {
-      const g = globalThis as unknown as {
-        __e2eHostToolbarInstance: {
-          context: { views: { hostToolbar: { loadFile(p: string): Promise<void> } } }
-        }
-      }
-      return g.__e2eHostToolbarInstance.context.views.hostToolbar.loadFile(file)
+      const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+      return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.loadFile(file)
     }, path.join(FIXTURES, 'toolbar-64.html'))
 
     const height = await pollUntil(placeholderHeight, (v) => v === 64, 30_000, 300)
@@ -95,22 +114,16 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     // a preload that does only an unrelated thing (exposes a marker global,
     // installs NO advertiser), and load 88px-tall content.
     await electronApp.evaluate((_electronMods) => {
-      const g = globalThis as unknown as {
-        __e2eHostToolbarInstance: {
-          context: { views: { hostToolbar: { webContents: { isDestroyed(): boolean; close(): void } | null } } }
-        }
-      }
-      const wc = g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents
-      if (wc && !wc.isDestroyed()) wc.close()
+      const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+      const wc = g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.webContents
+      if (wc && !wc.isDestroyed()) (wc as unknown as { close(): void }).close()
     })
     // Wait until the old webContents is fully gone (the control surface
     // reports null) so the next loadFile lazily rebuilds the view.
     await pollUntil(
       () => electronApp.evaluate((_electronMods) => {
-        const g = globalThis as unknown as {
-          __e2eHostToolbarInstance: { context: { views: { hostToolbar: { webContents: unknown } } } }
-        }
-        return g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents === null
+        const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+        return g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.webContents === null
       }),
       (gone) => gone === true,
       10_000,
@@ -118,19 +131,8 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     )
 
     await electronApp.evaluate((_electronMods, args) => {
-      const g = globalThis as unknown as {
-        __e2eHostToolbarInstance: {
-          context: {
-            views: {
-              hostToolbar: {
-                setPreloadPath(p: string | null): void
-                loadFile(p: string): Promise<void>
-              }
-            }
-          }
-        }
-      }
-      const toolbar = g.__e2eHostToolbarInstance.context.views.hostToolbar
+      const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+      const toolbar = g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar
       toolbar.setPreloadPath(args.preload)
       return toolbar.loadFile(args.file)
     }, {
@@ -145,17 +147,9 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     const mark = await pollUntil(
       () => electronApp.evaluate(async (_electronMods) => {
         const g = globalThis as unknown as {
-          __e2eHostToolbarInstance: {
-            context: {
-              views: {
-                hostToolbar: {
-                  webContents: { isDestroyed(): boolean; executeJavaScript(code: string): Promise<unknown> } | null
-                }
-              }
-            }
-          }
+          __e2eHostToolbarInstance: HostToolbarInstance
         }
-        const wc = g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents
+        const wc = g.__e2eHostToolbarInstance.projectWindows()[0].context.views.hostToolbar.webContents
         if (!wc || wc.isDestroyed()) return null
         return wc.executeJavaScript('window.__e2eHostPreloadMark ?? null')
       }),
@@ -174,15 +168,16 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     expect(height).toBe(88)
   })
 
-  test('no leak: the main window main world carries no toolbar-runtime / host-preload globals', async () => {
+  test('no leak: the workbench window main world carries no toolbar-runtime / host-preload globals', async () => {
     // The session preload executes in EVERY defaultSession renderer
-    // (including this main window), but the marker+isMainFrame guard must
-    // make it return before
-    // touching the page: no advertiser globals, and — critically — the
-    // HOST's preload must never be session-registered (an implementation
-    // that "fixes" setPreloadPath by registering the host preload on the
-    // session would leak __e2eHostPreloadMark into every window).
-    const leaks = await mainWindow.evaluate(() =>
+    // (including the workbench window's own top-level frame, which shares
+    // the session with the embedded toolbar WCV), but the marker+isMainFrame
+    // guard must make it return before touching the page: no advertiser
+    // globals, and — critically — the HOST's preload must never be
+    // session-registered (an implementation that "fixes" setPreloadPath by
+    // registering the host preload on the session would leak
+    // __e2eHostPreloadMark into every window).
+    const leaks = await workbench.evaluate(() =>
       Object.getOwnPropertyNames(window).filter((name) =>
         // `window.toolbar` (exact name) is excluded: it is the Web-platform
         // BarProp BUILTIN, an own property of EVERY Chromium window — verified
@@ -205,29 +200,33 @@ test.describe('Host toolbar: session-resident height advertiser (R1)', () => {
     // strip (88px from the test above) remains attached+visible on top of the
     // project-list page, covering its search box until the next project open.
 
-    /** Is the toolbar WCV currently among any window's contentView children? */
-    const toolbarAttached = () => electronApp.evaluate(({ BrowserWindow }) => {
-      const g = globalThis as unknown as {
-        __e2eHostToolbarInstance: {
-          context: { views: { hostToolbar: { webContents: { id: number; isDestroyed(): boolean } | null } } }
-        }
-      }
-      const wc = g.__e2eHostToolbarInstance.context.views.hostToolbar.webContents
-      if (!wc || wc.isDestroyed()) return false
+    // Capture the toolbar WCV's webContents id ONCE, while the project window
+    // is still open — closing the project removes it from
+    // `instance.projectWindows()`, so `context.views.hostToolbar` is only
+    // reachable through the instance BEFORE closeProject runs.
+    const toolbarWcId = await electronApp.evaluate(() => {
+      const g = globalThis as unknown as { __e2eHostToolbarInstance: HostToolbarInstance }
+      const wc = g.__e2eHostToolbarInstance.projectWindows()[0]?.context.views.hostToolbar.webContents
+      return wc && !wc.isDestroyed() ? wc.id : null
+    })
+    expect(toolbarWcId, 'toolbar webContents must exist while the project is open').not.toBeNull()
+
+    /** Is a view with this webContents id among any window's contentView children? */
+    const wcAttached = (wcId: number) => electronApp.evaluate(({ BrowserWindow }, id) => {
       return BrowserWindow.getAllWindows().some((win) => {
         const children = win.contentView.children as Array<{ webContents?: { id: number } }>
-        return children.some((v) => v.webContents?.id === wc.id)
+        return children.some((v) => v.webContents?.id === id)
       })
-    })
+    }, wcId)
 
     // Meaningfulness guard: the strip really is mounted while the project is
     // open — otherwise the post-close assertion would pass vacuously.
-    expect(await toolbarAttached()).toBe(true)
+    expect(await wcAttached(toolbarWcId!)).toBe(true)
 
-    await closeProject(mainWindow)
+    await closeProject(electronApp)
 
     const attachedAfterClose = await pollUntil(
-      toolbarAttached,
+      () => wcAttached(toolbarWcId!),
       (attached) => attached === false,
       15_000,
       300,
diff --git a/packages/devtools/e2e/internal-devtools-console-reopen.spec.ts b/packages/devtools/e2e/internal-devtools-console-reopen.spec.ts
index 4c50a9bc..16345013 100644
--- a/packages/devtools/e2e/internal-devtools-console-reopen.spec.ts
+++ b/packages/devtools/e2e/internal-devtools-console-reopen.spec.ts
@@ -28,6 +28,7 @@ const FIXTURE_DIR = path.resolve(__dirname, 'fixtures', 'tabbar-app')
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 
 /**
  * Resolve the STANDALONE debug window's own DevTools front-end wc. Opening
@@ -183,7 +184,7 @@ test.describe('Standalone debug window Console survives a close/reopen cycle', (
       10000, 100,
     )
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
     await pollUntil(
       () => evalInSimulator<boolean>(electronApp, `(() => !!document.querySelector('.device-shell-root'))()`).catch(() => false),
@@ -192,7 +193,7 @@ test.describe('Standalone debug window Console survives a close/reopen cycle', (
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -201,7 +202,7 @@ test.describe('Standalone debug window Console survives a close/reopen cycle', (
     // only reach the panel via the mirror's buffered replay, not live mirroring.
     await logInServiceHost(tokenT1)
 
-    await mainWindow.getByTestId('sim-open-internal-devtools').click()
+    await workbench.getByTestId('sim-open-internal-devtools').click()
     await waitInternalDevtoolsConsoleReady()
 
     const count = await pollUntil(
@@ -227,7 +228,7 @@ test.describe('Standalone debug window Console survives a close/reopen cycle', (
     // replay-on-reopen path, exactly like T1 did on first open.
     await logInServiceHost(tokenT2)
 
-    await mainWindow.getByTestId('sim-open-internal-devtools').click()
+    await workbench.getByTestId('sim-open-internal-devtools').click()
     await pollUntil(
       () => isInternalDevtoolsWindowVisible(),
       (visible) => visible === true,
diff --git a/packages/devtools/e2e/internal-devtools-window.spec.ts b/packages/devtools/e2e/internal-devtools-window.spec.ts
index 02b726d6..c810ca7b 100644
--- a/packages/devtools/e2e/internal-devtools-window.spec.ts
+++ b/packages/devtools/e2e/internal-devtools-window.spec.ts
@@ -13,14 +13,14 @@ test.describe('Internal (app-wide) DevTools window', () => {
 
   useSharedProject(test, DEMO_APP_DIR)
 
-  test('debug button is visible in the simulator bottom bar', async ({ mainWindow }) => {
-    await expect(mainWindow.getByTestId('sim-open-internal-devtools')).toBeVisible()
+  test('debug button is visible in the simulator bottom bar', async ({ workbench }) => {
+    await expect(workbench.getByTestId('sim-open-internal-devtools')).toBeVisible()
   })
 
-  test('clicking it opens exactly one new BrowserWindow, titled for whole-app debugging', async ({ mainWindow, electronApp }) => {
+  test('clicking it opens exactly one new BrowserWindow, titled for whole-app debugging', async ({ workbench, electronApp }) => {
     const before = await electronApp.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length)
 
-    await mainWindow.getByTestId('sim-open-internal-devtools').click()
+    await workbench.getByTestId('sim-open-internal-devtools').click()
 
     await expect.poll(
       async () => electronApp.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length),
@@ -31,18 +31,18 @@ test.describe('Internal (app-wide) DevTools window', () => {
     expect(titles.some((t) => t.includes('调试'))).toBe(true)
   })
 
-  test('clicking it again reuses the same window (no second BrowserWindow)', async ({ mainWindow, electronApp }) => {
+  test('clicking it again reuses the same window (no second BrowserWindow)', async ({ workbench, electronApp }) => {
     const countAfterFirstOpen = await electronApp.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length)
 
-    await mainWindow.getByTestId('sim-open-internal-devtools').click()
+    await workbench.getByTestId('sim-open-internal-devtools').click()
     // Give main a beat to process the (idempotent) IPC round trip.
-    await mainWindow.waitForTimeout(300)
+    await workbench.waitForTimeout(300)
 
     const countAfterSecondClick = await electronApp.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length)
     expect(countAfterSecondClick).toBe(countAfterFirstOpen)
   })
 
-  test('closing it hides rather than destroys — reopening reuses the SAME window', async ({ mainWindow, electronApp }) => {
+  test('closing it hides rather than destroys — reopening reuses the SAME window', async ({ workbench, electronApp }) => {
     // Baseline BEFORE closing — the app also carries a permanently-hidden
     // "Dimina Service Host" BrowserWindow (id:2 in a real run, always
     // present, unrelated to this feature), so an ABSOLUTE window count
@@ -78,7 +78,7 @@ test.describe('Internal (app-wide) DevTools window', () => {
     const countAfterClose = await electronApp.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length)
     expect(countAfterClose, 'closing the internal devtools window must not destroy it').toBe(countBeforeClose)
 
-    await mainWindow.getByTestId('sim-open-internal-devtools').click()
+    await workbench.getByTestId('sim-open-internal-devtools').click()
 
     await expect.poll(
       async () => electronApp.evaluate(({ BrowserWindow }) => {
diff --git a/packages/devtools/e2e/ipc-workflow.spec.ts b/packages/devtools/e2e/ipc-workflow.spec.ts
index f62fa388..eb7ac7d3 100644
--- a/packages/devtools/e2e/ipc-workflow.spec.ts
+++ b/packages/devtools/e2e/ipc-workflow.spec.ts
@@ -3,8 +3,15 @@ import { DEMO_APP_DIR, ipcInvoke, addProject, closeProject } from './helpers'
 import { ProjectsChannel, ProjectChannel } from '../src/shared/ipc-channels'
 
 test.describe('IPC + Project Workflow', () => {
-  test.afterEach(async ({ mainWindow }) => {
-    await closeProject(mainWindow).catch(() => {})
+  // These tests drive `ProjectChannel.Open/Close` directly (not through the
+  // project-card click), so they never spawn a real workbench BrowserWindow —
+  // the session lives in the calling (list) window's own WorkbenchContext.
+  // Close it the same way; `closeProject(electronApp)` only tears down real
+  // workbench windows and would be a no-op here. It's still called as a
+  // belt-and-suspenders in case a later test starts opening through the UI.
+  test.afterEach(async ({ mainWindow, electronApp }) => {
+    await ipcInvoke(mainWindow, ProjectChannel.Close).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await ipcInvoke(mainWindow, ProjectsChannel.Remove, DEMO_APP_DIR).catch(() => {})
   })
 
@@ -66,6 +73,6 @@ test.describe('IPC + Project Workflow', () => {
     expect(typeof result).toBe('object')
 
     // Close the project so teardown doesn't hang
-    await closeProject(mainWindow)
+    await ipcInvoke(mainWindow, ProjectChannel.Close)
   })
 })
diff --git a/packages/devtools/e2e/minigame-launch.spec.ts b/packages/devtools/e2e/minigame-launch.spec.ts
index 9a0c00c9..20eed539 100644
--- a/packages/devtools/e2e/minigame-launch.spec.ts
+++ b/packages/devtools/e2e/minigame-launch.spec.ts
@@ -27,8 +27,12 @@ interface OpenProjectResult {
 }
 
 test.describe('mini-game project support', () => {
-  test.afterEach(async ({ mainWindow }) => {
-    await closeProject(mainWindow).catch(() => {})
+  // Most tests below drive `ProjectChannel.Open` directly (list window's own
+  // WorkbenchContext, no real workbench window); the last test opens through
+  // the UI (a real workbench BrowserWindow). Cover both close paths.
+  test.afterEach(async ({ mainWindow, electronApp }) => {
+    await ipcInvoke(mainWindow, ProjectChannel.Close).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await ipcInvoke(mainWindow, ProjectsChannel.Remove, MINI_GAME_DIR).catch(() => {})
   })
 
@@ -54,12 +58,15 @@ test.describe('mini-game project support', () => {
     expect(result.success, `open failed: ${result.error}`).toBe(true)
   })
 
-  test('opening the project in the UI renders a real game canvas', async ({ electronApp, mainWindow }) => {
+  // `mainWindow` is requested but unused: acquiring it is what health-checks
+  // the app and relaunches a dead one, and that has to happen before this test
+  // drives the UI, not when `afterEach` first asks for it.
+  test('opening the project in the UI renders a real game canvas', async ({ electronApp, mainWindow: _mainWindow }) => {
     await installConsoleCollector(electronApp)
     // The project-list grid is filtered by category (default '小程序'); a
     // mini-game project's card only renders once '小游戏' is selected.
     await selectProjectCategoryInUI(electronApp, 'minigame')
-    await openProjectInUI(mainWindow, MINI_GAME_DIR)
+    await openProjectInUI(electronApp, MINI_GAME_DIR)
 
     const hasGameCanvas = await evalInWebContentsByUrl<boolean>(
       electronApp,
diff --git a/packages/devtools/e2e/native-host-console-project-switch.spec.ts b/packages/devtools/e2e/native-host-console-project-switch.spec.ts
index f533d338..938f5d47 100644
--- a/packages/devtools/e2e/native-host-console-project-switch.spec.ts
+++ b/packages/devtools/e2e/native-host-console-project-switch.spec.ts
@@ -169,13 +169,18 @@ test.describe('Right-panel Console keeps working after switching projects', () =
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
   test('a log in project A is visible, then a log in project B (after a real close+reopen) is visible too', async () => {
     // ── Project A ────────────────────────────────────────────────────────
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 60_000 })
+    // Each project now opens in its own workbench window; the returned page
+    // is that window. The console assertions below still go through
+    // `electronApp.evaluate` (the panel is a separate devtools:// webContents,
+    // not part of the workbench window's own DOM) — `workbenchA` is kept to
+    // prove the window itself is really gone once `closeProject` runs.
+    const workbenchA = await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 60_000 })
     await waitForSimulatorWebview(electronApp)
     await pollUntil(
       () => evalInSimulator<boolean>(electronApp, `(() => !!document.querySelector('.device-shell-root'))()`).catch(() => false),
@@ -207,8 +212,9 @@ test.describe('Right-panel Console keeps working after switching projects', () =
     }
 
     // ── Switch to project B: a REAL close, not just the back-button path ──
-    await closeProject(mainWindow)
-    await openProjectInUI(mainWindow, PROJECT_B_DIR, { waitMs: 60_000 })
+    await closeProject(electronApp, { projectDir: DEMO_APP_DIR })
+    expect(workbenchA.isClosed(), 'project A\'s workbench window should be gone after closeProject').toBe(true)
+    const workbenchB = await openProjectInUI(electronApp, PROJECT_B_DIR, { waitMs: 60_000 })
     await waitForSimulatorWebview(electronApp)
     await pollUntil(
       () => evalInSimulator<boolean>(electronApp, `(() => !!document.querySelector('.device-shell-root'))()`).catch(() => false),
@@ -227,6 +233,7 @@ test.describe('Right-panel Console keeps working after switching projects', () =
       45000, 500,
     )
     expect(countB, 'a log made in project B\'s (new) service host should be visible in the (rebuilt) right-panel Console after switching').toBeGreaterThanOrEqual(1)
+    expect(workbenchB.isClosed(), 'project B\'s own workbench window should still be open').toBe(false)
 
     const selectedTabForB = await readSelectedTabText()
     if (selectedTabForB !== null) {
diff --git a/packages/devtools/e2e/native-host-current-page.spec.ts b/packages/devtools/e2e/native-host-current-page.spec.ts
index bdb7ee90..608eb101 100644
--- a/packages/devtools/e2e/native-host-current-page.spec.ts
+++ b/packages/devtools/e2e/native-host-current-page.spec.ts
@@ -1,7 +1,7 @@
 /**
- * E2E (native-host only): the devtools main-window simulator-panel bottom
- * toolbar's CURRENT-PAGE path display must UPDATE when the mini-app navigates
- * to a different page.
+ * E2E (native-host only): the devtools project workbench window's
+ * simulator-panel bottom toolbar's CURRENT-PAGE path display must UPDATE
+ * when the mini-app navigates to a different page.
  *
  * Contract being pinned:
  *   Under DIMINA_NATIVE_HOST=1 the mini-app renders in a main-process
@@ -21,7 +21,7 @@
  * from the initial launch URL and never updates on in-app navigation, so after
  * navigating it remains the entry route (pages/home/home).
  *
- * The toolbar text is read from the main window's DOM (the simulator-panel is a
+ * The toolbar text is read from the project workbench window's DOM (the simulator-panel is a
  * renderer React component): the bottom toolbar (`.bg-sim-bottom`) contains a
  * `<span>` with the current page text followed by the `title="复制路径"`
  * button — see
@@ -59,6 +59,7 @@ const TARGET_ROUTE = 'pages/detail/detail'
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 let autoPort = 0
 
 // One-shot JSON-RPC call to the miniprogram-automator WebSocket server (mirrors
@@ -88,8 +89,8 @@ function wsCall<T = Record<string, unknown>>(
 }
 
 /**
- * Read the simulator-panel bottom-toolbar current-page text from the MAIN
- * window DOM. The toolbar is `.bg-sim-bottom` (see simulator-panel.tsx); the
+ * Read the simulator-panel bottom-toolbar current-page text from the project
+ * workbench window's DOM. The toolbar is `.bg-sim-bottom` (see simulator-panel.tsx); the
  * route lives in its first text-bearing span, directly before the
  * `title="复制路径"` copy button. We read that span's textContent and trim it.
  * Returns '' if the toolbar isn't present yet.
@@ -148,7 +149,7 @@ test.describe('native-host current-page toolbar e2e', () => {
       100,
     ) as number
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
 
     // DeviceShell mounts only after SimulatorMiniApp.spawn() resolves; poll for
@@ -166,7 +167,7 @@ test.describe('native-host current-page toolbar e2e', () => {
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -183,7 +184,7 @@ test.describe('native-host current-page toolbar e2e', () => {
 
     // ── BEFORE: the toolbar shows the entry route. ───────────────────────────
     const before = await pollUntil(
-      () => readToolbarCurrentPage(mainWindow),
+      () => readToolbarCurrentPage(workbench),
       (txt) => txt.includes(ENTRY_ROUTE),
       20000,
       400,
@@ -209,7 +210,7 @@ test.describe('native-host current-page toolbar e2e', () => {
     // route and must no longer be the entry route. THIS is the contract that
     // current code violates under native-host. ──────────────────────────────
     const after = await pollUntil(
-      () => readToolbarCurrentPage(mainWindow),
+      () => readToolbarCurrentPage(workbench),
       (txt) => txt.includes(TARGET_ROUTE),
       15000,
       400,
@@ -233,7 +234,7 @@ test.describe('native-host current-page toolbar e2e', () => {
     // The toolbar must show the FULL route (path + params), like WeChat
     // DevTools' simulator page-path bar — a bare path would hide the params.
     const shown = await pollUntil(
-      () => readToolbarCurrentPage(mainWindow),
+      () => readToolbarCurrentPage(workbench),
       (txt) => txt.includes('pages/detail/detail?from=nav&id=7'),
       15000,
       400,
@@ -249,7 +250,7 @@ test.describe('native-host current-page toolbar e2e', () => {
     // route and the toolbar shows it.
     const QUERIED = 'pages/detail/detail?from=nav&id=7'
     await pollUntil(
-      () => readToolbarCurrentPage(mainWindow),
+      () => readToolbarCurrentPage(workbench),
       (txt) => txt.includes('pages/detail/detail?from=nav'),
       15000,
       400,
@@ -291,7 +292,7 @@ test.describe('native-host current-page toolbar e2e', () => {
 
     try {
       await ipcInvoke(
-        mainWindow,
+        workbench,
         ProjectFsChannel.WriteFile,
         detailWxml,
         original.replace('DETAIL PAGE', marker),
@@ -306,7 +307,7 @@ test.describe('native-host current-page toolbar e2e', () => {
       )
       expect(rendered, 'saved detail.wxml text must appear after the watcher rebuild').toContain(marker)
     } finally {
-      await ipcInvoke(mainWindow, ProjectFsChannel.WriteFile, detailWxml, original).catch(() => {})
+      await ipcInvoke(workbench, ProjectFsChannel.WriteFile, detailWxml, original).catch(() => {})
       // Let the restore-triggered rebuild settle so the next spec opens a
       // clean project (mirrors editor-hot-reload.spec.ts's restore wait).
       await pollUntil(
@@ -320,7 +321,7 @@ test.describe('native-host current-page toolbar e2e', () => {
     // After the rebuild cycle the toolbar must STILL show the queried route —
     // the page AND its params survive the recompile.
     const after = await pollUntil(
-      () => readToolbarCurrentPage(mainWindow),
+      () => readToolbarCurrentPage(workbench),
       (txt) => txt.includes('pages/detail/detail?from=nav&id=7'),
       15000,
       400,
diff --git a/packages/devtools/e2e/native-host-devtools-console.spec.ts b/packages/devtools/e2e/native-host-devtools-console.spec.ts
index 953c0eab..d7084226 100644
--- a/packages/devtools/e2e/native-host-devtools-console.spec.ts
+++ b/packages/devtools/e2e/native-host-devtools-console.spec.ts
@@ -213,7 +213,7 @@ test.describe('native-host DevTools Console attaches to the service host (logic
       100,
     ) as number
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
 
     // DeviceShell mounts only after SimulatorMiniApp.spawn() resolves; wait for it
@@ -231,7 +231,7 @@ test.describe('native-host DevTools Console attaches to the service host (logic
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/native-host-devtools-elements-respawn.spec.ts b/packages/devtools/e2e/native-host-devtools-elements-respawn.spec.ts
index 7a03aae2..82aac064 100644
--- a/packages/devtools/e2e/native-host-devtools-elements-respawn.spec.ts
+++ b/packages/devtools/e2e/native-host-devtools-elements-respawn.spec.ts
@@ -44,7 +44,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 // ── Boot / shutdown ──────────────────────────────────────────────────────
 
-interface AppHandle { app: ElectronApplication; win: PwPage }
+interface AppHandle { app: ElectronApplication; win: PwPage; workbench: PwPage }
 
 async function bootApp(): Promise<AppHandle> {
   const appPath = path.resolve(__dirname, 'electron-entry.js')
@@ -87,9 +87,9 @@ async function bootApp(): Promise<AppHandle> {
     100,
   )
 
-  await openProjectInUI(win, DEMO_APP_DIR, { waitMs: 30000 })
+  const workbench = await openProjectInUI(app, DEMO_APP_DIR, { waitMs: 30000 })
 
-  return { app, win }
+  return { app, win, workbench }
 }
 
 // ── Render-guest text probe (main-process evaluation) ────────────────────
@@ -220,9 +220,9 @@ async function pollGetDocumentRoot(
  * next cycle (or following spec) opens against a clean, fully-compiled output.
  * Best-effort — never throws.
  */
-async function settleAfterRestore(win: PwPage): Promise<void> {
+async function settleAfterRestore(workbench: PwPage): Promise<void> {
   const compileStatus = (): Promise<'done' | 'building' | 'unknown'> =>
-    win.evaluate(() => {
+    workbench.evaluate(() => {
       const els = document.querySelectorAll('[class*="truncate"]')
       for (const el of els) {
         const t = el.textContent || ''
@@ -283,7 +283,7 @@ test.describe('native-host Elements panel stays pointed at the render guest afte
   })
 
   test('DOM.getDocument returns the render guest document across hot-reload respawn cycles', async () => {
-    const { app, win } = handle!
+    const { app, workbench } = handle!
 
     const wxmlPath = path.join(DEMO_APP_DIR, 'pages', 'index', 'index.wxml')
     const original = fs.readFileSync(wxmlPath, 'utf8')
@@ -326,7 +326,7 @@ test.describe('native-host Elements panel stays pointed at the render guest afte
 
       try {
         // Trigger hot reload via the same write path Monaco uses.
-        await ipcInvoke(win, ProjectFsChannel.WriteFile, wxmlPath, mutated)
+        await ipcInvoke(workbench, ProjectFsChannel.WriteFile, wxmlPath, mutated)
 
         // Wait for the render guest to respawn and show the new text — this is the
         // signal that the DeviceShell has been replaced with a new WebContents.
@@ -371,7 +371,7 @@ test.describe('native-host Elements panel stays pointed at the render guest afte
         // Restore the original source so the next cycle (or following spec) starts
         // clean. Use sync write to guarantee the file is on disk before settle.
         fs.writeFileSync(wxmlPath, original, 'utf8')
-        await settleAfterRestore(win)
+        await settleAfterRestore(workbench)
       }
     }
   })
diff --git a/packages/devtools/e2e/native-host-devtools-elements.spec.ts b/packages/devtools/e2e/native-host-devtools-elements.spec.ts
index bd7542a8..52cc4c73 100644
--- a/packages/devtools/e2e/native-host-devtools-elements.spec.ts
+++ b/packages/devtools/e2e/native-host-devtools-elements.spec.ts
@@ -46,7 +46,7 @@ import { AutomationChannel, SimulatorWxmlChannel } from '../src/shared/ipc-chann
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const FIXTURE_DIR = path.resolve(__dirname, 'fixtures', 'tabbar-app')
 
-interface AppHandle { app: ElectronApplication; win: PwPage }
+interface AppHandle { app: ElectronApplication; win: PwPage; workbench: PwPage }
 
 interface WxmlNode { tagName?: string; children?: WxmlNode[] }
 
@@ -89,7 +89,7 @@ async function bootApp(): Promise<AppHandle> {
     100,
   )
 
-  await openProjectInUI(win, FIXTURE_DIR, { waitMs: 20000 })
+  const workbench = await openProjectInUI(app, FIXTURE_DIR, { waitMs: 20000 })
   await waitForSimulatorWebview(app)
 
   // Wait for at least one render guest (__frame__.html) to exist — the
@@ -108,18 +108,18 @@ async function bootApp(): Promise<AppHandle> {
   // Wait for the WXML tree to mount — this is the readiness signal the WXML panel
   // uses and indicates the render guest is fully set up.
   await pollUntil(
-    () => ipcInvoke<WxmlNode | null>(win, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
+    () => ipcInvoke<WxmlNode | null>(workbench, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
     (t) => !!t && typeof (t as WxmlNode).tagName === 'string',
     30000,
     400,
   )
 
-  return { app, win }
+  return { app, win, workbench }
 }
 
 async function shutdownApp(handle: AppHandle | undefined): Promise<void> {
   if (!handle) return
-  await closeProject(handle.win).catch(() => {})
+  await closeProject(handle.app).catch(() => {})
   await handle.app.close().catch(() => {})
 }
 
diff --git a/packages/devtools/e2e/native-host-network-response-body.spec.ts b/packages/devtools/e2e/native-host-network-response-body.spec.ts
index 086833da..bb18e428 100644
--- a/packages/devtools/e2e/native-host-network-response-body.spec.ts
+++ b/packages/devtools/e2e/native-host-network-response-body.spec.ts
@@ -144,7 +144,7 @@ async function bootApp(): Promise<AppHandle> {
     }
   })
 
-  await openProjectInUI(win, FIXTURE_DIR, { waitMs: 20000 })
+  await openProjectInUI(app, FIXTURE_DIR, { waitMs: 20000 })
   await waitForSimulatorWebview(app)
 
   // The simulator's CDP Network tracking hangs off the DeviceShell target; gate
@@ -177,7 +177,7 @@ async function bootApp(): Promise<AppHandle> {
 
 async function shutdownApp(handle: AppHandle | undefined): Promise<void> {
   if (!handle) return
-  await closeProject(handle.win).catch(() => {})
+  await closeProject(handle.app).catch(() => {})
   await handle.app.close().catch(() => {})
 }
 
diff --git a/packages/devtools/e2e/native-host-open-in-editor.spec.ts b/packages/devtools/e2e/native-host-open-in-editor.spec.ts
index 8aa41249..1bf9eacd 100644
--- a/packages/devtools/e2e/native-host-open-in-editor.spec.ts
+++ b/packages/devtools/e2e/native-host-open-in-editor.spec.ts
@@ -80,6 +80,7 @@ const EXCLUDED_REL = 'common.js'
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 
 /**
  * The service-host spawn URL carries the authoritative routing context the main
@@ -294,7 +295,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
       100,
     )
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
 
     // DeviceShell + at least one page guest must exist so the service host is
@@ -323,11 +324,11 @@ test.describe('native-host: console source link click opens the file in Monaco',
       300,
     )
 
-    await armEditorOpenSink(mainWindow)
+    await armEditorOpenSink(workbench)
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -372,7 +373,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
     const ctx = await readServiceContext(electronApp)
     expect(ctx).not.toBeNull()
     await armSentinelSink(electronApp)
-    await armEditorOpenSink(mainWindow)
+    await armEditorOpenSink(workbench)
 
     // Project-source click WITH a navigable href: a green result proves the
     // interceptor's preventDefault actually suppressed the default navigation.
@@ -385,7 +386,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
     ).toBe(true)
 
     const payloads = await pollUntil(
-      () => readEditorOpenSink(mainWindow),
+      () => readEditorOpenSink(workbench),
       (ps) => ps.some((p) => p.path === SOURCE_REL),
       12000,
       200,
@@ -426,7 +427,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
     // NEGATIVE: now click a build-chunk (common.js) with NO href (an unclaimed
     // click must not navigate + tear down the host wc).
     await armSentinelSink(electronApp)
-    await armEditorOpenSink(mainWindow)
+    await armEditorOpenSink(workbench)
     const url = resourceUrl(ctx!, EXCLUDED_REL)
     const click = await clickDevtoolsLink(electronApp, url, 3, false)
     expect(click.dispatched, `click should dispatch: ${click.reason}`).toBe(true)
@@ -449,7 +450,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
       `common.js must not emit a sentinel (front-end excludeBuildChunk); sink=${JSON.stringify(sink)}`,
     ).toBeFalsy()
 
-    const payloads = await readEditorOpenSink(mainWindow)
+    const payloads = await readEditorOpenSink(workbench)
     const leakedOpen = payloads.find((p) => p.path === EXCLUDED_REL || p.path.endsWith('/common.js'))
     expect(
       leakedOpen,
@@ -469,7 +470,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
     //   by Layer 2 (editor:openFile payload) instead.
     const ctx = await readServiceContext(electronApp)
     expect(ctx).not.toBeNull()
-    await armEditorOpenSink(mainWindow)
+    await armEditorOpenSink(workbench)
 
     const url = resourceUrl(ctx!, SOURCE_REL)
     const click = await clickDevtoolsLink(electronApp, url, 8, true)
@@ -477,7 +478,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
 
     // (a) precondition: the open IPC reaches the renderer.
     const payloads = await pollUntil(
-      () => readEditorOpenSink(mainWindow),
+      () => readEditorOpenSink(workbench),
       (ps) => ps.some((p) => p.path === SOURCE_REL && p.line === 8),
       12000,
       200,
@@ -498,7 +499,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
     //
     // If the editor panel does not render in this headless native-host harness,
     // degrade to the IPC precondition above and record why.
-    const editorMounted = await mainWindow
+    const editorMounted = await workbench
       .waitForSelector('[data-area="editor"] .monaco-editor', { timeout: 15000 })
       .then(() => true)
       .catch(() => false)
@@ -516,7 +517,7 @@ test.describe('native-host: console source link click opens the file in Monaco',
     // few distinctive tokens so line virtualization (only viewport lines paint)
     // can't flake the assertion as long as the model is open at the top.
     const editorText = await pollUntil(
-      () => mainWindow.evaluate(() => {
+      () => workbench.evaluate(() => {
         const el = document.querySelector('[data-area="editor"] .monaco-editor .view-lines')
         return el ? (el.textContent || '') : ''
       }),
diff --git a/packages/devtools/e2e/native-host-render.spec.ts b/packages/devtools/e2e/native-host-render.spec.ts
index 1849a0aa..7f2ed74a 100644
--- a/packages/devtools/e2e/native-host-render.spec.ts
+++ b/packages/devtools/e2e/native-host-render.spec.ts
@@ -44,6 +44,7 @@ const FIXTURE_DIR = path.resolve(__dirname, 'fixtures', 'tabbar-app')
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 let autoPort = 0
 
 // One-shot JSON-RPC call to the miniprogram-automator WebSocket server. Drives
@@ -115,12 +116,12 @@ test.describe('native-host render path e2e', () => {
       100,
     ) as number
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -139,7 +140,7 @@ test.describe('native-host render path e2e', () => {
     // The WXML service pulls the tree from the active render guest via the
     // injected inspector; it's ready once the page DOM (its Vue tree) mounts.
     const tree = await pollUntil(
-      () => ipcInvoke<{ tagName?: string } | null>(mainWindow, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
+      () => ipcInvoke<{ tagName?: string } | null>(workbench, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
       (t) => !!t && typeof t.tagName === 'string',
       30000,
       400,
@@ -150,7 +151,7 @@ test.describe('native-host render path e2e', () => {
 
   test('AppData panel is populated from the service→render setData tap', async () => {
     const snap = await pollUntil(
-      () => ipcInvoke<{ bridges?: unknown[] } | null>(mainWindow, SimulatorAppDataChannel.GetSnapshot).catch(() => null),
+      () => ipcInvoke<{ bridges?: unknown[] } | null>(workbench, SimulatorAppDataChannel.GetSnapshot).catch(() => null),
       (s) => !!s && Array.isArray(s.bridges) && s.bridges.length >= 1,
       30000,
       400,
@@ -162,15 +163,15 @@ test.describe('native-host render path e2e', () => {
   })
 
   test('Storage panel reads/writes the service-host store', async () => {
-    const prefix = await ipcInvoke<string>(mainWindow, SimulatorStorageChannel.GetActivePrefix)
+    const prefix = await ipcInvoke<string>(workbench, SimulatorStorageChannel.GetActivePrefix)
     expect(prefix, 'active storage prefix should resolve under native-host').toBeTruthy()
     const key = `${prefix}__e2e_native_storage`
 
-    const set = await ipcInvoke<{ ok: boolean }>(mainWindow, SimulatorStorageChannel.Set, { key, value: 'native-1' })
+    const set = await ipcInvoke<{ ok: boolean }>(workbench, SimulatorStorageChannel.Set, { key, value: 'native-1' })
     expect(set?.ok, 'Set should succeed against the service-host store').toBe(true)
 
     const items = await pollUntil(
-      () => ipcInvoke<Array<{ key: string; value: string }>>(mainWindow, SimulatorStorageChannel.GetSnapshot).catch(() => []),
+      () => ipcInvoke<Array<{ key: string; value: string }>>(workbench, SimulatorStorageChannel.GetSnapshot).catch(() => []),
       (arr) => Array.isArray(arr) && arr.some((it) => it.key === key && it.value === 'native-1'),
       10000,
       300,
@@ -191,7 +192,7 @@ test.describe('native-host render path e2e', () => {
     // highlight until one maps to a real, laid-out element.
     const tree = await pollUntil(
       () => ipcInvoke<{ tagName?: string; sid?: string; children?: unknown[] } | null>(
-        mainWindow, SimulatorWxmlChannel.GetSnapshot,
+        workbench, SimulatorWxmlChannel.GetSnapshot,
       ).catch(() => null),
       (t) => !!t && typeof t.tagName === 'string',
       30000,
@@ -209,13 +210,13 @@ test.describe('native-host render path e2e', () => {
     let hit: { rect?: { width?: number } } | null = null
     for (const sid of sids.slice(0, 30)) {
       const r = await ipcInvoke<{ rect?: { width?: number } } | null>(
-        mainWindow, SimulatorElementChannel.Inspect, sid,
+        workbench, SimulatorElementChannel.Inspect, sid,
       ).catch(() => null)
       if (r && r.rect) { hit = r; break }
     }
     expect(hit, 'at least one sid should highlight a real element via the render inspector').toBeTruthy()
     expect(typeof hit!.rect!.width).toBe('number')
-    await ipcInvoke(mainWindow, SimulatorElementChannel.Clear).catch(() => {})
+    await ipcInvoke(workbench, SimulatorElementChannel.Clear).catch(() => {})
   })
 
   test('App.getCurrentPage + Page.getElement/Element.tap reach the render guest', async () => {
@@ -283,9 +284,9 @@ test.describe('native-host render path e2e', () => {
 
     let zoom = await pollUntil(zoomOf, settled, 8000, 300).catch(() => null)
     if (!settled(zoom)) {
-      const toggle = mainWindow.locator('[data-testid="layout-toolbar-toggle-simulator"]')
+      const toggle = workbench.locator('[data-testid="layout-toolbar-toggle-simulator"]')
       await toggle.click()
-      await mainWindow.waitForTimeout(500)
+      await workbench.waitForTimeout(500)
       await toggle.click()
       zoom = await pollUntil(zoomOf, settled, 8000, 300).catch(() => null)
     }
diff --git a/packages/devtools/e2e/native-host-thumbnail-capture.spec.ts b/packages/devtools/e2e/native-host-thumbnail-capture.spec.ts
index 122685db..96cf565a 100644
--- a/packages/devtools/e2e/native-host-thumbnail-capture.spec.ts
+++ b/packages/devtools/e2e/native-host-thumbnail-capture.spec.ts
@@ -69,6 +69,7 @@ test.describe('native-host captureThumbnail targets the render guest, not the si
 
   let electronApp: ElectronApplication
   let mainWindow: PwPage
+  let workbench: PwPage
 
   test.beforeAll(async () => {
     // Extend the hook timeout: Electron cold-boot + first fixture compile can
@@ -118,7 +119,7 @@ test.describe('native-host captureThumbnail targets the render guest, not the si
       100,
     )
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
 
     // Wait until the render guest (__frame__.html) is mounted and has a URL —
@@ -137,7 +138,7 @@ test.describe('native-host captureThumbnail targets the render guest, not the si
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -196,7 +197,7 @@ test.describe('native-host captureThumbnail targets the render guest, not the si
 
     // Call captureThumbnail via IPC (the renderer-facing entry point).
     const thumbnailDataUrl = await ipcInvoke<string | null>(
-      mainWindow,
+      workbench,
       ProjectChannel.CaptureThumbnail,
       FIXTURE_DIR,
     )
diff --git a/packages/devtools/e2e/native-host-websocket-contract.spec.ts b/packages/devtools/e2e/native-host-websocket-contract.spec.ts
index 2d1bc50f..67e5d0d8 100644
--- a/packages/devtools/e2e/native-host-websocket-contract.spec.ts
+++ b/packages/devtools/e2e/native-host-websocket-contract.spec.ts
@@ -188,7 +188,7 @@ async function bootApp(projectDir: string, userDataDir: string): Promise<AppHand
   })
   const win = await findMainWindow(app)
   await win.waitForLoadState('domcontentloaded')
-  await openProjectInUI(win, projectDir, { waitMs: 20_000 })
+  await openProjectInUI(app, projectDir, { waitMs: 20_000 })
   await waitForSimulatorWebview(app)
   await pollUntil(
     () => evalInWebContentsByUrl<boolean>(
@@ -230,7 +230,7 @@ test.describe('DevTools runs the upstream WebSocket contract page', () => {
 
   test.afterAll(async () => {
     if (handle) {
-      await closeProject(handle.win).catch(() => {})
+      await closeProject(handle.app).catch(() => {})
       await handle.app.close().catch(() => {})
     }
     if (wss) {
diff --git a/packages/devtools/e2e/native-host-websocket-panel.spec.ts b/packages/devtools/e2e/native-host-websocket-panel.spec.ts
index 47a1a1d2..d3b15a29 100644
--- a/packages/devtools/e2e/native-host-websocket-panel.spec.ts
+++ b/packages/devtools/e2e/native-host-websocket-panel.spec.ts
@@ -43,7 +43,7 @@ const FIXTURE_DIR = path.resolve(__dirname, 'fixtures', 'tabbar-app')
 
 interface AppHandle {
   app: ElectronApplication
-  win: PwPage
+  workbench: PwPage
 }
 
 /** One recorded `Network.webSocket*` CDP event from the front-end realm. */
@@ -120,8 +120,8 @@ async function bootApp(): Promise<AppHandle> {
       DIMINA_E2E_USER_DATA_DIR: userDataDir,
     },
   })
-  const win = await findMainWindow(app)
-  await win.waitForLoadState('domcontentloaded')
+  const mainWin = await findMainWindow(app)
+  await mainWin.waitForLoadState('domcontentloaded')
 
   await app.evaluate(async ({ BrowserWindow }) => {
     const window = BrowserWindow.getAllWindows()[0]
@@ -137,7 +137,7 @@ async function bootApp(): Promise<AppHandle> {
     }
   })
 
-  await openProjectInUI(win, FIXTURE_DIR, { waitMs: 20_000 })
+  const workbench = await openProjectInUI(app, FIXTURE_DIR, { waitMs: 20_000 })
   await waitForSimulatorWebview(app)
   await pollUntil(
     () => evalInWebContentsByUrl<boolean>(
@@ -149,12 +149,12 @@ async function bootApp(): Promise<AppHandle> {
     20_000,
     500,
   )
-  return { app, win }
+  return { app, workbench }
 }
 
 async function shutdownApp(handle: AppHandle | undefined): Promise<void> {
   if (!handle) return
-  await closeProject(handle.win).catch(() => {})
+  await closeProject(handle.app).catch(() => {})
   await handle.app.close().catch(() => {})
 }
 
@@ -428,7 +428,7 @@ test.describe('native-host DevTools Network panel shows real wx.connectSocket co
 
     // After the terminal closed, a settle window produces no further events
     // for this requestId (the id mapping is released at closed).
-    await handle!.win.waitForTimeout(300)
+    await handle!.workbench.waitForTimeout(300)
     const settled = await readRecorder(app)
     firstLogLength = eventsFor(settled, firstRequestId).length
     expect(firstLogLength).toBe(EXPECTED_METHOD_SEQUENCE.length)
diff --git a/packages/devtools/e2e/native-host-white-screen-reconcile.spec.ts b/packages/devtools/e2e/native-host-white-screen-reconcile.spec.ts
index 6025f8a8..5dbd61a2 100644
--- a/packages/devtools/e2e/native-host-white-screen-reconcile.spec.ts
+++ b/packages/devtools/e2e/native-host-white-screen-reconcile.spec.ts
@@ -48,6 +48,7 @@ const CYCLE = [
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 
 async function selectDevice(win: PwPage, deviceName: string): Promise<void> {
   const sel = win.locator('select', { has: win.locator(`option[value="${deviceName}"]`) }).first()
@@ -97,7 +98,7 @@ test.describe('native-host white-screen reconcile e2e', () => {
       100,
     )
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
 
     await pollUntil(
@@ -112,7 +113,7 @@ test.describe('native-host white-screen reconcile e2e', () => {
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -121,7 +122,7 @@ test.describe('native-host white-screen reconcile e2e', () => {
     // previous sentinel window may still be open — the conditions that used to
     // strand the view detached.
     for (let i = 0; i < 16; i++) {
-      await selectDevice(mainWindow, CYCLE[i % CYCLE.length]!.name)
+      await selectDevice(workbench, CYCLE[i % CYCLE.length]!.name)
       await new Promise((r) => setTimeout(r, 120))
     }
     // Let the last relayout settle.
diff --git a/packages/devtools/e2e/native-host-wx-method.spec.ts b/packages/devtools/e2e/native-host-wx-method.spec.ts
index c4f30f1c..8c2f27c6 100644
--- a/packages/devtools/e2e/native-host-wx-method.spec.ts
+++ b/packages/devtools/e2e/native-host-wx-method.spec.ts
@@ -132,12 +132,12 @@ test.describe('native-host App.callWxMethod (non-nav) e2e', () => {
       100,
     ) as number
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/native-host-wxml-highlight.spec.ts b/packages/devtools/e2e/native-host-wxml-highlight.spec.ts
index 9c24f25c..1b4f7dda 100644
--- a/packages/devtools/e2e/native-host-wxml-highlight.spec.ts
+++ b/packages/devtools/e2e/native-host-wxml-highlight.spec.ts
@@ -58,7 +58,7 @@ const FIXTURE_DIR = path.resolve(__dirname, 'fixtures', 'tabbar-app')
 
 interface WxmlNode { tagName?: string; sid?: string; children?: WxmlNode[] }
 
-interface AppHandle { app: ElectronApplication; win: PwPage }
+interface AppHandle { app: ElectronApplication; workbench: PwPage }
 
 /**
  * Launch a fresh, isolated native-host devtools instance with the fixture open,
@@ -81,8 +81,8 @@ async function bootApp(slot: string): Promise<AppHandle> {
     env: { ...process.env, NODE_ENV: 'test', DIMINA_NATIVE_HOST: '1', DIMINA_E2E_USER_DATA_DIR: userDataDir },
   })
 
-  const win = await findMainWindow(app)
-  await win.waitForLoadState('domcontentloaded')
+  const mainWin = await findMainWindow(app)
+  await mainWin.waitForLoadState('domcontentloaded')
 
   await app.evaluate(async ({ BrowserWindow }) => {
     const w = BrowserWindow.getAllWindows()[0]
@@ -99,31 +99,31 @@ async function bootApp(slot: string): Promise<AppHandle> {
   })
 
   await pollUntil(
-    () => ipcInvoke<number | null>(win, AutomationChannel.GetPort),
+    () => ipcInvoke<number | null>(mainWin, AutomationChannel.GetPort),
     (val) => typeof val === 'number' && val > 0,
     10000,
     100,
   )
 
-  await openProjectInUI(win, FIXTURE_DIR, { waitMs: 20000 })
+  const workbench = await openProjectInUI(app, FIXTURE_DIR, { waitMs: 20000 })
   await waitForSimulatorWebview(app)
 
   // The WXML snapshot is the readiness signal the panel itself uses; it injects
   // the inspector IIFE via executeJavaScript and does NOT touch CDP/Overlay, so
   // the guest's Overlay domain stays cold until the first Inspect.
   await pollUntil(
-    () => ipcInvoke<WxmlNode | null>(win, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
+    () => ipcInvoke<WxmlNode | null>(workbench, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
     (t) => !!t && typeof t.tagName === 'string',
     30000,
     400,
   )
 
-  return { app, win }
+  return { app, workbench }
 }
 
 async function shutdownApp(handle: AppHandle | undefined): Promise<void> {
   if (!handle) return
-  await closeProject(handle.win).catch(() => {})
+  await closeProject(handle.app).catch(() => {})
   await handle.app.close().catch(() => {})
 }
 
@@ -197,9 +197,9 @@ async function captureGuestStats(app: ElectronApplication, baselineB64: string |
 }
 
 /** Walk the WXML tree (once it's up) and return its sids in tree order. */
-async function getGuestSids(win: PwPage): Promise<string[]> {
+async function getGuestSids(workbench: PwPage): Promise<string[]> {
   const tree = await pollUntil(
-    () => ipcInvoke<WxmlNode | null>(win, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
+    () => ipcInvoke<WxmlNode | null>(workbench, SimulatorWxmlChannel.GetSnapshot).catch(() => null),
     (t) => !!t && typeof t.tagName === 'string',
     30000,
     400,
@@ -219,14 +219,14 @@ async function hoverUntilPainted(
   sids: string[],
   baseline: { b64: string; bluish: number },
 ): Promise<{ sid: string; changed: number; bluishDelta: number } | null> {
-  const { app, win } = handle
+  const { app, workbench } = handle
   for (const sid of sids.slice(0, 30)) {
     const r = await ipcInvoke<{ rect?: { width?: number } } | null>(
-      win, SimulatorElementChannel.Inspect, sid,
+      workbench, SimulatorElementChannel.Inspect, sid,
     ).catch(() => null)
     if (!r || !r.rect) continue
     // Let the compositor paint the overlay before capturing.
-    await win.waitForTimeout(300)
+    await workbench.waitForTimeout(300)
     const after = await captureGuestStats(app, baseline.b64)
     if (!after) continue
     const bluishDelta = after.bluish - baseline.bluish
@@ -236,8 +236,8 @@ async function hoverUntilPainted(
     if (after.changed > 4000 && bluishDelta > 1500) {
       return { sid, changed: after.changed, bluishDelta }
     }
-    await ipcInvoke(win, SimulatorElementChannel.Clear).catch(() => {})
-    await win.waitForTimeout(150)
+    await ipcInvoke(workbench, SimulatorElementChannel.Clear).catch(() => {})
+    await workbench.waitForTimeout(150)
   }
   return null
 }
@@ -262,7 +262,7 @@ test.describe('native-host WXML highlight via CDP Overlay (not a div)', () => {
     // the tag and separates the component from its internals with a synthetic
     // #shadow-root. A bare `<page>` root means the container bundle lost the
     // name=path injection (e.g. built from a stale dimina checkout).
-    const tree = await ipcInvoke<WxmlNode | null>(handle.win, SimulatorWxmlChannel.GetSnapshot)
+    const tree = await ipcInvoke<WxmlNode | null>(handle.workbench, SimulatorWxmlChannel.GetSnapshot)
     expect(tree, 'WXML snapshot should exist').toBeTruthy()
     // The snapshot root may be a synthetic #fragment (multi-root wrapper the
     // panel renders transparently); the page node is its first child then.
@@ -278,7 +278,7 @@ test.describe('native-host WXML highlight via CDP Overlay (not a div)', () => {
     // Reading the WXML tree injects the IIFE; afterwards the guest must expose
     // __diminaRenderInspect, proving highlight resolves sids against the
     // render-host registry, not the dimina-fe iframe's __simulatorData.
-    await ipcInvoke(handle.win, SimulatorWxmlChannel.GetSnapshot).catch(() => null)
+    await ipcInvoke(handle.workbench, SimulatorWxmlChannel.GetSnapshot).catch(() => null)
     const hasApi = await pollUntil(
       () => evalInGuest<boolean>(handle.app, '!!(window.__diminaRenderInspect && typeof window.__diminaRenderInspect.elementFor === "function")'),
       (ok) => ok === true,
@@ -292,7 +292,7 @@ test.describe('native-host WXML highlight via CDP Overlay (not a div)', () => {
     // Single live guest so the capture targets the SAME page the Inspect hovers.
     expect(await guestCount(handle.app), 'fixture should have exactly one live render guest').toBe(1)
 
-    const sids = await getGuestSids(handle.win)
+    const sids = await getGuestSids(handle.workbench)
     expect(sids.length, 'WXML tree should expose sids to hover').toBeGreaterThan(0)
 
     // Pre-hover baseline of the guest pixels + the div-absent invariant.
@@ -315,7 +315,7 @@ test.describe('native-host WXML highlight via CDP Overlay (not a div)', () => {
       'render guest must NOT contain #__simulator-highlight (the old injected-div overlay path)',
     ).toBe(false)
 
-    await ipcInvoke(handle.win, SimulatorElementChannel.Clear).catch(() => {})
+    await ipcInvoke(handle.workbench, SimulatorElementChannel.Clear).catch(() => {})
   })
 })
 
@@ -344,7 +344,7 @@ test.describe('native-host WXML highlight without opening the Elements panel', (
     // paint happens, not which path enabled it.
     expect(await guestCount(handle.app), 'fixture should have exactly one live render guest').toBe(1)
 
-    const sids = await getGuestSids(handle.win)
+    const sids = await getGuestSids(handle.workbench)
     expect(sids.length, 'WXML tree should expose sids').toBeGreaterThan(0)
 
     const before = await captureGuestStats(handle.app, null)
@@ -361,6 +361,6 @@ test.describe('native-host WXML highlight without opening the Elements panel', (
     )
     expect(divInGuest, 'hover must not fall back to a guest div overlay').toBe(false)
 
-    await ipcInvoke(handle.win, SimulatorElementChannel.Clear).catch(() => {})
+    await ipcInvoke(handle.workbench, SimulatorElementChannel.Clear).catch(() => {})
   })
 })
diff --git a/packages/devtools/e2e/panel-switching.spec.ts b/packages/devtools/e2e/panel-switching.spec.ts
index 73df74d1..1358d279 100644
--- a/packages/devtools/e2e/panel-switching.spec.ts
+++ b/packages/devtools/e2e/panel-switching.spec.ts
@@ -6,21 +6,21 @@ test.describe('Right panel switching', () => {
 
   useSharedProject(test, DEMO_APP_DIR)
 
-  test('selecting each panel renders the correct panel in the main window', async ({
-    mainWindow,
+  test('selecting each panel renders the correct panel in the workbench window', async ({
+    workbench,
   }) => {
     // UI-driven: click the real tab buttons (the only switching path a user
     // has). The raw PanelChannel.Select/SelectSimulator IPC channels this
     // test used to drive are being decommissioned.
     for (const name of ['WXML', 'AppData', 'Storage']) {
-      const tab = mainWindow.getByRole('tab', { name })
+      const tab = workbench.getByRole('tab', { name })
       await tab.click()
       // The dock marks the selected tab with `data-active`; that flip IS the
       // switch-complete signal, so the assertion's own wait replaces a sleep.
       await expect(tab).toHaveAttribute('data-active', 'true')
     }
     // Selecting Console should show the devtools overlay (chrome devtools)
-    const consoleTab = mainWindow.getByRole('tab', { name: 'Console' })
+    const consoleTab = workbench.getByRole('tab', { name: 'Console' })
     await consoleTab.click()
     await expect(consoleTab).toHaveAttribute('data-active', 'true')
 
@@ -32,21 +32,21 @@ test.describe('Right panel switching', () => {
     // open project" — the initial compiling/ready projectStatus emissions race
     // the renderer's subscription mount, so right after open the log may
     // legitimately be empty. The hook unit tests own the event semantics.
-    const compileTab = mainWindow.getByRole('tab', { name: '编译' })
+    const compileTab = workbench.getByRole('tab', { name: '编译' })
     await compileTab.click()
     await expect(compileTab).toHaveAttribute('data-active', 'true')
     // The dock keeps every panel body mounted; the active one's
     // `data-deck-panel-body` wrapper flips to display:flex (visible).
-    await expect(mainWindow.locator('[data-deck-panel-body="compile"]')).toBeVisible()
+    await expect(workbench.locator('[data-deck-panel-body="compile"]')).toBeVisible()
   })
 
-  test('selecting WXML tab shows WXML panel content in main window', async ({ mainWindow }) => {
-    await mainWindow.getByRole('tab', { name: 'WXML' }).click()
+  test('selecting WXML tab shows WXML panel content in the workbench window', async ({ workbench }) => {
+    await workbench.getByRole('tab', { name: 'WXML' }).click()
 
     // The WXML panel has no manual refresh button (it's live). Poll for the
     // panel container instead of a fixed sleep — it mounts once the tab is
     // selected.
-    await expect(mainWindow.getByTestId('wxml-panel')).toBeVisible({ timeout: 5000 })
+    await expect(workbench.getByTestId('wxml-panel')).toBeVisible({ timeout: 5000 })
   })
 
   test('closing project does not leave orphan right-panel views', async ({ electronApp }) => {
diff --git a/packages/devtools/e2e/qdml-filetypes.spec.ts b/packages/devtools/e2e/qdml-filetypes.spec.ts
index b13ce37d..56cd2620 100644
--- a/packages/devtools/e2e/qdml-filetypes.spec.ts
+++ b/packages/devtools/e2e/qdml-filetypes.spec.ts
@@ -109,7 +109,7 @@ async function probeEditor(app: ElectronApplication): Promise<{
 test.describe('Custom file types (.qdml/.qdss/.qds) — render + editor', () => {
   test.setTimeout(180_000)
   let app: ElectronApplication
-  let mainWindow: Page
+  let workbench: Page
 
   test.beforeAll(async () => {
     // Launch + addProject + first compile easily exceeds Playwright's default
@@ -122,13 +122,13 @@ test.describe('Custom file types (.qdml/.qdss/.qds) — render + editor', () =>
       args: [path.resolve(__dirname, 'qdml-verify-entry.js'), `--user-data-dir=${userDataDir}`],
       env: { ...process.env, NODE_ENV: 'test' },
     })
-    mainWindow = await findMainWindow(app)
+    const mainWindow = await findMainWindow(app)
     await mainWindow.waitForLoadState('domcontentloaded')
     await app.evaluate(async ({ BrowserWindow }) => {
       const w = BrowserWindow.getAllWindows()[0]
       if (w) { w.setPosition(-2000, -2000); w.blur() }
     })
-    await openProjectInUI(mainWindow, FIXTURE, { waitMs: 60_000 })
+    workbench = await openProjectInUI(app, FIXTURE, { waitMs: 60_000 })
   })
 
   test.afterAll(async () => { await app?.close() })
@@ -151,7 +151,7 @@ test.describe('Custom file types (.qdml/.qdss/.qds) — render + editor', () =>
     // Force the lazily-attached workbench WCV to load by feeding the editor dock
     // slot a non-zero rect (the renderer's ViewAnchor would do this when the
     // panel is visible; in this off-screen harness we drive the IPC directly).
-    await ipcInvoke(mainWindow, ViewChannel.WorkbenchBounds, { x: 0, y: 0, width: 900, height: 700 }).catch(() => {})
+    await ipcInvoke(workbench, ViewChannel.WorkbenchBounds, { x: 0, y: 0, width: 900, height: 700 }).catch(() => {})
 
     const probe = await pollUntil(
       () => probeEditor(app),
diff --git a/packages/devtools/e2e/recompile-button-recompiles.spec.ts b/packages/devtools/e2e/recompile-button-recompiles.spec.ts
index 9d493c8b..1c64fba4 100644
--- a/packages/devtools/e2e/recompile-button-recompiles.spec.ts
+++ b/packages/devtools/e2e/recompile-button-recompiles.spec.ts
@@ -34,6 +34,7 @@ const SENTINEL = 'RECOMPILE-BUTTON-SENTINEL'
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 let originalWxml = ''
 let autoPort = 0
 
@@ -81,7 +82,7 @@ async function readActivePageText(): Promise<string> {
  * that WebContents specifically.
  */
 async function clickRecompileInPopover(startPage?: string): Promise<void> {
-  const compileDropdown = mainWindow.getByRole('button', { name: /普通编译/ })
+  const compileDropdown = workbench.getByRole('button', { name: /普通编译/ })
   await compileDropdown.waitFor({ timeout: 10000 })
   await compileDropdown.click()
 
@@ -193,7 +194,7 @@ test.describe('popover 重新编译 rebuilds and relaunches at the selected star
       compile: { ...settings.compile, autoBuild: false },
     })
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorWebview(electronApp)
 
     await pollUntil(
@@ -209,7 +210,7 @@ test.describe('popover 重新编译 rebuilds and relaunches at the selected star
 
   test.afterAll(async () => {
     fs.writeFileSync(HOME_WXML, originalWxml)
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
diff --git a/packages/devtools/e2e/relaunch-resilience.spec.ts b/packages/devtools/e2e/relaunch-resilience.spec.ts
index 04b5a423..7bb7ff1b 100644
--- a/packages/devtools/e2e/relaunch-resilience.spec.ts
+++ b/packages/devtools/e2e/relaunch-resilience.spec.ts
@@ -34,8 +34,8 @@ import {
 
 // ── Helpers ──────────────────────────────────────────────────────────────
 
-async function getStatus(mainWindow: import('@playwright/test').Page) {
-  return mainWindow.evaluate(
+async function getStatus(workbench: import('@playwright/test').Page) {
+  return workbench.evaluate(
     () => document.querySelector('[class*="truncate"]')?.textContent || '',
   )
 }
@@ -127,28 +127,28 @@ async function getNativePageState(
 }
 
 async function waitForStatus(
-  mainWindow: import('@playwright/test').Page,
+  workbench: import('@playwright/test').Page,
   targets: string[],
   timeout = 15000,
 ) {
   return pollUntil(
-    () => getStatus(mainWindow),
+    () => getStatus(workbench),
     (s) => targets.some((t) => s.includes(t)),
     timeout,
     500,
   )
 }
 
-async function clickRelaunchButton(mainWindow: import('@playwright/test').Page) {
-  await mainWindow.getByRole('button', { name: '重新编译' }).click()
+async function clickRelaunchButton(workbench: import('@playwright/test').Page) {
+  await workbench.getByRole('button', { name: '重新编译' }).click()
 }
 
 async function relaunchViaPopover(
-  mainWindow: import('@playwright/test').Page,
+  workbench: import('@playwright/test').Page,
   electronApp: import('@playwright/test').ElectronApplication,
   targetPage: string,
 ) {
-  await mainWindow.getByRole('button', { name: /普通编译/ }).click()
+  await workbench.getByRole('button', { name: /普通编译/ }).click()
   // The popover WCV is created asynchronously after the click; poll for it
   // instead of a fixed sleep (a slow tick leaves the one-shot lookup empty).
   const popoverWcId = await pollUntil(
@@ -210,17 +210,17 @@ async function relaunchViaPopover(
 test.describe('Relaunch & compile resilience', () => {
   test.setTimeout(120_000)
 
-  test.beforeEach(async ({ mainWindow }) => {
-    await openProjectInUI(mainWindow, DEMO_APP_DIR, { waitMs: 10000 })
+  test.beforeEach(async ({ electronApp }) => {
+    await openProjectInUI(electronApp, DEMO_APP_DIR, { waitMs: 10000 })
   })
 
-  test.afterEach(async ({ mainWindow }) => {
-    await closeProject(mainWindow)
+  test.afterEach(async ({ electronApp }) => {
+    await closeProject(electronApp)
   })
 
-  test('↺ button reloads same page successfully', async ({ mainWindow, electronApp }) => {
-    await clickRelaunchButton(mainWindow)
-    const status = await waitForStatus(mainWindow, ['刷新完成', '编译完成'])
+  test('↺ button reloads same page successfully', async ({ workbench, electronApp }) => {
+    await clickRelaunchButton(workbench)
+    const status = await waitForStatus(workbench, ['刷新完成', '编译完成'])
     expect(status).toContain('完成')
 
     // After the reload the DeviceShell must remount with a live render-host page
@@ -232,9 +232,9 @@ test.describe('Relaunch & compile resilience', () => {
     ).toBeGreaterThanOrEqual(1)
   })
 
-  test('popover page switch navigates correctly', async ({ mainWindow, electronApp }) => {
-    await relaunchViaPopover(mainWindow, electronApp, 'storage-test')
-    const status = await waitForStatus(mainWindow, ['刷新完成', '编译完成'])
+  test('popover page switch navigates correctly', async ({ workbench, electronApp }) => {
+    await relaunchViaPopover(workbench, electronApp, 'storage-test')
+    const status = await waitForStatus(workbench, ['刷新完成', '编译完成'])
     expect(status).toContain('完成')
 
     // A respawn at storage-test must produce a render-host page guest whose
@@ -255,10 +255,10 @@ test.describe('Relaunch & compile resilience', () => {
     expect(await getDeviceShellWebviewCount(electronApp)).toBeGreaterThanOrEqual(1)
   })
 
-  test('multiple sequential page switches all succeed', async ({ mainWindow, electronApp }) => {
+  test('multiple sequential page switches all succeed', async ({ workbench, electronApp }) => {
     for (const page of ['console-test', 'storage-test', 'index']) {
-      await relaunchViaPopover(mainWindow, electronApp, page)
-      const status = await waitForStatus(mainWindow, ['刷新完成', '编译完成'])
+      await relaunchViaPopover(workbench, electronApp, page)
+      const status = await waitForStatus(workbench, ['刷新完成', '编译完成'])
       expect(status).toContain('完成')
 
       // Each respawn must land a render-host page guest on the chosen entry page.
@@ -278,12 +278,12 @@ test.describe('Relaunch & compile resilience', () => {
     }
   })
 
-  test('rapid double-click ↺ does not break state', async ({ mainWindow, electronApp }) => {
-    await clickRelaunchButton(mainWindow)
-    await mainWindow.waitForTimeout(50)
-    await clickRelaunchButton(mainWindow)
+  test('rapid double-click ↺ does not break state', async ({ workbench, electronApp }) => {
+    await clickRelaunchButton(workbench)
+    await workbench.waitForTimeout(50)
+    await clickRelaunchButton(workbench)
 
-    const status = await waitForStatus(mainWindow, ['完成', '失败', '超时'])
+    const status = await waitForStatus(workbench, ['完成', '失败', '超时'])
     expect(status).toContain('完成')
 
     // A double-fire must still leave the DeviceShell mounted with a live page
@@ -297,7 +297,7 @@ test.describe('Relaunch & compile resilience', () => {
     expect(state.anyCrashed, 'no guest or shell should be crashed after a double ↺').toBe(false)
   })
 
-  test('rapid file changes do not crash webview', async ({ mainWindow, electronApp }) => {
+  test('rapid file changes do not crash webview', async ({ workbench, electronApp }) => {
     const files = ['index.js', 'index.wxml', 'index.wxss'].map((f) =>
       path.join(DEMO_APP_DIR, 'pages', 'index', f),
     )
@@ -312,11 +312,11 @@ test.describe('Relaunch & compile resilience', () => {
       // Rapid-fire touch 3 files in 300ms
       for (const f of Object.keys(originals)) {
         fs.writeFileSync(f, originals[f] + `\n// e2e-${Date.now()}`)
-        await mainWindow.waitForTimeout(100)
+        await workbench.waitForTimeout(100)
       }
 
       // Wait for rebuild to settle
-      await mainWindow.waitForTimeout(15000)
+      await workbench.waitForTimeout(15000)
 
       // The render-host guests must survive the rapid-fire rebuild churn: the
       // DeviceShell still has a live page webview and nothing crashed.
@@ -334,7 +334,7 @@ test.describe('Relaunch & compile resilience', () => {
     }
   })
 
-  test('UI stays usable after build error and recovers', async ({ mainWindow, electronApp }) => {
+  test('UI stays usable after build error and recovers', async ({ workbench, electronApp }) => {
     const jsFile = path.join(DEMO_APP_DIR, 'pages', 'index', 'index.js')
     const original = fs.readFileSync(jsFile, 'utf8')
 
@@ -346,22 +346,22 @@ test.describe('Relaunch & compile resilience', () => {
     try {
       // Introduce syntax error
       fs.writeFileSync(jsFile, 'const x = {{{BROKEN')
-      await mainWindow.waitForTimeout(15000)
+      await workbench.waitForTimeout(15000)
 
       // Toolbar must remain visible (not white/black screen)
-      const hasToolbar = await mainWindow.evaluate(() =>
+      const hasToolbar = await workbench.evaluate(() =>
         document.body.innerText.includes('普通编译'),
       )
       expect(hasToolbar).toBe(true)
 
       // Restore and verify recovery
       fs.writeFileSync(jsFile, original)
-      await mainWindow.waitForTimeout(15000)
+      await workbench.waitForTimeout(15000)
 
       // Should be able to relaunch after recovery: the DeviceShell remounts with a
       // live render-host page webview once the good build compiles.
-      await clickRelaunchButton(mainWindow)
-      await waitForStatus(mainWindow, ['完成', '失败', '超时'])
+      await clickRelaunchButton(workbench)
+      await waitForStatus(workbench, ['完成', '失败', '超时'])
       const webviews = await waitForDeviceShellReady(electronApp)
       expect(
         webviews,
diff --git a/packages/devtools/e2e/settings.spec.ts b/packages/devtools/e2e/settings.spec.ts
index 8c085fc5..d0bba3ee 100644
--- a/packages/devtools/e2e/settings.spec.ts
+++ b/packages/devtools/e2e/settings.spec.ts
@@ -16,8 +16,8 @@ import { ProjectChannel, ProjectsChannel } from '../src/shared/ipc-channels'
  * raw `ipcInvoke('settings:setVisible', true)` backdoor, which kept passing
  * even while the overlay was unreachable from the actual UI.
  */
-async function openSettingsViaUI(mainWindow: Page, electronApp: ElectronApplication): Promise<void> {
-  const settingsButton = mainWindow.getByRole('button', { name: '设置' })
+async function openSettingsViaUI(workbench: Page, electronApp: ElectronApplication): Promise<void> {
+  const settingsButton = workbench.getByRole('button', { name: '设置' })
   await expect(settingsButton).toBeVisible({ timeout: 15_000 })
   await settingsButton.click()
   // The click is fire-and-forget from Playwright's perspective: it drives
@@ -32,17 +32,17 @@ async function openSettingsViaUI(mainWindow: Page, electronApp: ElectronApplicat
 }
 
 test.describe('Settings', () => {
-  test.beforeEach(async ({ mainWindow }) => {
-    await openProjectInUI(mainWindow, DEMO_APP_DIR)
+  test.beforeEach(async ({ electronApp }) => {
+    await openProjectInUI(electronApp, DEMO_APP_DIR)
   })
 
-  test.afterEach(async ({ mainWindow }) => {
-    await closeProject(mainWindow)
+  test.afterEach(async ({ mainWindow, electronApp }) => {
+    await closeProject(electronApp)
     await ipcInvoke(mainWindow, ProjectsChannel.Remove, DEMO_APP_DIR).catch(() => {})
   })
 
-  test('settings view opens from the toolbar 设置 button', async ({ mainWindow, electronApp }) => {
-    await openSettingsViaUI(mainWindow, electronApp)
+  test('settings view opens from the toolbar 设置 button', async ({ workbench, electronApp }) => {
+    await openSettingsViaUI(workbench, electronApp)
 
     const text = await pollUntil(
       () => evalInWebContentsByUrl<string>(electronApp, 'entries/settings', `document.body.innerText`),
@@ -53,8 +53,8 @@ test.describe('Settings', () => {
     expect(text).toContain('本地设置')
   })
 
-  test('settings view receives current project path', async ({ mainWindow, electronApp }) => {
-    await openSettingsViaUI(mainWindow, electronApp)
+  test('settings view receives current project path', async ({ workbench, electronApp }) => {
+    await openSettingsViaUI(workbench, electronApp)
     await evalInWebContentsByUrl(
       electronApp,
       'entries/settings',
@@ -79,7 +79,7 @@ test.describe('Settings', () => {
     expect(text).toContain(DEMO_APP_DIR)
   })
 
-  test('settings configChanged persists compile config', async ({ mainWindow, electronApp }) => {
+  test('settings configChanged persists compile config', async ({ mainWindow, workbench, electronApp }) => {
     const original = await ipcInvoke<{
       startPage: string
       scene: number
@@ -92,7 +92,7 @@ test.describe('Settings', () => {
       queryParams: [{ key: 'from', value: 'e2e' }],
     }
 
-    await openSettingsViaUI(mainWindow, electronApp)
+    await openSettingsViaUI(workbench, electronApp)
     await evalInWebContentsByUrl(
       electronApp,
       'entries/settings',
diff --git a/packages/devtools/e2e/standalone-devtools-flood-cold-start.spec.ts b/packages/devtools/e2e/standalone-devtools-flood-cold-start.spec.ts
index e1df8ac6..e86c792f 100644
--- a/packages/devtools/e2e/standalone-devtools-flood-cold-start.spec.ts
+++ b/packages/devtools/e2e/standalone-devtools-flood-cold-start.spec.ts
@@ -2,7 +2,7 @@ import { test, expect, _electron, type ElectronApplication, type Page as PwPage
 import path from 'path'
 import fs from 'fs'
 import { fileURLToPath } from 'url'
-import { addProject, waitForSimulatorWebview, closeProject, ipcInvoke, pollUntil, evalInSimulator, findMainWindow } from './helpers'
+import { addProject, waitForSimulatorWebview, closeProject, ipcInvoke, pollUntil, evalInSimulator, findMainWindow, findWorkbenchWindow } from './helpers'
 import { AutomationChannel } from '../src/shared/ipc-channels'
 import { INTERNAL_LOG_WRAPPER_MARK } from '../src/main/services/views/console-filter'
 import { FRONTEND_BOOTSTRAP_PROBE_SCRIPT } from '../src/main/services/views/frontend-bootstrap-gate'
@@ -168,7 +168,7 @@ test.describe('Floating internal DevTools window — cold start + log flood', ()
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -189,7 +189,10 @@ test.describe('Floating internal DevTools window — cold start + log flood', ()
     await projectPathLabel.waitFor()
     await projectPathLabel.locator('..').click()
 
-    const debugButton = mainWindow.getByTestId('sim-open-internal-devtools')
+    // The click above opens the project in its OWN workbench window (list
+    // window stays put) — the debug button lives in that new window, not here.
+    const workbench = await findWorkbenchWindow(electronApp, { projectDir: FIXTURE_DIR, timeoutMs: 15000 })
+    const debugButton = workbench.getByTestId('sim-open-internal-devtools')
     await debugButton.waitFor({ timeout: 15000 })
     // Fire immediately — the right panel's own service-host attach (which
     // depends on compile finishing) has certainly not happened yet.
diff --git a/packages/devtools/e2e/standalone-devtools-window-churn.spec.ts b/packages/devtools/e2e/standalone-devtools-window-churn.spec.ts
index 9cca13df..2aee50c1 100644
--- a/packages/devtools/e2e/standalone-devtools-window-churn.spec.ts
+++ b/packages/devtools/e2e/standalone-devtools-window-churn.spec.ts
@@ -8,33 +8,38 @@ import { FRONTEND_BOOTSTRAP_PROBE_SCRIPT } from '../src/main/services/views/fron
 
 /**
  * Real-Electron extreme-journey coverage for the independent floating
- * internal (app-wide) DevTools window (`internal-devtools-window/index.ts`)
- * and its unfiltered console mirror (`global-console-mirror.ts`) — the
- * standalone-app-cdp split. `internal-devtools-window.spec.ts` already covers
- * the single-click open/reuse/hide contract in isolation; this spec drives
- * the SAME window through button-mashing, open/close churn, and project /
- * main-window lifecycle transitions happening WHILE it stays open, to falsify
+ * internal DevTools window (`internal-devtools-window/index.ts`), owned by the
+ * project window it debugs, and its unfiltered console mirror
+ * (`global-console-mirror.ts`) — the standalone-app-cdp split.
+ * `internal-devtools-window.spec.ts` already covers the single-click
+ * open/reuse/hide contract in isolation; this spec drives the SAME window
+ * through button-mashing, open/close churn, and project /
+ * window lifecycle transitions happening WHILE it stays open, to falsify
  * the class of bug this design is most exposed to: a duplicate BrowserWindow,
  * a lost or duplicated mirrored console entry, or a mirror left wired to a
  * torn-down service host after the project underneath it churns.
  *
- * All tests in this file share ONE opened project and (from the first test
- * onward) one floating window instance — later tests build on the window
- * state the earlier ones left behind, matching this suite's existing
- * `test.describe.configure({ mode: 'serial' })` convention.
+ * Tests build on the window state the earlier ones left behind, matching this
+ * suite's existing `test.describe.configure({ mode: 'serial' })` convention:
+ * one floating instance runs from the first test through the click storm and
+ * the open/close churn, and the project close/reopen test then proves the
+ * instance is owned by its project window — destroyed with it, rebuilt on the
+ * next one, never duplicated.
  */
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const FIXTURE_DIR = path.resolve(__dirname, 'fixtures', 'tabbar-app')
 
 let electronApp: ElectronApplication
 let mainWindow: PwPage
+let workbench: PwPage
 
 type FrontendKind = 'floating' | 'right'
 
 /** Resolve a `devtools://` front-end wc by which BrowserWindow owns it — the
  * floating window's title contains '调试' (see internal-devtools-window/index.ts's
- * `'全局调试'` title); the right-panel front-end is hosted inside the main
- * window (title 'Dimina DevTools', never '调试'). Never via
+ * `'全局调试'` title); the right-panel front-end is hosted inside the project
+ * window itself, whose title is the project's name and never contains '调试'.
+ * Never via
  * `devToolsWebContents`/`isDevToolsOpened()` — both read `null` for a
  * `setDevToolsWebContents`-based external front-end regardless of whether it
  * is genuinely attached (see console-filter-live.spec.ts's header comment for
@@ -133,6 +138,14 @@ async function windowCount(): Promise<number> {
   return electronApp.evaluate(({ BrowserWindow }) => BrowserWindow.getAllWindows().length)
 }
 
+/** How many floating debug windows exist right now — the orphan check: a
+ * project window that goes away must take its floating window with it, and a
+ * reopened project must not stack a second one next to a survivor. */
+async function floatingWindowCount(): Promise<number> {
+  return electronApp.evaluate(({ BrowserWindow }) =>
+    BrowserWindow.getAllWindows().filter((x) => x.getTitle().includes('调试')).length)
+}
+
 async function floatingVisible(): Promise<boolean | null> {
   return electronApp.evaluate(({ BrowserWindow }) => {
     const w = BrowserWindow.getAllWindows().find((x) => x.getTitle().includes('调试'))
@@ -152,7 +165,7 @@ async function closeFloatingNatively(): Promise<void> {
 }
 
 async function openFloatingViaButton(): Promise<void> {
-  await mainWindow.getByTestId('sim-open-internal-devtools').click()
+  await workbench.getByTestId('sim-open-internal-devtools').click()
 }
 
 async function waitForSimulatorSettled(timeoutMs = 45000): Promise<void> {
@@ -194,12 +207,12 @@ test.describe('Floating internal DevTools window — extreme journeys', () => {
       10000, 100,
     )
 
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorSettled()
   })
 
   test.afterAll(async () => {
-    await closeProject(mainWindow).catch(() => {})
+    await closeProject(electronApp).catch(() => {})
     await electronApp?.close().catch(() => {})
   })
 
@@ -210,7 +223,7 @@ test.describe('Floating internal DevTools window — extreme journeys', () => {
     // whole loop runs in well under 200ms, tighter than an actual human could
     // click, and stronger stress than 10 sequential Playwright `.click()`
     // calls (each of which pays its own actionability wait).
-    await mainWindow.evaluate(() => {
+    await workbench.evaluate(() => {
       const btn = document.querySelector('[data-testid="sim-open-internal-devtools"]') as HTMLElement | null
       if (!btn) throw new Error('debug button not found in the simulator toolbar')
       for (let i = 0; i < 10; i++) btn.click()
@@ -264,15 +277,24 @@ test.describe('Floating internal DevTools window — extreme journeys', () => {
     }
   })
 
-  test('closing and reopening the project keeps the floating mirror wired to the NEW service host', async () => {
+  test('the floating window reopened after a project close/reopen mirrors the NEW service host', async () => {
     test.setTimeout(180_000)
     expect(await floatingVisible(), 'precondition: floating window is open from the previous test').toBe(true)
 
-    await closeProject(mainWindow)
-    await openProjectInUI(mainWindow, FIXTURE_DIR, { waitMs: 20000 })
+    await closeProject(electronApp)
+    // The floating window debugs one project window's renderer and is owned by
+    // that window's context, so closing the project destroys it. What must not
+    // survive is an orphan still mirroring a service host that is gone.
+    await pollUntil(() => floatingWindowCount(), (n) => n === 0, 30000, 300)
+    expect(await floatingWindowCount(), 'closing the project must leave no floating window behind').toBe(0)
+
+    workbench = await openProjectInUI(electronApp, FIXTURE_DIR, { waitMs: 20000 })
     await waitForSimulatorSettled()
 
-    expect(await floatingVisible(), 'the floating window must survive project close/reopen (never destroyed)').toBe(true)
+    await openFloatingViaButton()
+    await pollUntil(() => floatingVisible(), (v) => v === true, 15000, 200)
+    expect(await floatingWindowCount(), 'the reopened project must own exactly one floating window').toBe(1)
+    await pollUntil(() => isFrontendBootstrapped('floating'), (ok) => ok === true, 30000, 300)
 
     const rand = `${process.pid}_${Date.now()}`
     const token = `REOPEN_${rand}`
@@ -291,19 +313,19 @@ test.describe('Floating internal DevTools window — extreme journeys', () => {
     expect(floatingCount, 'the new session token must reach the floating window Console').toBeGreaterThanOrEqual(1)
   })
 
-  test('hiding the main window during a log does not drop the entry from the floating console', async () => {
+  test('hiding the workbench window during a log does not drop the entry from the floating console', async () => {
     test.setTimeout(90_000)
     expect(await floatingVisible(), 'precondition: floating window is open from the previous test').toBe(true)
 
-    const mainWindowHandle = await electronApp.browserWindow(mainWindow)
-    await mainWindowHandle.evaluate((win) => win.hide())
+    const workbenchHandle = await electronApp.browserWindow(workbench)
+    await workbenchHandle.evaluate((win) => win.hide())
 
     const rand = `${process.pid}_${Date.now()}`
     const token = `HIDDEN_MAIN_${rand}`
     try {
       await logInServiceHost(token)
     } finally {
-      await mainWindowHandle.evaluate((win) => win.show())
+      await workbenchHandle.evaluate((win) => win.show())
     }
 
     const count = await pollUntil(() => countVisibleToken('floating', token).catch(() => -1), (n) => n >= 1, 20000, 300)
diff --git a/packages/devtools/e2e/toolbar-visual.spec.ts b/packages/devtools/e2e/toolbar-visual.spec.ts
index b5d9784d..ffe02142 100644
--- a/packages/devtools/e2e/toolbar-visual.spec.ts
+++ b/packages/devtools/e2e/toolbar-visual.spec.ts
@@ -25,15 +25,19 @@ import {
  * file location is stable regardless of which cwd Playwright is launched
  * from.
  */
-test('toolbar: refactored visual layout (no right-pane tabs, compile-mode dropdown, pane toggle)', async ({ mainWindow }) => {
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await waitForEditorReady(mainWindow)
+test('toolbar: refactored visual layout (no right-pane tabs, compile-mode dropdown, pane toggle)', async ({ electronApp }) => {
+  // The workbench window only exists once the project is open, so it is taken
+  // from `openProjectInUI`'s return value rather than the `workbench` fixture
+  // (which resolves before the test body runs and would time out waiting for a
+  // window nothing has asked for yet).
+  const workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await waitForEditorReady(workbench)
 
   // 1. The toolbar header band must not host any tab switcher: the old
   //    right-pane DevTools/WXML/AppData/Storage tabs are gone. Every remaining
   //    `[role="tab"]` is a DOCK tab and therefore lives inside a
   //    `[data-deck-group]`; none stray into the toolbar/header.
-  const stragglingTabs = await mainWindow.$$eval(
+  const stragglingTabs = await workbench.$$eval(
     '[role="tab"]',
     (els) =>
       els
@@ -45,7 +49,7 @@ test('toolbar: refactored visual layout (no right-pane tabs, compile-mode dropdo
   // The dock tablist is EXACTLY the five debug panels (simulator + editor are
   // tabless structural panels) — assert the precise set so a stray tab can't slip
   // back in unnoticed.
-  const dockTabIds = await mainWindow.$$eval('[data-deck-tab]', (els) =>
+  const dockTabIds = await workbench.$$eval('[data-deck-tab]', (els) =>
     els.map((el) => el.getAttribute('data-deck-tab')),
   )
   expect([...dockTabIds].sort(), 'the dock tablist must be exactly the five debug tabs').toEqual(
@@ -53,11 +57,11 @@ test('toolbar: refactored visual layout (no right-pane tabs, compile-mode dropdo
   )
 
   // 2. Compile-mode dropdown trigger exists in the toolbar.
-  const compileBtn = mainWindow.getByRole('button', { name: /普通编译/ })
+  const compileBtn = workbench.getByRole('button', { name: /普通编译/ })
   await expect(compileBtn).toBeVisible()
 
   // 3. Section visibility toggles live in a labelled toolbar group.
-  const visibilityGroup = mainWindow.getByRole('group', { name: '面板可见性' })
+  const visibilityGroup = workbench.getByRole('group', { name: '面板可见性' })
   await expect(visibilityGroup).toBeVisible()
   await expect(visibilityGroup.getByRole('button', { name: /^(隐藏|显示)模拟器$/ })).toBeVisible()
   await expect(visibilityGroup.getByRole('button', { name: /^(隐藏|显示)编辑器$/ })).toBeVisible()
@@ -72,7 +76,7 @@ test('toolbar: refactored visual layout (no right-pane tabs, compile-mode dropdo
   // Toolbar controls need their own interaction surfaces: --qd-muted is the
   // same color as the light toolbar chrome, so the generic ghost hover is
   // invisible here. Verify the settled hover paint differs from the row.
-  const alignmentToggle = mainWindow.getByTestId('layout-toolbar-alignment-toggle')
+  const alignmentToggle = workbench.getByTestId('layout-toolbar-alignment-toggle')
   const toolbarColor = await alignmentToggle.evaluate((node) =>
     getComputedStyle(node.closest('.bg-surface-2')!).backgroundColor,
   )
@@ -80,23 +84,27 @@ test('toolbar: refactored visual layout (no right-pane tabs, compile-mode dropdo
   await expect.poll(() => alignmentToggle.evaluate((node) =>
     getComputedStyle(node).backgroundColor,
   )).not.toBe(toolbarColor)
-  await mainWindow.mouse.move(1, 1)
+  await workbench.mouse.move(1, 1)
 
   // Screenshot — resolve test-results relative to THIS spec file so the
   // output lands inside packages/devtools/test-results regardless of cwd.
   const here = path.dirname(fileURLToPath(import.meta.url))
   const outDir = path.resolve(here, '..', 'test-results')
   if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true })
-  await mainWindow.screenshot({ path: path.join(outDir, 'toolbar-final.png') })
+  await workbench.screenshot({ path: path.join(outDir, 'toolbar-final.png') })
 })
 
-test('toolbar: native tooltip measures content and survives a second hover', async ({ mainWindow, electronApp }) => {
-  await openProjectInUI(mainWindow, DEMO_APP_DIR)
-  await waitForEditorReady(mainWindow)
+test('toolbar: native tooltip measures content and survives a second hover', async ({ electronApp }) => {
+  const workbench = await openProjectInUI(electronApp, DEMO_APP_DIR)
+  await waitForEditorReady(workbench)
 
+  // The toolbar buttons under test ('重新编译'/'设置') live in the workbench
+  // window's own renderer — the tooltip WCV attaches there too, so the
+  // measured surface must be found on `entries/workbench`, not the project
+  // list's `entries/main`.
   const surfaceState = () => electronApp.evaluate(({ BrowserWindow }) => {
     const win = BrowserWindow.getAllWindows().find((candidate) =>
-      candidate.webContents.getURL().includes('entries/main'),
+      candidate.webContents.getURL().includes('entries/workbench'),
     )
     if (!win) return null
     for (const child of win.contentView.children) {
@@ -109,19 +117,19 @@ test('toolbar: native tooltip measures content and survives a second hover', asy
     return null
   })
 
-  await mainWindow.getByRole('button', { name: '重新编译' }).hover()
+  await workbench.getByRole('button', { name: '重新编译' }).hover()
   const firstText = await pollUntil(
     () => evalInWebContentsByUrl<string>(electronApp, 'entries/tooltip', 'document.body.innerText'),
     (text) => text.trim() === '重新编译',
     10_000,
   )
   const firstBounds = await pollUntil(surfaceState, (bounds) => bounds !== null, 10_000)
-  expect(firstBounds, 'the measured tooltip must attach to the main window').not.toBeNull()
+  expect(firstBounds, 'the measured tooltip must attach to the workbench window').not.toBeNull()
   expect(firstText.trim()).toBe('重新编译')
   expect(firstBounds!.width).toBeGreaterThan(20)
   expect(firstBounds!.width).toBeLessThan(160)
 
-  await mainWindow.getByRole('button', { name: '设置' }).hover()
+  await workbench.getByRole('button', { name: '设置' }).hover()
   const secondText = await pollUntil(
     () => evalInWebContentsByUrl<string>(electronApp, 'entries/tooltip', 'document.body.innerText'),
     (text) => text.trim() === '设置',
@@ -131,10 +139,10 @@ test('toolbar: native tooltip measures content and survives a second hover', asy
   expect(secondText.trim()).toBe('设置')
   expect(secondBounds!.width).toBeLessThan(firstBounds!.width)
 
-  await mainWindow.mouse.move(1, 1)
+  await workbench.mouse.move(1, 1)
   await pollUntil(surfaceState, (bounds) => bounds === null, 10_000)
 })
 
-test.afterEach(async ({ mainWindow }) => {
-  await closeProject(mainWindow)
+test.afterEach(async ({ electronApp }) => {
+  await closeProject(electronApp)
 })
diff --git a/packages/devtools/e2e/wal-audit.spec.ts b/packages/devtools/e2e/wal-audit.spec.ts
index 836f6ad2..0ced1059 100644
--- a/packages/devtools/e2e/wal-audit.spec.ts
+++ b/packages/devtools/e2e/wal-audit.spec.ts
@@ -23,9 +23,9 @@ test.describe('fs-core WAL audit ledger (embedded workbench)', () => {
   // the first test pays the attach+ready wait.
   useSharedProject(test, DEMO_APP_DIR, { openOptions: { waitMs: 60_000 }, openTimeoutMs: 120_000 })
   let workbenchReady = false
-  test.beforeEach(async ({ mainWindow, electronApp }) => {
+  test.beforeEach(async ({ workbench, electronApp }) => {
     if (workbenchReady) return
-    const status = await attachWorkbenchAndWaitReady(mainWindow, electronApp)
+    const status = await attachWorkbenchAndWaitReady(workbench, electronApp)
     expect(status, 'workbench must reach a ready status before driving __WB_AUDIT').toMatch(
       /workbench-ready|exthost-alive/,
     )
diff --git a/packages/devtools/e2e/workbench-probe.ts b/packages/devtools/e2e/workbench-probe.ts
index 296f4121..693bbace 100644
--- a/packages/devtools/e2e/workbench-probe.ts
+++ b/packages/devtools/e2e/workbench-probe.ts
@@ -50,11 +50,16 @@ export async function workbenchStatus(app: ElectronApplication): Promise<string
  * status. Returns the status so a spec can assert on it.
  */
 export async function attachWorkbenchAndWaitReady(
-  mainWindow: Page,
+  // Named `projectWindow`, not `workbench`, to avoid colliding with this
+  // file's own vocabulary — here "workbench" always means the embedded VS
+  // Code WebContentsView, a different thing from a project's workbench
+  // BrowserWindow. `ViewChannel.WorkbenchBounds` is a project-scoped dock
+  // channel, so this must be the real project workbench window.
+  projectWindow: Page,
   electronApp: ElectronApplication,
   timeoutMs = 90_000,
 ): Promise<string | null> {
-  await ipcInvoke(mainWindow, ViewChannel.WorkbenchBounds, { x: 0, y: 0, width: 900, height: 700 }).catch(() => {})
+  await ipcInvoke(projectWindow, ViewChannel.WorkbenchBounds, { x: 0, y: 0, width: 900, height: 700 }).catch(() => {})
   return pollUntil(
     () => workbenchStatus(electronApp),
     (s) => s === 'workbench-ready' || s === 'exthost-alive',
diff --git a/packages/devtools/src/main/app/app.ts b/packages/devtools/src/main/app/app.ts
index 04ee992a..268b1dec 100644
--- a/packages/devtools/src/main/app/app.ts
+++ b/packages/devtools/src/main/app/app.ts
@@ -1,85 +1,143 @@
 import { setupCdpPort, registerDifileScheme, suppressInsecureCspWarnings } from './bootstrap.js'
 import { installMaxListenersWarningDiagnostic } from './max-listeners-diagnostic.js'
-import { registerProjectFsIpc } from '../ipc/project-fs.js'
 
-import { app, BrowserWindow, nativeImage, session } from 'electron'
-import fs from 'fs'
-import path from 'path'
-import type { BuiltinModuleId, MenuContext, WorkbenchAppConfig } from '../../shared/types.js'
-import { HOST_SIDEBAR_DEFAULT_WIDTH } from '../../shared/constants.js'
+import { app, BrowserWindow, session } from 'electron'
+import type { WorkbenchAppConfig } from '../../shared/types.js'
 import type {
   SimulatorUiExtensionHandle,
   SimulatorUiExtensionRegistration,
 } from '../../shared/simulator-ui.js'
 import type { SimulatorApiHandler } from '../services/simulator/custom-apis.js'
-import { rendererDir as defaultRendererDir, defaultPreloadPath, devtoolsPackageRoot } from '../utils/paths.js'
-import { installThemeBackgroundSync } from '../utils/theme.js'
-import { createMainWindow, wireMainWindowEvents } from '../windows/main-window/index.js'
-import { createInternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js'
-import { createGlobalConsoleMirror } from '../services/console-forward/global-console-mirror.js'
-import { createGlobalDiagnosticsMirror } from '../services/console-forward/global-diagnostics-mirror.js'
-import { isAppQuitting } from './lifecycle.js'
-import { resolveNativeAppDataKeys, resolveNativeStorageOverview } from './native-overview.js'
+import { rendererDir as defaultRendererDir } from '../utils/paths.js'
 // eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
-import { createWorkbenchContext, type WorkbenchContext } from '../services/workbench-context.js'
-import { setupCompileWorkerStandby } from '../services/compile-standby.js'
-import { loadWorkbenchSettings, applyTheme } from '../services/settings/index.js'
-import { installAppMenu } from '../menu/index.js'
+import type { WorkbenchContext } from '../services/workbench-context.js'
+import { createAppServices, registerTrustedWindow } from '../services/app-services.js'
+import { createWindowContextRouter, type WindowContextRouter } from '../services/window-contexts/context-router.js'
+import { createInternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js'
 import {
   registerAppIpc,
   registerInternalDevtoolsIpc,
   registerTooltipIpc,
   registerProjectCreateIpc,
   registerViewsIpc,
-  popoverModule,
-  projectsModule,
-  sessionModule,
-  settingsModule,
-  simulatorModule,
 } from '../ipc/index.js'
-import type { WorkbenchModule } from '../services/module.js'
-import { startAutomationServer, type AutomationServer } from '../services/automation/index.js'
-import {
-  startMcpServer,
-  setNativeHost,
-  setActiveBridgeId,
-  setNativeOverviewProvider,
-} from '../services/mcp/index.js'
-import { setupSimulatorStorage } from '../services/simulator-storage/index.js'
-import { createNetworkForwarder } from '../services/network-forward/index.js'
-import { setupSimulatorWxml } from '../services/simulator-wxml/index.js'
-import { setupSimulatorAppData } from '../services/simulator-appdata/index.js'
-import { setupSimulatorCurrentPage } from '../services/simulator-current-page/index.js'
-import { createRenderInspector } from '../services/render-inspect/index.js'
-import { setupSimulatorTempFiles } from '../services/simulator-temp-files/index.js'
-import { SHARED_MINIAPP_PARTITION } from '../services/views/miniapp-partition.js'
+import { registerProjectFsIpc } from '../ipc/project-fs.js'
 import { setupSimulatorSessionPolicy } from '../services/views/simulator-session-policy.js'
-import { startWorkbenchCoiServer } from '../services/workbench-coi-server.js'
+import { setupCompileWorkerStandby } from '../services/compile-standby.js'
+import { installThemeBackgroundSync } from '../utils/theme.js'
+import { isAppQuitting } from './lifecycle.js'
+import { loadWorkbenchSettings, applyTheme } from '../services/settings/index.js'
+import type { AutomationServer } from '../services/automation/index.js'
+import { SHARED_MINIAPP_PARTITION } from '../services/views/miniapp-partition.js'
+import { setupSimulatorTempFiles } from '../services/simulator-temp-files/index.js'
 import { UpdateManager } from '../services/update/index.js'
-import { toDisposable, type Disposable } from '@dimina-kit/electron-deck/main'
+import { toDisposable, DisposableRegistry, type Disposable } from '@dimina-kit/electron-deck/main'
 import { IpcRegistry } from '../utils/ipc-registry.js'
-import { WindowChannel } from '../../shared/ipc-channels.js'
+import { createLauncherWindow, type ProjectRef, type ProjectWindow } from './project-window.js'
+import { createProjectListSurface } from './project-list-surface.js'
+import { createWorkbenchWindowManager } from './workbench-window.js'
+import { registerModuleIpc, setupWindowModules } from './workbench-modules.js'
+import { registerOpenProjectWindowIpc } from './open-project-ipc.js'
+import { createUiExtensionTargets } from './ui-extension-targets.js'
+import { installGlobalMirrors } from './global-mirrors.js'
+import { installHostSidebarDefault } from './host-sidebar-default.js'
+import { installMenu } from './menu-setup.js'
+import {
+  createOpenForMcp,
+  createTargetForMcp,
+  noteActiveMcpWindowChanged,
+  setActiveMcpWindowResolver,
+} from '../services/mcp/index.js'
+import { setupAutomation, setupMcp } from './servers.js'
+import { enableDevRendererAutoReload } from './window-events.js'
+import { wireMainWindowEvents } from '../windows/main-window/index.js'
 
-const DEFAULT_MODULES: Record<BuiltinModuleId, boolean> = {
-  projects: true,
-  session: true,
-  simulator: true,
-  popover: true,
-  settings: true,
-}
+export { setupWindowModules } from './workbench-modules.js'
 
-const BUILTIN_MODULES: Record<BuiltinModuleId, WorkbenchModule> = {
-  projects: projectsModule,
-  session: sessionModule,
-  simulator: simulatorModule,
-  popover: popoverModule,
-  settings: settingsModule,
+/**
+ * Registers the workbench's IPC surface against the router, so each message is
+ * answered with the context of the window it came from.
+ */
+function registerWorkbenchIpc(
+  config: WorkbenchAppConfig,
+  router: WindowContextRouter<WorkbenchContext>,
+  context: WorkbenchContext,
+  mainWindow: BrowserWindow,
+  appRegistry: DisposableRegistry,
+): void {
+  appRegistry.add(registerAppIpc(router))
+  // Sandboxed project file-system IPC (the renderer-side project:fs:* surface).
+  appRegistry.add(registerProjectFsIpc(router))
+  // Standalone internal (app-wide) DevTools debug window controller — the
+  // independent floating CDP panel that debugs the whole Electron app (as
+  // opposed to the right-panel CDP, which inspects only the user's
+  // mini-program). Assembled before the IPC handler below so a request
+  // arriving right after boot always finds it.
+  // `isAppQuitting` lets the controller stop intercepting 'close' during a
+  // real quit — its habitual preventDefault()+hide() would otherwise cancel
+  // the quit itself and strand the process with a hidden window.
+  // One per window (each debugs its own renderer), so it is parked on the
+  // window's context registry, not the app's.
+  context.internalDevtoolsWindow = createInternalDevtoolsWindow(mainWindow, { isAppQuitting })
+  context.registry.add(toDisposable(() => context.internalDevtoolsWindow?.dispose()))
+  // Unconditional (not a toggleable BUILTIN_MODULES entry): it's core dev
+  // tooling, not a host-configurable feature.
+  appRegistry.add(registerInternalDevtoolsIpc(router))
+  // Unconditional (not a toggleable BUILTIN_MODULES entry): the tooltip
+  // overlay is core UI chrome (every toolbar in this app relies on it), not a
+  // host-configurable feature.
+  appRegistry.add(registerTooltipIpc(router))
+  // Unconditional: the project-create dialog is core UI chrome (the built-in
+  // "新建项目" flow every host falls back to), not a host-configurable feature.
+  appRegistry.add(registerProjectCreateIpc(router))
+  // Unconditional (not a toggleable BUILTIN_MODULES entry): placement/host-
+  // slot IPC has no real dependency on the simulator module — `ctx.views`
+  // (ViewManager) is constructed unconditionally regardless of
+  // `modules.simulator`, and host-sidebar in particular lives on the
+  // project-list page, unrelated to the simulator webview. Every renderer
+  // entry point also blocks its first render on `AllocatePlacementGeneration`
+  // (see renderer-placement-generation.ts) — gating any of this behind the
+  // simulator toggle would strand a host that disables it on the fatal
+  // boot-failure page, or leave placement silently non-functional.
+  appRegistry.add(registerViewsIpc(router))
+  // Referer/CORS webRequest policy for the simulator runtime's sessions (shared
+  // fallback + every per-project partition). Registered into the app registry so
+  // its configurator + per-session listeners are torn down with the app —
+  // re-creating the app never leaks a duplicate configurator, and a window
+  // closing must not strip the policy off the sessions other windows still use.
+  appRegistry.add(setupSimulatorSessionPolicy())
+  // One process-wide listener that re-syncs every window's native
+  // backgroundColor on theme change — windows otherwise keep the stale
+  // creation-time color (see installThemeBackgroundSync).
+  appRegistry.add(installThemeBackgroundSync())
+  // Warm-standby compile worker: only meaningful for the devkit-backed
+  // default adapter (a host-injected adapter has no devkit fork to adopt the
+  // spare). Registered into the registry so the spare dies with the app.
+  if (!config.adapter) appRegistry.add(setupCompileWorkerStandby(context))
+  registerModuleIpc(config, router, appRegistry)
 }
 
 export interface WorkbenchAppInstance {
+  /** The project-list window. It stays open for the whole session. */
   mainWindow: BrowserWindow
+  /** The project-list window's context. Workbench windows have their own. */
   context: WorkbenchContext
-  /** Gated custom-IPC registration surface bound to `context.senderPolicy`. */
+  /**
+   * Open `project` in its own workbench window, or focus the window already
+   * showing it. This is the only way a project is opened: the list window never
+   * turns into a workbench.
+   */
+  openProjectWindow: (project: ProjectRef) => Promise<BrowserWindow>
+  /** Every open workbench window, in the order they were opened. */
+  projectWindows: () => ProjectWindow[]
+  /**
+   * Dispose every live window's WebContentsViews. Called at `before-quit`,
+   * while the main loop is still healthy, so no view survives into Chromium's
+   * native shutdown. Idempotent, and covers every window — a workbench window's
+   * views hold the MessagePorts that segfault if torn down natively.
+   */
+  disposeViews: () => void
+  /** Gated custom-IPC registration surface; admits every workbench window. */
   readonly ipc: IpcRegistry
   /** Adds a host-owned BrowserWindow to the trusted-sender set. */
   registerTrustedWindow: (win: BrowserWindow) => Disposable
@@ -94,315 +152,6 @@ export interface WorkbenchAppInstance {
   dispose: () => Promise<void>
 }
 
-/**
- * Adds `win.webContents` to the context's trusted-sender set and returns a
- * Disposable that removes it again.
- *
- * Trust is reference-counted: registering the SAME window N times keeps it
- * trusted until every one of the N returned Disposables has been disposed.
- * `trustedWindowSenderIds` is a `Map<webContents.id, refCount>`; each register
- * bumps the count, each dispose decrements it, and the window is un-trusted
- * only when the count reaches zero.
- *
- * The window's `closed` event short-circuits the ref-count: it deletes the
- * map entry outright (the window is dead, so it must be un-trusted
- * immediately regardless of how many Disposables are still outstanding).
- * After `closed`, disposing any leftover Disposable is a safe no-op — the
- * map entry is already gone, so the decrement finds `undefined` and bails
- * without driving the count negative or resurrecting trust.
- *
- * Each returned Disposable is itself idempotent (`removed` flag), and its
- * `closed` listener removes itself once fired so a long-lived context
- * doesn't accumulate dead listeners on closed windows.
- */
-function registerTrustedWindow(context: WorkbenchContext, win: BrowserWindow): Disposable {
-  const senderId = win.webContents.id
-  const counts = context.trustedWindowSenderIds
-  counts.set(senderId, (counts.get(senderId) ?? 0) + 1)
-
-  let removed = false
-  const onClosed = () => {
-    // The window is gone: zero the ref-count for this sender id outright,
-    // regardless of any other outstanding registrations for the same window.
-    counts.delete(senderId)
-    win.removeListener('closed', onClosed)
-  }
-
-  function remove() {
-    if (removed) return
-    removed = true
-    win.removeListener('closed', onClosed)
-    const count = counts.get(senderId)
-    // `undefined` → the entry was already cleared (e.g. by `closed` or by a
-    // prior sibling's decrement that hit zero). Nothing to do — never go
-    // negative, never resurrect trust.
-    if (count === undefined) return
-    if (count <= 1) counts.delete(senderId)
-    else counts.set(senderId, count - 1)
-  }
-
-  win.once('closed', onClosed)
-  return toDisposable(remove)
-}
-
-/** Parse --auto, --auto-port, --project from process.argv. */
-function parseAutoArgs(): { auto: boolean; autoPort: number; projectPath: string } {
-  const argv = process.argv
-  let auto = false
-  let autoPort = 9420
-  let projectPath = ''
-
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === 'auto' || argv[i] === '--auto') auto = true
-    if ((argv[i] === '--auto-port' || argv[i] === '--auto_port') && argv[i + 1]) {
-      const parsed = parseInt(argv[i + 1]!, 10)
-      // 0 → OS-assigned free port (used by parallel e2e workers)
-      if (Number.isFinite(parsed) && parsed >= 0) autoPort = parsed
-    }
-    if (argv[i] === '--project' && argv[i + 1]) {
-      projectPath = argv[i + 1]!
-    }
-  }
-
-  return { auto, autoPort, projectPath }
-}
-
-function resolveModules(config: WorkbenchAppConfig): Record<BuiltinModuleId, boolean> {
-  return {
-    ...DEFAULT_MODULES,
-    ...config.modules,
-  }
-}
-
-async function disposeContext(ctx: WorkbenchContext): Promise<void> {
-  await ctx.workspace.closeProject()
-  await ctx.registry.dispose().catch((err) => {
-    console.warn('[workbench] dispose registry encountered errors:', err)
-  })
-}
-
-function createConfiguredMainWindow(config: WorkbenchAppConfig, rendererDir: string): BrowserWindow {
-  const mainWindow = createMainWindow({
-    title: config.appName ?? 'Dimina DevTools',
-    indexHtml: path.join(rendererDir, 'entries/main/index.html'),
-    width: config.window?.width,
-    height: config.window?.height,
-    minWidth: config.window?.minWidth,
-    minHeight: config.window?.minHeight,
-    autoShow: config.window?.autoShow,
-  })
-
-  // Set window/taskbar icon if provided (Linux/Windows; macOS uses app bundle icon)
-  if (config.icon) {
-    const icon = nativeImage.createFromPath(config.icon)
-    if (!icon.isEmpty()) mainWindow.setIcon(icon)
-  }
-
-  return mainWindow
-}
-
-function createContext(config: WorkbenchAppConfig, mainWindow: BrowserWindow, rendererDir: string): WorkbenchContext {
-  return createWorkbenchContext({
-    mainWindow,
-    adapter: config.adapter,
-    preloadPath: config.preloadPath ?? defaultPreloadPath,
-    rendererDir,
-    appName: config.appName,
-    apiNamespaces: config.apiNamespaces,
-    fileTypes: config.fileTypes,
-    brandingProvider: config.brandingProvider,
-    // The host-supplied ProjectsProvider / template types in `shared/types`
-    // are structurally compatible with the main-process equivalents —
-    // these casts are safe; we re-narrow at the workspace-service /
-    // create-project-service boundary.
-    projectsProvider: config.projectsProvider as
-      | import('../services/projects/types.js').ProjectsProvider
-      | undefined,
-    projectTemplates: config.projectTemplates as
-      | import('../services/projects/types.js').ProjectTemplate[]
-      | undefined,
-    builtinTemplates: config.builtinTemplates,
-    customCreateProjectDialog: config.customCreateProjectDialog as
-      // eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
-      | import('../services/workbench-context.js').WorkbenchContext['customCreateProjectDialog']
-      | undefined,
-    // No cast needed here: the hook receives the project record, so the
-    // main-process `Project` the context hands it satisfies the structural
-    // `EditableProject` the config declares.
-    customEditProjectDialog: config.customEditProjectDialog,
-    onBeforeOpenProject: config.onBeforeOpenProject,
-  })
-}
-
-function registerBuiltinModules(config: WorkbenchAppConfig, context: WorkbenchContext): void {
-  const modules = resolveModules(config)
-  ;(Object.keys(modules) as BuiltinModuleId[]).forEach((moduleId) => {
-    if (modules[moduleId]) context.registry.add(BUILTIN_MODULES[moduleId].setup(context))
-  })
-}
-
-/**
- * Build the hand-written narrow `MenuContext` a host menu builder receives —
- * explicit construction (not clone+delete), so the runtime object carries
- * EXACTLY the contract members and nothing else. Every member is a lazy
- * closure over the live context: a host monkey-patch of
- * `context.workspace.openProject` (the documented permission-gate pattern)
- * still intercepts calls made through this menu surface.
- */
-function toMenuContext(context: WorkbenchContext): MenuContext {
-  return {
-    appName: context.appName,
-    workspace: {
-      hasActiveSession: () => context.workspace.hasActiveSession(),
-      getProjectPath: () => context.workspace.getProjectPath(),
-      openProject: (projectPath) => context.workspace.openProject(projectPath),
-      closeProject: () => context.workspace.closeProject(),
-      getSession: () => context.workspace.getSession(),
-    },
-    openSettings: () => context.openSettings(),
-    notify: {
-      projectStatus: (payload) => context.notify.projectStatus(payload),
-      windowNavigateBack: () => context.notify.windowNavigateBack(),
-    },
-  }
-}
-
-function installMenu(config: WorkbenchAppConfig, mainWindow: BrowserWindow, context: WorkbenchContext): void {
-  // Menu: use host-provided builder or fall back to default
-  if (config.menuBuilder) {
-    config.menuBuilder(mainWindow, toMenuContext(context))
-  } else {
-    installAppMenu(context)
-  }
-}
-
-async function setupAutomation(instance: WorkbenchAppInstance): Promise<void> {
-  // Start automation server if --auto flag is present
-  const autoArgs = parseAutoArgs()
-  if (autoArgs.auto) {
-    const server = await startAutomationServer(instance.context, autoArgs.autoPort)
-    instance.automationServer = server
-    instance.context.registry.add(() => server.close())
-    // Stable, parseable line for e2e harnesses that scrape stdout.
-    console.log(`[automation] listening on ws://127.0.0.1:${server.port}`)
-  }
-}
-
-function setupMcp(context: WorkbenchContext): Disposable | null {
-  const settings = loadWorkbenchSettings()
-  if (!settings.mcp.enabled) return null
-
-  const cdpPortSwitch = app.commandLine.getSwitchValue('remote-debugging-port')
-  const cdpPort = cdpPortSwitch ? parseInt(cdpPortSwitch, 10) : settings.cdp.port
-  return startMcpServer(cdpPort, settings.mcp.port, {
-    workspace: context.workspace,
-    sessionStatus: context.sessionStatus,
-    compileLogs: context.compileLogBuffer,
-    // The renderer owns the open path (mounting ProjectRuntime compiles and
-    // attaches the simulator), so project_open pushes it there.
-    requestOpenInUi: (p) => context.notify.windowOpenProject(p),
-    requestNavigateBack: () => context.notify.windowNavigateBack(),
-  })
-}
-
-function wireAppWindowEvents(
-  config: WorkbenchAppConfig,
-  instance: WorkbenchAppInstance,
-  isOnProjectScreen: () => boolean,
-): Disposable {
-  const { mainWindow, context } = instance
-  // In-flight guard: `closeProject()` is async, and the window stays open
-  // (preventDefault'd) while it runs — a second close click during that window
-  // would re-enter and tear the same session down twice. Swallow re-entrancy.
-  let closing = false
-  return wireMainWindowEvents(mainWindow, {
-    context,
-    onResize: () => context.views.repositionAll(),
-    onClose: async (e) => {
-      // A real application quit (⌘Q / menu "Quit" / app.quit()) fires
-      // `before-quit` first, then this window's `close`. Let it through so the
-      // app actually exits — do NOT convert it into "close the project".
-      // Without this, `hasActiveSession()` would be true and the quit gets
-      // swallowed into closeProject(), so the app can never be quit while a
-      // project is open.
-      if (isAppQuitting()) return
-
-      // A close arriving while a project teardown is already in flight (the
-      // user rapid-double-clicked the close button) MUST keep the window open.
-      // This guard runs BEFORE hasActiveSession() on purpose: `closeProject()`
-      // → `disposeSession()` synchronously nulls the active session before it
-      // finishes awaiting `session.close()`, so by the time the second close
-      // arrives `hasActiveSession()` is already false. With the old guard order
-      // that second close fell straight through the hasActiveSession() check
-      // WITHOUT `preventDefault()`, so Electron destroyed the last window →
-      // `window-all-closed` → `app.quit()`, quitting the whole app on a
-      // double-click. Swallow the re-entrant close and keep the window.
-      if (closing) {
-        e.preventDefault()
-        return
-      }
-
-      // Keep the app alive on close whenever EITHER a live compiled session
-      // exists OR the renderer reports it is on a project screen. The renderer
-      // enters the project screen (and reports it) before openProject resolves,
-      // so a FAILED open — invalid/non-existent project, no session ever
-      // created — still parks the renderer there showing the compile-failed
-      // overlay. Keying off `hasActiveSession()` alone let that close fall
-      // through with no preventDefault → the last window is destroyed →
-      // `window-all-closed` → `app.quit()`, quitting the whole app instead of
-      // returning to the list. The two signals answer one question ("is the
-      // user inside a project, so close means back-to-list?"); the renderer's
-      // screen is the authority and hasActiveSession is a resource-safety belt
-      // (never destroy the window while a live session runs behind it).
-      if (!context.workspace.hasActiveSession() && !isOnProjectScreen()) return
-
-      // Close button while inside a project: stay in the workbench and surface
-      // the project list. Tear down only the session — do NOT dispose
-      // `context.registry`, which owns every IPC handler (projects, dialog,
-      // settings…). Disposing it would leave the renderer alive but unable to
-      // invoke anything, so subsequent clicks on Import/etc. would raise
-      // `No handler registered for ...`.
-      e.preventDefault()
-      closing = true
-      try {
-        if (config.onBeforeClose) {
-          await config.onBeforeClose(instance)
-        }
-        await context.workspace.closeProject()
-        context.notify.windowNavigateBack()
-      }
-      finally {
-        closing = false
-      }
-    },
-  })
-}
-
-function enableDevRendererAutoReload(rendererDir: string): Disposable {
-  // Auto-reload renderer windows when dist files change during development
-  if (app.isPackaged) {
-    return toDisposable(() => {})
-  }
-
-  let reloadTimer: ReturnType<typeof setTimeout> | null = null
-  const watcher = fs.watch(rendererDir, { recursive: true }, () => {
-    if (reloadTimer) clearTimeout(reloadTimer)
-    reloadTimer = setTimeout(() => {
-      for (const win of BrowserWindow.getAllWindows()) {
-        win.webContents.reload()
-      }
-    }, 300)
-  })
-
-  return toDisposable(() => {
-    if (reloadTimer) {
-      clearTimeout(reloadTimer)
-      reloadTimer = null
-    }
-    watcher.close()
-  })
-}
-
 /**
  * Pre-ready bootstrap side effects (app name, CDP port, CSP suppression,
  * privileged scheme). MUST run before `app.whenReady()`. Extracted so the `RuntimeBackend.beforeReady` hook (which launch()
@@ -430,10 +179,11 @@ export function runDevtoolsBootstrap(config: WorkbenchAppConfig = {}): void {
 }
 
 /**
- * Domain runtime assembly — the post-whenReady body. Builds the main window +
- * context, registers IPC modules, stands up simulator/storage/CDP/native-host
- * services, and returns the fat {@link WorkbenchAppInstance}. Extracted so the
- * v2 `RuntimeBackend.assemble` reuses the exact same body (parity by shared
+ * Domain runtime assembly — the post-whenReady body. Builds the app-wide
+ * services and the context router, opens the project window, registers IPC
+ * against the router, stands up simulator/storage/CDP/native-host services, and
+ * returns the fat {@link WorkbenchAppInstance}. Extracted so the v2
+ * `RuntimeBackend.assemble` reuses the exact same body (parity by shared
  * implementation, not behavioural re-creation).
  */
 export async function createDevtoolsRuntime(
@@ -457,103 +207,44 @@ export async function createDevtoolsRuntime(
   applyTheme(loadWorkbenchSettings().theme)
 
   const rendererDir = config.rendererDir ?? defaultRendererDir
-  const mainWindow = createConfiguredMainWindow(config, rendererDir)
-  const context = createContext(config, mainWindow, rendererDir)
-
-  // Anchor the main window's renderer as the first Connection. Resources
-  // scoped to the main webContents (acquired by later wiring) tear down with
-  // it; see packages/electron-deck/docs/foundation.md (teardown paths).
-  context.connections.acquire(mainWindow.webContents)
-
-  context.registry.add(registerAppIpc(context))
-  // Sandboxed project file-system IPC (the renderer-side project:fs:* surface).
-  context.registry.add(registerProjectFsIpc(context))
-  // Standalone internal (app-wide) DevTools debug window controller — the
-  // independent floating CDP panel that debugs the whole Electron app (as
-  // opposed to the right-panel CDP, which inspects only the user's
-  // mini-program). Assembled before the IPC handler below so a request
-  // arriving right after boot always finds it.
-  // `isAppQuitting` lets the controller stop intercepting 'close' during a
-  // real quit — its habitual preventDefault()+hide() would otherwise cancel
-  // the quit itself and strand the process with a hidden window.
-  context.internalDevtoolsWindow = createInternalDevtoolsWindow(mainWindow, { isAppQuitting })
-  context.registry.add(toDisposable(() => context.internalDevtoolsWindow?.dispose()))
-  // Unconditional (not a toggleable BUILTIN_MODULES entry): it's core dev
-  // tooling, not a host-configurable feature.
-  context.registry.add(registerInternalDevtoolsIpc(context))
-  // Unconditional (not a toggleable BUILTIN_MODULES entry): the tooltip
-  // overlay is core UI chrome (every toolbar in this app relies on it), not a
-  // host-configurable feature.
-  context.registry.add(registerTooltipIpc(context))
-  // Unconditional: the project-create dialog is core UI chrome (the built-in
-  // "新建项目" flow every host falls back to), not a host-configurable feature.
-  context.registry.add(registerProjectCreateIpc(context))
-  // Unconditional (not a toggleable BUILTIN_MODULES entry): placement/host-
-  // slot IPC has no real dependency on the simulator module — `ctx.views`
-  // (ViewManager) is constructed unconditionally regardless of
-  // `modules.simulator`, and host-sidebar in particular lives on the
-  // project-list page, unrelated to the simulator webview. Every renderer
-  // entry point also blocks its first render on `AllocatePlacementGeneration`
-  // (see renderer-placement-generation.ts) — gating any of this behind the
-  // simulator toggle would strand a host that disables it on the fatal
-  // boot-failure page, or leave placement silently non-functional.
-  context.registry.add(registerViewsIpc(context))
-  // Referer/CORS webRequest policy for the simulator runtime's sessions (shared
-  // fallback + every per-project partition). Registered into the context
-  // registry so its configurator + per-session listeners are torn down with the
-  // context — re-creating the app never leaks a duplicate configurator.
-  context.registry.add(setupSimulatorSessionPolicy())
-  // One process-wide listener that re-syncs every window's native
-  // backgroundColor on theme change — windows otherwise keep the stale
-  // creation-time color (see installThemeBackgroundSync).
-  context.registry.add(installThemeBackgroundSync())
-  // Warm-standby compile worker: only meaningful for the devkit-backed
-  // default adapter (a host-injected adapter has no devkit fork to adopt the
-  // spare). Registered into the registry so the spare dies with the context.
-  if (!config.adapter) context.registry.add(setupCompileWorkerStandby(context))
-  registerBuiltinModules(config, context)
-
-  // Global console mirror: while the standalone
-  // internal DevTools window is open, mirror every guest console entry
-  // (service + render, UNFILTERED — see global-console-mirror.ts) into it —
-  // each open replays the forwarder's current history buffer first (see that
-  // module's doc comment for why the subscribe lifecycle is gated on
-  // onHostChanged rather than subscribed once at construction time).
-  // `context.consoleForwarder` is assembled by the simulator module's
-  // installBridgeRouter just above; absent only when that builtin module was
-  // disabled via config. The Console panel shows the INSPECTED target's own
-  // console (mainWindow, per internal-devtools-window.ts's
-  // setDevToolsWebContents relationship) — NOT the front-end host page's
-  // console, so `target` is always mainWindow.webContents, never the hostWc
-  // onHostChanged hands the mirror.
-  if (context.consoleForwarder && context.internalDevtoolsWindow) {
-    const consoleMirror = createGlobalConsoleMirror(
-      context.consoleForwarder,
-      mainWindow.webContents,
-      context.internalDevtoolsWindow.onHostChanged,
-      // CDP transport (never executeJavaScript) — see the mirror's inject()
-      // doc for the setDevToolsWebContents + external-CDP double-attach hang.
-      { broker: context.cdpSessionBroker },
-    )
-    context.registry.add(toDisposable(() => consoleMirror.dispose()))
-  }
 
-  // Global diagnostics mirror (same wiring, same INSPECTED-side
-  // target rationale as the console mirror above): every diagnostic —
-  // including `audience:'internal'` ones console-forward's own service-host
-  // injection now skips (see compile-standby.ts / index.ts's handleDiagnostic
-  // gate) — surfaces here instead of vanishing. `context.diagnostics` is
-  // assembled alongside `context.consoleForwarder` by the same
-  // installBridgeRouter call.
-  if (context.diagnostics && context.internalDevtoolsWindow) {
-    const diagnosticsMirror = createGlobalDiagnosticsMirror(
-      context.diagnostics,
-      mainWindow.webContents,
-      context.internalDevtoolsWindow.onHostChanged,
-      { broker: context.cdpSessionBroker },
-    )
-    context.registry.add(toDisposable(() => diagnosticsMirror.dispose()))
-  }
+  // App-wide, built once: the project list, the templates, the trusted-sender
+  // ledger and the host's simulator APIs are properties of the application, not
+  // of any single window.
+  const appServices = createAppServices({
+    // The host-supplied ProjectsProvider / template types in `shared/types`
+    // are structurally compatible with the main-process equivalents —
+    // these casts are safe; we re-narrow at the workspace-service /
+    // create-project-service boundary.
+    projectsProvider: config.projectsProvider as
+      | import('../services/projects/types.js').ProjectsProvider
+      | undefined,
+    projectTemplates: config.projectTemplates as
+      | import('../services/projects/types.js').ProjectTemplate[]
+      | undefined,
+    builtinTemplates: config.builtinTemplates,
+  })
+  const router = createWindowContextRouter<WorkbenchContext>()
+
+  // App-lifetime registry. `ipcMain.handle` is a process-wide singleton per
+  // channel, so the IPC surface is registered exactly once and answers
+  // whichever window a message came from. Keeping it OFF the launcher
+  // context's registry is what lets the user close the project list without
+  // stripping every handler out from under the workbench windows still open.
+  const appRegistry = new DisposableRegistry()
+
+  const launcher = createLauncherWindow({ config, rendererDir, appServices, router })
+  const { window: mainWindow, context } = launcher
+  const projectList = createProjectListSurface({ window: mainWindow, context })
+
+  registerWorkbenchIpc(config, router, context, mainWindow, appRegistry)
+  // No `setupWindowModules` here: the only per-window module is the simulator's
+  // bridge router, and the project list runs no mini-app — it has no simulator,
+  // no service host and no page stack. Installing one here would also claim the
+  // process-global `dmb:*` invoke channels before the first workbench window
+  // could. `installGlobalMirrors` skips the console/diagnostics mirrors when the
+  // router never ran, so the list window keeps its own internal DevTools.
+  installGlobalMirrors(context, mainWindow)
 
   // Wire the simulator-side difile:// protocol handler + temp-file IPC
   // before host onSetup so any host-driven simulator boot sees the
@@ -561,37 +252,129 @@ export async function createDevtoolsRuntime(
   // (simulator-session-only) — see file header — because the default
   // workbench policy intentionally rejects the simulator <webview>.
   const simSession = session.fromPartition(SHARED_MINIAPP_PARTITION)
-  context.registry.add(setupSimulatorTempFiles(simSession))
+  appRegistry.add(setupSimulatorTempFiles(simSession))
+
+  // Gated custom-IPC surface for the host. Admits any sender the router places
+  // in a live window, so a host channel invoked from a workbench window is
+  // answered the same as one invoked from the list — binding it to the
+  // launcher's own policy would reject every workbench renderer.
+  const hostIpc = new IpcRegistry((sender) => router.resolve(sender) !== null)
+  appRegistry.add(hostIpc)
+
+  // Host-registered simulator UI extensions are app-level, but an extension can
+  // only live in a project window, so the ledger keeps one copy per window.
+  const uiExtensions = createUiExtensionTargets<WorkbenchContext>({
+    projectWindows: () => workbenchWindows.list().map((pw) => pw.context),
+    activeWindow: () => workbenchWindows.activeContext(),
+  })
 
-  installMenu(config, mainWindow, context)
+  // The open-project IPC is registered below, well before `config.onSetup` is
+  // awaited, so a renderer that races ahead can ask for a project window while
+  // the host is still wiring its extensions up. Those opens park on `ready`
+  // instead of producing a window the host never got to extend.
+  let markReady!: (setup: Promise<void>) => void
+  const ready = new Promise<void>((resolve) => { markReady = resolve })
+  // The parked open reports an onSetup failure to whoever asked for the
+  // window; this keeps the rejection handled when nobody ever asks.
+  void ready.catch(() => {})
+
+  const workbenchWindows = createWorkbenchWindowManager({
+    config,
+    rendererDir,
+    appServices,
+    router,
+    ready,
+    // Not wrapped in try/catch the way `onBeforeClose` is: this hook runs on
+    // the way IN, so a host that could not configure the window has no window
+    // worth keeping — the manager tears it down and the error reaches the
+    // caller.
+    setupProjectWindow: async (opened, project) => {
+      await config.setupProjectWindow?.(instance, {
+        path: project.path,
+        name: project.name,
+        window: opened.window,
+        context: opened.context,
+      })
+    },
+    setupWindowModules: (ctx) => {
+      setupWindowModules(config, ctx)
+      uiExtensions.attachTo(ctx)
+    },
+    // MCP's CDP connections are aimed at the active project window and have to
+    // follow it when the user moves.
+    onActiveContextChanged: noteActiveMcpWindowChanged,
+    onBeforeClose: async (closing, project) => {
+      try {
+        await config.onBeforeClose?.(instance, {
+          path: project.path,
+          name: project.name,
+          window: closing.window,
+          context: closing.context,
+        })
+      } catch (err) {
+        // The host gets to react to the close, not to cancel it: revealing the
+        // list window below is what keeps something on screen, and it must not
+        // be skipped because host code threw.
+        console.error('[workbench] host onBeforeClose hook failed:', err)
+      }
+      // The closing window keeps its place in the manager's list until its
+      // teardown finishes, so "the last project" means no OTHER window is
+      // open. The list window may be hidden behind it (see the close handler
+      // below) — leaving it hidden strands the user with a running app and
+      // nothing on screen.
+      if (workbenchWindows.list().every((pw) => pw === closing)) projectList.revealProjectList()
+    },
+  })
+
+  // Menu, automation and MCP drive whatever project the user is working in, so
+  // they read the active WORKBENCH context, resolved per call — never the list
+  // window, which owns no session. With no project open they fall back to the
+  // launcher context, whose `hasActiveSession()` is false, while MCP's CDP
+  // targets and native-host state live in the window itself: null instead.
+  const activeProjectContext = (): WorkbenchContext => workbenchWindows.activeContext() ?? context
+  setActiveMcpWindowResolver(() => workbenchWindows.activeContext())
+  appRegistry.add(toDisposable(() => setActiveMcpWindowResolver(() => null)))
+  installMenu(config, mainWindow, activeProjectContext, projectList.revealProjectList)
 
-  // Gated custom-IPC surface for the host. Bound to ctx.senderPolicy so
-  // host channels go through the same gateway as built-in IPC, and
-  // registered into ctx.registry so its handlers are torn down with the
-  // context.
-  const hostIpc = new IpcRegistry(context.senderPolicy)
-  context.registry.add(hostIpc)
+  appRegistry.add(registerOpenProjectWindowIpc(router, (project) => workbenchWindows.open(project)))
 
   const instance: WorkbenchAppInstance = {
     mainWindow,
     context,
     ipc: hostIpc,
+    // `awaitReady: false`: `ready` only resolves once `config.onSetup` itself
+    // settles (`markReady(setup)` below), so a host that calls
+    // `instance.openProjectWindow` FROM WITHIN its own `onSetup` would
+    // otherwise deadlock — `open()` awaiting `ready` while `ready` awaits the
+    // very `onSetup` call that is awaiting `open()`. The renderer-facing IPC
+    // path (`registerOpenProjectWindowIpc` above) keeps the default: a
+    // renderer racing ahead of `onSetup` still has to park.
+    openProjectWindow: (project: ProjectRef) => workbenchWindows.open(project, { awaitReady: false }),
+    projectWindows: () => workbenchWindows.list(),
+    disposeViews: () => {
+      for (const ctx of router.list()) ctx.views.disposeAll()
+    },
     // Return the registry wrapper, not the raw disposable: disposing the
     // wrapper splices the registry entry out AND drives the underlying
     // teardown, so a single dispose leaves no dead entry behind.
+    // App-level: the trusted-sender ledger and the simulator API map are
+    // shared by every window, so they outlive any one of them.
     registerTrustedWindow: (win: BrowserWindow) =>
-      context.registry.add(registerTrustedWindow(context, win)),
+      appRegistry.add(registerTrustedWindow(appServices, win)),
+    // Simulator APIs live in the ONE registry AppServices owns, which every
+    // window's context points at, so a single registration serves every
+    // window — including windows opened later, since the service host reads
+    // the registered names off it when it spawns. The disposer therefore
+    // belongs to the app: parking it on a window would let that window's close
+    // delete the handler out from under every other open window.
     registerSimulatorApi: (name: string, handler: SimulatorApiHandler) =>
-      context.registry.add(toDisposable(context.simulatorApis.register(name, handler))),
-    registerSimulatorUiExtension: (registration: SimulatorUiExtensionRegistration) => {
-      const extension = context.simulatorUiExtensions.register(registration)
-      const owned = context.registry.add(extension)
-      return {
-        dispose: () => owned.dispose(),
-        invoke: (method, params) => extension.invoke(method, params),
-      }
+      appRegistry.add(toDisposable(appServices.simulatorApis.register(name, handler))),
+    registerSimulatorUiExtension: (registration) => uiExtensions.register(registration),
+    dispose: async () => {
+      await workbenchWindows.disposeAll()
+      await launcher.dispose()
+      await appRegistry.dispose()
     },
-    dispose: () => disposeContext(context),
   }
   onInstanceCreated?.(instance)
 
@@ -602,53 +385,19 @@ export async function createDevtoolsRuntime(
     return 'hello'
   })
 
-  // devtools' own default content for the host-sidebar slot: a narrow icon
-  // rail (logo + 小程序/小游戏 toggle) filtering the project-list grid by
-  // `Project.type`. Loaded BEFORE `config.onSetup` runs below, so any
-  // downstream `loadURL`/`loadFile` call inside onSetup necessarily happens
-  // later and naturally supersedes this default via plain chronological
-  // ordering — no override flag needed.
-  context.registry.add(
-    context.views.hostSidebar.onMessage('project-category-selected', (payload) => {
-      const category = (payload as { category?: unknown } | null)?.category
-      if (category !== 'miniprogram' && category !== 'minigame') return
-      context.notify.hostSidebarCategorySelected(category)
-    }),
-  )
-  context.views.hostSidebar
-    .loadFile(path.join(rendererDir, 'entries/host-sidebar-default/index.html'))
-    .catch((err) => {
-      console.warn('[workbench] failed to load host-sidebar default content:', err)
-    })
-  // Seed the notified width with the rail's own known intrinsic width
-  // (`HOST_SIDEBAR_DEFAULT_WIDTH`) instead of leaving it at 0 until the
-  // rail's in-page advertiser reports back. That report can never arrive on
-  // its own: the placeholder above only becomes "desired visible" once a
-  // nonzero width is known (project-list-screen.tsx), attach only happens
-  // for a "desired visible" view (placement-reconciler.ts), and the rail's
-  // advertiser (view-anchor's measure-loop.ts) only ever fires via
-  // `requestAnimationFrame`, which Chromium never schedules for a
-  // WebContentsView that was never attached — a structural deadlock, not a
-  // slow-to-resolve race. `setWidthMode({fixed})` pushes the seed
-  // synchronously (no attach/rAF dependency) and, critically, retains it in
-  // `getHostSidebarWidth()` too, so a renderer that mounts and pulls before
-  // any push replays the real seed instead of a stale 0. Flipping back to
-  // 'auto' immediately after, before anything has attached or advertised, is
-  // a same-tick no-op past the seed (`setExtentMode`'s reapply branch only
-  // fires once something has actually been advertised) — it leaves the slot
-  // in 'auto' for whichever content ends up loaded (this rail's own later
-  // report, or a downstream replacement's), not pinned.
-  context.views.hostSidebar.setWidthMode({ fixed: HOST_SIDEBAR_DEFAULT_WIDTH })
-  context.views.hostSidebar.setWidthMode('auto')
+  installHostSidebarDefault(context, rendererDir)
 
-  if (config.onSetup) {
-    await config.onSetup(instance)
-  }
+  // Run inside an async IIFE so a hook that throws SYNCHRONOUSLY still settles
+  // `ready` — leaving it pending would park every queued open forever, and
+  // `disposeAll()` waits on those queues.
+  const setup = (async () => { await config.onSetup?.(instance) })()
+  markReady(setup)
+  await setup
 
   if (config.updateChecker) {
     instance.updateManager = new UpdateManager({
       checker: config.updateChecker,
-      showUpdatePanel: (info) => context.views.showUpdateDialog(info),
+      showUpdatePanel: (info) => projectList.showUpdate(info),
       notifyDownloadProgress: (percent) => context.views.notifyUpdateDownloadProgress(percent),
       hideUpdatePanel: () => context.views.hideUpdateDialog(),
       senderPolicy: context.senderPolicy,
@@ -656,243 +405,57 @@ export async function createDevtoolsRuntime(
       initialDelay: config.updateOptions?.initialDelay,
       getCurrentVersion: config.updateOptions?.getCurrentVersion,
     })
-    context.registry.add(() => instance.updateManager!.dispose())
-  }
-
-  await setupAutomation(instance)
-  const mcp = setupMcp(context)
-  if (mcp) context.registry.add(mcp)
-
-  // Resolve the active project's appId. Shared by the storage panel filter
-  // and the native-host WXML/element-inspect services (which scope the
-  // active render guest by appId).
-  const getActiveAppId = (): string | null => {
-    const session = context.workspace.getSession()
-    const appInfo = session?.appInfo as { appId?: string } | undefined
-    return appInfo?.appId ?? null
+    appRegistry.add(() => instance.updateManager!.dispose())
   }
 
-  // Native-host: the real mini-app page runs in a nested render-host
-  // <webview> guest, not the localhost:7788 shell. Point the MCP
-  // `simulator` CDP target at the active render guest and keep it following
-  // the visible page across navigation/tab switches. Only wired under
-  // native-host so the default path stays byte-identical.
-  if (context.bridge?.isNativeHost()) {
-    setNativeHost(true)
-    setNativeOverviewProvider(async () => {
-      const appId = getActiveAppId()
-      const stack = context.bridge?.getPageStack?.(appId ?? undefined) ?? []
-      const top = stack[stack.length - 1]
-      const overview = {
-        currentRoute: top?.pagePath ?? null,
-        pageStackDepth: stack.length,
-        storageKeys: [] as string[],
-        storageCount: 0,
-        appDataKeys: [] as string[],
-      }
-
-      if (appId) {
-        const storage = await resolveNativeStorageOverview(context, appId)
-        overview.storageKeys = storage.storageKeys
-        overview.storageCount = storage.storageCount
-        overview.appDataKeys = resolveNativeAppDataKeys(context, appId)
+  const automation = await setupAutomation(instance, activeProjectContext, router)
+  if (automation) appRegistry.add(automation)
+  const mcp = setupMcp(createTargetForMcp({
+    list: () => workbenchWindows.list(),
+    activeContext: activeProjectContext,
+    // `close()` (not `destroy()`) so the window's own close handling runs the
+    // same teardown a user-driven close does.
+    close: (window) => { if (!window.isDestroyed()) window.close() },
+  }), createOpenForMcp(workbenchWindows))
+  if (mcp) appRegistry.add(mcp)
+
+  // The list window opens no project, so its close needs none of the workbench
+  // teardown: just unregister its context, or a recycled `webContents.id`
+  // could later resolve to a destroyed window.
+  context.registry.add(wireMainWindowEvents(mainWindow, {
+    context,
+    onResize: () => context.views.repositionAll(),
+    onClose: (e) => {
+      if (isAppQuitting()) return
+      // With projects still open, this window must survive its own close
+      // button: it is the only way back to the project list, and the
+      // app-level IPC it registered cannot be registered again on a
+      // replacement window. Hide it — every path back calls
+      // `projectList.revealProjectList()`, including the last project window
+      // closing.
+      if (workbenchWindows.list().length > 0) {
+        e.preventDefault()
+        mainWindow.hide()
+        return
       }
-
-      return overview
-    })
-    const off = context.bridge.onRenderEvent((ev) => setActiveBridgeId(ev.bridgeId))
-    context.registry.add(off)
-    context.registry.add(() => setNativeHost(false))
-    context.registry.add(() => setNativeOverviewProvider(null))
-  }
-
-  // Native-host inspector: injects the render-guest IIFE and drives WXML /
-  // element-highlight against the active render-host <webview>. Reused by
-  // the storage panel (element inspect) and the WXML panel service.
-  const renderInspector = createRenderInspector({ connections: context.connections, broker: context.cdpSessionBroker })
-
-  const storage = setupSimulatorStorage(mainWindow.webContents, {
-    senderPolicy: context.senderPolicy,
-    connections: context.connections,
-    broker: context.cdpSessionBroker,
-    // Per-project filter for the simulator-storage panel: the simulator
-    // uses a fixed `persist:simulator` partition + a fixed simulator.html
-    // origin, so localStorage is shared across every project that has
-    // ever opened. The dimina runtime isolates writes with `${appId}_`
-    // prefixes; this callback lets the storage panel filter the CDP
-    // snapshot/event stream to the active appId.
-    getActiveAppId,
-    // Native-host: route element inspection to the active render guest, and
-    // read/write storage from the service-host window's file:// store.
-    bridge: context.bridge,
-    renderInspector,
-  })
-  context.registry.add(storage)
-  // Native-host: expose the async-storage runtime hook so bridge-router
-  // routes async wx.setStorage/etc. to the unified service-host store.
-  if (storage.storageApi) {
-    context.storageApi = storage.storageApi
-    context.registry.add(() => { context.storageApi = undefined })
-    // SYNC wx storage writes bypass main (they hit the service-host localStorage
-    // directly); the service-host posts `storageChanged` and bridge-router routes
-    // it here so the Storage panel stays live without a manual reload.
-    context.onServiceStorageChanged = storage.onSyncStorageChange
-    context.registry.add(() => { context.onServiceStorageChanged = undefined })
-  }
-
-  // Native-host WXML + AppData panels: main sources the data (WXML pulled
-  // from the active render guest; AppData tapped from the service→render
-  // setData stream in bridge-router) and pushes it to the renderer. Inert on
-  // the default dimina-fe path (which sources both from the simulator
-  // miniappSnapshot transport), so only wire them when native-host is on.
-  if (context.bridge?.isNativeHost()) {
-    // Native-host: surface the simulator WCV's network (wx.request/download/
-    // upload run there, not in the service host) in the embedded DevTools by
-    // injecting its raw Network.* CDP events into the DevTools front-end so the
-    // native Network tab renders them (service-host console line is the
-    // fallback). The ViewManager calls the forwarder's attachSimulator +
-    // setDevtoolsHost from attachNativeSimulator once the simulator WCV +
-    // DevTools host exist; getServiceWc here is the fallback sink target.
-    const networkForward = createNetworkForwarder({
-      getServiceWc: (appId) => context.bridge?.getServiceWc(appId) ?? null,
-      getResourceServerBaseUrl: () => context.bridge?.getResourceBaseUrl?.() ?? null,
-      // The simulator shell's own static-asset server (serves simulator.html
-      // + its JS/CSS, independent from the resource server above — see
-      // NetworkForwarderBridge.getSimulatorServerBaseUrl's doc). Host is
-      // always 'localhost' — see shared/simulator-route.ts's
-      // buildSimulatorUrlFromSpec default. Absent (null port) when no
-      // project is open.
-      getSimulatorServerBaseUrl: () => {
-        const port = context.workspace?.getSession()?.port
-        return typeof port === 'number' ? `http://localhost:${port}/` : null
-      },
-      connections: context.connections,
-      broker: context.cdpSessionBroker,
-    })
-    context.networkForward = networkForward
-    context.registry.add(networkForward)
-    context.registry.add(() => { context.networkForward = undefined })
-    // Global mirror: once the standalone internal
-    // DevTools window builds its own front-end host, mirror the full
-    // unfiltered Network stream into it. Attached AFTER context.networkForward
-    // is assigned above — the callback re-reads the mutable field on every
-    // fire, so ordering only matters for readability here, not correctness.
-    context.registry.add(toDisposable(
-      context.internalDevtoolsWindow?.onHostChanged((hostWc) => {
-        context.networkForward?.setGlobalDevtoolsHost(hostWc)
-      }) ?? (() => {}),
-    ))
-
-    // Main-process WebSocket traffic (wx.connectSocket runs on the Node `ws`
-    // transport, invisible to any webContents debugger): bridge-router fans
-    // the trace stream out here, and the forwarder synthesizes it into
-    // Network.webSocket* CDP events for the same Network panel sinks.
-    context.registry.add(toDisposable(
-      context.bridge?.onNativeWebSocketTrace?.((ownerId, event) => {
-        context.networkForward?.reportWebSocketTrace(ownerId, event)
-      }) ?? (() => {}),
-    ))
-
-    context.registry.add(setupSimulatorWxml(mainWindow.webContents, {
-      senderPolicy: context.senderPolicy,
-      bridge: context.bridge,
-      inspector: renderInspector,
-      getActiveAppId,
-    }))
-    const appDataService = setupSimulatorAppData(mainWindow.webContents, {
-      senderPolicy: context.senderPolicy,
-      getActiveAppId,
-      // AppData-panel edit write-back target: the service-host window owning
-      // the edited page bridge.
-      bridge: context.bridge,
-    })
-    // bridge-router feeds this via ctx.appData (service→render tap + evict).
-    context.appData = appDataService
-    context.registry.add(appDataService)
-    context.registry.add(() => { context.appData = undefined })
-    // Push the visible page route to the toolbar on every navigation (the
-    // page stack lives in the DeviceShell WCV, invisible to renderer
-    // <webview> nav events).
-    context.registry.add(setupSimulatorCurrentPage(mainWindow.webContents, {
-      bridge: context.bridge,
-    }))
-  }
-  // Embedded workbench editor — the sole devtools editor. Stand up the COI
-  // http server that serves the workbench bundle with the SharedArrayBuffer
-  // isolation headers and bridges `/__fs/*` onto the active project, then hand its
-  // base URL to the view manager so the 'editor' dock slot mounts the workbench
-  // WebContentsView. Both the server and the WCV tear down with the context
-  // registry.
-  //
-  // Default the bundle dir to the devtools package's OWN `dist/vscode-workbench`
-  // (resolved from the package root), NOT relative to the caller's rendererDir:
-  // a host that overrides `rendererDir` but omits `editorViewConfig.bundleDir`
-  // would otherwise compute a path next to ITS renderer, where no workbench
-  // bundle exists → 404 / blank editor.
-  const bundleDir =
-    config.editorViewConfig?.bundleDir ?? path.join(devtoolsPackageRoot, 'dist/vscode-workbench')
-  // Skip the entire editor assembly when the bundle is missing. Starting the COI
-  // server and attaching the WCV against a non-existent bundle yields a silent
-  // blank editor (the WCV loads index.html → 404); a launchable app with no
-  // editor is strictly better. The view manager never gets a source, so the
-  // 'editor' slot's lazy attach is a no-op.
-  if (!fs.existsSync(path.join(bundleDir, 'index.html'))) {
-    console.warn(
-      `[workbench] editor bundle not found at ${bundleDir} — skipping embedded editor assembly`,
-    )
-  } else {
-    const coiServer = await startWorkbenchCoiServer({
-      rootDir: bundleDir,
-      getProjectRoot: () => context.workspace.getProjectPath(),
-      extensionsDir: config.editorViewConfig?.extensionsDir,
-      getFileTypes: () => context.fileTypes,
-      // Names the editor's VS Code workspace after the active miniapp, so each
-      // project gets its own open-editors/view-state bucket instead of all of
-      // them sharing the one derived from the constant mirror root.
-      getProjectIdentity: () => ({
-        appId: getActiveAppId(),
-        projectPath: context.workspace.getProjectPath(),
-      }),
-    })
-    // Return the close promise so the registry awaits server shutdown on dispose
-    // instead of fire-and-forgetting it (a dangling http server would keep the
-    // port + event loop alive past teardown).
-    context.registry.add(() => coiServer.close())
-    // The registry disposes LIFO, so this runs BEFORE the context-level
-    // disposeAll: void any in-flight open's attach hold here too, or a stale
-    // release / cap firing could rebuild the workbench during the awaited
-    // coiServer.close() above, before disposeAll's own cancel runs.
-    context.registry.add(() => {
-      context.views.cancelWorkbenchAttachHold()
-      context.views.detachWorkbench()
-    })
-    // Only HAND the view manager the COI URL — do NOT load yet. The heavy
-    // WebContentsView load (10MB bundle + ext-host) is deferred to the first time
-    // the 'editor' dock slot becomes visible (first non-zero bounds), so it never
-    // sits on the app boot critical path. Loading it eagerly here delayed
-    // preload/window-ready enough to trip the e2e launch health check.
-    context.views.setWorkbenchSource(coiServer.baseUrl)
+      void launcher.dispose()
+    },
+  }))
+
+  // macOS keeps the app running with no window on screen. Clicking the dock
+  // icon then has to bring something back, and the project list is the app's
+  // home — a workbench window only exists for a project the user already
+  // chose.
+  const onActivate = (): void => {
+    if (mainWindow.isDestroyed()) return
+    if (mainWindow.isVisible()) return
+    if (workbenchWindows.list().some((pw) => !pw.window.isDestroyed() && pw.window.isVisible())) return
+    projectList.revealProjectList()
   }
+  app.on('activate', onActivate)
+  appRegistry.add(toDisposable(() => { app.removeListener('activate', onActivate) }))
 
-  // Main's mirror of the renderer's top-level screen. The renderer's `page`
-  // state is the single authority; it pushes every change over
-  // WindowChannel.ScreenState. Main reads this mirror in the window-close
-  // decision so a close while the renderer is parked on a project screen (even
-  // a failed open with no session) returns to the list instead of quitting.
-  let rendererScreen: 'list' | 'project' = 'list'
-  context.registry.add(
-    new IpcRegistry(context.senderPolicy).handle(
-      WindowChannel.ScreenState,
-      (_e, screen) => {
-        rendererScreen = screen === 'project' ? 'project' : 'list'
-      },
-    ),
-  )
-
-  context.registry.add(
-    wireAppWindowEvents(config, instance, () => rendererScreen === 'project'),
-  )
-  context.registry.add(enableDevRendererAutoReload(rendererDir))
+  appRegistry.add(enableDevRendererAutoReload(rendererDir))
 
   return instance
 }
diff --git a/packages/devtools/src/main/app/close-invalid-project-no-quit.test.ts b/packages/devtools/src/main/app/close-invalid-project-no-quit.test.ts
index 4acf1b72..78e3e6f5 100644
--- a/packages/devtools/src/main/app/close-invalid-project-no-quit.test.ts
+++ b/packages/devtools/src/main/app/close-invalid-project-no-quit.test.ts
@@ -1,25 +1,25 @@
 /**
- * WINDOW-CLOSE CONTRACT — closing while the renderer is on the PROJECT screen
- * after a FAILED project open (onClose in app.ts wireAppWindowEvents).
+ * WORKBENCH-WINDOW CLOSE CONTRACT — closing a workbench window after a FAILED
+ * project open (the unconditional-teardown guard in workbench-window.ts).
  *
  * Bug guarded against: the user tries to open a non-existent / invalid
  * mini-program project. `openProject()` fails and no session is ever created
- * (`workspace.hasActiveSession()` stays false throughout). The renderer,
- * however, has already navigated to its in-project screen (it reports this
- * via `WindowChannel.ScreenState` the moment it enters the project route,
- * BEFORE the open call resolves) and shows a "compile failed" error overlay
- * there. The close handler currently keys its preventDefault decision purely
- * off `hasActiveSession()`, so with no session it sees nothing to protect and
- * lets the close pass through — the last window is destroyed, triggering
- * `window-all-closed` → `app.quit()`, and the whole app exits instead of
- * returning the user to the project list.
+ * (`workspace.hasActiveSession()` stays false throughout), yet the window
+ * already owns views, an editor server and IPC registrations. A close handler
+ * that gates its teardown on `hasActiveSession()` sees nothing to protect and
+ * lets the close fall straight through — the window is destroyed with its
+ * resources still live, and back when that was the only window the whole
+ * application went down with it (`window-all-closed` → `app.quit()`).
  *
- * Contract: the close decision must consult the renderer's last-reported
- * screen (`WindowChannel.ScreenState`), not just session presence. Closing
- * while the reported screen is `'project'` must preventDefault and send
- * `WindowChannel.NavigateBack` so the renderer returns to the list, even with
- * no active session. Closing while the reported screen is `'list'` must pass
- * through so the app can quit normally.
+ * Contract: a workbench window's close tears that window down
+ * UNCONDITIONALLY — session or not. Teardown runs, the window is destroyed
+ * only once teardown finishes, and neither the application nor the
+ * project-list window goes with it.
+ *
+ * Window identity is what the contract keys off now: a workbench window IS the
+ * project screen, so main never has to ask a renderer which screen it is on.
+ * The project-list window owns no project and keeps the opposite contract —
+ * its close passes through so the app can quit.
  *
  * Harness (electron + fs + devkit mocks, real createDevtoolsRuntime) lifted
  * from `double-close-quit.test.ts` / `close-with-active-session.test.ts`.
@@ -177,6 +177,8 @@ vi.mock('electron', () => {
   class BrowserWindow {
     private em = stubs.makeEmitter()
     destroyed = false
+    visible = true
+    minimized = false
     webContents = new WebContents()
     contentView: View | WebContentsView = new WebContentsView()
     on = this.em.on.bind(this.em)
@@ -188,9 +190,14 @@ vi.mock('electron', () => {
     getContentSize = () => [1280, 980]
     setIcon = vi.fn()
     setTitle = vi.fn()
-    show = vi.fn()
+    show = vi.fn(() => { this.visible = true })
     showInactive = vi.fn()
     focus = vi.fn()
+    hide = vi.fn(() => { this.visible = false })
+    isVisible = () => this.visible
+    minimize = vi.fn(() => { this.minimized = true })
+    isMinimized = () => this.minimized
+    restore = vi.fn(() => { this.minimized = false })
     close = vi.fn()
     destroy = vi.fn(() => {
       this.destroyed = true
@@ -331,13 +338,6 @@ vi.mock('@dimina-kit/devkit', () => ({
 }))
 
 // ── Lazy imports ────────────────────────────────────────────────────────
-import { WindowChannel } from '../../shared/ipc-channels.js'
-// `WindowChannel` does not yet export a screen-state channel — the renderer
-// has no way to report its current top-level screen to main at all. This is
-// itself part of the guarded gap: main has nothing to consult, so it can only
-// ever key off `hasActiveSession()`. Once the channel is added to
-// `shared/ipc-channels.ts`, this local constant must match its value exactly.
-const SCREEN_STATE_CHANNEL = 'window:screenState'
 let createDevtoolsRuntime: typeof import('./app.js').createDevtoolsRuntime
 
 beforeEach(async () => {
@@ -347,6 +347,9 @@ beforeEach(async () => {
   ;({ createDevtoolsRuntime } = await import('./app.js'))
 })
 
+type Instance = Awaited<ReturnType<typeof createDevtoolsRuntime>>
+type ProjectWindow = ReturnType<Instance['projectWindows']>[number]
+
 /** A close event that records how many times preventDefault was called. */
 function makeCloseEvent() {
   let prevented = 0
@@ -358,107 +361,86 @@ function makeCloseEvent() {
   }
 }
 
-function emitClose(instance: Awaited<ReturnType<typeof createDevtoolsRuntime>>, fakeEvent: unknown) {
-  ;(instance.mainWindow as unknown as {
-    emit: (event: string, ...args: unknown[]) => void
-  }).emit('close', fakeEvent)
+function emitClose(win: unknown, fakeEvent: unknown) {
+  ;(win as { emit: (event: string, ...args: unknown[]) => void }).emit('close', fakeEvent)
 }
 
-/**
- * Reports the renderer's current top-level screen via the registered IPC
- * handler, mirroring the renderer calling
- * `ipcRenderer.invoke(SCREEN_STATE_CHANNEL, screen)`. No handler is currently
- * registered for this channel at all — main has no way to learn the
- * renderer's screen — so this is a no-op today. That is itself the gap this
- * file guards: the close decision below falls back to whatever main can
- * currently observe (only `hasActiveSession()`), which is precisely the bug.
- */
-async function reportScreen(
-  instance: Awaited<ReturnType<typeof createDevtoolsRuntime>>,
-  screen: 'project' | 'list',
-) {
-  const handler = stubs.handlers.get(SCREEN_STATE_CHANNEL)
-  // The fake IpcMainInvokeEvent must carry the main window's webContents as its
-  // sender: every renderer→main invoke passes the sender-policy gate, which
-  // trusts the main-window renderer. A bare `{}` has no sender and crashes the
-  // gate before the handler runs.
-  const event = { sender: instance.mainWindow.webContents }
-  await handler?.(event, screen)
+/** Opens `dir` in its own workbench window and returns that window's record. */
+async function openWorkbenchWindow(instance: Instance, dir: string): Promise<ProjectWindow> {
+  await instance.openProjectWindow({ path: dir })
+  const [projectWindow] = instance.projectWindows()
+  expect(projectWindow, 'openProjectWindow must publish the window it opened').toBeTruthy()
+  return projectWindow!
 }
 
-describe('window close after a failed project open (no session, renderer stuck on project screen)', () => {
-  it('preventDefaults the close and navigates the renderer back to the list instead of quitting', async () => {
+describe('workbench window close after a failed project open (no session was ever created)', () => {
+  it('tears the window down anyway, destroys only that window, and never quits the app', async () => {
     // Do NOT add the dir to projectsWithAppJson: openProject() must fail
     // because app.json is missing, exactly like opening a non-existent /
     // invalid mini-program project.
     stubs.setProjectsJson(JSON.stringify([]))
 
     const instance = await createDevtoolsRuntime({})
+    const projectWindow = await openWorkbenchWindow(instance, '/tmp/doesNotExist')
 
-    const openResult = await instance.context.workspace.openProject('/tmp/doesNotExist')
+    const openResult = await projectWindow.context.workspace.openProject('/tmp/doesNotExist')
     expect(openResult.success, 'opening a non-existent project must fail').toBe(false)
     expect(
-      instance.context.workspace.hasActiveSession(),
+      projectWindow.context.workspace.hasActiveSession(),
       'a failed open must leave no active session',
     ).toBe(false)
 
-    // The renderer navigated into the project screen (to show the compile
-    // failed overlay) before the open call resolved.
-    await reportScreen(instance, 'project')
-
+    // `closeProject()` is the teardown hop that must run even with nothing to
+    // close — it is what releases the window's views and editor server.
+    const closeProjectSpy = vi.spyOn(projectWindow.context.workspace, 'closeProject')
     const quitSpy = vi.mocked((await import('electron')).app.quit)
-    const destroySpy = vi.mocked(instance.mainWindow.destroy)
-    const sendSpy = vi.mocked(instance.mainWindow.webContents.send)
+    const listDestroySpy = vi.mocked(instance.mainWindow.destroy)
+    const windowDestroySpy = vi.mocked(projectWindow.window.destroy)
     quitSpy.mockClear()
-    destroySpy.mockClear()
-    sendSpy.mockClear()
+    listDestroySpy.mockClear()
+    windowDestroySpy.mockClear()
 
     const evt = makeCloseEvent()
-    emitClose(instance, evt.event)
+    emitClose(projectWindow.window, evt.event)
 
-    await new Promise((r) => setTimeout(r, 0))
     await vi.waitFor(() => {
-      expect(evt.prevented).toBeGreaterThanOrEqual(1)
-    })
+      expect(windowDestroySpy).toHaveBeenCalledTimes(1)
+    }, { timeout: 2000 })
 
     expect(
       evt.prevented,
-      'closing while stuck on the project screen (even with no session) must preventDefault exactly once',
+      'the close must be held back exactly once so teardown finishes before the window goes',
     ).toBe(1)
-    expect(quitSpy, 'the app must not quit while the renderer is on the project screen').not.toHaveBeenCalled()
-    expect(destroySpy, 'the main window must not be destroyed while the renderer is on the project screen').not.toHaveBeenCalled()
-    expect(instance.mainWindow.isDestroyed()).toBe(false)
-
-    const navigateBackCalls = sendSpy.mock.calls.filter(
-      (c) => c[0] === WindowChannel.NavigateBack,
-    )
     expect(
-      navigateBackCalls.length,
-      'the renderer must be told to navigate back to the project list',
-    ).toBeGreaterThanOrEqual(1)
+      closeProjectSpy,
+      'teardown must run even with no session — that is what releases the views and editor server',
+    ).toHaveBeenCalledTimes(1)
+    expect(quitSpy, 'closing one workbench window must never quit the application').not.toHaveBeenCalled()
+    expect(
+      listDestroySpy,
+      'the project list window must survive a workbench window closing',
+    ).not.toHaveBeenCalled()
+    expect(instance.mainWindow.isDestroyed()).toBe(false)
 
     await instance.dispose()
   })
 })
 
-describe('window close while the renderer is on the project list (no session)', () => {
+describe('project-list window close', () => {
   it('passes the close through so the app can quit', async () => {
     stubs.setProjectsJson(JSON.stringify([]))
 
     const instance = await createDevtoolsRuntime({})
     expect(instance.context.workspace.hasActiveSession()).toBe(false)
 
-    await reportScreen(instance, 'project')
-    await reportScreen(instance, 'list')
-
     const evt = makeCloseEvent()
-    emitClose(instance, evt.event)
+    emitClose(instance.mainWindow, evt.event)
 
     await new Promise((r) => setTimeout(r, 0))
 
     expect(
       evt.prevented,
-      'with the renderer back on the list screen the close must pass through so the app can quit',
+      'the list window owns no project, so its close must pass through and let the app quit',
     ).toBe(0)
 
     await instance.dispose()
diff --git a/packages/devtools/src/main/app/close-with-active-session.test.ts b/packages/devtools/src/main/app/close-with-active-session.test.ts
index bf175e9e..3818d35d 100644
--- a/packages/devtools/src/main/app/close-with-active-session.test.ts
+++ b/packages/devtools/src/main/app/close-with-active-session.test.ts
@@ -1,17 +1,19 @@
 /**
- * Behavior tests for the main BrowserWindow's `close` event while a project
+ * Behavior tests for a workbench window's `close` event while its project
  * session is active.
  *
  * Contract under test:
- *  - `event.preventDefault()` is called (the window stays open).
+ *  - `event.preventDefault()` is called, so teardown finishes before the
+ *    window goes away.
  *  - The project session is torn down — `workspace.hasActiveSession()` is
  *    false afterwards.
- *  - The renderer is notified via the `window:navigateBack` channel
- *    (i.e. `mainWindow.webContents.send('window:navigateBack')` is called).
- *  - Every IPC handler that was registered at setup time is STILL registered
- *    afterwards. The regression we guard against: a previous implementation
- *    disposed the whole IPC registry on close, leaving the renderer alive
- *    with no handlers behind it (the Import button silently broke).
+ *  - That one window is destroyed; the project-list window and the
+ *    application survive.
+ *  - Every IPC handler the application and the list window were serving
+ *    beforehand is STILL registered afterwards. The regression we guard
+ *    against: a previous implementation disposed the whole IPC registry on
+ *    close, leaving a live renderer with no handlers behind it (the Import
+ *    button silently broke).
  */
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 
@@ -187,6 +189,8 @@ vi.mock('electron', () => {
   class BrowserWindow {
     private em = stubs.makeEmitter()
     destroyed = false
+    visible = true
+    minimized = false
     webContents = new WebContents()
     contentView: View | WebContentsView = new WebContentsView()
     on = this.em.on.bind(this.em)
@@ -198,9 +202,14 @@ vi.mock('electron', () => {
     getContentSize = () => [1280, 980]
     setIcon = vi.fn()
     setTitle = vi.fn()
-    show = vi.fn()
+    show = vi.fn(() => { this.visible = true })
     showInactive = vi.fn()
     focus = vi.fn()
+    hide = vi.fn(() => { this.visible = false })
+    isVisible = () => this.visible
+    minimize = vi.fn(() => { this.minimized = true })
+    isMinimized = () => this.minimized
+    restore = vi.fn(() => { this.minimized = false })
     close = vi.fn()
     destroy = vi.fn(() => {
       this.destroyed = true
@@ -372,7 +381,7 @@ vi.mock('@dimina-kit/devkit', () => ({
 }))
 
 // ── Lazy imports ────────────────────────────────────────────────────────
-import { WindowChannel, ProjectsChannel } from '../../shared/ipc-channels.js'
+import { ProjectsChannel } from '../../shared/ipc-channels.js'
 let createDevtoolsRuntime: typeof import('./app.js').createDevtoolsRuntime
 
 beforeEach(async () => {
@@ -382,22 +391,41 @@ beforeEach(async () => {
   ;({ createDevtoolsRuntime } = await import('./app.js'))
 })
 
-describe('mainWindow close while a project session is active', () => {
-  it('calls event.preventDefault, tears down the session, and notifies window:navigateBack', async () => {
+type Instance = Awaited<ReturnType<typeof createDevtoolsRuntime>>
+type ProjectWindow = ReturnType<Instance['projectWindows']>[number]
+
+/** Opens `dir` in its own workbench window and returns that window's record. */
+async function openWorkbenchWindow(instance: Instance, dir: string): Promise<ProjectWindow> {
+  await instance.openProjectWindow({ path: dir })
+  const [projectWindow] = instance.projectWindows()
+  expect(projectWindow, 'openProjectWindow must publish the window it opened').toBeTruthy()
+  return projectWindow!
+}
+
+function emitClose(win: unknown, fakeEvent: unknown) {
+  ;(win as { emit: (event: string, ...args: unknown[]) => void }).emit('close', fakeEvent)
+}
+
+describe('workbench window close while its project session is active', () => {
+  it('calls event.preventDefault, tears down the session, and destroys that window only', async () => {
     const projectDir = '/tmp/projActive'
     stubs.projectsWithAppJson.add(projectDir)
     stubs.setProjectsJson(JSON.stringify([]))
 
     const instance = await createDevtoolsRuntime({})
+    const projectWindow = await openWorkbenchWindow(instance, projectDir)
 
-    // Open a project directly through the workspace service. Bypasses the
-    // IPC layer because what we want to set up is "a session exists".
-    const openResult = await instance.context.workspace.openProject(projectDir)
+    // Open the project directly through the window's workspace service.
+    // Bypasses the IPC layer because what we want to set up is "a session
+    // exists behind this window".
+    const openResult = await projectWindow.context.workspace.openProject(projectDir)
     expect(openResult.success).toBe(true)
-    expect(instance.context.workspace.hasActiveSession()).toBe(true)
+    expect(projectWindow.context.workspace.hasActiveSession()).toBe(true)
 
-    const sendSpy = vi.mocked(instance.mainWindow.webContents.send)
-    sendSpy.mockClear()
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    const listDestroySpy = vi.mocked(instance.mainWindow.destroy)
+    destroySpy.mockClear()
+    listDestroySpy.mockClear()
 
     // Build a fake close event that records preventDefault calls.
     let prevented = 0
@@ -408,46 +436,40 @@ describe('mainWindow close while a project session is active', () => {
     }
 
     // Fire the close event the same way Electron would.
-    ;(instance.mainWindow as unknown as {
-      emit: (event: string, ...args: unknown[]) => void
-    }).emit('close', fakeEvent)
+    emitClose(projectWindow.window, fakeEvent)
 
     // The close handler is fire-and-forget (returns void); wait for the
-    // full sequence (session teardown + renderer notification) to settle.
+    // full sequence (session teardown, then the window going away) to settle.
     await vi.waitFor(
       () => {
-        expect(instance.context.workspace.hasActiveSession()).toBe(false)
-        const calls = sendSpy.mock.calls.filter(
-          (call) => call[0] === WindowChannel.NavigateBack,
-        )
-        expect(calls.length).toBeGreaterThanOrEqual(1)
+        expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
+        expect(destroySpy).toHaveBeenCalledTimes(1)
       },
       { timeout: 2000 },
     )
 
     expect(prevented).toBe(1)
-
-    // The renderer should have been told to navigate back to the project list.
-    const navigateBackCalls = sendSpy.mock.calls.filter(
-      (call) => call[0] === WindowChannel.NavigateBack,
-    )
-    expect(navigateBackCalls).toHaveLength(1)
+    expect(
+      listDestroySpy,
+      'closing one project must not take the project list down with it',
+    ).not.toHaveBeenCalled()
+    expect(instance.mainWindow.isDestroyed()).toBe(false)
 
     await instance.dispose()
   })
 
-  it('does NOT unregister IPC handlers — every channel registered at setup time is still active afterwards', async () => {
+  it('does NOT unregister the app-level IPC handlers — every channel the list window was served by is still active afterwards', async () => {
     const projectDir = '/tmp/projActiveKeepHandlers'
     stubs.projectsWithAppJson.add(projectDir)
     stubs.setProjectsJson(JSON.stringify([]))
 
     const instance = await createDevtoolsRuntime({})
-    await instance.context.workspace.openProject(projectDir)
-    expect(instance.context.workspace.hasActiveSession()).toBe(true)
 
-    // Snapshot the live handler set at setup time. We include the critical
-    // channels by name explicitly so a regression that drops *only one* still
-    // fails this test, plus a broader "every channel that was registered".
+    // Snapshot the live handler set BEFORE any workbench window exists: this
+    // is exactly the surface the application and the project-list window own,
+    // and all of it must outlive a workbench window's close. We include the
+    // critical channels by name explicitly so a regression that drops *only
+    // one* still fails this test.
     const liveBefore = new Set(stubs.handlers.keys())
     const criticalChannels = [
       ProjectsChannel.List,
@@ -461,28 +483,35 @@ describe('mainWindow close while a project session is active', () => {
       ).toBe(true)
     }
 
+    const projectWindow = await openWorkbenchWindow(instance, projectDir)
+    await projectWindow.context.workspace.openProject(projectDir)
+    expect(projectWindow.context.workspace.hasActiveSession()).toBe(true)
+
     const removeHandlerCallsBefore = stubs.removeHandlerCalls.length
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    destroySpy.mockClear()
 
     // Fire the close event.
     const fakeEvent = { preventDefault: () => {} }
-    ;(instance.mainWindow as unknown as {
-      emit: (event: string, ...args: unknown[]) => void
-    }).emit('close', fakeEvent)
+    emitClose(projectWindow.window, fakeEvent)
 
-    // Wait for the close handler to fully resolve (session teardown is async).
+    // Wait for the close handler to fully resolve (session teardown is async,
+    // and the window is destroyed only once it finishes).
     await vi.waitFor(
       () => {
-        expect(instance.context.workspace.hasActiveSession()).toBe(false)
+        expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
+        expect(destroySpy).toHaveBeenCalledTimes(1)
       },
       { timeout: 2000 },
     )
 
-    // Every previously-live channel must still be live.
+    // Every channel that was live before the workbench window existed must
+    // still be live.
     const liveAfter = new Set(stubs.handlers.keys())
     for (const ch of liveBefore) {
       expect(
         liveAfter.has(ch),
-        `expected channel '${ch}' to remain registered after close event`,
+        `expected channel '${ch}' to remain registered after a workbench window closed`,
       ).toBe(true)
     }
 
@@ -506,11 +535,11 @@ describe('mainWindow close while a project session is active', () => {
  * LEAK-PROOFING WAVE (项目关闭时保证编译子进程同步关闭) — app/registry
  * teardown conduction.
  *
- * `instance.dispose()` (the path hosts and tests run at app shutdown,
- * backing `disposeContext`) must tear down the ACTIVE SESSION, not just the
- * IPC registry. The session's close() is the only hop that reaches devkit
- * and kills the forked compile worker — an app teardown that skips it leaks
- * one compiler process per shutdown-with-open-project.
+ * `instance.dispose()` (the path hosts and tests run at app shutdown) must
+ * tear down every open workbench window's ACTIVE SESSION, not just the IPC
+ * registry. The session's close() is the only hop that reaches devkit and
+ * kills the forked compile worker — an app teardown that skips it leaks one
+ * compiler process per shutdown-with-open-project.
  *
  * Workspace-level conduction (closeProject → session.close, open-switch,
  * rejecting close) is pinned in
@@ -518,15 +547,16 @@ describe('mainWindow close while a project session is active', () => {
  * pins the one hop above it: dispose → closeProject → session.close.
  */
 describe('instance.dispose() while a project session is active (app teardown leak guard)', () => {
-  it('dispose() closes the active devkit session exactly once and clears it', async () => {
+  it('dispose() closes the workbench window\'s active devkit session exactly once and clears it', async () => {
     const projectDir = '/tmp/projDisposeActive'
     stubs.projectsWithAppJson.add(projectDir)
     stubs.setProjectsJson(JSON.stringify([]))
 
     const instance = await createDevtoolsRuntime({})
-    const openResult = await instance.context.workspace.openProject(projectDir)
+    const projectWindow = await openWorkbenchWindow(instance, projectDir)
+    const openResult = await projectWindow.context.workspace.openProject(projectDir)
     expect(openResult.success).toBe(true)
-    expect(instance.context.workspace.hasActiveSession()).toBe(true)
+    expect(projectWindow.context.workspace.hasActiveSession()).toBe(true)
     // The open itself must not have closed anything (a fresh service's
     // pre-open disposeSession is a no-op) — baseline for the pin below.
     expect(devkitStubs.sessionClose).not.toHaveBeenCalled()
@@ -538,7 +568,7 @@ describe('instance.dispose() while a project session is active (app teardown lea
       'instance.dispose() must close the active session — this is the hop that kills the forked '
       + 'compile worker; disposing only the IPC registry leaks one compiler process per app shutdown',
     ).toHaveBeenCalledTimes(1)
-    expect(instance.context.workspace.hasActiveSession()).toBe(false)
+    expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
   })
 
   it('dispose() with no active session does not invent a session close (and stays idempotent after a real one)', async () => {
@@ -547,7 +577,8 @@ describe('instance.dispose() while a project session is active (app teardown lea
     stubs.setProjectsJson(JSON.stringify([]))
 
     const instance = await createDevtoolsRuntime({})
-    await instance.context.workspace.openProject(projectDir)
+    const projectWindow = await openWorkbenchWindow(instance, projectDir)
+    await projectWindow.context.workspace.openProject(projectDir)
 
     await instance.dispose()
     expect(devkitStubs.sessionClose).toHaveBeenCalledTimes(1)
diff --git a/packages/devtools/src/main/app/double-close-quit.test.ts b/packages/devtools/src/main/app/double-close-quit.test.ts
index b08459ab..4e425a30 100644
--- a/packages/devtools/src/main/app/double-close-quit.test.ts
+++ b/packages/devtools/src/main/app/double-close-quit.test.ts
@@ -1,25 +1,27 @@
 /**
- * DOUBLE-CLOSE RACE CONTRACT — main BrowserWindow `close` while a project
- * session is active (onClose in app.ts wireAppWindowEvents).
+ * DOUBLE-CLOSE RACE CONTRACT — a workbench window's `close` while its project
+ * session is active (the in-flight guard in workbench-window.ts).
  *
  * Bug guarded against: the user rapidly double-clicks the window close button,
- * so the main window receives TWO `close` events.
+ * so the window receives TWO `close` events.
  *
- *   - Close #1: handler calls `event.preventDefault()` (window stays open) and
- *     starts the async `closeProject()` teardown.
+ *   - Close #1: handler calls `event.preventDefault()` (the window stays until
+ *     teardown finishes) and starts the async `closeProject()` teardown.
  *   - Key timing: `closeProject()` synchronously nulls the active session
  *     (real `disposeSession` sets `currentSession = null` BEFORE awaiting
  *     `session.close()`), so `workspace.hasActiveSession()` becomes false while
  *     teardown is still in-flight (the `await session.close()` hop).
- *   - Close #2 (arrives during that await window): the CURRENT bug is the
- *     handler sees `hasActiveSession() === false`, returns early, and crucially
- *     never calls `event.preventDefault()`. The window is then destroyed →
- *     last window closed → `window-all-closed` → `app.quit()` → the whole app
- *     exits, when all the user wanted was to close one project.
+ *   - Close #2 (arrives during that await window): a handler keyed off session
+ *     presence sees `hasActiveSession() === false`, returns early, and
+ *     crucially never calls `event.preventDefault()`. Chromium then destroys
+ *     the window out from under a live teardown — and back when this was the
+ *     only window, `window-all-closed` → `app.quit()` took the whole app with
+ *     it, when all the user wanted was to close one project.
  *
- * Contract (RED until fixed): BOTH close events must be preventDefault'd; the
- * second close arriving mid-teardown must NOT let the window be destroyed and
- * must NOT cause `app.quit()`.
+ * Contract: BOTH close events must be preventDefault'd; the second close
+ * arriving mid-teardown must NOT let the window be destroyed and must NOT
+ * cause `app.quit()`. The window is destroyed exactly once, by the close
+ * handler itself, after teardown resolves.
  *
  * Timing reproduction: we replace the devkit session `close()` with a deferred
  * promise that stays pending under test control. That keeps `closeProject()`
@@ -182,6 +184,8 @@ vi.mock('electron', () => {
   class BrowserWindow {
     private em = stubs.makeEmitter()
     destroyed = false
+    visible = true
+    minimized = false
     webContents = new WebContents()
     contentView: View | WebContentsView = new WebContentsView()
     on = this.em.on.bind(this.em)
@@ -193,9 +197,14 @@ vi.mock('electron', () => {
     getContentSize = () => [1280, 980]
     setIcon = vi.fn()
     setTitle = vi.fn()
-    show = vi.fn()
+    show = vi.fn(() => { this.visible = true })
     showInactive = vi.fn()
     focus = vi.fn()
+    hide = vi.fn(() => { this.visible = false })
+    isVisible = () => this.visible
+    minimize = vi.fn(() => { this.minimized = true })
+    isMinimized = () => this.minimized
+    restore = vi.fn(() => { this.minimized = false })
     close = vi.fn()
     destroy = vi.fn(() => {
       this.destroyed = true
@@ -339,7 +348,6 @@ vi.mock('@dimina-kit/devkit', () => ({
 }))
 
 // ── Lazy imports ────────────────────────────────────────────────────────
-import { WindowChannel } from '../../shared/ipc-channels.js'
 let createDevtoolsRuntime: typeof import('./app.js').createDevtoolsRuntime
 let electron: typeof import('electron')
 
@@ -352,6 +360,9 @@ beforeEach(async () => {
   ;({ createDevtoolsRuntime } = await import('./app.js'))
 })
 
+type Instance = Awaited<ReturnType<typeof createDevtoolsRuntime>>
+type ProjectWindow = ReturnType<Instance['projectWindows']>[number]
+
 /** A close event that records how many times preventDefault was called. */
 function makeCloseEvent() {
   let prevented = 0
@@ -363,25 +374,36 @@ function makeCloseEvent() {
   }
 }
 
-async function openProject(dir: string) {
+/**
+ * Boots the app, opens `dir` in its own workbench window and establishes a live
+ * session behind it — the state a close has to tear down.
+ */
+async function openProject(dir: string): Promise<{ instance: Instance; projectWindow: ProjectWindow }> {
   stubs.projectsWithAppJson.add(dir)
   stubs.setProjectsJson(JSON.stringify([]))
   const instance = await createDevtoolsRuntime({})
-  const openResult = await instance.context.workspace.openProject(dir)
+  await instance.openProjectWindow({ path: dir })
+  const [projectWindow] = instance.projectWindows()
+  expect(projectWindow, 'openProjectWindow must publish the window it opened').toBeTruthy()
+  const openResult = await projectWindow!.context.workspace.openProject(dir)
   expect(openResult.success).toBe(true)
-  expect(instance.context.workspace.hasActiveSession()).toBe(true)
-  return instance
+  expect(projectWindow!.context.workspace.hasActiveSession()).toBe(true)
+  return { instance, projectWindow: projectWindow! }
 }
 
-function emitClose(instance: Awaited<ReturnType<typeof createDevtoolsRuntime>>, fakeEvent: unknown) {
-  ;(instance.mainWindow as unknown as {
-    emit: (event: string, ...args: unknown[]) => void
-  }).emit('close', fakeEvent)
+function emitClose(win: unknown, fakeEvent: unknown) {
+  ;(win as { emit: (event: string, ...args: unknown[]) => void }).emit('close', fakeEvent)
 }
 
 describe('double-close race: second close arriving during project teardown', () => {
   it('preventDefaults BOTH close events even though hasActiveSession() flips false mid-teardown', async () => {
-    const instance = await openProject('/tmp/projDoubleClose')
+    const { instance, projectWindow } = await openProject('/tmp/projDoubleClose')
+
+    // Teardown must run exactly once however many closes arrive: a re-entrant
+    // close is swallowed, never started as a second teardown of the same
+    // project (which would close an already-closed session and dispose the
+    // window's registry twice).
+    const closeProjectSpy = vi.spyOn(projectWindow.context.workspace, 'closeProject')
 
     // Park the teardown: closeProject() will null the session synchronously,
     // then await session.close() — which now never resolves until we say so.
@@ -394,33 +416,42 @@ describe('double-close race: second close arriving during project teardown', ()
     )
 
     const first = makeCloseEvent()
-    emitClose(instance, first.event)
+    emitClose(projectWindow.window, first.event)
 
     // First close must have preventDefault'd AND driven closeProject far enough
     // that the active session is already gone (real disposeSession nulls it
     // before awaiting close), yet the teardown is still in-flight.
     await vi.waitFor(
       () => {
-        expect(instance.context.workspace.hasActiveSession()).toBe(false)
+        expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
         expect(devkitStubs.sessionClose).toHaveBeenCalledTimes(1)
       },
       { timeout: 2000 },
     )
-    expect(first.prevented, 'first close must preventDefault to keep the window').toBe(1)
+    expect(first.prevented, 'first close must preventDefault so teardown can finish').toBe(1)
 
     // Second close arrives DURING the parked teardown — this is the race.
     const second = makeCloseEvent()
-    emitClose(instance, second.event)
+    emitClose(projectWindow.window, second.event)
 
     // The regression: handler sees hasActiveSession()===false and returns
-    // early WITHOUT preventDefault, so the window is destroyed and the app
-    // quits. The fix must keep the window alive → preventDefault here too.
+    // early WITHOUT preventDefault, so Chromium destroys the window while its
+    // teardown is still running. The fix must hold the window → preventDefault
+    // here too.
     expect(
       second.prevented,
-      'a second close while teardown is in-flight MUST also preventDefault — otherwise the '
-      + 'window is destroyed → window-all-closed → app.quit() and the whole app exits',
+      'a second close while teardown is in-flight MUST also preventDefault — otherwise Chromium '
+      + 'destroys the window out from under a live teardown',
     ).toBe(1)
 
+    // Drain a macrotask so a (wrongly) re-entered teardown would have started.
+    await new Promise((r) => setTimeout(r, 0))
+    expect(
+      closeProjectSpy,
+      'the re-entrant close must be swallowed — running teardown twice tears the same project '
+      + 'down while its first teardown is still in flight',
+    ).toHaveBeenCalledTimes(1)
+
     // Let the parked teardown finish so dispose() is clean.
     resolveClose?.()
     await vi.waitFor(() => {
@@ -431,7 +462,7 @@ describe('double-close race: second close arriving during project teardown', ()
   })
 
   it('the second close does NOT destroy the window nor quit the app', async () => {
-    const instance = await openProject('/tmp/projDoubleCloseNoQuit')
+    const { instance, projectWindow } = await openProject('/tmp/projDoubleCloseNoQuit')
 
     let resolveClose: (() => void) | undefined
     devkitStubs.sessionClose.mockImplementation(
@@ -442,44 +473,48 @@ describe('double-close race: second close arriving during project teardown', ()
     )
 
     const first = makeCloseEvent()
-    emitClose(instance, first.event)
+    emitClose(projectWindow.window, first.event)
     await vi.waitFor(
       () => {
-        expect(instance.context.workspace.hasActiveSession()).toBe(false)
+        expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
       },
       { timeout: 2000 },
     )
 
-    const destroySpy = vi.mocked(instance.mainWindow.destroy)
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    const listDestroySpy = vi.mocked(instance.mainWindow.destroy)
     const quitSpy = vi.mocked(electron.app.quit)
     destroySpy.mockClear()
+    listDestroySpy.mockClear()
     quitSpy.mockClear()
 
     const second = makeCloseEvent()
-    emitClose(instance, second.event)
+    emitClose(projectWindow.window, second.event)
 
     // Drain a macrotask so the async close handler runs.
     await new Promise((r) => setTimeout(r, 0))
 
     // In real Electron, a `close` event that is NOT preventDefault'd destroys
-    // the window → window-all-closed → app.quit(). The JS mock cannot simulate
-    // that native destroy, so the only observable proxy for "the window
-    // survives" is that the handler preventDefault'd this second close. The
-    // bug leaves it un-prevented (early return on hasActiveSession()===false),
-    // which in production is precisely what lets the window be destroyed and
-    // the app quit.
+    // the window immediately. The JS mock cannot simulate that native destroy,
+    // so the observable proxies for "the window survives its own teardown" are
+    // that the handler preventDefault'd this second close and that nothing
+    // destroyed the window while `session.close()` is still parked.
     expect(
       second.prevented,
       'the second close during teardown must be preventDefault\'d — un-prevented, real Electron '
-      + 'destroys the window → window-all-closed → app.quit()',
+      + 'destroys the window mid-teardown',
     ).toBe(1)
     expect(
-      instance.mainWindow.isDestroyed(),
-      'the main window must survive the second close during teardown',
+      projectWindow.window.isDestroyed(),
+      'the workbench window must survive until its own teardown finishes',
     ).toBe(false)
     expect(
       destroySpy,
-      'the second close must not destroy the main window mid-teardown',
+      'the second close must not destroy the window mid-teardown',
+    ).not.toHaveBeenCalled()
+    expect(
+      listDestroySpy,
+      'closing one project must never take the project list window down',
     ).not.toHaveBeenCalled()
     expect(
       quitSpy,
@@ -495,48 +530,60 @@ describe('double-close race: second close arriving during project teardown', ()
   })
 })
 
-describe('double-close: existing single-close / no-session contracts still hold', () => {
-  it('a normal single close with an active session: preventDefault once + closeProject + navigateBack', async () => {
-    const instance = await openProject('/tmp/projSingleClose')
+describe('double-close: the single-close and no-session contracts still hold', () => {
+  it('a normal single close with an active session: preventDefault once + closeProject + the window is destroyed once', async () => {
+    const { instance, projectWindow } = await openProject('/tmp/projSingleClose')
 
-    const sendSpy = vi.mocked(instance.mainWindow.webContents.send)
-    sendSpy.mockClear()
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    destroySpy.mockClear()
 
     const evt = makeCloseEvent()
-    emitClose(instance, evt.event)
+    emitClose(projectWindow.window, evt.event)
 
     await vi.waitFor(
       () => {
-        expect(instance.context.workspace.hasActiveSession()).toBe(false)
-        const calls = sendSpy.mock.calls.filter(
-          (c) => c[0] === WindowChannel.NavigateBack,
-        )
-        expect(calls.length).toBeGreaterThanOrEqual(1)
+        expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
+        expect(destroySpy).toHaveBeenCalledTimes(1)
       },
       { timeout: 2000 },
     )
 
-    expect(evt.prevented, 'a plain close-while-open stays in the workbench').toBe(1)
+    expect(evt.prevented, 'the close is held back exactly once, until teardown finishes').toBe(1)
     expect(devkitStubs.sessionClose).toHaveBeenCalledTimes(1)
 
     await instance.dispose()
   })
 
-  it('a close with NO active session is allowed through (no preventDefault) so the app can quit', async () => {
-    // Open then close so we are in the no-project state, mirroring "user closed
-    // the project, now clicks close again to exit the app".
-    const instance = await openProject('/tmp/projNoSession')
-    await instance.context.workspace.closeProject()
-    expect(instance.context.workspace.hasActiveSession()).toBe(false)
+  it('a workbench window with NO active session is still torn down, while the list window\'s close passes through', async () => {
+    // Close the project first, so the window is in the no-session state that a
+    // session-gated handler would skip teardown for.
+    const { instance, projectWindow } = await openProject('/tmp/projNoSession')
+    await projectWindow.context.workspace.closeProject()
+    expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
 
-    const evt = makeCloseEvent()
-    emitClose(instance, evt.event)
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    destroySpy.mockClear()
+
+    const workbenchEvt = makeCloseEvent()
+    emitClose(projectWindow.window, workbenchEvt.event)
+
+    await vi.waitFor(() => {
+      expect(destroySpy).toHaveBeenCalledTimes(1)
+    }, { timeout: 2000 })
+    expect(
+      workbenchEvt.prevented,
+      'teardown is unconditional: a session-less workbench window still owns views, an editor '
+      + 'server and IPC registrations, so its close is held back until they are released',
+    ).toBe(1)
 
+    // "Now close the app": that is the list window, which owns no project.
+    const listEvt = makeCloseEvent()
+    emitClose(instance.mainWindow, listEvt.event)
     await new Promise((r) => setTimeout(r, 0))
 
     expect(
-      evt.prevented,
-      'with no active session the close must pass through so quitting the app works',
+      listEvt.prevented,
+      'the list window close must pass through so quitting the app works',
     ).toBe(0)
 
     await instance.dispose()
diff --git a/packages/devtools/src/main/app/editor-view.ts b/packages/devtools/src/main/app/editor-view.ts
new file mode 100644
index 00000000..a150acda
--- /dev/null
+++ b/packages/devtools/src/main/app/editor-view.ts
@@ -0,0 +1,90 @@
+import fs from 'fs'
+import path from 'path'
+import type { CustomFileTypes, WorkbenchAppConfig } from '../../shared/types.js'
+import type { ViewManager } from '../services/views/view-manager.js'
+import type { WorkspaceService } from '../services/workspace/workspace-service.js'
+import type { DisposableRegistry } from '@dimina-kit/electron-deck/main'
+import { devtoolsPackageRoot } from '../utils/paths.js'
+import { startWorkbenchCoiServer } from '../services/workbench-coi-server.js'
+
+/** Narrow view of the context fields the embedded editor depends on. */
+export interface EditorViewContext {
+  workspace: WorkspaceService
+  fileTypes: CustomFileTypes
+  views: ViewManager
+  registry: DisposableRegistry
+}
+
+/**
+ * Embedded workbench editor — the sole devtools editor. Stands up the COI http
+ * server that serves the workbench bundle with the SharedArrayBuffer isolation
+ * headers and bridges `/__fs/*` onto the active project, then hands its base URL
+ * to the view manager so the 'editor' dock slot mounts the workbench
+ * WebContentsView. Both the server and the WCV tear down with the context
+ * registry.
+ */
+export async function setupEditorView(
+  config: WorkbenchAppConfig,
+  context: EditorViewContext,
+  getActiveAppId: () => string | null,
+): Promise<void> {
+  // Default the bundle dir to the devtools package's OWN `dist/vscode-workbench`
+  // (resolved from the package root), NOT relative to the caller's rendererDir:
+  // a host that overrides `rendererDir` but omits `editorViewConfig.bundleDir`
+  // would otherwise compute a path next to ITS renderer, where no workbench
+  // bundle exists → 404 / blank editor.
+  const bundleDir =
+    config.editorViewConfig?.bundleDir ?? path.join(devtoolsPackageRoot, 'dist/vscode-workbench')
+  // Skip the entire editor assembly when the bundle is missing. Starting the COI
+  // server and attaching the WCV against a non-existent bundle yields a silent
+  // blank editor (the WCV loads index.html → 404); a launchable app with no
+  // editor is strictly better. The view manager never gets a source, so the
+  // 'editor' slot's lazy attach is a no-op.
+  if (!fs.existsSync(path.join(bundleDir, 'index.html'))) {
+    console.warn(
+      `[workbench] editor bundle not found at ${bundleDir} — skipping embedded editor assembly`,
+    )
+    return
+  }
+
+  const coiServer = await startWorkbenchCoiServer({
+    rootDir: bundleDir,
+    getProjectRoot: () => context.workspace.getProjectPath(),
+    extensionsDir: config.editorViewConfig?.extensionsDir,
+    getFileTypes: () => context.fileTypes,
+    // Names the editor's VS Code workspace after the active miniapp, so each
+    // project gets its own open-editors/view-state bucket instead of all of
+    // them sharing the one derived from the constant mirror root.
+    getProjectIdentity: () => ({
+      appId: getActiveAppId(),
+      projectPath: context.workspace.getProjectPath(),
+    }),
+  })
+  try {
+    // Return the close promise so the registry awaits server shutdown on dispose
+    // instead of fire-and-forgetting it (a dangling http server would keep the
+    // port + event loop alive past teardown).
+    context.registry.add(() => coiServer.close())
+    // The registry disposes LIFO, so this runs BEFORE the context-level
+    // disposeAll: void any in-flight open's attach hold here too, or a stale
+    // release / cap firing could rebuild the workbench during the awaited
+    // coiServer.close() above, before disposeAll's own cancel runs.
+    context.registry.add(() => {
+      context.views.cancelWorkbenchAttachHold()
+      context.views.detachWorkbench()
+    })
+  } catch (err) {
+    // The window was torn down while the bridge was still binding, so the
+    // registry that would have closed it is already disposed and refuses new
+    // entries. Close it here instead: an orphaned route keeps the shared COI
+    // listener (and its port) alive for the rest of the process.
+    await coiServer.close().catch(() => {})
+    throw err
+  }
+  // Only HAND the view manager the COI URL — do NOT load yet. The heavy
+  // WebContentsView load (10MB bundle + ext-host) is deferred to the first time
+  // the 'editor' dock slot becomes visible (first non-zero bounds), so it never
+  // sits on the app boot critical path. Loading it eagerly here delayed
+  // preload/window-ready enough to trip the e2e launch health check.
+  context.views.setWorkbenchSource(coiServer.baseUrl)
+}
diff --git a/packages/devtools/src/main/app/global-mirrors.ts b/packages/devtools/src/main/app/global-mirrors.ts
new file mode 100644
index 00000000..7987ce5b
--- /dev/null
+++ b/packages/devtools/src/main/app/global-mirrors.ts
@@ -0,0 +1,61 @@
+import type { BrowserWindow } from 'electron'
+import type { ConsoleForwarder } from '../services/console-forward/index.js'
+import type { DiagnosticsBus } from '../services/diagnostics/index.js'
+import type { CdpSessionBroker } from '../services/cdp-session/index.js'
+import type { InternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js'
+import { createGlobalConsoleMirror } from '../services/console-forward/global-console-mirror.js'
+import { createGlobalDiagnosticsMirror } from '../services/console-forward/global-diagnostics-mirror.js'
+import { toDisposable, type DisposableRegistry } from '@dimina-kit/electron-deck/main'
+
+/** Narrow view of the context fields the two global mirrors depend on. */
+export interface GlobalMirrorContext {
+  consoleForwarder?: ConsoleForwarder
+  diagnostics?: DiagnosticsBus
+  internalDevtoolsWindow?: InternalDevtoolsWindow
+  cdpSessionBroker: CdpSessionBroker
+  registry: DisposableRegistry
+}
+
+/**
+ * Console + diagnostics mirrors into the standalone internal DevTools window.
+ *
+ * Both mirrors target the INSPECTED side — `mainWindow.webContents`, per
+ * internal-devtools-window.ts's setDevToolsWebContents relationship — and NOT
+ * the front-end host page the `onHostChanged` callback hands them.
+ */
+export function installGlobalMirrors(context: GlobalMirrorContext, mainWindow: BrowserWindow): void {
+  // While the standalone internal DevTools window is open, mirror every guest
+  // console entry (service + render, UNFILTERED — see global-console-mirror.ts)
+  // into it — each open replays the forwarder's current history buffer first
+  // (see that module's doc comment for why the subscribe lifecycle is gated on
+  // onHostChanged rather than subscribed once at construction time).
+  // `context.consoleForwarder` is assembled by the simulator module's
+  // installBridgeRouter; absent only when that builtin module was disabled via
+  // config.
+  if (context.consoleForwarder && context.internalDevtoolsWindow) {
+    const consoleMirror = createGlobalConsoleMirror(
+      context.consoleForwarder,
+      mainWindow.webContents,
+      context.internalDevtoolsWindow.onHostChanged,
+      // CDP transport (never executeJavaScript) — see the mirror's inject()
+      // doc for the setDevToolsWebContents + external-CDP double-attach hang.
+      { broker: context.cdpSessionBroker },
+    )
+    context.registry.add(toDisposable(() => consoleMirror.dispose()))
+  }
+
+  // Same wiring for diagnostics: every diagnostic — including
+  // `audience:'internal'` ones console-forward's own service-host injection
+  // now skips (see compile-standby.ts / index.ts's handleDiagnostic gate) —
+  // surfaces here instead of vanishing. `context.diagnostics` is assembled
+  // alongside `context.consoleForwarder` by the same installBridgeRouter call.
+  if (context.diagnostics && context.internalDevtoolsWindow) {
+    const diagnosticsMirror = createGlobalDiagnosticsMirror(
+      context.diagnostics,
+      mainWindow.webContents,
+      context.internalDevtoolsWindow.onHostChanged,
+      { broker: context.cdpSessionBroker },
+    )
+    context.registry.add(toDisposable(() => diagnosticsMirror.dispose()))
+  }
+}
diff --git a/packages/devtools/src/main/app/host-sidebar-default.ts b/packages/devtools/src/main/app/host-sidebar-default.ts
new file mode 100644
index 00000000..bd10b3c2
--- /dev/null
+++ b/packages/devtools/src/main/app/host-sidebar-default.ts
@@ -0,0 +1,55 @@
+import path from 'path'
+import type { ViewManager } from '../services/views/view-manager.js'
+import type { RendererNotifier } from '../services/notifications/renderer-notifier.js'
+import type { DisposableRegistry } from '@dimina-kit/electron-deck/main'
+import { HOST_SIDEBAR_DEFAULT_WIDTH } from '../../shared/constants.js'
+
+/** Narrow view of the context fields the default sidebar content depends on. */
+export interface HostSidebarContext {
+  views: ViewManager
+  notify: RendererNotifier
+  registry: DisposableRegistry
+}
+
+/**
+ * devtools' own default content for the host-sidebar slot: a narrow icon rail
+ * (logo + 小程序/小游戏 toggle) filtering the project-list grid by
+ * `Project.type`. Loaded BEFORE `config.onSetup` runs, so any downstream
+ * `loadURL`/`loadFile` call inside onSetup necessarily happens later and
+ * naturally supersedes this default via plain chronological ordering — no
+ * override flag needed.
+ */
+export function installHostSidebarDefault(context: HostSidebarContext, rendererDir: string): void {
+  context.registry.add(
+    context.views.hostSidebar.onMessage('project-category-selected', (payload) => {
+      const category = (payload as { category?: unknown } | null)?.category
+      if (category !== 'miniprogram' && category !== 'minigame') return
+      context.notify.hostSidebarCategorySelected(category)
+    }),
+  )
+  context.views.hostSidebar
+    .loadFile(path.join(rendererDir, 'entries/host-sidebar-default/index.html'))
+    .catch((err) => {
+      console.warn('[workbench] failed to load host-sidebar default content:', err)
+    })
+  // Seed the notified width with the rail's own known intrinsic width
+  // (`HOST_SIDEBAR_DEFAULT_WIDTH`) instead of leaving it at 0 until the
+  // rail's in-page advertiser reports back. That report can never arrive on
+  // its own: the placeholder above only becomes "desired visible" once a
+  // nonzero width is known (project-list-screen.tsx), attach only happens
+  // for a "desired visible" view (placement-reconciler.ts), and the rail's
+  // advertiser (view-anchor's measure-loop.ts) only ever fires via
+  // `requestAnimationFrame`, which Chromium never schedules for a
+  // WebContentsView that was never attached — a structural deadlock, not a
+  // slow-to-resolve race. `setWidthMode({fixed})` pushes the seed
+  // synchronously (no attach/rAF dependency) and, critically, retains it in
+  // `getHostSidebarWidth()` too, so a renderer that mounts and pulls before
+  // any push replays the real seed instead of a stale 0. Flipping back to
+  // 'auto' immediately after, before anything has attached or advertised, is
+  // a same-tick no-op past the seed (`setExtentMode`'s reapply branch only
+  // fires once something has actually been advertised) — it leaves the slot
+  // in 'auto' for whichever content ends up loaded (this rail's own later
+  // report, or a downstream replacement's), not pinned.
+  context.views.hostSidebar.setWidthMode({ fixed: HOST_SIDEBAR_DEFAULT_WIDTH })
+  context.views.hostSidebar.setWidthMode('auto')
+}
diff --git a/packages/devtools/src/main/app/instance-ipc-extension.test.ts b/packages/devtools/src/main/app/instance-ipc-extension.test.ts
index 25a0b194..aa1cd536 100644
--- a/packages/devtools/src/main/app/instance-ipc-extension.test.ts
+++ b/packages/devtools/src/main/app/instance-ipc-extension.test.ts
@@ -540,53 +540,53 @@ describe('Requirement B: instance.registerTrustedWindow', () => {
     ).toBe(false)
   })
 
-  // ── Registry-entry leak: the returned Disposable must be the registry wrapper ─
-  //
-  // `instance.registerTrustedWindow` does `ctx.registry.add(disposable)` but
-  // `DisposableRegistry.add()` RETURNS a wrapper — only disposing that wrapper
-  // splices the entry out of `registry.entries`. If the method returns the raw
-  // `disposable` instead of the wrapper, the host can dispose it (un-trusting
-  // the window) yet the dead registry entry lingers, accumulating until the
-  // whole context is torn down. The fix must return the wrapper so a single
-  // dispose does BOTH: un-trust the window AND drop the registry entry.
-
-  it('disposing the returned Disposable drops its ctx.registry entry (no leak)', async () => {
+  // ── App-level ownership: the trusted-sender ledger outlives any one window's
+  // context, so `registerTrustedWindow`'s Disposable is tracked at the app
+  // level rather than in `ctx.registry`. What must hold regardless of WHERE
+  // the bookkeeping lives is the observable IPC contract: a channel gated by
+  // `context.senderPolicy` (the same gate the built-in workbench IPC surface
+  // uses) accepts the window while registered and rejects it — with the
+  // IpcRegistry gate's own rejection — once disposed, and a second dispose is
+  // a safe no-op rather than resurrecting trust or throwing.
+
+  it('registerTrustedWindow(win) is accepted by a senderPolicy-gated IPC channel until disposed, and dispose is idempotent', async () => {
     const instance = await setupInstance()
+    const hostWin = new BrowserWindowMock()
     const reg = instance as unknown as {
       registerTrustedWindow: (w: import('electron').BrowserWindow) => import('@dimina-kit/electron-deck/main').Disposable
     }
-    const registry = instance.context.registry as unknown as { size: number }
 
-    // `size` is the only stable window into live registry entries — the fix
-    // adds it as a readonly getter on DisposableRegistry.
-    const baseline = registry.size
+    // Same gate shape the built-in workbench IPC surface uses (see e.g.
+    // automation/index.ts's `new IpcRegistry((sender) => getCtx().senderPolicy(sender))`).
+    const gated = new IpcRegistry((sender) => instance.context.senderPolicy(sender))
+    gated.handle('host:trust-gate', () => 'trusted-data')
+    const guarded = stubs.ipcHandlers.get('host:trust-gate')!
 
-    const hostWin = new BrowserWindowMock()
     const disposable = reg.registerTrustedWindow(hostWin)
 
-    // Registration added exactly one live entry to ctx.registry.
-    expect(
-      registry.size,
-      'registerTrustedWindow must add exactly one entry to ctx.registry',
-    ).toBe(baseline + 1)
+    // Registered: the gate resolves the channel for this window's sender.
+    await expect(
+      Promise.resolve(guarded({ sender: hostWin.webContents })),
+      'a registered window must be accepted by a senderPolicy-gated channel',
+    ).resolves.toBe('trusted-data')
 
     await disposable.dispose()
 
-    // The returned disposable must be the registry wrapper, not the RAW
-    // disposable: disposing it splices the entry out so size returns to
-    // baseline. (A raw disposable would never splice the entry, leaving a
-    // leaked dead entry at baseline+1.)
-    expect(
-      registry.size,
-      'disposing the returned Disposable must remove its ctx.registry entry — return the wrapper from registry.add(), not the raw disposable',
-    ).toBe(baseline)
+    // Disposed: the same sender is rejected, with the IpcRegistry gate's own
+    // rejection message (not a generic thrown/falsy value).
+    await expect(
+      Promise.resolve(guarded({ sender: hostWin.webContents })),
+      'a disposed registration must be rejected by the senderPolicy gate',
+    ).rejects.toThrow('IPC sender rejected for channel host:trust-gate')
 
-    // The dispose must ALSO release the underlying resource: the window is
-    // un-trusted. So the single dispose does both jobs.
-    expect(
-      instance.context.senderPolicy(hostWin.webContents),
-      'disposing the returned Disposable must also un-trust the window',
-    ).toBe(false)
+    // Idempotent: a second dispose must not throw, and must not resurrect trust.
+    await expect(
+      Promise.resolve(disposable.dispose()),
+      'disposing an already-disposed registration must be a safe no-op',
+    ).resolves.not.toThrow()
+    await expect(
+      Promise.resolve(guarded({ sender: hostWin.webContents })),
+    ).rejects.toThrow('IPC sender rejected for channel host:trust-gate')
 
     await instance.dispose()
   })
diff --git a/packages/devtools/src/main/app/instance-simulator-api.test.ts b/packages/devtools/src/main/app/instance-simulator-api.test.ts
index 78174d87..5ba79d60 100644
--- a/packages/devtools/src/main/app/instance-simulator-api.test.ts
+++ b/packages/devtools/src/main/app/instance-simulator-api.test.ts
@@ -248,10 +248,19 @@ async function setupInstance(): Promise<AppInstance & WithRegisterSimulatorApi>
   return instance as AppInstance & WithRegisterSimulatorApi
 }
 
-/** The per-context simulator registry the instance must register into. */
-function ctxRegistry(instance: AppInstance): SimulatorApiRegistry {
-  const reg = (instance.context as unknown as { simulatorApis?: SimulatorApiRegistry }).simulatorApis
-  expect(reg, 'ctx.simulatorApis must exist (Requirement A)').toBeDefined()
+/**
+ * Only a workbench (project) window ever runs a simulator, so
+ * `ctx.simulatorApis` lives on a `ProjectWindow`'s context — never on the
+ * launcher's `instance.context`. Opens a project window at a fresh path (the
+ * window manager keys windows by path, so reusing one across calls in the
+ * same test would return the existing window instead of a new one) and
+ * returns its registry.
+ */
+async function openWindowRegistry(instance: AppInstance, path: string): Promise<SimulatorApiRegistry> {
+  await instance.openProjectWindow({ path })
+  const pw = instance.projectWindows().at(-1)!
+  const reg = (pw.context as unknown as { simulatorApis?: SimulatorApiRegistry }).simulatorApis
+  expect(reg, 'ctx.simulatorApis must exist on a project window context (Requirement A)').toBeDefined()
   return reg!
 }
 
@@ -262,15 +271,16 @@ describe('Requirement B: instance.registerSimulatorApi', () => {
     await instance.dispose()
   })
 
-  it('registered handler is visible in THIS context\'s registry (list + invoke)', async () => {
+  it('an api registered before a workbench window opens is replayed into that window\'s registry (list + invoke)', async () => {
     const instance = await setupInstance()
     const handler = vi.fn((p: unknown) => ({ echoed: p }))
 
     instance.registerSimulatorApi('host.api', handler)
 
-    const reg = ctxRegistry(instance)
-    // Catches: registerSimulatorApi was a no-op, or wrote somewhere other
-    // than ctx.simulatorApis (e.g. the deleted process-global).
+    // Catches: registerSimulatorApi only reaching windows that already
+    // existed, or writing nowhere a later window can see (e.g. the deleted
+    // process-global).
+    const reg = await openWindowRegistry(instance, '/tmp/dimina-test-replay-project')
     expect(reg.list()).toContain('host.api')
 
     const result = await reg.invoke('host.api', { v: 1 })
@@ -280,106 +290,87 @@ describe('Requirement B: instance.registerSimulatorApi', () => {
     await instance.dispose()
   })
 
-  it('returns a Disposable; disposing it removes the registration', async () => {
+  it('a window already open when the api is registered sees it immediately', async () => {
     const instance = await setupInstance()
+    const reg = await openWindowRegistry(instance, '/tmp/dimina-test-live-project')
+    const handler = vi.fn(() => 'live')
+
+    // Catches: registration only replaying into FUTURE windows and skipping
+    // ones already open.
+    instance.registerSimulatorApi('live.api', handler)
+
+    expect(reg.list()).toContain('live.api')
+    await expect(reg.invoke('live.api', null)).resolves.toBe('live')
+    expect(handler).toHaveBeenCalled()
+
+    await instance.dispose()
+  })
+
+  it('returns a Disposable; disposing it removes the api from an already-open window and withholds it from windows opened afterward', async () => {
+    const instance = await setupInstance()
+
+    // The window must already be open BEFORE registration, matching the
+    // "already-open window" case above — registerSimulatorApi snapshots the
+    // currently-open windows to revoke from on dispose.
+    const regOpen = await openWindowRegistry(instance, '/tmp/dimina-test-dispose-open-project')
 
     const disposable = instance.registerSimulatorApi('temp.api', () => 'x')
     // Catches: registerSimulatorApi returning void / a bare disposer fn.
     expect(typeof disposable?.dispose, 'registerSimulatorApi must return a Disposable').toBe('function')
-
-    const reg = ctxRegistry(instance)
-    expect(reg.list()).toContain('temp.api')
+    expect(regOpen.list()).toContain('temp.api')
 
     await disposable.dispose()
 
-    // Catches: the returned Disposable is a no-op.
-    expect(reg.list()).not.toContain('temp.api')
-    await expect(reg.invoke('temp.api', null)).rejects.toThrowError(/temp\.api/)
+    // Catches: dispose only clearing the host-level map and leaving the copy
+    // already replayed into a live window's registry dangling.
+    expect(regOpen.list(), 'dispose must revoke the api from a window that already had it').not.toContain('temp.api')
+    await expect(regOpen.invoke('temp.api', null)).rejects.toThrowError(/temp\.api/)
+
+    // Catches: dispose only touching already-open windows, leaving the
+    // host-level map entry (and thus the replay-on-open path) intact.
+    const regLater = await openWindowRegistry(instance, '/tmp/dimina-test-dispose-later-project')
+    expect(regLater.list(), 'a window opened after dispose must never see the api').not.toContain('temp.api')
+
+    // Idempotent: a second dispose must not throw or resurrect the registration.
+    await expect(Promise.resolve(disposable.dispose())).resolves.not.toThrow()
+    expect(regOpen.list()).not.toContain('temp.api')
 
     await instance.dispose()
   })
 
-  it('the registration is released when the context is disposed (it joins ctx.registry)', async () => {
+  it('dispose also revokes the api from windows that got it through the open-time replay', async () => {
     const instance = await setupInstance()
-    const reg = ctxRegistry(instance)
 
-    // Never call the returned disposable — context dispose alone must clean up.
-    instance.registerSimulatorApi('ctx.scoped.api', () => 'y')
-    expect(reg.list()).toContain('ctx.scoped.api')
+    // Registration first, window second: this window receives the api through
+    // the setupWindowModules replay, NOT through the list of windows live at
+    // registration time. Catches a dispose that only walks that registration-
+    // time list, leaving every later window holding a revoked api forever.
+    const disposable = instance.registerSimulatorApi('replayed.api', () => 'x')
+    const reg = await openWindowRegistry(instance, '/tmp/dimina-test-dispose-replayed-project')
+    expect(reg.list()).toContain('replayed.api')
 
-    await instance.dispose()
+    await disposable.dispose()
 
-    // Catches: registerSimulatorApi forgot to add its disposable to
-    // ctx.registry, so context teardown leaves the handler dangling.
-    expect(
-      reg.list(),
-      'context dispose must release the registerSimulatorApi registration (it must live in ctx.registry)',
-    ).not.toContain('ctx.scoped.api')
+    expect(reg.list(), 'dispose must revoke the api from a window opened after registration').not.toContain('replayed.api')
+    await expect(reg.invoke('replayed.api', null)).rejects.toThrowError(/replayed\.api/)
+
+    await instance.dispose()
   })
 
   it('two app instances do not share simulator APIs (per-context isolation)', async () => {
     const a = await setupInstance()
     a.registerSimulatorApi('a.only', () => 'A')
+    const regA = await openWindowRegistry(a, '/tmp/dimina-test-isolation-a')
 
     const b = await setupInstance()
-
-    const regA = ctxRegistry(a)
-    const regB = ctxRegistry(b)
+    const regB = await openWindowRegistry(b, '/tmp/dimina-test-isolation-b')
 
     // The bug the old process-global caused: an API registered on one app
-    // leaking into a second app. Per-context kills it.
+    // leaking into a second app's window. Per-app-instance host map kills it.
     expect(regA.list()).toContain('a.only')
     expect(regB.list()).not.toContain('a.only')
 
     await a.dispose()
     await b.dispose()
   })
-
-  // ── Registry-entry leak: the returned Disposable must be the registry wrapper ─
-  //
-  // `instance.registerSimulatorApi` does `ctx.registry.add(disposable)` but
-  // `DisposableRegistry.add()` RETURNS a wrapper — only disposing that wrapper
-  // splices the entry out of `registry.entries`. If the method returns the raw
-  // `disposable` instead of the wrapper, the host can dispose it (removing the
-  // API) yet the dead registry entry lingers, accumulating until the whole
-  // context is torn down. The fix must return the wrapper so a single dispose
-  // does BOTH: remove the API AND drop the registry entry.
-
-  it('disposing the returned Disposable drops its ctx.registry entry (no leak)', async () => {
-    const instance = await setupInstance()
-    const reg = ctxRegistry(instance)
-    const registry = instance.context.registry as unknown as { size: number }
-
-    // `size` is the only stable window into live registry entries — the fix
-    // adds it as a readonly getter on DisposableRegistry.
-    const baseline = registry.size
-
-    const disposable = instance.registerSimulatorApi('leak.api', () => 'z')
-
-    // Registration added exactly one live entry to ctx.registry.
-    expect(
-      registry.size,
-      'registerSimulatorApi must add exactly one entry to ctx.registry',
-    ).toBe(baseline + 1)
-
-    await disposable.dispose()
-
-    // The returned disposable is the registry wrapper, not the RAW
-    // toDisposable(disposer): disposing it splices the entry out, so size
-    // returns to baseline rather than lingering at baseline+1 as a leaked
-    // dead entry.
-    expect(
-      registry.size,
-      'disposing the returned Disposable must remove its ctx.registry entry — return the wrapper from registry.add(), not the raw disposable',
-    ).toBe(baseline)
-
-    // The dispose must ALSO release the underlying resource: the API is gone.
-    // So the single dispose does both jobs.
-    expect(
-      reg.list(),
-      'disposing the returned Disposable must also remove the simulator API',
-    ).not.toContain('leak.api')
-
-    await instance.dispose()
-  })
 })
diff --git a/packages/devtools/src/main/app/internal-devtools-global-console-wiring.test.ts b/packages/devtools/src/main/app/internal-devtools-global-console-wiring.test.ts
index 28f42b05..e77c6e8b 100644
--- a/packages/devtools/src/main/app/internal-devtools-global-console-wiring.test.ts
+++ b/packages/devtools/src/main/app/internal-devtools-global-console-wiring.test.ts
@@ -9,13 +9,16 @@
  * (already implemented+tested) and internal-devtools-window/index.ts's `open()`
  * (which builds the host view attached via `target.webContents.setDevToolsWebContents`).
  *
- * `context.consoleForwarder` is assembled by the simulator module's
- * `installBridgeRouter` inside `registerBuiltinModules` (see app.ts around the
- * `if (context.consoleForwarder)` wiring block) — this suite first proves it
- * is actually truthy under the default `createDevtoolsRuntime({})` boot path
- * (a precondition for the wiring below to matter at all: if it were
- * `undefined`, the whole block would be a no-op and every test in this file
- * would trivially observe no forwarding).
+ * All of this is per-workbench-window wiring: the console forwarder is
+ * assembled by the simulator module's `installBridgeRouter`, which only runs
+ * for a window that hosts a mini app, and the internal DevTools window debugs
+ * that window's own renderer. The launcher window has neither. So every test
+ * here opens a project window first and drives ITS context (see
+ * `installGlobalMirrors`' `if (context.consoleForwarder)` block) — the suite
+ * first proves that forwarder is actually truthy there (a precondition for
+ * the wiring below to matter at all: if it were `undefined`, the whole block
+ * would be a no-op and every test in this file would trivially observe no
+ * forwarding).
  *
  * Electron mock: copied verbatim from internal-devtools-global-network-wiring.test.ts
  * (this package's convention: main-process suites vi.mock('electron') per file
@@ -261,20 +264,46 @@ function currentHostWc(): StubExecuteJavaScript {
   return lastBrowserWindow().contentView.children[0].webContents
 }
 
+type Instance = Awaited<ReturnType<typeof createDevtoolsRuntime>>
+
+interface OpenedWorkbench {
+  ctx: ConsoleForwardWiringContext
+  /**
+   * The workbench window's own renderer — the target the internal DevTools
+   * window inspects, and therefore the console mirror's destination.
+   */
+  targetWc: Electron.WebContents
+}
+
+/**
+ * Boots the app and opens one workbench window, returning its context — only a
+ * workbench window runs a simulator, so only its context carries a
+ * `consoleForwarder` and its own internal-DevTools window.
+ */
+async function openWorkbench(instance: Instance): Promise<OpenedWorkbench> {
+  await instance.openProjectWindow({ path: '/tmp/projConsoleForward' })
+  const [projectWindow] = instance.projectWindows()
+  expect(projectWindow, 'openProjectWindow must publish the window it opened').toBeTruthy()
+  return {
+    ctx: projectWindow!.context as unknown as ConsoleForwardWiringContext,
+    targetWc: projectWindow!.window.webContents,
+  }
+}
+
 describe('main-process wiring: internalDevtoolsWindow host changes drive the global console mirror', () => {
-  it('context.consoleForwarder IS assembled under the default createDevtoolsRuntime({}) boot (empirical baseline for the tests below)', async () => {
+  it('a workbench window\'s context.consoleForwarder IS assembled under the default boot (empirical baseline for the tests below)', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as ConsoleForwardWiringContext
-
-      // Empirical finding this suite locks in (verified by actually running
-      // createDevtoolsRuntime({}), not assumed): registerBuiltinModules's
-      // simulator installBridgeRouter assembles context.consoleForwarder by
-      // default, so the `if (context.consoleForwarder)` wiring block in
-      // app.ts is live (not a no-op) for this config. If this assertion ever
-      // fails, the mirror wiring below never installed a subscription at all
-      // and the remaining tests in this file would need re-checking against
-      // whatever boot path makes consoleForwarder undefined.
+      const { ctx } = await openWorkbench(instance)
+
+      // Empirical finding this suite locks in (verified by actually opening a
+      // workbench window, not assumed): the window's simulator module runs
+      // installBridgeRouter, which assembles context.consoleForwarder, so the
+      // `if (context.consoleForwarder)` block in installGlobalMirrors is live
+      // (not a no-op) for this config. If this assertion ever fails, the
+      // mirror wiring below never installed a subscription at all and the
+      // remaining tests in this file would need re-checking against whatever
+      // boot path makes consoleForwarder undefined.
       expect(ctx.consoleForwarder).toBeTruthy()
       expect(typeof ctx.consoleForwarder!.emit).toBe('function')
       expect(typeof ctx.consoleForwarder!.subscribe).toBe('function')
@@ -297,7 +326,7 @@ describe('main-process wiring: internalDevtoolsWindow host changes drive the glo
   it('does not throw when consoleForwarder emits before the internal devtools window has ever been opened', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as ConsoleForwardWiringContext
+      const { ctx } = await openWorkbench(instance)
 
       // No open() call yet — getTargetWc() must resolve to null and the
       // mirror must no-op rather than throw.
@@ -317,20 +346,21 @@ describe('main-process wiring: internalDevtoolsWindow host changes drive the glo
   // once ... disposed" further down, so this vacuous test is removed rather
   // than kept alongside it.
 
-  // Bug A: the mirror's target must be the INSPECTED side (mainWindow.webContents
-  // — see internal-devtools-window/index.ts's `target.webContents.setDevToolsWebContents(hostView.webContents)`),
+  // Bug A: the mirror's target must be the INSPECTED side (the workbench
+  // window's own webContents — see internal-devtools-window/index.ts's
+  // `target.webContents.setDevToolsWebContents(hostView.webContents)`),
   // never the independent window's own front-end host wc. A console.log executed
   // inside the front-end host's own JS realm only reaches that realm's own
   // (unwatched) console — never the Console panel it itself renders — so wiring
   // getTargetWc to follow `hostWc` makes the whole mirror invisible in practice.
-  it('mirrors console entries into mainWindow.webContents (the inspected target), not the independent host wc', async () => {
+  it('mirrors console entries into the workbench window\'s webContents (the inspected target), not the independent host wc', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as ConsoleForwardWiringContext
+      const { ctx, targetWc } = await openWorkbench(instance)
       ctx.internalDevtoolsWindow!.open()
 
       const hostWc = currentHostWc()
-      const mainWc = instance.mainWindow.webContents
+      const mainWc = targetWc
       // The mirror's transport is CDP Runtime.evaluate over the debugger
       // broker (never executeJavaScript — see global-console-mirror.ts's
       // inject() doc), so the observable is the wc's debugger channel.
@@ -357,15 +387,15 @@ describe('main-process wiring: internalDevtoolsWindow host changes drive the glo
   })
 
   // Bug A, window-open-state variant: getTargetWc must go null when the window is
-  // CLOSED (onHostChanged(null)) even though mainWindow.webContents itself is very
-  // much alive and open — the mirror is gated on "is the standalone window open",
-  // not on mainWindow's own lifecycle.
-  it('stops mirroring into mainWindow.webContents once the internal devtools window is disposed (closed), even though mainWindow itself stays alive', async () => {
+  // CLOSED (onHostChanged(null)) even though the workbench window's webContents
+  // itself is very much alive and open — the mirror is gated on "is the
+  // standalone window open", not on the workbench window's own lifecycle.
+  it('stops mirroring into the workbench window\'s webContents once the internal devtools window is disposed (closed), even though the window itself stays alive', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as ConsoleForwardWiringContext
+      const { ctx, targetWc } = await openWorkbench(instance)
       ctx.internalDevtoolsWindow!.open()
-      const mainWc = instance.mainWindow.webContents
+      const mainWc = targetWc
       type Dbg = { debugger: { sendCommand: ReturnType<typeof vi.fn> } }
       const mainSend = vi.spyOn((mainWc as unknown as Dbg).debugger, 'sendCommand')
 
diff --git a/packages/devtools/src/main/app/internal-devtools-global-network-wiring.test.ts b/packages/devtools/src/main/app/internal-devtools-global-network-wiring.test.ts
index b50df33a..fa09bc1f 100644
--- a/packages/devtools/src/main/app/internal-devtools-global-network-wiring.test.ts
+++ b/packages/devtools/src/main/app/internal-devtools-global-network-wiring.test.ts
@@ -1,5 +1,5 @@
 /**
- * `createDevtoolsRuntime` must wire `context.internalDevtoolsWindow`'s
+ * A workbench window's assembly must wire its `context.internalDevtoolsWindow`
  * `onHostChanged` subscription to `context.networkForward.setGlobalDevtoolsHost`
  * so the independent floating internal-DevTools window (once its own
  * front-end host view exists) receives the full, unfiltered CDP Network
@@ -7,6 +7,11 @@
  * implemented+tested) and internal-devtools-window/index.ts's `open()` (which
  * builds the host view attached via `target.webContents.setDevToolsWebContents`).
  *
+ * Both halves are per-window: each workbench window debugs its own renderer and
+ * forwards its own project's network traffic. The project-list window owns no
+ * simulator and therefore no forwarder at all, so this whole contract lives on
+ * a workbench window's context.
+ *
  * The subscription must be attached AFTER `context.networkForward` is
  * assigned: `internalDevtoolsWindow.onHostChanged((hostWc) => {
  * context.networkForward?.setGlobalDevtoolsHost(hostWc) })` reads
@@ -21,13 +26,13 @@
  * `context.networkForward` exists at open() time.
  *
  * `context.networkForward` is only assembled when `context.bridge?.isNativeHost()`
- * is true (see app.ts around the `createNetworkForwarder` call). EMPIRICAL
- * FINDING (verified by actually running `createDevtoolsRuntime({})` in this
- * suite, not assumed): on this branch the default boot path's bridge IS a
- * native-host bridge (native-host is the only runtime left — see
- * native-only-decommission history), so `context.networkForward` is ALWAYS
- * assembled (truthy) for `createDevtoolsRuntime({})`, no special adapter
- * config needed. This suite therefore asserts the wiring's real
+ * is true (see window-runtime-services.ts around the `createNetworkForwarder`
+ * call). EMPIRICAL FINDING (verified by actually opening a workbench window in
+ * this suite, not assumed): the default boot path's bridge IS a native-host
+ * bridge (native-host is the only runtime left — see native-only-decommission
+ * history), so `context.networkForward` is ALWAYS assembled (truthy) for a
+ * workbench window opened out of `createDevtoolsRuntime({})`, no special
+ * adapter config needed. This suite therefore asserts the wiring's real
  * value-passing end-to-end against the REAL `NetworkForwarder` instance
  * (spied via `vi.spyOn`, not a hand-rolled stub — replacing
  * `context.networkForward` with an incomplete fake object breaks unrelated
@@ -238,18 +243,33 @@ interface NetworkForwardWiringContext {
   }
 }
 
+type Instance = Awaited<ReturnType<typeof createDevtoolsRuntime>>
+
+/**
+ * Boots the app and opens one workbench window, returning its context — the
+ * only context that owns a simulator, and therefore a network forwarder.
+ */
+async function openWorkbenchContext(
+  instance: Instance,
+): Promise<NetworkForwardWiringContext> {
+  await instance.openProjectWindow({ path: '/tmp/projNetworkForward' })
+  const [projectWindow] = instance.projectWindows()
+  expect(projectWindow, 'openProjectWindow must publish the window it opened').toBeTruthy()
+  return projectWindow!.context as unknown as NetworkForwardWiringContext
+}
+
 describe('main-process wiring: internalDevtoolsWindow host changes drive networkForward.setGlobalDevtoolsHost', () => {
-  it('context.networkForward IS assembled under the default createDevtoolsRuntime({}) boot (empirical baseline for the tests below)', async () => {
+  it('a workbench window\'s context.networkForward IS assembled under the default boot (empirical baseline for the tests below)', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as NetworkForwardWiringContext
-
-      // Empirical finding this suite locks in (verified by actually running
-      // createDevtoolsRuntime({}), not assumed): on this branch the default
-      // bridge is native-host, so context.networkForward is truthy without
-      // any special adapter config. If this assertion starts failing, the
-      // default assembly path changed — the two tests below (which spy on
-      // the REAL networkForward instance) would need re-checking.
+      const ctx = await openWorkbenchContext(instance)
+
+      // Empirical finding this suite locks in (verified by actually opening a
+      // workbench window, not assumed): the default bridge is native-host, so
+      // the window's context.networkForward is truthy without any special
+      // adapter config. If this assertion starts failing, the window assembly
+      // path changed — the two tests below (which spy on the REAL
+      // networkForward instance) would need re-checking.
       expect(ctx.networkForward).toBeTruthy()
       expect(typeof ctx.networkForward!.setGlobalDevtoolsHost).toBe('function')
     } finally {
@@ -260,14 +280,14 @@ describe('main-process wiring: internalDevtoolsWindow host changes drive network
   it('context.internalDevtoolsWindow.open() does not throw regardless of whether networkForward is wired up', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as NetworkForwardWiringContext
+      const ctx = await openWorkbenchContext(instance)
 
       // Guards the optional-chaining wiring: `context.networkForward?.setGlobalDevtoolsHost(...)`
-      // must not throw. On this branch's default boot networkForward is
-      // actually assembled (see the baseline test above), so this mainly
-      // guards against the wiring itself throwing — a real undefined case
-      // would additionally need a boot path without native-host, which was
-      // not found under `createDevtoolsRuntime({})`.
+      // must not throw. On a workbench window networkForward is actually
+      // assembled (see the baseline test above), so this mainly guards against
+      // the wiring itself throwing — a real undefined case would additionally
+      // need a boot path without native-host, which was not found under
+      // `createDevtoolsRuntime({})`.
       expect(() => ctx.internalDevtoolsWindow!.open()).not.toThrow()
     } finally {
       await instance.dispose()
@@ -277,11 +297,11 @@ describe('main-process wiring: internalDevtoolsWindow host changes drive network
   it('forwards the fresh host webContents to the REAL networkForward.setGlobalDevtoolsHost on open()', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as NetworkForwardWiringContext
-      // Spy on the method of the REAL NetworkForwarder assembled by boot —
-      // not a hand-rolled stub swapped into context.networkForward, which
-      // would break unrelated teardown code (disposeProjectViews expects the
-      // full NetworkForwarder shape, e.g. detachSimulator).
+      const ctx = await openWorkbenchContext(instance)
+      // Spy on the method of the REAL NetworkForwarder assembled with the
+      // window — not a hand-rolled stub swapped into context.networkForward,
+      // which would break unrelated teardown code (disposeProjectViews expects
+      // the full NetworkForwarder shape, e.g. detachSimulator).
       const spy = vi.spyOn(ctx.networkForward!, 'setGlobalDevtoolsHost')
 
       ctx.internalDevtoolsWindow!.open()
@@ -297,7 +317,7 @@ describe('main-process wiring: internalDevtoolsWindow host changes drive network
   it('forwards null to the REAL networkForward.setGlobalDevtoolsHost when the internal devtools window closes', async () => {
     const instance = await createDevtoolsRuntime({})
     try {
-      const ctx = instance.context as unknown as NetworkForwardWiringContext
+      const ctx = await openWorkbenchContext(instance)
       const spy = vi.spyOn(ctx.networkForward!, 'setGlobalDevtoolsHost')
 
       ctx.internalDevtoolsWindow!.open()
diff --git a/packages/devtools/src/main/app/main-window-close-guard.test.ts b/packages/devtools/src/main/app/main-window-close-guard.test.ts
new file mode 100644
index 00000000..fad00463
--- /dev/null
+++ b/packages/devtools/src/main/app/main-window-close-guard.test.ts
@@ -0,0 +1,104 @@
+/**
+ * LIST-WINDOW CLOSE GUARD (per-project-window architecture).
+ *
+ * The project-list window is the app's only way back to the project list,
+ * and it registers app-level IPC that cannot be registered a second time on
+ * a replacement window (see app.ts's `registerWorkbenchIpc`). So while any
+ * project window is open, closing the list window must NOT destroy it: the
+ * close is intercepted and the window is hidden instead — `revealWindow`
+ * (see `workbench-window-reveal-on-close.test.ts`) is the only way back.
+ *
+ * Two cases must NOT be intercepted, or the app becomes unclosable:
+ *  - no project window is open (there is nothing left to come back to);
+ *  - a real application quit is already underway (`isAppQuitting()`), where
+ *    intercepting would swallow ⌘Q / menu Quit and strand the process.
+ *
+ * Harness (electron/fs/devkit mocks + `createDevtoolsRuntime` lifecycle) is
+ * shared with `workbench-window-reveal-on-close.test.ts` via
+ * `window-close-reveal.harness.ts`.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  openProjectWindow,
+  makeCloseEvent,
+  emitClose,
+} from './window-close-reveal.harness.js'
+
+const state = registerRuntimeTestLifecycle()
+
+describe('list window close guard', () => {
+  it('with a project window open, close is intercepted: the window hides instead of being destroyed, and its context stays live', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    await openProjectWindow(instance, '/tmp/projGuardA')
+    expect(instance.projectWindows().length).toBe(1)
+
+    const disposeSpy = vi.spyOn(instance.context.registry, 'dispose')
+    const destroySpy = vi.mocked(instance.mainWindow.destroy)
+    const hideSpy = vi.mocked(instance.mainWindow.hide)
+
+    const { event, prevented } = makeCloseEvent()
+    emitClose(instance.mainWindow, event)
+    // Drain a macrotask so a (buggy) async teardown would have run by now.
+    await new Promise((r) => setTimeout(r, 0))
+
+    expect(
+      prevented(),
+      'a project is still open — closing the list window must not let it be destroyed, or the user loses the only way back to the project list',
+    ).toBe(true)
+    expect(hideSpy, 'the window must hide, not merely stay open untouched').toHaveBeenCalledTimes(1)
+    expect(destroySpy).not.toHaveBeenCalled()
+    expect(
+      disposeSpy,
+      'an intercepted close must not tear down the app-level IPC this window owns — it cannot be re-registered on a replacement window',
+    ).not.toHaveBeenCalled()
+
+    await instance.dispose()
+  })
+
+  it('with no project window open, close is NOT intercepted and really disposes the window (or the app could never quit)', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    expect(instance.projectWindows().length).toBe(0)
+
+    const disposeSpy = vi.spyOn(instance.context.registry, 'dispose')
+    const hideSpy = vi.mocked(instance.mainWindow.hide)
+
+    const { event, prevented } = makeCloseEvent()
+    emitClose(instance.mainWindow, event)
+    await vi.waitFor(() => {
+      expect(disposeSpy).toHaveBeenCalledTimes(1)
+    })
+
+    expect(
+      prevented(),
+      'nothing is open behind the list window — its close must go through untouched',
+    ).toBe(false)
+    expect(hideSpy).not.toHaveBeenCalled()
+  })
+
+  it('once a real quit is underway (before-quit fired), close is NOT intercepted even with a project window still open', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    await openProjectWindow(instance, '/tmp/projGuardC')
+    expect(instance.projectWindows().length).toBe(1)
+
+    state.registerAppLifecycle()
+    ;(state.electron.app as unknown as { emit: (e: string, ...a: unknown[]) => void }).emit(
+      'before-quit',
+      { preventDefault: () => {} },
+    )
+    expect(state.isAppQuitting()).toBe(true)
+
+    const hideSpy = vi.mocked(instance.mainWindow.hide)
+    const { event, prevented } = makeCloseEvent()
+    emitClose(instance.mainWindow, event)
+    await new Promise((r) => setTimeout(r, 0))
+
+    expect(
+      prevented(),
+      '⌘Q must not be swallowed by the "keep the list window alive" guard, or the app can never exit with a project open',
+    ).toBe(false)
+    expect(hideSpy).not.toHaveBeenCalled()
+
+    await instance.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/app/menu-active-project-context.test.ts b/packages/devtools/src/main/app/menu-active-project-context.test.ts
new file mode 100644
index 00000000..dfd846ee
--- /dev/null
+++ b/packages/devtools/src/main/app/menu-active-project-context.test.ts
@@ -0,0 +1,102 @@
+/**
+ * The menu drives the project the user is actually in.
+ *
+ * A project lives in its own window while the project list stays open, so a
+ * menu item like "关闭当前项目" or "读取当前 session" must resolve the active
+ * project window every time it runs. Binding the menu to one context at
+ * install time pins it to the list window forever: `hasActiveSession()` is
+ * then always false, `getProjectPath()` always empty, and `closeProject()`
+ * never reaches the project the user is looking at.
+ *
+ * The menu is installed once, before any project window exists, so this is a
+ * per-call resolution — not a snapshot taken at install time.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import type { MenuContext } from '../../shared/types.js'
+import { registerRuntimeTestLifecycle, openProjectWindow } from './window-close-reveal.harness.js'
+
+const state = registerRuntimeTestLifecycle()
+
+async function bootWithMenu(): Promise<{
+  instance: Awaited<ReturnType<typeof state.createDevtoolsRuntime>>
+  menu: MenuContext
+}> {
+  let captured: MenuContext | undefined
+  const instance = await state.createDevtoolsRuntime({
+    menuBuilder: (_window, menuContext) => { captured = menuContext },
+  })
+  expect(captured, 'setup: menuBuilder must receive the menu context').toBeDefined()
+  return { instance, menu: captured! }
+}
+
+describe('the workspace a host menu builder drives', () => {
+  it('follows the active project window instead of staying on the project list', async () => {
+    const { instance, menu } = await bootWithMenu()
+
+    expect(
+      menu.workspace.getProjectPath(),
+      'with no project open the list window answers, and it owns no project',
+    ).toBe('')
+
+    const first = await openProjectWindow(instance, '/tmp/menuActiveA')
+    first.context.workspace.getProjectPath = () => '/tmp/menuActiveA'
+    first.context.workspace.hasActiveSession = () => true
+
+    expect(
+      menu.workspace.getProjectPath(),
+      'a menu item must read the project the user has open, not the empty list window',
+    ).toBe('/tmp/menuActiveA')
+    expect(
+      menu.workspace.hasActiveSession(),
+      'a session-gated menu item must stay enabled while a project window is open',
+    ).toBe(true)
+
+    const second = await openProjectWindow(instance, '/tmp/menuActiveB')
+    second.context.workspace.getProjectPath = () => '/tmp/menuActiveB'
+
+    expect(
+      menu.workspace.getProjectPath(),
+      'opening a second project moves the menu onto it — the menu is installed only once',
+    ).toBe('/tmp/menuActiveB')
+
+    await instance.dispose()
+  })
+
+  it('closes the active project window, not the project list session', async () => {
+    const { instance, menu } = await bootWithMenu()
+    const listClose = vi.fn(async () => {})
+    instance.context.workspace.closeProject = listClose
+
+    const projectWindow = await openProjectWindow(instance, '/tmp/menuActiveClose')
+    const projectClose = vi.fn(async () => {})
+    projectWindow.context.workspace.closeProject = projectClose
+
+    await menu.workspace.closeProject()
+
+    expect(projectClose, '"关闭当前项目" must reach the open project window').toHaveBeenCalledTimes(1)
+    expect(listClose, 'the project list owns no session to close').not.toHaveBeenCalled()
+
+    await instance.dispose()
+  })
+
+  it('keeps a host monkey-patch of the active window openProject interceptable', async () => {
+    const { instance, menu } = await bootWithMenu()
+    const projectWindow = await openProjectWindow(instance, '/tmp/menuActivePatch')
+
+    const intercepted: string[] = []
+    projectWindow.context.workspace.openProject = async (projectPath: string) => {
+      intercepted.push(projectPath)
+      return { success: false, error: 'denied by host' }
+    }
+
+    const result = await menu.workspace.openProject('/tmp/other')
+
+    expect(
+      intercepted,
+      'the documented permission-gate pattern patches the live context, so the menu must read it per call',
+    ).toEqual(['/tmp/other'])
+    expect(result).toMatchObject({ success: false, error: 'denied by host' })
+
+    await instance.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/app/menu-setup-reveal-project-list.test.ts b/packages/devtools/src/main/app/menu-setup-reveal-project-list.test.ts
new file mode 100644
index 00000000..f9e767a9
--- /dev/null
+++ b/packages/devtools/src/main/app/menu-setup-reveal-project-list.test.ts
@@ -0,0 +1,103 @@
+/**
+ * "打开项目" in the menu must bring the PROJECT-LIST window forward, not
+ * whatever window `activeContext()` currently resolves to. `activeContext()`
+ * tracks the focused project window while one is open, so routing the click
+ * through `activeContext().notify.windowNavigateBack()` sends the refresh
+ * notification to the project window itself instead of the list. `installMenu`
+ * takes an injected `revealProjectList` for this exact purpose — the menu
+ * must call it, and must stop reaching into `activeContext()` for this item.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import type { BrowserWindow } from 'electron'
+import type { MenuContext, WorkbenchAppConfig } from '../../shared/types.js'
+import { installMenu as installMenuUntyped, type MenuHostContext } from './menu-setup.js'
+
+// menu-setup.ts pulls in `../menu/index.js`, which imports `Menu` from
+// 'electron' at module load time even though a host `menuBuilder` (used
+// below) bypasses it at runtime — so the module still needs to resolve.
+vi.mock('electron', () => ({
+  Menu: { buildFromTemplate: vi.fn(), setApplicationMenu: vi.fn() },
+}))
+
+// `installMenu` does not take a `revealProjectList` parameter yet — that is
+// exactly the contract this suite is pinning ahead of the fix. Typing the
+// call against the post-fix signature (rather than loosening it to `any`)
+// keeps every other argument checked, and lets the extra argument through
+// as a plain no-op on today's implementation instead of a type error.
+type InstallMenuAfterFix = (
+  config: WorkbenchAppConfig,
+  mainWindow: BrowserWindow,
+  activeContext: () => MenuHostContext,
+  revealProjectList: () => void,
+) => void
+const installMenu = installMenuUntyped as unknown as InstallMenuAfterFix
+
+function makeActiveContext(): { activeContext: () => MenuHostContext; activeNotifyBack: ReturnType<typeof vi.fn> } {
+  const activeNotifyBack = vi.fn()
+  const ctx = {
+    appName: 'Test',
+    workspace: {
+      hasActiveSession: () => false,
+      getProjectPath: () => '',
+      openProject: async () => ({ success: true }),
+      closeProject: async () => {},
+      getSession: () => null,
+    },
+    openSettings: async () => {},
+    notify: {
+      projectStatus: () => {},
+      windowNavigateBack: activeNotifyBack,
+    },
+  } as unknown as MenuHostContext
+  return { activeContext: () => ctx, activeNotifyBack }
+}
+
+// Today's (unfixed) `windowNavigateBack` closure still calls
+// `revealWindow(listWindow)` before reaching `activeContext()`, so
+// `mainWindow` needs real no-op window methods — a bare `{}` would throw
+// inside `revealWindow` and mask the assertions this suite exists to make.
+function makeMainWindow(): BrowserWindow {
+  return {
+    isDestroyed: () => false,
+    isMinimized: () => false,
+    restore: vi.fn(),
+    show: vi.fn(),
+    focus: vi.fn(),
+  } as unknown as BrowserWindow
+}
+
+function captureMenuContext(revealProjectList: () => void, activeContext: () => MenuHostContext): MenuContext {
+  let captured: MenuContext | undefined
+  const config: WorkbenchAppConfig = {
+    menuBuilder: (_win, menuContext) => { captured = menuContext },
+  }
+  const mainWindow = makeMainWindow()
+  installMenu(config, mainWindow, activeContext, revealProjectList)
+  expect(captured, 'setup: menuBuilder must receive the menu context').toBeDefined()
+  return captured!
+}
+
+describe('installMenu "back to project list" routes through the injected surface', () => {
+  it('calls the injected revealProjectList exactly once per click', () => {
+    const { activeContext } = makeActiveContext()
+    const revealProjectList = vi.fn()
+    const menu = captureMenuContext(revealProjectList, activeContext)
+
+    menu.notify.windowNavigateBack()
+
+    expect(revealProjectList).toHaveBeenCalledTimes(1)
+  })
+
+  it('no longer notifies the active window\'s own context — that context may be a project window, not the list', () => {
+    const { activeContext, activeNotifyBack } = makeActiveContext()
+    const revealProjectList = vi.fn()
+    const menu = captureMenuContext(revealProjectList, activeContext)
+
+    menu.notify.windowNavigateBack()
+
+    expect(
+      activeNotifyBack,
+      'routing through activeContext() sends the refresh to whatever window is focused, not the list',
+    ).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/devtools/src/main/app/menu-setup.ts b/packages/devtools/src/main/app/menu-setup.ts
new file mode 100644
index 00000000..00beb5d5
--- /dev/null
+++ b/packages/devtools/src/main/app/menu-setup.ts
@@ -0,0 +1,69 @@
+import type { BrowserWindow } from 'electron'
+import type { MenuContext, WorkbenchAppConfig } from '../../shared/types.js'
+import type { WorkspaceService } from '../services/workspace/workspace-service.js'
+import type { RendererNotifier } from '../services/notifications/renderer-notifier.js'
+import { installAppMenu } from '../menu/index.js'
+
+/** Narrow view of the context fields the menu surface closes over. */
+export interface MenuHostContext {
+  appName: string
+  workspace: WorkspaceService
+  openSettings: () => Promise<void>
+  notify: RendererNotifier
+}
+
+/**
+ * Build the hand-written narrow `MenuContext` a host menu builder receives —
+ * explicit construction (not clone+delete), so the runtime object carries
+ * EXACTLY the contract members and nothing else. Every member is a lazy
+ * closure over the live context: a host monkey-patch of
+ * `context.workspace.openProject` (the documented permission-gate pattern)
+ * still intercepts calls made through this menu surface.
+ *
+ * The context is resolved per call, never captured: the menu is installed once
+ * before any project exists, and a project lives in its own window, so a menu
+ * item run later must reach the window the user is actually in.
+ */
+function toMenuContext(
+  activeContext: () => MenuHostContext,
+  revealProjectList: () => void,
+): MenuContext {
+  return {
+    get appName() { return activeContext().appName },
+    workspace: {
+      hasActiveSession: () => activeContext().workspace.hasActiveSession(),
+      getProjectPath: () => activeContext().workspace.getProjectPath(),
+      openProject: (projectPath) => activeContext().workspace.openProject(projectPath),
+      closeProject: () => activeContext().workspace.closeProject(),
+      getSession: () => activeContext().workspace.getSession(),
+    },
+    openSettings: () => activeContext().openSettings(),
+    notify: {
+      projectStatus: (payload) => activeContext().notify.projectStatus(payload),
+      // A project opens in its own window, so "back to the project list" is
+      // no longer a screen change inside one window — it brings the list
+      // window forward. That window owns its own context, which may not be
+      // `activeContext()` (a project window can be the active one), so this
+      // routes through the injected surface instead of notifying whatever is
+      // currently active.
+      windowNavigateBack: () => revealProjectList(),
+    },
+  }
+}
+
+export function installMenu(
+  config: WorkbenchAppConfig,
+  mainWindow: BrowserWindow,
+  activeContext: () => MenuHostContext,
+  revealProjectList: () => void,
+): void {
+  // Menu: use host-provided builder or fall back to default. Both consume the
+  // same narrow MenuContext, so the built-in menu proves the hand-written
+  // contract covers the real internal consumption.
+  const menuContext = toMenuContext(activeContext, revealProjectList)
+  if (config.menuBuilder) {
+    config.menuBuilder(mainWindow, menuContext)
+  } else {
+    installAppMenu(menuContext)
+  }
+}
diff --git a/packages/devtools/src/main/app/open-project-ipc.ts b/packages/devtools/src/main/app/open-project-ipc.ts
new file mode 100644
index 00000000..d29b8da1
--- /dev/null
+++ b/packages/devtools/src/main/app/open-project-ipc.ts
@@ -0,0 +1,28 @@
+import { WindowChannel } from '../../shared/ipc-channels.js'
+import type { IpcContextSource } from '../utils/ipc-context-source.js'
+import { IpcRegistry } from '../utils/ipc-registry.js'
+import type { ProjectRef } from './project-window.js'
+
+/**
+ * Opening a project from the list — and from MCP's project_open, which the
+ * list renderer forwards here — always means "give it its own window", so the
+ * channel does nothing but hand the request to the workbench window manager.
+ *
+ * Generic over the context type: the handler never touches the context, and
+ * naming it would drag `WorkbenchContext` into this module.
+ */
+export function registerOpenProjectWindowIpc<TCtx>(
+  router: IpcContextSource<TCtx>,
+  open: (project: ProjectRef) => Promise<unknown>,
+): IpcRegistry<TCtx> {
+  const windowIpc = new IpcRegistry<TCtx>(router)
+  windowIpc.handleRouted(
+    WindowChannel.OpenProjectWindow,
+    async (_ctx, _event, ...args: unknown[]) => {
+      const project = args[0] as ProjectRef | undefined
+      if (!project?.path) throw new Error('openProjectWindow requires a project path')
+      await open({ path: project.path, name: project.name })
+    },
+  )
+  return windowIpc
+}
diff --git a/packages/devtools/src/main/app/project-list-surface.test.ts b/packages/devtools/src/main/app/project-list-surface.test.ts
new file mode 100644
index 00000000..c82fef2e
--- /dev/null
+++ b/packages/devtools/src/main/app/project-list-surface.test.ts
@@ -0,0 +1,118 @@
+/**
+ * "回到项目列表" and the update dialog both belong to the project-list
+ * window — never to whichever window happens to be `activeContext()` at
+ * call time. `createProjectListSurface` is the single place both flows
+ * route through: `revealProjectList()` brings the list window forward and
+ * tells its OWN context to refresh, and `showUpdate()` reveals the list
+ * window before showing the dialog so a hidden list window never eats an
+ * update prompt no one can see.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import type { BrowserWindow } from 'electron'
+import type { UpdateInfo } from '../../shared/types.js'
+import { createProjectListSurface } from './project-list-surface.js'
+
+interface FakeWindow {
+  isDestroyed: () => boolean
+  isMinimized: () => boolean
+  restore: ReturnType<typeof vi.fn>
+  show: ReturnType<typeof vi.fn>
+  focus: ReturnType<typeof vi.fn>
+}
+
+function makeWindow(state: { destroyed?: boolean; minimized?: boolean } = {}): FakeWindow {
+  return {
+    isDestroyed: () => state.destroyed ?? false,
+    isMinimized: () => state.minimized ?? false,
+    restore: vi.fn(),
+    show: vi.fn(),
+    focus: vi.fn(),
+  }
+}
+
+function makeSurface(window: FakeWindow, calls: string[] = []) {
+  const windowNavigateBack = vi.fn(() => { calls.push('reveal') })
+  const showUpdateDialog = vi.fn((_info: UpdateInfo) => { calls.push('dialog') })
+  const surface = createProjectListSurface({
+    window: window as unknown as BrowserWindow,
+    context: {
+      notify: { windowNavigateBack },
+      views: { showUpdateDialog },
+    },
+  })
+  return { surface, windowNavigateBack, showUpdateDialog, calls }
+}
+
+describe('createProjectListSurface.revealProjectList', () => {
+  it('shows and focuses a hidden list window without restoring it', () => {
+    const window = makeWindow()
+    const { surface, windowNavigateBack } = makeSurface(window)
+
+    surface.revealProjectList()
+
+    expect(window.restore, 'not minimized, so restore() must not run').not.toHaveBeenCalled()
+    expect(window.show).toHaveBeenCalledTimes(1)
+    expect(window.focus).toHaveBeenCalledTimes(1)
+    expect(windowNavigateBack, 'the list window\'s own context must be told to refresh').toHaveBeenCalledTimes(1)
+  })
+
+  it('restores a minimized list window before showing and focusing it', () => {
+    const window = makeWindow({ minimized: true })
+    const { surface } = makeSurface(window)
+
+    surface.revealProjectList()
+
+    expect(window.restore).toHaveBeenCalledTimes(1)
+    expect(window.show).toHaveBeenCalledTimes(1)
+    expect(window.focus).toHaveBeenCalledTimes(1)
+  })
+
+  it('still notifies the list context but skips show/focus/restore on a destroyed window', () => {
+    const window = makeWindow({ destroyed: true })
+    const { surface, windowNavigateBack } = makeSurface(window)
+
+    expect(() => surface.revealProjectList()).not.toThrow()
+
+    expect(window.restore).not.toHaveBeenCalled()
+    expect(window.show).not.toHaveBeenCalled()
+    expect(window.focus).not.toHaveBeenCalled()
+    expect(windowNavigateBack).toHaveBeenCalledTimes(1)
+  })
+
+  it('reveals and notifies exactly once per call, not once per surface', () => {
+    const window = makeWindow()
+    const { surface, windowNavigateBack } = makeSurface(window)
+
+    surface.revealProjectList()
+    surface.revealProjectList()
+
+    expect(window.show).toHaveBeenCalledTimes(2)
+    expect(windowNavigateBack).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('createProjectListSurface.showUpdate', () => {
+  it('reveals the list window before showing the update dialog, with the same info object', () => {
+    const window = makeWindow()
+    const calls: string[] = []
+    const { surface, showUpdateDialog } = makeSurface(window, calls)
+    const info: UpdateInfo = { version: '2.0.0', downloadUrl: 'https://example.com/2.0.0.dmg' }
+
+    surface.showUpdate(info)
+
+    expect(calls, 'reveal must happen before the dialog, or a hidden window eats the prompt').toEqual(['reveal', 'dialog'])
+    expect(showUpdateDialog).toHaveBeenCalledTimes(1)
+    expect(showUpdateDialog.mock.calls[0][0], 'the dialog must receive the exact info object, not a copy').toBe(info)
+  })
+
+  it('brings a hidden list window forward as part of showing the update', () => {
+    const window = makeWindow()
+    const { surface } = makeSurface(window)
+    const info: UpdateInfo = { version: '3.1.0', downloadUrl: 'https://example.com/3.1.0.dmg' }
+
+    surface.showUpdate(info)
+
+    expect(window.show, 'the update dialog is useless if the window that hosts it stays hidden').toHaveBeenCalledTimes(1)
+    expect(window.focus).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/packages/devtools/src/main/app/project-list-surface.ts b/packages/devtools/src/main/app/project-list-surface.ts
new file mode 100644
index 00000000..7fbcb3ca
--- /dev/null
+++ b/packages/devtools/src/main/app/project-list-surface.ts
@@ -0,0 +1,45 @@
+import type { BrowserWindow } from 'electron'
+import type { UpdateInfo } from '../../shared/types.js'
+import { revealWindow } from './window-events.js'
+
+/**
+ * Narrow view of the context fields the project-list surface closes over —
+ * structural, not `WorkbenchContext` (see eslint-workbench-context-gate) —
+ * so the surface carries no dependency on the whole workbench.
+ */
+export interface ProjectListSurfaceContext {
+  notify: { windowNavigateBack: () => void }
+  views: { showUpdateDialog: (info: UpdateInfo) => void }
+}
+
+export interface ProjectListSurfaceDeps {
+  window: BrowserWindow
+  context: ProjectListSurfaceContext
+}
+
+export interface ProjectListSurface {
+  revealProjectList: () => void
+  showUpdate: (info: UpdateInfo) => void
+}
+
+/**
+ * "回到项目列表" 和更新弹窗都属于列表窗口本身，而不是当时 activeContext() 恰好
+ * 解析到的窗口——那个窗口可能是某个项目工作台。这里是两条路径共同的入口：
+ * revealProjectList 把列表窗口带到前台并通知它自己的 context 刷新；showUpdate
+ * 先做同一件事，再弹更新对话框，避免窗口还处于 hide() 状态时用户看不到弹窗。
+ */
+export function createProjectListSurface(deps: ProjectListSurfaceDeps): ProjectListSurface {
+  const { window, context } = deps
+
+  const revealProjectList = (): void => {
+    revealWindow(window)
+    context.notify.windowNavigateBack()
+  }
+
+  const showUpdate = (info: UpdateInfo): void => {
+    revealProjectList()
+    context.views.showUpdateDialog(info)
+  }
+
+  return { revealProjectList, showUpdate }
+}
diff --git a/packages/devtools/src/main/app/project-window-auto-show.test.ts b/packages/devtools/src/main/app/project-window-auto-show.test.ts
new file mode 100644
index 00000000..96219c28
--- /dev/null
+++ b/packages/devtools/src/main/app/project-window-auto-show.test.ts
@@ -0,0 +1,82 @@
+/**
+ * PROJECT-WINDOW VISIBILITY CONTRACT.
+ *
+ * A project window is now ALWAYS created hidden (`autoShow: false` into
+ * `createMainWindow`) — `workbench-window.ts`'s reveal gate is the only thing
+ * that ever shows it, once `setupProjectWindow` has resolved AND the
+ * renderer's own `ready-to-show` has fired. `config.projectWindow.autoShow`
+ * no longer reaches `createMainWindow` at all; the reveal gate reads it
+ * instead (see `workbench-window-show-after-setup-hook.test.ts`).
+ *
+ * The project-LIST window is unaffected: `config.window.autoShow` still goes
+ * straight into `createMainWindow` for `createLauncherWindow`, independent of
+ * anything under `config.projectWindow`.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import { registerRuntimeTestLifecycle } from './window-close-reveal.harness.js'
+import type { WorkbenchAppConfig } from '../../shared/types.js'
+import type { CreateProjectWindowOptions } from './project-window.js'
+
+const createMainWindowSpy = vi.hoisted(() => vi.fn())
+
+vi.mock('../windows/main-window/create.js', async () => {
+  const actual =
+    await vi.importActual<typeof import('../windows/main-window/create.js')>('../windows/main-window/create.js')
+  return {
+    ...actual,
+    createMainWindow: (opts: Parameters<typeof actual.createMainWindow>[0]) => {
+      createMainWindowSpy(opts)
+      return actual.createMainWindow(opts)
+    },
+  }
+})
+
+const state = registerRuntimeTestLifecycle()
+
+async function buildOptions(): Promise<Omit<CreateProjectWindowOptions, 'config'>> {
+  const [{ createAppServices }, { createWindowContextRouter }, { rendererDir }] = await Promise.all([
+    import('../services/app-services.js'),
+    import('../services/window-contexts/context-router.js'),
+    import('../utils/paths.js'),
+  ])
+  return { appServices: createAppServices({}), router: createWindowContextRouter(), rendererDir }
+}
+
+/** The `autoShow` the most recent `createMainWindow` call was given. */
+function lastAutoShow(): boolean | undefined {
+  const call = createMainWindowSpy.mock.calls.at(-1) as [{ autoShow?: boolean }] | undefined
+  return call?.[0].autoShow
+}
+
+describe('project window autoShow visibility', () => {
+  it.each([
+    ['no projectWindow config', {} as WorkbenchAppConfig],
+    ['projectWindow.autoShow: true', { projectWindow: { autoShow: true } } as WorkbenchAppConfig],
+    ['projectWindow.autoShow: false', { projectWindow: { autoShow: false } } as WorkbenchAppConfig],
+    ['window.autoShow: false (list-window opt-out)', { window: { autoShow: false } } as WorkbenchAppConfig],
+  ])('creates the project window hidden regardless of config (%s)', async (_label, config) => {
+    await state.createDevtoolsRuntime({})
+    createMainWindowSpy.mockClear()
+    const { createWorkbenchWindow } = await import('./project-window.js')
+    const opts = await buildOptions()
+
+    createWorkbenchWindow({ config, ...opts }, { path: '/tmp/autoShowAlwaysHidden' })
+
+    expect(
+      lastAutoShow(),
+      'a project window must always be created hidden — the reveal gate in workbench-window.ts shows it, not createMainWindow',
+    ).toBe(false)
+  })
+
+  it('the list window keeps tracking config.window.autoShow, unaffected by projectWindow', async () => {
+    await state.createDevtoolsRuntime({})
+    createMainWindowSpy.mockClear()
+    const { createLauncherWindow } = await import('./project-window.js')
+    const opts = await buildOptions()
+    const config: WorkbenchAppConfig = { projectWindow: { autoShow: false }, window: { autoShow: false } }
+
+    createLauncherWindow({ config, ...opts })
+
+    expect(lastAutoShow(), 'the list window must keep tracking its own config.window.autoShow').toBe(false)
+  })
+})
diff --git a/packages/devtools/src/main/app/project-window.ts b/packages/devtools/src/main/app/project-window.ts
new file mode 100644
index 00000000..4273ba28
--- /dev/null
+++ b/packages/devtools/src/main/app/project-window.ts
@@ -0,0 +1,156 @@
+import { BrowserWindow, nativeImage } from 'electron'
+import path from 'path'
+import type { WorkbenchAppConfig } from '../../shared/types.js'
+import { defaultPreloadPath } from '../utils/paths.js'
+import { createMainWindow } from '../windows/main-window/index.js'
+// eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
+import { createWorkbenchContext, type CreateContextOptions, type WorkbenchContext } from '../services/workbench-context.js'
+import type { AppServices } from '../services/app-services.js'
+import type { WindowContextRouter } from '../services/window-contexts/context-router.js'
+
+/** The project a workbench window is opened for. */
+export interface ProjectRef {
+  path: string
+  name?: string
+}
+
+/** A window and the context that answers IPC coming from it. */
+export interface ProjectWindow {
+  window: BrowserWindow
+  context: WorkbenchContext
+  dispose: () => Promise<void>
+}
+
+export interface CreateProjectWindowOptions {
+  config: WorkbenchAppConfig
+  rendererDir: string
+  appServices: AppServices
+  router: WindowContextRouter<WorkbenchContext>
+}
+
+function createConfiguredMainWindow(
+  config: WorkbenchAppConfig,
+  rendererDir: string,
+  entry: string,
+  title: string,
+  autoShow: boolean | undefined,
+  query?: Record<string, string>,
+): BrowserWindow {
+  const mainWindow = createMainWindow({
+    title,
+    indexHtml: path.join(rendererDir, entry),
+    query,
+    width: config.window?.width,
+    height: config.window?.height,
+    minWidth: config.window?.minWidth,
+    minHeight: config.window?.minHeight,
+    autoShow,
+  })
+
+  // Set window/taskbar icon if provided (Linux/Windows; macOS uses app bundle icon)
+  if (config.icon) {
+    const icon = nativeImage.createFromPath(config.icon)
+    if (!icon.isEmpty()) mainWindow.setIcon(icon)
+  }
+
+  return mainWindow
+}
+
+function createContext(
+  config: WorkbenchAppConfig,
+  mainWindow: BrowserWindow,
+  rendererDir: string,
+  appServices: AppServices,
+): WorkbenchContext {
+  return createWorkbenchContext({
+    mainWindow,
+    appServices,
+    adapter: config.adapter,
+    preloadPath: config.preloadPath ?? defaultPreloadPath,
+    rendererDir,
+    appName: config.appName,
+    apiNamespaces: config.apiNamespaces,
+    fileTypes: config.fileTypes,
+    brandingProvider: config.brandingProvider,
+    customCreateProjectDialog: config.customCreateProjectDialog as
+      CreateContextOptions['customCreateProjectDialog'],
+    // No cast needed here: the hook receives the project record, so the
+    // main-process `Project` the context hands it satisfies the structural
+    // `EditableProject` the config declares.
+    customEditProjectDialog: config.customEditProjectDialog,
+    onBeforeOpenProject: config.onBeforeOpenProject,
+  })
+}
+
+export async function disposeContext(ctx: WorkbenchContext): Promise<void> {
+  await ctx.workspace.closeProject()
+  await ctx.registry.dispose().catch((err) => {
+    console.warn('[workbench] dispose registry encountered errors:', err)
+  })
+}
+
+/**
+ * Build a window together with the context that owns it, and publish that
+ * context to the router so IPC arriving from this window is answered by it.
+ *
+ * The router registration is parked on the context's own registry: a window
+ * that is torn down must stop claiming senders in the same breath, or a
+ * recycled `webContents.id` would resolve to a dead context.
+ */
+function createWindowWithContext(
+  opts: CreateProjectWindowOptions,
+  entry: string,
+  title: string,
+  autoShow: boolean | undefined,
+  query?: Record<string, string>,
+): ProjectWindow {
+  const { config, rendererDir, appServices, router } = opts
+  const window = createConfiguredMainWindow(config, rendererDir, entry, title, autoShow, query)
+  const context = createContext(config, window, rendererDir, appServices)
+
+  // Anchor the window's renderer as the first Connection. Resources scoped to
+  // that webContents (acquired by later wiring) tear down with it; see
+  // packages/electron-deck/docs/foundation.md (teardown paths).
+  context.connections.acquire(window.webContents)
+  context.registry.add(router.register(context))
+
+  return { window, context, dispose: () => disposeContext(context) }
+}
+
+/**
+ * The project-list window. It is the application's root window: the app-level
+ * IPC surface is registered while it exists, and it stays open for the whole
+ * session so workbench windows can come and go around it.
+ */
+export function createLauncherWindow(opts: CreateProjectWindowOptions): ProjectWindow {
+  return createWindowWithContext(
+    opts,
+    'entries/main/index.html',
+    opts.config.appName ?? 'Dimina DevTools',
+    opts.config.window?.autoShow,
+  )
+}
+
+/**
+ * A workbench window: one open mini-program project, with its own simulator,
+ * panels and editor. The project identity travels in the URL query so the
+ * renderer entry can mount straight into the project without asking main.
+ */
+export function createWorkbenchWindow(
+  opts: CreateProjectWindowOptions,
+  project: ProjectRef,
+): ProjectWindow {
+  return createWindowWithContext(
+    opts,
+    'entries/workbench/index.html',
+    project.name || opts.config.appName || 'Dimina DevTools',
+    // Always hidden: `workbench-window.ts`'s reveal gate is the sole place
+    // that ever shows a project window, once BOTH `setupProjectWindow` has
+    // resolved and the renderer's own `ready-to-show` has fired. Passing
+    // anything but `false` here would let `createMainWindow`'s own
+    // `ready-to-show` handler show the window itself and race that gate.
+    // `config.projectWindow?.autoShow` is read by the gate instead, not here.
+    false,
+    { path: project.path, name: project.name ?? '' },
+  )
+}
diff --git a/packages/devtools/src/main/app/quit-flag-onclose.test.ts b/packages/devtools/src/main/app/quit-flag-onclose.test.ts
index 32878997..bb540630 100644
--- a/packages/devtools/src/main/app/quit-flag-onclose.test.ts
+++ b/packages/devtools/src/main/app/quit-flag-onclose.test.ts
@@ -1,7 +1,7 @@
 /**
  * ⌘Q QUIT-FLAG CONTRACT (host-shell extensibility) — lifecycle + onClose.
  *
- * Bug guarded against: with a project open, pressing ⌘Q fires the main
+ * Bug guarded against: with a project open, pressing ⌘Q fires the workbench
  * window's `close` event, the onClose handler unconditionally
  * `preventDefault()`s + `closeProject()`s, and the application never quits —
  * the quit is swallowed and turned into "close the project".
@@ -10,14 +10,15 @@
  *  - `lifecycle.isAppQuitting()` starts `false`.
  *  - `registerAppLifecycle()` wires `app.on('before-quit', …)`; once that
  *    handler runs, `isAppQuitting()` returns `true`.
- *  - The main-window onClose consults it: when quitting, it must NOT
- *    `preventDefault()` and must NOT tear the project down (let the real
- *    quit proceed). When NOT quitting and a session is active, it keeps the
- *    original behaviour (preventDefault + closeProject + navigateBack).
+ *  - The workbench window's onClose consults it: when quitting, it must NOT
+ *    `preventDefault()`, must NOT tear the project down and must NOT destroy
+ *    the window itself (let the real quit proceed). When NOT quitting it keeps
+ *    the normal behaviour: preventDefault, tear the project down, then destroy
+ *    that one window.
  *
  * Two layers are pinned:
  *  1. lifecycle.ts: the flag flips after before-quit.
- *  2. app.ts createDevtoolsRuntime: the wired onClose honours the flag.
+ *  2. workbench-window.ts: the wired onClose honours the flag.
  *
  * Harness for layer 2 lifted from `close-with-active-session.test.ts`
  * (electron + fs + devkit mocks, real createDevtoolsRuntime).
@@ -174,6 +175,8 @@ vi.mock('electron', () => {
   class BrowserWindow {
     private em = stubs.makeEmitter()
     destroyed = false
+    visible = true
+    minimized = false
     webContents = new WebContents()
     contentView: View | WebContentsView = new WebContentsView()
     on = this.em.on.bind(this.em)
@@ -185,9 +188,14 @@ vi.mock('electron', () => {
     getContentSize = () => [1280, 980]
     setIcon = vi.fn()
     setTitle = vi.fn()
-    show = vi.fn()
+    show = vi.fn(() => { this.visible = true })
     showInactive = vi.fn()
     focus = vi.fn()
+    hide = vi.fn(() => { this.visible = false })
+    isVisible = () => this.visible
+    minimize = vi.fn(() => { this.minimized = true })
+    isMinimized = () => this.minimized
+    restore = vi.fn(() => { this.minimized = false })
     close = vi.fn()
     destroy = vi.fn(() => {
       this.destroyed = true
@@ -325,10 +333,8 @@ vi.mock('@dimina-kit/devkit', () => ({
   ),
 }))
 
-import { WindowChannel } from '../../shared/ipc-channels.js'
 let createDevtoolsRuntime: typeof import('./app.js').createDevtoolsRuntime
 let registerAppLifecycle: typeof import('./lifecycle.js').registerAppLifecycle
-// Will only exist once the fix lands; referencing it red-flags the contract.
 let isAppQuitting: typeof import('./lifecycle.js').isAppQuitting
 let electron: typeof import('electron')
 
@@ -365,20 +371,30 @@ describe('lifecycle: app-quit flag', () => {
   })
 })
 
-describe('mainWindow onClose honours the app-quit flag', () => {
-  async function openProject() {
+describe('workbench window onClose honours the app-quit flag', () => {
+  type Instance = Awaited<ReturnType<typeof createDevtoolsRuntime>>
+  type ProjectWindow = ReturnType<Instance['projectWindows']>[number]
+
+  async function openProject(): Promise<{ instance: Instance; projectWindow: ProjectWindow }> {
     const projectDir = '/tmp/projQuitFlag'
     stubs.projectsWithAppJson.add(projectDir)
     stubs.setProjectsJson(JSON.stringify([]))
     const instance = await createDevtoolsRuntime({})
-    const openResult = await instance.context.workspace.openProject(projectDir)
+    await instance.openProjectWindow({ path: projectDir })
+    const [projectWindow] = instance.projectWindows()
+    expect(projectWindow, 'openProjectWindow must publish the window it opened').toBeTruthy()
+    const openResult = await projectWindow!.context.workspace.openProject(projectDir)
     expect(openResult.success).toBe(true)
-    expect(instance.context.workspace.hasActiveSession()).toBe(true)
-    return instance
+    expect(projectWindow!.context.workspace.hasActiveSession()).toBe(true)
+    return { instance, projectWindow: projectWindow! }
+  }
+
+  function emitClose(win: unknown, fakeEvent: unknown) {
+    ;(win as { emit: (event: string, ...args: unknown[]) => void }).emit('close', fakeEvent)
   }
 
-  it('when quitting (before-quit fired): does NOT preventDefault and does NOT close the project', async () => {
-    const instance = await openProject()
+  it('when quitting (before-quit fired): does NOT preventDefault, does NOT close the project and does NOT destroy the window', async () => {
+    const { instance, projectWindow } = await openProject()
 
     // Simulate the real ⌘Q ordering: Electron emits before-quit, then the
     // window close event for each open window.
@@ -388,14 +404,12 @@ describe('mainWindow onClose honours the app-quit flag', () => {
     }).emit('before-quit', { preventDefault: () => {} })
     expect(isAppQuitting()).toBe(true)
 
-    const sendSpy = vi.mocked(instance.mainWindow.webContents.send)
-    sendSpy.mockClear()
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    destroySpy.mockClear()
 
     let prevented = 0
     const fakeEvent = { preventDefault: () => { prevented += 1 } }
-    ;(instance.mainWindow as unknown as {
-      emit: (event: string, ...args: unknown[]) => void
-    }).emit('close', fakeEvent)
+    emitClose(projectWindow.window, fakeEvent)
 
     // Drain a macrotask so any (incorrect) async closeProject would run.
     await new Promise((r) => setTimeout(r, 0))
@@ -406,42 +420,38 @@ describe('mainWindow onClose honours the app-quit flag', () => {
       + 'into "close the project" and the app never exits',
     ).toBe(0)
     expect(
-      instance.context.workspace.hasActiveSession(),
+      projectWindow.context.workspace.hasActiveSession(),
       'quitting must not tear the project down via the close handler — the app is exiting whole',
     ).toBe(true)
-    const navBack = sendSpy.mock.calls.filter((c) => c[0] === WindowChannel.NavigateBack)
     expect(
-      navBack,
-      'a real quit must not push the renderer back to the project list',
-    ).toHaveLength(0)
+      destroySpy,
+      'during a real quit Electron destroys the window itself; the handler must keep its hands off',
+    ).not.toHaveBeenCalled()
 
     await instance.dispose()
   })
 
-  it('when NOT quitting and a session is active: keeps original behaviour (preventDefault + closeProject + navigateBack)', async () => {
-    const instance = await openProject()
+  it('when NOT quitting and a session is active: preventDefault, tear the project down, then destroy that window', async () => {
+    const { instance, projectWindow } = await openProject()
     // before-quit NOT fired → isAppQuitting() stays false.
     expect(isAppQuitting()).toBe(false)
 
-    const sendSpy = vi.mocked(instance.mainWindow.webContents.send)
-    sendSpy.mockClear()
+    const destroySpy = vi.mocked(projectWindow.window.destroy)
+    destroySpy.mockClear()
 
     let prevented = 0
     const fakeEvent = { preventDefault: () => { prevented += 1 } }
-    ;(instance.mainWindow as unknown as {
-      emit: (event: string, ...args: unknown[]) => void
-    }).emit('close', fakeEvent)
+    emitClose(projectWindow.window, fakeEvent)
 
     await vi.waitFor(
       () => {
-        expect(instance.context.workspace.hasActiveSession()).toBe(false)
-        const calls = sendSpy.mock.calls.filter((c) => c[0] === WindowChannel.NavigateBack)
-        expect(calls.length).toBeGreaterThanOrEqual(1)
+        expect(projectWindow.context.workspace.hasActiveSession()).toBe(false)
+        expect(destroySpy).toHaveBeenCalledTimes(1)
       },
       { timeout: 2000 },
     )
 
-    expect(prevented, 'a plain close-while-open stays in the workbench').toBe(1)
+    expect(prevented, 'the close is held back exactly once, until teardown finishes').toBe(1)
 
     await instance.dispose()
   })
diff --git a/packages/devtools/src/main/app/servers.ts b/packages/devtools/src/main/app/servers.ts
new file mode 100644
index 00000000..cbd506f1
--- /dev/null
+++ b/packages/devtools/src/main/app/servers.ts
@@ -0,0 +1,74 @@
+import { app } from 'electron'
+import type { WorkbenchAppInstance } from './app.js'
+import { startAutomationServer } from '../services/automation/index.js'
+import {
+  startMcpServer,
+  type McpOpenedProject,
+  type McpProjectTarget,
+} from '../services/mcp/index.js'
+import { loadWorkbenchSettings } from '../services/settings/index.js'
+import type { Disposable } from '@dimina-kit/electron-deck/main'
+
+/** Parse --auto, --auto-port, --project from process.argv. */
+function parseAutoArgs(): { auto: boolean; autoPort: number; projectPath: string } {
+  const argv = process.argv
+  let auto = false
+  let autoPort = 9420
+  let projectPath = ''
+
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === 'auto' || argv[i] === '--auto') auto = true
+    if ((argv[i] === '--auto-port' || argv[i] === '--auto_port') && argv[i + 1]) {
+      const parsed = parseInt(argv[i + 1]!, 10)
+      // 0 → OS-assigned free port (used by parallel e2e workers)
+      if (Number.isFinite(parsed) && parsed >= 0) autoPort = parsed
+    }
+    if (argv[i] === '--project' && argv[i + 1]) {
+      projectPath = argv[i + 1]!
+    }
+  }
+
+  return { auto, autoPort, projectPath }
+}
+
+/**
+ * The automation server outlives every window: it binds its port at boot,
+ * before any project is open, so it cannot capture a context at start and
+ * takes `getContext` instead. What that resolver hands back is only the
+ * starting point — each connection pins the first project window it reaches
+ * and stays there, so window focus cannot redirect a live client.
+ */
+export async function setupAutomation(
+  instance: WorkbenchAppInstance,
+  getContext: Parameters<typeof startAutomationServer>[0],
+  senders: Parameters<typeof startAutomationServer>[1],
+): Promise<Disposable | null> {
+  // Start automation server if --auto flag is present
+  const autoArgs = parseAutoArgs()
+  if (!autoArgs.auto) return null
+  const server = await startAutomationServer(getContext, senders, autoArgs.autoPort)
+  instance.automationServer = server
+  // Stable, parseable line for e2e harnesses that scrape stdout.
+  console.log(`[automation] listening on ws://127.0.0.1:${server.port}`)
+  return { dispose: () => server.close() }
+}
+
+export function setupMcp(
+  currentProject: () => McpProjectTarget,
+  openProjectWindow: (project: { path: string; name: string }) => Promise<McpOpenedProject>,
+): Disposable | null {
+  const settings = loadWorkbenchSettings()
+  if (!settings.mcp.enabled) return null
+
+  const cdpPortSwitch = app.commandLine.getSwitchValue('remote-debugging-port')
+  const cdpPort = cdpPortSwitch ? parseInt(cdpPortSwitch, 10) : settings.cdp.port
+  // Resolved per tool call, not once at boot: the project MCP drives lives in
+  // whichever workbench window is active, and that changes as windows open and
+  // close. Each call then holds the target it got.
+  return startMcpServer(cdpPort, settings.mcp.port, {
+    currentProject,
+    // A project opens into its own window; the renderer entry mounted there
+    // compiles it and attaches the simulator.
+    requestOpenInUi: (p) => openProjectWindow(p),
+  })
+}
diff --git a/packages/devtools/src/main/app/simulator-api-app-level.test.ts b/packages/devtools/src/main/app/simulator-api-app-level.test.ts
new file mode 100644
index 00000000..ea95646c
--- /dev/null
+++ b/packages/devtools/src/main/app/simulator-api-app-level.test.ts
@@ -0,0 +1,85 @@
+/**
+ * SIMULATOR CUSTOM APIs ARE APP-LEVEL, NOT PER-WINDOW.
+ *
+ * `ctx.simulatorApis` is the ONE registry owned by `AppServices` — every
+ * window's context points at the same object (workbench-context.ts takes
+ * `appServices.simulatorApis`). So a name registered once is visible to every
+ * window, including windows opened later: the service host reads the
+ * registered names off the registry when it spawns.
+ *
+ * The failure this guards: parking a registration's disposer on a WINDOW's
+ * registry. Closing that window then deletes the handler from the shared map,
+ * and every other open window loses `wx.<name>()` — including the built-in
+ * `login`. A registration may only be revoked by the host disposing it.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  openProjectWindow,
+  makeCloseEvent,
+  emitClose,
+} from './window-close-reveal.harness.js'
+
+const state = registerRuntimeTestLifecycle()
+
+describe('simulator custom API lifetime across project windows', () => {
+  it('keeps host APIs working in the windows that stay open when one window closes', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const first = await openProjectWindow(instance, '/tmp/simApiA1')
+    const second = await openProjectWindow(instance, '/tmp/simApiA2')
+
+    instance.registerSimulatorApi('hostEcho', async (params) => params)
+
+    // Wait for the window to be DESTROYED, not merely for the manager's list
+    // to shrink: destruction is the last step of teardown, so it is the only
+    // point at which the closing window's registry is guaranteed to have run.
+    emitClose(first.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(first.window.isDestroyed()).toBe(true)
+    }, { timeout: 2000 })
+
+    expect(
+      second.context.simulatorApis.has('hostEcho'),
+      'closing one project window must not revoke a host API from the windows still open',
+    ).toBe(true)
+    await expect(second.context.simulatorApis.invoke('hostEcho', 42)).resolves.toBe(42)
+    expect(
+      second.context.simulatorApis.has('login'),
+      'the built-in login API travels the same path and must survive a window close too',
+    ).toBe(true)
+
+    await instance.dispose()
+  })
+
+  it('exposes an API registered before any window opened to a window opened after', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    instance.registerSimulatorApi('hostLate', async () => 'late')
+
+    const projectWindow = await openProjectWindow(instance, '/tmp/simApiB')
+
+    expect(
+      projectWindow.context.simulatorApis.has('hostLate'),
+      'a window opened later reads the same app-level registry — no replay needed',
+    ).toBe(true)
+    await expect(projectWindow.context.simulatorApis.invoke('hostLate', null)).resolves.toBe('late')
+
+    await instance.dispose()
+  })
+
+  it('revokes an API everywhere when the host disposes its registration', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const projectWindow = await openProjectWindow(instance, '/tmp/simApiC')
+
+    const registration = instance.registerSimulatorApi('hostRevocable', async () => 'ok')
+    expect(projectWindow.context.simulatorApis.has('hostRevocable')).toBe(true)
+
+    await registration.dispose()
+
+    expect(
+      projectWindow.context.simulatorApis.has('hostRevocable'),
+      'the host disposing its registration is the ONLY thing that revokes an API',
+    ).toBe(false)
+
+    await instance.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/app/ui-extension-active-project-window.test.ts b/packages/devtools/src/main/app/ui-extension-active-project-window.test.ts
new file mode 100644
index 00000000..cba5eca3
--- /dev/null
+++ b/packages/devtools/src/main/app/ui-extension-active-project-window.test.ts
@@ -0,0 +1,106 @@
+/**
+ * A simulator UI extension belongs to the project windows, and `invoke` reaches
+ * the project window the user is working in.
+ *
+ * Two failures this guards:
+ *
+ * 1. The project list is not a simulator surface — it runs no bridge router, no
+ *    service host and no device frame. Registering an extension into it gives
+ *    `invoke` a target that can never mount anything, and whenever the list
+ *    window is the app-active one that dead target is what `invoke` picks.
+ * 2. A target record outlives its window. The record is created when a window
+ *    opens; if nothing removes it when that window is torn down, `invoke`
+ *    reaches an extension that was already disposed with the window, and the
+ *    ledger grows with every project window ever opened.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import type { SimulatorUiExtensionHandle } from '../../shared/simulator-ui.js'
+import {
+  registerRuntimeTestLifecycle,
+  openProjectWindow,
+  makeCloseEvent,
+  emitClose,
+} from './window-close-reveal.harness.js'
+
+const state = registerRuntimeTestLifecycle()
+
+const REGISTRATION = { id: 'host.panel', rendererScriptPath: '/tmp/host-panel.js' }
+
+/**
+ * Replace one window's extension registry with a recorder, so "which window
+ * did this invoke reach" is observable without a live simulator renderer.
+ */
+function recordExtensionsOf(context: unknown, label: string) {
+  const calls: string[] = []
+  let disposed = false
+  ;(context as { simulatorUiExtensions: unknown }).simulatorUiExtensions = {
+    register: (): SimulatorUiExtensionHandle => ({
+      dispose: () => { disposed = true },
+      invoke: async <T>(method: string) => {
+        calls.push(method)
+        return `${label}:${method}` as T
+      },
+    }),
+    // The window's own teardown clears its registry; the recorder stands in for
+    // the whole surface, so it has to answer that too.
+    attach: () => {},
+    detach: () => {},
+    clear: () => {},
+  }
+  return { calls, isDisposed: () => disposed }
+}
+
+describe('a host simulator UI extension across project windows', () => {
+  it('invokes into the active project window, never the project list', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const first = await openProjectWindow(instance, '/tmp/uiExtA1')
+    const second = await openProjectWindow(instance, '/tmp/uiExtA2')
+    const firstCalls = recordExtensionsOf(first.context, 'first')
+    const secondCalls = recordExtensionsOf(second.context, 'second')
+
+    const handle = instance.registerSimulatorUiExtension(REGISTRATION)
+
+    // The project list holds app focus (nothing has focused a project window),
+    // and it is exactly then that the extension must still reach the project.
+    await expect(
+      handle.invoke('ping'),
+      'an extension drives the simulator, so its invoke belongs to the project window the user is working in — the project list has no simulator to reach',
+    ).resolves.toBe('second:ping')
+    expect(
+      firstCalls.calls,
+      'only the active project window answers; a background project must not receive the call',
+    ).toEqual([])
+    expect(secondCalls.calls).toEqual(['ping'])
+
+    await handle.dispose()
+    await instance.dispose()
+  })
+
+  it('stops reaching a window that has been closed', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const only = await openProjectWindow(instance, '/tmp/uiExtB')
+    const onlyCalls = recordExtensionsOf(only.context, 'only')
+
+    const handle = instance.registerSimulatorUiExtension(REGISTRATION)
+
+    emitClose(only.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(only.window.isDestroyed()).toBe(true)
+    }, { timeout: 2000 })
+
+    // Wrapped in a call the host awaits, which is what the failure has to reach
+    // whether it arrives as a throw or a rejected promise.
+    await expect(
+      (async () => handle.invoke('ping'))(),
+      'with the last project window closed there is nothing to invoke into; the host must be told so rather than driven into a torn-down window',
+    ).rejects.toThrow(/no live window/i)
+    expect(
+      onlyCalls.calls,
+      'the closed window extension was disposed with it — a target record that outlives the window sends the host into a dead extension',
+    ).toEqual([])
+    expect(onlyCalls.isDisposed(), 'the window close disposes the extension it owned').toBe(true)
+
+    await handle.dispose()
+    await instance.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/app/ui-extension-registration.test.ts b/packages/devtools/src/main/app/ui-extension-registration.test.ts
new file mode 100644
index 00000000..2d785e5c
--- /dev/null
+++ b/packages/devtools/src/main/app/ui-extension-registration.test.ts
@@ -0,0 +1,184 @@
+/**
+ * Whether a simulator UI extension registration is legal is a property of the
+ * registration, not of what happens to be on screen when the host makes it.
+ *
+ * Hosts register in `onSetup`, before any project window exists. A bad
+ * registration accepted there — malformed id, relative script path, an id
+ * already taken — surfaces much later, while a project window is being built,
+ * where the failure reads as "this project will not open" and, because the bad
+ * record stays in the ledger, keeps every later project from opening too.
+ *
+ * The same isolation applies to one window refusing an otherwise legal
+ * extension: that is a fact about that window, and it must not decide whether
+ * the project opens.
+ */
+import { describe, expect, it } from 'vitest'
+import type { Disposable } from '@dimina-kit/electron-deck/main'
+import type {
+  SimulatorUiExtensionHandle,
+  SimulatorUiExtensionRegistration,
+} from '../../shared/simulator-ui.js'
+import { createUiExtensionTargets, type UiExtensionWindow } from './ui-extension-targets.js'
+
+/** A project window that takes extensions, or refuses them when told to. */
+function fakeWindow(refuse?: string) {
+  const taken: string[] = []
+  const window: UiExtensionWindow = {
+    simulatorUiExtensions: {
+      register: (registration: SimulatorUiExtensionRegistration): SimulatorUiExtensionHandle => {
+        if (refuse) throw new Error(refuse)
+        taken.push(registration.id)
+        return {
+          dispose: () => {},
+          invoke: async <T>(method: string) => method as T,
+        }
+      },
+    },
+    registry: { add: (d: Disposable) => d },
+  }
+  return { window, taken }
+}
+
+function targetsWithWindows(...windows: UiExtensionWindow[]) {
+  return createUiExtensionTargets<UiExtensionWindow>({
+    projectWindows: () => windows,
+    activeWindow: () => windows[0] ?? null,
+  })
+}
+
+describe('registering a simulator UI extension before any project window exists', () => {
+  it('rejects a malformed id right away', () => {
+    const targets = targetsWithWindows()
+    expect(
+      () => targets.register({ id: 'not a valid id', rendererScriptPath: '/tmp/panel.js' }),
+      'the host has to learn its registration is unusable while it is registering, not when the user opens a project',
+    ).toThrow(/id/i)
+  })
+
+  it('rejects a renderer script path that is not absolute', () => {
+    const targets = targetsWithWindows()
+    expect(
+      () => targets.register({ id: 'host.panel', rendererScriptPath: 'panel.js' }),
+      'a relative path is resolved against nothing in particular, so it can only fail later inside a window',
+    ).toThrow(/absolute/i)
+  })
+
+  it('rejects a second registration of an id already taken', () => {
+    const targets = targetsWithWindows()
+    targets.register({ id: 'host.panel', rendererScriptPath: '/tmp/panel.js' })
+    expect(
+      () => targets.register({ id: 'host.panel', rendererScriptPath: '/tmp/other.js' }),
+      'two extensions under one id cannot both be reachable; the second registration is the one that is wrong',
+    ).toThrow(/already registered/i)
+  })
+
+  it('leaves nothing behind when it rejects one', () => {
+    const targets = targetsWithWindows()
+    expect(() =>
+      targets.register({ id: 'bad id', rendererScriptPath: '/tmp/panel.js' }),
+    ).toThrow()
+
+    const opened = fakeWindow()
+    expect(
+      () => targets.attachTo(opened.window),
+      'a rejected registration kept in the ledger would be handed to every project window opened afterwards',
+    ).not.toThrow()
+    expect(opened.taken).toEqual([])
+
+    // The rejected id was never taken, so the host can register it properly.
+    expect(() =>
+      targets.register({ id: 'bad.id', rendererScriptPath: '/tmp/panel.js' }),
+    ).not.toThrow()
+  })
+
+  it('frees the id it was registered under, not the one the object carries now', () => {
+    const targets = targetsWithWindows()
+    // The host reuses one object to describe both extensions.
+    const reused: SimulatorUiExtensionRegistration = {
+      id: 'host.first',
+      rendererScriptPath: '/tmp/panel.js',
+    }
+    const first = targets.register(reused)
+    reused.id = 'host.second'
+    targets.register({ id: 'host.second', rendererScriptPath: '/tmp/other.js' })
+
+    void first.dispose()
+
+    expect(
+      () => targets.register({ id: 'host.second', rendererScriptPath: '/tmp/third.js' }),
+      'the second extension is still registered and reachable; accepting its id again puts two extensions under one id in every project window',
+    ).toThrow(/already registered/i)
+    expect(
+      () => targets.register({ id: 'host.first', rendererScriptPath: '/tmp/panel.js' }),
+      'the disposed registration must give its own id back, or that id stays taken for the life of the app',
+    ).not.toThrow()
+  })
+
+  it('gives a window opened later the extension as it was registered', () => {
+    const targets = targetsWithWindows()
+    const reused: SimulatorUiExtensionRegistration = {
+      id: 'host.first',
+      rendererScriptPath: '/tmp/panel.js',
+    }
+    targets.register(reused)
+    reused.id = 'host.second'
+    targets.register({ id: 'host.second', rendererScriptPath: '/tmp/other.js' })
+
+    const opened = fakeWindow()
+    targets.attachTo(opened.window)
+
+    expect(
+      opened.taken,
+      'the ledger describes what was registered; replaying the host object as it reads now would give the window two copies of one extension and lose the other entirely',
+    ).toEqual(['host.first', 'host.second'])
+  })
+
+  it('frees the id of a registration the host disposed', () => {
+    const targets = targetsWithWindows()
+    const handle = targets.register({ id: 'host.panel', rendererScriptPath: '/tmp/panel.js' })
+    void handle.dispose()
+
+    expect(
+      () => targets.register({ id: 'host.panel', rendererScriptPath: '/tmp/panel.js' }),
+      're-registering an id the host gave up is how a host swaps its extension implementation',
+    ).not.toThrow()
+  })
+})
+
+describe('a project window that cannot take an extension', () => {
+  it('still opens, and still takes the extensions it can', () => {
+    const refusing = fakeWindow('this window already has that extension')
+    const targets = createUiExtensionTargets<UiExtensionWindow>({
+      projectWindows: () => [],
+      activeWindow: () => null,
+    })
+    targets.register({ id: 'host.panel', rendererScriptPath: '/tmp/panel.js' })
+
+    expect(
+      () => targets.attachTo(refusing.window),
+      'one extension failing to mount is not a reason to roll the whole project window back — the user would be left unable to open any project',
+    ).not.toThrow()
+  })
+
+  it('does not stop a later project window from taking it', () => {
+    const refusing = fakeWindow('this window already has that extension')
+    const opened = fakeWindow()
+    const windows: UiExtensionWindow[] = [refusing.window]
+    const targets = createUiExtensionTargets<UiExtensionWindow>({
+      projectWindows: () => windows,
+      activeWindow: () => windows[0] ?? null,
+    })
+
+    expect(
+      () => targets.register({ id: 'host.panel', rendererScriptPath: '/tmp/panel.js' }),
+      'a window refusing the extension is a fact about that window, not about the registration',
+    ).not.toThrow()
+
+    windows.push(opened.window)
+    targets.attachTo(opened.window)
+    expect(
+      opened.taken,
+      'the next project window must still get the extension the host registered',
+    ).toEqual(['host.panel'])
+  })
+})
diff --git a/packages/devtools/src/main/app/ui-extension-targets.ts b/packages/devtools/src/main/app/ui-extension-targets.ts
new file mode 100644
index 00000000..2f25125a
--- /dev/null
+++ b/packages/devtools/src/main/app/ui-extension-targets.ts
@@ -0,0 +1,140 @@
+/**
+ * The ledger of host-registered simulator UI extensions.
+ *
+ * A registration is app-level — the host makes it once — but an extension can
+ * only exist inside a PROJECT window: it mounts into that window's device
+ * frame and talks to its simulator renderer. So one registration becomes one
+ * live extension per project window, and the ledger is what keeps those copies
+ * in step with the windows: every project window that opens gets its own copy,
+ * and a copy exists exactly as long as the window that owns it.
+ *
+ * The project list is deliberately not a target. It runs no bridge router and
+ * no simulator, so an extension registered into it could never mount, and
+ * `invoke` — which follows the window the user works in — would be answered by
+ * that dead copy every time the list window has focus.
+ */
+
+import { toDisposable, type Disposable } from '@dimina-kit/electron-deck/main'
+import { assertSimulatorUiExtensionShape } from '../services/simulator/ui-extensions.js'
+import type {
+  SimulatorUiExtensionHandle,
+  SimulatorUiExtensionRegistration,
+} from '../../shared/simulator-ui.js'
+
+/**
+ * The window surface the ledger needs, described structurally so this module
+ * does not import WorkbenchContext (see eslint-workbench-context-gate).
+ */
+export interface UiExtensionWindow {
+  simulatorUiExtensions: {
+    register: (registration: SimulatorUiExtensionRegistration) => SimulatorUiExtensionHandle
+  }
+  registry: { add: (d: Disposable) => Disposable }
+}
+
+export interface UiExtensionTargetsDeps<W extends UiExtensionWindow> {
+  /** Every open project window, in open order. */
+  projectWindows: () => W[]
+  /** The project window the user is working in, or null when none is open. */
+  activeWindow: () => W | null
+}
+
+export interface UiExtensionTargets<W extends UiExtensionWindow> {
+  /** Give a freshly opened project window its copy of every registration. */
+  attachTo: (window: W) => void
+  register: (registration: SimulatorUiExtensionRegistration) => SimulatorUiExtensionHandle
+}
+
+export function createUiExtensionTargets<W extends UiExtensionWindow>(
+  deps: UiExtensionTargetsDeps<W>,
+): UiExtensionTargets<W> {
+  interface Target { window: W; extension: SimulatorUiExtensionHandle; owned: Disposable }
+  /** Per registration, one target per project window that currently holds it. */
+  const ledger = new Map<SimulatorUiExtensionRegistration, Target[]>()
+  /** Ids currently spoken for app-wide, so a clash is caught where it happens. */
+  const ids = new Set<string>()
+
+  function attach(
+    window: W,
+    targets: Target[],
+    registration: SimulatorUiExtensionRegistration,
+  ): void {
+    const extension = window.simulatorUiExtensions.register(registration)
+    // Owned by the window: its registry drives this on close, which both tears
+    // the extension down and drops the record. A record left behind would keep
+    // a disposed extension reachable as an `invoke` target and would make the
+    // ledger grow with every window ever opened.
+    const owned = window.registry.add(toDisposable(async () => {
+      const index = targets.findIndex((t) => t.extension === extension)
+      if (index >= 0) targets.splice(index, 1)
+      await extension.dispose()
+    }))
+    targets.push({ window, extension, owned })
+  }
+
+  /**
+   * A window refusing an extension is a fact about that window: the project
+   * still opens, the other windows keep their copies, and windows opened later
+   * still get theirs. Letting it escape would turn one bad extension into "no
+   * project can be opened any more".
+   */
+  function tryAttach(
+    window: W,
+    targets: Target[],
+    registration: SimulatorUiExtensionRegistration,
+  ): void {
+    try {
+      attach(window, targets, registration)
+    } catch (error) {
+      console.warn(
+        `[simulator-ui] project window did not take extension "${registration.id}":`,
+        error instanceof Error ? error.message : String(error),
+      )
+    }
+  }
+
+  return {
+    attachTo: (window) => {
+      for (const [registration, targets] of ledger) tryAttach(window, targets, registration)
+    },
+    register: (registration) => {
+      // Checked here, before anything is recorded: the ledger owns the
+      // app-level set of registrations, and hosts register in `onSetup` where
+      // there is no project window to do the checking. A rejected registration
+      // must leave no record — otherwise it is handed to every project window
+      // opened afterwards and takes each of them down as it is built.
+      // Snapshotted before anything reads it: the ledger outlives this call and
+      // hands the registration to every project window opened later, so a host
+      // that reuses its object to describe the next extension would otherwise
+      // rewrite what an already-registered one means — the id it releases, and
+      // the extension future windows are given.
+      const snapshot: SimulatorUiExtensionRegistration = { ...registration }
+      assertSimulatorUiExtensionShape(snapshot)
+      const id = snapshot.id
+      if (ids.has(id)) {
+        throw new Error(`Simulator UI extension "${id}" is already registered`)
+      }
+      const targets: Target[] = []
+      ids.add(id)
+      ledger.set(snapshot, targets)
+      for (const window of deps.projectWindows()) tryAttach(window, targets, snapshot)
+      return {
+        dispose: () => {
+          // Only while this registration is the one holding the id: a second
+          // dispose must not free an id a later registration now owns.
+          if (!ledger.delete(snapshot)) return
+          ids.delete(id)
+          // Copied: disposing a window-owned record splices it out of `targets`.
+          for (const target of [...targets]) void target.owned.dispose()
+          targets.length = 0
+        },
+        invoke: (method, params) => {
+          const active = deps.activeWindow()
+          const target = targets.find((t) => t.window === active) ?? targets[targets.length - 1]
+          if (!target) throw new Error('simulator UI extension has no live window')
+          return target.extension.invoke(method, params)
+        },
+      }
+    },
+  }
+}
diff --git a/packages/devtools/src/main/app/window-close-reveal.harness.ts b/packages/devtools/src/main/app/window-close-reveal.harness.ts
new file mode 100644
index 00000000..378dac26
--- /dev/null
+++ b/packages/devtools/src/main/app/window-close-reveal.harness.ts
@@ -0,0 +1,84 @@
+/**
+ * Shared vitest mock harness for the list/workbench-window close-guard test
+ * files (`main-window-close-guard.test.ts`, `workbench-window-reveal-on-
+ * close.test.ts`, and siblings) — all drive the REAL `createDevtoolsRuntime`
+ * against the electron/fs/`@dimina-kit/devkit` mock set defined in
+ * `../runtime/devtools-runtime-mock.harness.ts`, plus the runtime-lifecycle
+ * and window-opening helpers below that those tests need in common.
+ *
+ * `vi.mock(...)` calls in the imported core module run once per importing
+ * test file's own isolated module graph (vitest scopes mocking per test
+ * file); chaining through this module has the same effect as if they were
+ * written directly in the importing file.
+ */
+import { beforeEach, vi } from 'vitest'
+import { stubs, devkitStubs } from '../runtime/devtools-runtime-mock.harness.js'
+
+export { stubs, devkitStubs } from '../runtime/devtools-runtime-mock.harness.js'
+
+/**
+ * Shared per-test setup: reset modules (fresh module-level state each test),
+ * reset the mock harness above, and dynamically re-import `electron` +
+ * `createDevtoolsRuntime` + the lifecycle flag — dynamic, not a static
+ * top-level import, because it must happen AFTER `vi.resetModules()` picks
+ * up a fresh module instance each test. Registers its own `beforeEach`; call
+ * once per describing test file.
+ */
+export interface RuntimeTestState {
+  createDevtoolsRuntime: typeof import('./app.js').createDevtoolsRuntime
+  registerAppLifecycle: typeof import('./lifecycle.js').registerAppLifecycle
+  isAppQuitting: typeof import('./lifecycle.js').isAppQuitting
+  electron: typeof import('electron')
+}
+
+export function registerRuntimeTestLifecycle(): RuntimeTestState {
+  const state = {} as RuntimeTestState
+  beforeEach(async () => {
+    vi.resetModules()
+    stubs.reset()
+    devkitStubs.sessionClose.mockClear()
+    state.electron = await import('electron')
+    ;({ createDevtoolsRuntime: state.createDevtoolsRuntime } = await import('./app.js'))
+    ;({ registerAppLifecycle: state.registerAppLifecycle, isAppQuitting: state.isAppQuitting } =
+      await import('./lifecycle.js'))
+  })
+  return state
+}
+
+/**
+ * Registers `projectDir` as an openable project (app.json present, empty
+ * projects list) and opens it in its own window via the real
+ * `openProjectWindow`. Does NOT open a devkit session — the close guards
+ * under test branch on window-list membership, not session state (teardown
+ * is unconditional; see workbench-window.ts's `wireWorkbenchWindowEvents`
+ * doc comment), so a session adds cost without adding coverage here.
+ */
+export async function openProjectWindow(
+  instance: Awaited<ReturnType<typeof import('./app.js').createDevtoolsRuntime>>,
+  projectDir: string,
+): Promise<ReturnType<Awaited<ReturnType<typeof import('./app.js').createDevtoolsRuntime>>['projectWindows']>[number]> {
+  stubs.projectsWithAppJson.add(projectDir)
+  if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+  await instance.openProjectWindow({ path: projectDir })
+  // The manager keys its window map by project path and this helper always
+  // opens a path it just registered, so the newest entry is the one that was
+  // asked for. Matching on anything weaker (e.g. "the first window that isn't
+  // the list window") hands back the PREVIOUSLY opened project once a second
+  // one is open, which is exactly the multi-window case these tests exist for.
+  const found = instance.projectWindows().at(-1)
+  if (!found) throw new Error(`openProjectWindow(${projectDir}) did not publish a window`)
+  return found
+}
+
+/** A fresh Electron-shaped close event, plus a getter for whether it was prevented. */
+export function makeCloseEvent(): { event: { preventDefault: () => void }; prevented: () => boolean } {
+  let count = 0
+  return {
+    event: { preventDefault: () => { count += 1 } },
+    prevented: () => count > 0,
+  }
+}
+
+export function emitClose(win: unknown, event: unknown): void {
+  ;(win as { emit: (event: string, ...args: unknown[]) => void }).emit('close', event)
+}
diff --git a/packages/devtools/src/main/app/window-events.ts b/packages/devtools/src/main/app/window-events.ts
new file mode 100644
index 00000000..88dea275
--- /dev/null
+++ b/packages/devtools/src/main/app/window-events.ts
@@ -0,0 +1,45 @@
+import { app, BrowserWindow } from 'electron'
+import fs from 'fs'
+import { toDisposable, type Disposable } from '@dimina-kit/electron-deck/main'
+
+/**
+ * Bring `win` back in front of the user from any hidden or minimized state.
+ *
+ * The project-list window hides instead of closing while projects are open —
+ * it owns app-level IPC that cannot be registered a second time, so it must
+ * outlive its own close button — which makes "show the project list" a real
+ * operation with several entry points (the menu, a macOS dock activate, the
+ * last project window closing). They all go through here so none of them can
+ * drift into handling only some of the hidden states.
+ */
+export function revealWindow(win: BrowserWindow): void {
+  if (win.isDestroyed()) return
+  if (win.isMinimized()) win.restore()
+  win.show()
+  win.focus()
+}
+
+export function enableDevRendererAutoReload(rendererDir: string): Disposable {
+  // Auto-reload renderer windows when dist files change during development
+  if (app.isPackaged) {
+    return toDisposable(() => {})
+  }
+
+  let reloadTimer: ReturnType<typeof setTimeout> | null = null
+  const watcher = fs.watch(rendererDir, { recursive: true }, () => {
+    if (reloadTimer) clearTimeout(reloadTimer)
+    reloadTimer = setTimeout(() => {
+      for (const win of BrowserWindow.getAllWindows()) {
+        win.webContents.reload()
+      }
+    }, 300)
+  })
+
+  return toDisposable(() => {
+    if (reloadTimer) {
+      clearTimeout(reloadTimer)
+      reloadTimer = null
+    }
+    watcher.close()
+  })
+}
diff --git a/packages/devtools/src/main/app/window-runtime-services.ts b/packages/devtools/src/main/app/window-runtime-services.ts
new file mode 100644
index 00000000..f7e390f4
--- /dev/null
+++ b/packages/devtools/src/main/app/window-runtime-services.ts
@@ -0,0 +1,225 @@
+import type { BrowserWindow } from 'electron'
+import type { ConnectionRegistry, DisposableRegistry } from '@dimina-kit/electron-deck/main'
+import type { SyncStorageChange } from '../../shared/ipc-channels.js'
+import type { SenderPolicy } from '../utils/ipc-registry.js'
+import type { BridgeRouterHandle } from '../ipc/bridge-router.js'
+import type { CdpSessionBroker } from '../services/cdp-session/index.js'
+import type { InternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js'
+import type { NetworkForwarder } from '../services/network-forward/index.js'
+import type { AppDataTap } from '../services/simulator-appdata/index.js'
+import type { StorageApi } from '../services/simulator-storage/index.js'
+import type { WorkspaceService } from '../services/workspace/workspace-service.js'
+import { resolveNativeAppDataKeys, resolveNativeStorageOverview } from './native-overview.js'
+import { registerMcpWindow, noteActiveBridgeId } from '../services/mcp/index.js'
+import { createRenderInspector } from '../services/render-inspect/index.js'
+import { setupSimulatorStorage } from '../services/simulator-storage/index.js'
+import { createNetworkForwarder } from '../services/network-forward/index.js'
+import { setupSimulatorWxml } from '../services/simulator-wxml/index.js'
+import { setupSimulatorAppData } from '../services/simulator-appdata/index.js'
+import { setupSimulatorCurrentPage } from '../services/simulator-current-page/index.js'
+import { toDisposable } from '@dimina-kit/electron-deck/main'
+
+/**
+ * Narrow view of the context fields these services read, plus the four fields
+ * they publish back onto it for bridge-router to consume.
+ */
+export interface WindowRuntimeContext {
+  registry: DisposableRegistry
+  connections: ConnectionRegistry
+  cdpSessionBroker: CdpSessionBroker
+  senderPolicy: SenderPolicy
+  workspace: WorkspaceService
+  bridge?: BridgeRouterHandle
+  internalDevtoolsWindow?: InternalDevtoolsWindow
+  storageApi?: StorageApi
+  onServiceStorageChanged?: (appId: string, change: SyncStorageChange) => void
+  networkForward?: NetworkForwarder
+  appData?: AppDataTap
+}
+
+/**
+ * Resolve the active project's appId. Shared by the storage panel filter, the
+ * native-host WXML/element-inspect services (which scope the active render
+ * guest by appId) and the editor's per-project workspace identity.
+ */
+export function createActiveAppIdResolver(context: Pick<WindowRuntimeContext, 'workspace'>): () => string | null {
+  return () => {
+    const session = context.workspace.getSession()
+    const appInfo = session?.appInfo as { appId?: string } | undefined
+    return appInfo?.appId ?? null
+  }
+}
+
+/**
+ * Panel-backing services that push into one window's renderer: storage, and
+ * under native-host the MCP target tracking plus the WXML / AppData /
+ * current-page streams.
+ */
+export function setupWindowRuntimeServices(
+  context: WindowRuntimeContext,
+  mainWindow: BrowserWindow,
+  getActiveAppId: () => string | null,
+  projectPath: string,
+): void {
+  // MCP drives whichever project window the user is in, so each window records
+  // its own facts and this record dies with the window — other project windows
+  // keep theirs. The project path is the window's identity, taken from the
+  // project it opened with rather than read back off session state that does
+  // not exist until the first compile.
+  const mcpWindow = registerMcpWindow(context, {
+    nativeHost: false,
+    activeBridgeId: null,
+    nativeOverviewProvider: null,
+    projectPath,
+    getAppId: getActiveAppId,
+  })
+  context.registry.add(mcpWindow.dispose)
+
+  // Native-host: the real mini-app page runs in a nested render-host
+  // <webview> guest, not the localhost:7788 shell. Point the MCP
+  // `simulator` CDP target at the active render guest and keep it following
+  // the visible page across navigation/tab switches. Only wired under
+  // native-host so the default path stays byte-identical.
+  if (context.bridge?.isNativeHost()) {
+    mcpWindow.facts.nativeHost = true
+    mcpWindow.facts.nativeOverviewProvider = async () => {
+      const appId = getActiveAppId()
+      const stack = context.bridge?.getPageStack?.(appId ?? undefined) ?? []
+      const top = stack[stack.length - 1]
+      const overview = {
+        currentRoute: top?.pagePath ?? null,
+        pageStackDepth: stack.length,
+        storageKeys: [] as string[],
+        storageCount: 0,
+        appDataKeys: [] as string[],
+      }
+
+      if (appId) {
+        const storage = await resolveNativeStorageOverview(context, appId)
+        overview.storageKeys = storage.storageKeys
+        overview.storageCount = storage.storageCount
+        overview.appDataKeys = resolveNativeAppDataKeys(context, appId)
+      }
+
+      return overview
+    }
+    const off = context.bridge.onRenderEvent((ev) => noteActiveBridgeId(context, ev.bridgeId))
+    context.registry.add(off)
+  }
+
+  // Native-host inspector: injects the render-guest IIFE and drives WXML /
+  // element-highlight against the active render-host <webview>. Reused by
+  // the storage panel (element inspect) and the WXML panel service.
+  const renderInspector = createRenderInspector({ connections: context.connections, broker: context.cdpSessionBroker })
+
+  const storage = setupSimulatorStorage(mainWindow.webContents, {
+    senderPolicy: context.senderPolicy,
+    connections: context.connections,
+    broker: context.cdpSessionBroker,
+    // Scopes simulator-webview discovery to THIS window — otherwise a second
+    // project window can steal the first window's already-attached simulator
+    // (see setupSimulatorStorage's `window` option doc).
+    window: mainWindow,
+    // Per-project filter for the simulator-storage panel: the simulator
+    // uses a fixed `persist:simulator` partition + a fixed simulator.html
+    // origin, so localStorage is shared across every project that has
+    // ever opened. The dimina runtime isolates writes with `${appId}_`
+    // prefixes; this callback lets the storage panel filter the CDP
+    // snapshot/event stream to the active appId.
+    getActiveAppId,
+    // Native-host: route element inspection to the active render guest, and
+    // read/write storage from the service-host window's file:// store.
+    bridge: context.bridge,
+    renderInspector,
+  })
+  context.registry.add(storage)
+  // Native-host: expose the async-storage runtime hook so bridge-router
+  // routes async wx.setStorage/etc. to the unified service-host store.
+  if (storage.storageApi) {
+    context.storageApi = storage.storageApi
+    context.registry.add(() => { context.storageApi = undefined })
+    // SYNC wx storage writes bypass main (they hit the service-host localStorage
+    // directly); the service-host posts `storageChanged` and bridge-router routes
+    // it here so the Storage panel stays live without a manual reload.
+    context.onServiceStorageChanged = storage.onSyncStorageChange
+    context.registry.add(() => { context.onServiceStorageChanged = undefined })
+  }
+
+  // Native-host WXML + AppData panels: main sources the data (WXML pulled
+  // from the active render guest; AppData tapped from the service→render
+  // setData stream in bridge-router) and pushes it to the renderer. Inert on
+  // the default dimina-fe path (which sources both from the simulator
+  // miniappSnapshot transport), so only wire them when native-host is on.
+  if (context.bridge?.isNativeHost()) {
+    // Native-host: surface the simulator WCV's network (wx.request/download/
+    // upload run there, not in the service host) in the embedded DevTools by
+    // injecting its raw Network.* CDP events into the DevTools front-end so the
+    // native Network tab renders them (service-host console line is the
+    // fallback). The ViewManager calls the forwarder's attachSimulator +
+    // setDevtoolsHost from attachNativeSimulator once the simulator WCV +
+    // DevTools host exist; getServiceWc here is the fallback sink target.
+    const networkForward = createNetworkForwarder({
+      getServiceWc: (appId) => context.bridge?.getServiceWc(appId) ?? null,
+      getResourceServerBaseUrl: () => context.bridge?.getResourceBaseUrl?.() ?? null,
+      // The simulator shell's own static-asset server (serves simulator.html
+      // + its JS/CSS, independent from the resource server above — see
+      // NetworkForwarderBridge.getSimulatorServerBaseUrl's doc). Host is
+      // always 'localhost' — see shared/simulator-route.ts's
+      // buildSimulatorUrlFromSpec default. Absent (null port) when no
+      // project is open.
+      getSimulatorServerBaseUrl: () => {
+        const port = context.workspace?.getSession()?.port
+        return typeof port === 'number' ? `http://localhost:${port}/` : null
+      },
+      connections: context.connections,
+      broker: context.cdpSessionBroker,
+    })
+    context.networkForward = networkForward
+    context.registry.add(networkForward)
+    context.registry.add(() => { context.networkForward = undefined })
+    // Global mirror: once the standalone internal
+    // DevTools window builds its own front-end host, mirror the full
+    // unfiltered Network stream into it. Attached AFTER context.networkForward
+    // is assigned above — the callback re-reads the mutable field on every
+    // fire, so ordering only matters for readability here, not correctness.
+    context.registry.add(toDisposable(
+      context.internalDevtoolsWindow?.onHostChanged((hostWc) => {
+        context.networkForward?.setGlobalDevtoolsHost(hostWc)
+      }) ?? (() => {}),
+    ))
+
+    // Main-process WebSocket traffic (wx.connectSocket runs on the Node `ws`
+    // transport, invisible to any webContents debugger): bridge-router fans
+    // the trace stream out here, and the forwarder synthesizes it into
+    // Network.webSocket* CDP events for the same Network panel sinks.
+    context.registry.add(toDisposable(
+      context.bridge?.onNativeWebSocketTrace?.((ownerId, event) => {
+        context.networkForward?.reportWebSocketTrace(ownerId, event)
+      }) ?? (() => {}),
+    ))
+
+    context.registry.add(setupSimulatorWxml(mainWindow.webContents, {
+      senderPolicy: context.senderPolicy,
+      bridge: context.bridge,
+      inspector: renderInspector,
+      getActiveAppId,
+    }))
+    const appDataService = setupSimulatorAppData(mainWindow.webContents, {
+      senderPolicy: context.senderPolicy,
+      getActiveAppId,
+      // AppData-panel edit write-back target: the service-host window owning
+      // the edited page bridge.
+      bridge: context.bridge,
+    })
+    // bridge-router feeds this via ctx.appData (service→render tap + evict).
+    context.appData = appDataService
+    context.registry.add(appDataService)
+    context.registry.add(() => { context.appData = undefined })
+    // Push the visible page route to the toolbar on every navigation (the
+    // page stack lives in the DeviceShell WCV, invisible to renderer
+    // <webview> nav events).
+    context.registry.add(setupSimulatorCurrentPage(mainWindow.webContents, {
+      bridge: context.bridge,
+    }))
+  }
+}
diff --git a/packages/devtools/src/main/app/workbench-modules.ts b/packages/devtools/src/main/app/workbench-modules.ts
new file mode 100644
index 00000000..95ae2021
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-modules.ts
@@ -0,0 +1,76 @@
+import type { DisposableRegistry } from '@dimina-kit/electron-deck/main'
+import type { BuiltinModuleId, WorkbenchAppConfig } from '../../shared/types.js'
+import {
+  popoverModule,
+  projectsModule,
+  sessionModule,
+  settingsModule,
+  simulatorModule,
+} from '../ipc/index.js'
+import type { WorkbenchModule } from '../services/module.js'
+import type { WindowContextRouter } from '../services/window-contexts/context-router.js'
+import type { ProjectWindow } from './project-window.js'
+
+/**
+ * The window context type, taken from `ProjectWindow` so this module doesn't
+ * import `WorkbenchContext` directly (see eslint-workbench-context-gate).
+ */
+type WindowContext = ProjectWindow['context']
+
+const DEFAULT_MODULES: Record<BuiltinModuleId, boolean> = {
+  projects: true,
+  session: true,
+  simulator: true,
+  popover: true,
+  settings: true,
+}
+
+const BUILTIN_MODULES: Record<BuiltinModuleId, WorkbenchModule> = {
+  projects: projectsModule,
+  session: sessionModule,
+  simulator: simulatorModule,
+  popover: popoverModule,
+  settings: settingsModule,
+}
+
+function resolveModules(config: WorkbenchAppConfig): Record<BuiltinModuleId, boolean> {
+  return {
+    ...DEFAULT_MODULES,
+    ...config.modules,
+  }
+}
+
+/**
+ * The IPC half of the built-in modules: registered ONCE for the application.
+ * Each handler answers whichever window a message came from (it takes the
+ * router), so a second window needs no second registration — and must not make
+ * one, since `ipcMain.handle` is a process-wide singleton per channel.
+ */
+export function registerModuleIpc(
+  config: WorkbenchAppConfig,
+  router: WindowContextRouter<WindowContext>,
+  appRegistry: DisposableRegistry,
+): void {
+  const modules = resolveModules(config)
+  ;(Object.keys(modules) as BuiltinModuleId[]).forEach((moduleId) => {
+    if (!modules[moduleId]) return
+    appRegistry.add(BUILTIN_MODULES[moduleId].setup(router))
+  })
+}
+
+/**
+ * The per-window half: wiring that mutates one concrete context (the
+ * simulator's bridge router assigning `ctx.bridge` / `ctx.consoleForwarder`).
+ * Runs once per window and is parked on that window's own registry.
+ */
+export function setupWindowModules(
+  config: WorkbenchAppConfig,
+  context: WindowContext,
+): void {
+  const modules = resolveModules(config)
+  ;(Object.keys(modules) as BuiltinModuleId[]).forEach((moduleId) => {
+    if (!modules[moduleId]) return
+    const module = BUILTIN_MODULES[moduleId]
+    if (module.setupWindow) context.registry.add(module.setupWindow(context))
+  })
+}
diff --git a/packages/devtools/src/main/app/workbench-window-close-hook.test.ts b/packages/devtools/src/main/app/workbench-window-close-hook.test.ts
new file mode 100644
index 00000000..2a40ffbd
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-close-hook.test.ts
@@ -0,0 +1,167 @@
+/**
+ * THE HOST'S `onBeforeClose` HOOK AND THE CLOSING PROJECT WINDOW.
+ *
+ * Three properties of the close path, all about the boundary between host
+ * code and the framework's own teardown:
+ *
+ * - Host code runs on the way out, but it cannot cancel the framework's
+ *   cleanup. A hook that rejects still leaves the window disposed and the
+ *   list window back on screen; otherwise the app keeps running with a dead
+ *   session and, when the last project closes, nothing visible at all.
+ * - The hook is told WHICH project is closing. With several project windows
+ *   open, a hook that only gets the app instance cannot tell them apart —
+ *   `instance.context` is always the list window's, which owns no session.
+ * - "One window per project" holds for the WHOLE close, not just up to the
+ *   moment the map entry is dropped. A re-open arriving while the hook is
+ *   still running must wait, or the user gets two windows and two compile
+ *   sessions on one directory.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  openProjectWindow,
+  makeCloseEvent,
+  emitClose,
+} from './window-close-reveal.harness.js'
+
+const state = registerRuntimeTestLifecycle()
+
+interface DisposalProbe {
+  registry: { add: (fn: () => void) => unknown }
+}
+
+/** A context is disposed exactly when its registry refuses new entries. */
+function isDisposed(ctx: unknown): boolean {
+  try {
+    ;(ctx as DisposalProbe).registry.add(() => {})
+    return false
+  } catch {
+    return true
+  }
+}
+
+describe('host onBeforeClose that rejects', () => {
+  it('still disposes the window and brings the list window back', async () => {
+    const instance = await state.createDevtoolsRuntime({
+      onBeforeClose: () => Promise.reject(new Error('host failed to save its state')),
+    })
+    const projectWindow = await openProjectWindow(instance, '/tmp/hookRejectReveal')
+
+    // Hide the list window the way its close guard does with a project open.
+    emitClose(instance.mainWindow, makeCloseEvent().event)
+    await new Promise((r) => setTimeout(r, 0))
+    expect(instance.mainWindow.isVisible(), 'setup: the list window must be hidden first').toBe(false)
+
+    emitClose(projectWindow.window, makeCloseEvent().event)
+
+    await vi.waitFor(() => {
+      expect(projectWindow.window.isDestroyed()).toBe(true)
+    }, { timeout: 2000 })
+    expect(
+      isDisposed(projectWindow.context),
+      'host code must not be able to veto disposal of the session, bridge and editor server',
+    ).toBe(true)
+    expect(
+      instance.mainWindow.isVisible(),
+      'the last project window is gone — a failing host hook must not leave the user with nothing on screen',
+    ).toBe(true)
+    expect(instance.projectWindows()).toHaveLength(0)
+
+    await instance.dispose()
+  })
+})
+
+describe('the project handed to the host close hook', () => {
+  it('identifies the window being closed, not the project list', async () => {
+    interface ClosingArg { path: string; name?: string; context: unknown }
+    const seen: ClosingArg[] = []
+    const instance = await state.createDevtoolsRuntime({
+      onBeforeClose: (_instance, closing) => {
+        seen.push(closing as ClosingArg)
+      },
+    })
+    const first = await openProjectWindow(instance, '/tmp/hookIdentityA')
+    const second = await openProjectWindow(instance, '/tmp/hookIdentityB')
+
+    emitClose(second.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(seen).toHaveLength(1)
+    })
+    expect(
+      seen[0]?.path,
+      'a host saving per-project state needs to know which project is closing',
+    ).toBe('/tmp/hookIdentityB')
+    expect(
+      seen[0]?.context,
+      'the hook must receive the closing window\'s own context — the list window context owns no session',
+    ).toBe(second.context)
+    expect(seen[0]?.context).not.toBe(instance.context)
+
+    emitClose(first.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(seen).toHaveLength(2)
+    })
+    expect(
+      seen[1]?.path,
+      'each closing window must be reported as itself, not as whichever window closed first',
+    ).toBe('/tmp/hookIdentityA')
+    expect(seen[1]?.context).toBe(first.context)
+
+    await instance.dispose()
+  })
+})
+
+describe('re-opening a project while its window is still closing', () => {
+  it('waits for the previous window to finish tearing down instead of racing a second one', async () => {
+    let releaseHook!: () => void
+    const hookGate = new Promise<void>((resolve) => {
+      releaseHook = resolve
+    })
+    const events: string[] = []
+
+    const instance = await state.createDevtoolsRuntime({
+      onBeforeClose: async () => {
+        events.push('hook-start')
+        await hookGate
+        events.push('hook-end')
+      },
+    })
+    const first = await openProjectWindow(instance, '/tmp/reopenRace')
+    const disposeFirst = first.dispose.bind(first)
+    first.dispose = async () => {
+      await disposeFirst()
+      events.push('disposed')
+    }
+
+    emitClose(first.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(events).toContain('hook-start')
+    })
+
+    const reopen = instance.openProjectWindow({ path: '/tmp/reopenRace' }).then((win) => {
+      events.push('reopened')
+      return win
+    })
+    await new Promise((r) => setTimeout(r, 20))
+
+    expect(
+      events,
+      'a second window (and a second compile session) must not appear while the first is still tearing down',
+    ).not.toContain('reopened')
+
+    releaseHook()
+    await reopen
+
+    expect(
+      events,
+      'the re-open must be serialized behind the full teardown of the previous window',
+    ).toEqual(['hook-start', 'hook-end', 'disposed', 'reopened'])
+    expect(
+      instance.projectWindows(),
+      'one project, one window — including across a close/re-open overlap',
+    ).toHaveLength(1)
+    expect(instance.projectWindows()[0]).not.toBe(first)
+
+    await instance.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-dispose-terminates.test.ts b/packages/devtools/src/main/app/workbench-window-dispose-terminates.test.ts
new file mode 100644
index 00000000..ee49c919
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-dispose-terminates.test.ts
@@ -0,0 +1,246 @@
+/**
+ * TERMINATION SEMANTICS for `WorkbenchWindowManager.disposeAll()`.
+ *
+ * `disposeAll()` currently only snapshots and clears the `windows` map; it
+ * does not set any terminal state and does not touch `pathQueues`. That
+ * leaves two gaps:
+ *
+ * 1. An `open()` arriving after `disposeAll()` — directly, or dequeued later
+ *    from behind a close that was already queued on the same path — finds an
+ *    empty map and happily builds a brand new window, resurrecting a project
+ *    the app just tore down.
+ * 2. An `open()` already past the map insertion and awaiting
+ *    `setupEditorView()` when `disposeAll()` runs gets its window disposed
+ *    and destroyed out from under it. `disposeAll()` does not wait for this
+ *    in-flight open, so it can return before that race even resolves. The
+ *    open then resumes, finds nothing wrong, and hands the caller an
+ *    already-destroyed `BrowserWindow` while firing `onActiveContextChanged`
+ *    for a window nothing can reach any more.
+ *
+ * These tests pin the contract: once `disposeAll()` starts, no `open()` —
+ * pending, queued, or in-flight — produces a live window, and `disposeAll()`
+ * does not return until every in-flight open has settled.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  makeCloseEvent,
+  emitClose,
+  stubs,
+} from './window-close-reveal.harness.js'
+
+const editorStubs = vi.hoisted(() => ({
+  gate: null as null | { promise: Promise<void>; resolve: () => void },
+  contexts: [] as unknown[],
+  created: [] as Array<{ window: { isDestroyed: () => boolean } }>,
+}))
+
+// Tracks every window the manager actually builds, so a rejected open can be
+// proven to have never built one — the assertion these tests exist to make.
+vi.mock('./project-window.js', async () => {
+  const actual = await vi.importActual<typeof import('./project-window.js')>('./project-window.js')
+  return {
+    ...actual,
+    createWorkbenchWindow: (...args: Parameters<typeof actual.createWorkbenchWindow>) => {
+      const projectWindow = actual.createWorkbenchWindow(...args)
+      editorStubs.created.push(projectWindow)
+      return projectWindow
+    },
+  }
+})
+
+// The last awaited step of `open()`, and a controllable pause point: with a
+// gate installed, setupEditorView parks here until the test releases it,
+// which is what lets a test land `disposeAll()` mid-open.
+vi.mock('./editor-view.js', () => ({
+  setupEditorView: vi.fn(async (_config: unknown, context: unknown) => {
+    editorStubs.contexts.push(context)
+    if (editorStubs.gate) await editorStubs.gate.promise
+  }),
+}))
+
+const state = registerRuntimeTestLifecycle()
+
+interface DisposalProbe {
+  registry: { add: (fn: () => void) => unknown }
+}
+
+/** A context is disposed exactly when its registry refuses new entries. */
+function isDisposed(ctx: DisposalProbe): boolean {
+  try {
+    ctx.registry.add(() => {})
+    return false
+  } catch {
+    return true
+  }
+}
+
+function createGate(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((res) => { resolve = res })
+  return { promise, resolve }
+}
+
+async function buildManager(onBeforeClose?: () => Promise<void>) {
+  const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+    await Promise.all([
+      import('./workbench-window.js'),
+      import('../services/app-services.js'),
+      import('../services/window-contexts/context-router.js'),
+      import('../utils/paths.js'),
+    ])
+  const onActiveContextChanged = vi.fn()
+  const manager = createWorkbenchWindowManager({
+    config: {},
+    rendererDir,
+    appServices: createAppServices({}),
+    router: createWindowContextRouter(),
+    setupWindowModules: () => {},
+    onActiveContextChanged,
+    onBeforeClose: onBeforeClose ?? (async () => {}),
+  })
+  return { manager, onActiveContextChanged }
+}
+
+function registerProject(path: string): void {
+  stubs.projectsWithAppJson.add(path)
+  if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+}
+
+describe('workbench window manager disposeAll termination', () => {
+  it('rejects any open() requested after disposeAll(), without building a window', async () => {
+    editorStubs.gate = null
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const { manager } = await buildManager()
+    registerProject('/tmp/afterDispose')
+
+    await manager.disposeAll()
+
+    await expect(
+      manager.open({ path: '/tmp/afterDispose' }),
+      'a manager that already tore everything down must not resurrect a project window',
+    ).rejects.toThrow(/disposed/)
+
+    expect(
+      editorStubs.created,
+      'the rejection must happen before any window is built',
+    ).toHaveLength(0)
+    expect(manager.list()).toHaveLength(0)
+  })
+
+  it('rejects an open() that was queued behind an in-flight close when disposeAll() runs', async () => {
+    editorStubs.gate = null
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const closeGate = createGate()
+    const { manager } = await buildManager(async () => { await closeGate.promise })
+    registerProject('/tmp/queuedOpen')
+
+    const window1 = await manager.open({ path: '/tmp/queuedOpen' })
+    expect(manager.list()).toHaveLength(1)
+
+    // Starts the close's teardown, which parks on the onBeforeClose gate and
+    // occupies this path's queue.
+    emitClose(window1, makeCloseEvent().event)
+
+    // Queued behind the still-pending close.
+    const secondOpen = manager.open({ path: '/tmp/queuedOpen' })
+
+    const disposeAllPromise = manager.disposeAll()
+    closeGate.resolve()
+
+    await expect(
+      secondOpen,
+      'an open dequeued after disposeAll() started must not build a second window',
+    ).rejects.toThrow(/disposed/)
+    await disposeAllPromise
+
+    expect(manager.list()).toHaveLength(0)
+    expect(
+      editorStubs.created,
+      'only the first, already-closing window should ever have been built',
+    ).toHaveLength(1)
+  })
+
+  it('waits for an open() stuck in setupEditorView, which tears itself down and rejects', async () => {
+    editorStubs.gate = createGate()
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const { manager, onActiveContextChanged } = await buildManager()
+    registerProject('/tmp/inFlightOpen')
+
+    const openPromise = manager.open({ path: '/tmp/inFlightOpen' })
+    await vi.waitFor(() => {
+      expect(editorStubs.contexts).toHaveLength(1)
+    }, { timeout: 2000 })
+
+    const callsBeforeDispose = onActiveContextChanged.mock.calls.length
+    let disposeAllSettled = false
+    const disposeAllPromise = manager.disposeAll().then(() => { disposeAllSettled = true })
+
+    // Give the pending gate a few microtask turns: disposeAll() must not
+    // resolve while the open it needs to wait for is still stuck.
+    await Promise.resolve()
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(
+      disposeAllSettled,
+      'disposeAll() must wait for the in-flight open to settle, not race past it',
+    ).toBe(false)
+
+    editorStubs.gate.resolve()
+
+    await expect(
+      openPromise,
+      'an open racing disposeAll() must reject instead of handing back a destroyed window',
+    ).rejects.toThrow(/disposed/)
+    await disposeAllPromise
+
+    expect(disposeAllSettled).toBe(true)
+    expect(manager.list()).toHaveLength(0)
+
+    const ctx = editorStubs.contexts.at(0) as DisposalProbe
+    expect(
+      isDisposed(ctx),
+      'the open must clean up the half-built context itself once it discovers it lost the race',
+    ).toBe(true)
+    expect(
+      editorStubs.created.at(0)?.window.isDestroyed(),
+      'the window built by the losing open must not be left on screen',
+    ).toBe(true)
+    expect(
+      onActiveContextChanged.mock.calls.length,
+      'a losing open must not announce itself as the active context',
+    ).toBe(callsBeforeDispose)
+  })
+
+  it('is idempotent: a second call does not throw or re-dispose the same window', async () => {
+    editorStubs.gate = null
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const { manager } = await buildManager()
+    registerProject('/tmp/idempotentDispose')
+
+    await manager.open({ path: '/tmp/idempotentDispose' })
+    expect(manager.list()).toHaveLength(1)
+
+    await manager.disposeAll()
+    expect(manager.list()).toHaveLength(0)
+
+    await expect(
+      manager.disposeAll(),
+      'a repeated disposeAll() must resolve cleanly, not throw on an already-torn-down state',
+    ).resolves.toBeUndefined()
+    expect(manager.list()).toHaveLength(0)
+
+    await expect(
+      manager.open({ path: '/tmp/idempotentDispose' }),
+      'the terminal state set by the first disposeAll() must still hold after a second call',
+    ).rejects.toThrow(/disposed/)
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-host-open-during-setup.test.ts b/packages/devtools/src/main/app/workbench-window-host-open-during-setup.test.ts
new file mode 100644
index 00000000..9719ad9e
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-host-open-during-setup.test.ts
@@ -0,0 +1,133 @@
+/**
+ * `deps.ready` gates every `open()` so a renderer racing ahead of the host's
+ * own `config.onSetup` never gets a window the host hasn't finished
+ * extending — see `workbench-window.ts`'s `ready` doc comment. But `ready`
+ * itself resolves only once `onSetup` settles (`app.ts`'s `markReady(setup)`),
+ * so a host that calls `instance.openProjectWindow()` FROM WITHIN its own
+ * `onSetup` deadlocks: `open()` awaits `ready`, and `ready` awaits the very
+ * `onSetup` call that is awaiting `open()`.
+ *
+ * The fix under test: `open()` takes a second, optional
+ * `{ awaitReady?: boolean }` argument. `awaitReady: false` lets the caller
+ * skip the readiness gate — the host uses it for its own
+ * `instance.openProjectWindow` calls, never for the renderer-facing IPC path,
+ * which must keep parking on `ready` exactly as today.
+ */
+import { describe, it, expect } from 'vitest'
+import { registerRuntimeTestLifecycle, stubs } from './window-close-reveal.harness.js'
+import type { WorkbenchWindowDeps, WorkbenchWindowManager } from './workbench-window.js'
+import type { ProjectRef } from './project-window.js'
+
+const state = registerRuntimeTestLifecycle()
+
+function registerProject(path: string): void {
+  stubs.projectsWithAppJson.add(path)
+  if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+}
+
+async function buildManager(ready: Promise<void>): Promise<WorkbenchWindowManager> {
+  const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+    await Promise.all([
+      import('./workbench-window.js'),
+      import('../services/app-services.js'),
+      import('../services/window-contexts/context-router.js'),
+      import('../utils/paths.js'),
+    ])
+  const deps: WorkbenchWindowDeps = {
+    config: {},
+    rendererDir,
+    appServices: createAppServices({}),
+    router: createWindowContextRouter(),
+    setupWindowModules: () => {},
+    ready,
+  }
+  return createWorkbenchWindowManager(deps)
+}
+
+/**
+ * Calls `open` with the not-yet-typed `awaitReady` option. The option is
+ * cast in, not typed on `WorkbenchWindowManager['open']`, so this helper is
+ * the one place a future signature change has to touch.
+ */
+function openWithOptions(
+  manager: WorkbenchWindowManager,
+  project: ProjectRef,
+  options: { awaitReady?: boolean },
+): Promise<unknown> {
+  return (manager.open as unknown as (p: ProjectRef, o?: { awaitReady?: boolean }) => Promise<unknown>)(
+    project,
+    options,
+  )
+}
+
+/** True if `p` has not settled after `ms` — never used to await a real resolution, only to prove one hasn't happened yet. */
+function isStillPendingAfter(p: Promise<unknown>, ms: number): Promise<boolean> {
+  const pending = Symbol('pending')
+  return Promise.race([
+    p.then(() => 'settled' as const, () => 'settled' as const),
+    new Promise<typeof pending>((resolve) => setTimeout(() => resolve(pending), ms)),
+  ]).then((result) => result === pending)
+}
+
+describe('workbench window open during a pending host onSetup', () => {
+  it('open(project, { awaitReady: false }) resolves while deps.ready never settles', async () => {
+    await state.createDevtoolsRuntime({})
+    const neverReady = new Promise<void>(() => {})
+    const manager = await buildManager(neverReady)
+    registerProject('/tmp/awaitReadyFalseResolves')
+
+    const opened = await Promise.race([
+      openWithOptions(manager, { path: '/tmp/awaitReadyFalseResolves' }, { awaitReady: false }),
+      new Promise((_, reject) => setTimeout(
+        () => reject(new Error('open(project, { awaitReady: false }) did not resolve within 2000ms even though deps.ready never settles')),
+        2000,
+      )),
+    ])
+
+    expect(opened, 'open() must still hand back the opened window').toBeDefined()
+  })
+
+  it('open(project) with no options keeps parking on deps.ready, unlike awaitReady:false', async () => {
+    await state.createDevtoolsRuntime({})
+    const neverReady = new Promise<void>(() => {})
+    const manager = await buildManager(neverReady)
+    registerProject('/tmp/awaitReadyDefaultParks')
+
+    const stillPending = await isStillPendingAfter(
+      manager.open({ path: '/tmp/awaitReadyDefaultParks' }),
+      250,
+    )
+
+    expect(stillPending, 'open() with no options must remain parked behind an unsettled deps.ready').toBe(true)
+  })
+})
+
+describe('app.ts: a host onSetup that opens its own project window', () => {
+  it('createDevtoolsRuntime settles even when onSetup awaits instance.openProjectWindow for a project it opens itself', async () => {
+    registerProject('/tmp/onSetupOpensOwnWindow')
+
+    const booted = await Promise.race([
+      state.createDevtoolsRuntime({
+        // `onSetup`'s declared param type (`WorkbenchHostInstance`) omits
+        // `openProjectWindow` — it is a runtime-only member of the fuller
+        // `WorkbenchAppInstance` this hook actually receives.
+        onSetup: async (instance) => {
+          await (instance as unknown as { openProjectWindow: (p: ProjectRef) => Promise<unknown> })
+            .openProjectWindow({ path: '/tmp/onSetupOpensOwnWindow' })
+        },
+      }).then((instance) => ({ settled: true as const, instance })),
+      new Promise<{ settled: false }>((resolve) => setTimeout(
+        () => resolve({ settled: false }),
+        2000,
+      )),
+    ])
+
+    expect(
+      booted.settled,
+      'instance.openProjectWindow awaited inside onSetup must not deadlock app boot (open() awaits ready, ready awaits onSetup)',
+    ).toBe(true)
+    if (booted.settled) {
+      expect(booted.instance.projectWindows()).toHaveLength(1)
+    }
+  }, 4000)
+})
diff --git a/packages/devtools/src/main/app/workbench-window-open-teardown.test.ts b/packages/devtools/src/main/app/workbench-window-open-teardown.test.ts
new file mode 100644
index 00000000..d64528c8
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-open-teardown.test.ts
@@ -0,0 +1,179 @@
+/**
+ * PARTIAL-OPEN AND HOOK-FAILURE TEARDOWN for workbench windows.
+ *
+ * Two failures that leave a window the app can no longer clean up:
+ *
+ * 1. `open()` rejects halfway (the editor's COI http server can fail on a
+ *    taken port or exhausted fds). The window, its context and its runtime
+ *    services already exist by then. Leaving them behind gives the user a
+ *    window whose close disposes nothing, and leaves a phantom entry in the
+ *    manager's map — which is what the list window consults to decide whether
+ *    to hide itself, so it hides behind a project that is not there.
+ * 2. The host's `onBeforeClose` hook rejects. Host code cannot be allowed to
+ *    veto OUR cleanup: the compile session, bridge router, editor server and
+ *    IPC registrations must go regardless.
+ *
+ * Both invariants are the same one: whatever happens, a workbench window
+ * leaves no live resources and no map entry behind.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  makeCloseEvent,
+  emitClose,
+  stubs,
+} from './window-close-reveal.harness.js'
+
+const editorStubs = vi.hoisted(() => ({
+  failWith: null as Error | null,
+  contexts: [] as unknown[],
+  created: [] as Array<{ window: { isDestroyed: () => boolean } }>,
+}))
+
+// Records every workbench window the manager builds, so a window abandoned by
+// a failed open can still be inspected — the manager's own list is exactly
+// what such a window must NOT appear in.
+vi.mock('./project-window.js', async () => {
+  const actual = await vi.importActual<typeof import('./project-window.js')>('./project-window.js')
+  return {
+    ...actual,
+    createWorkbenchWindow: (...args: Parameters<typeof actual.createWorkbenchWindow>) => {
+      const projectWindow = actual.createWorkbenchWindow(...args)
+      editorStubs.created.push(projectWindow)
+      return projectWindow
+    },
+  }
+})
+
+// The editor assembly is the last awaited step of `open()` and the realistic
+// place for a partial-open failure, so it is the seam this file drives.
+vi.mock('./editor-view.js', () => ({
+  setupEditorView: vi.fn(async (_config: unknown, context: unknown) => {
+    editorStubs.contexts.push(context)
+    if (editorStubs.failWith) throw editorStubs.failWith
+  }),
+}))
+
+const state = registerRuntimeTestLifecycle()
+
+interface DisposalProbe {
+  registry: { add: (fn: () => void) => unknown }
+}
+
+/** A context is disposed exactly when its registry refuses new entries. */
+function isDisposed(ctx: DisposalProbe): boolean {
+  try {
+    ctx.registry.add(() => {})
+    return false
+  } catch {
+    return true
+  }
+}
+
+describe('workbench window whose initialization fails partway', () => {
+  it('leaves no window, no context and no map entry behind, and reports the failure', async () => {
+    editorStubs.failWith = null
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    const instance = await state.createDevtoolsRuntime({})
+
+    stubs.projectsWithAppJson.add('/tmp/partialOpen')
+    if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+    editorStubs.failWith = new Error('COI server failed to bind')
+
+    await expect(
+      instance.openProjectWindow({ path: '/tmp/partialOpen' }),
+      'a failed initialization must reach the caller, not resolve with a broken window',
+    ).rejects.toThrow('COI server failed to bind')
+
+    expect(
+      instance.projectWindows(),
+      'a window that never finished opening must not count as an open project — the list window hides itself based on this',
+    ).toHaveLength(0)
+
+    const ctx = editorStubs.contexts.at(-1) as DisposalProbe
+    expect(ctx, 'setup: the failing open must have reached the editor step').toBeTruthy()
+    expect(
+      isDisposed(ctx),
+      'the half-built context owns runtime services and IPC registrations — the failure path must dispose it',
+    ).toBe(true)
+    expect(
+      editorStubs.created.at(-1)?.window.isDestroyed(),
+      'an orphan window with no working close handling must not be left on screen',
+    ).toBe(true)
+
+    editorStubs.failWith = null
+    await instance.dispose()
+  })
+
+  it('lets the same project be opened again after a failed attempt', async () => {
+    editorStubs.failWith = null
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    const instance = await state.createDevtoolsRuntime({})
+
+    stubs.projectsWithAppJson.add('/tmp/partialOpenRetry')
+    if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+    editorStubs.failWith = new Error('COI server failed to bind')
+    await expect(instance.openProjectWindow({ path: '/tmp/partialOpenRetry' })).rejects.toThrow()
+
+    editorStubs.failWith = null
+    await instance.openProjectWindow({ path: '/tmp/partialOpenRetry' })
+
+    expect(
+      instance.projectWindows(),
+      'the failed attempt must not leave a stale entry that swallows the retry',
+    ).toHaveLength(1)
+
+    await instance.dispose()
+  })
+})
+
+describe('workbench window teardown when the host close hook rejects', () => {
+  it('disposes the window context anyway', async () => {
+    editorStubs.failWith = null
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+
+    const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+      await Promise.all([
+        import('./workbench-window.js'),
+        import('../services/app-services.js'),
+        import('../services/window-contexts/context-router.js'),
+        import('../utils/paths.js'),
+      ])
+
+    const manager = createWorkbenchWindowManager({
+      config: {},
+      rendererDir,
+      appServices: createAppServices({}),
+      router: createWindowContextRouter(),
+      setupWindowModules: () => {},
+      onBeforeClose: async () => {
+        throw new Error('host onBeforeClose rejected')
+      },
+    })
+
+    stubs.projectsWithAppJson.add('/tmp/hookRejects')
+    if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+    const window = await manager.open({ path: '/tmp/hookRejects' })
+    const projectWindow = manager.list()[0]!
+    const ctx = projectWindow.context as unknown as DisposalProbe
+
+    emitClose(window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(window.isDestroyed()).toBe(true)
+    }, { timeout: 2000 })
+
+    expect(
+      isDisposed(ctx),
+      'a rejecting host hook must not strand the compile session, bridge and editor server',
+    ).toBe(true)
+    expect(
+      manager.list(),
+      'the window is gone, so it must not still count as an open project',
+    ).toHaveLength(0)
+
+    await manager.disposeAll()
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-path-identity.test.ts b/packages/devtools/src/main/app/workbench-window-path-identity.test.ts
new file mode 100644
index 00000000..3c416efa
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-path-identity.test.ts
@@ -0,0 +1,66 @@
+/**
+ * Contract: `WorkbenchWindowManager.open()` must resolve `project.path`
+ * before using it as the window-identity key. The manager keys `windows` and
+ * `pathQueues` by the raw string it receives (workbench-window.ts:135,141,
+ * 157,171) — two spellings of the same directory ('/tmp/proj-a' vs.
+ * '/tmp/proj-a/.') currently miss each other and open two windows over the
+ * same project instead of focusing the existing one.
+ *
+ * Harness: same direct `createWorkbenchWindowManager` construction as the
+ * third describe block in workbench-window-open-teardown.test.ts (the
+ * "host close hook rejects" case), reusing its shared electron/devkit mock
+ * set and stubs via window-close-reveal.harness.js.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  stubs,
+} from './window-close-reveal.harness.js'
+
+vi.mock('./editor-view.js', () => ({
+  setupEditorView: vi.fn(async () => {}),
+}))
+
+const state = registerRuntimeTestLifecycle()
+
+describe('WorkbenchWindowManager.open(): project.path identity is resolved, not compared as a raw string', () => {
+  it('a second open() of the same directory under a differently-spelled path reuses the first window', async () => {
+    await state.createDevtoolsRuntime({})
+
+    const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+      await Promise.all([
+        import('./workbench-window.js'),
+        import('../services/app-services.js'),
+        import('../services/window-contexts/context-router.js'),
+        import('../utils/paths.js'),
+      ])
+
+    const manager = createWorkbenchWindowManager({
+      config: {},
+      rendererDir,
+      appServices: createAppServices({}),
+      router: createWindowContextRouter(),
+      setupWindowModules: () => {},
+    })
+
+    const canonicalPath = '/tmp/proj-a'
+    // Deliberately NOT built with path.join/path.resolve — those normalize
+    // away the trailing '/.' before the manager ever sees it, defeating the
+    // point of this test (the manager itself must resolve, not its caller).
+    const respelledPath = '/tmp/proj-a/.'
+    stubs.projectsWithAppJson.add(canonicalPath)
+    stubs.projectsWithAppJson.add(respelledPath)
+    if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+
+    const first = await manager.open({ path: canonicalPath })
+    const second = await manager.open({ path: respelledPath })
+
+    expect(
+      manager.list(),
+      'a differently-spelled path pointing at the SAME directory must not open a second window',
+    ).toHaveLength(1)
+    expect(second, 'the resolved second open must hand back the already-open window, not a fresh one').toBe(first)
+
+    await manager.disposeAll()
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-ready-gate.test.ts b/packages/devtools/src/main/app/workbench-window-ready-gate.test.ts
new file mode 100644
index 00000000..9910ca72
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-ready-gate.test.ts
@@ -0,0 +1,117 @@
+/**
+ * APP-READINESS GATE for `WorkbenchWindowManager.open()`.
+ *
+ * `deps.ready`, when provided, must resolve before `open()` builds a window.
+ * `app.ts` registers the `OpenProjectWindow` IPC handler well before it
+ * awaits the host's own `config.onSetup` hook, so a renderer that races
+ * ahead can otherwise ask for a project window before the host has finished
+ * wiring itself up. Omitting `ready` must not change behavior — most
+ * managers never pass one.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  stubs,
+} from './window-close-reveal.harness.js'
+import type { WorkbenchWindowDeps } from './workbench-window.js'
+
+const editorStubs = vi.hoisted(() => ({
+  created: [] as Array<{ window: { isDestroyed: () => boolean } }>,
+}))
+
+// Tracks every window the manager actually builds, so "not built yet" can be
+// asserted directly instead of inferred from timing.
+vi.mock('./project-window.js', async () => {
+  const actual = await vi.importActual<typeof import('./project-window.js')>('./project-window.js')
+  return {
+    ...actual,
+    createWorkbenchWindow: (...args: Parameters<typeof actual.createWorkbenchWindow>) => {
+      const projectWindow = actual.createWorkbenchWindow(...args)
+      editorStubs.created.push(projectWindow)
+      return projectWindow
+    },
+  }
+})
+
+vi.mock('./editor-view.js', () => ({
+  setupEditorView: vi.fn(async () => {}),
+}))
+
+const state = registerRuntimeTestLifecycle()
+
+function createGate(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((res) => { resolve = res })
+  return { promise, resolve }
+}
+
+async function buildManager(ready?: Promise<void>) {
+  const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+    await Promise.all([
+      import('./workbench-window.js'),
+      import('../services/app-services.js'),
+      import('../services/window-contexts/context-router.js'),
+      import('../utils/paths.js'),
+    ])
+  const deps: WorkbenchWindowDeps = {
+    config: {},
+    rendererDir,
+    appServices: createAppServices({}),
+    router: createWindowContextRouter(),
+    setupWindowModules: () => {},
+    ready,
+  }
+  return createWorkbenchWindowManager(deps)
+}
+
+function registerProject(path: string): void {
+  stubs.projectsWithAppJson.add(path)
+  if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+}
+
+describe('workbench window manager app-readiness gate', () => {
+  it('does not build a window while deps.ready is still pending', async () => {
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    const manager = await buildManager(gate.promise)
+    registerProject('/tmp/readyGatePending')
+
+    const openPromise = manager.open({ path: '/tmp/readyGatePending' })
+    await Promise.resolve()
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(
+      editorStubs.created,
+      'open() must not build a workbench window before deps.ready resolves',
+    ).toHaveLength(0)
+
+    gate.resolve()
+    await openPromise
+
+    expect(editorStubs.created, 'the window is built once deps.ready resolves').toHaveLength(1)
+  })
+
+  it('builds the window once deps.ready has already resolved', async () => {
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const manager = await buildManager(Promise.resolve())
+    registerProject('/tmp/readyGateResolved')
+
+    await manager.open({ path: '/tmp/readyGateResolved' })
+
+    expect(editorStubs.created).toHaveLength(1)
+  })
+
+  it('builds the window immediately when deps.ready is not provided at all', async () => {
+    editorStubs.created.length = 0
+    await state.createDevtoolsRuntime({})
+    const manager = await buildManager(undefined)
+    registerProject('/tmp/readyGateOmitted')
+
+    await manager.open({ path: '/tmp/readyGateOmitted' })
+
+    expect(editorStubs.created).toHaveLength(1)
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-reveal-on-close.test.ts b/packages/devtools/src/main/app/workbench-window-reveal-on-close.test.ts
new file mode 100644
index 00000000..20170d18
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-reveal-on-close.test.ts
@@ -0,0 +1,95 @@
+/**
+ * LIST-WINDOW REVEAL ON LAST PROJECT CLOSE (per-project-window architecture).
+ *
+ * The list window hides instead of closing while any project window is open
+ * (see `main-window-close-guard.test.ts`). Once the LAST project window
+ * closes, `onBeforeClose` in app.ts's `createWorkbenchWindowManager` config
+ * must bring it back — otherwise the app keeps running with nothing on
+ * screen. `revealWindow` (window-events.ts) both un-hides and un-minimizes
+ * it.
+ *
+ * Closing one of SEVERAL open project windows must leave the list window
+ * alone — it is not the one the user was looking at, and stealing focus to
+ * it would be as wrong as leaving nothing on screen.
+ *
+ * Harness shared with `main-window-close-guard.test.ts` via
+ * `window-close-reveal.harness.ts`.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  openProjectWindow,
+  makeCloseEvent,
+  emitClose,
+} from './window-close-reveal.harness.js'
+
+const state = registerRuntimeTestLifecycle()
+
+describe('list window reveal on last project window close', () => {
+  it('re-shows a list window that was hidden behind the project it is closing', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const projectWindow = await openProjectWindow(instance, '/tmp/projRevealA')
+
+    // Hide the list window the way the close guard does with a project open.
+    emitClose(instance.mainWindow, makeCloseEvent().event)
+    await new Promise((r) => setTimeout(r, 0))
+    expect(instance.mainWindow.isVisible(), 'setup: list window must be hidden before the case under test').toBe(false)
+
+    const showSpy = vi.mocked(instance.mainWindow.show)
+    const focusSpy = vi.mocked(instance.mainWindow.focus)
+
+    emitClose(projectWindow.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(instance.mainWindow.isVisible()).toBe(true)
+    })
+
+    expect(
+      showSpy,
+      'the last project window is gone — the user needs the list window back on screen',
+    ).toHaveBeenCalled()
+    expect(focusSpy).toHaveBeenCalled()
+
+    await instance.dispose()
+  })
+
+  it('restores the list window first if it was minimized, then shows and focuses it', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const projectWindow = await openProjectWindow(instance, '/tmp/projRevealB')
+
+    instance.mainWindow.minimize()
+    expect(instance.mainWindow.isMinimized()).toBe(true)
+    const restoreSpy = vi.mocked(instance.mainWindow.restore)
+
+    emitClose(projectWindow.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(restoreSpy).toHaveBeenCalled()
+    })
+    expect(instance.mainWindow.isMinimized(), 'restore() must actually clear the minimized state').toBe(false)
+
+    await instance.dispose()
+  })
+
+  it('closing one of several open project windows leaves the list window alone', async () => {
+    const instance = await state.createDevtoolsRuntime({})
+    const pw1 = await openProjectWindow(instance, '/tmp/projRevealC1')
+    const pw2 = await openProjectWindow(instance, '/tmp/projRevealC2')
+    expect(instance.projectWindows().length).toBe(2)
+    void pw2
+
+    const showSpy = vi.mocked(instance.mainWindow.show)
+    const focusSpy = vi.mocked(instance.mainWindow.focus)
+
+    emitClose(pw1.window, makeCloseEvent().event)
+    await vi.waitFor(() => {
+      expect(instance.projectWindows().length).toBe(1)
+    })
+
+    expect(
+      showSpy,
+      'another project window is still open — the list window must not be pulled to the front',
+    ).not.toHaveBeenCalled()
+    expect(focusSpy).not.toHaveBeenCalled()
+
+    await instance.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-setup-hook.test.ts b/packages/devtools/src/main/app/workbench-window-setup-hook.test.ts
new file mode 100644
index 00000000..d908b4c1
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-setup-hook.test.ts
@@ -0,0 +1,189 @@
+/**
+ * SETUP HOOK CONTRACT for `WorkbenchWindowManager.open()`.
+ *
+ * `deps.setupProjectWindow`, when provided, is awaited after
+ * `setupEditorView()` finishes and before `open()` reports success. It
+ * receives the window's OWN project context — never whatever context the
+ * router currently considers active — so a host hook always configures the
+ * window it was just told about, not some other open project.
+ *
+ * A rejection from the hook is not survivable the way `onBeforeClose`'s is:
+ * there is no user-visible window left to run in yet, so `open()` must tear
+ * the half-built window down (destroy the `BrowserWindow`, dispose its
+ * context, drop it from `list()`) and reject with the hook's own error,
+ * exactly like a `setupEditorView()` failure already does.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import {
+  registerRuntimeTestLifecycle,
+  stubs,
+} from './window-close-reveal.harness.js'
+import type { ProjectWindow } from './project-window.js'
+import type { WorkbenchWindowDeps } from './workbench-window.js'
+
+const editorStubs = vi.hoisted(() => ({
+  contexts: [] as unknown[],
+  created: [] as Array<{
+    window: { isDestroyed: () => boolean }
+    context: { registry: { add: (fn: () => void) => unknown } }
+  }>,
+  order: [] as string[],
+}))
+
+// Tracks every window the manager actually builds, so a rejected open can be
+// proven to have torn its own window down — the assertion these tests exist
+// to make.
+vi.mock('./project-window.js', async () => {
+  const actual = await vi.importActual<typeof import('./project-window.js')>('./project-window.js')
+  return {
+    ...actual,
+    createWorkbenchWindow: (...args: Parameters<typeof actual.createWorkbenchWindow>) => {
+      const projectWindow = actual.createWorkbenchWindow(...args)
+      editorStubs.created.push(projectWindow)
+      return projectWindow
+    },
+  }
+})
+
+vi.mock('./editor-view.js', () => ({
+  setupEditorView: vi.fn(async (_config: unknown, context: unknown) => {
+    editorStubs.contexts.push(context)
+    editorStubs.order.push('editor')
+  }),
+}))
+
+const state = registerRuntimeTestLifecycle()
+
+interface DisposalProbe {
+  registry: { add: (fn: () => void) => unknown }
+}
+
+/** A context is disposed exactly when its registry refuses new entries. */
+function isDisposed(ctx: DisposalProbe): boolean {
+  try {
+    ctx.registry.add(() => {})
+    return false
+  } catch {
+    return true
+  }
+}
+
+function createGate(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void
+  const promise = new Promise<void>((res) => { resolve = res })
+  return { promise, resolve }
+}
+
+async function buildManager(setupProjectWindow?: WorkbenchWindowDeps['setupProjectWindow']) {
+  const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+    await Promise.all([
+      import('./workbench-window.js'),
+      import('../services/app-services.js'),
+      import('../services/window-contexts/context-router.js'),
+      import('../utils/paths.js'),
+    ])
+  const onActiveContextChanged = vi.fn()
+  const deps: WorkbenchWindowDeps = {
+    config: {},
+    rendererDir,
+    appServices: createAppServices({}),
+    router: createWindowContextRouter(),
+    setupWindowModules: () => {},
+    onActiveContextChanged,
+    setupProjectWindow,
+  }
+  const manager = createWorkbenchWindowManager(deps)
+  return { manager, onActiveContextChanged }
+}
+
+function registerProject(path: string): void {
+  stubs.projectsWithAppJson.add(path)
+  if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+}
+
+describe('workbench window manager setupProjectWindow hook', () => {
+  it('awaits the hook after setupEditorView, and does not resolve open() until it settles', async () => {
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    editorStubs.order.length = 0
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    const setupProjectWindow = vi.fn(async () => {
+      editorStubs.order.push('setup')
+      await gate.promise
+    })
+    const { manager, onActiveContextChanged } = await buildManager(setupProjectWindow)
+    registerProject('/tmp/setupHookPending')
+
+    const openPromise = manager.open({ path: '/tmp/setupHookPending' })
+    await vi.waitFor(() => {
+      expect(setupProjectWindow).toHaveBeenCalledTimes(1)
+    }, { timeout: 2000 })
+
+    expect(editorStubs.order, 'setupEditorView must run before the hook').toEqual(['editor', 'setup'])
+    expect(
+      onActiveContextChanged,
+      'open() must not announce a context change while the hook is still pending',
+    ).not.toHaveBeenCalled()
+
+    let resolved = false
+    void openPromise.then(() => { resolved = true })
+    await Promise.resolve()
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(resolved, 'open() must not resolve while the hook is still pending').toBe(false)
+
+    gate.resolve()
+    await openPromise
+
+    expect(resolved).toBe(true)
+    expect(onActiveContextChanged).toHaveBeenCalled()
+  })
+
+  it('tears the window down and rejects with the hook\'s own error when it throws', async () => {
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    editorStubs.order.length = 0
+    await state.createDevtoolsRuntime({})
+    const failure = new Error('setup hook exploded')
+    const setupProjectWindow = vi.fn(async () => { throw failure })
+    const { manager, onActiveContextChanged } = await buildManager(setupProjectWindow)
+    registerProject('/tmp/setupHookThrows')
+
+    await expect(
+      manager.open({ path: '/tmp/setupHookThrows' }),
+      'open() must reject with the hook\'s own error, not a wrapped one',
+    ).rejects.toBe(failure)
+
+    expect(manager.list(), 'a window that failed setup must not remain listed').toHaveLength(0)
+    expect(
+      onActiveContextChanged,
+      'a failed open must never announce a context change',
+    ).not.toHaveBeenCalled()
+
+    const built = editorStubs.created.at(-1)
+    expect(built, 'the window under test must have been built before the hook ran').toBeDefined()
+    expect(built!.window.isDestroyed(), 'the window must be destroyed on hook failure').toBe(true)
+    expect(isDisposed(built!.context), 'the context must be disposed on hook failure').toBe(true)
+  })
+
+  it('passes the hook the window\'s own context, not another project\'s', async () => {
+    editorStubs.contexts.length = 0
+    editorStubs.created.length = 0
+    editorStubs.order.length = 0
+    await state.createDevtoolsRuntime({})
+    const seen: unknown[] = []
+    const setupProjectWindow = vi.fn(async (win: ProjectWindow) => { seen.push(win.context) })
+    const { manager } = await buildManager(setupProjectWindow)
+    registerProject('/tmp/setupHookCtxA')
+    registerProject('/tmp/setupHookCtxB')
+
+    await manager.open({ path: '/tmp/setupHookCtxA' })
+    await manager.open({ path: '/tmp/setupHookCtxB' })
+
+    expect(seen, 'the hook must run once per opened project').toHaveLength(2)
+    expect(seen[0], 'project A\'s hook call must see project A\'s own context').toBe(editorStubs.contexts[0])
+    expect(seen[1], 'project B\'s hook call must see project B\'s own context').toBe(editorStubs.contexts[1])
+    expect(seen[0], 'the two projects must never share a context').not.toBe(seen[1])
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window-show-after-setup-hook.test.ts b/packages/devtools/src/main/app/workbench-window-show-after-setup-hook.test.ts
new file mode 100644
index 00000000..7a3ad5e3
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window-show-after-setup-hook.test.ts
@@ -0,0 +1,279 @@
+/**
+ * PROJECT-WINDOW REVEAL CONTRACT.
+ *
+ * A project window is created hidden and must stay hidden until BOTH of
+ * these have happened, in either order:
+ *
+ *  - its `setupProjectWindow` hook has resolved (a hook that fails leaves
+ *    nothing worth showing — see `workbench-window-setup-hook.test.ts`), and
+ *  - the window's own `ready-to-show` has fired (Chromium's signal that the
+ *    first frame is paintable).
+ *
+ * Today `createConfiguredMainWindow` passes `config.projectWindow?.autoShow
+ * ?? true` straight into `createMainWindow`, which shows the window on
+ * `ready-to-show` alone — the hook's progress never enters into it. A hook
+ * that is still running (or about to throw) loses the race: the window
+ * flashes on screen and, on failure, is destroyed a moment later.
+ *
+ * `config.projectWindow.autoShow === false` is a separate, permanent opt-out:
+ * the framework must never show that window on its own, no matter what the
+ * hook does or how many times `ready-to-show` fires.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import { registerRuntimeTestLifecycle, stubs, makeCloseEvent, emitClose } from './window-close-reveal.harness.js'
+import type { WorkbenchAppConfig } from '../../shared/types.js'
+import type { WorkbenchWindowDeps } from './workbench-window.js'
+
+const state = registerRuntimeTestLifecycle()
+
+function registerProject(path: string): void {
+  stubs.projectsWithAppJson.add(path)
+  if (stubs.getProjectsJson() === null) stubs.setProjectsJson(JSON.stringify([]))
+}
+
+function createGate(): { promise: Promise<void>; resolve: () => void; reject: (err: unknown) => void } {
+  let resolve!: () => void
+  let reject!: (err: unknown) => void
+  const promise = new Promise<void>((res, rej) => { resolve = res; reject = rej })
+  return { promise, resolve, reject }
+}
+
+interface MockWindow {
+  emit: (event: string, ...args: unknown[]) => void
+  show: { mock: { calls: unknown[][] } }
+  showInactive: { mock: { calls: unknown[][] } }
+}
+
+/** Every call this test can observe the manager making to reveal the window. */
+function revealCallCount(win: MockWindow): number {
+  return win.show.mock.calls.length + win.showInactive.mock.calls.length
+}
+
+async function buildManager(
+  config: WorkbenchAppConfig,
+  setupProjectWindow: WorkbenchWindowDeps['setupProjectWindow'],
+  extraDeps?: Partial<WorkbenchWindowDeps>,
+) {
+  const [{ createWorkbenchWindowManager }, { createAppServices }, { createWindowContextRouter }, { rendererDir }] =
+    await Promise.all([
+      import('./workbench-window.js'),
+      import('../services/app-services.js'),
+      import('../services/window-contexts/context-router.js'),
+      import('../utils/paths.js'),
+    ])
+  const deps: WorkbenchWindowDeps = {
+    config,
+    rendererDir,
+    appServices: createAppServices({}),
+    router: createWindowContextRouter(),
+    setupWindowModules: () => {},
+    setupProjectWindow,
+    ...extraDeps,
+  }
+  return createWorkbenchWindowManager(deps)
+}
+
+describe('project window reveal waits on both the setup hook and ready-to-show', () => {
+  it('ready-to-show before the hook resolves must not reveal the window; the hook resolving does, exactly once', async () => {
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    const manager = await buildManager({}, async () => { await gate.promise })
+    registerProject('/tmp/showAfterHookPending')
+
+    const openPromise = manager.open({ path: '/tmp/showAfterHookPending' })
+    await vi.waitFor(() => {
+      expect(manager.list()).toHaveLength(1)
+    })
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    win.emit('ready-to-show')
+    expect(
+      revealCallCount(win),
+      'ready-to-show firing before the hook resolves must not reveal the window',
+    ).toBe(0)
+
+    gate.resolve()
+    await openPromise
+
+    expect(
+      revealCallCount(win),
+      'the window must be revealed exactly once, after the hook resolves',
+    ).toBe(1)
+  })
+
+  it('a rejecting hook must never reveal the window, even after ready-to-show fired', async () => {
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    const failure = new Error('setup hook exploded')
+    const manager = await buildManager({}, async () => { await gate.promise })
+    registerProject('/tmp/showAfterHookRejects')
+
+    const openPromise = manager.open({ path: '/tmp/showAfterHookRejects' })
+    await vi.waitFor(() => {
+      expect(manager.list()).toHaveLength(1)
+    })
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    win.emit('ready-to-show')
+    gate.reject(failure)
+
+    await expect(openPromise, 'open() must reject with the hook\'s own error').rejects.toBe(failure)
+    expect(
+      revealCallCount(win),
+      'a window whose hook failed must never be revealed, ready-to-show or not',
+    ).toBe(0)
+  })
+
+  it('a hook that resolves before ready-to-show only reveals once ready-to-show fires, and open() does not wait for the reveal', async () => {
+    await state.createDevtoolsRuntime({})
+    const manager = await buildManager({}, async () => {})
+    registerProject('/tmp/showAfterReadyToShowLate')
+
+    const openPromise = manager.open({ path: '/tmp/showAfterReadyToShowLate' })
+    await openPromise
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    expect(
+      revealCallCount(win),
+      'open() resolving (hook already settled) must not by itself reveal the window',
+    ).toBe(0)
+
+    win.emit('ready-to-show')
+    expect(revealCallCount(win), 'ready-to-show after the hook must reveal the window').toBe(1)
+  })
+
+  it('config.projectWindow.autoShow === false keeps the window hidden no matter what the hook or ready-to-show do', async () => {
+    await state.createDevtoolsRuntime({})
+    const config: WorkbenchAppConfig = { projectWindow: { autoShow: false } }
+    const manager = await buildManager(config, async () => {})
+    registerProject('/tmp/showAfterAutoShowFalse')
+
+    const openPromise = manager.open({ path: '/tmp/showAfterAutoShowFalse' })
+    await openPromise
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    win.emit('ready-to-show')
+    expect(
+      revealCallCount(win),
+      'projectWindow.autoShow: false must permanently opt the window out of the framework\'s own reveal',
+    ).toBe(0)
+  })
+})
+
+describe('a close or teardown that lands while the setup hook is pending must win the race', () => {
+  it('a window closed while the hook is still pending must never be revealed once the hook resolves', async () => {
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    let hookEntered = false
+    const manager = await buildManager({}, async () => {
+      hookEntered = true
+      await gate.promise
+    })
+    registerProject('/tmp/closeDuringSetupHook')
+
+    const openPromise = manager.open({ path: '/tmp/closeDuringSetupHook' })
+    await vi.waitFor(() => {
+      expect(hookEntered).toBe(true)
+    })
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    win.emit('ready-to-show')
+
+    // The window is asked to close while setupProjectWindow is still pending;
+    // teardown queues behind the still-running open on the same project path.
+    emitClose(win, makeCloseEvent().event)
+
+    gate.resolve()
+    await openPromise
+
+    expect(
+      revealCallCount(win),
+      'a window whose close was already requested must not be revealed just because the hook later resolved',
+    ).toBe(0)
+
+    await vi.waitFor(() => {
+      expect(manager.list()).toHaveLength(0)
+    })
+  })
+
+  it('a manager torn down by disposeAll while the hook is pending must never reveal the window', async () => {
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    let hookEntered = false
+    const manager = await buildManager({}, async () => {
+      hookEntered = true
+      await gate.promise
+    })
+    registerProject('/tmp/disposeAllDuringSetupHook')
+
+    const openPromise = manager.open({ path: '/tmp/disposeAllDuringSetupHook' })
+    await vi.waitFor(() => {
+      expect(hookEntered).toBe(true)
+    })
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    win.emit('ready-to-show')
+
+    const disposeAllPromise = manager.disposeAll()
+    gate.resolve()
+
+    await expect(
+      openPromise,
+      'an open whose hook resolved after disposeAll() began must reject, not hand back a window about to be destroyed',
+    ).rejects.toThrow(/disposed/)
+    await disposeAllPromise
+
+    expect(
+      revealCallCount(win),
+      'a window whose manager already started disposeAll() must not be revealed once the hook resolves',
+    ).toBe(0)
+  })
+
+  it('teardown queued behind an open that disposeAll already tore down must not run onBeforeClose again', async () => {
+    await state.createDevtoolsRuntime({})
+    const gate = createGate()
+    let hookEntered = false
+    const onBeforeClose = vi.fn(async () => {})
+    const manager = await buildManager(
+      {},
+      async () => {
+        hookEntered = true
+        await gate.promise
+      },
+      { onBeforeClose },
+    )
+    registerProject('/tmp/teardownAfterDisposeAllRace')
+
+    const openPromise = manager.open({ path: '/tmp/teardownAfterDisposeAllRace' })
+    await vi.waitFor(() => {
+      expect(hookEntered).toBe(true)
+    })
+    const win = manager.list()[0]!.window as unknown as MockWindow
+
+    win.emit('ready-to-show')
+
+    // Close is requested first, so its teardown queues behind this still-running
+    // open on the same project path (see `enqueue`); disposeAll() then begins
+    // while both are still queued.
+    emitClose(win, makeCloseEvent().event)
+    const disposeAllPromise = manager.disposeAll()
+    gate.resolve()
+
+    await expect(
+      openPromise,
+      'an open whose hook resolved after disposeAll() began must reject',
+    ).rejects.toThrow(/disposed/)
+    await disposeAllPromise
+    await vi.waitFor(() => {
+      expect(manager.list()).toHaveLength(0)
+    })
+
+    expect(
+      onBeforeClose,
+      'the queued teardown finds its window already torn down by the failed open and must not hand ' +
+        'a destroyed window to onBeforeClose a second time',
+    ).not.toHaveBeenCalled()
+    expect(revealCallCount(win)).toBe(0)
+    expect(manager.list()).toHaveLength(0)
+  })
+})
diff --git a/packages/devtools/src/main/app/workbench-window.ts b/packages/devtools/src/main/app/workbench-window.ts
new file mode 100644
index 00000000..04956891
--- /dev/null
+++ b/packages/devtools/src/main/app/workbench-window.ts
@@ -0,0 +1,394 @@
+import path from 'path'
+import type { BrowserWindow } from 'electron'
+import { toDisposable, type Disposable } from '@dimina-kit/electron-deck/main'
+import type { WorkbenchAppConfig } from '../../shared/types.js'
+import type { AppServices } from '../services/app-services.js'
+import type { WindowContextRouter } from '../services/window-contexts/context-router.js'
+import { createInternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js'
+import { revealMainWindow, wireMainWindowEvents } from '../windows/main-window/index.js'
+import { isAppQuitting } from './lifecycle.js'
+import { installGlobalMirrors } from './global-mirrors.js'
+import { setupEditorView } from './editor-view.js'
+import { createActiveAppIdResolver, setupWindowRuntimeServices } from './window-runtime-services.js'
+import { createWorkbenchWindow, type ProjectRef, type ProjectWindow } from './project-window.js'
+
+/**
+ * The window context type, taken from `ProjectWindow` so this module doesn't
+ * import `WorkbenchContext` directly (see eslint-workbench-context-gate).
+ */
+type WindowContext = ProjectWindow['context']
+
+export interface WorkbenchWindowDeps {
+  config: WorkbenchAppConfig
+  rendererDir: string
+  appServices: AppServices
+  router: WindowContextRouter<WindowContext>
+  /**
+   * Per-window module wiring — the `setupWindow` half of the built-in modules
+   * (notably the simulator's `installBridgeRouter`, which assigns `ctx.bridge`
+   * / `ctx.consoleForwarder` / `ctx.diagnostics`). The IPC half is registered
+   * once against the router and is NOT repeated here.
+   */
+  setupWindowModules: (ctx: WindowContext) => void
+  /**
+   * Told whenever `activeContext()` can have changed — a window opened, took
+   * focus, or was torn down. App-level services that hold something aimed at
+   * the active project window (the MCP CDP connections) re-aim on it.
+   */
+  onActiveContextChanged?: () => void
+  /**
+   * Host hook, awaited before a window tears its project down, and told which
+   * project that is. A rejection is logged and swallowed: the hook runs on the
+   * way out, so it can react but never cancel the teardown behind it.
+   */
+  onBeforeClose?: (win: ProjectWindow, project: ProjectRef) => Promise<void> | void
+  /**
+   * Host hook, awaited once the window is fully wired and before `open()`
+   * reports success, and told which project it belongs to. Unlike
+   * `onBeforeClose` it CAN fail the open: there is no usable window to react
+   * in yet, so a rejection tears the half-built window down and travels back
+   * to the caller unchanged.
+   */
+  setupProjectWindow?: (win: ProjectWindow, project: ProjectRef) => Promise<void> | void
+  /**
+   * Gate every open waits on before it builds anything. The app registers the
+   * open-project IPC before it awaits the host's own setup hook, so a renderer
+   * that races ahead must be parked rather than handed a window the host has
+   * not finished extending. Omitted means there is nothing to wait for.
+   */
+  ready?: Promise<void>
+}
+
+export interface WorkbenchWindowManager {
+  /**
+   * Open `project` in its own window, or focus the window already showing it.
+   * Resolves once the window exists and its per-window services are wired.
+   * Opens and closes of the same project are serialized, so a call arriving
+   * while that project's window is still closing waits it out and then opens a
+   * fresh window — never a second one alongside it. Rejects if the window
+   * cannot be brought up, leaving nothing behind.
+   *
+   * `awaitReady: false` skips parking on `deps.ready` (still queued behind
+   * other opens/closes of the same path). Only the host's own
+   * `instance.openProjectWindow` uses it — see `app.ts`'s call site for why.
+   * The renderer-facing IPC path always uses the default.
+   */
+  open: (project: ProjectRef, options?: { awaitReady?: boolean }) => Promise<BrowserWindow>
+  list: () => ProjectWindow[]
+  /**
+   * The workbench context the user is working in — the focused one, or the
+   * most recently opened when focus sits on the project list. Null until the
+   * first project window opens.
+   */
+  activeContext: () => WindowContext | null
+  /**
+   * Tear every workbench window down (app quit / runtime disposal). Terminal
+   * and idempotent: once it starts, no `open()` — pending, queued or already
+   * in flight — leaves a live window behind, and it does not resolve until
+   * every in-flight open or close has settled.
+   */
+  disposeAll: () => Promise<void>
+}
+
+/**
+ * Close semantics for a workbench window. Unlike the old single-window app —
+ * where closing meant "return this window to the project list" — closing a
+ * workbench window means the window itself goes away, so teardown must finish
+ * BEFORE the window is destroyed.
+ *
+ * Three guards, each covering a failure this app has actually shipped:
+ *
+ * 1. A real application quit (⌘Q / menu Quit / app.quit()) fires `before-quit`
+ *    first. Let it through: converting a quit into a project close swallows the
+ *    quit and the app can never exit with a project open.
+ * 2. A close arriving while teardown is already in flight (the user
+ *    rapid-double-clicked) MUST keep the window. This runs BEFORE any
+ *    session check on purpose: `closeProject()` → `disposeSession()`
+ *    synchronously nulls the active session before it finishes awaiting
+ *    `session.close()`, so a session-presence check would already read false
+ *    by the time the second close arrives, fall through with no
+ *    `preventDefault()`, and let Chromium destroy the window out from under a
+ *    live teardown.
+ * 3. Teardown is UNCONDITIONAL — deliberately not gated on
+ *    `hasActiveSession()`. A failed open (invalid/non-existent project) never
+ *    creates a session, yet the window still owns views, an editor server and
+ *    IPC registrations. Gating on session presence let that case skip teardown
+ *    entirely, which is how closing an invalid project used to take the whole
+ *    app down with it.
+ */
+function wireWorkbenchWindowEvents(
+  win: BrowserWindow,
+  ctx: WindowContext,
+  teardown: () => Promise<void>,
+): Disposable {
+  let closing = false
+  let torndown = false
+  return wireMainWindowEvents(win, {
+    context: ctx,
+    onResize: () => ctx.views.repositionAll(),
+    onClose: async (e) => {
+      if (isAppQuitting()) return
+      if (closing) {
+        e.preventDefault()
+        return
+      }
+      // Safety net for a `close()` that arrives after teardown finished (this
+      // module destroys the window itself, which emits no `close`).
+      if (torndown) return
+
+      e.preventDefault()
+      closing = true
+      try {
+        await teardown()
+      } catch (err) {
+        console.error('[workbench] workbench window teardown failed:', err)
+      } finally {
+        closing = false
+        torndown = true
+      }
+      if (!win.isDestroyed()) win.destroy()
+    },
+  })
+}
+
+export function createWorkbenchWindowManager(
+  deps: WorkbenchWindowDeps,
+): WorkbenchWindowManager {
+  const { config, rendererDir, appServices, router } = deps
+  // Keyed by project path: one window per project, so a second open of the
+  // same project focuses the existing window instead of racing two sessions
+  // (and two compile workers) over the same directory.
+  const windows = new Map<string, ProjectWindow>()
+  // Serializes every open and close of one project path. The map alone cannot
+  // carry "one window per project": an open has awaits in it, and a close
+  // awaits host code, so overlapping requests (a re-click on the project list,
+  // MCP's project_open) must queue rather than each find "no window" and build
+  // one. Entries are dropped once a path goes idle.
+  const pathQueues = new Map<string, Promise<unknown>>()
+  // Terminal state owned by this manager, deliberately not `isAppQuitting()`:
+  // a runtime can be disposed while the app keeps running, and a manager that
+  // has torn everything down must never build another window either way.
+  let disposed = false
+
+  function disposedError(): Error {
+    return new Error('workbench window manager is disposed')
+  }
+
+  function enqueue<T>(path: string, task: () => Promise<T>): Promise<T> {
+    const previous = pathQueues.get(path) ?? Promise.resolve()
+    // Same task on either outcome: a failed open or close must not wedge the
+    // queue for its path.
+    const result = previous.then(task, task)
+    const settled = result.then(() => {}, () => {})
+    pathQueues.set(path, settled)
+    void settled.then(() => {
+      if (pathQueues.get(path) === settled) pathQueues.delete(path)
+    })
+    return result
+  }
+
+  async function openWindow(project: ProjectRef): Promise<BrowserWindow> {
+    // Checked where the queued task starts running, not where it was queued:
+    // an open sitting behind a close on the same path can be dequeued long
+    // after `disposeAll()` began, and must fail instead of resurrecting a
+    // project the app just tore down.
+    if (disposed) throw disposedError()
+
+    const existing = windows.get(project.path)
+    if (existing && !existing.window.isDestroyed()) {
+      if (existing.window.isMinimized()) existing.window.restore()
+      existing.window.focus()
+      router.setActive(existing.context)
+      deps.onActiveContextChanged?.()
+      return existing.window
+    }
+
+    const projectWindow = createWorkbenchWindow(
+      { config, rendererDir, appServices, router },
+      project,
+    )
+    const { window, context } = projectWindow
+    windows.set(project.path, projectWindow)
+
+    // Reveal gate: the window is created hidden (see `createWorkbenchWindow`)
+    // and must stay hidden until BOTH the renderer has painted its first
+    // frame (`ready-to-show`) and `setupProjectWindow` has resolved —
+    // whichever finishes second triggers the reveal, exactly once. Wired
+    // before any `await` below so a renderer that paints before the hook
+    // settles (the common case) is never missed.
+    let rendererReady = false
+    let setupDone = false
+    let revealed = false
+    // Flipped the moment a close is requested, not when teardown runs: the
+    // close queues behind this open on the same path, so the hook can still
+    // resolve first and would otherwise show a window whose close was
+    // already asked for, only for the queued teardown to destroy it.
+    let closeRequested = false
+    const revealIfReady = () => {
+      if (revealed || !rendererReady || !setupDone) return
+      if (window.isDestroyed()) return
+      // Same for a manager already tearing everything down: `disposeAll()`
+      // waits for this open to settle, and the window must not flash on the
+      // way out.
+      if (closeRequested || disposed) return
+      // Permanent opt-out: the framework must never show this window, no
+      // matter how many times the two gates above are satisfied.
+      if (config.projectWindow?.autoShow === false) return
+      revealed = true
+      revealMainWindow(window)
+    }
+    window.once('ready-to-show', () => {
+      rendererReady = true
+      revealIfReady()
+    })
+
+    const teardown = async () => {
+      // A close queued behind an open that then failed (or lost to
+      // `disposeAll()`) finds the window already removed and torn down by
+      // that open's own undo path. Nothing is left to close, and the host
+      // hook must not be handed a disposed context and a destroyed window.
+      if (windows.get(project.path) !== projectWindow) return
+      try {
+        await deps.onBeforeClose?.(projectWindow, project)
+      } catch (err) {
+        // The hook is the host's chance to react, not a veto: everything below
+        // (compile session, bridge router, editor server, IPC and app-level
+        // listeners) has to go, and the map entry with it, or the window's
+        // resources outlive a window nothing can reach any more.
+        console.error('[workbench] host onBeforeClose hook failed:', err)
+      }
+      try {
+        await projectWindow.dispose()
+      } finally {
+        // Dropped LAST: while teardown is in flight this project still has a
+        // window, and an open arriving mid-close must queue behind it (see
+        // `enqueue`) instead of finding an empty map and building a second one.
+        if (windows.get(project.path) === projectWindow) windows.delete(project.path)
+      }
+      // After the map entry is gone, so listeners read the window that is left.
+      deps.onActiveContextChanged?.()
+    }
+
+    try {
+      // The standalone internal DevTools window debugs THIS window's renderer,
+      // so it is per-window wiring. `isAppQuitting` lets the controller stop
+      // intercepting 'close' during a real quit.
+      context.internalDevtoolsWindow = createInternalDevtoolsWindow(window, { isAppQuitting })
+      context.registry.add(toDisposable(() => context.internalDevtoolsWindow?.dispose()))
+
+      // Wired before the awaited steps below: the window is already closable
+      // even though it's still hidden behind the reveal gate above, so it
+      // must never exist without the close handling that disposes it.
+      context.registry.add(wireWorkbenchWindowEvents(window, context, () => {
+        closeRequested = true
+        return enqueue(project.path, teardown)
+      }))
+
+      // Whichever workbench window the user is looking at answers the IPC that
+      // no single window owns (menus, app-level host windows).
+      const onFocus = () => {
+        router.setActive(context)
+        deps.onActiveContextChanged?.()
+      }
+      window.on('focus', onFocus)
+      context.registry.add(toDisposable(() => {
+        if (!window.isDestroyed()) window.removeListener('focus', onFocus)
+      }))
+
+      // Order matters: the bridge router assigns ctx.bridge / ctx.consoleForwarder
+      // / ctx.diagnostics, which both the mirrors and the runtime services read.
+      deps.setupWindowModules(context)
+      installGlobalMirrors(context, window)
+
+      const getActiveAppId = createActiveAppIdResolver(context)
+      setupWindowRuntimeServices(context, window, getActiveAppId, project.path)
+      await setupEditorView(config, context, getActiveAppId)
+      // `disposeAll()` can land while this open is parked above. It waits for
+      // this task to settle rather than reaching into a half-built window, so
+      // the undo below is this open's own job.
+      if (disposed) throw disposedError()
+      // Last, so the host configures a window whose own services are all up.
+      // It runs while the window is already in `windows`: a hook that opens
+      // views or drives the session needs the window reachable, and a failure
+      // path below removes the entry again.
+      await deps.setupProjectWindow?.(projectWindow, project)
+      // Re-checked after the hook for the same reason as before it: the hook
+      // is host code of unbounded duration, and an open that lost the race
+      // must reject rather than hand back a window `disposeAll()` is about
+      // to destroy.
+      if (disposed) throw disposedError()
+      // Does not block `open()` returning: if `ready-to-show` already fired,
+      // this reveals now; otherwise it just marks the gate and the pending
+      // `ready-to-show` listener above reveals once Chromium paints.
+      setupDone = true
+      revealIfReady()
+    } catch (err) {
+      // A half-built window (the editor's http server can fail to bind) leaves
+      // live services behind and keeps the project counted as open — which is
+      // what the list window reads to decide whether to stay hidden. Undo the
+      // whole thing before handing the failure back.
+      windows.delete(project.path)
+      await projectWindow.dispose().catch((disposeErr) => {
+        console.warn('[workbench] failed to dispose a partially opened window:', disposeErr)
+      })
+      if (!window.isDestroyed()) window.destroy()
+      throw err
+    }
+
+    deps.onActiveContextChanged?.()
+    return window
+  }
+
+  return {
+    // One project window per RESOLVED absolute path: two differently-spelled
+    // strings pointing at the same directory ('/a/b' vs '/a/b/.') must not
+    // race two windows (and two compile workers) over one project. Resolving
+    // here, before the path reaches `windows`/`pathQueues`/`openWindow`,
+    // keeps every downstream lookup keyed on the one canonical spelling.
+    open: (project, options) => {
+      const normalized: ProjectRef = { ...project, path: path.resolve(project.path) }
+      // The readiness gate is awaited inside the queued task, not before
+      // queuing: opens of one path must keep their arrival order, and a
+      // `disposeAll()` landing meanwhile still finds this open in the queue it
+      // drains rather than floating loose outside it.
+      const awaitReady = options?.awaitReady ?? true
+      return enqueue(normalized.path, async () => {
+        if (awaitReady) await deps.ready
+        return openWindow(normalized)
+      })
+    },
+    list: () => [...windows.values()],
+    activeContext: () => {
+      const active = router.active()
+      const all = [...windows.values()]
+      if (all.some((pw) => pw.context === active)) return active
+      return all.length > 0 ? all[all.length - 1]!.context : null
+    },
+    disposeAll: async () => {
+      // Set before waiting, never after: the in-flight opens and closes being
+      // waited on are exactly the code that has to observe the terminal state
+      // in order to finish instead of building on.
+      disposed = true
+      // Drained repeatedly because settling one entry releases whatever was
+      // queued behind it on the same path; new opens reject at their task
+      // start, so the queues run dry.
+      while (pathQueues.size > 0) {
+        await Promise.allSettled([...pathQueues.values()])
+      }
+
+      // Snapshotted only now: an open that lost the race above already removed
+      // and disposed itself, and a finished close already dropped its entry,
+      // so nothing here is disposed twice.
+      const all = [...windows.values()]
+      windows.clear()
+      // Serial: each teardown closes a devkit session and an http server, and
+      // a parallel storm during quit is exactly when those races bite.
+      for (const projectWindow of all) {
+        await projectWindow.dispose().catch((err) => {
+          console.warn('[workbench] failed to tear down workbench window:', err)
+        })
+        if (!projectWindow.window.isDestroyed()) projectWindow.window.destroy()
+      }
+    },
+  }
+}
diff --git a/packages/devtools/src/main/eslint-workbench-context-gate.test.ts b/packages/devtools/src/main/eslint-workbench-context-gate.test.ts
index 739c27f6..37d7f62c 100644
--- a/packages/devtools/src/main/eslint-workbench-context-gate.test.ts
+++ b/packages/devtools/src/main/eslint-workbench-context-gate.test.ts
@@ -535,7 +535,8 @@ describe('⑦ WorkbenchContext gate — round 4: grandfather inventory ceiling',
     ).toBe(21)
     expect(distribution).toEqual([
       'src/main/api.ts ×1',
-      'src/main/app/app.ts ×2',
+      'src/main/app/app.ts ×1',
+      'src/main/app/project-window.ts ×1',
       'src/main/ipc/app.ts ×1',
       'src/main/ipc/popover.ts ×1',
       'src/main/ipc/project-fs.ts ×1',
diff --git a/packages/devtools/src/main/ipc/app.ts b/packages/devtools/src/main/ipc/app.ts
index c3529dc5..f67d5d75 100644
--- a/packages/devtools/src/main/ipc/app.ts
+++ b/packages/devtools/src/main/ipc/app.ts
@@ -3,12 +3,13 @@ import { AppChannel } from '../../shared/ipc-channels.js'
 import type { WorkbenchContext } from '../services/workbench-context.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
-export function registerAppIpc(
-  ctx: Pick<WorkbenchContext, 'brandingProvider' | 'appName' | 'senderPolicy'>,
-): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(AppChannel.GetBranding, async () => {
+type AppIpcCtx = Pick<WorkbenchContext, 'brandingProvider' | 'appName' | 'senderPolicy'>
+
+export function registerAppIpc(input: IpcInput<AppIpcCtx>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(AppChannel.GetBranding, async (ctx) => {
       if (ctx.brandingProvider) return ctx.brandingProvider()
       return { appName: ctx.appName }
     })
diff --git a/packages/devtools/src/main/ipc/bridge-router-active-page-on-bind.test.ts b/packages/devtools/src/main/ipc/bridge-router-active-page-on-bind.test.ts
index 98409230..280184c1 100644
--- a/packages/devtools/src/main/ipc/bridge-router-active-page-on-bind.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-active-page-on-bind.test.ts
@@ -162,7 +162,15 @@ beforeEach(() => {
   stubs.reset()
 })
 
+// The router registers on process-wide ipc channels through the mux, which
+// installs one real `ipcMain` registration per channel and keeps it until the
+// last owner leaves. Running each install's disposers is what lets the next
+// test's install register on a freshly cleared stub instead of finding the
+// channel already taken by the previous test's router.
+const routerDisposers: AnyFn[] = []
+
 afterEach(() => {
+  for (const dispose of routerDisposers.splice(0)) dispose()
   vi.clearAllMocks()
 })
 
@@ -176,10 +184,10 @@ function emitOn(channel: string, sender: unknown, payload: unknown): void {
 function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const simulatorWc = stubs.makeWebContents()
   const ctx = {
-    registry: { add: (_fn: AnyFn) => {} },
+    registry: { add: (fn: AnyFn) => { routerDisposers.push(fn) } },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     onServiceStorageChanged: vi.fn(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-api-fail-passthrough.test.ts b/packages/devtools/src/main/ipc/bridge-router-api-fail-passthrough.test.ts
index e4bfb4fb..db15e81d 100644
--- a/packages/devtools/src/main/ipc/bridge-router-api-fail-passthrough.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-api-fail-passthrough.test.ts
@@ -173,7 +173,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
     registry: { add: (_fn: AnyFn) => {} },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
   } as unknown as WorkbenchContext
   return { ctx, simulatorWc }
diff --git a/packages/devtools/src/main/ipc/bridge-router-api-namespaces.test.ts b/packages/devtools/src/main/ipc/bridge-router-api-namespaces.test.ts
index 1ecb3e43..d4488fb7 100644
--- a/packages/devtools/src/main/ipc/bridge-router-api-namespaces.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-api-namespaces.test.ts
@@ -223,7 +223,7 @@ function makeCtx(apiNamespaces: string[] = []): { ctx: WorkbenchContext; simulat
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     apiNamespaces,
diff --git a/packages/devtools/src/main/ipc/bridge-router-app-lifecycle.test.ts b/packages/devtools/src/main/ipc/bridge-router-app-lifecycle.test.ts
index cb2fbbd0..3da6f116 100644
--- a/packages/devtools/src/main/ipc/bridge-router-app-lifecycle.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-app-lifecycle.test.ts
@@ -167,7 +167,10 @@ function emitOn(channel: string, sender: unknown, payload: unknown): void {
 /** Build a WorkbenchContext with an event-emitting mainWindow. */
 function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc; mainWindow: ReturnType<typeof stubs.makeEmitter> } {
   const simulatorWc = stubs.makeWebContents()
-  const mainWindow = stubs.makeEmitter()
+  // Stands in for a BrowserWindow, so it answers `isDestroyed` as well as
+  // emitting: the router asks whether its window is alive before claiming a
+  // sender.
+  const mainWindow = Object.assign(stubs.makeEmitter(), { isDestroyed: () => false })
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     connections: createConnectionRegistry(),
diff --git a/packages/devtools/src/main/ipc/bridge-router-census.test.ts b/packages/devtools/src/main/ipc/bridge-router-census.test.ts
index 65ee694f..fa8e2c39 100644
--- a/packages/devtools/src/main/ipc/bridge-router-census.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-census.test.ts
@@ -204,7 +204,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-connection-reset.test.ts b/packages/devtools/src/main/ipc/bridge-router-connection-reset.test.ts
index 8b96306f..0cbeeea0 100644
--- a/packages/devtools/src/main/ipc/bridge-router-connection-reset.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-connection-reset.test.ts
@@ -257,7 +257,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc; connections: R
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections,
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-debugtap.test.ts b/packages/devtools/src/main/ipc/bridge-router-debugtap.test.ts
index 03b7bc45..16662402 100644
--- a/packages/devtools/src/main/ipc/bridge-router-debugtap.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-debugtap.test.ts
@@ -200,7 +200,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
     registry: { add: (_fn: AnyFn) => {} },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
   } as unknown as WorkbenchContext
   return { ctx, simulatorWc }
diff --git a/packages/devtools/src/main/ipc/bridge-router-diagnostics.test.ts b/packages/devtools/src/main/ipc/bridge-router-diagnostics.test.ts
index 8b2c852c..8af565ac 100644
--- a/packages/devtools/src/main/ipc/bridge-router-diagnostics.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-diagnostics.test.ts
@@ -227,7 +227,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: new DisposableRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-dispose-awaitable.test.ts b/packages/devtools/src/main/ipc/bridge-router-dispose-awaitable.test.ts
index 08851e54..e8856822 100644
--- a/packages/devtools/src/main/ipc/bridge-router-dispose-awaitable.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-dispose-awaitable.test.ts
@@ -180,7 +180,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     appData: undefined,
diff --git a/packages/devtools/src/main/ipc/bridge-router-entry-page-path.test.ts b/packages/devtools/src/main/ipc/bridge-router-entry-page-path.test.ts
index c9c1c3c2..b18a6935 100644
--- a/packages/devtools/src/main/ipc/bridge-router-entry-page-path.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-entry-page-path.test.ts
@@ -179,7 +179,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined, getProjectPath: () => '/tmp/dimina-project', isClosing: () => false },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-keep-api.test.ts b/packages/devtools/src/main/ipc/bridge-router-keep-api.test.ts
index 04276e3a..281d0a6d 100644
--- a/packages/devtools/src/main/ipc/bridge-router-keep-api.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-keep-api.test.ts
@@ -198,7 +198,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
     // these keep-API assertions.
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
   } as unknown as WorkbenchContext
   return { ctx, simulatorWc }
diff --git a/packages/devtools/src/main/ipc/bridge-router-logic-bundle-fail-loud.test.ts b/packages/devtools/src/main/ipc/bridge-router-logic-bundle-fail-loud.test.ts
index a63a9191..a28d54a2 100644
--- a/packages/devtools/src/main/ipc/bridge-router-logic-bundle-fail-loud.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-logic-bundle-fail-loud.test.ts
@@ -225,7 +225,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-minigame-load-order.test.ts b/packages/devtools/src/main/ipc/bridge-router-minigame-load-order.test.ts
index 8de34f45..fbe90830 100644
--- a/packages/devtools/src/main/ipc/bridge-router-minigame-load-order.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-minigame-load-order.test.ts
@@ -202,7 +202,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-missing-page-guard.test.ts b/packages/devtools/src/main/ipc/bridge-router-missing-page-guard.test.ts
index 7d730488..95fb3490 100644
--- a/packages/devtools/src/main/ipc/bridge-router-missing-page-guard.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-missing-page-guard.test.ts
@@ -232,7 +232,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-multi-session-binding.test.ts b/packages/devtools/src/main/ipc/bridge-router-multi-session-binding.test.ts
index c116c371..3595343f 100644
--- a/packages/devtools/src/main/ipc/bridge-router-multi-session-binding.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-multi-session-binding.test.ts
@@ -218,7 +218,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-multi-session-overlap.test.ts b/packages/devtools/src/main/ipc/bridge-router-multi-session-overlap.test.ts
index 6fc47f0e..7c184d3e 100644
--- a/packages/devtools/src/main/ipc/bridge-router-multi-session-overlap.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-multi-session-overlap.test.ts
@@ -209,7 +209,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-nav-guard.test.ts b/packages/devtools/src/main/ipc/bridge-router-nav-guard.test.ts
index a31e4ef3..78f1be7b 100644
--- a/packages/devtools/src/main/ipc/bridge-router-nav-guard.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-nav-guard.test.ts
@@ -196,7 +196,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-page-open-guard.test.ts b/packages/devtools/src/main/ipc/bridge-router-page-open-guard.test.ts
index faa0230f..2c0eec68 100644
--- a/packages/devtools/src/main/ipc/bridge-router-page-open-guard.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-page-open-guard.test.ts
@@ -193,7 +193,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-registered-apis.test.ts b/packages/devtools/src/main/ipc/bridge-router-registered-apis.test.ts
index 02bcc609..1be56bb9 100644
--- a/packages/devtools/src/main/ipc/bridge-router-registered-apis.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-registered-apis.test.ts
@@ -231,7 +231,7 @@ function makeCtx(registeredApiNames: string[] = []): { ctx: WorkbenchContext; si
       invoke: async () => ({}),
       list: () => registeredApiNames,
     },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     apiNamespaces: [],
diff --git a/packages/devtools/src/main/ipc/bridge-router-registry-no-leak.test.ts b/packages/devtools/src/main/ipc/bridge-router-registry-no-leak.test.ts
index 6e109769..50f790ab 100644
--- a/packages/devtools/src/main/ipc/bridge-router-registry-no-leak.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-registry-no-leak.test.ts
@@ -182,7 +182,7 @@ function makeCtx(): { ctx: WorkbenchContext; registry: DisposableRegistry; simul
   const ctx = {
     registry,
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     appData: undefined,
diff --git a/packages/devtools/src/main/ipc/bridge-router-request-watchdog.test.ts b/packages/devtools/src/main/ipc/bridge-router-request-watchdog.test.ts
index 0af95f18..203c5103 100644
--- a/packages/devtools/src/main/ipc/bridge-router-request-watchdog.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-request-watchdog.test.ts
@@ -168,7 +168,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
     registry: { add: (_fn: AnyFn) => {} },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
   } as unknown as WorkbenchContext
   return { ctx, simulatorWc }
diff --git a/packages/devtools/src/main/ipc/bridge-router-resolve-current-app.test.ts b/packages/devtools/src/main/ipc/bridge-router-resolve-current-app.test.ts
index be4852d6..a82b8fe7 100644
--- a/packages/devtools/src/main/ipc/bridge-router-resolve-current-app.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-resolve-current-app.test.ts
@@ -175,7 +175,7 @@ function makeCtxNoWorkspaceSession(): { ctx: WorkbenchContext; simulatorWc: Mock
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     // No active workspace session: resolveCurrentApp's workspace branch is skipped.
     workspace: { getSession: () => null, getProjectPath: () => '' },
     connections: createConnectionRegistry(),
@@ -210,7 +210,7 @@ function makeCtxWithIsClosing(closing: boolean): { ctx: WorkbenchContext; simula
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => null, getProjectPath: () => '', isClosing: () => closing },
     connections: createConnectionRegistry(),
     appData: undefined,
diff --git a/packages/devtools/src/main/ipc/bridge-router-resource-base-url.test.ts b/packages/devtools/src/main/ipc/bridge-router-resource-base-url.test.ts
index 6854d242..6f527ba1 100644
--- a/packages/devtools/src/main/ipc/bridge-router-resource-base-url.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-resource-base-url.test.ts
@@ -177,7 +177,7 @@ function makeCtxNoWorkspaceSession(): { ctx: WorkbenchContext; simulatorWc: Mock
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     // No active workspace session: resolveCurrentApp's workspace branch is skipped.
     workspace: { getSession: () => null, getProjectPath: () => '' },
     connections: createConnectionRegistry(),
diff --git a/packages/devtools/src/main/ipc/bridge-router-root-page-close.test.ts b/packages/devtools/src/main/ipc/bridge-router-root-page-close.test.ts
index a52eed2e..4efbee1b 100644
--- a/packages/devtools/src/main/ipc/bridge-router-root-page-close.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-root-page-close.test.ts
@@ -168,7 +168,7 @@ function makeHarness(): Harness {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined, getProjectPath: () => '/tmp/dimina-project', isClosing: () => false },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-runtime-status-dispose.test.ts b/packages/devtools/src/main/ipc/bridge-router-runtime-status-dispose.test.ts
index e96e4ad3..dbd38ab9 100644
--- a/packages/devtools/src/main/ipc/bridge-router-runtime-status-dispose.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-runtime-status-dispose.test.ts
@@ -204,7 +204,7 @@ function makeCtx(): {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     notify,
diff --git a/packages/devtools/src/main/ipc/bridge-router-runtime-status-failures.test.ts b/packages/devtools/src/main/ipc/bridge-router-runtime-status-failures.test.ts
index d0d5e755..ef307d03 100644
--- a/packages/devtools/src/main/ipc/bridge-router-runtime-status-failures.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-runtime-status-failures.test.ts
@@ -242,7 +242,7 @@ function makeCtx(): {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     notify,
diff --git a/packages/devtools/src/main/ipc/bridge-router-runtime-status-launch.test.ts b/packages/devtools/src/main/ipc/bridge-router-runtime-status-launch.test.ts
index f1bda3a4..0264654f 100644
--- a/packages/devtools/src/main/ipc/bridge-router-runtime-status-launch.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-runtime-status-launch.test.ts
@@ -219,7 +219,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc; notify: { sess
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     notify,
diff --git a/packages/devtools/src/main/ipc/bridge-router-service-host-ready.test.ts b/packages/devtools/src/main/ipc/bridge-router-service-host-ready.test.ts
index bdeb7957..d65c8cbc 100644
--- a/packages/devtools/src/main/ipc/bridge-router-service-host-ready.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-service-host-ready.test.ts
@@ -148,15 +148,21 @@ import type { SpawnRequest, SpawnResult } from '../../shared/bridge-channels.js'
 import type { WorkbenchContext } from '../services/workbench-context.js'
 import { createConnectionRegistry } from '@dimina-kit/electron-deck/main'
 import type { ServiceHostReadyEvent } from './bridge-router.js'
-import { installBridgeRouter } from './bridge-router.js'
+
+// Imported per test after `vi.resetModules()`: the ipc mux keeps module-level
+// channel registries, so a stale instance would keep channels registered that
+// this file's fresh `ipcMain` stub no longer knows about.
+let installBridgeRouter: typeof import('./bridge-router.js').installBridgeRouter
 
 type AnyFn = (...args: unknown[]) => unknown
 type MockWc = ReturnType<typeof stubs.makeWebContents>
 
 const APP_ID = 'demo-app'
 
-beforeEach(() => {
+beforeEach(async () => {
+  vi.resetModules()
   stubs.reset()
+  ;({ installBridgeRouter } = await import('./bridge-router.js'))
 })
 
 afterEach(() => {
@@ -169,7 +175,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
     registry: { add: (_fn: AnyFn) => {} },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
   } as unknown as WorkbenchContext
   return { ctx, simulatorWc }
diff --git a/packages/devtools/src/main/ipc/bridge-router-service-invoke-page-routing.test.ts b/packages/devtools/src/main/ipc/bridge-router-service-invoke-page-routing.test.ts
index 201c8306..52d31cb2 100644
--- a/packages/devtools/src/main/ipc/bridge-router-service-invoke-page-routing.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-service-invoke-page-routing.test.ts
@@ -159,7 +159,15 @@ beforeEach(() => {
   stubs.reset()
 })
 
+// The router registers on process-wide ipc channels through the mux, which
+// installs one real `ipcMain` registration per channel and keeps it until the
+// last owner leaves. Running each install's disposers is what lets the next
+// test's install register on a freshly cleared stub instead of finding the
+// channel already taken by the previous test's router.
+const routerDisposers: AnyFn[] = []
+
 afterEach(() => {
+  for (const dispose of routerDisposers.splice(0)) dispose()
   vi.clearAllMocks()
 })
 
@@ -173,10 +181,10 @@ function emitOn(channel: string, sender: unknown, payload: unknown): void {
 function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const simulatorWc = stubs.makeWebContents()
   const ctx = {
-    registry: { add: (_fn: AnyFn) => {} },
+    registry: { add: (fn: AnyFn) => { routerDisposers.push(fn) } },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     onServiceStorageChanged: vi.fn(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-simulator-destroyed.test.ts b/packages/devtools/src/main/ipc/bridge-router-simulator-destroyed.test.ts
index 49645fd0..760beade 100644
--- a/packages/devtools/src/main/ipc/bridge-router-simulator-destroyed.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-simulator-destroyed.test.ts
@@ -252,7 +252,7 @@ function makeCtx(): {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
     appData,
diff --git a/packages/devtools/src/main/ipc/bridge-router-spawn-fallback.test.ts b/packages/devtools/src/main/ipc/bridge-router-spawn-fallback.test.ts
index 8cfc8fac..4e978c84 100644
--- a/packages/devtools/src/main/ipc/bridge-router-spawn-fallback.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-spawn-fallback.test.ts
@@ -245,7 +245,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-spawn-teardown-race.test.ts b/packages/devtools/src/main/ipc/bridge-router-spawn-teardown-race.test.ts
index de337c44..32789d07 100644
--- a/packages/devtools/src/main/ipc/bridge-router-spawn-teardown-race.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-spawn-teardown-race.test.ts
@@ -196,7 +196,7 @@ function makeCtx(opts?: { getProjectPath?: () => string }): {
   const ctx = {
     registry: { add: (_fn: AnyFn) => {} },
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace,
     connections: createConnectionRegistry(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/bridge-router-storage-wxml-notify.test.ts b/packages/devtools/src/main/ipc/bridge-router-storage-wxml-notify.test.ts
index f715a4bc..6abdc2dc 100644
--- a/packages/devtools/src/main/ipc/bridge-router-storage-wxml-notify.test.ts
+++ b/packages/devtools/src/main/ipc/bridge-router-storage-wxml-notify.test.ts
@@ -146,15 +146,21 @@ import type { SyncStorageChange } from '../../shared/ipc-channels.js'
 import type { WorkbenchContext } from '../services/workbench-context.js'
 import { createConnectionRegistry } from '@dimina-kit/electron-deck/main'
 import type { RenderEvent } from './bridge-router.js'
-import { installBridgeRouter } from './bridge-router.js'
+
+// Imported per test after `vi.resetModules()`: the ipc mux keeps module-level
+// channel registries, so a stale instance would keep channels registered that
+// this file's fresh `ipcMain` stub no longer knows about.
+let installBridgeRouter: typeof import('./bridge-router.js').installBridgeRouter
 
 type AnyFn = (...args: unknown[]) => unknown
 type MockWc = ReturnType<typeof stubs.makeWebContents>
 
 const APP_ID = 'demo-app'
 
-beforeEach(() => {
+beforeEach(async () => {
+  vi.resetModules()
   stubs.reset()
+  ;({ installBridgeRouter } = await import('./bridge-router.js'))
 })
 
 afterEach(() => {
@@ -174,7 +180,7 @@ function makeCtx(): { ctx: WorkbenchContext; simulatorWc: MockWc } {
     registry: { add: (_fn: AnyFn) => {} },
     connections: createConnectionRegistry(),
     simulatorApis: { has: (_name: string) => false, invoke: async () => ({}), list: () => [] },
-    windows: { mainWindow: { webContents: simulatorWc } },
+    windows: { mainWindow: { webContents: simulatorWc, isDestroyed: () => false } },
     workspace: { getSession: () => undefined },
     onServiceStorageChanged: vi.fn(),
   } as unknown as WorkbenchContext
diff --git a/packages/devtools/src/main/ipc/internal-devtools.ts b/packages/devtools/src/main/ipc/internal-devtools.ts
index 7ca86d6a..3a414c39 100644
--- a/packages/devtools/src/main/ipc/internal-devtools.ts
+++ b/packages/devtools/src/main/ipc/internal-devtools.ts
@@ -1,6 +1,7 @@
 import { InternalDevtoolsChannel } from '../../shared/ipc-channels.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { IpcRegistry, type SenderPolicy } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 import type { InternalDevtoolsWindow } from '../windows/internal-devtools-window/index.js'
 
 /**
@@ -14,9 +15,9 @@ export interface InternalDevtoolsIpcDeps {
   senderPolicy: SenderPolicy
 }
 
-export function registerInternalDevtoolsIpc(ctx: InternalDevtoolsIpcDeps): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(InternalDevtoolsChannel.Open, () => {
+export function registerInternalDevtoolsIpc(input: IpcInput<InternalDevtoolsIpcDeps>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(InternalDevtoolsChannel.Open, (ctx) => {
       ctx.internalDevtoolsWindow?.open()
     })
 }
diff --git a/packages/devtools/src/main/ipc/popover.ts b/packages/devtools/src/main/ipc/popover.ts
index 903826c8..81108761 100644
--- a/packages/devtools/src/main/ipc/popover.ts
+++ b/packages/devtools/src/main/ipc/popover.ts
@@ -10,17 +10,20 @@ import {
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
-export function registerPopoverIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'senderPolicy'>): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(PopoverChannel.Show, (_event, ...args: unknown[]) => {
+type PopoverIpcCtx = Pick<WorkbenchContext, 'views' | 'notify' | 'senderPolicy'>
+
+export function registerPopoverIpc(input: IpcInput<PopoverIpcCtx>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(PopoverChannel.Show, (ctx, _event, ...args: unknown[]) => {
       const [data] = validate(PopoverChannel.Show, PopoverShowSchema, args)
       ctx.views.showPopover(data)
     })
-    .handle(PopoverChannel.Hide, () => {
+    .handleRouted(PopoverChannel.Hide, (ctx) => {
       ctx.views.hidePopover()
     })
-    .on(PopoverChannel.Relaunch, (_event, ...args: unknown[]) => {
+    .onRouted(PopoverChannel.Relaunch, (ctx, _event, ...args: unknown[]) => {
       const [newConfig] = validate(PopoverChannel.Relaunch, PopoverRelaunchSchema, args)
       ctx.views.hidePopover()
       ctx.notify.popoverRelaunch(newConfig as CompileConfig)
diff --git a/packages/devtools/src/main/ipc/project-create.ts b/packages/devtools/src/main/ipc/project-create.ts
index a30a7130..971abe72 100644
--- a/packages/devtools/src/main/ipc/project-create.ts
+++ b/packages/devtools/src/main/ipc/project-create.ts
@@ -6,6 +6,7 @@ import { ProjectCreateShowSchema, ProjectCreateSubmitSchema } from '../../shared
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry, type SenderPolicy } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
 /** Module-local narrow deps — deliberately NOT `Pick<WorkbenchContext, ...>`
  * (the gate in eslint.config.* is shrink-only; see its message). */
@@ -15,16 +16,16 @@ export interface ProjectCreateIpcDeps {
   senderPolicy?: SenderPolicy
 }
 
-export function registerProjectCreateIpc(ctx: ProjectCreateIpcDeps): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .on(ProjectCreateChannel.Show, (_event, ...args: unknown[]) => {
+export function registerProjectCreateIpc(input: IpcInput<ProjectCreateIpcDeps>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .onRouted(ProjectCreateChannel.Show, (ctx, _event, ...args: unknown[]) => {
       const [data] = validate(ProjectCreateChannel.Show, ProjectCreateShowSchema, args)
       ctx.views.showProjectCreateDialog(data)
     })
-    .on(ProjectCreateChannel.Cancel, () => {
+    .onRouted(ProjectCreateChannel.Cancel, (ctx) => {
       ctx.views.hideProjectCreateDialog()
     })
-    .on(ProjectCreateChannel.Submit, (_event, ...args: unknown[]) => {
+    .onRouted(ProjectCreateChannel.Submit, (ctx, _event, ...args: unknown[]) => {
       const [input] = validate(ProjectCreateChannel.Submit, ProjectCreateSubmitSchema, args)
       ctx.views.hideProjectCreateDialog()
       ctx.notify.projectCreateSubmitted(input)
diff --git a/packages/devtools/src/main/ipc/project-fs.ts b/packages/devtools/src/main/ipc/project-fs.ts
index c9b0aebf..8abfd5f9 100644
--- a/packages/devtools/src/main/ipc/project-fs.ts
+++ b/packages/devtools/src/main/ipc/project-fs.ts
@@ -48,6 +48,7 @@ import { z } from 'zod'
 import type { WorkbenchContext } from '../services/workbench-context.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 import { validate } from '../utils/ipc-schema.js'
 import { ProjectFsChannel } from '../../shared/ipc-channels.js'
 import { WATCH_IGNORE_DIRS } from '@dimina-kit/devkit/watch-ignore'
@@ -600,42 +601,45 @@ async function listFiles(root: string, rootArg: string): Promise<string[]> {
  * Register the project-fs IPC channels. Call once during workbench setup;
  * the returned Disposable removes every channel (park on `ctx.registry`).
  */
-export function registerProjectFsIpc(
-  ctx: Pick<WorkbenchContext, 'workspace' | 'senderPolicy'>,
-): Disposable {
-  const getRoot = () => ctx.workspace.getProjectPath()
-  const getLastClosedRoot = () => ctx.workspace.getLastClosedProjectPath()
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(ProjectFsChannel.GetRoot, () => getRoot())
-    .handle(ProjectFsChannel.ReadFile, (_event, ...args: unknown[]) => {
+type ProjectFsIpcCtx = Pick<WorkbenchContext, 'workspace' | 'senderPolicy'>
+
+export function registerProjectFsIpc(input: IpcInput<ProjectFsIpcCtx>): Disposable {
+  // Roots are read per call from the CALLING window's workspace: each window
+  // has its own open project, so a captured root would sandbox one window's
+  // file access against another's project.
+  const getRoot = (ctx: ProjectFsIpcCtx) => ctx.workspace.getProjectPath()
+  const getLastClosedRoot = (ctx: ProjectFsIpcCtx) => ctx.workspace.getLastClosedProjectPath()
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(ProjectFsChannel.GetRoot, (ctx) => getRoot(ctx))
+    .handleRouted(ProjectFsChannel.ReadFile, (ctx, _event, ...args: unknown[]) => {
       const [p] = validate(ProjectFsChannel.ReadFile, ReadFileSchema, args)
       // Reads stay scoped to the CURRENT root only — never widen the read
       // surface to the last-closed project.
-      return readFile(getRoot(), p)
+      return readFile(getRoot(ctx), p)
     })
-    .handle(ProjectFsChannel.WriteFile, (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectFsChannel.WriteFile, (ctx, _event, ...args: unknown[]) => {
       const [p, content] = validate(ProjectFsChannel.WriteFile, WriteFileSchema, args)
       // Accept a write under the current OR the just-closed project root (the
       // latter rescues an in-flight teardown flush after `closeProject`). The
       // selected root then runs the FULL sandbox (realpath containment +
       // ancestor guard + O_NOFOLLOW) inside `writeFile`, so the boundary is
       // never relaxed — only WHICH root is considered.
-      const root = pickWriteRoot(p, { current: getRoot(), lastClosed: getLastClosedRoot() })
+      const root = pickWriteRoot(p, { current: getRoot(ctx), lastClosed: getLastClosedRoot(ctx) })
       return writeFile(root, p, content)
     })
-    .handleSync(ProjectFsChannel.WriteFileSync, (_event, ...args: unknown[]) => {
+    .handleSyncRouted(ProjectFsChannel.WriteFileSync, (ctx, _event, ...args: unknown[]) => {
       // Synchronous twin of WriteFile for the editor's beforeunload flush. Same
       // root selection + same sandbox (`writeFileSync` mirrors `writeFile`); the
       // only difference is the blocking transport. Returns `{ ok: true }`; any
       // throw is converted to `{ ok: false, code, message }` by `handleSync`.
       const [p, content] = validate(ProjectFsChannel.WriteFileSync, WriteFileSchema, args)
-      const root = pickWriteRoot(p, { current: getRoot(), lastClosed: getLastClosedRoot() })
+      const root = pickWriteRoot(p, { current: getRoot(ctx), lastClosed: getLastClosedRoot(ctx) })
       writeFileSync(root, p, content)
       return { ok: true }
     })
-    .handle(ProjectFsChannel.ListFiles, (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectFsChannel.ListFiles, (ctx, _event, ...args: unknown[]) => {
       const [p] = validate(ProjectFsChannel.ListFiles, ListFilesSchema, args)
-      return listFiles(getRoot(), p)
+      return listFiles(getRoot(ctx), p)
     })
 }
 
diff --git a/packages/devtools/src/main/ipc/projects-edit-dialog.test.ts b/packages/devtools/src/main/ipc/projects-edit-dialog.test.ts
index 02f8ba56..faba77c7 100644
--- a/packages/devtools/src/main/ipc/projects-edit-dialog.test.ts
+++ b/packages/devtools/src/main/ipc/projects-edit-dialog.test.ts
@@ -89,7 +89,7 @@ function makeCtx(opts: {
     projectTemplates: [],
     customCreateProjectDialog: undefined,
     customEditProjectDialog: opts.customEditProjectDialog,
-  } as unknown as Parameters<typeof registerProjectsIpc>[0]
+  } as unknown as import('./projects.js').ProjectsIpcCtx
 }
 
 describe('ProjectsChannel.OpenEditDialog', () => {
diff --git a/packages/devtools/src/main/ipc/projects.ts b/packages/devtools/src/main/ipc/projects.ts
index e18004bb..bca0b4f0 100644
--- a/packages/devtools/src/main/ipc/projects.ts
+++ b/packages/devtools/src/main/ipc/projects.ts
@@ -13,6 +13,7 @@ import type { WorkbenchModule } from '../services/module.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 import { sanitizeTemplates } from '../services/projects/templates.js'
 import { createProject } from '../services/projects/create-project-service.js'
 import type { CreateProjectInput } from '../services/projects/types.js'
@@ -21,7 +22,7 @@ import {
   saveWorkbenchSettings,
 } from '../services/settings/index.js'
 
-type ProjectsIpcCtx = Pick<
+export type ProjectsIpcCtx = Pick<
   WorkbenchContext,
   | 'workspace'
   | 'windows'
@@ -34,19 +35,19 @@ type ProjectsIpcCtx = Pick<
   | 'views'
 >
 
-export function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(ProjectsChannel.List, () => {
+export function registerProjectsIpc(input: IpcInput<ProjectsIpcCtx>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(ProjectsChannel.List, (ctx) => {
       return ctx.workspace.listProjects()
     })
-    .handle(DialogChannel.OpenDirectory, async () => {
+    .handleRouted(DialogChannel.OpenDirectory, async (ctx) => {
       const result = await dialog.showOpenDialog(ctx.windows.mainWindow, {
         properties: ['openDirectory'],
         title: '选择小程序项目目录',
       })
       return result.canceled ? null : result.filePaths[0]
     })
-    .handle(ProjectsChannel.Add, async (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectsChannel.Add, async (ctx, _event, ...args: unknown[]) => {
       const [dirPath] = validate(ProjectsChannel.Add, ProjectsAddSchema, args)
       const dirError = await ctx.workspace.validateProjectDir(dirPath)
       if (dirError) {
@@ -83,11 +84,11 @@ export function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable {
       ctx.views.hostSidebar.send('project-category-forced', { category: importedCategory })
       return project
     })
-    .handle(ProjectsChannel.Remove, (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectsChannel.Remove, (ctx, _event, ...args: unknown[]) => {
       const [dirPath] = validate(ProjectsChannel.Remove, ProjectsRemoveSchema, args)
       return ctx.workspace.removeProject(dirPath)
     })
-    .handle(ProjectsChannel.Update, (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectsChannel.Update, (ctx, _event, ...args: unknown[]) => {
       const [dirPath, patch] = validate(
         ProjectsChannel.Update,
         ProjectsUpdateSchema,
@@ -96,13 +97,13 @@ export function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable {
       return ctx.workspace.updateProject(dirPath, patch)
     })
     // ── template catalog + create flow ──
-    .handle(ProjectsChannel.ListTemplates, () => {
+    .handleRouted(ProjectsChannel.ListTemplates, (ctx) => {
       // Sanitize at the IPC boundary: `generate` is a function and the
       // structured-clone algorithm Electron uses for invoke would otherwise
       // throw "could not be cloned" before the renderer ever sees it.
       return sanitizeTemplates(ctx.projectTemplates ?? [])
     })
-    .handle(ProjectsChannel.OpenCreateDialog, async () => {
+    .handleRouted(ProjectsChannel.OpenCreateDialog, async (ctx) => {
       if (!ctx.customCreateProjectDialog) return null
       const sanitized = sanitizeTemplates(ctx.projectTemplates ?? [])
       return await ctx.customCreateProjectDialog({
@@ -110,7 +111,7 @@ export function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable {
         templates: sanitized,
       })
     })
-    .handle(ProjectsChannel.OpenEditDialog, async (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectsChannel.OpenEditDialog, async (ctx, _event, ...args: unknown[]) => {
       if (!ctx.customEditProjectDialog) return null
       const [dirPath] = validate(
         ProjectsChannel.OpenEditDialog,
@@ -132,7 +133,7 @@ export function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable {
       // fall through into the built-in one right behind it.
       return { result }
     })
-    .handle(ProjectsChannel.Create, async (_event, ...args: unknown[]) => {
+    .handleRouted(ProjectsChannel.Create, async (ctx, _event, ...args: unknown[]) => {
       // We deliberately don't run this through zod yet — the input shape is
       // wide (any template can stash arbitrary `extra` fields) and the
       // service does its own per-field validation. Bound size to keep this
@@ -175,7 +176,7 @@ export function registerProjectsIpc(ctx: ProjectsIpcCtx): Disposable {
       }
       return project
     })
-    .handle(ProjectsChannel.GetCreateDefaults, () => {
+    .handleRouted(ProjectsChannel.GetCreateDefaults, () => {
       // Fallback chain: persisted last parent → user's Documents → home.
       // Documents covers the common "我把项目都放在 Documents/ 下" case for
       // first-time users on macOS; home is just a safe final fallback.
diff --git a/packages/devtools/src/main/ipc/session.ts b/packages/devtools/src/main/ipc/session.ts
index 165c7d68..131ba28d 100644
--- a/packages/devtools/src/main/ipc/session.ts
+++ b/packages/devtools/src/main/ipc/session.ts
@@ -14,18 +14,21 @@ import type { WorkbenchModule } from '../services/module.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
-export function registerSessionIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'senderPolicy'>): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(ProjectChannel.Open, (_, ...args: unknown[]) => {
+type SessionIpcCtx = Pick<WorkbenchContext, 'workspace' | 'senderPolicy'>
+
+export function registerSessionIpc(input: IpcInput<SessionIpcCtx>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(ProjectChannel.Open, (ctx, _e, ...args: unknown[]) => {
       const [projectPath] = validate(ProjectChannel.Open, ProjectOpenSchema, args)
       return ctx.workspace.openProject(projectPath)
     })
-    .handle(ProjectChannel.GetPages, (_, ...args: unknown[]) => {
+    .handleRouted(ProjectChannel.GetPages, (ctx, _e, ...args: unknown[]) => {
       const [projectPath] = validate(ProjectChannel.GetPages, ProjectGetPagesSchema, args)
       return ctx.workspace.getProjectPages(projectPath)
     })
-    .handle(ProjectChannel.GetCompileConfig, (_, ...args: unknown[]) => {
+    .handleRouted(ProjectChannel.GetCompileConfig, (ctx, _e, ...args: unknown[]) => {
       const [projectPath] = validate(
         ProjectChannel.GetCompileConfig,
         ProjectGetCompileConfigSchema,
@@ -33,7 +36,7 @@ export function registerSessionIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'se
       )
       return ctx.workspace.getCompileConfig(projectPath)
     })
-    .handle(ProjectChannel.SaveCompileConfig, (_, ...args: unknown[]) => {
+    .handleRouted(ProjectChannel.SaveCompileConfig, (ctx, _e, ...args: unknown[]) => {
       const [projectPath, config] = validate(
         ProjectChannel.SaveCompileConfig,
         ProjectSaveCompileConfigSchema,
@@ -41,10 +44,10 @@ export function registerSessionIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'se
       )
       return ctx.workspace.saveCompileConfig(projectPath, config as CompileConfig)
     })
-    .handle(ProjectChannel.Close, () => {
+    .handleRouted(ProjectChannel.Close, (ctx) => {
       return ctx.workspace.closeProject()
     })
-    .handle(ProjectChannel.Rebuild, async () => {
+    .handleRouted(ProjectChannel.Rebuild, async (ctx) => {
       const session = ctx.workspace.getSession()
       if (!session) throw new Error('project:rebuild — no active project session')
       // A host CompilationAdapter predating session.rebuild must not break:
@@ -53,7 +56,7 @@ export function registerSessionIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'se
       await session.rebuild()
       return { supported: true }
     })
-    .handle(ProjectChannel.CaptureThumbnail, (_, ...args: unknown[]) => {
+    .handleRouted(ProjectChannel.CaptureThumbnail, (ctx, _e, ...args: unknown[]) => {
       const [projectPath] = validate(
         ProjectChannel.CaptureThumbnail,
         ProjectCaptureThumbnailSchema,
@@ -61,7 +64,7 @@ export function registerSessionIpc(ctx: Pick<WorkbenchContext, 'workspace' | 'se
       )
       return ctx.workspace.captureThumbnail(projectPath)
     })
-    .handle(ProjectChannel.GetThumbnail, (_, ...args: unknown[]) => {
+    .handleRouted(ProjectChannel.GetThumbnail, (ctx, _e, ...args: unknown[]) => {
       const [projectPath] = validate(
         ProjectChannel.GetThumbnail,
         ProjectGetThumbnailSchema,
diff --git a/packages/devtools/src/main/ipc/settings.ts b/packages/devtools/src/main/ipc/settings.ts
index dea97f5c..5e191beb 100644
--- a/packages/devtools/src/main/ipc/settings.ts
+++ b/packages/devtools/src/main/ipc/settings.ts
@@ -25,13 +25,19 @@ import type { Disposable } from '@dimina-kit/electron-deck/main'
 import type { WorkbenchModule } from '../services/module.js'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
-export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'workspace' | 'rendererDir' | 'senderPolicy'>): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(WorkbenchSettingsChannel.Get, () => {
+type SettingsIpcCtx = Pick<
+  WorkbenchContext,
+  'views' | 'notify' | 'workspace' | 'rendererDir' | 'senderPolicy'
+>
+
+export function registerSettingsIpc(input: IpcInput<SettingsIpcCtx>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(WorkbenchSettingsChannel.Get, () => {
       return loadWorkbenchSettings()
     })
-    .handle(WorkbenchSettingsChannel.Save, (_, ...args: unknown[]) => {
+    .handleRouted(WorkbenchSettingsChannel.Save, (_ctx, _e, ...args: unknown[]) => {
       const [settings] = validate(
         WorkbenchSettingsChannel.Save,
         WorkbenchSettingsSaveSchema,
@@ -41,7 +47,7 @@ export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notif
       applyTheme((settings.theme as ThemeSource | undefined) ?? 'system')
       return { success: true }
     })
-    .handle(WorkbenchSettingsChannel.SetTheme, (_, ...args: unknown[]) => {
+    .handleRouted(WorkbenchSettingsChannel.SetTheme, (_ctx, _e, ...args: unknown[]) => {
       const [theme] = validate(
         WorkbenchSettingsChannel.SetTheme,
         WorkbenchSettingsSetThemeSchema,
@@ -49,11 +55,11 @@ export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notif
       )
       applyTheme(theme)
     })
-    .handle(WorkbenchSettingsChannel.Restart, () => {
+    .handleRouted(WorkbenchSettingsChannel.Restart, () => {
       app.relaunch()
       app.quit()
     })
-    .handle(WorkbenchSettingsChannel.GetCdpStatus, () => {
+    .handleRouted(WorkbenchSettingsChannel.GetCdpStatus, () => {
       const settings = loadWorkbenchSettings()
       const switchValue = app.commandLine.getSwitchValue('remote-debugging-port')
       const implicitDevDefault = !app.isPackaged && !settings.cdp.enabled && switchValue === String(DEFAULT_CDP_PORT)
@@ -65,7 +71,7 @@ export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notif
         implicitDevDefault,
       }
     })
-    .handle(WorkbenchSettingsChannel.GetMcpStatus, () => {
+    .handleRouted(WorkbenchSettingsChannel.GetMcpStatus, () => {
       const settings = loadWorkbenchSettings()
       const runtime = getMcpStatus()
       return {
@@ -76,7 +82,7 @@ export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notif
         error: runtime.error,
       }
     })
-    .handle(SettingsChannel.SetVisible, async (_, ...args: unknown[]) => {
+    .handleRouted(SettingsChannel.SetVisible, async (ctx, _e, ...args: unknown[]) => {
       const [visible] = validate(SettingsChannel.SetVisible, SettingsSetVisibleSchema, args)
       if (visible) {
         await ctx.views.showSettings()
@@ -90,7 +96,7 @@ export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notif
         ctx.views.hideSettings()
       }
     })
-    .on(SettingsChannel.ConfigChanged, async (_, ...args: unknown[]) => {
+    .onRouted(SettingsChannel.ConfigChanged, async (ctx, _e, ...args: unknown[]) => {
       const [config] = validate(
         SettingsChannel.ConfigChanged,
         SettingsConfigChangedSchema,
@@ -101,7 +107,7 @@ export function registerSettingsIpc(ctx: Pick<WorkbenchContext, 'views' | 'notif
         await ctx.workspace.saveCompileConfig(projectPath, config as CompileConfig)
       }
     })
-    .on(SettingsChannel.ProjectSettingsChanged, (_, ...args: unknown[]) => {
+    .onRouted(SettingsChannel.ProjectSettingsChanged, (ctx, _e, ...args: unknown[]) => {
       const [patch] = validate(
         SettingsChannel.ProjectSettingsChanged,
         SettingsProjectSettingsChangedSchema,
diff --git a/packages/devtools/src/main/ipc/simulator-module.ts b/packages/devtools/src/main/ipc/simulator-module.ts
index e2066005..7b6bc713 100644
--- a/packages/devtools/src/main/ipc/simulator-module.ts
+++ b/packages/devtools/src/main/ipc/simulator-module.ts
@@ -1,5 +1,5 @@
 import type { WorkbenchModule } from '../services/module.js'
-import { DisposableRegistry } from '@dimina-kit/electron-deck/main'
+import { toDisposable } from '@dimina-kit/electron-deck/main'
 import { registerSimulatorIpc } from './simulator.js'
 import { installBridgeRouter } from './bridge-router.js'
 
@@ -14,12 +14,16 @@ import { installBridgeRouter } from './bridge-router.js'
  * window decides whether to actually call dmb:* channels, but the main-side
  * handlers must always be ready or `ipcRenderer.invoke('dmb:spawn')` fails
  * with `No handler registered`.
+ *
+ * The router installs onto a concrete context (it assigns `ctx.bridge`,
+ * `ctx.consoleForwarder` and `ctx.diagnostics`, which the window assembly
+ * reads straight afterwards), so it is per-window wiring rather than
+ * app-level registration.
  */
 export const simulatorModule: WorkbenchModule = {
-  setup: (ctx) => {
-    const reg = new DisposableRegistry()
-    reg.add(registerSimulatorIpc(ctx))
+  setup: (source) => registerSimulatorIpc(source),
+  setupWindow: (ctx) => {
     installBridgeRouter(ctx)
-    return reg
+    return toDisposable(() => {})
   },
 }
diff --git a/packages/devtools/src/main/ipc/simulator.ts b/packages/devtools/src/main/ipc/simulator.ts
index d8aedcc8..32bd5f0d 100644
--- a/packages/devtools/src/main/ipc/simulator.ts
+++ b/packages/devtools/src/main/ipc/simulator.ts
@@ -11,21 +11,27 @@ import type { WorkbenchContext } from '../services/workbench-context.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
-export function registerSimulatorIpc(ctx: Pick<WorkbenchContext, 'views' | 'notify' | 'senderPolicy' | 'simulatorApis' | 'bridge'>): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .handle(SimulatorChannel.AttachNative, (_, ...args: unknown[]) => {
+type SimulatorIpcCtx = Pick<
+  WorkbenchContext,
+  'views' | 'notify' | 'senderPolicy' | 'simulatorApis' | 'bridge'
+>
+
+export function registerSimulatorIpc(input: IpcInput<SimulatorIpcCtx>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .handleRouted(SimulatorChannel.AttachNative, (ctx, _e, ...args: unknown[]) => {
       const [simulatorUrl, simWidth] = validate(SimulatorChannel.AttachNative, SimulatorAttachNativeSchema, args)
       return ctx.views.attachNativeSimulator(simulatorUrl, simWidth)
     })
-    .handle(SimulatorChannel.SoftReload, (_, ...args: unknown[]) => {
+    .handleRouted(SimulatorChannel.SoftReload, (ctx, _e, ...args: unknown[]) => {
       const [simulatorUrl] = validate(SimulatorChannel.SoftReload, SimulatorSoftReloadSchema, args)
       return ctx.views.softReloadNativeSimulator(simulatorUrl)
     })
-    .handle(SimulatorChannel.Detach, () => {
+    .handleRouted(SimulatorChannel.Detach, (ctx) => {
       ctx.views.detachSimulator()
     })
-    .handle(SimulatorChannel.SetDeviceInfo, (_, ...args: unknown[]) => {
+    .handleRouted(SimulatorChannel.SetDeviceInfo, (ctx, _e, ...args: unknown[]) => {
       const [device] = validate(SimulatorChannel.SetDeviceInfo, SimulatorSetDeviceInfoSchema, args)
       // Cache the selection (rides the next NATIVE_HOST_ENABLED reply for a
       // race-free DeviceShell init) and push DEVICE_CHANGE to the live simulator
@@ -44,7 +50,7 @@ export function registerSimulatorIpc(ctx: Pick<WorkbenchContext, 'views' | 'noti
         serviceWc.send(ServiceHostChannel.HostEnvUpdate, deviceInfoToHostEnv(device))
       }
     })
-    .handle(SimulatorCustomApiChannel.Invoke, (_, ...args: unknown[]) => {
+    .handleRouted(SimulatorCustomApiChannel.Invoke, (ctx, _e, ...args: unknown[]) => {
       const [name, params] = validate(SimulatorCustomApiChannel.Invoke, SimulatorCustomApiInvokeSchema, args)
       return ctx.simulatorApis.invoke(name, params)
     })
diff --git a/packages/devtools/src/main/ipc/tooltip.ts b/packages/devtools/src/main/ipc/tooltip.ts
index ee6771db..15b21cda 100644
--- a/packages/devtools/src/main/ipc/tooltip.ts
+++ b/packages/devtools/src/main/ipc/tooltip.ts
@@ -5,6 +5,7 @@ import { TooltipMeasuredSchema, TooltipShowSchema } from '../../shared/ipc-schem
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry, type SenderPolicy } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
 
 /** Module-local narrow deps — deliberately NOT `Pick<WorkbenchContext, ...>`
  * (the gate in eslint.config.* is shrink-only; see its message). */
@@ -20,22 +21,22 @@ export interface TooltipIpcDeps {
   senderPolicy?: SenderPolicy
 }
 
-export function registerTooltipIpc(ctx: TooltipIpcDeps): Disposable {
-  return new IpcRegistry(ctx.senderPolicy)
-    .on(TooltipChannel.Prepare, () => {
+export function registerTooltipIpc(input: IpcInput<TooltipIpcDeps>): Disposable {
+  return new IpcRegistry(toIpcContextSource(input))
+    .onRouted(TooltipChannel.Prepare, (ctx) => {
       ctx.views.prepareTooltip()
     })
-    .on(TooltipChannel.Show, (_event, ...args: unknown[]) => {
+    .onRouted(TooltipChannel.Show, (ctx, _event, ...args: unknown[]) => {
       const [data] = validate(TooltipChannel.Show, TooltipShowSchema, args)
       ctx.views.showTooltip(data)
     })
-    .on(TooltipChannel.Hide, () => {
+    .onRouted(TooltipChannel.Hide, (ctx) => {
       ctx.views.hideTooltip()
     })
-    .on(OverlayChannel.Ready, (event) => {
+    .onRouted(OverlayChannel.Ready, (ctx, event) => {
       ctx.views.markOverlayReady(event.sender.id)
     })
-    .on(TooltipChannel.Measured, (event, ...args: unknown[]) => {
+    .onRouted(TooltipChannel.Measured, (ctx, event, ...args: unknown[]) => {
       const [measurement] = validate(
         TooltipChannel.Measured,
         TooltipMeasuredSchema,
diff --git a/packages/devtools/src/main/ipc/views.ts b/packages/devtools/src/main/ipc/views.ts
index 8d5dc4b3..ff3378e7 100644
--- a/packages/devtools/src/main/ipc/views.ts
+++ b/packages/devtools/src/main/ipc/views.ts
@@ -12,6 +12,9 @@ import type { WorkbenchContext } from '../services/workbench-context.js'
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 import { validate } from '../utils/ipc-schema.js'
 import { IpcRegistry } from '../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../utils/ipc-context-source.js'
+
+type ViewsIpcCtx = Pick<WorkbenchContext, 'views' | 'senderPolicy'>
 
 /**
  * Renderer-driven overlay bounds, plus the renderer bootstrap's
@@ -42,18 +45,29 @@ import { IpcRegistry } from '../utils/ipc-registry.js'
  * disables it on the fatal boot-failure page, or leave placement silently
  * non-functional. See disabled-module.test.ts for the end-to-end guard.
  */
-export function registerViewsIpc(
-  ctx: Pick<WorkbenchContext, 'views' | 'senderPolicy'>,
-): Disposable {
-  const registry = new IpcRegistry(ctx.senderPolicy)
+export function registerViewsIpc(input: IpcInput<ViewsIpcCtx>): Disposable {
+  const source = toIpcContextSource(input)
+
+  // The raw listeners below trust an exact wc id, and each window mounts its
+  // own host slots — so the id itself names the owning window. Scanning the
+  // live contexts for the one whose slot holds this sender is both the trust
+  // gate and the routing decision; no match means the message came from
+  // somewhere that is not a host slot at all, and is dropped.
+  const ownerOfSlot = (
+    event: IpcMainEvent,
+    slotWebContentsId: (ctx: ViewsIpcCtx) => number | null,
+  ): ViewsIpcCtx | null =>
+    source.list().find((ctx) => slotWebContentsId(ctx) === event.sender.id) ?? null
+
+  const registry = new IpcRegistry(source)
     // Renderer bootstrap: allocate this session's placement-generation seed
     // (see renderer-placement-generation.ts / PlacementReconciler.allocateGeneration).
-    .handle(ViewChannel.AllocatePlacementGeneration, () => ctx.views.allocatePlacementGeneration())
+    .handleRouted(ViewChannel.AllocatePlacementGeneration, (ctx) => ctx.views.allocatePlacementGeneration())
     // Window-level placement snapshot: the single source of truth for every
     // managed native view's bounds/visibility/z-order. The renderer's central
     // publisher coalesces one snapshot per frame; the reconciler diffs it
     // against the actual view tree. Supersedes the per-view bounds channels.
-    .handle(ViewChannel.PlacementSnapshot, (_event, ...args: unknown[]) => {
+    .handleRouted(ViewChannel.PlacementSnapshot, (ctx, _event, ...args: unknown[]) => {
       const [snapshot] = validate(
         ViewChannel.PlacementSnapshot,
         PlacementSnapshotSchema,
@@ -69,10 +83,10 @@ export function registerViewsIpc(
     // senderPolicy-gated registry as HostToolbarBounds: the toolbar WCV's
     // arbitrary host content must not reach this — only the trusted main
     // renderer pulls. Live delegation, not a registration-time snapshot.
-    .handle(ViewChannel.HostToolbarGetHeight, () => ctx.views.getHostToolbarHeight())
+    .handleRouted(ViewChannel.HostToolbarGetHeight, (ctx) => ctx.views.getHostToolbarHeight())
     // Same mount-time replay role as HostToolbarGetHeight, on the sidebar's
     // inline (width) axis.
-    .handle(ViewChannel.HostSidebarGetWidth, () => ctx.views.getHostSidebarWidth())
+    .handleRouted(ViewChannel.HostSidebarGetWidth, (ctx) => ctx.views.getHostSidebarWidth())
 
   // Reverse size-advertiser: the toolbar WCV's OWN renderer sends this, and the
   // host loads ARBITRARY content into that WCV. We DELIBERATELY do NOT add the
@@ -85,7 +99,8 @@ export function registerViewsIpc(
   // The host content can reach ONLY this one channel, carrying only a
   // non-negative integer height.
   const onAdvertiseHeight = (event: IpcMainEvent, ...args: unknown[]): void => {
-    if (event.sender.id !== ctx.views.getHostToolbarWebContentsId()) return
+    const ctx = ownerOfSlot(event, (c) => c.views.getHostToolbarWebContentsId())
+    if (!ctx) return
     let extent: number
     try {
       ;[{ extent }] = validate(
@@ -103,7 +118,8 @@ export function registerViewsIpc(
   // Same precise-sender-id trust model as onAdvertiseHeight, on the
   // sidebar's inline (width) axis.
   const onAdvertiseWidth = (event: IpcMainEvent, ...args: unknown[]): void => {
-    if (event.sender.id !== ctx.views.getHostSidebarWebContentsId()) return
+    const ctx = ownerOfSlot(event, (c) => c.views.getHostSidebarWebContentsId())
+    if (!ctx) return
     let extent: number
     try {
       ;[{ extent }] = validate(
@@ -123,7 +139,8 @@ export function registerViewsIpc(
   // slot: either axis may arrive, and the view manager re-centers using
   // whichever axes it has measured so far.
   const onAdvertiseDialogSize = (event: IpcMainEvent, ...args: unknown[]): void => {
-    if (event.sender.id !== ctx.views.getHostDialogWebContentsId()) return
+    const ctx = ownerOfSlot(event, (c) => c.views.getHostDialogWebContentsId())
+    if (!ctx) return
     let axis: 'block' | 'inline'
     let extent: number
     try {
diff --git a/packages/devtools/src/main/runtime/devtools-backend-before-quit.harness.ts b/packages/devtools/src/main/runtime/devtools-backend-before-quit.harness.ts
index ffaabe10..48e30b88 100644
--- a/packages/devtools/src/main/runtime/devtools-backend-before-quit.harness.ts
+++ b/packages/devtools/src/main/runtime/devtools-backend-before-quit.harness.ts
@@ -1,327 +1,23 @@
 /**
  * Shared vitest mock harness for `devtools-backend-before-quit.test.ts` and
  * `devtools-backend-shutdown-race.test.ts` — both drive the REAL
- * `createDevtoolsBackend`/`createDevtoolsRuntime` against this same
- * electron/fs/`@dimina-kit/devkit`/view-manager mock set (lifted from
- * `quit-flag-onclose.test.ts`), split out to keep each test file under the
- * repo's 500-line file-length ratchet without duplicating ~350 lines of
- * mock setup between them.
+ * `createDevtoolsBackend`/`createDevtoolsRuntime` against the electron/fs/
+ * `@dimina-kit/devkit` mock set defined in `./devtools-runtime-mock.harness.ts`,
+ * plus the view-manager spy shim and backend-lifecycle helpers below that
+ * only these two tests need.
  *
- * `vi.mock(...)` calls here run once per importing test file's own isolated
- * module graph (vitest scopes mocking per test file), so importing this
- * module has the same effect as if each call were written directly in the
- * importing file — both test files' `beforeEach` still dynamically
- * `await import('./devtools-backend.js')` AFTER `vi.resetModules()`, well
- * after this module's mock registrations have already run.
+ * `vi.mock(...)` calls in the imported core module run once per importing
+ * test file's own isolated module graph (vitest scopes mocking per test
+ * file); chaining through this module has the same effect as if they were
+ * written directly in the importing file — both test files' `beforeEach`
+ * still dynamically `await import('./devtools-backend.js')` AFTER
+ * `vi.resetModules()`, well after the core module's mock registrations have
+ * already run.
  */
 import { beforeEach, expect, vi } from 'vitest'
 import type { WorkbenchAppConfig } from '../../shared/types.js'
 import type { RuntimeBackend } from '@dimina-kit/electron-deck'
-
-// ── Hoisted stub state (lifted from quit-flag-onclose.test.ts) ────────────
-// `export const x = vi.hoisted(...)` is rejected by vitest's hoisting
-// transform ("Cannot export hoisted variable") — declare then export below.
-const stubs = vi.hoisted(() => {
-  type AnyFn = (...args: unknown[]) => unknown
-  type EventBag = Record<string, Set<AnyFn>>
-
-  const handlers = new Map<string, AnyFn>()
-  const projectsJsonPath = '/tmp/dimina-test-userdata/dimina-projects.json'
-  let projectsJsonContent: string | null = null
-  const projectsWithAppJson = new Set<string>()
-
-  function makeEmitter() {
-    const listeners: EventBag = {}
-    return {
-      listeners,
-      on(event: string, fn: AnyFn) {
-        ;(listeners[event] ??= new Set()).add(fn)
-        return this
-      },
-      once(event: string, fn: AnyFn) {
-        const wrap: AnyFn = (...args: unknown[]) => {
-          listeners[event]?.delete(wrap)
-          return fn(...args)
-        }
-        ;(listeners[event] ??= new Set()).add(wrap)
-        return this
-      },
-      off(event: string, fn: AnyFn) {
-        listeners[event]?.delete(fn)
-        return this
-      },
-      removeListener(event: string, fn: AnyFn) {
-        listeners[event]?.delete(fn)
-        return this
-      },
-      emit(event: string, ...args: unknown[]) {
-        for (const fn of [...(listeners[event] ?? [])]) fn(...args)
-      },
-    }
-  }
-
-  function reset() {
-    handlers.clear()
-    projectsJsonContent = null
-    projectsWithAppJson.clear()
-  }
-
-  return {
-    handlers,
-    projectsJsonPath,
-    getProjectsJson() {
-      return projectsJsonContent
-    },
-    setProjectsJson(v: string | null) {
-      projectsJsonContent = v
-    },
-    projectsWithAppJson,
-    makeEmitter,
-    reset,
-  }
-})
-
-// ── electron stub ────────────────────────────────────────────────────────
-// `app` is a live emitter so `registerAppLifecycle` can attach a
-// `before-quit` listener that the test fires directly.
-vi.mock('electron', () => {
-  type AnyFn = (...args: unknown[]) => unknown
-
-  const ipcEmitter = stubs.makeEmitter()
-  const ipcMain = {
-    ...ipcEmitter,
-    handle: vi.fn((channel: string, fn: AnyFn) => {
-      stubs.handlers.set(channel, fn)
-    }),
-    removeHandler: vi.fn((channel: string) => {
-      stubs.handlers.delete(channel)
-    }),
-    on: vi.fn((event: string, fn: AnyFn) => ipcEmitter.on(event, fn)),
-    removeListener: vi.fn((event: string, fn: AnyFn) =>
-      ipcEmitter.removeListener(event, fn),
-    ),
-  }
-
-  const appEmitter = stubs.makeEmitter()
-  const app = {
-    ...appEmitter,
-    isPackaged: true,
-    whenReady: vi.fn(() => Promise.resolve()),
-    getPath: vi.fn(() => '/tmp/dimina-test-userdata'),
-    quit: vi.fn(),
-    setName: vi.fn(),
-    commandLine: {
-      getSwitchValue: vi.fn(() => ''),
-      appendSwitch: vi.fn(),
-    },
-  }
-
-  // `WebContents` and `BrowserWindow` below both wrap a `stubs.makeEmitter()`
-  // and need the SAME on/once/off/removeListener/emit delegation (the
-  // emitter's own methods use `this` internally, so a plain property copy
-  // would call them with the wrong receiver — each needs `.bind(em)`). Shared
-  // base class instead of re-declaring the same 5 bound fields in both.
-  class EmittingStub {
-    protected em = stubs.makeEmitter()
-    on = this.em.on.bind(this.em)
-    once = this.em.once.bind(this.em)
-    off = this.em.off.bind(this.em)
-    removeListener = this.em.removeListener.bind(this.em)
-    emit = this.em.emit.bind(this.em)
-  }
-
-  class WebContents extends EmittingStub {
-    destroyed = false
-    id = Math.floor(Math.random() * 1e6)
-    send = vi.fn()
-    isDestroyed = () => this.destroyed
-    openDevTools = vi.fn()
-    closeDevTools = vi.fn()
-    setDevToolsWebContents = vi.fn()
-    setWindowOpenHandler = vi.fn()
-    loadFile = vi.fn(() => Promise.resolve())
-    loadURL = vi.fn(() => Promise.resolve())
-    executeJavaScript = vi.fn(() => Promise.resolve(undefined))
-    reload = vi.fn()
-    getType = () => 'window'
-    getURL = () => ''
-    debugger = {
-      attach: vi.fn(),
-      detach: vi.fn(),
-      isAttached: () => false,
-      on: vi.fn(),
-      removeListener: vi.fn(),
-      sendCommand: vi.fn(() => Promise.resolve({ entries: [] })),
-    }
-    close = vi.fn(() => {
-      this.destroyed = true
-    })
-  }
-
-  class WebContentsView {
-    webContents = new WebContents()
-    setBounds = vi.fn()
-    setBackgroundColor = vi.fn()
-  }
-
-  class View {
-    children: View[] = []
-    addChildView(child: View) {
-      this.children.push(child)
-    }
-    removeChildView(child: View) {
-      const i = this.children.indexOf(child)
-      if (i >= 0) this.children.splice(i, 1)
-    }
-  }
-
-  class BrowserWindow extends EmittingStub {
-    destroyed = false
-    webContents = new WebContents()
-    contentView: View | WebContentsView = new WebContentsView()
-    isDestroyed = () => this.destroyed
-    getContentSize = () => [1280, 980]
-    setIcon = vi.fn()
-    setTitle = vi.fn()
-    show = vi.fn()
-    showInactive = vi.fn()
-    focus = vi.fn()
-    close = vi.fn()
-    destroy = vi.fn(() => {
-      this.destroyed = true
-    })
-    loadFile = vi.fn(() => Promise.resolve())
-    loadURL = vi.fn(() => Promise.resolve())
-    static getAllWindows = vi.fn(() => [] as BrowserWindow[])
-  }
-
-  const sessionStub = {
-    fromPartition: vi.fn(() => ({
-      webRequest: {
-        onBeforeSendHeaders: vi.fn(),
-        onHeadersReceived: vi.fn(),
-      },
-      registerPreloadScript: vi.fn(),
-      protocol: { handle: vi.fn(), unhandle: vi.fn() },
-    })),
-    defaultSession: {
-      protocol: { handle: vi.fn(), unhandle: vi.fn() },
-    },
-  }
-
-  const dialog = {
-    showOpenDialog: vi.fn(() =>
-      Promise.resolve({ canceled: true, filePaths: [] }),
-    ),
-    showMessageBox: vi.fn(() => Promise.resolve({ response: 0 })),
-  }
-
-  const Menu = {
-    buildFromTemplate: vi.fn((tpl: unknown) => ({ template: tpl })),
-    setApplicationMenu: vi.fn(),
-  }
-
-  const shell = {
-    openExternal: vi.fn(() => Promise.resolve()),
-    openPath: vi.fn(() => Promise.resolve('')),
-  }
-
-  const nativeImage = {
-    createFromPath: vi.fn(() => ({ isEmpty: () => true })),
-  }
-
-  const nativeTheme = { ...stubs.makeEmitter(), themeSource: 'system' }
-
-  const globalShortcut = {
-    register: vi.fn(() => false),
-    unregister: vi.fn(),
-    unregisterAll: vi.fn(),
-  }
-
-  const webContentsStatic = {
-    fromId: vi.fn(() => null),
-    getAllWebContents: vi.fn(() => [] as WebContents[]),
-  }
-
-  const Tray = vi.fn()
-
-  return {
-    app,
-    ipcMain,
-    BrowserWindow,
-    WebContentsView,
-    BrowserView: WebContentsView,
-    View,
-    webContents: webContentsStatic,
-    session: sessionStub,
-    protocol: { registerSchemesAsPrivileged: vi.fn(), handle: vi.fn(), unhandle: vi.fn() },
-    dialog,
-    Menu,
-    shell,
-    nativeImage,
-    nativeTheme,
-    globalShortcut,
-    Tray,
-    default: {},
-  }
-})
-
-vi.mock('fs', async () => {
-  const real = await vi.importActual<typeof import('fs')>('fs')
-
-  function existsSync(p: import('fs').PathLike): boolean {
-    const s = String(p)
-    if (s === stubs.projectsJsonPath) return stubs.getProjectsJson() !== null
-    if (s.endsWith('/app.json') || s.endsWith('\\app.json')) {
-      const dir = s.replace(/[\\/]app\.json$/, '')
-      return stubs.projectsWithAppJson.has(dir)
-    }
-    return true
-  }
-
-  function readFileSync(p: import('fs').PathOrFileDescriptor, opts?: unknown): string {
-    const s = String(p)
-    if (s === stubs.projectsJsonPath) {
-      const content = stubs.getProjectsJson()
-      if (content === null) throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
-      return content
-    }
-    return (real.readFileSync as (...a: unknown[]) => string)(p as never, opts as never)
-  }
-
-  function writeFileSync(p: import('fs').PathOrFileDescriptor, data: string | Buffer | Uint8Array): void {
-    const s = String(p)
-    if (s === stubs.projectsJsonPath) {
-      stubs.setProjectsJson(typeof data === 'string' ? data : Buffer.from(data).toString('utf8'))
-    }
-  }
-
-  const mocked = {
-    ...real,
-    existsSync,
-    readFileSync,
-    writeFileSync,
-    mkdirSync: vi.fn(),
-    statSync: vi.fn(() => ({ isDirectory: () => true, isFile: () => false, size: 0, mtimeMs: 0 } as unknown as import('fs').Stats)),
-    watch: vi.fn(),
-    realpathSync: vi.fn((p: string) => p),
-  }
-  return { ...mocked, default: mocked }
-})
-
-const devkitStubs = vi.hoisted(() => ({
-  sessionClose: vi.fn(() => Promise.resolve()),
-}))
-
-vi.mock('@dimina-kit/devkit', () => ({
-  openProject: vi.fn(() =>
-    Promise.resolve({
-      port: 12345,
-      appInfo: { appId: 'fakeApp' },
-      close: devkitStubs.sessionClose,
-    }),
-  ),
-}))
+import { stubs, devkitStubs } from './devtools-runtime-mock.harness.js'
 
 // ── view-manager spy shim ───────────────────────────────────────────────
 // `createDevtoolsBackend` keeps its assembled `instance` in a private
@@ -348,7 +44,8 @@ vi.mock('../services/views/view-manager.js', async (importOriginal) => {
   }
 })
 
-export { stubs, devkitStubs, viewManagerStubs }
+export { stubs, devkitStubs } from './devtools-runtime-mock.harness.js'
+export { viewManagerStubs }
 
 /**
  * Shared per-test setup both `devtools-backend-before-quit.test.ts` and
diff --git a/packages/devtools/src/main/runtime/devtools-backend.ts b/packages/devtools/src/main/runtime/devtools-backend.ts
index 875b6bcd..8bd91325 100644
--- a/packages/devtools/src/main/runtime/devtools-backend.ts
+++ b/packages/devtools/src/main/runtime/devtools-backend.ts
@@ -3,6 +3,7 @@ import type { WorkbenchAppConfig } from '../../shared/types.js'
 import { runDevtoolsBootstrap, createDevtoolsRuntime } from '../app/app.js'
 import type { WorkbenchAppInstance } from '../app/app.js'
 import { isAppQuitting, registerAppLifecycle } from '../app/lifecycle.js'
+import { closeAllCoiHosts } from '../services/workbench-coi-host.js'
 
 /**
  * Adapts the devtools runtime into a {@link RuntimeBackend} the framework
@@ -65,7 +66,7 @@ export function createDevtoolsBackend(config: WorkbenchAppConfig = {}): RuntimeB
       // handler closing an already-torn-down MessagePort segfaults natively.
       // Safe to run again from `onShutdown`'s `instance.dispose()` afterwards
       // — `views.disposeAll()` and its constituents are dispose-idempotent.
-      registerAppLifecycle(() => instance?.context.views.disposeAll())
+      registerAppLifecycle(() => instance?.disposeViews())
       // `onInstanceCreated` (not the return value) is what assigns `instance`:
       // `createDevtoolsRuntime` awaits the host's `config.onSetup(instance)`
       // — which may run arbitrarily long and can itself load the host toolbar
@@ -77,7 +78,7 @@ export function createDevtoolsBackend(config: WorkbenchAppConfig = {}): RuntimeB
         // Quit may have already started (before-quit already fired) before
         // this instance existed, so the hook above ran with nothing to
         // dispose. Self-heal: run the same teardown now that there is.
-        if (isAppQuitting()) instance.context.views.disposeAll()
+        if (isAppQuitting()) instance.disposeViews()
       }).then(() => {})
       await assembling
     },
@@ -97,7 +98,16 @@ export function createDevtoolsBackend(config: WorkbenchAppConfig = {}): RuntimeB
     // not a reason to skip disposing whatever DID get constructed.
     onShutdown: async () => {
       await assembling?.catch(() => {})
-      await instance?.dispose()
+      // The workbench COI listener is deliberately kept alive across project
+      // windows (its port IS the workbench origin, see workbench-coi-host.ts),
+      // so no window teardown ever closes it. Process shutdown is the one place
+      // that must — after the windows above have released their routes, and
+      // even if one of their disposers threw on the way.
+      try {
+        await instance?.dispose()
+      } finally {
+        await closeAllCoiHosts()
+      }
     },
   }
 }
diff --git a/packages/devtools/src/main/runtime/devtools-runtime-mock.harness.ts b/packages/devtools/src/main/runtime/devtools-runtime-mock.harness.ts
new file mode 100644
index 00000000..3b72f07e
--- /dev/null
+++ b/packages/devtools/src/main/runtime/devtools-runtime-mock.harness.ts
@@ -0,0 +1,347 @@
+/**
+ * Shared electron/fs/`@dimina-kit/devkit` mock core for
+ * `window-close-reveal.harness.ts` (app/) and
+ * `devtools-backend-before-quit.harness.ts` (runtime/) — both those harnesses
+ * drive a REAL runtime (`createDevtoolsRuntime` or `createDevtoolsBackend`)
+ * against the same mock set (lifted from `quit-flag-onclose.test.ts`) and
+ * previously duplicated it in full; this module holds the part that's
+ * actually identical between them.
+ *
+ * `BrowserWindow` here tracks visible/minimized state and implements
+ * `hide`/`isVisible`/`minimize`/`isMinimized`/`restore` on top of `show`/
+ * `showInactive` — the window-close-reveal guards need all of that, while the
+ * before-quit/shutdown-race tests only ever `destroy()` a window and never
+ * observe the extra state, so carrying it there is a no-op.
+ *
+ * `vi.mock(...)` calls here run once per importing test file's own isolated
+ * module graph (vitest scopes mocking per test file). A harness that imports
+ * this module chains into that same module graph, so importing THIS module
+ * (directly, or transitively through one of the two harnesses above) has the
+ * same effect as if each `vi.mock` call were written directly in the test
+ * file itself.
+ */
+import { vi } from 'vitest'
+
+// ── Hoisted stub state ──────────────────────────────────────────────────
+const stubs = vi.hoisted(() => {
+  type AnyFn = (...args: unknown[]) => unknown
+  type EventBag = Record<string, Set<AnyFn>>
+
+  const handlers = new Map<string, AnyFn>()
+  const projectsJsonPath = '/tmp/dimina-test-userdata/dimina-projects.json'
+  let projectsJsonContent: string | null = null
+  const projectsWithAppJson = new Set<string>()
+
+  function makeEmitter() {
+    const listeners: EventBag = {}
+    return {
+      listeners,
+      on(event: string, fn: AnyFn) {
+        ;(listeners[event] ??= new Set()).add(fn)
+        return this
+      },
+      once(event: string, fn: AnyFn) {
+        const wrap: AnyFn = (...args: unknown[]) => {
+          listeners[event]?.delete(wrap)
+          return fn(...args)
+        }
+        ;(listeners[event] ??= new Set()).add(wrap)
+        return this
+      },
+      off(event: string, fn: AnyFn) {
+        listeners[event]?.delete(fn)
+        return this
+      },
+      removeListener(event: string, fn: AnyFn) {
+        listeners[event]?.delete(fn)
+        return this
+      },
+      emit(event: string, ...args: unknown[]) {
+        for (const fn of [...(listeners[event] ?? [])]) fn(...args)
+      },
+    }
+  }
+
+  function reset() {
+    handlers.clear()
+    projectsJsonContent = null
+    projectsWithAppJson.clear()
+  }
+
+  return {
+    handlers,
+    projectsJsonPath,
+    getProjectsJson() {
+      return projectsJsonContent
+    },
+    setProjectsJson(v: string | null) {
+      projectsJsonContent = v
+    },
+    projectsWithAppJson,
+    makeEmitter,
+    reset,
+  }
+})
+
+// ── electron stub ────────────────────────────────────────────────────────
+vi.mock('electron', () => {
+  type AnyFn = (...args: unknown[]) => unknown
+
+  const ipcEmitter = stubs.makeEmitter()
+  const ipcMain = {
+    ...ipcEmitter,
+    handle: vi.fn((channel: string, fn: AnyFn) => {
+      stubs.handlers.set(channel, fn)
+    }),
+    removeHandler: vi.fn((channel: string) => {
+      stubs.handlers.delete(channel)
+    }),
+    on: vi.fn((event: string, fn: AnyFn) => ipcEmitter.on(event, fn)),
+    removeListener: vi.fn((event: string, fn: AnyFn) =>
+      ipcEmitter.removeListener(event, fn),
+    ),
+  }
+
+  const appEmitter = stubs.makeEmitter()
+  const app = {
+    ...appEmitter,
+    isPackaged: true,
+    whenReady: vi.fn(() => Promise.resolve()),
+    getPath: vi.fn(() => '/tmp/dimina-test-userdata'),
+    quit: vi.fn(),
+    setName: vi.fn(),
+    commandLine: {
+      getSwitchValue: vi.fn(() => ''),
+      appendSwitch: vi.fn(),
+    },
+  }
+
+  // `WebContents` and `BrowserWindow` below both wrap a `stubs.makeEmitter()`
+  // and need the SAME on/once/off/removeListener/emit delegation (the
+  // emitter's own methods use `this` internally, so a plain property copy
+  // would call them with the wrong receiver — each needs `.bind(em)`). Shared
+  // base class instead of re-declaring the same 5 bound fields in both.
+  class EmittingStub {
+    protected em = stubs.makeEmitter()
+    on = this.em.on.bind(this.em)
+    once = this.em.once.bind(this.em)
+    off = this.em.off.bind(this.em)
+    removeListener = this.em.removeListener.bind(this.em)
+    emit = this.em.emit.bind(this.em)
+  }
+
+  class WebContents extends EmittingStub {
+    destroyed = false
+    id = Math.floor(Math.random() * 1e6)
+    send = vi.fn()
+    isDestroyed = () => this.destroyed
+    openDevTools = vi.fn()
+    closeDevTools = vi.fn()
+    setDevToolsWebContents = vi.fn()
+    setWindowOpenHandler = vi.fn()
+    loadFile = vi.fn(() => Promise.resolve())
+    loadURL = vi.fn(() => Promise.resolve())
+    executeJavaScript = vi.fn(() => Promise.resolve(undefined))
+    reload = vi.fn()
+    getType = () => 'window'
+    getURL = () => ''
+    debugger = {
+      attach: vi.fn(),
+      detach: vi.fn(),
+      isAttached: () => false,
+      on: vi.fn(),
+      removeListener: vi.fn(),
+      sendCommand: vi.fn(() => Promise.resolve({ entries: [] })),
+    }
+    close = vi.fn(() => {
+      this.destroyed = true
+    })
+  }
+
+  class WebContentsView {
+    webContents = new WebContents()
+    setBounds = vi.fn()
+    setBackgroundColor = vi.fn()
+  }
+
+  class View {
+    children: View[] = []
+    addChildView(child: View) {
+      this.children.push(child)
+    }
+    removeChildView(child: View) {
+      const i = this.children.indexOf(child)
+      if (i >= 0) this.children.splice(i, 1)
+    }
+  }
+
+  class BrowserWindow extends EmittingStub {
+    destroyed = false
+    // The list window and every workbench window start shown/restored — the
+    // reveal/hide guards this state exists for only ever move a window AWAY
+    // from it, never establish it.
+    visible = true
+    minimized = false
+    webContents = new WebContents()
+    contentView: View | WebContentsView = new WebContentsView()
+    isDestroyed = () => this.destroyed
+    isVisible = () => this.visible && !this.destroyed
+    isMinimized = () => this.minimized
+    getContentSize = () => [1280, 980]
+    setIcon = vi.fn()
+    setTitle = vi.fn()
+    show = vi.fn(() => {
+      this.visible = true
+    })
+    showInactive = vi.fn(() => {
+      this.visible = true
+    })
+    hide = vi.fn(() => {
+      this.visible = false
+    })
+    minimize = vi.fn(() => {
+      this.minimized = true
+    })
+    restore = vi.fn(() => {
+      this.minimized = false
+      this.visible = true
+    })
+    focus = vi.fn()
+    close = vi.fn()
+    destroy = vi.fn(() => {
+      this.destroyed = true
+    })
+    loadFile = vi.fn(() => Promise.resolve())
+    loadURL = vi.fn(() => Promise.resolve())
+    static getAllWindows = vi.fn(() => [] as BrowserWindow[])
+  }
+
+  const sessionStub = {
+    fromPartition: vi.fn(() => ({
+      webRequest: {
+        onBeforeSendHeaders: vi.fn(),
+        onHeadersReceived: vi.fn(),
+      },
+      registerPreloadScript: vi.fn(),
+      protocol: { handle: vi.fn(), unhandle: vi.fn() },
+    })),
+    defaultSession: {
+      protocol: { handle: vi.fn(), unhandle: vi.fn() },
+    },
+  }
+
+  const dialog = {
+    showOpenDialog: vi.fn(() =>
+      Promise.resolve({ canceled: true, filePaths: [] }),
+    ),
+    showMessageBox: vi.fn(() => Promise.resolve({ response: 0 })),
+  }
+
+  const Menu = {
+    buildFromTemplate: vi.fn((tpl: unknown) => ({ template: tpl })),
+    setApplicationMenu: vi.fn(),
+  }
+
+  const shell = {
+    openExternal: vi.fn(() => Promise.resolve()),
+    openPath: vi.fn(() => Promise.resolve('')),
+  }
+
+  const nativeImage = {
+    createFromPath: vi.fn(() => ({ isEmpty: () => true })),
+  }
+
+  const nativeTheme = { ...stubs.makeEmitter(), themeSource: 'system' }
+
+  const globalShortcut = {
+    register: vi.fn(() => false),
+    unregister: vi.fn(),
+    unregisterAll: vi.fn(),
+  }
+
+  const webContentsStatic = {
+    fromId: vi.fn(() => null),
+    getAllWebContents: vi.fn(() => [] as WebContents[]),
+  }
+
+  const Tray = vi.fn()
+
+  return {
+    app,
+    ipcMain,
+    BrowserWindow,
+    WebContentsView,
+    BrowserView: WebContentsView,
+    View,
+    webContents: webContentsStatic,
+    session: sessionStub,
+    protocol: { registerSchemesAsPrivileged: vi.fn(), handle: vi.fn(), unhandle: vi.fn() },
+    dialog,
+    Menu,
+    shell,
+    nativeImage,
+    nativeTheme,
+    globalShortcut,
+    Tray,
+    default: {},
+  }
+})
+
+vi.mock('fs', async () => {
+  const real = await vi.importActual<typeof import('fs')>('fs')
+
+  function existsSync(p: import('fs').PathLike): boolean {
+    const s = String(p)
+    if (s === stubs.projectsJsonPath) return stubs.getProjectsJson() !== null
+    if (s.endsWith('/app.json') || s.endsWith('\\app.json')) {
+      const dir = s.replace(/[\\/]app\.json$/, '')
+      return stubs.projectsWithAppJson.has(dir)
+    }
+    return true
+  }
+
+  function readFileSync(p: import('fs').PathOrFileDescriptor, opts?: unknown): string {
+    const s = String(p)
+    if (s === stubs.projectsJsonPath) {
+      const content = stubs.getProjectsJson()
+      if (content === null) throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' })
+      return content
+    }
+    return (real.readFileSync as (...a: unknown[]) => string)(p as never, opts as never)
+  }
+
+  function writeFileSync(p: import('fs').PathOrFileDescriptor, data: string | Buffer | Uint8Array): void {
+    const s = String(p)
+    if (s === stubs.projectsJsonPath) {
+      stubs.setProjectsJson(typeof data === 'string' ? data : Buffer.from(data).toString('utf8'))
+    }
+  }
+
+  const mocked = {
+    ...real,
+    existsSync,
+    readFileSync,
+    writeFileSync,
+    mkdirSync: vi.fn(),
+    statSync: vi.fn(() => ({ isDirectory: () => true, isFile: () => false, size: 0, mtimeMs: 0 } as unknown as import('fs').Stats)),
+    watch: vi.fn(),
+    realpathSync: vi.fn((p: string) => p),
+  }
+  return { ...mocked, default: mocked }
+})
+
+const devkitStubs = vi.hoisted(() => ({
+  sessionClose: vi.fn(() => Promise.resolve()),
+}))
+
+vi.mock('@dimina-kit/devkit', () => ({
+  openProject: vi.fn(() =>
+    Promise.resolve({
+      port: 12345,
+      appInfo: { appId: 'fakeApp' },
+      close: devkitStubs.sessionClose,
+    }),
+  ),
+}))
+
+export { stubs, devkitStubs }
diff --git a/packages/devtools/src/main/services/app-services.ts b/packages/devtools/src/main/services/app-services.ts
new file mode 100644
index 00000000..5fb41c7e
--- /dev/null
+++ b/packages/devtools/src/main/services/app-services.ts
@@ -0,0 +1,113 @@
+import type { BrowserWindow } from 'electron'
+import { toDisposable, type Disposable } from '@dimina-kit/electron-deck/main'
+import { createLocalProjectsProvider } from './projects/local-provider.js'
+import { resolveTemplates } from './projects/templates.js'
+import { BUILTIN_TEMPLATES } from './projects/builtin-templates.js'
+import type { ProjectsProvider, ProjectTemplate } from './projects/types.js'
+import {
+  createSimulatorApiRegistry,
+  type SimulatorApiRegistry,
+} from './simulator/custom-apis.js'
+
+/**
+ * The services that belong to the whole application rather than to one window.
+ *
+ * They are all registered or configured ONCE by the host (through
+ * `WorkbenchAppConfig` and the `WorkbenchAppInstance` registration methods),
+ * so every window context reads the same instance. Anything whose owner is a
+ * single window — views, connections, the CDP broker, the workspace — stays on
+ * `WorkbenchContext` instead.
+ */
+export interface AppServices {
+  /** Backing store for the project list. One list, shown by every window. */
+  projectsProvider: ProjectsProvider
+  /** Built-in templates merged with the host's, per `builtinTemplates`. */
+  projectTemplates: ProjectTemplate[]
+  /**
+   * Reference-counted `webContents.id` → live registration count for
+   * host-owned BrowserWindows registered as trusted senders. A host window is
+   * registered against the app, not against whichever window happened to be
+   * open at the time, so the map is shared and every context's sender policy
+   * consults the same entries.
+   */
+  trustedWindowSenderIds: Map<number, number>
+  /**
+   * Simulator custom APIs registered by the host. The host registers each
+   * handler once (in `onSetup`), so the registry is app-wide: a window opened
+   * later must answer the same `wx.*` calls as the one that was open during
+   * registration.
+   */
+  simulatorApis: SimulatorApiRegistry
+}
+
+export interface CreateAppServicesOptions {
+  projectsProvider?: ProjectsProvider
+  projectTemplates?: ProjectTemplate[]
+  builtinTemplates?: 'all' | 'none' | readonly string[]
+}
+
+export function createAppServices(opts: CreateAppServicesOptions = {}): AppServices {
+  return {
+    projectsProvider: opts.projectsProvider ?? createLocalProjectsProvider(),
+    projectTemplates: resolveTemplates(
+      BUILTIN_TEMPLATES,
+      opts.projectTemplates ?? [],
+      opts.builtinTemplates ?? 'all',
+    ),
+    trustedWindowSenderIds: new Map<number, number>(),
+    simulatorApis: createSimulatorApiRegistry(),
+  }
+}
+
+/**
+ * Adds `win.webContents` to the trusted-sender set and returns a Disposable
+ * that removes it again.
+ *
+ * Trust is reference-counted: registering the SAME window N times keeps it
+ * trusted until every one of the N returned Disposables has been disposed.
+ * Each register bumps the count, each dispose decrements it, and the window is
+ * un-trusted only when the count reaches zero.
+ *
+ * The window's `closed` event short-circuits the ref-count: it deletes the
+ * map entry outright (the window is dead, so it must be un-trusted
+ * immediately regardless of how many Disposables are still outstanding).
+ * After `closed`, disposing any leftover Disposable is a safe no-op — the
+ * map entry is already gone, so the decrement finds `undefined` and bails
+ * without driving the count negative or resurrecting trust.
+ *
+ * Each returned Disposable is itself idempotent (`removed` flag), and its
+ * `closed` listener removes itself once fired so a long-lived app doesn't
+ * accumulate dead listeners on closed windows.
+ */
+export function registerTrustedWindow(
+  services: Pick<AppServices, 'trustedWindowSenderIds'>,
+  win: BrowserWindow,
+): Disposable {
+  const senderId = win.webContents.id
+  const counts = services.trustedWindowSenderIds
+  counts.set(senderId, (counts.get(senderId) ?? 0) + 1)
+
+  let removed = false
+  const onClosed = () => {
+    // The window is gone: zero the ref-count for this sender id outright,
+    // regardless of any other outstanding registrations for the same window.
+    counts.delete(senderId)
+    win.removeListener('closed', onClosed)
+  }
+
+  function remove() {
+    if (removed) return
+    removed = true
+    win.removeListener('closed', onClosed)
+    const count = counts.get(senderId)
+    // `undefined` → the entry was already cleared (e.g. by `closed` or by a
+    // prior sibling's decrement that hit zero). Nothing to do — never go
+    // negative, never resurrect trust.
+    if (count === undefined) return
+    if (count <= 1) counts.delete(senderId)
+    else counts.set(senderId, count - 1)
+  }
+
+  win.once('closed', onClosed)
+  return toDisposable(remove)
+}
diff --git a/packages/devtools/src/main/services/automation/connection-target.ts b/packages/devtools/src/main/services/automation/connection-target.ts
new file mode 100644
index 00000000..83da42df
--- /dev/null
+++ b/packages/devtools/src/main/services/automation/connection-target.ts
@@ -0,0 +1,70 @@
+import type { WindowService } from '../window-service.js'
+import type { WorkspaceService } from '../workspace/workspace-service.js'
+
+/** The slice of a window context that decides where a connection's commands go. */
+export interface TargetContext {
+  windows: Pick<WindowService, 'mainWindow'>
+  workspace: Pick<WorkspaceService, 'hasActiveSession'>
+}
+
+/**
+ * The project window one automation connection acts on.
+ *
+ * The active context follows window focus, so resolving it afresh per message
+ * would let a click on another project's window redirect a script that is
+ * already driving one — the script does nothing wrong and its commands land
+ * somewhere else. A connection therefore PINS the first context it reaches
+ * that has a session and keeps it for the rest of its life. Which window a
+ * connection drives is decided by what it reached first, never by what the
+ * user is looking at.
+ *
+ * Nothing is pinned before a project window exists: a client may connect at
+ * boot and open a project afterwards, so until a context with a session shows
+ * up every use resolves the active one (the project list, which drives
+ * nothing). Pinning the list window would tie the connection to a window that
+ * can never run a command.
+ */
+export interface ConnectionTarget<T extends TargetContext> {
+  /**
+   * The context to run a command against. Throws once the pinned window is
+   * gone, so a connection whose project was closed fails loudly instead of
+   * sliding onto whichever project happens to be open now.
+   */
+  resolve(): T
+  /** The same target, but null instead of a throw once its window is gone. */
+  peek(): T | null
+}
+
+export function createConnectionTarget<T extends TargetContext>(
+  getCtx: () => T,
+): ConnectionTarget<T> {
+  let pinned: T | null = null
+
+  // The window, not the session, is what a connection is pinned to: closing
+  // the project inside a window (`Tool.close`) leaves that window able to open
+  // another, while destroying the window ends the connection's target for good.
+  const isGone = (ctx: T): boolean => {
+    const win = ctx.windows.mainWindow
+    return !win || win.isDestroyed()
+  }
+
+  const current = (): T | null => {
+    if (pinned) return isGone(pinned) ? null : pinned
+    const ctx = getCtx()
+    if (ctx.workspace.hasActiveSession()) pinned = ctx
+    return ctx
+  }
+
+  return {
+    peek: current,
+    resolve() {
+      const ctx = current()
+      if (!ctx) {
+        throw new Error(
+          'The project window this connection was driving has been closed. Reconnect to drive another project.',
+        )
+      }
+      return ctx
+    },
+  }
+}
diff --git a/packages/devtools/src/main/services/automation/console-bridge.ts b/packages/devtools/src/main/services/automation/console-bridge.ts
new file mode 100644
index 00000000..1999bc55
--- /dev/null
+++ b/packages/devtools/src/main/services/automation/console-bridge.ts
@@ -0,0 +1,123 @@
+import type { WebContents } from 'electron'
+import type { ConnectionRegistry } from '@dimina-kit/electron-deck/main'
+import { SimulatorChannel } from '../../../shared/ipc-channels.js'
+import type { ConsoleForwarder, GuestConsoleEntry } from '../console-forward/index.js'
+import type { RpcEvent } from './shared.js'
+
+/** The slice of a window context the two console taps read. */
+export interface ConsoleTargetContext {
+  consoleForwarder?: ConsoleForwarder
+  connections: ConnectionRegistry
+}
+
+/**
+ * How often an idle connection re-checks its target for a console to attach
+ * to. A connection that never sends a message (a script that only listens for
+ * logs) has no other moment to notice its window's simulator appearing or
+ * being replaced by a rebuild.
+ */
+const SYNC_INTERVAL_MS = 1000
+
+/**
+ * The `App.logAdded` stream of ONE automation connection, taken from the same
+ * window that connection's commands reach.
+ *
+ * Two taps, because the two architectures deliver guest console differently:
+ *   - native-host: the render/service preloads post to main, bridge-router
+ *     routes into the window's always-on ConsoleForwarder, and we subscribe.
+ *   - default dimina-fe: the page/service console flows through the simulator
+ *     guest's `ipc-message-host` channel, so we listen on that webContents.
+ * Both are re-pointed by `sync()`, which is what keeps the log stream and the
+ * command stream on the same window as the target and its simulator change.
+ */
+export interface ConsoleBridge {
+  /** Re-point both taps at the connection's current target. */
+  sync(): void
+  dispose(): void
+}
+
+export function createConsoleBridge<T extends ConsoleTargetContext>(
+  target: () => T | null,
+  simulatorOf: (ctx: T) => WebContents | null,
+  emit: (event: RpcEvent) => void,
+): ConsoleBridge {
+  let subscribedForwarder: ConsoleForwarder | null = null
+  let forwarderSub: { dispose: () => void } | undefined
+  let attachedSim: WebContents | null = null
+  let simHandler: ((event: unknown, channel: string, data: unknown) => void) | null = null
+  // The destroyed-teardown is owned by the sim's connection rather than a
+  // bespoke `sim.once('destroyed')`, so it cannot accumulate across re-attaches.
+  let simDestroyedDisposer: { dispose: () => void | Promise<void> } | null = null
+
+  function logAdded(entry: { level?: string; args?: unknown[] } | undefined): void {
+    const e = entry ?? {}
+    emit({ method: 'App.logAdded', params: { type: e.level || 'log', args: e.args || [] } })
+  }
+
+  // Keyed on the forwarder itself, not the context: a window is wired with its
+  // forwarder after the context exists, so a context-identity check would miss
+  // the forwarder arriving on a context we already looked at.
+  function syncForwarder(ctx: T | null): void {
+    const forwarder = ctx?.consoleForwarder ?? null
+    if (forwarder === subscribedForwarder) return
+    forwarderSub?.dispose()
+    subscribedForwarder = forwarder
+    forwarderSub = forwarder?.subscribe((entry: GuestConsoleEntry) => logAdded(entry))
+  }
+
+  function detachSim(): void {
+    if (attachedSim && simHandler) {
+      try {
+        if (!attachedSim.isDestroyed()) {
+          ;(attachedSim as NodeJS.EventEmitter).removeListener('ipc-message-host', simHandler)
+        }
+      } catch { /* noop */ }
+    }
+    try { simDestroyedDisposer?.dispose() } catch { /* noop */ }
+    attachedSim = null
+    simHandler = null
+    simDestroyedDisposer = null
+  }
+
+  function syncSim(ctx: T | null): void {
+    const sim = ctx ? simulatorOf(ctx) : null
+    const next = sim && !sim.isDestroyed() ? sim : null
+    if (next === attachedSim) return
+    detachSim()
+    if (!next || !ctx) return
+
+    const onIpcMessageHost = (_event: unknown, channel: string, data: unknown): void => {
+      if (channel !== SimulatorChannel.Console) return
+      logAdded(data as { level?: string; args?: unknown[] })
+    }
+    attachedSim = next
+    simHandler = onIpcMessageHost
+    ;(next as NodeJS.EventEmitter).on('ipc-message-host', onIpcMessageHost)
+    simDestroyedDisposer = ctx.connections.acquire(next).own(() => {
+      // Dead webContents: drop the refs (removeListener on it would throw) and
+      // let the next sync attach to the replacement.
+      attachedSim = null
+      simHandler = null
+      simDestroyedDisposer = null
+    })
+  }
+
+  function sync(): void {
+    const ctx = target()
+    syncForwarder(ctx)
+    syncSim(ctx)
+  }
+
+  const timer = setInterval(sync, SYNC_INTERVAL_MS)
+
+  return {
+    sync,
+    dispose() {
+      clearInterval(timer)
+      detachSim()
+      forwarderSub?.dispose()
+      forwarderSub = undefined
+      subscribedForwarder = null
+    },
+  }
+}
diff --git a/packages/devtools/src/main/services/automation/index.test.ts b/packages/devtools/src/main/services/automation/index.test.ts
index 72752b8d..f2888a66 100644
--- a/packages/devtools/src/main/services/automation/index.test.ts
+++ b/packages/devtools/src/main/services/automation/index.test.ts
@@ -95,6 +95,9 @@ vi.mock('./exec.js', async () => {
 
 const getSimulatorMock = vi.mocked(getSimulator)
 
+/** The `WorkbenchContext` shape `getCtx()` resolves to inside the server. */
+type CtxStub = ReturnType<Parameters<typeof startAutomationServer>[0]>
+
 function makeCtx(senderPolicy: (s: unknown) => boolean = () => true) {
   return {
     senderPolicy,
@@ -104,8 +107,14 @@ function makeCtx(senderPolicy: (s: unknown) => boolean = () => true) {
     // so the sim stub's `once('destroyed')` / `isDestroyed()` drive it faithfully.
     connections: createConnectionRegistry(),
     views: { getSimulatorWebContentsId: () => 1 },
+    // A connection pins the window it drives and checks that window is still
+    // alive before every use (see connection-target.ts).
+    windows: { mainWindow: { isDestroyed: () => false } },
     workspace: { hasActiveSession: () => true },
-  } as unknown as Parameters<typeof startAutomationServer>[0]
+    // `ensureConsoleSub` reads this every time it (re-)subscribes; undefined
+    // is a legal ctx (no forwarder yet) and must not throw.
+    consoleForwarder: { subscribe: vi.fn(() => ({ dispose: vi.fn() })) },
+  } as unknown as CtxStub
 }
 
 function makeSim() {
@@ -154,7 +163,7 @@ describe('startAutomationServer lifecycle', () => {
     const policy = vi.fn(() => true)
     const ctx = makeCtx(policy)
 
-    const server = await startAutomationServer(ctx, 0)
+    const server = await startAutomationServer(() => ctx, ctx, 0)
 
     expect(ipcMainStub.handle).toHaveBeenCalledWith(AutomationChannel.GetPort, expect.any(Function))
     // The handler stored is the IpcRegistry guard, not the raw () => currentPort.
@@ -174,7 +183,7 @@ describe('startAutomationServer lifecycle', () => {
   it('rejects callers when senderPolicy returns false', async () => {
     const policy = vi.fn(() => false)
     const ctx = makeCtx(policy)
-    const server = await startAutomationServer(ctx, 0)
+    const server = await startAutomationServer(() => ctx, ctx, 0)
 
     const guarded = guardedFns.get(AutomationChannel.GetPort)!
     // The IpcRegistry sender gate now surfaces as a rejected promise (the
@@ -191,7 +200,7 @@ describe('startAutomationServer lifecycle', () => {
     const sim = makeSim()
     getSimulatorMock.mockReturnValue(sim as unknown as ReturnType<typeof getSimulator>)
 
-    const server = await startAutomationServer(ctx, 0)
+    const server = await startAutomationServer(() => ctx, ctx, 0)
 
     // Simulate a ws connection arriving — that calls setupConsoleForwarding.
     const wss = wssStub.created[0]!
@@ -228,7 +237,7 @@ describe('startAutomationServer lifecycle', () => {
     const sim = makeSim()
     getSimulatorMock.mockReturnValue(sim as unknown as ReturnType<typeof getSimulator>)
 
-    const server = await startAutomationServer(ctx, 0)
+    const server = await startAutomationServer(() => ctx, ctx, 0)
 
     const wss = wssStub.created[0]!
     wss.emit('connection', { readyState: 1, OPEN: 1, send: vi.fn(), close: vi.fn(), on: vi.fn() })
@@ -254,7 +263,7 @@ describe('startAutomationServer lifecycle', () => {
     const sim = makeSim()
     getSimulatorMock.mockReturnValue(sim as unknown as ReturnType<typeof getSimulator>)
 
-    const server = await startAutomationServer(ctx, 0)
+    const server = await startAutomationServer(() => ctx, ctx, 0)
 
     const wss = wssStub.created[0]!
     wss.emit('connection', { readyState: 1, OPEN: 1, send: vi.fn(), close: vi.fn(), on: vi.fn() })
@@ -272,4 +281,27 @@ describe('startAutomationServer lifecycle', () => {
     server.close()
     expect(sim.removeListener).not.toHaveBeenCalled()
   })
+
+  it('unsubscribes from the window\'s ConsoleForwarder when the connection closes', async () => {
+    const ctx = makeCtx()
+    const server = await startAutomationServer(() => ctx, ctx, 0)
+
+    const wss = wssStub.created[0]!
+    const ws = { readyState: 1, OPEN: 1, send: vi.fn(), close: vi.fn(), on: vi.fn() }
+    wss.emit('connection', ws)
+
+    const subscribe = (ctx.consoleForwarder as unknown as { subscribe: ReturnType<typeof vi.fn> }).subscribe
+    expect(subscribe).toHaveBeenCalledTimes(1)
+    const unsubscribe = (subscribe.mock.results[0]!.value as { dispose: ReturnType<typeof vi.fn> }).dispose
+
+    const onClose = ws.on.mock.calls.find(([event]) => event === 'close')?.[1] as () => void
+    expect(onClose, 'connection handler must register a close listener').toBeTypeOf('function')
+    onClose()
+
+    // A late console entry from the window must not fire at a client that is
+    // already gone.
+    expect(unsubscribe).toHaveBeenCalledTimes(1)
+
+    server.close()
+  })
 })
diff --git a/packages/devtools/src/main/services/automation/index.ts b/packages/devtools/src/main/services/automation/index.ts
index e579c222..ee4b40e5 100644
--- a/packages/devtools/src/main/services/automation/index.ts
+++ b/packages/devtools/src/main/services/automation/index.ts
@@ -10,14 +10,16 @@
  * (simulator webContents, IPC handlers, etc.) without modifying dimina upstream.
  */
 
-import type { WebContents } from 'electron'
 import type { AddressInfo } from 'net'
 import { WebSocketServer, type WebSocket } from 'ws'
-import { AutomationChannel, SimulatorChannel } from '../../../shared/ipc-channels.js'
+import { AutomationChannel } from '../../../shared/ipc-channels.js'
 import { IpcRegistry } from '../../utils/ipc-registry.js'
+import { toIpcContextSource, type IpcInput } from '../../utils/ipc-context-source.js'
 // eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
 import type { WorkbenchContext } from '../workbench-context.js'
 import type { Handler, RpcEvent, RpcRequest, RpcResponse } from './shared.js'
+import { createConnectionTarget } from './connection-target.js'
+import { createConsoleBridge, type ConsoleBridge } from './console-bridge.js'
 import { getSimulator } from './exec.js'
 import { toolHandlers } from './handlers/tool.js'
 import { appHandlers } from './handlers/app.js'
@@ -46,8 +48,19 @@ export function getAutomationPort(): number | null {
   return currentPort
 }
 
+/**
+ * `getCtx` rather than a context: the server binds its port at boot, before any
+ * project window exists, so there is nothing to capture yet. Each connection
+ * then pins the first project window it reaches and keeps driving that one —
+ * `getCtx` is how it finds that window, not a per-message lookup.
+ *
+ * `senders` covers every live window instead, because the port channel is asked
+ * by renderers `getCtx` never names: the project list and background project
+ * windows all start automation clients of their own.
+ */
 export async function startAutomationServer(
-  ctx: WorkbenchContext,
+  getCtx: () => WorkbenchContext,
+  senders: IpcInput<WorkbenchContext>,
   port: number = 0,
 ): Promise<AutomationServer> {
   const wss = new WebSocketServer({ port })
@@ -63,127 +76,36 @@ export async function startAutomationServer(
   const resolvedPort = typeof addr === 'object' && addr ? (addr as AddressInfo).port : port
   currentPort = resolvedPort
 
-  // Gate AutomationChannel.GetPort with the workbench sender policy (only
-  // the main renderer + workbench settings/popover overlays are allowed to
-  // read the port — see createWorkbenchSenderPolicy; the simulator webview
-  // is intentionally NOT trusted for IPC invokes).
-  const portIpc = new IpcRegistry(ctx.senderPolicy)
+  // Gated per OWNING window: each window trusts its own renderer plus its
+  // settings/popover overlays (see createWorkbenchSenderPolicy), and the
+  // simulator webview is trusted by none of them. Gating on the active
+  // window's policy instead would reject every window that does not currently
+  // have focus, starting with the project list.
+  const portIpc = new IpcRegistry(toIpcContextSource(senders))
   portIpc.handle(AutomationChannel.GetPort, () => {
     return currentPort
   })
 
-  function broadcast(event: RpcEvent): void {
-    const msg = JSON.stringify(event)
-    for (const ws of clients) {
-      if (ws.readyState === ws.OPEN) ws.send(msg)
-    }
-  }
-
-  // Native-host console forwarding: under native-host the page/service console
-  // doesn't flow through the simulator guest's `ipc-message-host` channel (there
-  // is no Worker/MiniApp in the guest). Instead the render-host / service-host
-  // preloads post each console entry to main, bridge-router routes it to the
-  // always-on ConsoleForwarder, and we SUBSCRIBE to rebroadcast every entry
-  // (both layers) as an `App.logAdded` event — same shape the default-arch path
-  // emits below in `setupConsoleForwarding`. We no longer set `ctx.guestConsole`
-  // ourselves (the forwarder owns it); subscribing means render + service both
-  // reach automation while the forwarder also mirrors render into the service
-  // host's console for the embedded DevTools. Unsubscribed on close().
-  const consoleSub = ctx.consoleForwarder?.subscribe((entry) => {
-    const e = (entry ?? {}) as { level?: string; args?: unknown[] }
-    broadcast({
-      method: 'App.logAdded',
-      params: { type: e.level || 'log', args: e.args || [] },
-    })
-  })
-
-  // Forward simulator console logs as App.logAdded events.
-  // Track the polling interval + stop timer + currently-attached sim and
-  // the named handler so we can fully detach on close() or sim destruction.
-  // Without this the listener accumulates across create/dispose cycles and
-  // across simulator rebuilds.
-  let consoleForwardingSetup = false
-  let pollInterval: ReturnType<typeof setInterval> | null = null
-  let pollStopTimer: ReturnType<typeof setTimeout> | null = null
-  let attachedSim: WebContents | null = null
-  let ipcMessageHostHandler: ((event: unknown, channel: string, data: unknown) => void) | null = null
-  // Handle for the destroyed-teardown owned by the sim's connection (replaces a
-  // bespoke `sim.once('destroyed')` + manual removeListener). Disposing it on
-  // graceful close()/detach releases the disposer from the connection segment so
-  // it can't accumulate across automation create/dispose cycles on the same sim.
-  let simDestroyedDisposer: { dispose: () => void | Promise<void> } | null = null
-
-  function detachConsoleForwarding(): void {
-    if (attachedSim) {
-      if (ipcMessageHostHandler) {
-        try {
-          if (!attachedSim.isDestroyed()) {
-            ;(attachedSim as NodeJS.EventEmitter).removeListener('ipc-message-host', ipcMessageHostHandler)
-          }
-        } catch { /* noop */ }
-      }
-    }
-    // Release the connection-owned destroyed disposer (idempotent; safe even if
-    // the sim is already destroyed — the disposer body only nulls local refs).
-    try { simDestroyedDisposer?.dispose() } catch { /* noop */ }
-    attachedSim = null
-    ipcMessageHostHandler = null
-    simDestroyedDisposer = null
-  }
-
-  function setupConsoleForwarding(): void {
-    if (consoleForwardingSetup) return
-    consoleForwardingSetup = true
-
-    pollInterval = setInterval(() => {
-      const sim = getSimulator(ctx)
-      if (!sim) return
-      if (pollInterval) {
-        clearInterval(pollInterval)
-        pollInterval = null
-      }
-
-      const onIpcMessageHost = (_event: unknown, channel: string, data: unknown): void => {
-        if (channel === SimulatorChannel.Console) {
-          const logData = data as { level?: string; args?: unknown[] }
-          broadcast({
-            method: 'App.logAdded',
-            params: { type: logData.level || 'log', args: logData.args || [] },
-          })
-        }
-      }
-      const onSimDestroyed = (): void => {
-        // Sim webContents is dead — drop refs (removeListener on a destroyed
-        // sender would throw) and allow re-attach to a new simulator.
-        attachedSim = null
-        ipcMessageHostHandler = null
-        simDestroyedDisposer = null
-        consoleForwardingSetup = false
-      }
-
-      attachedSim = sim
-      ipcMessageHostHandler = onIpcMessageHost
-      ;(sim as NodeJS.EventEmitter).on('ipc-message-host', onIpcMessageHost)
-      // Route the destroyed-teardown through the per-webContents connection
-      // registry: the connection arms a single `wc.once('destroyed')` and runs
-      // owned disposers on hard-destroy (or soft reset for pool reuse), so we no
-      // longer manage a bespoke 'destroyed' listener here.
-      simDestroyedDisposer = ctx.connections.acquire(sim).own(onSimDestroyed)
-    }, 1000)
-
-    // Stop polling after 30s
-    pollStopTimer = setTimeout(() => {
-      if (pollInterval) {
-        clearInterval(pollInterval)
-        pollInterval = null
-      }
-      pollStopTimer = null
-    }, 30000)
-  }
+  // Every connection owns its console bridge, because every connection has its
+  // own target window: a single server-wide broadcast would hand one client the
+  // logs of a project another client is driving.
+  const bridges = new Set<ConsoleBridge>()
 
   wss.on('connection', (ws) => {
     clients.add(ws)
-    setupConsoleForwarding()
+
+    const send = (msg: RpcEvent | RpcResponse): void => {
+      if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(msg))
+    }
+    // Pinned, not resolved per message: the window a script drives is settled by
+    // the first project window this connection reaches, so a user clicking
+    // another project's window can't redirect it (see `createConnectionTarget`).
+    const target = createConnectionTarget(getCtx)
+    const consoleBridge = createConsoleBridge(() => target.peek(), getSimulator, send)
+    bridges.add(consoleBridge)
+    // Before any message: a client that only listens for `App.logAdded` never
+    // sends one, and still has to receive its target window's console.
+    consoleBridge.sync()
 
     ws.on('message', async (raw) => {
       let req: RpcRequest
@@ -199,6 +121,9 @@ export async function startAutomationServer(
         response = { id, error: { message: `Unknown method: ${method}` } }
       } else {
         try {
+          // Same target for the command and for the logs it produces.
+          const ctx = target.resolve()
+          consoleBridge.sync()
           const result = await handler(ctx, params)
           response = { id, result }
         } catch (err) {
@@ -206,28 +131,24 @@ export async function startAutomationServer(
         }
       }
 
-      if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(response))
+      send(response)
     })
 
-    ws.on('close', () => clients.delete(ws))
+    ws.on('close', () => {
+      clients.delete(ws)
+      bridges.delete(consoleBridge)
+      consoleBridge.dispose()
+    })
   })
 
   return {
     close: () => {
-      if (pollInterval) {
-        clearInterval(pollInterval)
-        pollInterval = null
-      }
-      if (pollStopTimer) {
-        clearTimeout(pollStopTimer)
-        pollStopTimer = null
-      }
-      detachConsoleForwarding()
-      // Unsubscribe from the always-on ConsoleForwarder so a late guest console
-      // entry can't broadcast against a torn-down server. The forwarder keeps
-      // owning `ctx.guestConsole` (render→service mirroring continues without an
-      // automation client). No-op if the forwarder was absent.
-      consoleSub?.dispose()
+      // Detaches every connection's simulator listener and unsubscribes it from
+      // its window's ConsoleForwarder, so a late guest console entry can't fire
+      // against a torn-down server. The forwarder keeps owning `ctx.guestConsole`
+      // (render→service mirroring continues without an automation client).
+      for (const bridge of bridges) bridge.dispose()
+      bridges.clear()
       for (const ws of clients) {
         try { ws.close() } catch { /* noop */ }
       }
diff --git a/packages/devtools/src/main/services/automation/port-sender-routing.test.ts b/packages/devtools/src/main/services/automation/port-sender-routing.test.ts
new file mode 100644
index 00000000..7c64d022
--- /dev/null
+++ b/packages/devtools/src/main/services/automation/port-sender-routing.test.ts
@@ -0,0 +1,108 @@
+/**
+ * Who may read the automation port is decided by the window the caller belongs
+ * to, not by the window that happens to be active.
+ *
+ * `AutomationChannel.GetPort` is asked by every renderer that starts an
+ * automation client: the project list, and each project window. Gating it on
+ * the ACTIVE window's `senderPolicy` means the list window and every
+ * background project window are told "sender rejected" — the port is trusted
+ * information for all of them, and each one owns its own sender.
+ */
+import { beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest'
+
+const stub = vi.hoisted(() => {
+  type Handler = (...args: unknown[]) => unknown
+  const guardedFns = new Map<string, Handler>()
+  const ipcMainStub = {
+    handle: vi.fn((channel: string, fn: Handler) => { guardedFns.set(channel, fn) }),
+    removeHandler: vi.fn((channel: string) => { guardedFns.delete(channel) }),
+    on: vi.fn(),
+    removeListener: vi.fn(),
+  }
+  return { guardedFns, ipcMainStub }
+})
+
+vi.mock('electron', () => ({
+  ipcMain: stub.ipcMainStub,
+  app: { on: vi.fn(), removeListener: vi.fn() },
+  webContents: { fromId: vi.fn(() => null), getAllWebContents: vi.fn(() => []) },
+  BrowserWindow: class {},
+}))
+
+vi.mock('ws', () => ({
+  WebSocketServer: class {
+    constructor(_opts: unknown) {
+      return {
+        on: vi.fn(),
+        once: vi.fn((event: string, fn: () => void) => {
+          if (event === 'listening') queueMicrotask(() => fn())
+        }),
+        close: vi.fn(),
+        address: vi.fn(() => ({ port: 54321 })),
+      } as unknown as InstanceType<typeof WebSocketServer>
+    }
+  },
+}))
+
+import { WebSocketServer } from 'ws'
+import { AutomationChannel } from '../../../shared/ipc-channels.js'
+import { startAutomationServer } from './index.js'
+
+type CtxStub = ReturnType<Parameters<typeof startAutomationServer>[0]>
+
+/** One window: it trusts its own renderer and nothing else. */
+function makeWindowCtx(senderId: number) {
+  return {
+    senderId,
+    senderPolicy: (sender: { id: number }) => sender.id === senderId,
+  } as unknown as CtxStub & { senderId: number }
+}
+
+const sender = (id: number) => ({ sender: { id, isDestroyed: () => false, getURL: () => `devtools://w${id}` } })
+
+beforeEach(() => {
+  stub.guardedFns.clear()
+  stub.ipcMainStub.handle.mockClear()
+})
+
+describe('the automation port handler with several windows open', () => {
+  const listWindow = makeWindowCtx(1)
+  const projectA = makeWindowCtx(2)
+  const projectB = makeWindowCtx(3)
+  /** Stands in for the app's window-context router. */
+  const senders = {
+    resolve: (s: unknown) => [listWindow, projectA, projectB]
+      .find((ctx) => ctx.senderPolicy(s as never)) ?? null,
+    list: () => [listWindow, projectA, projectB],
+  }
+
+  it('answers a window that is not the active one', async () => {
+    // The user is working in project A; the list window asks for the port.
+    const server = await startAutomationServer(() => projectA, senders, 0)
+    // Closed no matter how the assertions go: the invoke handler is registered
+    // process-wide, so a server left open leaks its gate into the next test.
+    onTestFinished(() => server.close())
+    const guarded = stub.guardedFns.get(AutomationChannel.GetPort)!
+
+    await expect(
+      guarded(sender(listWindow.senderId) as unknown as { sender: unknown }),
+      'the project list starts automation clients too — rejecting it because another window has focus breaks automation everywhere but the focused project',
+    ).resolves.toBe(54321)
+
+    await expect(
+      guarded(sender(projectB.senderId) as unknown as { sender: unknown }),
+      'a background project window owns its own sender and must be answered from its own policy',
+    ).resolves.toBe(54321)
+  })
+
+  it('still rejects a sender no window owns', async () => {
+    const server = await startAutomationServer(() => projectA, senders, 0)
+    onTestFinished(() => server.close())
+    const guarded = stub.guardedFns.get(AutomationChannel.GetPort)!
+
+    await expect(
+      guarded(sender(99) as unknown as { sender: unknown }),
+      'routing by owning window must stay a trust gate: a sender belonging to no window (the simulator webview) still gets nothing',
+    ).rejects.toThrow(/sender rejected/i)
+  })
+})
diff --git a/packages/devtools/src/main/services/automation/target-binding.test.ts b/packages/devtools/src/main/services/automation/target-binding.test.ts
new file mode 100644
index 00000000..5f23ace0
--- /dev/null
+++ b/packages/devtools/src/main/services/automation/target-binding.test.ts
@@ -0,0 +1,278 @@
+/**
+ * Which project window a single automation connection acts on.
+ *
+ * A script connects, drives one project, and must keep driving THAT project:
+ * the window the user happens to be looking at is not part of the protocol.
+ * These tests pin the user-visible half of that — where a command lands, where
+ * the console it receives comes from, and what happens once the window it was
+ * driving is gone.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  ipcMain: { handle: vi.fn(), removeHandler: vi.fn(), on: vi.fn(), removeListener: vi.fn() },
+  app: { on: vi.fn(), removeListener: vi.fn() },
+  webContents: { fromId: vi.fn(() => null), getAllWebContents: vi.fn(() => []) },
+  BrowserWindow: class {},
+}))
+
+// ws stub: emulate the WebSocketServer surface used by startAutomationServer.
+const wssStub = vi.hoisted(() => {
+  const created: Array<{ emit: (event: string, ...args: unknown[]) => void }> = []
+  class WebSocketServerStub {
+    private listeners = new Map<string, Array<(...args: unknown[]) => void>>()
+    constructor(_opts: unknown) {
+      const self = {
+        on: vi.fn((event: string, fn: (...args: unknown[]) => void) => {
+          if (!this.listeners.has(event)) this.listeners.set(event, [])
+          this.listeners.get(event)!.push(fn)
+        }),
+        once: vi.fn((event: string, fn: (...args: unknown[]) => void) => {
+          if (event === 'listening') queueMicrotask(() => fn())
+        }),
+        close: vi.fn(),
+        address: vi.fn(() => ({ port: 54321 })),
+        emit: (event: string, ...args: unknown[]) => {
+          for (const fn of this.listeners.get(event) ?? []) fn(...args)
+        },
+      }
+      created.push(self)
+      return self as unknown as WebSocketServerStub
+    }
+  }
+  return { created, WebSocketServerStub }
+})
+
+vi.mock('ws', () => ({ WebSocketServer: wssStub.WebSocketServerStub }))
+
+// Import AFTER the mocks so the module picks up the stubs.
+import { createConnectionRegistry } from '@dimina-kit/electron-deck/main'
+import { SimulatorChannel } from '../../../shared/ipc-channels.js'
+import { startAutomationServer } from './index.js'
+import { getSimulator } from './exec.js'
+
+vi.mock('./exec.js', async () => {
+  const actual = await vi.importActual<typeof import('./exec.js')>('./exec.js')
+  return { ...actual, getSimulator: vi.fn() }
+})
+
+const getSimulatorMock = vi.mocked(getSimulator)
+
+type CtxStub = ReturnType<Parameters<typeof startAutomationServer>[0]>
+
+interface CtxHarness {
+  ctx: CtxStub
+  window: { isDestroyed: ReturnType<typeof vi.fn> }
+  closeProject: ReturnType<typeof vi.fn>
+}
+
+/**
+ * `Tool.close` is a registered handler that only touches `ctx.workspace`, so a
+ * per-context `closeProject` spy shows WHICH window a message actually reached.
+ */
+function makeCtx(hasSession = true): CtxHarness {
+  const window = { isDestroyed: vi.fn(() => false) }
+  const closeProject = vi.fn(async () => {})
+  const raw = {
+    senderPolicy: () => true,
+    connections: createConnectionRegistry(),
+    windows: { mainWindow: window },
+    workspace: { hasActiveSession: () => hasSession, closeProject },
+  }
+  return { ctx: raw as unknown as CtxStub, window, closeProject }
+}
+
+let nextSimId = 1
+function makeSim() {
+  const listeners = new Map<string, Array<(...a: unknown[]) => void>>()
+  return {
+    id: nextSimId++,
+    isDestroyed: vi.fn(() => false),
+    on: vi.fn((event: string, fn: (...a: unknown[]) => void) => {
+      if (!listeners.has(event)) listeners.set(event, [])
+      listeners.get(event)!.push(fn)
+    }),
+    once: vi.fn((event: string, fn: (...a: unknown[]) => void) => {
+      if (!listeners.has(event)) listeners.set(event, [])
+      listeners.get(event)!.push(fn)
+    }),
+    removeListener: vi.fn((event: string, fn: (...a: unknown[]) => void) => {
+      const arr = listeners.get(event)
+      if (!arr) return
+      const i = arr.indexOf(fn)
+      if (i >= 0) arr.splice(i, 1)
+    }),
+    log: (text: string) => {
+      for (const fn of [...(listeners.get('ipc-message-host') ?? [])]) {
+        fn({}, SimulatorChannel.Console, { level: 'log', args: [text] })
+      }
+    },
+  }
+}
+
+type SimStub = ReturnType<typeof makeSim>
+
+/** Route `getSimulator(ctx)` per context, the way separate windows do. */
+const simOf = new Map<CtxStub, SimStub | null>()
+
+function makeClient() {
+  const send = vi.fn()
+  const on = vi.fn()
+  const ws = { readyState: 1, OPEN: 1, send, close: vi.fn(), on }
+  return {
+    ws,
+    send,
+    message: (method: string, id = '1') => {
+      const listener = on.mock.calls.find(([event]) => event === 'message')?.[1] as
+        (raw: string) => Promise<void>
+      return listener(JSON.stringify({ id, method, params: {} }))
+    },
+    responses: () =>
+      send.mock.calls
+        .map(([raw]) => JSON.parse(String(raw)) as { id?: string; error?: { message: string } })
+        .filter((m) => m.id !== undefined),
+    logs: () =>
+      send.mock.calls
+        .map(([raw]) => JSON.parse(String(raw)) as { method?: string; params?: { args?: unknown[] } })
+        .filter((m) => m.method === 'App.logAdded')
+        .flatMap((m) => (m.params?.args ?? []) as unknown[]),
+  }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  wssStub.created.length = 0
+  simOf.clear()
+  getSimulatorMock.mockReset()
+  getSimulatorMock.mockImplementation(
+    (ctx) => (simOf.get(ctx as unknown as CtxStub) ?? null) as ReturnType<typeof getSimulator>,
+  )
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('automation connection target', () => {
+  it('keeps driving the project it reached when another project window takes focus', async () => {
+    const a = makeCtx()
+    const b = makeCtx()
+    let active = a.ctx
+    const server = await startAutomationServer(() => active, { resolve: () => active, list: () => [active] }, 0)
+
+    const client = makeClient()
+    wssStub.created[0]!.emit('connection', client.ws)
+    await client.message('Tool.close')
+    expect(a.closeProject).toHaveBeenCalledTimes(1)
+
+    // The user clicks the other project's window; the script did nothing.
+    active = b.ctx
+    await client.message('Tool.close', '2')
+
+    expect(b.closeProject, 'window focus must not redirect a live connection').not.toHaveBeenCalled()
+    expect(a.closeProject).toHaveBeenCalledTimes(2)
+
+    server.close()
+  })
+
+  it('forwards console from the same window its commands reach', async () => {
+    const a = makeCtx()
+    const b = makeCtx()
+    const simA = makeSim()
+    const simB = makeSim()
+    simOf.set(a.ctx, simA)
+    simOf.set(b.ctx, simB)
+    let active = a.ctx
+    const server = await startAutomationServer(() => active, { resolve: () => active, list: () => [active] }, 0)
+
+    const client = makeClient()
+    wssStub.created[0]!.emit('connection', client.ws)
+    await client.message('Tool.close')
+
+    active = b.ctx
+    await vi.advanceTimersByTimeAsync(1000)
+    await client.message('Tool.close', '2')
+
+    simA.log('from-a')
+    simB.log('from-b')
+
+    expect(client.logs(), 'console must come from the window the commands reach').toContain('from-a')
+    expect(client.logs()).not.toContain('from-b')
+    expect(b.closeProject).not.toHaveBeenCalled()
+
+    server.close()
+  })
+
+  it('binds to the first project window that opens when the client connected before one existed', async () => {
+    const list = makeCtx(false)
+    const a = makeCtx()
+    const b = makeCtx()
+    let active: CtxStub = list.ctx
+    const server = await startAutomationServer(() => active, { resolve: () => active, list: () => [active] }, 0)
+
+    // Connecting at boot must work: nothing to drive yet, but no error either.
+    const client = makeClient()
+    wssStub.created[0]!.emit('connection', client.ws)
+    await client.message('Tool.getInfo')
+    expect(client.responses()[0]?.error).toBeUndefined()
+
+    // The script opens a project; the first window with a session becomes its target.
+    active = a.ctx
+    await client.message('Tool.close', '2')
+    expect(a.closeProject).toHaveBeenCalledTimes(1)
+
+    active = b.ctx
+    await client.message('Tool.close', '3')
+    expect(a.closeProject).toHaveBeenCalledTimes(2)
+    expect(b.closeProject).not.toHaveBeenCalled()
+
+    server.close()
+  })
+
+  it('fails the command instead of drifting once its window is closed', async () => {
+    const a = makeCtx()
+    const b = makeCtx()
+    let active = a.ctx
+    const server = await startAutomationServer(() => active, { resolve: () => active, list: () => [active] }, 0)
+
+    const client = makeClient()
+    wssStub.created[0]!.emit('connection', client.ws)
+    await client.message('Tool.close')
+
+    // The user closes the window the script was driving; another project stays open.
+    a.window.isDestroyed.mockReturnValue(true)
+    active = b.ctx
+    await client.message('Tool.close', '2')
+
+    const last = client.responses().at(-1)!
+    expect(last.error?.message, 'a closed target must be reported, not replaced').toMatch(/closed/i)
+    expect(b.closeProject, 'a closed target must not fall through to another project').not.toHaveBeenCalled()
+
+    server.close()
+  })
+
+  it('follows its own window when the simulator is replaced by a rebuild', async () => {
+    const a = makeCtx()
+    const first = makeSim()
+    const rebuilt = makeSim()
+    simOf.set(a.ctx, first)
+    const server = await startAutomationServer(() => a.ctx, a.ctx, 0)
+
+    const client = makeClient()
+    wssStub.created[0]!.emit('connection', client.ws)
+    await vi.advanceTimersByTimeAsync(1000)
+    first.log('before-rebuild')
+
+    // A rebuild swaps the window's simulator webContents.
+    simOf.set(a.ctx, rebuilt)
+    await vi.advanceTimersByTimeAsync(1000)
+    rebuilt.log('after-rebuild')
+    first.log('stale')
+
+    expect(client.logs()).toContain('before-rebuild')
+    expect(client.logs(), 'console must re-point at the replacement simulator').toContain('after-rebuild')
+    expect(client.logs(), 'the replaced simulator must be detached').not.toContain('stale')
+
+    server.close()
+  })
+})
diff --git a/packages/devtools/src/main/services/default-adapter.test.ts b/packages/devtools/src/main/services/default-adapter.test.ts
new file mode 100644
index 00000000..37830e8a
--- /dev/null
+++ b/packages/devtools/src/main/services/default-adapter.test.ts
@@ -0,0 +1,57 @@
+/**
+ * Contract: the default compilation adapter must stop asking devkit's
+ * `openProject` to build under a single flat `outputDir` (name-collision risk
+ * across projects with the same appid) and instead pass `outputRoot` —
+ * `<userData>/dimina-fe-output` — letting devkit key each project's artifacts
+ * onto its own hashed subdirectory.
+ *
+ * Electron mock: only `app.getPath` is exercised here, copied down from the
+ * fuller stub in open-settings-wiring.test.ts. `@dimina-kit/devkit` is
+ * mocked so the assertion reads the exact options object the adapter built,
+ * without spinning up a real compile.
+ */
+import path from 'node:path'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => ({
+  app: {
+    getPath: vi.fn(() => '/tmp/dimina-test-userdata'),
+  },
+}))
+
+const devkitOpenProject = vi.hoisted(() => vi.fn((_opts: Record<string, unknown>) => Promise.resolve({
+  port: 0,
+  appInfo: { appId: 'unknown', name: 'x', path: '/tmp/proj' },
+  rebuild: () => Promise.resolve(),
+  close: () => Promise.resolve(),
+})))
+
+vi.mock('@dimina-kit/devkit', () => ({
+  openProject: devkitOpenProject,
+}))
+
+beforeEach(() => {
+  vi.resetModules()
+  devkitOpenProject.mockClear()
+})
+
+describe('defaultAdapter.openProject: passes outputRoot, not a flat outputDir, to devkit', () => {
+  it('calls devkit openProject with outputRoot = <userData>/dimina-fe-output and outputDir left undefined', async () => {
+    const { defaultAdapter } = await import('./default-adapter.js')
+
+    await defaultAdapter.openProject({ projectPath: '/tmp/some-project' })
+
+    expect(devkitOpenProject).toHaveBeenCalledTimes(1)
+    const opts = devkitOpenProject.mock.calls[0]![0] as Record<string, unknown>
+
+    expect(
+      opts.outputRoot,
+      'the adapter must key artifacts onto a per-project subdirectory via outputRoot, not a single shared outputDir',
+    ).toBe(path.join('/tmp/dimina-test-userdata', 'dimina-fe-output'))
+
+    expect(
+      opts.outputDir,
+      'outputDir and outputRoot are mutually exclusive in devkit — passing both makes openProject reject',
+    ).toBeUndefined()
+  })
+})
diff --git a/packages/devtools/src/main/services/default-adapter.ts b/packages/devtools/src/main/services/default-adapter.ts
index 8ee8b285..cc669629 100644
--- a/packages/devtools/src/main/services/default-adapter.ts
+++ b/packages/devtools/src/main/services/default-adapter.ts
@@ -8,7 +8,7 @@ export const defaultAdapter: CompilationAdapter = {
   async openProject(opts) {
     const diminaKit = await import('@dimina-kit/devkit')
     const openProjectOpts: OpenProjectOptions = {
-      outputDir: path.join(app.getPath('userData'), 'dimina-fe-output'),
+      outputRoot: path.join(app.getPath('userData'), 'dimina-fe-output'),
       ...opts,
       simulatorDir,
     }
diff --git a/packages/devtools/src/main/services/fs-watch-sse.ts b/packages/devtools/src/main/services/fs-watch-sse.ts
index 0cdee346..7f4f9b21 100644
--- a/packages/devtools/src/main/services/fs-watch-sse.ts
+++ b/packages/devtools/src/main/services/fs-watch-sse.ts
@@ -40,15 +40,22 @@ function shouldReportWatchPath(rel: string): boolean {
 
 export const __testing = { shouldReportWatchPath }
 
+/**
+ * Returns the call that ends this stream from the server side, or `null` when
+ * the request was answered with an error instead of a stream. Nothing else can
+ * end it: the client is the only party that ever disconnects, so the server
+ * that outlives the request needs a handle to close the channel when IT is the
+ * one going away.
+ */
 export function handleFsWatchRequest(
   req: http.IncomingMessage,
   res: http.ServerResponse,
   getProjectRoot: () => string,
-): void {
+): (() => void) | null {
   const watchedRoot = getProjectRoot()
   if (!watchedRoot) {
     jsonRes(res, 409, { error: 'No active project', code: 'ENOACTIVE' })
-    return
+    return null
   }
 
   let watcher: nodeFs.FSWatcher
@@ -56,7 +63,7 @@ export function handleFsWatchRequest(
     watcher = nodeFs.watch(watchedRoot, { recursive: true }, onChange)
   } catch (e) {
     jsonRes(res, 500, { error: String(e) })
-    return
+    return null
   }
 
   res.writeHead(200, {
@@ -123,4 +130,10 @@ export function handleFsWatchRequest(
   }, WATCH_DEBOUNCE_MS)
 
   req.on('close', cleanup)
+
+  return function endStream(): void {
+    if (closed) return
+    cleanup()
+    res.end()
+  }
 }
diff --git a/packages/devtools/src/main/services/mcp/active-window-repoint.test.ts b/packages/devtools/src/main/services/mcp/active-window-repoint.test.ts
new file mode 100644
index 00000000..a10cc7f9
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/active-window-repoint.test.ts
@@ -0,0 +1,168 @@
+/**
+ * A live MCP CDP connection follows the project window the user moves to.
+ *
+ * The `simulator` and `workbench` targets are process-wide and carry no window
+ * argument, so they always mean "the project the user is working in". Which
+ * window that is was only ever read while a connection was being established,
+ * so a connection made while project A had focus kept answering from A's pages
+ * for as long as it stayed alive — every MCP tool then reported and drove the
+ * wrong project once the user switched windows.
+ *
+ * Two things the re-point must not do: reconnect on focus that ends up back
+ * where it started (clicking between windows would otherwise tear the
+ * connection down repeatedly), and connect into a window whose facts are
+ * already gone because it is being torn down.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const noop = () => {}
+  const makeClient = () => ({
+    Page: { enable: async () => {} },
+    Runtime: { enable: async () => {}, on: noop },
+    DOM: { enable: async () => {} },
+    Network: { enable: async () => {}, on: noop },
+    Console: { enable: async () => {}, on: noop },
+    on: noop,
+    close: async () => {},
+  })
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      return makeClient()
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+const guestUrl = (bridgeId: string) =>
+  `file:///app/dist/render-host/__frame__.html?appId=x&bridgeId=${bridgeId}`
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const SHELL_URL = 'http://localhost:7788/simulator.html'
+
+/**
+ * Both project windows' render guests, plus the simulator shell — the target a
+ * window with no facts of its own degrades to, so "re-pointed at a window that
+ * has none" is observable rather than silently finding nothing to connect to.
+ */
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = [
+    { type: 'page', url: SHELL_URL },
+    { type: 'webview', url: guestUrl('bridge-a') },
+    { type: 'webview', url: guestUrl('bridge-b') },
+  ]
+  cdp.connectedTo = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('the MCP simulator target after the active project window changes', () => {
+  it('re-points a live connection at the window the user switched to', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: 'bridge-a', nativeOverviewProvider: null,
+      projectPath: '/proj/a',
+      getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b',
+      getAppId: () => 'app-b',
+    })
+    let active: object = a
+    tm.setActiveMcpWindowResolver(() => active)
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo, 'the first connection follows the window that was active').toEqual([
+      guestUrl('bridge-a'),
+    ])
+
+    active = b
+    tm.noteActiveMcpWindowChanged()
+    await vi.advanceTimersByTimeAsync(1000)
+
+    expect(
+      cdp.connectedTo.at(-1),
+      'once the user works in project B, MCP tools must drive B — an established connection that stays on A silently reports and drives the wrong project',
+    ).toBe(guestUrl('bridge-b'))
+  })
+
+  it('leaves the connection alone when focus lands back where it started', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: 'bridge-a', nativeOverviewProvider: null,
+      projectPath: '/proj/a',
+      getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b',
+      getAppId: () => 'app-b',
+    })
+    let active: object = a
+    tm.setActiveMcpWindowResolver(() => active)
+
+    await tm.connectTarget('simulator')
+
+    // Clicking through B and back to A, faster than the connection can settle.
+    active = b
+    tm.noteActiveMcpWindowChanged()
+    active = a
+    tm.noteActiveMcpWindowChanged()
+    await vi.advanceTimersByTimeAsync(1000)
+
+    expect(
+      cdp.connectedTo,
+      'focus that ends up on the window the connection is already bound to must not reconnect — tearing the CDP client down on every click drops buffered console and network events',
+    ).toEqual([guestUrl('bridge-a')])
+  })
+
+  it('does not re-point into a window that is being torn down', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: 'bridge-a', nativeOverviewProvider: null,
+      projectPath: '/proj/a',
+      getAppId: () => 'app-a',
+    })
+    const registrationB = tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b',
+      getAppId: () => 'app-b',
+    })
+    let active: object = a
+    tm.setActiveMcpWindowResolver(() => active)
+
+    await tm.connectTarget('simulator')
+
+    // B is closing: its facts are dropped while it is still the resolver answer.
+    active = b
+    registrationB.dispose()
+    tm.noteActiveMcpWindowChanged()
+    await vi.advanceTimersByTimeAsync(1000)
+
+    expect(
+      cdp.connectedTo,
+      'a window whose facts are already gone is on its way out; connecting into it would bind MCP to pages that are about to be destroyed',
+    ).toEqual([guestUrl('bridge-a')])
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/buffers-follow-connection-owner.test.ts b/packages/devtools/src/main/services/mcp/buffers-follow-connection-owner.test.ts
new file mode 100644
index 00000000..71e0f88e
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/buffers-follow-connection-owner.test.ts
@@ -0,0 +1,148 @@
+/**
+ * The console/network ring buffers belong to the WINDOW a connection is
+ * publishing for, not to the target-kind slot forever.
+ *
+ * `subscribeBuffers` always pushes onto `state.consoleLogs` /
+ * `state.networkRequests`, and nothing ever clears them — so switching the
+ * live connection from window A to window B leaves A's events sitting in the
+ * buffer `${kind}_console_logs` / `${kind}_network_log` (and
+ * `simulator_get_overview`'s summaries) hand back for B. A reconnect that
+ * lands on the SAME owner (e.g. after a transient disconnect) must not lose
+ * anything, so the fix is to key the buffer's contents to the owner it was
+ * published for and clear on a genuine owner change, not on every publish.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+interface CapturedHandlers {
+  url: string
+  disconnect: (() => void)[]
+  on: Map<string, (...args: unknown[]) => void>
+}
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+  clients: [] as CapturedHandlers[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      const captured: CapturedHandlers = { url: target.url, disconnect: [], on: new Map() }
+      cdp.clients.push(captured)
+      return {
+        Page: { enable: async () => {} },
+        Runtime: {
+          enable: async () => {},
+          on: (event: string, cb: (...args: unknown[]) => void) => captured.on.set(`Runtime.${event}`, cb),
+        },
+        DOM: { enable: async () => {} },
+        Network: {
+          enable: async () => {},
+          on: (event: string, cb: (...args: unknown[]) => void) => captured.on.set(`Network.${event}`, cb),
+        },
+        Console: {
+          enable: async () => {},
+          on: (event: string, cb: (...args: unknown[]) => void) => captured.on.set(`Console.${event}`, cb),
+        },
+        on: (event: string, cb: () => void) => { if (event === 'disconnect') captured.disconnect.push(cb) },
+        close: async () => {},
+      }
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const shellUrl = (appId: string) => `http://localhost:7788/simulator.html?appId=${appId}`
+
+function emitConsoleLog(client: CapturedHandlers, text: string) {
+  client.on.get('Runtime.consoleAPICalled')?.({ type: 'log', args: [{ value: text }], timestamp: Date.now() })
+}
+
+function emitNetworkRequest(client: CapturedHandlers, url: string) {
+  const requestId = `req-${url}`
+  client.on.get('Network.requestWillBeSent')?.({ requestId, request: { url, method: 'GET' }, timestamp: 0 })
+  client.on.get('Network.responseReceived')?.({
+    requestId,
+    response: { status: 200, mimeType: 'text/plain', encodedDataLength: 10 },
+  })
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.connectedTo = []
+  cdp.clients = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('buffers scoped to the connection owner', () => {
+  it('drops the previous owner`s console/network entries when the live connection re-aims at a different window', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: false, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: false, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+
+    tm.setActiveMcpWindowResolver(() => a)
+    cdp.listed = [{ type: 'page', url: shellUrl('app-a') }]
+    await tm.connectTarget('simulator')
+    emitConsoleLog(cdp.clients[0], 'hello from A')
+    emitNetworkRequest(cdp.clients[0], 'https://a.example/data')
+
+    expect(tm.getTargetState('simulator').consoleLogs.length).toBe(1)
+    expect(tm.getTargetState('simulator').networkRequests.length).toBe(1)
+
+    tm.setActiveMcpWindowResolver(() => b)
+    cdp.listed = [{ type: 'page', url: shellUrl('app-b') }]
+    await tm.connectTarget('simulator')
+
+    expect(
+      tm.getTargetState('simulator').consoleLogs,
+      'B must not inherit A`s console entries just because they share the simulator buffer slot',
+    ).toEqual([])
+    expect(
+      tm.getTargetState('simulator').networkRequests,
+      'B must not inherit A`s network entries just because they share the simulator buffer slot',
+    ).toEqual([])
+  })
+
+  it('keeps buffered entries across a disconnect/reconnect that lands on the same owner', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: false, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.setActiveMcpWindowResolver(() => a)
+    cdp.listed = [{ type: 'page', url: shellUrl('app-a') }]
+    await tm.connectTarget('simulator')
+    emitConsoleLog(cdp.clients[0], 'hello from A')
+
+    // Simulate the transport dropping: fires `disconnect`, which schedules a
+    // reconnect back onto the same still-active owner A.
+    cdp.clients[0].disconnect.forEach((cb) => cb())
+    await vi.advanceTimersByTimeAsync(3000)
+
+    expect(
+      tm.getTargetState('simulator').consoleLogs,
+      'a reconnect that lands back on the SAME owner must not discard what was already collected for it',
+    ).toEqual([expect.objectContaining({ text: 'hello from A' })])
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/connect-generation.test.ts b/packages/devtools/src/main/services/mcp/connect-generation.test.ts
new file mode 100644
index 00000000..70060b76
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/connect-generation.test.ts
@@ -0,0 +1,206 @@
+/**
+ * Only the newest MCP connection attempt may publish itself.
+ *
+ * Establishing a CDP connection is a long chain of awaits (list targets,
+ * connect, enable five domains), and the reason to establish one — which window
+ * is active, which page it shows — can change while that chain runs. A
+ * connection that finishes after a newer one was started is aimed at a page the
+ * user has already left; publishing it pins every MCP tool to that stale page,
+ * and closing the live client on its way out leaves MCP reporting "not
+ * connected" while a good connection existed.
+ *
+ * The connections here are held open deliberately: without controlling when
+ * each `CDP()` resolves there is no interleaving to test.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+interface PendingConnect {
+  url: string
+  resolve: () => void
+  isClosed: () => boolean
+}
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  attempted: [] as string[],
+  pending: [] as PendingConnect[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const noop = () => {}
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.attempted.push(target.url)
+      const listeners: (() => void)[] = []
+      let closed = false
+      const client = {
+        url: target.url,
+        Page: { enable: async () => {} },
+        Runtime: { enable: async () => {}, on: noop },
+        DOM: { enable: async () => {} },
+        Network: { enable: async () => {}, on: noop },
+        Console: { enable: async () => {}, on: noop },
+        // A real CDP client emits `disconnect` when it is closed.
+        on: (event: string, cb: () => void) => { if (event === 'disconnect') listeners.push(cb) },
+        close: async () => { closed = true; for (const cb of listeners.splice(0)) cb() },
+      }
+      // The test decides when this connect finishes.
+      await new Promise<void>((resolve) => {
+        cdp.pending.push({ url: target.url, resolve, isClosed: () => closed })
+      })
+      return client
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const SHELL_URL = 'http://localhost:7788/simulator.html'
+const guestUrl = (bridgeId: string) =>
+  `file:///app/dist/render-host/__frame__.html?appId=x&bridgeId=${bridgeId}`
+
+/** Let every already-resolved promise in the connect chain run. */
+async function settle(): Promise<void> {
+  await vi.advanceTimersByTimeAsync(0)
+}
+
+/** Finish the in-flight connect to `url` and hand back its record. */
+async function release(url: string): Promise<PendingConnect> {
+  const index = cdp.pending.findIndex((p) => p.url === url)
+  if (index < 0) throw new Error(`no in-flight CDP connect to ${url}`)
+  const [entry] = cdp.pending.splice(index, 1)
+  entry.resolve()
+  await settle()
+  return entry
+}
+
+/**
+ * The user works in project B; its page navigates while the connect aimed at
+ * the previous page is still in flight, and that older connect finishes last.
+ */
+async function interleavedNavigation() {
+  const tm = await loadTargetManager()
+  const b = {}
+  const facts = {
+    nativeHost: true,
+    activeBridgeId: 'bridge-b1' as string | null,
+    nativeOverviewProvider: null,
+    projectPath: '/proj/b',
+    getAppId: () => 'app-b',
+  }
+  tm.registerMcpWindow(b, facts)
+  tm.setActiveMcpWindowResolver(() => b)
+  cdp.listed = [
+    { type: 'page', url: SHELL_URL },
+    { type: 'webview', url: guestUrl('bridge-b1') },
+    { type: 'webview', url: guestUrl('bridge-b2') },
+  ]
+
+  const older = tm.connectTarget('simulator')
+  await settle()
+  expect(cdp.pending.map((p) => p.url), 'the first connect is held open').toEqual([
+    guestUrl('bridge-b1'),
+  ])
+
+  // B navigates to the next page, which starts a second connect.
+  facts.activeBridgeId = 'bridge-b2'
+  const newer = tm.connectTarget('simulator')
+  await settle()
+
+  await release(guestUrl('bridge-b2'))
+  await newer
+  const stale = await release(guestUrl('bridge-b1'))
+  await older
+
+  return { tm, stale }
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.attempted = []
+  cdp.pending = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('two MCP connection attempts overlapping', () => {
+  it('leaves MCP on the page the window shows now, not the one it was leaving', async () => {
+    const { tm, stale } = await interleavedNavigation()
+
+    expect(
+      (tm.getTargetState('simulator').client as unknown as { url: string } | null)?.url,
+      'a connect that finishes after a newer one must not take the simulator tools back to the page the user already navigated away from',
+    ).toBe(guestUrl('bridge-b2'))
+    expect(
+      stale.isClosed(),
+      'the discarded connect owns an open CDP client; dropping it without closing leaks the connection for the life of the app',
+    ).toBe(true)
+  })
+
+  it('keeps the live connection usable when the discarded one is dropped', async () => {
+    const { tm } = await interleavedNavigation()
+
+    expect(
+      () => tm.getClient('simulator'),
+      'closing the discarded connection must not report the live one as gone — MCP tools would refuse to run while a good connection exists',
+    ).not.toThrow()
+
+    cdp.attempted = []
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(
+      cdp.attempted,
+      'the discarded connection must not schedule a reconnect that tears the live one down again',
+    ).toEqual([])
+  })
+
+  it('does not read a connection closed for re-aiming as one that was lost', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: 'bridge-b1', nativeOverviewProvider: null,
+      projectPath: '/proj/a',
+      getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b2', nativeOverviewProvider: null,
+      projectPath: '/proj/b',
+      getAppId: () => 'app-b',
+    })
+    let active: object = a
+    tm.setActiveMcpWindowResolver(() => active)
+    cdp.listed = [
+      { type: 'webview', url: guestUrl('bridge-b1') },
+      { type: 'webview', url: guestUrl('bridge-b2') },
+    ]
+
+    const established = tm.connectTarget('simulator')
+    await settle()
+    await release(guestUrl('bridge-b1'))
+    await established
+
+    // The user moves to B: the live client is closed on purpose and the connect
+    // that replaces it is held open.
+    active = b
+    tm.noteActiveMcpWindowChanged()
+    await vi.advanceTimersByTimeAsync(200)
+    expect(cdp.pending.map((p) => p.url), 'the re-aim is in flight').toEqual([
+      guestUrl('bridge-b2'),
+    ])
+
+    cdp.attempted = []
+    await vi.advanceTimersByTimeAsync(10_000)
+    expect(
+      cdp.attempted,
+      'a client closed to re-aim it did not lose its target; treating it as lost arms a reconnect that races the connect already running and opens CDP clients nobody asked for',
+    ).toEqual([])
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/connect-prefers-owned-candidate.test.ts b/packages/devtools/src/main/services/mcp/connect-prefers-owned-candidate.test.ts
new file mode 100644
index 00000000..a5f9e3df
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/connect-prefers-owned-candidate.test.ts
@@ -0,0 +1,125 @@
+/**
+ * `findTarget` must pick a candidate this connection can actually be
+ * attributed to, not merely the first one CDP.List happens to return first.
+ *
+ * `selectSimulatorTarget` / `selectWorkbenchTarget` apply their priority order
+ * over the RAW target list with no idea which window each candidate belongs
+ * to. When two project windows both expose a matching surface (two shells on
+ * localhost:7788, or a render guest next to the active window's own shell),
+ * list order decides — and list order never changes, so a candidate that
+ * belongs to the wrong window is picked every single attempt. `connectTarget`
+ * then discovers the mismatch via `connectionOwner`, closes the client, and
+ * retries — landing on the exact same wrong candidate again, forever.
+ *
+ * The fix has to filter candidates by ownership (via `connectionOwner`)
+ * BEFORE applying the priority order, so the one attempt that CAN reach the
+ * active window's target does.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const noop = () => {}
+  const makeClient = () => ({
+    Page: { enable: async () => {} },
+    Runtime: { enable: async () => {}, on: noop },
+    DOM: { enable: async () => {} },
+    Network: { enable: async () => {}, on: noop },
+    Console: { enable: async () => {}, on: noop },
+    on: noop,
+    close: async () => {},
+  })
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      return makeClient()
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const shellUrl = (appId: string) => `http://localhost:7788/simulator.html?appId=${appId}`
+const guestUrl = (bridgeId: string) =>
+  `file:///app/dist/render-host/__frame__.html?appId=x&bridgeId=${bridgeId}`
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.connectedTo = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('selecting a simulator target among two project windows', () => {
+  it('connects the active window`s shell, not whichever shell is listed first (non-native)', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: false, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: false, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    // A's shell is listed first — the bug is that list order alone decides.
+    cdp.listed = [
+      { type: 'page', url: shellUrl('app-a') },
+      { type: 'page', url: shellUrl('app-b') },
+    ]
+
+    await tm.connectTarget('simulator')
+
+    expect(
+      cdp.connectedTo,
+      'the one attempt must reach B`s shell directly instead of wasting itself on A`s and retrying',
+    ).toEqual([shellUrl('app-b')])
+    expect(tm.getTargetState('simulator').connected, 'B`s shell is a valid target and must end up connected').toBe(true)
+    expect(tm.getTargetState('simulator').owner, 'the published connection must be owned by the active window').toBe(b)
+  })
+
+  it('connects the active window`s own shell rather than another window`s render guest (native-host)', async () => {
+    const tm = await loadTargetManager()
+    const other = {}
+    const active = {}
+    tm.registerMcpWindow(other, {
+      nativeHost: true, activeBridgeId: 'bridge-other', nativeOverviewProvider: null,
+      projectPath: '/proj/other', getAppId: () => 'app-other',
+    })
+    tm.registerMcpWindow(active, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/active', getAppId: () => 'app-active',
+    })
+    tm.setActiveMcpWindowResolver(() => active)
+    // The other window's render guest is listed before the active window's
+    // shell, and "any render guest" outranks the shell fallback — so without
+    // ownership filtering the guest wins even though it belongs to `other`.
+    cdp.listed = [
+      { type: 'webview', url: guestUrl('bridge-other') },
+      { type: 'page', url: shellUrl('app-active') },
+    ]
+
+    await tm.connectTarget('simulator')
+
+    expect(
+      cdp.connectedTo,
+      'the active window has no render guest yet, so its own shell must be the one attempt reaches — never another window`s guest',
+    ).toEqual([shellUrl('app-active')])
+    expect(tm.getTargetState('simulator').connected).toBe(true)
+    expect(tm.getTargetState('simulator').owner).toBe(active)
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/connect-wrong-owner-no-subscribe.test.ts b/packages/devtools/src/main/services/mcp/connect-wrong-owner-no-subscribe.test.ts
new file mode 100644
index 00000000..d24954b2
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/connect-wrong-owner-no-subscribe.test.ts
@@ -0,0 +1,132 @@
+/**
+ * A connection that reaches a target it cannot attribute to the active window
+ * must leave no trace behind it.
+ *
+ * MCP exposes exactly ONE client per target kind, so a connection that landed
+ * on the wrong window's surface still has its console/network buffers wired up
+ * and is still reported as `connected` — the retry that follows only layers a
+ * correct attempt on top, it never undoes either. Until the retry lands,
+ * `getClient` hands out a client whose events belong to a different project,
+ * and the buffers it already collected stay mixed into the ones the eventual
+ * correct connection appends to.
+ *
+ * The fix: a wrong-owner connection closes its client and subscribes nothing,
+ * exactly as if no target had been found at all — the retry cadence is the
+ * only thing that carries over.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+interface FakeClient {
+  closed: boolean
+  subscribedEvents: string[]
+}
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+  clients: [] as FakeClient[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      const fake: FakeClient = { closed: false, subscribedEvents: [] }
+      cdp.clients.push(fake)
+      const record = (event: string) => fake.subscribedEvents.push(event)
+      return {
+        Page: { enable: async () => {} },
+        Runtime: { enable: async () => {}, on: (event: string) => record(`Runtime.${event}`) },
+        DOM: { enable: async () => {} },
+        Network: { enable: async () => {}, on: (event: string) => record(`Network.${event}`) },
+        Console: { enable: async () => {}, on: (event: string) => record(`Console.${event}`) },
+        on: () => {},
+        close: async () => {
+          fake.closed = true
+        },
+      }
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const shellUrl = (appId: string) => `http://localhost:7788/simulator.html?appId=${appId}`
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.connectedTo = []
+  cdp.clients = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * B is the active window, but neither window has a render guest yet, so the
+ * only simulator surface the CDP list offers is A's shell — the one target this
+ * connection can reach belongs to a window other than the one MCP means to
+ * drive.
+ */
+async function connectToWrongOwner() {
+  const tm = await loadTargetManager()
+  const a = {}
+  tm.registerMcpWindow(a, {
+    nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+    projectPath: '/proj/a', getAppId: () => 'app-a',
+  })
+  const b = {}
+  tm.registerMcpWindow(b, {
+    nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+    projectPath: '/proj/b', getAppId: () => 'app-b',
+  })
+  tm.setActiveMcpWindowResolver(() => b)
+  cdp.listed = [{ type: 'page', url: shellUrl('app-a') }]
+
+  await tm.connectTarget('simulator')
+  return tm
+}
+
+describe('a connection that reaches a target belonging to another window', () => {
+  it('closes the client and subscribes no buffers instead of leaving a wrong-owner connection live', async () => {
+    const tm = await connectToWrongOwner()
+
+    expect(cdp.connectedTo).toEqual([shellUrl('app-a')])
+    const client = cdp.clients[0]
+    expect(
+      client.closed,
+      "a client that reached another window's target must be closed rather than kept open as the live connection",
+    ).toBe(true)
+    expect(
+      client.subscribedEvents,
+      'no console/network buffer should ever be wired up for a connection that is not on the window MCP means to drive',
+    ).toEqual([])
+    expect(
+      tm.getTargetState('simulator').connected,
+      'a wrong-owner target must not be reported as the live connection',
+    ).toBe(false)
+    expect(
+      tm.getTargetState('simulator').client,
+      'no client should be retained in state once its target is known to belong to another window',
+    ).toBeNull()
+  })
+
+  it('keeps retrying on the usual interval, the same as when no target was found at all', async () => {
+    await connectToWrongOwner()
+
+    cdp.connectedTo = []
+    await vi.advanceTimersByTimeAsync(3000)
+
+    expect(
+      cdp.connectedTo,
+      'closing the wrong-owner connection must not also cancel the retry that eventually reaches the right window',
+    ).toEqual([shellUrl('app-a')])
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/connection-owner.ts b/packages/devtools/src/main/services/mcp/connection-owner.ts
new file mode 100644
index 00000000..a601c74a
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/connection-owner.ts
@@ -0,0 +1,103 @@
+/**
+ * Which project window a CDP target belongs to.
+ *
+ * MCP keeps one `simulator` and one `workbench` connection for the whole app,
+ * so every connection has to record the window it ACTUALLY reached: one
+ * recorded as arrived is left alone, one recorded elsewhere keeps retrying
+ * until it lands on the window the user is in.
+ */
+
+/** The per-window facts that decide which window a target belongs to. */
+export interface TargetIdentityFacts {
+  activeBridgeId: string | null
+  /**
+   * The resolved project path this window opened with. Fixed for the life of
+   * the window: a window names its project from the moment it exists, so
+   * attribution never has to wait for a compile to record anything.
+   */
+  projectPath: string
+  getAppId: () => string | null
+}
+
+export interface TargetBinding {
+  owner: object | null
+  onTarget: boolean
+}
+
+/** The value of query `key` in a target URL, or null when it carries none. */
+export function targetQuery(url: string | undefined, key: string): string | null {
+  if (!url) return null
+  try {
+    return new URL(url).searchParams.get(key)
+  } catch {
+    return null
+  }
+}
+
+function bind(owner: object, intended: object | null): TargetBinding {
+  return { owner, onTarget: owner === intended }
+}
+
+/** The window whose workbench renderer has this target's project open. */
+function workbenchOwner(
+  url: string | undefined,
+  windows: ReadonlyMap<object, TargetIdentityFacts>,
+): object | null {
+  const path = targetQuery(url, 'path')
+  if (!path) return null
+  for (const [candidate, facts] of windows) {
+    if (facts.projectPath === path) return candidate
+  }
+  return null
+}
+
+/**
+ * The window this simulator surface belongs to: a render guest names it through
+ * its `bridgeId`, the localhost:7788 shell through the `appId` its route
+ * carries. Two windows answering to one appId — what two projects declaring the
+ * same appId produce — name no single window, so neither is returned.
+ */
+function simulatorOwner(
+  url: string | undefined,
+  windows: ReadonlyMap<object, TargetIdentityFacts>,
+): object | null {
+  const bridgeId = targetQuery(url, 'bridgeId')
+  if (bridgeId !== null) {
+    for (const [candidate, facts] of windows) {
+      if (facts.activeBridgeId === bridgeId) return candidate
+    }
+    return null
+  }
+
+  const appId = targetQuery(url, 'appId')
+  if (appId === null) return null
+  let shell: object | null = null
+  for (const [candidate, facts] of windows) {
+    if (facts.getAppId() !== appId) continue
+    if (shell) return null
+    shell = candidate
+  }
+  return shell
+}
+
+/**
+ * The window a chosen target belongs to, and whether that is the window MCP
+ * means to drive right now.
+ *
+ * A simulator target that names no window it can be attributed to is treated as
+ * the wrong window on purpose: it may well be another project's, and keeping the
+ * retries running is what moves the connection onto the active window's render
+ * guest as soon as that guest exists. The one target that legitimately names no
+ * window is the project list, which is the right workbench surface exactly
+ * while no project window is open.
+ */
+export function connectionOwner(
+  kind: 'simulator' | 'workbench',
+  url: string | undefined,
+  intended: object | null,
+  windows: ReadonlyMap<object, TargetIdentityFacts>,
+): TargetBinding {
+  const owner = kind === 'workbench' ? workbenchOwner(url, windows) : simulatorOwner(url, windows)
+  if (owner) return bind(owner, intended)
+  return { owner: null, onTarget: kind === 'workbench' && intended === null }
+}
diff --git a/packages/devtools/src/main/services/mcp/connection-window-binding.test.ts b/packages/devtools/src/main/services/mcp/connection-window-binding.test.ts
new file mode 100644
index 00000000..22dc4252
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/connection-window-binding.test.ts
@@ -0,0 +1,312 @@
+/**
+ * A live MCP CDP connection is bound to the window it ACTUALLY reached.
+ *
+ * A target can still be reached that belongs to another window: a page that has
+ * not finished loading is not in the CDP list at all, and a simulator surface
+ * may name a project that is not the one the user is in — or name none. What
+ * must not happen is recording such a connection as if it had reached the
+ * window MCP means to drive: nothing then re-aims it, so every MCP tool keeps
+ * answering from the other project for as long as the app stays open, no
+ * matter where the user clicks.
+ *
+ * The mirror rule matters just as much: a connection that IS on the right
+ * surface must settle, or the connection would be torn down and rebuilt every
+ * few seconds and lose its buffered console and network events.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const noop = () => {}
+  const makeClient = () => {
+    const listeners: (() => void)[] = []
+    return {
+      Page: { enable: async () => {} },
+      Runtime: { enable: async () => {}, on: noop },
+      DOM: { enable: async () => {} },
+      Network: { enable: async () => {}, on: noop },
+      Console: { enable: async () => {}, on: noop },
+      // A real CDP client emits `disconnect` when it is closed, including when
+      // the manager closes it itself to re-aim.
+      on: (event: string, cb: () => void) => { if (event === 'disconnect') listeners.push(cb) },
+      close: async () => { for (const cb of listeners.splice(0)) cb() },
+    }
+  }
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      return makeClient()
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const LIST_URL = 'file:///app/dist/entries/main/index.html'
+const shellUrl = (appId: string) => `http://localhost:7788/simulator.html?appId=${appId}`
+const workbenchUrl = (path: string) =>
+  `file:///app/dist/entries/workbench/index.html?path=${encodeURIComponent(path)}&name=p`
+const guestUrl = (bridgeId: string) =>
+  `file:///app/dist/render-host/__frame__.html?appId=x&bridgeId=${bridgeId}`
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.connectedTo = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('an MCP connection that could not reach the active project window', () => {
+  it('keeps trying until it reaches the workbench of the project the user is in', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    // B is the window the user just opened: its renderer has not finished
+    // loading, so the only workbench page in the CDP list is A's.
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    cdp.listed = [
+      { type: 'page', url: LIST_URL },
+      { type: 'page', url: workbenchUrl('/proj/a') },
+    ]
+
+    await tm.connectTarget('workbench')
+    expect(
+      cdp.connectedTo,
+      'another project\'s workbench renderer, and the project list, are both the wrong window: neither may stand in for the project the user is in',
+    ).toEqual([])
+
+    // B's renderer finishes loading and becomes a CDP target.
+    cdp.listed = [...cdp.listed, { type: 'page', url: workbenchUrl('/proj/b') }]
+    await vi.advanceTimersByTimeAsync(10_000)
+
+    expect(
+      cdp.connectedTo,
+      'the connection must find its way to the project the user is working in on its own, without the user having to click anywhere',
+    ).toEqual([workbenchUrl('/proj/b')])
+  })
+
+  it('keeps trying until the active page of that window is reachable', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: 'bridge-a', nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    // B's page is still loading, so its render guest is not a CDP target yet.
+    cdp.listed = [
+      { type: 'page', url: shellUrl('app-b') },
+      { type: 'webview', url: guestUrl('bridge-a') },
+    ]
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo).toEqual([guestUrl('bridge-a')])
+
+    cdp.listed = [...cdp.listed, { type: 'webview', url: guestUrl('bridge-b') }]
+    await vi.advanceTimersByTimeAsync(10_000)
+
+    expect(
+      cdp.connectedTo,
+      'the simulator tools must end up on the page of the window the user is in once it exists, without the user having to click anywhere',
+    ).toEqual([guestUrl('bridge-a'), guestUrl('bridge-b')])
+  })
+
+  it('knows it is already there when the user moves to the window it did reach', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: 'bridge-a', nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    let active: object = b
+    tm.setActiveMcpWindowResolver(() => active)
+    // B's page is not reachable, so the connection lands on A's.
+    cdp.listed = [{ type: 'webview', url: guestUrl('bridge-a') }]
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo).toEqual([guestUrl('bridge-a')])
+
+    // The user moves to A — where this connection actually is.
+    active = a
+    tm.noteActiveMcpWindowChanged()
+    await vi.advanceTimersByTimeAsync(1000)
+
+    expect(
+      cdp.connectedTo,
+      'a connection recorded as the window it really reached knows this focus change needs nothing; rebuilding it drops the console and network events it has buffered',
+    ).toEqual([guestUrl('bridge-a')])
+  })
+
+  it('keeps trying when the only simulator surface belongs to another project', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    // B — the window the user is in — is registered first, so a shell taken to
+    // belong to whichever window comes to hand would be taken for B's.
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    // Neither window has a render guest yet, so the only simulator surface in
+    // the CDP list is project A's shell.
+    cdp.listed = [{ type: 'page', url: shellUrl('app-a') }]
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo).toEqual([shellUrl('app-a')])
+
+    cdp.listed = [...cdp.listed, { type: 'webview', url: guestUrl('bridge-b') }]
+    await vi.advanceTimersByTimeAsync(4000)
+
+    expect(
+      cdp.connectedTo,
+      'a shell belongs to the project whose appId it carries; recording another project\'s shell as an arrival leaves every simulator tool driving that project',
+    ).toEqual([shellUrl('app-a'), guestUrl('bridge-b')])
+  })
+
+  it('does not settle on a simulator shell no open window claims', async () => {
+    const tm = await loadTargetManager()
+    const b = {}
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    // The only shell in the list is the one a project window that has just
+    // closed was showing; B's own simulator has not loaded yet.
+    cdp.listed = [{ type: 'page', url: shellUrl('app-gone') }]
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo).toEqual([shellUrl('app-gone')])
+
+    cdp.listed = [...cdp.listed, { type: 'webview', url: guestUrl('bridge-b') }]
+    await vi.advanceTimersByTimeAsync(4000)
+
+    expect(
+      cdp.connectedTo,
+      'the appId a shell carries is what says whose it is; being the only window open does not make another project\'s shell yours',
+    ).toEqual([shellUrl('app-gone'), guestUrl('bridge-b')])
+  })
+
+  it('does not settle on a simulator surface that names no project at all', async () => {
+    const tm = await loadTargetManager()
+    const b = {}
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    cdp.listed = [{ type: 'page', url: 'http://localhost:7788/simulator.html' }]
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo).toEqual(['http://localhost:7788/simulator.html'])
+
+    cdp.listed = [...cdp.listed, { type: 'webview', url: guestUrl('bridge-b') }]
+    await vi.advanceTimersByTimeAsync(4000)
+
+    expect(
+      cdp.connectedTo,
+      'a surface carrying no project identity cannot be shown to be the right one, and assuming it is leaves MCP wherever it happened to land',
+    ).toEqual(['http://localhost:7788/simulator.html', guestUrl('bridge-b')])
+  })
+
+  it('keeps trying when two project windows claim the shell\'s appId', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    // Two projects can declare the same appId, and then the shell URL no longer
+    // says which window it is.
+    // Registered before the other claimant, so picking the first window that
+    // reports the appId would land on B and call it an arrival.
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: 'bridge-b', nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-shared',
+    })
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-shared',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    cdp.listed = [{ type: 'page', url: shellUrl('app-shared') }]
+
+    await tm.connectTarget('simulator')
+    expect(cdp.connectedTo).toEqual([shellUrl('app-shared')])
+
+    cdp.listed = [...cdp.listed, { type: 'webview', url: guestUrl('bridge-b') }]
+    await vi.advanceTimersByTimeAsync(4000)
+
+    expect(
+      cdp.connectedTo,
+      'an ambiguous shell may be the wrong project; only a target that names one window may stop the retries',
+    ).toEqual([shellUrl('app-shared'), guestUrl('bridge-b')])
+  })
+})
+
+describe('an MCP connection that is on the surface it was meant to reach', () => {
+  it('settles on the project list while no project window is open', async () => {
+    const tm = await loadTargetManager()
+    tm.setActiveMcpWindowResolver(() => null)
+    cdp.listed = [{ type: 'page', url: LIST_URL }]
+
+    await tm.connectTarget('workbench')
+    await vi.advanceTimersByTimeAsync(10_000)
+
+    expect(
+      cdp.connectedTo,
+      'with no project open the list IS the workbench surface; treating it as a miss would rebuild the connection every few seconds and drop its buffered events',
+    ).toEqual([LIST_URL])
+  })
+
+  it('settles on the simulator shell of the window the user is in', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: false, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.setActiveMcpWindowResolver(() => a)
+    cdp.listed = [{ type: 'page', url: shellUrl('app-a') }]
+
+    await tm.connectTarget('simulator')
+    await vi.advanceTimersByTimeAsync(10_000)
+
+    expect(
+      cdp.connectedTo,
+      'a shell that carries the appId of the window the user is in IS that window\'s surface; rebuilding it every few seconds would drop its buffered console and network events',
+    ).toEqual([shellUrl('app-a')])
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/get-client-owner-sync.test.ts b/packages/devtools/src/main/services/mcp/get-client-owner-sync.test.ts
new file mode 100644
index 00000000..bcec9b1b
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/get-client-owner-sync.test.ts
@@ -0,0 +1,113 @@
+/**
+ * `getClient` must answer for the window MCP means to drive right now, not
+ * for whichever window the live connection last reached.
+ *
+ * A focus change re-aims connections only after they settle
+ * (`ACTIVE_WINDOW_SETTLE_MS`, coalesced on purpose), but `getClient` checked
+ * only `state.connected && state.client` — both still true for the OLD
+ * owner's client during that settle window. A caller asking on the new
+ * window's behalf in that gap silently got the old window's client instead of
+ * an error, and every tool call it drove (console reads, DOM queries, network
+ * inspection) reported on the wrong project.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const noop = () => {}
+  const makeClient = () => ({
+    Page: { enable: async () => {} },
+    Runtime: { enable: async () => {}, on: noop },
+    DOM: { enable: async () => {} },
+    Network: { enable: async () => {}, on: noop },
+    Console: { enable: async () => {}, on: noop },
+    on: noop,
+    close: async () => {},
+  })
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      return makeClient()
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const workbenchUrl = (path: string) =>
+  `file:///app/dist/entries/workbench/index.html?path=${encodeURIComponent(path)}&name=p`
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.connectedTo = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('getClient synced against the active window', () => {
+  it('throws immediately when the active window changes, before the repoint settles', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    const b = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.registerMcpWindow(b, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+    let active: object = a
+    tm.setActiveMcpWindowResolver(() => active)
+    cdp.listed = [
+      { type: 'page', url: workbenchUrl('/proj/a') },
+      { type: 'page', url: workbenchUrl('/proj/b') },
+    ]
+
+    await tm.connectTarget('workbench')
+    expect(
+      () => tm.getClient('workbench'),
+      "the freshly established connection is on the window that is active — getClient must not refuse it",
+    ).not.toThrow()
+
+    active = b
+    tm.noteActiveMcpWindowChanged()
+
+    expect(
+      () => tm.getClient('workbench'),
+      "A's client must not be handed to a caller asking on B's behalf just because the settle delay has not landed the repoint yet",
+    ).toThrow()
+  })
+
+  it('keeps returning the client while the resolver still names the window the connection reached', async () => {
+    const tm = await loadTargetManager()
+    const a = {}
+    tm.registerMcpWindow(a, {
+      nativeHost: true, activeBridgeId: null, nativeOverviewProvider: null,
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    tm.setActiveMcpWindowResolver(() => a)
+    cdp.listed = [{ type: 'page', url: workbenchUrl('/proj/a') }]
+
+    await tm.connectTarget('workbench')
+    tm.noteActiveMcpWindowChanged()
+    await vi.advanceTimersByTimeAsync(200)
+
+    expect(
+      () => tm.getClient('workbench'),
+      'a resolver that keeps naming the window the connection already reached must never make getClient refuse it',
+    ).not.toThrow()
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/index.ts b/packages/devtools/src/main/services/mcp/index.ts
index a94a2f5a..26205270 100644
--- a/packages/devtools/src/main/services/mcp/index.ts
+++ b/packages/devtools/src/main/services/mcp/index.ts
@@ -13,12 +13,17 @@
  */
 
 export { startMcpServer } from './server.js'
+export type { McpProjectHost, McpProjectTarget } from './tools/project-tools.js'
 export { getMcpStatus, type McpRuntimeStatus } from './status.js'
-// Native-host: let app.ts point the `simulator` CDP target at the active
-// render-host guest as the visible page changes.
+// Every project window owns its own native-host state and its own renderer, so
+// each registers its facts and MCP resolves the active window on every use.
 export {
-  setNativeHost,
-  setActiveBridgeId,
-  setNativeOverviewProvider,
+  registerMcpWindow,
+  setActiveMcpWindowResolver,
+  noteActiveBridgeId,
+  noteActiveMcpWindowChanged,
+  activeMcpWindow,
   getNativeOverviewProvider,
+  type McpWindowFacts,
 } from './target-manager.js'
+export { createOpenForMcp, createTargetForMcp, type McpOpenedProject } from './opened-project.js'
diff --git a/packages/devtools/src/main/services/mcp/opened-project.close.test.ts b/packages/devtools/src/main/services/mcp/opened-project.close.test.ts
new file mode 100644
index 00000000..741f4a10
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/opened-project.close.test.ts
@@ -0,0 +1,71 @@
+/**
+ * The project window an MCP tool call is aimed at.
+ *
+ * A call resolves its target once, up front, and every surface it uses — the
+ * workspace, the status store, the window closer — comes from that one
+ * snapshot. The snapshot therefore has to capture the window, not re-read
+ * "whichever window is active" when it is finally used.
+ */
+import { describe, expect, it } from 'vitest'
+import { createTargetForMcp, type McpTargetContext } from './opened-project.js'
+
+/** A window context as the target factory reads it: three surfaces, identity-compared. */
+function makeContext(id: string): McpTargetContext {
+  return {
+    workspace: { id } as unknown as McpTargetContext['workspace'],
+    sessionStatus: { id } as unknown as McpTargetContext['sessionStatus'],
+    compileLogBuffer: { id } as unknown as McpTargetContext['compileLogBuffer'],
+  }
+}
+
+describe('the project window an MCP call is pinned to', () => {
+  it('stays on the window that was active when the target was taken', () => {
+    const closed: string[] = []
+    const a = { window: 'winA', context: makeContext('a') }
+    const b = { window: 'winB', context: makeContext('b') }
+    let active = a.context
+
+    const currentProject = createTargetForMcp({
+      list: () => [a, b],
+      activeContext: () => active,
+      close: (window) => { closed.push(window) },
+    })
+
+    const target = currentProject()
+    // The user clicks project B's window before the pinned close runs.
+    active = b.context
+    target.closeWindow()
+
+    expect(
+      closed,
+      'a target taken while A was active must close A even once B has focus',
+    ).toEqual(['winA'])
+  })
+
+  it('reads every surface off the same window context', () => {
+    const a = { window: 'winA', context: makeContext('a') }
+    const target = createTargetForMcp({
+      list: () => [a],
+      activeContext: () => a.context,
+      close: () => {},
+    })()
+
+    expect(target.workspace).toBe(a.context.workspace)
+    expect(target.sessionStatus).toBe(a.context.sessionStatus)
+    expect(target.compileLogs).toBe(a.context.compileLogBuffer)
+  })
+
+  it('closes nothing when the active context owns no project window', () => {
+    const listWindow = makeContext('list-window')
+    const target = createTargetForMcp({
+      list: () => [],
+      activeContext: () => listWindow,
+      close: () => { throw new Error('nothing to close') },
+    })()
+
+    expect(
+      () => target.closeWindow(),
+      'with no project window open there is nothing to take down, and the tool must not fail or close an unrelated window',
+    ).not.toThrow()
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/opened-project.test.ts b/packages/devtools/src/main/services/mcp/opened-project.test.ts
new file mode 100644
index 00000000..83242eb5
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/opened-project.test.ts
@@ -0,0 +1,115 @@
+/**
+ * Resolving the window an MCP-driven `project_open` landed in.
+ *
+ * Each project window keeps its own session-status store, so an open has to
+ * hand back the store of the window it actually opened together with the
+ * generation guard for awaiting THAT window's compile:
+ *  - a window built by this open starts empty, so its initial 'idle' must not
+ *    be mistaken for a finished compile;
+ *  - a window that was already showing the project is only focused, which
+ *    triggers no compile, so its current settled state is the answer.
+ */
+import { describe, expect, it } from 'vitest'
+import { createSessionStatusStore } from '../workspace/session-status-store.js'
+import { createOpenForMcp } from './opened-project.js'
+
+interface FakeWindow {
+  window: { id: string }
+  context: {
+    workspace: { getProjectPath: () => string; hasActiveSession: () => boolean }
+    sessionStatus: ReturnType<typeof createSessionStatusStore>
+  }
+}
+
+function makeWindow(projectPath: string): FakeWindow {
+  return {
+    window: { id: projectPath },
+    context: {
+      workspace: { getProjectPath: () => projectPath, hasActiveSession: () => true },
+      sessionStatus: createSessionStatusStore(),
+    },
+  }
+}
+
+/** A window manager that builds a window on first open and focuses it after. */
+function makeManager(initial: FakeWindow[] = []) {
+  const windows = [...initial]
+  const open = createOpenForMcp<FakeWindow['window']>({
+    open: async (project) => {
+      const existing = windows.find((w) => w.window.id === project.path)
+      if (existing) return existing.window
+      const created = makeWindow(project.path)
+      windows.push(created)
+      return created.window
+    },
+    list: () => windows,
+  })
+  return { open, windows }
+}
+
+describe('createOpenForMcp', () => {
+  it('hands back the store of the window it opened, not another project window', async () => {
+    const other = makeWindow('/proj/other')
+    other.context.sessionStatus.record({ status: 'ready', message: 'another project' })
+    const { open, windows } = makeManager([other])
+
+    const opened = await open({ name: 'demo', path: '/proj/demo' })
+
+    const demo = windows.find((w) => w.window.id === '/proj/demo')!
+    expect(
+      opened.sessionStatus,
+      'project_open must await the compile of the window it opened',
+    ).toBe(demo.context.sessionStatus)
+    expect(
+      opened.workspace.getProjectPath(),
+      'the reported status must describe the project that was opened',
+    ).toBe('/proj/demo')
+  })
+
+  it('guards a freshly built window so its empty store never counts as settled', async () => {
+    const { open, windows } = makeManager()
+
+    const opened = await open({ name: 'demo', path: '/proj/demo' })
+    const demo = windows[0]!
+
+    let settled = false
+    void opened.sessionStatus
+      .waitForSettled({ afterGeneration: opened.afterGeneration, timeoutMs: 1000 })
+      .then(() => { settled = true })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(
+      settled,
+      'a brand-new window has recorded nothing yet, so project_open must keep waiting',
+    ).toBe(false)
+
+    demo.context.sessionStatus.record({ status: 'ready', message: '编译完成' })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(settled, 'the first state this window records is the open result').toBe(true)
+  })
+
+  it('accepts the settled state of a project that was already open', async () => {
+    const demo = makeWindow('/proj/demo')
+    demo.context.sessionStatus.record({ status: 'ready', message: '编译完成' })
+    const { open } = makeManager([demo])
+
+    const opened = await open({ name: 'demo', path: '/proj/demo' })
+    const settled = await opened.sessionStatus.waitForSettled({
+      afterGeneration: opened.afterGeneration,
+      timeoutMs: 50,
+    })
+
+    expect(
+      settled.message,
+      'focusing an already-open project starts no compile, so its current state is the answer',
+    ).toBe('编译完成')
+  })
+
+  it('fails loudly when the window it opened is already gone', async () => {
+    const open = createOpenForMcp<{ id: string }>({
+      open: async () => ({ id: 'vanished' }),
+      list: () => [],
+    })
+
+    await expect(open({ name: 'demo', path: '/proj/demo' })).rejects.toThrow(/\/proj\/demo/)
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/opened-project.ts b/packages/devtools/src/main/services/mcp/opened-project.ts
new file mode 100644
index 00000000..862c0f0b
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/opened-project.ts
@@ -0,0 +1,120 @@
+/**
+ * Resolving the project window an MCP call is aimed at.
+ *
+ * A project lives in its own window and every window keeps its own
+ * session-status store, so `project_open` can only report the truth if it
+ * awaits the store of the window it just opened. Reading the app-active
+ * window's store instead times out on a first open (that window never compiles
+ * this project) and can return another project's rebuild as this one's result.
+ * The other tools have no window of their own to point at, so they take the
+ * active one — once per call, as a whole.
+ */
+
+import type { SessionStatusStore } from '../workspace/session-status-store.js'
+import type { McpProjectTarget } from './tools/project-tools.js'
+
+/** The status surface `project_open` reports from: one window's own state. */
+export interface McpProjectStatusSource {
+  workspace: {
+    getProjectPath(): string
+    hasActiveSession(): boolean
+  }
+  sessionStatus: SessionStatusStore
+}
+
+export interface McpOpenedProject extends McpProjectStatusSource {
+  /**
+   * Generation guard for awaiting this open's compile. A window built by the
+   * open reports 0, so its empty store's initial 'idle' is not mistaken for a
+   * finished compile. A window that was already showing the project reports
+   * `undefined`: focusing it triggers no compile, so its current settled state
+   * IS the answer, and waiting for a newer one would hang.
+   */
+  afterGeneration?: number
+}
+
+interface OpenedWindow<W> {
+  window: W
+  context: McpProjectStatusSource
+}
+
+export interface OpenForMcpDeps<W> {
+  /** Open the project in its own window (or focus the one already showing it). */
+  open: (project: { name?: string; path: string }) => Promise<W>
+  /** Every live project window, so the opened one can be matched by identity. */
+  list: () => OpenedWindow<W>[]
+}
+
+/**
+ * Build the `requestOpenInUi` the MCP project tools drive: open the project
+ * and hand back the window it landed in, together with the generation guard
+ * for awaiting that window's compile.
+ */
+export function createOpenForMcp<W>(
+  deps: OpenForMcpDeps<W>,
+): (project: { name: string; path: string }) => Promise<McpOpenedProject> {
+  return async (project) => {
+    // Sampled BEFORE the open: a window that already exists carries a previous
+    // compile's history, and only a state recorded after this point can be
+    // this open's result. Keyed by context identity, so a window rebuilt
+    // during the open is correctly seen as new.
+    const before = new Map(
+      deps.list().map((w) => [w.context, w.context.sessionStatus.get().generation] as const),
+    )
+    const window = await deps.open(project)
+    const opened = deps.list().find((w) => w.window === window)
+    if (!opened) throw new Error(`the window opened for ${project.path} is already gone`)
+
+    return {
+      workspace: opened.context.workspace,
+      sessionStatus: opened.context.sessionStatus,
+      afterGeneration: before.has(opened.context) ? undefined : 0,
+    }
+  }
+}
+
+/**
+ * The window-context fields an MCP project call reads. Structural, so this
+ * module stays independent of the workbench context that satisfies it.
+ */
+export interface McpTargetContext {
+  workspace: McpProjectTarget['workspace']
+  sessionStatus: McpProjectTarget['sessionStatus']
+  compileLogBuffer: McpProjectTarget['compileLogs']
+}
+
+export interface TargetForMcpDeps<W, C extends McpTargetContext> {
+  /** Every live project window, so the active one can be matched by context. */
+  list: () => { window: W; context: C }[]
+  /** The context of the project window the user is working in. */
+  activeContext: () => C
+  /** Take one window down the way a user-driven close does. */
+  close: (window: W) => void
+}
+
+/**
+ * Build the `currentProject` the MCP project tools drive: resolve the project
+ * window the user is working in NOW and hand back every surface a tool call
+ * needs, all bound to that one window.
+ *
+ * Tool calls yield — `closeProject()` awaits a teardown, `waitForSettled()`
+ * awaits a compile — and the user can focus another project meanwhile.
+ * Re-resolving afterwards reports one project's compile as another's, or
+ * closes the window they just moved to while the window whose session was torn
+ * down stays on screen, empty. The active context can also be the project
+ * list, which owns no project window: closing then does nothing.
+ */
+export function createTargetForMcp<W, C extends McpTargetContext>(
+  deps: TargetForMcpDeps<W, C>,
+): () => McpProjectTarget {
+  return () => {
+    const context = deps.activeContext()
+    const owner = deps.list().find((w) => w.context === context)
+    return {
+      workspace: context.workspace,
+      sessionStatus: context.sessionStatus,
+      compileLogs: context.compileLogBuffer,
+      closeWindow: () => { if (owner) deps.close(owner.window) },
+    }
+  }
+}
diff --git a/packages/devtools/src/main/services/mcp/server.test.ts b/packages/devtools/src/main/services/mcp/server.test.ts
index 0f076fa6..d58d477f 100644
--- a/packages/devtools/src/main/services/mcp/server.test.ts
+++ b/packages/devtools/src/main/services/mcp/server.test.ts
@@ -182,7 +182,7 @@ let port = 0
 const openReqs: http.ClientRequest[] = []
 
 function createProjectHost(): McpProjectHost {
-  return {
+  const target = {
     workspace: {
       validateProjectDir: vi.fn(async () => null),
       hasProject: vi.fn(async () => false),
@@ -194,8 +194,11 @@ function createProjectHost(): McpProjectHost {
     },
     sessionStatus: createSessionStatusStore(),
     compileLogs: createCompileLogBuffer(),
+    closeWindow: vi.fn(),
+  }
+  return {
+    currentProject: () => target,
     requestOpenInUi: vi.fn(),
-    requestNavigateBack: vi.fn(),
   }
 }
 
diff --git a/packages/devtools/src/main/services/mcp/target-identity-immutable.test.ts b/packages/devtools/src/main/services/mcp/target-identity-immutable.test.ts
new file mode 100644
index 00000000..bdb1f47d
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/target-identity-immutable.test.ts
@@ -0,0 +1,123 @@
+/**
+ * A project window's identity is fixed the moment it opens, not read live off
+ * compile/session state — and the workbench target selector trusts nothing
+ * but an exact match against that identity.
+ *
+ * `getProjectPath()` answered '' until a window's first compile recorded a
+ * path, so a workbench window just opened (before any build ran) named no
+ * project at all: nothing could tell its own renderer apart from another
+ * project's, and `selectWorkbenchTarget` papered over the gap by falling back
+ * to "the first workbench page" or the project list — landing MCP on whichever
+ * window happened to come first, not the one actually open.
+ *
+ * The project path a window opened with never changes for the life of that
+ * window, so it belongs on `TargetIdentityFacts`/`McpWindowFacts` as a plain
+ * value fixed at registration (`projectPath`), not a function that reads
+ * session state that may not exist yet. And once matching is exact-or-nothing,
+ * "no match" has to mean exactly that — never another window's page, never the
+ * project list standing in for a project that IS open.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { connectionOwner, type TargetIdentityFacts } from './connection-owner.js'
+
+const cdp = vi.hoisted(() => ({
+  listed: [] as { type: string; url: string }[],
+  connectedTo: [] as string[],
+}))
+
+vi.mock('chrome-remote-interface', () => {
+  const noop = () => {}
+  const makeClient = () => ({
+    Page: { enable: async () => {} },
+    Runtime: { enable: async () => {}, on: noop },
+    DOM: { enable: async () => {} },
+    Network: { enable: async () => {}, on: noop },
+    Console: { enable: async () => {}, on: noop },
+    on: noop,
+    close: async () => {},
+  })
+  const CDP = Object.assign(
+    vi.fn(async ({ target }: { target: { url: string } }) => {
+      cdp.connectedTo.push(target.url)
+      return makeClient()
+    }),
+    { List: vi.fn(async () => cdp.listed) },
+  )
+  return { default: CDP }
+})
+
+async function loadTargetManager() {
+  vi.resetModules()
+  return await import('./target-manager.js')
+}
+
+const LIST_URL = 'file:///app/dist/entries/main/index.html'
+const workbenchUrl = (path: string) =>
+  `file:///app/dist/entries/workbench/index.html?path=${encodeURIComponent(path)}&name=p`
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  cdp.listed = []
+  cdp.connectedTo = []
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe("a window's project path fixed at registration", () => {
+  it('is found by an exact target match even though its compile session has not started', () => {
+    const b = {}
+    const windows = new Map<object, TargetIdentityFacts>([
+      [b, { activeBridgeId: null, projectPath: '/proj/b', getAppId: () => 'app-b' }],
+    ])
+
+    const binding = connectionOwner('workbench', workbenchUrl('/proj/b'), b, windows)
+
+    expect(
+      binding,
+      "a window carries the project path it opened with from registration on — nothing about compiling should be required before its own renderer target can be attributed to it",
+    ).toEqual({ owner: b, onTarget: true })
+  })
+
+  it("lets a just-opened workbench window connect to its own renderer before any build has run", async () => {
+    const tm = await loadTargetManager()
+    const b = {}
+    tm.registerMcpWindow(b, {
+      nativeHost: true,
+      activeBridgeId: null,
+      nativeOverviewProvider: null,
+      projectPath: '/proj/b',
+      getAppId: () => 'app-b',
+    })
+    tm.setActiveMcpWindowResolver(() => b)
+    cdp.listed = [
+      { type: 'page', url: LIST_URL },
+      { type: 'page', url: workbenchUrl('/proj/b') },
+    ]
+
+    await tm.connectTarget('workbench')
+
+    expect(
+      cdp.connectedTo,
+      "the window's own path is known from the moment it registers, so the connection must land on it directly instead of degrading to the project list or another window's page",
+    ).toEqual([workbenchUrl('/proj/b')])
+  })
+})
+
+describe('selectWorkbenchTarget for the active project window', () => {
+  it("returns no target rather than another window's page when nothing matches the active path exactly", async () => {
+    const tm = await loadTargetManager()
+    const candidates = [
+      { type: 'page', url: LIST_URL },
+      { type: 'page', url: workbenchUrl('/proj/other') },
+    ]
+
+    const result = tm.selectWorkbenchTarget(candidates, { projectPath: '/proj/mine' })
+
+    expect(
+      result,
+      "a workbench page for a different project, or the project list, must never stand in for a project that IS open but not yet reachable",
+    ).toBeUndefined()
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/target-manager.select.test.ts b/packages/devtools/src/main/services/mcp/target-manager.select.test.ts
index e27d4a84..19499578 100644
--- a/packages/devtools/src/main/services/mcp/target-manager.select.test.ts
+++ b/packages/devtools/src/main/services/mcp/target-manager.select.test.ts
@@ -1,15 +1,12 @@
 import { describe, it, expect } from 'vitest'
 
-// Pins the pure helpers `selectSimulatorTarget` / `setNativeHost` / `setActiveBridgeId`
-// exported by target-manager.ts.
+// Pins the pure helper `selectSimulatorTarget` exported by target-manager.ts.
+// 每个窗口自己的 native-host 状态与 workbench target 选择见
+// `window-scoped-state.test.ts`。
 //
 // `target-manager.ts` 在模块顶层 import 了 `chrome-remote-interface`(CDP)，
-// vitest 下加载它不会真正建立连接，所以可以直接静态 import 这些纯函数/setter。
-import {
-  selectSimulatorTarget,
-  setNativeHost,
-  setActiveBridgeId,
-} from './target-manager.js'
+// vitest 下加载它不会真正建立连接，所以可以直接静态 import 这些纯函数。
+import { selectSimulatorTarget } from './target-manager.js'
 
 type Target = { url?: string; type?: string }
 
@@ -133,14 +130,3 @@ describe('selectSimulatorTarget — 双形态 simulator target 解析', () => {
     expect(selectSimulatorTarget([], { nativeHost: true, activeBridgeId: 'b2' })).toBeUndefined()
   })
 })
-
-describe('target-manager setters 存在性', () => {
-  // 仅断言 setter 被导出且为函数；其连接副作用依赖 CDP，不在单测范围内。
-  it('setNativeHost 被导出且为函数', () => {
-    expect(typeof setNativeHost).toBe('function')
-  })
-
-  it('setActiveBridgeId 被导出且为函数', () => {
-    expect(typeof setActiveBridgeId).toBe('function')
-  })
-})
diff --git a/packages/devtools/src/main/services/mcp/target-manager.ts b/packages/devtools/src/main/services/mcp/target-manager.ts
index 6eb9e0b5..39e7b9d1 100644
--- a/packages/devtools/src/main/services/mcp/target-manager.ts
+++ b/packages/devtools/src/main/services/mcp/target-manager.ts
@@ -12,17 +12,19 @@
 
 import CDP from 'chrome-remote-interface'
 import { DEFAULT_CDP_PORT } from '../../../shared/constants.js'
-import { DMB_PAGEFRAME_DOC_NAME } from '../../../shared/dmb-resource-url.js'
-
-const SIMULATOR_URL_PATTERN = 'localhost:7788'
-// Native-host: the real mini-app page runs in a nested render-host <webview>
-// guest whose CDP target URL carries the render frame + the page's bridgeId.
-// Import the shared reserved doc name rather than hand-writing a second
-// literal — that duplication is exactly what let this pattern drift out of
-// sync with the actual document URL shape (dmb-resource-url.ts).
-const RENDER_GUEST_PATTERN = DMB_PAGEFRAME_DOC_NAME
+import { connectionOwner, type TargetIdentityFacts } from './connection-owner.js'
+import { selectSimulatorTarget, selectWorkbenchTarget } from './target-selection.js'
+
+// Re-exported so existing `./target-manager.js` imports keep working — the
+// candidate-ranking rules live in target-selection.ts, but callers reach them
+// through the connection manager that uses them.
+export { selectSimulatorTarget, selectWorkbenchTarget } from './target-selection.js'
+
 const MAX_BUFFER = 500
 const RECONNECT_INTERVAL_MS = 3000
+// How long a burst of focus changes is allowed to settle before the live
+// connections are re-aimed.
+const ACTIVE_WINDOW_SETTLE_MS = 150
 
 export type TargetKind = 'simulator' | 'workbench'
 
@@ -54,90 +56,152 @@ export type NativeOverviewProvider = () => Promise<NativeOverview>
 interface TargetState {
   client: CDP.Client | null
   connected: boolean
+  /**
+   * The window this live connection ACTUALLY reached — not the one it was
+   * aimed at, and null when the target names no project window (the project
+   * list). Read on every `getClient`, so a connection left behind by a window
+   * switch is refused instead of answering for the wrong project.
+   */
+  owner: object | null
   timer: ReturnType<typeof setTimeout> | null
   consoleLogs: ConsoleLogEntry[]
   networkRequests: NetworkRequestEntry[]
+  /**
+   * The owner these buffers were most recently cleared and populated for.
+   * Distinct from `owner`, which goes null the instant a target is lost: a
+   * reconnect that lands back on the same window (a transient CDP drop) must
+   * find its buffers intact, so what decides whether to clear is this record
+   * of the last owner they were published for, not the connection's current
+   * live/dead state.
+   */
+  bufferOwner: object | null
 }
 
 let cdpPort = DEFAULT_CDP_PORT
 
-// Native-host mode: the simulator target is the active render-host <webview>
-// guest (pageFrame.html?...bridgeId=<id>) rather than the localhost:7788 shell.
-let nativeHostMode = false
-// The visible page's bridgeId, pushed from the bridge-router render events.
-// `selectSimulatorTarget` prefers the guest matching this id so MCP follows
-// the active page across navigation/tab switches.
-let activeBridgeId: string | null = null
-let nativeOverviewProvider: NativeOverviewProvider | null = null
-
-const targets: Record<TargetKind, TargetState> = {
-  simulator: { client: null, connected: false, timer: null, consoleLogs: [], networkRequests: [] },
-  workbench:  { client: null, connected: false, timer: null, consoleLogs: [], networkRequests: [] },
+/**
+ * What MCP needs to know about ONE project window.
+ *
+ * Every project runs in its own window, so native-host mode, the visible
+ * render guest, the cross-process overview provider and the project identity
+ * are facts about a single window — never about the process. A window
+ * publishes its own record here and drops only that record when it closes.
+ */
+export interface McpWindowFacts extends TargetIdentityFacts {
+  /** The window runs the native-host runtime (mini-app pages live in nested render guests). */
+  nativeHost: boolean
+  /**
+   * The visible page's bridgeId, pushed from this window's bridge-router
+   * render events. `selectSimulatorTarget` prefers the guest matching it so
+   * MCP follows the active page across navigation/tab switches.
+   */
+  activeBridgeId: string | null
+  nativeOverviewProvider: NativeOverviewProvider | null
+  /** Absolute path of the project this window opened with; never changes. */
+  projectPath: string
+  /** appId of the project open in this window; null before its session exists. */
+  getAppId: () => string | null
 }
 
-export function setCdpPort(port: number): void {
-  cdpPort = port
+export interface McpWindowRegistration {
+  facts: McpWindowFacts
+  dispose: () => void
 }
 
-export function setNativeHost(enabled: boolean): void {
-  nativeHostMode = enabled
-}
+const windowFacts = new Map<object, McpWindowFacts>()
+let resolveActiveOwner: () => object | null = () => null
 
 /**
- * Update the active-page bridgeId so the `simulator` target follows the
- * currently visible render guest. No-op when unchanged. When native-host is
- * on and the simulator target is already connected, fire-and-forget a
- * reconnect so MCP re-points at the new active page.
+ * Point MCP at the window the user is working in. Assembled once by the app;
+ * `owner` is the opaque token a window registered itself under. Resolving to
+ * null means no project window is open, which is the answer MCP reports before
+ * the first project is opened.
  */
-export function setActiveBridgeId(id: string | null): void {
-  if (id === activeBridgeId) return
-  activeBridgeId = id
-  if (nativeHostMode && targets.simulator.connected) {
-    void connectTarget('simulator')
+export function setActiveMcpWindowResolver(resolve: () => object | null): void {
+  resolveActiveOwner = resolve
+}
+
+export function registerMcpWindow(owner: object, facts: McpWindowFacts): McpWindowRegistration {
+  windowFacts.set(owner, facts)
+  return {
+    facts,
+    dispose: () => {
+      // Only this window's record: other project windows may still be open and
+      // their native-host state has to survive this teardown.
+      if (windowFacts.get(owner) === facts) windowFacts.delete(owner)
+    },
   }
 }
 
-export function setNativeOverviewProvider(provider: NativeOverviewProvider | null): void {
-  nativeOverviewProvider = provider
+/** The facts of the project window MCP currently drives, or null when none is open. */
+export function activeMcpWindow(): McpWindowFacts | null {
+  const owner = resolveActiveOwner()
+  return (owner !== null && windowFacts.get(owner)) || null
 }
 
-export function getNativeOverviewProvider(): NativeOverviewProvider | null {
-  return nativeOverviewProvider
+/**
+ * Record the render guest now visible in `owner`'s window. Re-points the live
+ * simulator connection only when that window is the one MCP drives — a
+ * navigation in a background project window must not steal the target.
+ */
+export function noteActiveBridgeId(owner: object, id: string | null): void {
+  const facts = windowFacts.get(owner)
+  if (!facts || facts.activeBridgeId === id) return
+  facts.activeBridgeId = id
+  if (facts.nativeHost && resolveActiveOwner() === owner && targets.simulator.connected) {
+    void connectTarget('simulator')
+  }
 }
 
 /**
- * Resolve which CDP target the `simulator` MCP tools should drive.
- *
- * Default (non-native) path: the localhost:7788 simulator shell — identical
- * to the original behavior; `activeBridgeId` is ignored.
+ * The active project window changed. A connection that is already established
+ * was aimed at whichever window was active when it was made, and nothing
+ * re-read that afterwards — so without this the MCP tools keep reporting and
+ * driving the project the user has left. Only connections bound to a different
+ * window are re-aimed; the rest are left alone.
  *
- * Native-host path: the active render-host <webview> guest
- * (pageFrame.html?...bridgeId=<id>), preferring the guest matching
- * `activeBridgeId`, then any pageFrame guest, then degrading to the shell.
+ * Coalesced on purpose: clicking across windows produces a burst of these, and
+ * re-resolving once the burst settles means focus that returns to the window a
+ * connection already holds costs nothing.
  */
-export function selectSimulatorTarget<T extends { url?: string; type?: string }>(
-  targets: T[],
-  opts: { nativeHost: boolean; activeBridgeId: string | null },
-): T | undefined {
-  if (!opts.nativeHost) {
-    return targets.find((t) => t.url?.includes(SIMULATOR_URL_PATTERN))
-  }
+export function noteActiveMcpWindowChanged(): void {
+  if (repointTimer) return
+  repointTimer = setTimeout(() => {
+    repointTimer = null
+    const owner = resolveActiveOwner()
+    // A window whose facts are already gone is on its way out: its pages are
+    // about to be destroyed, so connecting into them would only produce a
+    // client that immediately disconnects. The reconnect timer picks up
+    // whichever window replaces it.
+    if (owner !== null && !windowFacts.has(owner)) return
+    for (const kind of Object.keys(targets) as TargetKind[]) {
+      if (!targets[kind].connected || targets[kind].owner === owner) continue
+      void connectTarget(kind)
+    }
+  }, ACTIVE_WINDOW_SETTLE_MS)
+}
 
-  // 1) Active-bridge guest takes priority over list order.
-  if (opts.activeBridgeId !== null) {
-    const bridgeMatch = `bridgeId=${opts.activeBridgeId}`
-    const active = targets.find(
-      (t) => t.url?.includes(RENDER_GUEST_PATTERN) && t.url.includes(bridgeMatch),
-    )
-    if (active) return active
-  }
+// The two CDP connections are process-wide on purpose: MCP exposes one
+// `simulator` and one `workbench` target with no window argument, so both
+// always mean "the project the user is working in". Which window that is comes
+// from `activeMcpWindow()` on every (re)connect, so the pair follows the
+// active window rather than belonging to any one of them.
+const targets: Record<TargetKind, TargetState> = {
+  simulator: { client: null, connected: false, owner: null, timer: null, consoleLogs: [], networkRequests: [], bufferOwner: null },
+  workbench:  { client: null, connected: false, owner: null, timer: null, consoleLogs: [], networkRequests: [], bufferOwner: null },
+}
 
-  // 2) Any render guest (no active match / no active bridge).
-  const anyGuest = targets.find((t) => t.url?.includes(RENDER_GUEST_PATTERN))
-  if (anyGuest) return anyGuest
+/** Monotonic per target: only the newest connect attempt may publish itself. */
+const connectGeneration: Record<TargetKind, number> = { simulator: 0, workbench: 0 }
+let repointTimer: ReturnType<typeof setTimeout> | null = null
 
-  // 3) Degrade to the localhost:7788 shell when no render guest exists yet.
-  return targets.find((t) => t.url?.includes(SIMULATOR_URL_PATTERN))
+export function setCdpPort(port: number): void {
+  cdpPort = port
+}
+
+/** The cross-process overview reader of the window MCP drives, if it has one. */
+export function getNativeOverviewProvider(): NativeOverviewProvider | null {
+  return activeMcpWindow()?.nativeOverviewProvider ?? null
 }
 
 export function getTargetState(kind: TargetKind): TargetState {
@@ -154,29 +218,149 @@ async function listCdpTargets() {
 
 export { listCdpTargets as listTargets }
 
+/**
+ * `selectWorkbenchTarget` already matches on the active window's exact
+ * `projectPath`, so no candidate ranking is blind to ownership there — the
+ * match is exact or nothing, with nothing left for a pre-filter to change.
+ */
+function findWorkbenchTarget(allTargets: Awaited<ReturnType<typeof CDP.List>>) {
+  const active = activeMcpWindow()
+  return selectWorkbenchTarget(allTargets, { projectPath: active ? active.projectPath : null })
+}
+
+/**
+ * `selectSimulatorTarget` ranks candidates by a fixed priority order with no
+ * idea which window each one belongs to, and its "any guest" tier in
+ * particular has no way to tell a stray guest left over from another window
+ * apart from a legitimate one.
+ *
+ * Once the active window has an `activeBridgeId` of its own, it is known to
+ * be genuinely on a native page and merely waiting for that specific guest
+ * target to show up in the CDP list — connecting to whatever guest IS present
+ * and letting the post-connect ownership check below reject a wrong one is a
+ * reasonable, existing way to close that timing gap, so ranking stays
+ * unfiltered in that case.
+ *
+ * Before any page is known for this window (`activeBridgeId === null`, which
+ * is also always true for non-native windows), though, "any guest present"
+ * carries no signal it belongs to THIS window at all — so ranking is
+ * restricted to targets `connectionOwner` attributes to the active window,
+ * falling back to the raw list only when none of them qualify (the same
+ * retry-and-reject cadence as the unfiltered path, for a candidate list that
+ * belongs to no window MCP can currently claim).
+ */
+function findSimulatorTarget(allTargets: Awaited<ReturnType<typeof CDP.List>>) {
+  const active = activeMcpWindow()
+  const opts = { nativeHost: active?.nativeHost ?? false, activeBridgeId: active?.activeBridgeId ?? null }
+  if (opts.activeBridgeId !== null) return selectSimulatorTarget(allTargets, opts)
+
+  const intended = resolveActiveOwner()
+  const owned = allTargets.filter((t) => connectionOwner('simulator', t.url, intended, windowFacts).onTarget)
+  return selectSimulatorTarget(owned, opts) ?? selectSimulatorTarget(allTargets, opts)
+}
+
 function findTarget(allTargets: Awaited<ReturnType<typeof CDP.List>>, kind: TargetKind) {
-  if (kind === 'simulator') {
-    return selectSimulatorTarget(allTargets, { nativeHost: nativeHostMode, activeBridgeId })
+  return kind === 'simulator' ? findSimulatorTarget(allTargets) : findWorkbenchTarget(allTargets)
+}
+
+/**
+ * Console and network events into this target's ring buffers, which is all
+ * these subscriptions do — they hold no view of which window is connected, so
+ * they outlive nothing and need no generation check of their own.
+ */
+function subscribeBuffers(client: CDP.Client, state: TargetState): void {
+  const pending = new Map<string, { url: string; method: string; timestamp: number }>()
+  const pushNetworkRequest = (entry: NetworkRequestEntry) => {
+    state.networkRequests.push(entry)
+    if (state.networkRequests.length > MAX_BUFFER) state.networkRequests = state.networkRequests.slice(-MAX_BUFFER)
+  }
+  const pushConsoleLog = (entry: ConsoleLogEntry) => {
+    state.consoleLogs.push(entry)
+    if (state.consoleLogs.length > MAX_BUFFER) state.consoleLogs = state.consoleLogs.slice(-MAX_BUFFER)
   }
-  // workbench main window: page target whose URL contains index.html (renderer)
-  return allTargets.find(
-    (t) => t.type === 'page' && t.url?.includes('entries/main/index.html') && !t.url?.includes(SIMULATOR_URL_PATTERN)
-  )
+
+  client.Runtime.on('consoleAPICalled', (params: { type: string; args: Array<{ value?: unknown; description?: string }>; timestamp: number }) => {
+    pushConsoleLog({
+      level: params.type,
+      text: params.args.map((a) => String(a.value ?? a.description ?? JSON.stringify(a))).join(' '),
+      timestamp: new Date(params.timestamp).toISOString(),
+    })
+  })
+
+  client.Console.on('messageAdded', (params: { message: { level: string; text: string } }) => {
+    const msg = params.message
+    pushConsoleLog({ level: msg.level, text: msg.text, timestamp: new Date().toISOString() })
+  })
+
+  client.Network.on('requestWillBeSent', (params: { requestId: string; request: { url: string; method: string }; timestamp: number }) => {
+    pending.set(params.requestId, { url: params.request.url, method: params.request.method, timestamp: params.timestamp })
+  })
+  client.Network.on('responseReceived', (params: { requestId: string; response: { status: number; mimeType: string; encodedDataLength: number; timing?: { requestTime: number; receiveHeadersEnd: number } } }) => {
+    const req = pending.get(params.requestId)
+    if (!req) return
+    pending.delete(params.requestId)
+    pushNetworkRequest({
+      url: req.url, method: req.method,
+      status: params.response.status, mimeType: params.response.mimeType,
+      responseSize: params.response.encodedDataLength || 0,
+      timing: params.response.timing
+        ? { requestTime: params.response.timing.requestTime, receiveHeadersEnd: params.response.timing.receiveHeadersEnd }
+        : null,
+    })
+  })
+  client.Network.on('loadingFailed', (params: { requestId: string }) => {
+    const req = pending.get(params.requestId)
+    if (!req) return
+    pending.delete(params.requestId)
+    pushNetworkRequest({ url: req.url, method: req.method, status: 0, mimeType: '', responseSize: 0, timing: null })
+  })
+}
+
+/** Closing a client is never the reason an attempt fails. */
+async function closeQuietly(client: CDP.Client | null): Promise<void> {
+  if (!client) return
+  try { await client.close() } catch {}
+}
+
+/** No usable target right now: publish nothing and keep retrying. */
+function loseTarget(kind: TargetKind): void {
+  const state = targets[kind]
+  state.client = null
+  state.connected = false
+  state.owner = null
+  scheduleReconnect(kind)
+}
+
+/** Publish a connection that survived the race, on the window it reached. */
+function publishConnection(kind: TargetKind, client: CDP.Client, owner: object | null): void {
+  const state = targets[kind]
+  state.client = client
+  state.connected = true
+  state.owner = owner
+  if (state.timer) { clearTimeout(state.timer); state.timer = null }
 }
 
 export async function connectTarget(kind: TargetKind): Promise<void> {
   const state = targets[kind]
+  // Establishing a connection is a long chain of awaits, and the reason to
+  // establish it — which window is active, which page it shows — can change
+  // while that chain runs. An attempt overtaken by a newer one must publish
+  // nothing, close the client it opened, and schedule no work.
+  const generation = (connectGeneration[kind] += 1)
+  const superseded = () => connectGeneration[kind] !== generation
 
   if (state.client) {
-    try { await state.client.close() } catch {}
+    const previous = state.client
     state.client = null
+    await closeQuietly(previous)
+    if (superseded()) return
   }
 
   const allTargets = await listCdpTargets()
   const target = findTarget(allTargets, kind)
+  if (superseded()) return
   if (!target) {
-    state.connected = false
-    scheduleReconnect(kind)
+    loseTarget(kind)
     return
   }
 
@@ -192,77 +376,54 @@ export async function connectTarget(kind: TargetKind): Promise<void> {
       client.Console.enable(),
     ])
 
-    // Network buffer
-    const pending = new Map<string, { url: string; method: string; timestamp: number }>()
-    const pushNetworkRequest = (entry: NetworkRequestEntry) => {
-      state.networkRequests.push(entry)
-      if (state.networkRequests.length > MAX_BUFFER) state.networkRequests = state.networkRequests.slice(-MAX_BUFFER)
+    // Everything below subscribes or publishes, so an attempt that lost the
+    // race stops here and leaves nothing behind but its own closed client.
+    if (superseded()) {
+      await closeQuietly(client)
+      return
     }
 
-    // Console buffer
-    client.Runtime.on('consoleAPICalled', (params: { type: string; args: Array<{ value?: unknown; description?: string }>; timestamp: number }) => {
-      const entry: ConsoleLogEntry = {
-        level: params.type,
-        text: params.args.map((a) => String(a.value ?? a.description ?? JSON.stringify(a))).join(' '),
-        timestamp: new Date(params.timestamp).toISOString(),
-      }
-      state.consoleLogs.push(entry)
-      if (state.consoleLogs.length > MAX_BUFFER) state.consoleLogs = state.consoleLogs.slice(-MAX_BUFFER)
-    })
-
-    client.Console.on('messageAdded', (params: { message: { level: string; text: string } }) => {
-      const msg = params.message
-      state.consoleLogs.push({ level: msg.level, text: msg.text, timestamp: new Date().toISOString() })
-      if (state.consoleLogs.length > MAX_BUFFER) state.consoleLogs = state.consoleLogs.slice(-MAX_BUFFER)
-    })
+    // Which window this target belongs to is resolved here, not when the
+    // attempt started: an attempt that outlived a window switch has to be
+    // judged against the window the user is in now. MCP exposes ONE client per
+    // kind, so a target belonging to another window leaves nothing behind at
+    // all — buffers wired to it would mix that window's console and network
+    // events into the ones the eventual right connection appends to, and
+    // `connected` would hand it out meanwhile. The retry cadence is the only
+    // thing that carries over: the exact target may still be loading.
+    const binding = connectionOwner(kind, target.url, resolveActiveOwner(), windowFacts)
+    if (!binding.onTarget) {
+      await closeQuietly(client)
+      if (superseded()) return
+      loseTarget(kind)
+      return
+    }
 
-    client.Network.on('requestWillBeSent', (params: { requestId: string; request: { url: string; method: string }; timestamp: number }) => {
-      pending.set(params.requestId, { url: params.request.url, method: params.request.method, timestamp: params.timestamp })
-    })
-    client.Network.on('responseReceived', (params: { requestId: string; response: { status: number; mimeType: string; encodedDataLength: number; timing?: { requestTime: number; receiveHeadersEnd: number } } }) => {
-      const req = pending.get(params.requestId)
-      if (!req) return
-      pending.delete(params.requestId)
-      pushNetworkRequest({
-        url: req.url, method: req.method,
-        status: params.response.status, mimeType: params.response.mimeType,
-        responseSize: params.response.encodedDataLength || 0,
-        timing: params.response.timing
-          ? { requestTime: params.response.timing.requestTime, receiveHeadersEnd: params.response.timing.receiveHeadersEnd }
-          : null,
-      })
-    })
-    client.Network.on('loadingFailed', (params: { requestId: string }) => {
-      const req = pending.get(params.requestId)
-      if (!req) return
-      pending.delete(params.requestId)
-      pushNetworkRequest({
-        url: req.url,
-        method: req.method,
-        status: 0,
-        mimeType: '',
-        responseSize: 0,
-        timing: null,
-      })
-    })
+    // Buffers are keyed to the owner they were collected for, not to the
+    // kind slot: a reconnect landing on the SAME owner (a transient CDP drop)
+    // must keep what was already buffered, but re-aiming at a different
+    // window must not let that window inherit the previous owner's entries.
+    if (state.bufferOwner !== binding.owner) {
+      state.consoleLogs = []
+      state.networkRequests = []
+      state.bufferOwner = binding.owner
+    }
+    subscribeBuffers(client, state)
 
     client.on('disconnect', () => {
+      // A superseded client is closed on purpose; only the live connection
+      // going away means MCP has lost its target.
+      if (superseded()) return
       state.connected = false
       state.client = null
       scheduleReconnect(kind)
     })
 
-    state.client = client
-    state.connected = true
-
-    if (state.timer) { clearTimeout(state.timer); state.timer = null }
+    publishConnection(kind, client, binding.owner)
   } catch {
-    if (client) {
-      try { await client.close() } catch {}
-    }
-    state.client = null
-    state.connected = false
-    scheduleReconnect(kind)
+    await closeQuietly(client)
+    if (superseded()) return
+    loseTarget(kind)
   }
 }
 
@@ -277,9 +438,16 @@ function scheduleReconnect(kind: TargetKind): void {
 
 export function getClient(kind: TargetKind) {
   const state = targets[kind]
+  const label = kind === 'simulator' ? '模拟器' : '主窗口'
   if (!state.connected || !state.client) {
-    const label = kind === 'simulator' ? '模拟器' : '主窗口'
     throw new Error(`未连接到${label}。请确保 dimina-devtools 正在以开发模式运行。`)
   }
+  // A focus change re-aims the live connections only once the burst settles,
+  // and during that gap the client still belongs to the window the user left.
+  // Answering from it would report and drive the wrong project, so the caller
+  // waits for the re-aim instead.
+  if (state.owner !== resolveActiveOwner()) {
+    throw new Error(`${label}连接属于已切换的项目窗口，正在重新连接，请稍后重试。`)
+  }
   return state.client
 }
diff --git a/packages/devtools/src/main/services/mcp/target-selection.ts b/packages/devtools/src/main/services/mcp/target-selection.ts
new file mode 100644
index 00000000..3173932d
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/target-selection.ts
@@ -0,0 +1,87 @@
+/**
+ * Pure candidate-ranking rules for the two MCP CDP targets.
+ *
+ * Split out of target-manager.ts: these functions only rank a raw CDP.List
+ * result by URL shape and carry no connection state of their own, so they can
+ * be pinned with direct unit tests independent of the connection lifecycle.
+ */
+
+import { DMB_PAGEFRAME_DOC_NAME } from '../../../shared/dmb-resource-url.js'
+import { targetQuery } from './connection-owner.js'
+
+const SIMULATOR_URL_PATTERN = 'localhost:7788'
+// The two renderer entries MCP can drive: a project's workbench window and the
+// always-present project list.
+const WORKBENCH_ENTRY = 'entries/workbench/index.html'
+const PROJECT_LIST_ENTRY = 'entries/main/index.html'
+// Native-host: the real mini-app page runs in a nested render-host <webview>
+// guest whose CDP target URL carries the render frame + the page's bridgeId.
+// Import the shared reserved doc name rather than hand-writing a second
+// literal — that duplication is exactly what let this pattern drift out of
+// sync with the actual document URL shape (dmb-resource-url.ts).
+const RENDER_GUEST_PATTERN = DMB_PAGEFRAME_DOC_NAME
+
+/**
+ * Resolve which CDP target the `simulator` MCP tools should drive.
+ *
+ * Default (non-native) path: the localhost:7788 simulator shell — identical
+ * to the original behavior; `activeBridgeId` is ignored.
+ *
+ * Native-host path: the active render-host <webview> guest
+ * (pageFrame.html?...bridgeId=<id>), preferring the guest matching
+ * `activeBridgeId`, then any pageFrame guest, then degrading to the shell.
+ */
+export function selectSimulatorTarget<T extends { url?: string; type?: string }>(
+  targets: T[],
+  opts: { nativeHost: boolean; activeBridgeId: string | null },
+): T | undefined {
+  if (!opts.nativeHost) {
+    return targets.find((t) => t.url?.includes(SIMULATOR_URL_PATTERN))
+  }
+
+  // 1) Active-bridge guest takes priority over list order.
+  if (opts.activeBridgeId !== null) {
+    const bridgeMatch = `bridgeId=${opts.activeBridgeId}`
+    const active = targets.find(
+      (t) => t.url?.includes(RENDER_GUEST_PATTERN) && t.url.includes(bridgeMatch),
+    )
+    if (active) return active
+  }
+
+  // 2) Any render guest (no active match / no active bridge).
+  const anyGuest = targets.find((t) => t.url?.includes(RENDER_GUEST_PATTERN))
+  if (anyGuest) return anyGuest
+
+  // 3) Degrade to the localhost:7788 shell when no render guest exists yet.
+  return targets.find((t) => t.url?.includes(SIMULATOR_URL_PATTERN))
+}
+
+/**
+ * Resolve which CDP target the `workbench` MCP tools should drive.
+ *
+ * `projectPath` is the active project window's path, fixed when that window
+ * opened; null when no project window is open, and then the project list is
+ * the only workbench surface.
+ *
+ * A project window names its own renderer from the moment it exists, so the
+ * match is exact or nothing: another project's workbench page, or the project
+ * list standing in for a project that IS open, would leave every workbench
+ * tool answering for the wrong window with nothing to correct it.
+ *
+ * Matching is on the renderer ENTRY, never on "the URL mentions the project
+ * directory" — the service-host window carries the same directory in its own
+ * `pkgRoot` query and would win a substring match.
+ */
+export function selectWorkbenchTarget<T extends { url?: string; type?: string }>(
+  candidates: T[],
+  opts: { projectPath: string | null },
+): T | undefined {
+  const pages = candidates.filter(
+    (t) => t.type === 'page' && !t.url?.includes(SIMULATOR_URL_PATTERN),
+  )
+  if (opts.projectPath === null) return pages.find((t) => t.url?.includes(PROJECT_LIST_ENTRY))
+
+  return pages.find(
+    (t) => t.url?.includes(WORKBENCH_ENTRY) && targetQuery(t.url, 'path') === opts.projectPath,
+  )
+}
diff --git a/packages/devtools/src/main/services/mcp/tools/context-tools.native-overview.test.ts b/packages/devtools/src/main/services/mcp/tools/context-tools.native-overview.test.ts
index d20e97b5..00e87093 100644
--- a/packages/devtools/src/main/services/mcp/tools/context-tools.native-overview.test.ts
+++ b/packages/devtools/src/main/services/mcp/tools/context-tools.native-overview.test.ts
@@ -2,8 +2,9 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { registerContextTools } from './context-tools.js'
 import {
   getTargetState,
-  setNativeHost,
-  setNativeOverviewProvider,
+  registerMcpWindow,
+  setActiveMcpWindowResolver,
+  type McpWindowRegistration,
   type NativeOverview,
 } from '../target-manager.js'
 
@@ -13,8 +14,8 @@ import {
  * Under native-host the mini-app is split across processes; the in-target CDP
  * probe that `simulator_get_overview` runs is blind to page-stack / route /
  * storage / appdata state, so it returns zeros & empties even when pages are
- * open and storage is written. The fix exposes a module-level
- * `setNativeOverviewProvider` whose values the overview must merge in.
+ * open and storage is written. The fix lets each project window publish a
+ * native overview provider whose values the overview must merge in.
  *
  * This test pins the OUTPUT contract only: with native-host on, a connected
  * simulator target whose CDP probe is blind (pageStackDepth:0, route:null,
@@ -67,10 +68,13 @@ const BLIND_PROBE = {
   simulatorDataPresent: false,
 }
 
-// A connected fake CDP client whose Runtime.evaluate returns the blind probe.
+// A connected fake CDP client whose Runtime.evaluate returns the blind probe,
+// recorded on the window MCP is driving — a connection bound to any other
+// window is refused by getClient.
 function injectConnectedBlindSimulator() {
   const state = getTargetState('simulator')
   state.connected = true
+  state.owner = activeWindow
   state.client = {
     Runtime: {
       evaluate: async () => ({ result: { value: JSON.stringify(BLIND_PROBE) } }),
@@ -86,6 +90,7 @@ function resetSimulatorState() {
   const state = getTargetState('simulator')
   state.connected = false
   state.client = null
+  state.owner = null
   state.consoleLogs = []
   state.networkRequests = []
 }
@@ -99,16 +104,27 @@ async function callOverview(handlers: Map<string, ToolHandler>): Promise<Record<
   return JSON.parse(text as string) as Record<string, unknown>
 }
 
+// Stands in for the project window MCP is driving: it owns the native-host
+// state the overview reads.
+const activeWindow = {}
+let registration: McpWindowRegistration
+
 describe('simulator_get_overview — native-host cross-process fields', () => {
   beforeEach(() => {
-    setNativeHost(true)
-    setNativeOverviewProvider(null)
+    registration = registerMcpWindow(activeWindow, {
+      nativeHost: true,
+      activeBridgeId: null,
+      nativeOverviewProvider: null,
+      projectPath: '/proj/demo',
+      getAppId: () => 'app-demo',
+    })
+    setActiveMcpWindowResolver(() => activeWindow)
     injectConnectedBlindSimulator()
   })
 
   afterEach(() => {
-    setNativeHost(false)
-    setNativeOverviewProvider(null)
+    registration.dispose()
+    setActiveMcpWindowResolver(() => null)
     resetSimulatorState()
   })
 
@@ -120,7 +136,7 @@ describe('simulator_get_overview — native-host cross-process fields', () => {
       storageCount: 3,
       appDataKeys: ['list', 'loading'],
     }
-    setNativeOverviewProvider(async () => native)
+    registration.facts.nativeOverviewProvider = async () => native
 
     const { server, handlers } = makeFakeServer()
     registerContextTools(server)
diff --git a/packages/devtools/src/main/services/mcp/tools/context-tools.ts b/packages/devtools/src/main/services/mcp/tools/context-tools.ts
index 0023db0b..0ee1a5b6 100644
--- a/packages/devtools/src/main/services/mcp/tools/context-tools.ts
+++ b/packages/devtools/src/main/services/mcp/tools/context-tools.ts
@@ -16,6 +16,7 @@ import {
   getClient,
   getNativeOverviewProvider,
   getTargetState,
+  type NativeOverviewProvider,
   type TargetKind,
 } from '../target-manager.js'
 
@@ -182,8 +183,21 @@ export function registerContextTools(server: McpServer): void {
       }
 
       let result
+      // Snapshot the provider AND the console/network summaries in the same
+      // tick as `getClient`: the provider reads the active window live off
+      // `resolveActiveOwner()`, and the buffers are process-wide and get
+      // cleared and re-owned the moment a reconnect lands on another window.
+      // Both awaits below (the CDP probe, the native provider) are windows the
+      // user can switch projects during; reading either after them would mix
+      // this window's probe with whichever window is active by then.
+      let nativeOverviewProvider: NativeOverviewProvider | null
+      let consoleSum: ConsoleSummary
+      let networkSum: NetworkSummary
       try {
         const c = getClient('simulator')
+        nativeOverviewProvider = getNativeOverviewProvider()
+        consoleSum = summarizeConsole('simulator')
+        networkSum = summarizeNetwork('simulator')
         result = await c.Runtime.evaluate({ expression: SIMULATOR_PROBE_EXPR, returnByValue: true })
       } catch {
         const payload = buildDisconnectedOverview('simulator', [...hints, 'simulator disconnected before overview could finish'])
@@ -206,7 +220,6 @@ export function registerContextTools(server: McpServer): void {
         }
       }
 
-      const nativeOverviewProvider = getNativeOverviewProvider()
       if (nativeOverviewProvider) {
         try {
           const nativeOverview = await nativeOverviewProvider()
@@ -225,9 +238,6 @@ export function registerContextTools(server: McpServer): void {
       if (probe.pageStackDepth === 0) hints.push('no active miniapp page (empty page stack)')
       if (probe.storageCount > MAX_KEYS) hints.push(`storageKeys truncated to first ${MAX_KEYS} of ${probe.storageCount}`)
 
-      const consoleSum = summarizeConsole('simulator')
-      const networkSum = summarizeNetwork('simulator')
-
       const payload = {
         connected: true,
         url: probe.url,
@@ -265,8 +275,15 @@ export function registerContextTools(server: McpServer): void {
       }
 
       let result
+      // Same snapshot rule as the simulator overview: the buffers belong to
+      // the connection `getClient` just vouched for, so they are read before
+      // the probe's await, not after it.
+      let consoleSum: ConsoleSummary
+      let networkSum: NetworkSummary
       try {
         const c = getClient('workbench')
+        consoleSum = summarizeConsole('workbench')
+        networkSum = summarizeNetwork('workbench')
         result = await c.Runtime.evaluate({ expression: WORKBENCH_PROBE_EXPR, returnByValue: true })
       } catch {
         const payload = buildDisconnectedOverview('workbench', [...hints, 'workbench disconnected before overview could finish'])
@@ -289,9 +306,6 @@ export function registerContextTools(server: McpServer): void {
         }
       }
 
-      const consoleSum = summarizeConsole('workbench')
-      const networkSum = summarizeNetwork('workbench')
-
       const payload = {
         connected: true,
         url: probe.url,
diff --git a/packages/devtools/src/main/services/mcp/tools/project-tools-pinned-target.test.ts b/packages/devtools/src/main/services/mcp/tools/project-tools-pinned-target.test.ts
new file mode 100644
index 00000000..1b4ff610
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/tools/project-tools-pinned-target.test.ts
@@ -0,0 +1,143 @@
+/**
+ * Host contract project-tools is expected to drive after the pinned-target
+ * refactor: each tool call takes one `currentProject()` snapshot at the door
+ * and works against it for its whole lifetime, instead of re-reading live
+ * `workspace` / `sessionStatus` / `compileLogs` getters (or a separately
+ * re-resolved `pinActiveProjectWindow`) that can point at a different project
+ * window by the time an awaited step resolves.
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { createCompileLogBuffer } from '../../workspace/compile-log-buffer.js'
+import { createSessionStatusStore } from '../../workspace/session-status-store.js'
+import { registerProjectTools, type McpProjectHost } from './project-tools.js'
+
+interface ToolResult {
+  content: { type: string; text: string }[]
+  isError?: boolean
+}
+type ToolHandler = (args: Record<string, unknown>) => Promise<ToolResult>
+
+/** The per-call target `currentProject()` is expected to hand back. */
+interface FakeTarget {
+  workspace: {
+    validateProjectDir: (dir: string) => Promise<string | null>
+    hasProject: (dir: string) => Promise<boolean>
+    addProject: (dir: string) => Promise<{ name: string; path: string }>
+    listProjects: () => Promise<{ name: string; path: string }[]>
+    closeProject: () => Promise<void>
+    getProjectPath: () => string
+    hasActiveSession: () => boolean
+  }
+  sessionStatus: ReturnType<typeof createSessionStatusStore>
+  compileLogs: ReturnType<typeof createCompileLogBuffer>
+  closeWindow: ReturnType<typeof vi.fn>
+}
+
+function makeTarget(projectPath: string): FakeTarget {
+  return {
+    workspace: {
+      validateProjectDir: vi.fn(async () => null),
+      hasProject: vi.fn(async () => true),
+      addProject: vi.fn(async (dir: string) => ({ name: dir, path: dir })),
+      listProjects: vi.fn(async () => []),
+      closeProject: vi.fn(async () => {}),
+      getProjectPath: vi.fn(() => projectPath),
+      hasActiveSession: vi.fn(() => true),
+    },
+    sessionStatus: createSessionStatusStore(),
+    compileLogs: createCompileLogBuffer(),
+    closeWindow: vi.fn(),
+  }
+}
+
+/** A host whose `currentProject()` answer can be swapped mid-call, like a user re-focusing a window. */
+function makeHost(initial: FakeTarget) {
+  let current = initial
+  const currentProject = vi.fn(() => current)
+  const host = {
+    currentProject,
+    requestOpenInUi: vi.fn(async () => { throw new Error('not exercised by these tools') }),
+  } as unknown as McpProjectHost
+  return { host, currentProject, setCurrent: (t: FakeTarget) => { current = t } }
+}
+
+function captureTools(host: McpProjectHost) {
+  const handlers = new Map<string, ToolHandler>()
+  const server = {
+    tool(name: string, _desc: string, _schema: unknown, handler: ToolHandler) {
+      handlers.set(name, handler)
+    },
+  } as unknown as Parameters<typeof registerProjectTools>[0]
+  registerProjectTools(server, host)
+  function call(name: string, args: Record<string, unknown> = {}) {
+    const handler = handlers.get(name)
+    if (!handler) throw new Error(`tool not registered: ${name}`)
+    return handler(args)
+  }
+  return { call }
+}
+
+function parse(result: ToolResult): Record<string, unknown> {
+  return JSON.parse(result.content[0]!.text) as Record<string, unknown>
+}
+
+describe('project_wait_ready pins its target for the whole wait', () => {
+  it('reports the project held at call time, not whichever project is current when the wait settles', async () => {
+    const a = makeTarget('/proj/a')
+    const b = makeTarget('/proj/b')
+    b.sessionStatus.record({ status: 'compiling', message: '' })
+    const { host, setCurrent } = makeHost(b)
+    const { call } = captureTools(host)
+
+    const pending = call('project_wait_ready', { timeoutMs: 1000 })
+    await new Promise((r) => setTimeout(r, 0))
+    // The user switches the focused project window while B's compile is still running.
+    setCurrent(a)
+    b.sessionStatus.record({ status: 'ready', message: '编译完成' })
+
+    const result = await pending
+    expect(result.isError).toBeUndefined()
+    expect(
+      parse(result),
+      'the settled state must come from the target this call pinned (B), not the window current when it resolved',
+    ).toMatchObject({ projectPath: '/proj/b' })
+  })
+})
+
+describe('project_close pins its target before awaiting the teardown', () => {
+  it('closes the window pinned at call time, not the one focused when closeProject() resolves', async () => {
+    const a = makeTarget('/proj/a')
+    const b = makeTarget('/proj/b')
+    let resolveClose: () => void = () => {}
+    vi.mocked(b.workspace.closeProject).mockImplementation(
+      () => new Promise<void>((resolve) => { resolveClose = resolve }),
+    )
+    const { host, setCurrent } = makeHost(b)
+    const { call } = captureTools(host)
+
+    const pending = call('project_close')
+    await new Promise((r) => setTimeout(r, 0))
+    setCurrent(a)
+    resolveClose()
+    await pending
+
+    expect(b.closeWindow, 'the window whose session was just torn down must be the one that closes').toHaveBeenCalledTimes(1)
+    expect(a.closeWindow, 'the window the user moved to mid-close must be left alone').not.toHaveBeenCalled()
+  })
+})
+
+describe('project_status reads currentProject() exactly once per call', () => {
+  it('does not re-resolve the target after the initial snapshot', async () => {
+    const a = makeTarget('/proj/a')
+    a.sessionStatus.record({ status: 'ready', message: '编译完成' })
+    const { host, currentProject } = makeHost(a)
+    const { call } = captureTools(host)
+
+    const result = await call('project_status')
+    expect(parse(result)).toMatchObject({ projectPath: '/proj/a' })
+    expect(
+      currentProject,
+      'a call that re-resolves the target on every property access would call this more than once',
+    ).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/tools/project-tools.test.ts b/packages/devtools/src/main/services/mcp/tools/project-tools.test.ts
index 8e7ba6a2..be85ce7c 100644
--- a/packages/devtools/src/main/services/mcp/tools/project-tools.test.ts
+++ b/packages/devtools/src/main/services/mcp/tools/project-tools.test.ts
@@ -3,8 +3,11 @@
  *
  * Contracts pinned here:
  *  - project_open pushes the renderer-driven open (`requestOpenInUi`), never
- *    opens the workspace session from main, and only settles on a state
- *    recorded AFTER its own trigger (stale previous-session 'ready' rejected)
+ *    opens the workspace session from main, and awaits the compile of the
+ *    WINDOW that open landed in — not whichever window happened to be active
+ *    when the call arrived
+ *  - a freshly opened window has recorded nothing yet, so its empty store is
+ *    never mistaken for a finished compile
  *  - a compile error surfaces as isError with a compile_logs/stderr pointer
  *  - an already-open ready project short-circuits without re-triggering
  *  - project_status derives the public phase: settled 'ready' with no live
@@ -15,9 +18,11 @@
 import { describe, it, expect, vi } from 'vitest'
 import { createCompileLogBuffer } from '../../workspace/compile-log-buffer.js'
 import { createSessionStatusStore } from '../../workspace/session-status-store.js'
+import type { McpOpenedProject } from '../opened-project.js'
 import {
   registerProjectTools,
   type McpProjectHost,
+  type McpProjectTarget,
 } from './project-tools.js'
 
 interface ToolResult {
@@ -46,8 +51,32 @@ function parse(result: ToolResult): Record<string, unknown> {
   return JSON.parse(result.content[0]!.text) as Record<string, unknown>
 }
 
-function makeHost(overrides?: Partial<McpProjectHost['workspace']>): McpProjectHost {
+/**
+ * The window an open lands in: its own status store plus the generation guard
+ * a brand-new window carries (nothing recorded yet, so accept only what this
+ * open produces).
+ */
+function newWindow(): McpOpenedProject {
   return {
+    workspace: {
+      getProjectPath: vi.fn(() => ''),
+      hasActiveSession: vi.fn(() => false),
+    },
+    sessionStatus: createSessionStatusStore(),
+    afterGeneration: 0,
+  }
+}
+
+/**
+ * One host over one target. Spread flat as well, so a test can drive the
+ * target's stores directly — they are the same objects the tools reach through
+ * `currentProject()`.
+ */
+function makeHost(
+  overrides?: Partial<McpProjectTarget['workspace']>,
+  opened: McpOpenedProject = newWindow(),
+): McpProjectHost & McpProjectTarget {
+  const target: McpProjectTarget = {
     workspace: {
       validateProjectDir: vi.fn(async () => null),
       hasProject: vi.fn(async () => false),
@@ -60,21 +89,28 @@ function makeHost(overrides?: Partial<McpProjectHost['workspace']>): McpProjectH
     },
     sessionStatus: createSessionStatusStore(),
     compileLogs: createCompileLogBuffer(),
-    requestOpenInUi: vi.fn(),
-    requestNavigateBack: vi.fn(),
+    closeWindow: vi.fn(),
+  }
+  return {
+    ...target,
+    currentProject: () => target,
+    requestOpenInUi: vi.fn(async () => opened),
   }
 }
 
 describe('project_open', () => {
   it('registers unknown dirs, pushes the renderer open, and resolves on the compile settling', async () => {
-    const host = makeHost()
+    const opened = newWindow()
+    const host = makeHost(undefined, opened)
     // Simulate the renderer-driven open: the push eventually produces the
-    // compile transitions through the notifier tap (recorded to the store).
-    vi.mocked(host.requestOpenInUi).mockImplementation(() => {
-      host.sessionStatus.record({ status: 'compiling', message: '编译中' })
-      host.sessionStatus.record({ status: 'ready', message: '编译完成' })
-      vi.mocked(host.workspace.getProjectPath).mockReturnValue('/proj/demo')
-      vi.mocked(host.workspace.hasActiveSession).mockReturnValue(true)
+    // compile transitions through the notifier tap (recorded to the store of
+    // the window that was opened).
+    vi.mocked(host.requestOpenInUi).mockImplementation(async () => {
+      opened.sessionStatus.record({ status: 'compiling', message: '编译中' })
+      opened.sessionStatus.record({ status: 'ready', message: '编译完成' })
+      vi.mocked(opened.workspace.getProjectPath).mockReturnValue('/proj/demo')
+      vi.mocked(opened.workspace.hasActiveSession).mockReturnValue(true)
+      return opened
     })
     const { call } = captureTools(host)
 
@@ -90,33 +126,65 @@ describe('project_open', () => {
     })
   })
 
-  it('never accepts the PREVIOUS session settled state as its own result', async () => {
-    const host = makeHost()
-    // A previous session already settled 'ready' before this open.
-    host.sessionStatus.record({ status: 'ready', message: 'previous session' })
+  it('awaits the window it opened, not the window that was active when the call arrived', async () => {
+    const opened = newWindow()
+    const host = makeHost(undefined, opened)
     const { call } = captureTools(host)
 
     const pending = call('project_open', { path: '/proj/demo', timeoutMs: 1000 })
     let done = false
-    pending.then(() => { done = true })
+    void pending.then(() => { done = true })
+
+    // The previously active window finishes a rebuild of ITS OWN project,
+    // after this open already reached its wait.
+    await new Promise((r) => setTimeout(r, 0))
+    host.sessionStatus.record({ status: 'compiling', message: '' })
+    host.sessionStatus.record({ status: 'ready', message: 'another project rebuilt' })
+    await new Promise((r) => setTimeout(r, 0))
+    expect(
+      done,
+      'another project window settling must never be reported as this open result',
+    ).toBe(false)
+
+    vi.mocked(opened.workspace.getProjectPath).mockReturnValue('/proj/demo')
+    vi.mocked(opened.workspace.hasActiveSession).mockReturnValue(true)
+    opened.sessionStatus.record({ status: 'ready', message: '编译完成' })
+
+    const result = await pending
+    expect(result.isError).toBeUndefined()
+    expect(
+      parse(result),
+      'the reported status describes the project that was opened',
+    ).toMatchObject({ projectPath: '/proj/demo', message: '编译完成' })
+  })
+
+  it('never accepts the empty store of a brand-new window as its own result', async () => {
+    const opened = newWindow()
+    const host = makeHost(undefined, opened)
+    const { call } = captureTools(host)
+
+    const pending = call('project_open', { path: '/proj/demo', timeoutMs: 1000 })
+    let done = false
+    void pending.then(() => { done = true })
     // Macrotask flush: lets the handler run through its awaits and reach the
-    // settled-wait. A buggy wait (no generation guard) would have resolved on
-    // the stale 'ready' by now.
+    // settled-wait. Without the generation guard the fresh window's initial
+    // 'idle' would already have resolved it.
     await new Promise((r) => setTimeout(r, 0))
-    expect(done).toBe(false)
+    expect(done, 'a window that has compiled nothing yet must not report success').toBe(false)
 
-    // Only the transitions triggered by THIS open settle the call.
-    host.sessionStatus.record({ status: 'compiling', message: '' })
-    host.sessionStatus.record({ status: 'ready', message: '编译完成' })
+    opened.sessionStatus.record({ status: 'compiling', message: '' })
+    opened.sessionStatus.record({ status: 'ready', message: '编译完成' })
     const result = await pending
     expect(result.isError).toBeUndefined()
   })
 
   it('reports a compile error as isError pointing at compile_logs stderr', async () => {
-    const host = makeHost()
-    vi.mocked(host.requestOpenInUi).mockImplementation(() => {
-      host.sessionStatus.record({ status: 'compiling', message: '' })
-      host.sessionStatus.record({ status: 'error', message: '编译失败' })
+    const opened = newWindow()
+    const host = makeHost(undefined, opened)
+    vi.mocked(host.requestOpenInUi).mockImplementation(async () => {
+      opened.sessionStatus.record({ status: 'compiling', message: '' })
+      opened.sessionStatus.record({ status: 'error', message: '编译失败' })
+      return opened
     })
     const { call } = captureTools(host)
 
@@ -126,6 +194,16 @@ describe('project_open', () => {
     expect(result.content[0]!.text).toContain('compile_logs')
   })
 
+  it('surfaces a failure to open the window instead of waiting out the timeout', async () => {
+    const host = makeHost()
+    vi.mocked(host.requestOpenInUi).mockRejectedValue(new Error('编辑器服务端口被占用'))
+    const { call } = captureTools(host)
+
+    const result = await call('project_open', { path: '/proj/demo', timeoutMs: 1000 })
+    expect(result.isError).toBe(true)
+    expect(result.content[0]!.text).toContain('编辑器服务端口被占用')
+  })
+
   it('rejects an invalid project dir without pushing the renderer', async () => {
     const host = makeHost({
       validateProjectDir: vi.fn(async () => '不是有效的小程序目录'),
@@ -153,13 +231,15 @@ describe('project_open', () => {
   })
 
   it('reuses the registered project name instead of re-adding a known dir', async () => {
+    const opened = newWindow()
     const host = makeHost({
       hasProject: vi.fn(async () => true),
       listProjects: vi.fn(async () => [{ name: '我的小程序', path: '/proj/demo' }]),
-    })
-    vi.mocked(host.requestOpenInUi).mockImplementation(() => {
-      host.sessionStatus.record({ status: 'compiling', message: '' })
-      host.sessionStatus.record({ status: 'ready', message: '' })
+    }, opened)
+    vi.mocked(host.requestOpenInUi).mockImplementation(async () => {
+      opened.sessionStatus.record({ status: 'compiling', message: '' })
+      opened.sessionStatus.record({ status: 'ready', message: '' })
+      return opened
     })
     const { call } = captureTools(host)
 
@@ -179,7 +259,10 @@ describe('project_close', () => {
 
     const result = await call('project_close')
     expect(host.workspace.closeProject).toHaveBeenCalledTimes(1)
-    expect(host.requestNavigateBack).toHaveBeenCalledTimes(1)
+    expect(
+      host.closeWindow,
+      'the target window must actually close — tearing the session down without it leaves the project window on screen with a dead session',
+    ).toHaveBeenCalledTimes(1)
     expect(parse(result)).toMatchObject({ closed: true })
   })
 
diff --git a/packages/devtools/src/main/services/mcp/tools/project-tools.ts b/packages/devtools/src/main/services/mcp/tools/project-tools.ts
index a9a7cb68..59f2d8de 100644
--- a/packages/devtools/src/main/services/mcp/tools/project-tools.ts
+++ b/packages/devtools/src/main/services/mcp/tools/project-tools.ts
@@ -18,6 +18,7 @@ import type {
   SessionStatusSnapshot,
   SessionStatusStore,
 } from '../../workspace/session-status-store.js'
+import type { McpOpenedProject, McpProjectStatusSource } from '../opened-project.js'
 
 /**
  * Narrow structural slice of WorkspaceService the project tools need.
@@ -34,15 +35,38 @@ export interface McpProjectWorkspace {
   hasActiveSession(): boolean
 }
 
-/** Everything `registerProjectTools` needs, assembled by app bootstrap. */
-export interface McpProjectHost {
+/**
+ * One project window's surfaces, resolved together. A project lives in its own
+ * window with its own workspace, status store and log buffer, so a tool call
+ * that read them one by one could mix two projects: every surface here comes
+ * from the same window at the same instant.
+ */
+export interface McpProjectTarget {
   workspace: McpProjectWorkspace
   sessionStatus: SessionStatusStore
   compileLogs: CompileLogBuffer
-  /** Push the renderer to open the project (the user-click-equivalent path). */
-  requestOpenInUi(project: { name: string; path: string }): void
-  /** Push the renderer back to the project list after a close. */
-  requestNavigateBack(): void
+  /** Close this target's project window; a no-op when it has none. */
+  closeWindow(): void
+}
+
+/** Everything `registerProjectTools` needs, assembled by app bootstrap. */
+export interface McpProjectHost {
+  /**
+   * The project window a call arriving now is aimed at. Taken ONCE per tool
+   * call and held for its whole lifetime: tools await compiles and teardowns,
+   * and the user is free to focus another project meanwhile — re-resolving
+   * afterwards would report one project's compile as another's, or close the
+   * window they just moved to.
+   */
+  currentProject(): McpProjectTarget
+  /**
+   * Push the renderer to open the project (the user-click-equivalent path) and
+   * resolve with the window it landed in. A project lives in its own window
+   * with its own status store, so the caller can only await the right compile
+   * by holding that window — the window active when the call arrived is a
+   * different project.
+   */
+  requestOpenInUi(project: { name: string; path: string }): Promise<McpOpenedProject>
 }
 
 const DEFAULT_OPEN_TIMEOUT_MS = 180_000
@@ -70,13 +94,14 @@ function publicPhase(
   return snapshot.phase
 }
 
-function statusPayload(host: McpProjectHost) {
-  const snapshot = host.sessionStatus.get()
-  const sessionActive = host.workspace.hasActiveSession()
+/** Reads one window's own status: the pinned target, or the window an open landed in. */
+function statusPayload(source: McpProjectStatusSource) {
+  const snapshot = source.sessionStatus.get()
+  const sessionActive = source.workspace.hasActiveSession()
   return {
     phase: publicPhase(snapshot, sessionActive),
     message: snapshot.message,
-    projectPath: host.workspace.getProjectPath(),
+    projectPath: source.workspace.getProjectPath(),
     sessionActive,
     watcherAlive: snapshot.watcherAlive,
     updatedAt: snapshot.updatedAt,
@@ -94,35 +119,39 @@ export function registerProjectTools(server: McpServer, host: McpProjectHost): v
         .describe('Max time to wait for the compile to settle'),
     },
     async ({ path: rawPath, timeoutMs }) => {
+      const target = host.currentProject()
       const dir = path.resolve(rawPath)
 
       // Already open and settled: report instead of re-triggering a compile.
-      const current = host.sessionStatus.get()
-      if (host.workspace.getProjectPath() === dir
-        && host.workspace.hasActiveSession()
+      const current = target.sessionStatus.get()
+      if (target.workspace.getProjectPath() === dir
+        && target.workspace.hasActiveSession()
         && current.phase === 'ready') {
-        return text({ ...statusPayload(host), note: 'project already open' })
+        return text({ ...statusPayload(target), note: 'project already open' })
       }
 
-      const invalid = await host.workspace.validateProjectDir(dir)
+      const invalid = await target.workspace.validateProjectDir(dir)
       if (invalid) return errorText(invalid)
 
       let project: { name: string; path: string }
-      if (await host.workspace.hasProject(dir)) {
-        const known = (await host.workspace.listProjects()).find((p) => p.path === dir)
+      if (await target.workspace.hasProject(dir)) {
+        const known = (await target.workspace.listProjects()).find((p) => p.path === dir)
         project = known ?? { name: path.basename(dir), path: dir }
       } else {
-        project = await host.workspace.addProject(dir)
+        project = await target.workspace.addProject(dir)
       }
 
-      // Snapshot the generation BEFORE the trigger so a previous session's
-      // settled state can never be mistaken for this open's result.
-      const afterGeneration = host.sessionStatus.get().generation
-      host.requestOpenInUi({ name: project.name, path: project.path })
-
+      // The open hands back the window it landed in; that window's store is the
+      // only place this compile is reported, and its `afterGeneration` keeps a
+      // state that predates the open from being read as this open's result.
+      let opened: McpOpenedProject
       let settled: SessionStatusSnapshot
       try {
-        settled = await host.sessionStatus.waitForSettled({ afterGeneration, timeoutMs })
+        opened = await host.requestOpenInUi({ name: project.name, path: project.path })
+        settled = await opened.sessionStatus.waitForSettled({
+          afterGeneration: opened.afterGeneration,
+          timeoutMs,
+        })
       } catch (err) {
         return errorText(err instanceof Error ? err.message : String(err))
       }
@@ -132,7 +161,7 @@ export function registerProjectTools(server: McpServer, host: McpProjectHost): v
           `compile failed: ${settled.message} — call compile_logs (stream: "stderr") for details`,
         )
       }
-      return text(statusPayload(host))
+      return text(statusPayload(opened))
     },
   )
 
@@ -141,11 +170,14 @@ export function registerProjectTools(server: McpServer, host: McpProjectHost): v
     'Close the currently open project session and return the workbench to the project list.',
     {},
     async () => {
-      if (!host.workspace.getProjectPath() && !host.workspace.hasActiveSession()) {
+      // Held across the await: `closeProject()` yields, and a window the user
+      // focuses while it runs must not become the window this close takes down.
+      const target = host.currentProject()
+      if (!target.workspace.getProjectPath() && !target.workspace.hasActiveSession()) {
         return text({ closed: false, note: 'no project is open' })
       }
-      await host.workspace.closeProject()
-      host.requestNavigateBack()
+      await target.workspace.closeProject()
+      target.closeWindow()
       return text({ closed: true })
     },
   )
@@ -154,7 +186,7 @@ export function registerProjectTools(server: McpServer, host: McpProjectHost): v
     'project_status',
     'Query the current project compile status (phase: idle | compiling | ready | error). Includes `generation` — pass it to project_wait_ready to await the NEXT settled state.',
     {},
-    async () => text(statusPayload(host)),
+    async () => text(statusPayload(host.currentProject())),
   )
 
   server.tool(
@@ -167,12 +199,15 @@ export function registerProjectTools(server: McpServer, host: McpProjectHost): v
         .describe('Max time to wait'),
     },
     async ({ afterGeneration, timeoutMs }) => {
+      // Held across the wait: the state this call reports must come from the
+      // window it was aimed at, whichever window is focused when it settles.
+      const target = host.currentProject()
       try {
-        await host.sessionStatus.waitForSettled({ afterGeneration, timeoutMs })
+        await target.sessionStatus.waitForSettled({ afterGeneration, timeoutMs })
       } catch (err) {
         return errorText(err instanceof Error ? err.message : String(err))
       }
-      return text(statusPayload(host))
+      return text(statusPayload(target))
     },
   )
 
@@ -187,7 +222,7 @@ export function registerProjectTools(server: McpServer, host: McpProjectHost): v
         .describe('Only lines from this stream (stderr carries compile errors)'),
     },
     async ({ cursor, limit, stream }) => {
-      const read = host.compileLogs.read({ afterSeq: cursor, limit, stream })
+      const read = host.currentProject().compileLogs.read({ afterSeq: cursor, limit, stream })
       return text(read)
     },
   )
diff --git a/packages/devtools/src/main/services/mcp/tools/simulator-overview-provider-snapshot.test.ts b/packages/devtools/src/main/services/mcp/tools/simulator-overview-provider-snapshot.test.ts
new file mode 100644
index 00000000..ed479b24
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/tools/simulator-overview-provider-snapshot.test.ts
@@ -0,0 +1,197 @@
+/**
+ * `simulator_get_overview` must read the native overview provider of the
+ * window it was CALLED for, not whichever window happens to be active by the
+ * time the in-target CDP probe resolves.
+ *
+ * The tool awaits `Runtime.evaluate` before reading `getNativeOverviewProvider()`,
+ * which resolves the active window live off `resolveActiveOwner()`. If the
+ * user switches project windows while that evaluate is in flight, the
+ * provider read after the await belongs to the NEW active window even though
+ * `getClient('simulator')` (and the probe itself) answered for the window
+ * active when the call started — mixing window A's page/storage probe with
+ * window B's route/stack overview in one response.
+ *
+ * The fix is to snapshot the provider (or the owning window) at the same
+ * point `getClient` is read, before any await.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { registerContextTools } from './context-tools.js'
+import {
+  getTargetState,
+  registerMcpWindow,
+  setActiveMcpWindowResolver,
+  type McpWindowRegistration,
+  type NativeOverview,
+} from '../target-manager.js'
+
+type ToolHandler = (args: unknown) => Promise<{
+  content: Array<{ type: string; text?: string }>
+  isError?: boolean
+}>
+
+function makeFakeServer() {
+  const handlers = new Map<string, ToolHandler>()
+  const server = {
+    tool(name: string, _desc: string, _schema: unknown, handler: ToolHandler) {
+      handlers.set(name, handler)
+    },
+  }
+  return { server: server as unknown as Parameters<typeof registerContextTools>[0], handlers }
+}
+
+function makeDeferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>((r) => { resolve = r })
+  return { promise, resolve }
+}
+
+const BLIND_PROBE = {
+  url: 'file:///app/dist/render-host/pageFrame.html?appId=x&bridgeId=b1',
+  title: 'page',
+  viewport: { width: 390, height: 844 },
+  currentRoute: null as string | null,
+  pageStackDepth: 0,
+  storageKeys: [] as string[],
+  storageCount: 0,
+  appDataKeys: [] as string[],
+  bridgeReady: false,
+  simulatorDataPresent: false,
+}
+
+const overviewFor = (route: string): NativeOverview => ({
+  currentRoute: route,
+  pageStackDepth: 1,
+  storageKeys: [],
+  storageCount: 0,
+  appDataKeys: [],
+})
+
+function resetSimulatorState() {
+  const state = getTargetState('simulator')
+  state.connected = false
+  state.client = null
+  state.owner = null
+  state.consoleLogs = []
+  state.networkRequests = []
+}
+
+async function callOverview(handlers: Map<string, ToolHandler>) {
+  const handler = handlers.get('simulator_get_overview')
+  expect(handler, 'simulator_get_overview must be registered').toBeTypeOf('function')
+  return handler!({})
+}
+
+const windowA = {}
+const windowB = {}
+let registrationA: McpWindowRegistration
+let registrationB: McpWindowRegistration
+
+describe('simulator_get_overview provider snapshot vs. mid-flight window switch', () => {
+  beforeEach(() => {
+    registrationA = registerMcpWindow(windowA, {
+      nativeHost: true, activeBridgeId: null,
+      nativeOverviewProvider: async () => overviewFor('pages/A'),
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+    registrationB = registerMcpWindow(windowB, {
+      nativeHost: true, activeBridgeId: null,
+      nativeOverviewProvider: async () => overviewFor('pages/B'),
+      projectPath: '/proj/b', getAppId: () => 'app-b',
+    })
+  })
+
+  afterEach(() => {
+    registrationA.dispose()
+    registrationB.dispose()
+    setActiveMcpWindowResolver(() => null)
+    resetSimulatorState()
+  })
+
+  it('reports A`s route even when the active window switches to B before the CDP probe resolves', async () => {
+    setActiveMcpWindowResolver(() => windowA)
+
+    const state = getTargetState('simulator')
+    state.connected = true
+    state.owner = windowA
+    const deferred = makeDeferred<{ result: { value: string } }>()
+    state.client = {
+      Runtime: { evaluate: async () => deferred.promise },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    const { server, handlers } = makeFakeServer()
+    registerContextTools(server)
+
+    // Call starts while A is active: getClient('simulator') reads A's
+    // connection synchronously, before the probe's await suspends the tool.
+    const resultPromise = callOverview(handlers)
+
+    // The user switches windows while the probe is still in flight.
+    setActiveMcpWindowResolver(() => windowB)
+    deferred.resolve({ result: { value: JSON.stringify(BLIND_PROBE) } })
+
+    const res = await resultPromise
+    const text = res.content.find((c) => c.type === 'text')?.text
+    const payload = JSON.parse(text as string) as Record<string, unknown>
+
+    expect(
+      payload.currentRoute,
+      'the overview was requested for A (getClient answered for A before the switch); it must not silently report B`s route',
+    ).toBe('pages/A')
+    expect(payload.currentRoute).not.toBe('pages/B')
+  })
+
+  it('reports A`s console error even when a reconnect clears and re-owns the shared buffer while the native provider is in flight', async () => {
+    setActiveMcpWindowResolver(() => windowA)
+
+    const state = getTargetState('simulator')
+    state.connected = true
+    state.owner = windowA
+    state.bufferOwner = windowA
+    state.consoleLogs = [{ level: 'error', text: 'A boom', timestamp: '2026-01-01T00:00:00.000Z' }]
+    state.networkRequests = []
+    state.client = {
+      Runtime: { evaluate: async () => ({ result: { value: JSON.stringify(BLIND_PROBE) } }) },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    let providerCalled = false
+    const providerDeferred = makeDeferred<NativeOverview>()
+    registrationA = registerMcpWindow(windowA, {
+      nativeHost: true, activeBridgeId: null,
+      nativeOverviewProvider: () => { providerCalled = true; return providerDeferred.promise },
+      projectPath: '/proj/a', getAppId: () => 'app-a',
+    })
+
+    const { server, handlers } = makeFakeServer()
+    registerContextTools(server)
+
+    const resultPromise = callOverview(handlers)
+    await vi.waitFor(() => {
+      expect(providerCalled, 'the overview must reach the native provider await before the buffer is mutated below').toBe(true)
+    })
+
+    // A reconnect to B lands while A's native provider is still pending —
+    // target-manager clears the shared console/network buffer and re-owns it
+    // for B before A's own await settles.
+    state.consoleLogs = []
+    state.networkRequests = []
+    state.bufferOwner = windowB
+    state.owner = windowB
+    state.consoleLogs.push({ level: 'error', text: 'B boom', timestamp: '2026-01-01T00:00:01.000Z' })
+    setActiveMcpWindowResolver(() => windowB)
+
+    providerDeferred.resolve(overviewFor('pages/A'))
+
+    const res = await resultPromise
+    const text = res.content.find((c) => c.type === 'text')?.text
+    const payload = JSON.parse(text as string) as Record<string, unknown>
+    const lastError = payload.lastError as { text: string } | null
+
+    expect(
+      lastError?.text,
+      'the console summary must reflect the buffer as it stood when this overview call started, not whatever it was cleared and refilled with while the call was still in flight',
+    ).toBe('A boom')
+    expect(payload.recentErrorCount).toBe(1)
+  })
+})
diff --git a/packages/devtools/src/main/services/mcp/window-scoped-state.test.ts b/packages/devtools/src/main/services/mcp/window-scoped-state.test.ts
new file mode 100644
index 00000000..160be618
--- /dev/null
+++ b/packages/devtools/src/main/services/mcp/window-scoped-state.test.ts
@@ -0,0 +1,182 @@
+/**
+ * MCP runtime state belongs to a WINDOW, not to the process.
+ *
+ * Each project runs in its own window, so "is this native-host", "which render
+ * guest is visible", "how do I read the cross-process overview" and "which
+ * project is this" are facts about one window. MCP's tool surface takes no
+ * window argument, so it reads the window the user is working in — and one
+ * window closing must leave every other open window's state untouched.
+ *
+ * The `workbench` CDP target follows the same rule: it is the active project's
+ * workbench renderer, and only falls back to the project-list window when no
+ * project window is open.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import {
+  activeMcpWindow,
+  getNativeOverviewProvider,
+  noteActiveBridgeId,
+  registerMcpWindow,
+  selectWorkbenchTarget,
+  setActiveMcpWindowResolver,
+  type McpWindowRegistration,
+  type NativeOverview,
+} from './target-manager.js'
+
+const EMPTY_OVERVIEW: NativeOverview = {
+  currentRoute: null,
+  pageStackDepth: 0,
+  storageKeys: [],
+  storageCount: 0,
+  appDataKeys: [],
+}
+
+/** Stands in for one project window: an opaque owner token plus its facts. */
+function openWindow(projectPath: string, nativeHost = true): {
+  owner: object
+  registration: McpWindowRegistration
+  overview: () => Promise<NativeOverview>
+} {
+  const owner = { projectPath }
+  const overview = async (): Promise<NativeOverview> => ({ ...EMPTY_OVERVIEW, currentRoute: projectPath })
+  const registration = registerMcpWindow(owner, {
+    nativeHost,
+    activeBridgeId: null,
+    nativeOverviewProvider: nativeHost ? overview : null,
+    projectPath,
+    getAppId: () => null,
+  })
+  return { owner, registration, overview }
+}
+
+afterEach(() => {
+  setActiveMcpWindowResolver(() => null)
+})
+
+describe('two project windows open at once', () => {
+  it('reads the native overview of the window the user is working in', async () => {
+    const a = openWindow('/proj/a')
+    const b = openWindow('/proj/b')
+
+    let active: object = a.owner
+    setActiveMcpWindowResolver(() => active)
+    expect(
+      await getNativeOverviewProvider()?.(),
+      'MCP must read the overview of the active project window',
+    ).toMatchObject({ currentRoute: '/proj/a' })
+
+    active = b.owner
+    expect(
+      await getNativeOverviewProvider()?.(),
+      'switching the active window must switch the overview MCP reads',
+    ).toMatchObject({ currentRoute: '/proj/b' })
+
+    a.registration.dispose()
+    b.registration.dispose()
+  })
+
+  it('closing one project window leaves the other window native-host state intact', async () => {
+    const a = openWindow('/proj/a')
+    const b = openWindow('/proj/b')
+    setActiveMcpWindowResolver(() => b.owner)
+
+    a.registration.dispose()
+
+    expect(
+      activeMcpWindow()?.nativeHost,
+      'closing another project must not drop the still-open window out of native-host mode',
+    ).toBe(true)
+    expect(
+      await getNativeOverviewProvider()?.(),
+      'closing another project must not strip the still-open window native overview',
+    ).toMatchObject({ currentRoute: '/proj/b' })
+
+    b.registration.dispose()
+  })
+
+  it('a background window navigating never re-points MCP at its page', () => {
+    const a = openWindow('/proj/a')
+    const b = openWindow('/proj/b')
+    setActiveMcpWindowResolver(() => b.owner)
+
+    noteActiveBridgeId(b.owner, 'bridge-b')
+    noteActiveBridgeId(a.owner, 'bridge-a')
+
+    expect(
+      activeMcpWindow()?.activeBridgeId,
+      'a navigation in a background project window must not steal the MCP simulator target',
+    ).toBe('bridge-b')
+
+    a.registration.dispose()
+    b.registration.dispose()
+  })
+
+  it('reports no window state once every project window is gone', () => {
+    const a = openWindow('/proj/a')
+    setActiveMcpWindowResolver(() => a.owner)
+    a.registration.dispose()
+
+    expect(activeMcpWindow(), 'a disposed window must not answer for MCP any more').toBeNull()
+    expect(getNativeOverviewProvider()).toBeNull()
+  })
+})
+
+describe('selectWorkbenchTarget', () => {
+  const listWindow = { type: 'page', url: 'file:///app/dist/entries/main/index.html' }
+  const workbenchA = {
+    type: 'page',
+    url: 'file:///app/dist/entries/workbench/index.html?path=%2Fproj%2Fa&name=a',
+  }
+  const workbenchB = {
+    type: 'page',
+    url: 'file:///app/dist/entries/workbench/index.html?path=%2Fproj%2Fb&name=b',
+  }
+  // The service host for project B: its URL carries the SAME project directory,
+  // which is why the project path alone can never be the match criterion.
+  const serviceHostB = {
+    type: 'page',
+    url: 'file:///app/dist/service-host/index.html?pkgRoot=%2Fproj%2Fb&appId=demo',
+  }
+  const simulatorShell = { type: 'page', url: 'http://localhost:7788/simulator.html' }
+
+  it('picks the workbench window of the active project, not the project list', () => {
+    const picked = selectWorkbenchTarget(
+      [listWindow, simulatorShell, workbenchA, serviceHostB, workbenchB],
+      { projectPath: '/proj/b' },
+    )
+    expect(
+      picked,
+      'MCP workbench tools must reach the project workbench the user is in, not the project list',
+    ).toBe(workbenchB)
+  })
+
+  it('never picks the service host that merely carries the same project directory', () => {
+    const picked = selectWorkbenchTarget([listWindow, serviceHostB, simulatorShell], {
+      projectPath: '/proj/b',
+    })
+    expect(
+      picked,
+      'a service-host window is not a workbench renderer, even with the project dir in its URL — and with a project open the list is not a stand-in for it either',
+    ).toBeUndefined()
+  })
+
+  it('falls back to the project list when no project window is open', () => {
+    const picked = selectWorkbenchTarget([workbenchA, listWindow, simulatorShell], {
+      projectPath: null,
+    })
+    expect(picked, 'with no active project the list window is the workbench surface').toBe(listWindow)
+  })
+
+  it('picks a workbench window whose session has not started yet', () => {
+    const picked = selectWorkbenchTarget([listWindow, workbenchA], { projectPath: '/proj/a' })
+    expect(
+      picked,
+      'a window is matched on the path it opened with, so it is the target from the moment it exists — nothing has to compile first',
+    ).toBe(workbenchA)
+  })
+
+  it('never picks the simulator shell', () => {
+    expect(selectWorkbenchTarget([simulatorShell], { projectPath: '/proj/a' })).toBeUndefined()
+    expect(selectWorkbenchTarget([simulatorShell], { projectPath: null })).toBeUndefined()
+  })
+})
diff --git a/packages/devtools/src/main/services/module.ts b/packages/devtools/src/main/services/module.ts
index f6a5a39a..a7c73544 100644
--- a/packages/devtools/src/main/services/module.ts
+++ b/packages/devtools/src/main/services/module.ts
@@ -1,6 +1,7 @@
 import type { Disposable } from '@dimina-kit/electron-deck/main'
 // eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
 import type { WorkbenchContext } from './workbench-context.js'
+import type { IpcContextSource } from '../utils/ipc-context-source.js'
 
 /**
  * A composable unit of workbench functionality.
@@ -8,11 +9,18 @@ import type { WorkbenchContext } from './workbench-context.js'
  * Built-in modules (projects, session, simulator, popover, settings) are
  * implemented as `WorkbenchModule` values.
  *
- * `setup` is invoked once during workbench bootstrap. The returned
- * Disposable is added to `ctx.registry` so module teardown is symmetric
- * with the rest of the workbench lifecycle.
+ * The two hooks differ in what they own. `setup` registers IPC once for the
+ * application and answers each message with the context the sender belongs to,
+ * so its handlers must read everything from that argument. `setupWindow` is the
+ * escape hatch for wiring that genuinely belongs to a single window — it
+ * receives that window's concrete context and may mutate it.
+ *
+ * Both returned Disposables are added to a registry so module teardown is
+ * symmetric with the rest of the workbench lifecycle.
  */
 export interface WorkbenchModule {
-  /** Set up the module against ctx. Returns a Disposable owned by ctx.registry. */
-  setup(ctx: WorkbenchContext): Disposable
+  /** Register the module's IPC against every live window context. */
+  setup(source: IpcContextSource<WorkbenchContext>): Disposable
+  /** Optional per-window wiring, run once for each window that opens. */
+  setupWindow?(ctx: WorkbenchContext): Disposable
 }
diff --git a/packages/devtools/src/main/services/simulator-storage/index.ts b/packages/devtools/src/main/services/simulator-storage/index.ts
index 4e152710..5bad97e9 100644
--- a/packages/devtools/src/main/services/simulator-storage/index.ts
+++ b/packages/devtools/src/main/services/simulator-storage/index.ts
@@ -20,7 +20,7 @@
  *     flowing until they close it.
  */
 
-import { app, webContents as wcStatic, type WebContents } from 'electron'
+import { app, webContents as wcStatic, type BrowserWindow, type WebContents } from 'electron'
 import { DisposableRegistry, type ConnectionRegistry, type Disposable } from '@dimina-kit/electron-deck/main'
 import {
   SimulatorElementChannel,
@@ -35,6 +35,7 @@ import type { BridgeRouterHandle } from '../../ipc/bridge-router.js'
 import type { RenderInspector } from '../render-inspect/index.js'
 import { decodeStorageValue, encodeStorageValue, serviceStorage } from './service-storage-ops.js'
 import { createCdpSessionBroker, type CdpSessionBroker, type CdpSessionLease } from '../cdp-session/index.js'
+import { windowHostsWebContents } from './window-scope.js'
 
 /**
  * Runtime async-storage handler (native-host). bridge-router routes async
@@ -76,6 +77,17 @@ function isSimulatorWebview(wc: WebContents): boolean {
   return wc.getURL().includes('simulator.html')
 }
 
+/**
+ * `win` undefined means no owning window was configured — the legacy
+ * unscoped behavior, kept so single-window callers/tests that don't pass
+ * `window` keep compiling and behaving unchanged. Every production call
+ * site (window-runtime-services.ts) always passes its window.
+ */
+function belongsToWindow(win: BrowserWindow | undefined, wc: WebContents): boolean {
+  if (!win) return true
+  return windowHostsWebContents(win, wc)
+}
+
 function safeOff(target: { isDestroyed?: () => boolean; removeListener: (event: string, fn: (...args: unknown[]) => void) => unknown }, event: string, fn: (...args: unknown[]) => void): void {
   try {
     if (target.isDestroyed?.()) return
@@ -130,6 +142,17 @@ export interface SimulatorStorageOptions {
    * compile and behave unchanged, just without cross-module session sharing.
    */
   broker?: CdpSessionBroker
+  /**
+   * Owning window (typically `mainWindow`). Scopes every simulator-webview
+   * discovery path (initial scan, `web-contents-created`, lazy re-find) to
+   * webviews that live inside THIS window — required in a multi-window
+   * workbench, where `webContents`/`app.on('web-contents-created')` are
+   * process-global and would otherwise let one window's instance attach to
+   * (and read/write through) another window's simulator. Optional so
+   * existing single-window callers/tests compile and keep their prior
+   * unscoped behavior.
+   */
+  window?: BrowserWindow
 }
 
 export function setupSimulatorStorage(
@@ -279,7 +302,7 @@ export function setupSimulatorStorage(
    */
   async function ensureAttached(): Promise<void> {
     if (attachedWc && !attachedWc.isDestroyed()) return
-    const sim = findSimulatorWebContents()
+    const sim = findSimulatorWebContents(options.window)
     if (!sim) return
     await attachToSim(sim)
   }
@@ -470,7 +493,7 @@ export function setupSimulatorStorage(
   // Attach to any simulator webview that already exists (project may have
   // been opened before this function runs).
   for (const wc of wcStatic.getAllWebContents()) {
-    if (isSimulatorWebview(wc)) {
+    if (isSimulatorWebview(wc) && belongsToWindow(options.window, wc)) {
       void attachToSim(wc)
       break
     }
@@ -486,7 +509,7 @@ export function setupSimulatorStorage(
     wcSubs.set(wc, sub)
 
     const onFinishLoad = () => {
-      if (isSimulatorWebview(wc)) void attachToSim(wc)
+      if (isSimulatorWebview(wc) && belongsToWindow(options.window, wc)) void attachToSim(wc)
     }
     wc.on('did-finish-load', onFinishLoad)
     sub.add(() => safeOff(wc as unknown as Parameters<typeof safeOff>[0], 'did-finish-load', onFinishLoad as (...args: unknown[]) => void))
@@ -532,7 +555,7 @@ export function setupSimulatorStorage(
       if (!wc) return null
       return options.renderInspector.highlight(wc, sid)
     }
-    const sim = findSimulatorWebContents()
+    const sim = findSimulatorWebContents(options.window)
     if (!sim) return null
     try {
       const result = (await sim.executeJavaScript(
@@ -551,7 +574,7 @@ export function setupSimulatorStorage(
       if (wc) await options.renderInspector.unhighlight(wc)
       return
     }
-    const sim = findSimulatorWebContents()
+    const sim = findSimulatorWebContents(options.window)
     if (!sim) return
     try {
       await sim.executeJavaScript(
@@ -677,9 +700,12 @@ export function setupSimulatorStorage(
 // bridge via executeJavaScript. Looked up independently from `attachedWc` so
 // it keeps working when the user opens Chrome DevTools and the storage
 // debugger detaches (debugger.attach is mutually exclusive with F12).
-function findSimulatorWebContents(): WebContents | null {
+// Scoped to `win` for the same reason as the attach paths above — an
+// unscoped scan would resolve to whichever window's simulator comes first
+// in the process-global registry, not necessarily this instance's own.
+function findSimulatorWebContents(win: BrowserWindow | undefined): WebContents | null {
   for (const wc of wcStatic.getAllWebContents()) {
-    if (isSimulatorWebview(wc)) return wc
+    if (isSimulatorWebview(wc) && belongsToWindow(win, wc)) return wc
   }
   return null
 }
diff --git a/packages/devtools/src/main/services/simulator-storage/multi-window.test.ts b/packages/devtools/src/main/services/simulator-storage/multi-window.test.ts
new file mode 100644
index 00000000..d9197f21
--- /dev/null
+++ b/packages/devtools/src/main/services/simulator-storage/multi-window.test.ts
@@ -0,0 +1,252 @@
+/**
+ * Multi-window ownership regression for `setupSimulatorStorage`.
+ *
+ * One instance runs per project `BrowserWindow`, but the underlying
+ * `webContents`/`app.on('web-contents-created')` APIs are process-global.
+ * Without a per-window ownership check, whichever instance's scan or
+ * `did-finish-load` callback fires first attaches to ANY simulator webview
+ * in the process — so opening a second project window can steal the first
+ * window's simulator, and the first window's Storage panel starts reading
+ * and writing the second project's partition.
+ *
+ * Pinned invariant: window A's storage service only ever attaches to a
+ * simulator webview that belongs to window A. Window B's simulator
+ * finishing load must not cause A to detach from its own simulator, even
+ * though both instances share the same global `web-contents-created` event.
+ *
+ * The CDP debugger 'message' listener count is used as the attach signal
+ * (same approach as reattach.test.ts): `attachToSim` registers exactly one
+ * on the wc it captures, and `detachFromSim` removes it.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+type Handler = (...args: unknown[]) => unknown
+
+const stub = vi.hoisted(() => {
+  const ipcHandlers = new Map<string, Handler>()
+  const appListeners = new Map<string, Set<Handler>>()
+  const wcRegistry: unknown[] = []
+
+  const ipcMainStub = {
+    handle: vi.fn((channel: string, fn: Handler) => { ipcHandlers.set(channel, fn) }),
+    removeHandler: vi.fn((channel: string) => { ipcHandlers.delete(channel) }),
+  }
+  const appStub = {
+    on: vi.fn((event: string, fn: Handler) => {
+      if (!appListeners.has(event)) appListeners.set(event, new Set())
+      appListeners.get(event)!.add(fn)
+    }),
+    removeListener: vi.fn((event: string, fn: Handler) => {
+      appListeners.get(event)?.delete(fn)
+    }),
+  }
+  const webContentsStub = { getAllWebContents: vi.fn(() => wcRegistry) }
+
+  return { ipcHandlers, appListeners, wcRegistry, ipcMainStub, appStub, webContentsStub }
+})
+
+vi.mock('electron', () => ({
+  app: stub.appStub,
+  ipcMain: stub.ipcMainStub,
+  webContents: stub.webContentsStub,
+  BrowserWindow: class {},
+  shell: { openPath: vi.fn() },
+  nativeImage: { createFromPath: vi.fn(() => ({})) },
+}))
+
+import { setupSimulatorStorage } from './index.js'
+
+interface SimWc {
+  id: number
+  destroyed: boolean
+  isDestroyed: () => boolean
+  getType: () => string
+  getURL: () => string
+  hostWebContents: HostWc
+  executeJavaScript: ReturnType<typeof vi.fn>
+  _wcListeners: Map<string, Handler[]>
+  on: (event: string, fn: Handler) => void
+  once: (event: string, fn: Handler) => void
+  removeListener: (event: string, fn: Handler) => void
+  emit: (event: string, ...args: unknown[]) => void
+  debugger: {
+    attached: boolean
+    attach: ReturnType<typeof vi.fn>
+    detach: ReturnType<typeof vi.fn>
+    isAttached: () => boolean
+    sendCommand: ReturnType<typeof vi.fn>
+    _dbgListeners: Map<string, Handler[]>
+    on: (event: string, fn: Handler) => void
+    removeListener: (event: string, fn: Handler) => void
+  }
+}
+
+interface HostWc {
+  id: number
+  isDestroyed: () => boolean
+  send: ReturnType<typeof vi.fn>
+}
+
+interface FakeWin {
+  id: number
+  webContents: HostWc
+  contentView: { children: unknown[] }
+  isDestroyed: () => boolean
+}
+
+let nextId = 1
+
+function makeHostWc(): HostWc {
+  return { id: nextId++, isDestroyed: () => false, send: vi.fn() }
+}
+
+function makeWin(webContents: HostWc): FakeWin {
+  return { id: nextId++, webContents, contentView: { children: [] }, isDestroyed: () => false }
+}
+
+/** A simulator `<webview>` guest embedded in `hostWc`'s page. */
+function makeSimWc(hostWebContents: HostWc): SimWc {
+  const wc: SimWc = {
+    id: nextId++,
+    destroyed: false,
+    isDestroyed() { return this.destroyed },
+    getType: () => 'webview',
+    getURL: () => 'http://localhost/simulator.html',
+    hostWebContents,
+    executeJavaScript: vi.fn(() => Promise.resolve('http://localhost')),
+    _wcListeners: new Map(),
+    on(event, fn) {
+      const arr = this._wcListeners.get(event) ?? []
+      arr.push(fn)
+      this._wcListeners.set(event, arr)
+    },
+    once(event, fn) {
+      const wrap: Handler = (...args) => {
+        this.removeListener(event, wrap)
+        fn(...args)
+      }
+      this.on(event, wrap)
+    },
+    removeListener(event, fn) {
+      const arr = this._wcListeners.get(event)
+      if (!arr) return
+      const idx = arr.indexOf(fn)
+      if (idx >= 0) arr.splice(idx, 1)
+    },
+    emit(event, ...args) {
+      const arr = this._wcListeners.get(event) ?? []
+      for (const fn of [...arr]) fn(...args)
+    },
+    debugger: {
+      attached: false,
+      attach: vi.fn(),
+      detach: vi.fn(),
+      isAttached() { return this.attached },
+      sendCommand: vi.fn(() => Promise.resolve({ entries: [] })),
+      _dbgListeners: new Map(),
+      on(event, fn) {
+        const arr = this._dbgListeners.get(event) ?? []
+        arr.push(fn)
+        this._dbgListeners.set(event, arr)
+      },
+      removeListener(event, fn) {
+        const arr = this._dbgListeners.get(event)
+        if (!arr) return
+        const idx = arr.indexOf(fn)
+        if (idx >= 0) arr.splice(idx, 1)
+      },
+    },
+  }
+  wc.debugger.attach = vi.fn(() => { wc.debugger.attached = true }) as never
+  wc.debugger.detach = vi.fn(() => { wc.debugger.attached = false }) as never
+  return wc
+}
+
+function dbgMessageListenerCount(wc: SimWc): number {
+  return (wc.debugger._dbgListeners.get('message') ?? []).length
+}
+
+function allWcCreatedListeners(): Handler[] {
+  return Array.from(stub.appListeners.get('web-contents-created') ?? [])
+}
+
+beforeEach(() => {
+  nextId = 1
+  stub.ipcHandlers.clear()
+  stub.appListeners.clear()
+  stub.wcRegistry.length = 0
+  stub.ipcMainStub.handle.mockClear()
+  stub.ipcMainStub.removeHandler.mockClear()
+  stub.appStub.on.mockClear()
+  stub.appStub.removeListener.mockClear()
+  stub.webContentsStub.getAllWebContents.mockClear()
+})
+
+afterEach(() => {
+  vi.clearAllMocks()
+})
+
+describe('setupSimulatorStorage — per-window simulator ownership', () => {
+  it('window B finishing load does not steal window A\'s already-attached simulator', async () => {
+    const hostA = makeHostWc()
+    const winA = makeWin(hostA)
+    const simA = makeSimWc(hostA)
+    stub.wcRegistry.push(simA)
+
+    const svcA = setupSimulatorStorage(hostA as unknown as Electron.WebContents, {
+      getActiveAppId: () => 'wxA',
+      window: winA as unknown as Electron.BrowserWindow,
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(dbgMessageListenerCount(simA)).toBe(1)
+
+    const hostB = makeHostWc()
+    const winB = makeWin(hostB)
+    const svcB = setupSimulatorStorage(hostB as unknown as Electron.WebContents, {
+      getActiveAppId: () => 'wxB',
+      window: winB as unknown as Electron.BrowserWindow,
+    })
+
+    // Window B opens its project: its simulator webview is created and
+    // finishes loading. BOTH svcA's and svcB's global 'web-contents-created'
+    // listeners observe it (that's the process-global API this test guards
+    // against) — only svcB may attach.
+    const simB = makeSimWc(hostB)
+    for (const onCreated of allWcCreatedListeners()) onCreated({}, simB)
+    simB.emit('did-finish-load')
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(dbgMessageListenerCount(simB)).toBe(1)
+    // A's simulator must still carry its OWN attach — untouched by B's load.
+    expect(dbgMessageListenerCount(simA)).toBe(1)
+
+    await svcA.dispose()
+    await svcB.dispose()
+  })
+
+  it('initial scan only attaches to the simulator inside the given window, even when the other window\'s webview is listed first', async () => {
+    const hostA = makeHostWc()
+    const winA = makeWin(hostA)
+    const simA = makeSimWc(hostA)
+
+    const hostB = makeHostWc()
+    const simB = makeSimWc(hostB)
+
+    // B's webview registered before A's in the process-global registry.
+    stub.wcRegistry.push(simB, simA)
+
+    const svcA = setupSimulatorStorage(hostA as unknown as Electron.WebContents, {
+      getActiveAppId: () => 'wxA',
+      window: winA as unknown as Electron.BrowserWindow,
+    })
+    await Promise.resolve()
+    await Promise.resolve()
+
+    expect(dbgMessageListenerCount(simA)).toBe(1)
+    expect(dbgMessageListenerCount(simB)).toBe(0)
+
+    await svcA.dispose()
+  })
+})
diff --git a/packages/devtools/src/main/services/simulator-storage/window-scope.ts b/packages/devtools/src/main/services/simulator-storage/window-scope.ts
new file mode 100644
index 00000000..869fa3d8
--- /dev/null
+++ b/packages/devtools/src/main/services/simulator-storage/window-scope.ts
@@ -0,0 +1,19 @@
+/**
+ * Window-ownership judgment for simulator webContents discovery.
+ *
+ * The workbench runs one `setupSimulatorStorage` instance per project
+ * window, but Electron's `webContents`/`app.on('web-contents-created')`
+ * APIs are process-global — every instance sees every window's webviews.
+ * Without this filter, whichever instance's scan/callback fires first wins
+ * the simulator it finds, so opening a second project window can steal the
+ * first window's already-attached simulator (its Storage panel then reads
+ * and writes the second project's partition).
+ *
+ * The ownership rule itself (does a webContents sit inside a window's own
+ * renderer, its `contentView` tree, or a `<webview>` guest embedded in
+ * either) is shared with dimina-electron-runtime's bridge router, which
+ * faces the identical process-global-vs-per-window problem for its IPC
+ * routing — so it's owned by @dimina-kit/electron-deck/main and re-exported
+ * here under the name this package's callers expect.
+ */
+export { windowHostsWebContents } from '@dimina-kit/electron-deck/main'
diff --git a/packages/devtools/src/main/services/simulator/ui-extensions.ts b/packages/devtools/src/main/services/simulator/ui-extensions.ts
index 121acae0..0b14e1dd 100644
--- a/packages/devtools/src/main/services/simulator/ui-extensions.ts
+++ b/packages/devtools/src/main/services/simulator/ui-extensions.ts
@@ -33,6 +33,24 @@ export interface SimulatorUiExtensionRegistryOptions {
 
 const EXTENSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/
 
+/**
+ * The rules a registration has to satisfy on its own, with no window and no
+ * renderer involved: the id is a lookup key on both sides of the bridge, and
+ * the script is read straight from disk with no base to resolve against. They
+ * hold wherever a registration is accepted, so whoever accepts one first is
+ * where a host learns it is unusable.
+ */
+export function assertSimulatorUiExtensionShape(
+  registration: SimulatorUiExtensionRegistration,
+): void {
+  if (!EXTENSION_ID_RE.test(registration.id)) {
+    throw new Error(`Invalid simulator UI extension id: "${registration.id}"`)
+  }
+  if (!isAbsolute(registration.rendererScriptPath)) {
+    throw new Error('Simulator UI extension rendererScriptPath must be absolute')
+  }
+}
+
 export function createSimulatorUiExtensionRegistry(
   options: SimulatorUiExtensionRegistryOptions = {},
 ): SimulatorUiExtensionRegistry {
@@ -41,12 +59,7 @@ export function createSimulatorUiExtensionRegistry(
   let active: ActiveSimulator | null = null
 
   function assertRegistration(registration: SimulatorUiExtensionRegistration): void {
-    if (!EXTENSION_ID_RE.test(registration.id)) {
-      throw new Error(`Invalid simulator UI extension id: "${registration.id}"`)
-    }
-    if (!isAbsolute(registration.rendererScriptPath)) {
-      throw new Error('Simulator UI extension rendererScriptPath must be absolute')
-    }
+    assertSimulatorUiExtensionShape(registration)
     if (entries.has(registration.id)) {
       throw new Error(`Simulator UI extension "${registration.id}" is already registered`)
     }
diff --git a/packages/devtools/src/main/services/window-contexts/context-router-pure-resolve.test.ts b/packages/devtools/src/main/services/window-contexts/context-router-pure-resolve.test.ts
new file mode 100644
index 00000000..d20e415b
--- /dev/null
+++ b/packages/devtools/src/main/services/window-contexts/context-router-pure-resolve.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import type { WebContents } from 'electron'
+import { createWindowContextRouter, type RoutableWindowContext } from './context-router.js'
+
+/** Minimal stand-in: the router only ever reads `sender` through the predicates. */
+function wc(id: number): WebContents {
+  return { id } as unknown as WebContents
+}
+
+/** Same fixture shape as context-router.test.ts: owns one id, accepts a shared trusted set too. */
+function makeContext(ownId: number, trusted: Set<number>): RoutableWindowContext {
+  const ownsSender = (sender: WebContents) => sender.id === ownId
+  return {
+    ownsSender,
+    senderPolicy: (sender: WebContents) => ownsSender(sender) || trusted.has(sender.id),
+  }
+}
+
+describe('resolve() is a pure query: only setActive() and unregister move "active"', () => {
+  it('resolving a sender another window owns does not pull "active" away from the focused window', () => {
+    const router = createWindowContextRouter()
+    const a = makeContext(1, new Set())
+    const b = makeContext(2, new Set())
+    router.register(a)
+    router.register(b)
+    router.setActive(a)
+
+    expect(router.resolve(wc(2))).toBe(b)
+    expect(router.active(), 'looking up B\'s own sender must not make B the active window').toBe(a)
+  })
+
+  it('an accepted-but-unowned sender keeps resolving to the focused window, even after the unfocused window resolved a sender of its own', () => {
+    const trusted = new Set<number>([50])
+    const router = createWindowContextRouter()
+    const a = makeContext(1, trusted)
+    const b = makeContext(2, trusted)
+    router.register(a)
+    router.register(b)
+    router.setActive(a)
+
+    // B handles one of its own IPC calls first.
+    expect(router.resolve(wc(2))).toBe(b)
+
+    expect(
+      router.resolve(wc(50)),
+      'an app-wide sender no window owns must still be answered by the focused window',
+    ).toBe(a)
+  })
+
+  it('falls back to the next registrant when the focused window unregisters, unaffected by prior resolves', () => {
+    const router = createWindowContextRouter()
+    const a = makeContext(1, new Set())
+    const b = makeContext(2, new Set())
+    const c = makeContext(3, new Set())
+    const registrationA = router.register(a)
+    router.register(b)
+    router.register(c)
+    router.setActive(a)
+    router.resolve(wc(2))
+
+    registrationA.dispose()
+    expect(router.active()).toBe(b)
+  })
+})
diff --git a/packages/devtools/src/main/services/window-contexts/context-router.test.ts b/packages/devtools/src/main/services/window-contexts/context-router.test.ts
new file mode 100644
index 00000000..1e95d488
--- /dev/null
+++ b/packages/devtools/src/main/services/window-contexts/context-router.test.ts
@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import type { WebContents } from 'electron'
+import { createWindowContextRouter, type RoutableWindowContext } from './context-router.js'
+
+/** Minimal stand-in: the router only ever reads `sender` through the predicates. */
+function wc(id: number): WebContents {
+  return { id } as unknown as WebContents
+}
+
+/**
+ * A window context as the router sees it: it owns its own renderer, and its
+ * policy additionally accepts every id in the app-wide trusted-window map —
+ * the shape that makes a single-pass scan ambiguous.
+ */
+function makeContext(ownId: number, trusted: Set<number>): RoutableWindowContext {
+  const ownsSender = (sender: WebContents) => sender.id === ownId
+  return {
+    ownsSender,
+    senderPolicy: (sender: WebContents) => ownsSender(sender) || trusted.has(sender.id),
+  }
+}
+
+describe('window context router', () => {
+  it('routes each window renderer to its own context', () => {
+    const trusted = new Set<number>()
+    const router = createWindowContextRouter()
+    const first = makeContext(1, trusted)
+    const second = makeContext(2, trusted)
+    router.register(first)
+    router.register(second)
+
+    expect(router.resolve(wc(1))).toBe(first)
+    expect(router.resolve(wc(2))).toBe(second)
+  })
+
+  it('returns null for a sender no registered context accepts', () => {
+    const router = createWindowContextRouter()
+    router.register(makeContext(1, new Set()))
+
+    expect(router.resolve(wc(99))).toBeNull()
+  })
+
+  it('stops matching a context once it is unregistered', () => {
+    const router = createWindowContextRouter()
+    const first = makeContext(1, new Set())
+    const second = makeContext(2, new Set())
+    router.register(first)
+    const registration = router.register(second)
+
+    expect(router.resolve(wc(2))).toBe(second)
+    registration.dispose()
+
+    expect(router.resolve(wc(2))).toBeNull()
+    expect(router.list()).toEqual([first])
+  })
+
+  it('hands an app-wide trusted sender to the active context, not the first', () => {
+    const trusted = new Set<number>([50])
+    const router = createWindowContextRouter()
+    const first = makeContext(1, trusted)
+    const second = makeContext(2, trusted)
+    router.register(first)
+    router.register(second)
+
+    // Both policies accept 50; ownership decides who is answering right now.
+    router.setActive(second)
+    expect(router.resolve(wc(50))).toBe(second)
+
+    router.setActive(first)
+    expect(router.resolve(wc(50))).toBe(first)
+  })
+
+  it('answers an app-wide sender from the first registrant until a window is marked active', () => {
+    const trusted = new Set<number>([50])
+    const router = createWindowContextRouter()
+    const first = makeContext(1, trusted)
+    const second = makeContext(2, trusted)
+    router.register(first)
+    router.register(second)
+
+    // Nothing focused yet: registration order is the deterministic fallback,
+    // and resolving is a pure query that leaves it alone.
+    expect(router.active()).toBe(first)
+    expect(router.resolve(wc(2))).toBe(second)
+    expect(router.active()).toBe(first)
+    expect(router.resolve(wc(50))).toBe(first)
+  })
+
+  it('falls back to a still-registered context when the active one goes away', () => {
+    const router = createWindowContextRouter()
+    const first = makeContext(1, new Set())
+    const second = makeContext(2, new Set())
+    router.register(first)
+    const registration = router.register(second)
+    router.setActive(second)
+
+    registration.dispose()
+    expect(router.active()).toBe(first)
+  })
+
+  it('has no active context before anything registers', () => {
+    const router = createWindowContextRouter()
+    expect(router.active()).toBeNull()
+    expect(router.list()).toEqual([])
+  })
+
+  it('ignores setActive for a context it does not hold', () => {
+    const router = createWindowContextRouter()
+    const first = makeContext(1, new Set())
+    router.register(first)
+
+    router.setActive(makeContext(2, new Set()))
+    expect(router.active()).toBe(first)
+  })
+})
diff --git a/packages/devtools/src/main/services/window-contexts/context-router.ts b/packages/devtools/src/main/services/window-contexts/context-router.ts
new file mode 100644
index 00000000..3e060843
--- /dev/null
+++ b/packages/devtools/src/main/services/window-contexts/context-router.ts
@@ -0,0 +1,94 @@
+import type { WebContents } from 'electron'
+import { toDisposable, type Disposable } from '@dimina-kit/electron-deck/main'
+import type { IpcContextSource } from '../../utils/ipc-context-source.js'
+import type { SenderPolicy } from '../../utils/ipc-registry.js'
+
+/**
+ * What the router needs of a window context to place an incoming sender.
+ * Kept to these two predicates so the router stays independent of the rest of
+ * the context; the concrete context type is supplied by the caller.
+ */
+export interface RoutableWindowContext {
+  /** Every sender this window accepts, app-shared trusted windows included. */
+  senderPolicy: SenderPolicy
+  /** Only the senders this window structurally owns (see sender-policy.ts). */
+  ownsSender: SenderPolicy
+}
+
+/** Registry of live window contexts, and the authority on which one owns a sender. */
+export interface WindowContextRouter<T extends RoutableWindowContext = RoutableWindowContext>
+  extends IpcContextSource<T> {
+  /** Register a window context; the returned Disposable unregisters it. */
+  register(ctx: T): Disposable
+  /**
+   * The context owning `sender`, or null when no registered context claims it.
+   * A pure query: looking a sender up never changes which context is active.
+   */
+  resolve(sender: WebContents): T | null
+  /**
+   * The context last marked active by `setActive`. With none marked — or after
+   * the marked one unregisters — it falls back to the first still-registered
+   * context, and null when none are.
+   */
+  active(): T | null
+  /** Mark `ctx` active (on window focus). Ignored for unregistered contexts. */
+  setActive(ctx: T): void
+  list(): T[]
+}
+
+export function createWindowContextRouter<
+  T extends RoutableWindowContext = RoutableWindowContext,
+>(): WindowContextRouter<T> {
+  const contexts: T[] = []
+  let activeCtx: T | null = null
+
+  const first = (): T | null => contexts[0] ?? null
+
+  return {
+    register(ctx) {
+      contexts.push(ctx)
+      activeCtx ??= ctx
+      return toDisposable(() => {
+        const at = contexts.indexOf(ctx)
+        if (at === -1) return
+        contexts.splice(at, 1)
+        if (activeCtx === ctx) activeCtx = first()
+      })
+    },
+
+    resolve(sender) {
+      // Two passes, because the two predicates answer different questions.
+      // `senderPolicy` also accepts host windows registered through
+      // `registerTrustedWindow`, whose id map is app-wide — every context says
+      // yes to such a sender, so a single-pass scan would hand it to whichever
+      // window happened to register first. Pass one therefore only accepts a
+      // context that OWNS the sender (its own renderer, settings window or
+      // overlay views), which is unique by construction. Pass two covers the
+      // accepted-but-unowned senders that are left: they belong to the app
+      // rather than to a window, so the active window answers them.
+      //
+      // Neither pass moves "active": window focus is what decides which window
+      // an app-wide sender belongs to, and a background window handling its own
+      // IPC must not steal that answer from the focused one.
+      for (const ctx of contexts) {
+        if (ctx.ownsSender(sender)) return ctx
+      }
+      for (const ctx of contexts) {
+        if (ctx.senderPolicy(sender)) return activeCtx ?? first()
+      }
+      return null
+    },
+
+    active() {
+      return activeCtx ?? first()
+    },
+
+    setActive(ctx) {
+      if (contexts.includes(ctx)) activeCtx = ctx
+    },
+
+    list() {
+      return contexts.slice()
+    },
+  }
+}
diff --git a/packages/devtools/src/main/services/workbench-coi-host.test.ts b/packages/devtools/src/main/services/workbench-coi-host.test.ts
new file mode 100644
index 00000000..a27c437e
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-host.test.ts
@@ -0,0 +1,472 @@
+/**
+ * The shared-listener invariants of workbench-coi-host.ts: every project
+ * window backed by the same `rootDir`/`extensionsDir` lands on one origin
+ * (storage buckets by origin, not by window), each window's `/w/<token>/`
+ * prefix routes only to its own project, a torn-down window's prefix cannot
+ * be reused to reach another window's data, and the listener survives every
+ * window closing — closing a project and opening another must not move the
+ * origin. Only `closeAllCoiHosts` takes a listener down.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import fs from 'node:fs/promises'
+import http from 'node:http'
+import net from 'node:net'
+import os from 'node:os'
+import path from 'node:path'
+
+// startWorkbenchCoiServer pulls in `electron` transitively (project-fs →
+// ipc-registry's top-level `import { ipcMain } from 'electron'`). CI has no
+// Electron binary, so the unmocked import throws at module-eval; a no-op stub
+// is enough to let the module load without touching ipcMain.
+vi.mock('electron', () => ({ ipcMain: { handle: vi.fn(), removeHandler: vi.fn(), on: vi.fn(), off: vi.fn() } }))
+
+import { startWorkbenchCoiServer, type WorkbenchCoiServer } from './workbench-coi-server.js'
+import { closeAllCoiHosts, registerCoiHostSession, type CoiHostSession } from './workbench-coi-host.js'
+
+/** A minimal session whose `handle` always answers 200, for tests that only care about routing. */
+function okSession(): CoiHostSession {
+  return { handle: (_req, res) => { res.writeHead(200); res.end('ok') } }
+}
+
+/**
+ * Sends the exact wire path given, bypassing the URL normalization a `fetch`
+ * or `http.request({ path })` string might otherwise apply — needed to put a
+ * literal `//` or a stray `%` on the request line the way a crafted client
+ * would.
+ *
+ * A dropped connection resolves with `completed: false` rather than rejecting,
+ * because a destroyed response is an expected answer here — the only one left
+ * once a handler has already begun writing. `status` is then 0: no response
+ * was ever readable.
+ */
+function rawGet(port: number, rawPath: string): Promise<{ status: number; body: string; completed: boolean }> {
+  return new Promise((resolve) => {
+    const req = http.request({ host: '127.0.0.1', port, path: rawPath, method: 'GET' }, (res) => {
+      const chunks: Buffer[] = []
+      const settle = (completed: boolean) =>
+        resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString(), completed })
+      res.on('data', (c: Buffer) => chunks.push(c))
+      res.on('end', () => settle(true))
+      res.on('aborted', () => settle(false))
+      res.on('error', () => settle(false))
+    })
+    req.on('error', () => resolve({ status: 0, body: '', completed: false }))
+    req.end()
+  })
+}
+
+let tmpParent = ''
+let rootDir = ''
+let servers: WorkbenchCoiServer[] = []
+
+/** Starts a session on the shared host, tracked for automatic teardown. */
+async function open(opts: {
+  getProjectRoot: () => string
+  getProjectIdentity?: () => { appId: string | null; projectPath: string }
+}): Promise<WorkbenchCoiServer> {
+  const server = await startWorkbenchCoiServer({ rootDir, ...opts })
+  servers.push(server)
+  return server
+}
+
+/** Closes and un-tracks one session, so a later afterEach does not double-close it. */
+async function close(server: WorkbenchCoiServer): Promise<void> {
+  await server.close()
+  servers = servers.filter((s) => s !== server)
+}
+
+beforeEach(async () => {
+  tmpParent = await fs.mkdtemp(path.join(os.tmpdir(), 'coi-host-test-'))
+  rootDir = path.join(tmpParent, 'bundle')
+  await fs.mkdir(rootDir, { recursive: true })
+  await fs.writeFile(path.join(rootDir, 'index.html'), '<!doctype html>bundle')
+  servers = []
+})
+
+afterEach(async () => {
+  await Promise.all(servers.map((s) => s.close()))
+  servers = []
+  // A window's own close() deliberately leaves the listener up (see the
+  // module doc), so it takes a separate call to bring the port down between
+  // tests — otherwise every test after the first would find it already bound.
+  await closeAllCoiHosts()
+  await fs.rm(tmpParent, { recursive: true, force: true })
+})
+
+describe('shared origin across windows of the same bundle', () => {
+  it('gives two windows the same origin and port but distinct base URLs', async () => {
+    const a = await open({ getProjectRoot: () => '' })
+    const b = await open({ getProjectRoot: () => '' })
+
+    // Browser storage (IndexedDB, OPFS, Cache Storage, service worker
+    // registrations, Web Locks, BroadcastChannel) is keyed by origin —
+    // scheme + host + PORT. Two windows on different ports are two windows
+    // that can never see each other's storage, so a window that closes and
+    // reopens the same project would find its VS Code workspace memento gone
+    // even though nothing was ever deleted.
+    expect(new URL(a.baseUrl).origin).toBe(new URL(b.baseUrl).origin)
+    expect(a.port).toBe(b.port)
+    expect(a.baseUrl).not.toBe(b.baseUrl)
+  })
+})
+
+describe('per-window routing on the shared listener', () => {
+  it('routes each window to its own project root and its own /__project identity', async () => {
+    const projectA = path.join(tmpParent, 'project-a')
+    const projectB = path.join(tmpParent, 'project-b')
+    await fs.mkdir(projectA, { recursive: true })
+    await fs.mkdir(projectB, { recursive: true })
+    await fs.writeFile(path.join(projectA, 'shared-name.txt'), 'from A')
+    await fs.writeFile(path.join(projectB, 'shared-name.txt'), 'from B')
+
+    const a = await open({
+      getProjectRoot: () => projectA,
+      getProjectIdentity: () => ({ appId: 'wx-a', projectPath: projectA }),
+    })
+    const b = await open({
+      getProjectRoot: () => projectB,
+      getProjectIdentity: () => ({ appId: 'wx-b', projectPath: projectB }),
+    })
+
+    const fileA = await fetch(`${a.baseUrl}__fs/read?p=shared-name.txt`)
+    const fileB = await fetch(`${b.baseUrl}__fs/read?p=shared-name.txt`)
+    expect(await fileA.text()).toBe('from A')
+    expect(await fileB.text()).toBe('from B')
+
+    const projectIdA = (await (await fetch(`${a.baseUrl}__project`)).json()) as { workspaceId: string | null }
+    const projectIdB = (await (await fetch(`${b.baseUrl}__project`)).json()) as { workspaceId: string | null }
+    expect(projectIdA.workspaceId).toBeTruthy()
+    expect(projectIdB.workspaceId).toBeTruthy()
+    expect(projectIdA.workspaceId).not.toBe(projectIdB.workspaceId)
+  })
+})
+
+describe('a released window prefix is not reused for another window', () => {
+  it('answers 404 — never window B\'s data — once window A has closed', async () => {
+    const projectA = path.join(tmpParent, 'project-a')
+    const projectB = path.join(tmpParent, 'project-b')
+    await fs.mkdir(projectA, { recursive: true })
+    await fs.mkdir(projectB, { recursive: true })
+    await fs.writeFile(path.join(projectB, 'note.txt'), 'B secret')
+
+    const a = await open({ getProjectRoot: () => projectA })
+    // Kept alive (unused beyond registering) so the host has another live
+    // session — the case this guards against is a stale token being handed
+    // ANOTHER window's data, not merely "no windows left".
+    const _b = await open({
+      getProjectRoot: () => projectB,
+      getProjectIdentity: () => ({ appId: 'wx-b', projectPath: projectB }),
+    })
+    const staleBaseUrl = a.baseUrl
+    await close(a)
+
+    const fsRes = await fetch(`${staleBaseUrl}__fs/read?p=note.txt`)
+    expect(fsRes.status).toBe(404)
+    expect(await fsRes.text()).not.toContain('B secret')
+
+    const projectRes = await fetch(`${staleBaseUrl}__project`)
+    expect(projectRes.status).toBe(404)
+
+    // A stale prefix has no live session for ANY path under it, not just the
+    // bridge endpoints — it must not quietly fall back to serving the shared
+    // bundle either, or a closed window's URL would keep looking "alive".
+    const assetRes = await fetch(`${staleBaseUrl}index.html`)
+    expect(assetRes.status).toBe(404)
+  })
+})
+
+describe('closing one window does not disturb another', () => {
+  it('keeps window B serving after window A closes', async () => {
+    const projectA = path.join(tmpParent, 'project-a')
+    const projectB = path.join(tmpParent, 'project-b')
+    await fs.mkdir(projectA, { recursive: true })
+    await fs.mkdir(projectB, { recursive: true })
+    await fs.writeFile(path.join(projectB, 'note.txt'), 'still here')
+
+    const a = await open({ getProjectRoot: () => projectA })
+    const b = await open({ getProjectRoot: () => projectB })
+    await close(a)
+
+    const res = await fetch(`${b.baseUrl}__fs/read?p=note.txt`)
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe('still here')
+  })
+})
+
+describe('the shared listener survives the last window closing', () => {
+  it('gives the next window the same origin and port a closed window used, reachable through its own prefix', async () => {
+    const a = await open({ getProjectRoot: () => '' })
+    const originA = new URL(a.baseUrl).origin
+    const portA = a.port
+
+    // Closing every window (down to zero) is an ordinary project switch, not
+    // process shutdown — the fix this guards is the listener (and therefore
+    // the origin) being torn down here and the next window landing on a
+    // fresh port, which would strand the previous project's IndexedDB state
+    // on an origin nothing will ever visit again.
+    await close(a)
+
+    const b = await open({ getProjectRoot: () => '' })
+    expect(new URL(b.baseUrl).origin).toBe(originA)
+    expect(b.port).toBe(portA)
+
+    const res = await fetch(`${b.baseUrl}index.html`)
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe('<!doctype html>bundle')
+  })
+})
+
+describe('closeAllCoiHosts', () => {
+  it('refuses new connections on the port once called, even with a session still registered', async () => {
+    const a = await open({ getProjectRoot: () => '' })
+    const port = a.port
+
+    await closeAllCoiHosts()
+
+    await new Promise<void>((resolve, reject) => {
+      const socket = net.connect({ host: '127.0.0.1', port }, () => {
+        socket.destroy()
+        reject(new Error('connected to a port that should have been released'))
+      })
+      socket.on('error', () => resolve())
+    })
+  })
+
+  it('lets the next window start a fresh listener that serves normally', async () => {
+    // Registered but otherwise unused — closeAllCoiHosts must tear the host
+    // down even with a live session on it, not only when the last window has
+    // already released.
+    const _a = await open({ getProjectRoot: () => '' })
+    await closeAllCoiHosts()
+
+    const b = await open({ getProjectRoot: () => '' })
+    const res = await fetch(`${b.baseUrl}index.html`)
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe('<!doctype html>bundle')
+  })
+})
+
+describe('bridge endpoints require the window prefix; the bundle does not', () => {
+  it('answers 404 to /__fs, /__project and /__filetypes with no /w/<token> prefix', async () => {
+    const a = await open({ getProjectRoot: () => '' })
+    const origin = new URL(a.baseUrl).origin
+
+    const results = await Promise.all(
+      ['/__fs/read?p=x', '/__project', '/__filetypes'].map((p) => fetch(origin + p)),
+    )
+    for (const res of results) expect(res.status).toBe(404)
+  })
+
+  it('still serves the bundle itself with no window prefix (project-independent asset)', async () => {
+    const a = await open({ getProjectRoot: () => '' })
+    const origin = new URL(a.baseUrl).origin
+
+    const res = await fetch(`${origin}/index.html`)
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe('<!doctype html>bundle')
+  })
+})
+
+describe('cross-origin-isolation headers on the shared listener', () => {
+  it('sends COOP same-origin + COEP require-corp + CORP same-origin on both prefixed and bare-origin responses', async () => {
+    const a = await open({ getProjectRoot: () => '' })
+    const origin = new URL(a.baseUrl).origin
+
+    const prefixed = await fetch(`${a.baseUrl}__filetypes`)
+    const bare = await fetch(`${origin}/index.html`)
+    for (const res of [prefixed, bare]) {
+      expect(res.headers.get('cross-origin-opener-policy')).toBe('same-origin')
+      expect(res.headers.get('cross-origin-embedder-policy')).toBe('require-corp')
+      expect(res.headers.get('cross-origin-resource-policy')).toBe('same-origin')
+    }
+  })
+
+  it('still carries the isolation headers on a 404 response', async () => {
+    // setIsolationHeaders runs before any routing decision, so even a path
+    // nothing serves must carry it — a 404 that dropped isolation would break
+    // the workbench's SharedArrayBuffer gate the moment a request 404s.
+    const a = await open({ getProjectRoot: () => '' })
+    const res = await fetch(`${a.baseUrl}no-such-file.js`)
+    expect(res.status).toBe(404)
+    expect(res.headers.get('cross-origin-opener-policy')).toBe('same-origin')
+    expect(res.headers.get('cross-origin-embedder-policy')).toBe('require-corp')
+    expect(res.headers.get('cross-origin-resource-policy')).toBe('same-origin')
+  })
+})
+
+describe('prefix stripping copies the URL instead of re-parsing the remainder', () => {
+  it('keeps a `//` remainder as a literal pathname rather than reading it as an authority', async () => {
+    let captured: URL | null = null
+    const session: CoiHostSession = {
+      handle: (_req, res, url) => { captured = url; res.writeHead(200); res.end('ok') },
+    }
+    const reg = await registerCoiHostSession({ rootDir, extensionsDir: null, session })
+
+    // `/w/<token>//__project?x=1`: re-parsing `//__project?x=1` as a URL
+    // reference would read the leading `//` as a network-path authority,
+    // turning `__project` into the host and collapsing pathname to `/`.
+    const res = await rawGet(reg.port, `/w/${reg.token}//__project?x=1`)
+    expect(res.status).toBe(200)
+    expect(captured).not.toBeNull()
+    expect(captured!.pathname).toBe('//__project')
+    expect(captured!.search).toBe('?x=1')
+    expect(captured!.host).toBe('127.0.0.1')
+
+    await reg.release()
+  })
+
+  it('preserves the query string on an ordinary single-slash path', async () => {
+    let captured: URL | null = null
+    const session: CoiHostSession = {
+      handle: (_req, res, url) => { captured = url; res.writeHead(200); res.end('ok') },
+    }
+    const reg = await registerCoiHostSession({ rootDir, extensionsDir: null, session })
+
+    const res = await rawGet(reg.port, `/w/${reg.token}/__project?x=1`)
+    expect(res.status).toBe(200)
+    expect(captured!.pathname).toBe('/__project')
+    expect(captured!.search).toBe('?x=1')
+
+    await reg.release()
+  })
+})
+
+describe('malformed percent-encoding with no window prefix', () => {
+  it('answers 400 rather than crashing the request handler, and the listener keeps serving', async () => {
+    const reg = await registerCoiHostSession({ rootDir, extensionsDir: null, session: okSession() })
+
+    // A bare '%' fails decodeURIComponent; unprefixed paths are the ones
+    // workbench-coi-host.ts decodes itself (routed paths are forwarded raw).
+    const bad = await rawGet(reg.port, '/%')
+    expect(bad.status).toBe(400)
+
+    // The throw must not have taken the shared listener down with it.
+    const ok = await rawGet(reg.port, `/w/${reg.token}/still-alive`)
+    expect(ok.status).toBe(200)
+
+    await reg.release()
+  })
+})
+
+describe('a session handler that throws while forwarding a routed request', () => {
+  it('answers 500 and logs it, because a handler answers its own client errors', async () => {
+    // A window handler decodes and rejects the client's own mistakes itself (a
+    // stray '%' is answered 400 inside the session), so a throw that reaches
+    // the shared listener is a defect in that handler. A silent 400 here would
+    // read as the caller's fault and hide the bug for good.
+    const throwing: CoiHostSession = {
+      handle: () => { throw new Error('defect in the window handler') },
+    }
+    const bad = await registerCoiHostSession({ rootDir, extensionsDir: null, session: throwing })
+    const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    try {
+      const res = await rawGet(bad.port, `/w/${bad.token}/whatever`)
+      expect(res.status).toBe(500)
+      expect(res.body).toBe('Internal Server Error')
+      expect(logged).toHaveBeenCalled()
+    } finally {
+      // Restored inside the test rather than from an afterEach, so no later
+      // test in this file runs with console.error swallowed.
+      logged.mockRestore()
+    }
+
+    // A second session on the same shared host — not just another path
+    // through the session that threw — proves the listener itself survived,
+    // not merely that the throwing session recovered.
+    const good = await registerCoiHostSession({ rootDir, extensionsDir: null, session: okSession() })
+    const ok = await rawGet(good.port, `/w/${good.token}/ping`)
+    expect(ok.status).toBe(200)
+
+    await bad.release()
+    await good.release()
+  })
+
+  it('destroys the response when the throw lands after the header is already sent', async () => {
+    // Nothing can be turned into a 500 once the header has been written —
+    // writing a second one throws again, inside the boundary that exists to
+    // catch throws, and the response would then be left hanging on a
+    // Content-Length it never satisfies. Dropping the connection is the only
+    // answer left, and it is what a client sees for any interrupted response.
+    const throwing: CoiHostSession = {
+      handle: (_req, res) => {
+        res.writeHead(200, { 'Content-Length': '32' })
+        res.write('partial')
+        throw new Error('defect after the header went out')
+      },
+    }
+    const bad = await registerCoiHostSession({ rootDir, extensionsDir: null, session: throwing })
+    const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    try {
+      const res = await rawGet(bad.port, `/w/${bad.token}/whatever`)
+      expect(res.completed).toBe(false)
+      expect(res.body).not.toContain('Internal Server Error')
+      expect(logged).toHaveBeenCalled()
+    } finally {
+      logged.mockRestore()
+    }
+
+    const good = await registerCoiHostSession({ rootDir, extensionsDir: null, session: okSession() })
+    const ok = await rawGet(good.port, `/w/${good.token}/ping`)
+    expect(ok.status).toBe(200)
+
+    await bad.release()
+    await good.release()
+  })
+})
+
+describe('host cache key does not collide on a naive pipe-joined key', () => {
+  it('gives two (rootDir, extensionsDir) pairs that would collide as `a|b` distinct hosts', async () => {
+    const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'coi-key-test-'))
+    const a = path.join(tmp, 'a')
+    const b = path.join(tmp, 'b')
+    const c = path.join(tmp, 'c')
+    await fs.mkdir(a, { recursive: true })
+    await fs.mkdir(b, { recursive: true })
+    await fs.mkdir(c, { recursive: true })
+
+    // Naively joined with '|' (`rootDir + '|' + extensionsDir`) these two
+    // pairs both serialize to the same string `<a>|<b>|<c>` and would collide
+    // onto one host — the second bundle would read the first bundle's files.
+    const reg1 = await registerCoiHostSession({ rootDir: a, extensionsDir: `${b}|${c}`, session: okSession() })
+    const reg2 = await registerCoiHostSession({ rootDir: `${a}|${b}`, extensionsDir: c, session: okSession() })
+
+    expect(reg1.port).not.toBe(reg2.port)
+
+    await reg1.release()
+    await reg2.release()
+    await fs.rm(tmp, { recursive: true, force: true })
+  })
+})
+
+describe('closeAllCoiHosts gate on registration', () => {
+  it('waits out a concurrent full close instead of handing back an origin about to die', async () => {
+    const first = await registerCoiHostSession({ rootDir, extensionsDir: null, session: okSession() })
+    const firstPort = first.port
+
+    // closeAllCoiHosts runs synchronously up to its first await (setting the
+    // `closingAll` gate) before this expression yields, so registration
+    // deterministically observes the gate already up rather than racing it.
+    const [, second] = await Promise.all([
+      closeAllCoiHosts(),
+      registerCoiHostSession({ rootDir, extensionsDir: null, session: okSession() }),
+    ])
+
+    // A fresh host, not a reuse of the one that just went down.
+    expect(second.port).not.toBe(firstPort)
+
+    const res = await rawGet(second.port, `/w/${second.token}/ping`)
+    expect(res.status).toBe(200)
+
+    await second.release()
+  })
+
+  it('does not throw when closeAllCoiHosts is called concurrently more than once', async () => {
+    await registerCoiHostSession({ rootDir, extensionsDir: null, session: okSession() })
+
+    await expect(
+      Promise.all([closeAllCoiHosts(), closeAllCoiHosts(), closeAllCoiHosts()]),
+    ).resolves.toBeDefined()
+  })
+})
diff --git a/packages/devtools/src/main/services/workbench-coi-host.ts b/packages/devtools/src/main/services/workbench-coi-host.ts
new file mode 100644
index 00000000..0afff28b
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-host.ts
@@ -0,0 +1,251 @@
+/**
+ * The single http listener behind every project window's workbench bridge.
+ *
+ * Browser storage is keyed by ORIGIN: IndexedDB, OPFS, Cache Storage, service
+ * worker registrations, Web Locks and BroadcastChannel all live in a bucket
+ * named after scheme + host + PORT. A listener bound to port 0 gets a different
+ * port every time, so one http server per project window put every window on
+ * its own origin — the VS Code workspace- and global-scope mementos a window
+ * wrote (open editors, view state, explorer expansion) died with it, reopening
+ * the same project minted a fresh empty bucket, and each new port accumulated
+ * another service-worker registration and cache entry that nothing reclaimed.
+ *
+ * So the listener is shared by every window in the process and a window's
+ * bridge is addressed by an opaque path prefix (`/w/<token>/`) rather than by
+ * port: one origin for all workbenches, distinct `/__fs` + `/__project`
+ * routing per window. The prefix is routing, not a security boundary — pages
+ * on one origin can already reach each other's paths, which is the situation
+ * the app-wide server had before per-project windows existed.
+ *
+ * The listener also outlives the last window that used it, because closing
+ * every project and opening another one is an ordinary switch and must not
+ * move the origin. Only {@link closeAllCoiHosts} takes a listener down.
+ */
+import http from 'node:http'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { serveStaticFile, setIsolationHeaders } from './workbench-coi-static.js'
+import { createCoiServerShutdown, type CoiServerShutdown } from './workbench-coi-shutdown.js'
+
+export interface CoiHostSession {
+  /**
+   * Answers one request for this window. `url` has already had the window's
+   * `/w/<token>` prefix stripped, so the handler sees the same pathnames it
+   * would on a server of its own.
+   */
+  handle: (req: http.IncomingMessage, res: http.ServerResponse, url: URL) => void
+}
+
+export interface CoiHostRegistration {
+  /** Scheme + host + port of the shared listener, with no trailing slash. */
+  origin: string
+  port: number
+  /** The path segment that routes to this session. */
+  token: string
+  /** Drops the route, closing the shared listener when the last one goes. */
+  release: () => Promise<void>
+}
+
+interface Host {
+  server: http.Server
+  origin: string
+  port: number
+  rootDir: string
+  sessions: Map<string, CoiHostSession>
+  shutdown: CoiServerShutdown
+  closed: boolean
+}
+
+/**
+ * Tear down every listener. For process shutdown and for test isolation — a
+ * window's own teardown never gets here, because the origin has to survive it.
+ */
+export async function closeAllCoiHosts(): Promise<void> {
+  if (closingAll) return closingAll
+  const pending = [...hosts.values()]
+  hosts.clear()
+  const run = (async () => {
+    await Promise.all(
+      pending.map(async (p) => {
+        const host = await p.catch(() => null)
+        if (!host || host.closed) return
+        host.closed = true
+        await host.shutdown.close(host.server)
+      }),
+    )
+  })()
+  closingAll = run
+  try {
+    await run
+  } finally {
+    if (closingAll === run) closingAll = null
+  }
+}
+
+/**
+ * One host per bundle + extensions pair. Two hosts serving different bundles
+ * are genuinely different servers; every window of one app shares one entry.
+ */
+const hosts = new Map<string, Promise<Host>>()
+
+/**
+ * In-flight {@link closeAllCoiHosts}. A registration that was already waiting
+ * on `createHost` when a global close began must not hand its window an origin
+ * that close is about to take away, so it waits here and starts a fresh host.
+ */
+let closingAll: Promise<void> | null = null
+
+const WINDOW_PREFIX = /^\/w\/([A-Za-z0-9-]+)(\/.*)?$/
+
+function notFound(res: http.ServerResponse): void {
+  res.writeHead(404)
+  res.end('Not Found')
+}
+
+function badRequest(res: http.ServerResponse): void {
+  res.writeHead(400)
+  res.end('Bad Request')
+}
+
+function serverError(res: http.ServerResponse): void {
+  res.writeHead(500)
+  res.end('Internal Server Error')
+}
+
+async function createHost(rootDir: string): Promise<Host> {
+  const sessions = new Map<string, CoiHostSession>()
+  const shutdown = createCoiServerShutdown()
+  const server = http.createServer((req, res) => {
+    setIsolationHeaders(res)
+    let url: URL
+    try {
+      url = new URL(req.url ?? '/', 'http://127.0.0.1')
+    } catch {
+      // A malformed request line must not become an uncaught exception in the
+      // main process.
+      badRequest(res)
+      return
+    }
+    const routed = WINDOW_PREFIX.exec(url.pathname)
+    if (routed) {
+      const session = sessions.get(routed[1]!)
+      // A request for a window that has already been torn down. 404 rather
+      // than fall through to the bundle: the caller asked for one specific
+      // window's bridge, and answering with another window's data would be
+      // worse than not answering.
+      if (!session) { notFound(res); return }
+      // Strip the prefix by rewriting `pathname` on a copy. Re-parsing the
+      // remainder as a URL reference would read a leading `//` as an authority,
+      // so `/w/<token>//__project` would arrive as `/` on host `__project`.
+      const forwarded = new URL(url)
+      forwarded.pathname = routed[2] || '/'
+      try {
+        session.handle(req, res, forwarded)
+      } catch (err) {
+        // One window's handler must not take the shared listener's process
+        // with it — an uncaught exception here would end every other project
+        // window too. A handler answers its own client errors (a malformed
+        // percent escape, say), so anything reaching this point is a defect in
+        // it: 500 rather than 400, and logged, because a silent 400 would read
+        // as the caller's fault and hide the bug for good.
+        console.error('[workbench-coi] session handler threw', err)
+        if (res.headersSent) res.destroy()
+        else serverError(res)
+      }
+      return
+    }
+    // No window prefix. Every bridge endpoint has to know WHICH window asked,
+    // so answering one here would mean guessing a project — the ambiguity the
+    // prefix exists to remove. The bundle itself is project-independent and is
+    // still served, so an absolute asset URL inside it keeps working.
+    if (url.pathname.startsWith('/__')) { notFound(res); return }
+    let decoded: string
+    try {
+      decoded = decodeURIComponent(url.pathname)
+    } catch {
+      // A stray `%` in the path. Answering 400 keeps the listener alive; the
+      // throw would otherwise escape the request handler.
+      badRequest(res)
+      return
+    }
+    shutdown.trackRequest(res)
+    serveStaticFile(res, rootDir, decoded)
+  })
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => {
+      server.off('error', reject)
+      resolve()
+    })
+  })
+  const addr = server.address()
+  const port = typeof addr === 'object' && addr ? addr.port : 0
+  return {
+    server,
+    origin: `http://127.0.0.1:${port}`,
+    port,
+    rootDir,
+    sessions,
+    shutdown,
+    closed: false,
+  }
+}
+
+export async function registerCoiHostSession(opts: {
+  rootDir: string
+  extensionsDir: string | null
+  session: CoiHostSession
+}): Promise<CoiHostRegistration> {
+  const rootDir = path.resolve(opts.rootDir)
+  // JSON, not a separator character: `('/a', '/b|/c')` and `('/a|/b', '/c')`
+  // are both legal path pairs and would otherwise collide onto one host, so two
+  // different bundles would serve each other's files.
+  const key = JSON.stringify([rootDir, opts.extensionsDir ?? null])
+  // Loop rather than a single lookup: a release running concurrently can have
+  // marked the cached host closed without having removed it yet, and joining a
+  // closing server would hand back a dead origin.
+  for (;;) {
+    if (closingAll) {
+      await closingAll
+      continue
+    }
+    let pending = hosts.get(key)
+    if (!pending) {
+      pending = createHost(rootDir)
+      hosts.set(key, pending)
+    }
+    let host: Host
+    try {
+      host = await pending
+    } catch (err) {
+      if (hosts.get(key) === pending) hosts.delete(key)
+      throw err
+    }
+    // `closingAll` is re-checked because it can have started while this
+    // registration was awaiting `pending`: the host may still read as open and
+    // yet be one `await` away from losing its port.
+    if (host.closed || closingAll || hosts.get(key) !== pending) {
+      if (hosts.get(key) === pending) hosts.delete(key)
+      continue
+    }
+    const token = randomUUID()
+    host.sessions.set(token, opts.session)
+    let released = false
+    return {
+      origin: host.origin,
+      port: host.port,
+      token,
+      release: async () => {
+        if (released) return
+        released = true
+        host.sessions.delete(token)
+        // The listener deliberately stays up with no windows on it. Closing it
+        // would release the port, and the next window would bind a different
+        // one — a different origin, so the storage the closed window wrote
+        // would be unreachable. Closing the last project and opening another
+        // is the ordinary way to switch projects, so the origin has to hold
+        // for the life of the process, not just while a window is open.
+      },
+    }
+  }
+}
diff --git a/packages/devtools/src/main/services/workbench-coi-server-decode.test.ts b/packages/devtools/src/main/services/workbench-coi-server-decode.test.ts
new file mode 100644
index 00000000..62e4d6bf
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-server-decode.test.ts
@@ -0,0 +1,109 @@
+/**
+ * Which layer answers a malformed request path.
+ *
+ * A window's bridge is a route on a listener shared with every other project
+ * window, and that listener wraps the route in an exception boundary it cannot
+ * see through: a throw arriving there could be anything, so it can only log it
+ * and answer 500. A stray `%` in a path is not that — it is the client's own
+ * mistake, recognizable as such only inside the handler that decodes it. So
+ * the handler decodes and answers 400 itself, and a 500 (or a logged throw)
+ * for one of these paths would mean the layering broke.
+ *
+ * Split from workbench-coi-server.test.ts to keep both files under the
+ * file-length gate.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import fs from 'node:fs/promises'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+
+// The COI server pulls in `electron` transitively (project-fs → ipc-registry's
+// top-level `import { ipcMain } from 'electron'`). CI has no Electron binary, so
+// the unmocked import throws at module-eval. The server never touches ipcMain;
+// a no-op stub is enough to let the module load.
+vi.mock('electron', () => ({ ipcMain: { handle: vi.fn(), removeHandler: vi.fn(), on: vi.fn(), off: vi.fn() } }))
+
+import { startWorkbenchCoiServer, type WorkbenchCoiServer } from './workbench-coi-server.js'
+import { closeAllCoiHosts } from './workbench-coi-host.js'
+
+let tmpParent = ''
+let server: WorkbenchCoiServer | null = null
+
+/**
+ * Sends the exact wire path given: `fetch` will not carry a lone '%' through
+ * to the request line the way a crafted client does.
+ */
+function rawGet(port: number, rawPath: string): Promise<{ status: number; body: string }> {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: rawPath, method: 'GET' }, (res) => {
+      const chunks: Buffer[] = []
+      res.on('data', (c: Buffer) => chunks.push(c))
+      res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString() }))
+    })
+    req.on('error', reject)
+    req.end()
+  })
+}
+
+beforeEach(async () => {
+  tmpParent = await fs.mkdtemp(path.join(os.tmpdir(), 'coi-decode-test-'))
+  await fs.mkdir(path.join(tmpParent, 'bundle'), { recursive: true })
+  await fs.mkdir(path.join(tmpParent, 'extensions'), { recursive: true })
+  await fs.writeFile(path.join(tmpParent, 'bundle', 'index.html'), '<!doctype html>ok')
+  server = null
+})
+
+afterEach(async () => {
+  if (server) {
+    await server.close()
+    server = null
+  }
+  // A window's close deliberately leaves the shared listener up, so it takes a
+  // separate call to release the port between tests.
+  await closeAllCoiHosts()
+  await fs.rm(tmpParent, { recursive: true, force: true })
+})
+
+describe('malformed percent-encoding on a static path inside the window prefix', () => {
+  it('answers 400 from the handler itself, without reaching the shared listener boundary', async () => {
+    server = await startWorkbenchCoiServer({
+      rootDir: path.join(tmpParent, 'bundle'),
+      getProjectRoot: () => '',
+      // Set so `/__contrib/` reaches its static-file branch; with no
+      // extensions dir it would 404 before decoding anything.
+      extensionsDir: path.join(tmpParent, 'extensions'),
+    })
+    const logged = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+    try {
+      const prefix = new URL(server.baseUrl).pathname
+      // The two paths the handler decodes: contributed extension files and the
+      // workbench bundle fallback.
+      for (const suffix of ['%', '__contrib/%']) {
+        const res = await rawGet(server.port, prefix + suffix)
+        expect(res.status).toBe(400)
+        expect(res.body).toBe('Bad Request')
+      }
+      // A 500, or anything logged, would mean the throw escaped to the shared
+      // listener, which cannot tell a bad request from a bug in this handler.
+      expect(logged).not.toHaveBeenCalled()
+    } finally {
+      logged.mockRestore()
+    }
+  })
+
+  it('keeps serving well-formed paths on the same window after a rejected one', async () => {
+    server = await startWorkbenchCoiServer({
+      rootDir: path.join(tmpParent, 'bundle'),
+      getProjectRoot: () => '',
+    })
+    const prefix = new URL(server.baseUrl).pathname
+
+    expect((await rawGet(server.port, `${prefix}%`)).status).toBe(400)
+
+    const ok = await rawGet(server.port, `${prefix}index.html`)
+    expect(ok.status).toBe(200)
+    expect(ok.body).toBe('<!doctype html>ok')
+  })
+})
diff --git a/packages/devtools/src/main/services/workbench-coi-server.test.ts b/packages/devtools/src/main/services/workbench-coi-server.test.ts
index 798f33ab..ad718d1e 100644
--- a/packages/devtools/src/main/services/workbench-coi-server.test.ts
+++ b/packages/devtools/src/main/services/workbench-coi-server.test.ts
@@ -7,6 +7,7 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import fs from 'node:fs/promises'
+import http from 'node:http'
 import os from 'node:os'
 import path from 'node:path'
 
@@ -332,3 +333,134 @@ describe('symlink containment on /__contrib', () => {
     expect(await pkgRes.text()).toContain('"name":"ext"')
   })
 })
+
+describe('503 on new requests once the window has begun closing', () => {
+  it('serves normally before close() and refuses new requests with 503 once closing starts', async () => {
+    // getProjectRoot is read on every /__fs request, including the sanity GET
+    // below — so the "being served" signal has to single out the SECOND call
+    // (the write), or it fires early and close() races ahead of the write
+    // ever being tracked as in flight.
+    let calls = 0
+    let serving: () => void = () => {}
+    const beingServed = new Promise<void>((resolve) => { serving = resolve })
+    server = await startWorkbenchCoiServer({
+      rootDir,
+      getProjectRoot: () => { calls += 1; if (calls === 2) serving(); return activeProjectRoot },
+    })
+
+    const before = await fetch(`${server.baseUrl}__fs/readdir?p=.`)
+    expect(before.status).toBe(200)
+
+    // Keep a write in flight (headers sent, body withheld) so `drain()` has
+    // something to wait on: with nothing in flight it resolves synchronously
+    // and releases the window's route before a next request could observe
+    // `closing`, undershooting the window this guards.
+    const saveUrl = new URL('__fs/write?p=held.txt', server.baseUrl)
+    const save = http.request({
+      host: '127.0.0.1',
+      port: server.port,
+      path: saveUrl.pathname + saveUrl.search,
+      method: 'POST',
+      headers: { 'Content-Length': '4' },
+    })
+    save.on('error', () => {})
+    save.write('ab')
+    await beingServed
+
+    try {
+      // shutdown.drain() flips `closing` synchronously before its first
+      // await (see workbench-coi-shutdown.ts), so this observes the flip
+      // deterministically rather than racing it.
+      const closingPromise = server.close()
+      const after = await fetch(`${server.baseUrl}__fs/readdir?p=.`)
+      expect(after.status).toBe(503)
+
+      save.end('cd')
+      await closingPromise
+    } finally {
+      save.destroy()
+    }
+    server = null
+  })
+})
+
+/**
+ * A window's bridge is a route on the shared COI host, and the window cannot
+ * finish closing until that route is drained and dropped. `/__fs/watch` is an
+ * SSE stream that never ends on its own, so shutdown has to be driven by the
+ * side that is going away — without taking a save that is still arriving down
+ * with it.
+ *
+ * These reach the bridge over a raw `http.request` (a `fetch` cannot leave a
+ * body half-sent), so they have to spell out the window path prefix that
+ * `baseUrl` carries.
+ */
+describe('shutting the server down with connections still open', () => {
+  it('does not wait for a watch stream to disconnect first', async () => {
+    // The handler reads the project root as it starts, so this is the signal
+    // that the request is being served — the stream sends no response until the
+    // first file change, and a `fetch` would still be waiting for headers.
+    let serving: () => void = () => {}
+    const beingServed = new Promise<void>((resolve) => { serving = resolve })
+    server = await startWorkbenchCoiServer({
+      rootDir,
+      getProjectRoot: () => { serving(); return activeProjectRoot },
+    })
+
+    const watchUrl = new URL('__fs/watch', server.baseUrl)
+    const watch = http.request({ host: '127.0.0.1', port: server.port, path: watchUrl.pathname })
+    watch.on('error', () => {})
+    watch.end()
+    await beingServed
+
+    try {
+      const closed = server.close().then(() => 'closed' as const)
+      const hung = new Promise<'hung'>((resolve) => setTimeout(() => resolve('hung'), 3000))
+      expect(
+        await Promise.race([closed, hung]),
+        'a client that never disconnects on its own would otherwise hold the window open for as long as it lives',
+      ).toBe('closed')
+    } finally {
+      watch.destroy()
+    }
+    // Longer than the race above, so a shutdown that hangs reports the
+    // assertion rather than a bare test timeout.
+  }, 15_000)
+
+  it('lets a save that is still uploading reach disk', async () => {
+    let serving: () => void = () => {}
+    const beingServed = new Promise<void>((resolve) => { serving = resolve })
+    server = await startWorkbenchCoiServer({
+      rootDir,
+      getProjectRoot: () => { serving(); return activeProjectRoot },
+    })
+
+    const body = Buffer.from('the edit the user just made\n'.repeat(64))
+    const saveUrl = new URL('__fs/write?p=saved.txt', server.baseUrl)
+    const save = http.request({
+      host: '127.0.0.1',
+      port: server.port,
+      path: saveUrl.pathname + saveUrl.search,
+      method: 'POST',
+      headers: { 'Content-Length': String(body.length) },
+    })
+    save.on('error', () => {})
+    // Headers first, body second — that split is where an editor save is when
+    // the window closes underneath it.
+    save.write(body.subarray(0, 16))
+    await beingServed
+
+    try {
+      const closed = server.close()
+      save.end(body.subarray(16))
+      await closed
+
+      expect(
+        await fs.readFile(path.join(projectRoot, 'saved.txt'), 'utf8'),
+        'taking the sockets the moment shutdown starts would discard the file the user just saved',
+      ).toBe(body.toString())
+    } finally {
+      save.destroy()
+    }
+  }, 15_000)
+})
diff --git a/packages/devtools/src/main/services/workbench-coi-server.ts b/packages/devtools/src/main/services/workbench-coi-server.ts
index 717ca037..78d3328c 100644
--- a/packages/devtools/src/main/services/workbench-coi-server.ts
+++ b/packages/devtools/src/main/services/workbench-coi-server.ts
@@ -33,7 +33,6 @@
  * of compile state; see {@link handleFsWatchRequest}.
  */
 import http from 'node:http'
-import nodeFs from 'node:fs'
 import fs from 'node:fs/promises'
 import path from 'node:path'
 import {
@@ -47,6 +46,9 @@ import {
   SKIP_DIRS,
 } from '../ipc/project-fs.js'
 import { handleFsWatchRequest } from './fs-watch-sse.js'
+import { createCoiServerShutdown } from './workbench-coi-shutdown.js'
+import { serveStaticFile } from './workbench-coi-static.js'
+import { registerCoiHostSession } from './workbench-coi-host.js'
 import { FS_TYPE_DIR, FS_TYPE_FILE, toFsBridgeEntry } from './fs-bridge-protocol.js'
 import type { FsBridgeStat } from './fs-bridge-protocol.js'
 import { jsonRes } from './http-json.js'
@@ -55,65 +57,6 @@ import { miniappPartitionKey } from './views/miniapp-partition.js'
 /** Max `/__fs/write` body; enough to save large source files without OOM. */
 const MAX_FS_WRITE_BYTES = 32 * 1024 * 1024
 
-const MIME: Record<string, string> = {
-  '.html': 'text/html; charset=utf-8',
-  '.js': 'text/javascript; charset=utf-8',
-  '.mjs': 'text/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
-  '.json': 'application/json; charset=utf-8',
-  '.map': 'application/json; charset=utf-8',
-  '.wasm': 'application/wasm',
-  '.svg': 'image/svg+xml',
-  '.png': 'image/png',
-  '.ttf': 'font/ttf',
-  '.woff': 'font/woff',
-  '.woff2': 'font/woff2',
-  '.ico': 'image/x-icon',
-}
-
-function setIsolationHeaders(res: http.ServerResponse): void {
-  res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
-  res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
-  res.setHeader('Cross-Origin-Resource-Policy', 'same-origin')
-}
-
-/** Resolve a request pathname inside `root`, rejecting lexical traversal escapes. */
-function containedStaticPath(root: string, pathname: string): string | null {
-  const rel = pathname.replace(/^\/+/, '') || 'index.html'
-  const resolved = path.resolve(root, rel)
-  if (resolved !== root && !resolved.startsWith(root + path.sep)) return null
-  return resolved
-}
-
-/**
- * Serve a static file under `root`: lexical containment, then `fs.realpath`
- * BOTH the root and the resolved file before stat/stream, so a symlink inside
- * `root` pointing outside it cannot be served (the lexical check alone follows
- * symlinks because `stat`/`createReadStream` do). Sends the response itself.
- */
-function serveStaticFile(res: http.ServerResponse, root: string, pathname: string): void {
-  const candidate = containedStaticPath(root, pathname)
-  if (!candidate) { res.writeHead(403); res.end('Forbidden'); return }
-  Promise.all([fs.realpath(root), fs.realpath(candidate)])
-    .then(([realRoot, realFile]) => {
-      if (realFile !== realRoot && !realFile.startsWith(realRoot + path.sep)) {
-        res.writeHead(403); res.end('Forbidden'); return
-      }
-      nodeFs.stat(realFile, (err, stat) => {
-        if (err || !stat.isFile()) { res.writeHead(404); res.end('Not Found'); return }
-        res.writeHead(200, {
-          'Content-Type': MIME[path.extname(realFile)] ?? 'application/octet-stream',
-          'Content-Length': stat.size,
-          'Cache-Control': 'no-store',
-        })
-        // Stream the realpath'd file (already resolved to its real on-disk
-        // location, so a symlink inside the root cannot redirect it outside).
-        nodeFs.createReadStream(realFile).pipe(res)
-      })
-    })
-    .catch(() => { if (!res.headersSent) { res.writeHead(404); res.end('Not Found') } })
-}
-
 /** Thrown by {@link readBody} when the accumulated body exceeds the cap. */
 class BodyTooLargeError extends Error {
   constructor() {
@@ -185,6 +128,22 @@ function rejectUnsafeMutation(req: http.IncomingMessage): number | null {
 }
 
 /** Map a node fs error to the HTTP status the provider expects. */
+/**
+ * Percent-decode a request path, answering the client on a malformed escape.
+ * A stray `%` is the client's error and belongs here, not at the shared
+ * listener's exception boundary, which cannot tell a bad request from a bug in
+ * this handler. Returns `null` once the 400 has been sent.
+ */
+function decodePath(res: http.ServerResponse, pathname: string): string | null {
+  try {
+    return decodeURIComponent(pathname)
+  } catch {
+    res.writeHead(400)
+    res.end('Bad Request')
+    return null
+  }
+}
+
 function fsErrorStatus(e: unknown): number {
   const code = (e as { code?: string }).code
   if (code === 'ENOACTIVE') return 409
@@ -412,17 +371,29 @@ function workspaceIdOf(identity: { appId: string | null; projectPath: string } |
 export async function startWorkbenchCoiServer(options: WorkbenchCoiServerOptions): Promise<WorkbenchCoiServer> {
   const root = path.resolve(options.rootDir)
   const contribRoot = options.extensionsDir ? path.resolve(options.extensionsDir) : null
-  const server = http.createServer((req, res) => {
-    setIsolationHeaders(res)
-    const url = new URL(req.url ?? '/', 'http://127.0.0.1')
-
+  const shutdown = createCoiServerShutdown()
+  const handle = (req: http.IncomingMessage, res: http.ServerResponse, url: URL): void => {
+    // This window is tearing down. Anything accepted from here on would act on
+    // a project the user has already closed, and a new SSE stream would outlive
+    // the drain that was supposed to end them all.
+    if (shutdown.closing) {
+      res.writeHead(503)
+      res.end('Closing')
+      return
+    }
     // Special-cased ahead of the generic `/__fs/*` dispatch: unlike every other
     // action, this is a long-lived SSE stream, not a one-shot JSON response.
     if (url.pathname === '/__fs/watch') {
-      handleFsWatchRequest(req, res, options.getProjectRoot)
+      const endStream = handleFsWatchRequest(req, res, options.getProjectRoot)
+      if (endStream) shutdown.trackWatchStream(res, endStream)
       return
     }
 
+    // Everything below answers once. Shutdown lets these land rather than
+    // dropping the socket under them — a `/__fs/write` mid-body is the file the
+    // user just saved.
+    shutdown.trackRequest(res)
+
     if (url.pathname.startsWith('/__fs/')) {
       handleFsRequest(req, res, options.getProjectRoot(), url).catch((e) => {
         if (!res.headersSent) jsonRes(res, 500, { error: String(e) })
@@ -464,26 +435,37 @@ export async function startWorkbenchCoiServer(options: WorkbenchCoiServerOptions
           .catch((e) => { if (!res.headersSent) jsonRes(res, 500, { error: String(e) }) })
         return
       }
-      const rel = decodeURIComponent(url.pathname.slice('/__contrib/'.length))
+      const rel = decodePath(res, url.pathname.slice('/__contrib/'.length))
+      if (rel === null) return
       serveStaticFile(res, contribRoot, rel)
       return
     }
 
-    serveStaticFile(res, root, decodeURIComponent(url.pathname))
-  })
+    const filePath = decodePath(res, url.pathname)
+    if (filePath === null) return
+    serveStaticFile(res, root, filePath)
+  }
 
-  await new Promise<void>((resolve, reject) => {
-    server.once('error', reject)
-    server.listen(0, '127.0.0.1', () => {
-      server.off('error', reject)
-      resolve()
-    })
-  })
-  const addr = server.address()
-  const port = typeof addr === 'object' && addr ? addr.port : 0
+  // The listener is shared with every other project window so they land on one
+  // origin; this window is reached through its own path prefix. See
+  // workbench-coi-host.ts for why the port cannot be per-window.
+  const registration = await registerCoiHostSession({ rootDir: root, extensionsDir: contribRoot, session: { handle } })
   return {
-    baseUrl: `http://127.0.0.1:${port}/`,
-    port,
-    close: () => new Promise<void>((r) => server.close(() => r())),
+    baseUrl: `${registration.origin}/w/${registration.token}/`,
+    port: registration.port,
+    // Why this is not a bare `server.close()`: see workbench-coi-shutdown.ts.
+    // Drain first so this window's SSE streams end and its in-flight writes
+    // land, THEN drop the route — the listener itself only goes away with the
+    // last window.
+    close: async () => {
+      // `finally`: a drain that throws must still drop this window's route.
+      // Leaving it registered would keep a torn-down window's bridge reachable
+      // on the shared listener for the rest of the process.
+      try {
+        await shutdown.drain()
+      } finally {
+        await registration.release()
+      }
+    },
   }
 }
diff --git a/packages/devtools/src/main/services/workbench-coi-shutdown.test.ts b/packages/devtools/src/main/services/workbench-coi-shutdown.test.ts
new file mode 100644
index 00000000..3e6cdf33
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-shutdown.test.ts
@@ -0,0 +1,75 @@
+/**
+ * The grace-window bound of {@link createCoiServerShutdown}'s `drain`/`close`:
+ * a request that never finishes must not hold teardown open forever. Runs
+ * against a plain http.Server rather than the full workbench COI server so the
+ * grace window can be set short and the test stays fast.
+ */
+import { afterEach, describe, expect, it } from 'vitest'
+import http from 'node:http'
+import { createCoiServerShutdown } from './workbench-coi-shutdown.js'
+
+let server: http.Server | null = null
+
+afterEach(async () => {
+  if (server) {
+    server.closeAllConnections()
+    await new Promise<void>((resolve) => server!.close(() => resolve()))
+    server = null
+  }
+})
+
+describe('drain grace period destroys a stalled in-flight request', () => {
+  it('returns close() within the grace window and destroys the response that never ended', async () => {
+    const graceMs = 50
+    const shutdown = createCoiServerShutdown(graceMs)
+    // Boxed rather than a bare `let`: TS narrows a bare closure-assigned `let`
+    // to `never` at the read site below, since it cannot see the assignment
+    // happens before the read.
+    const served: { res: http.ServerResponse | null } = { res: null }
+    let mark: () => void = () => {}
+    const serving = new Promise<void>((resolve) => { mark = resolve })
+
+    server = http.createServer((req, res) => {
+      shutdown.trackRequest(res)
+      served.res = res
+      mark()
+      // Deliberately never calls res.end() — this stands in for a
+      // `/__fs/write` whose client stalled halfway through the body.
+    })
+    await new Promise<void>((resolve) => server!.listen(0, '127.0.0.1', () => resolve()))
+    const addr = server.address()
+    const port = typeof addr === 'object' && addr ? addr.port : 0
+
+    const req = http.request({ host: '127.0.0.1', port, method: 'POST', path: '/x' })
+    req.on('error', () => {}) // a destroyed socket surfaces here on the client side
+    req.flushHeaders()
+    req.write('partial-body-that-never-ends')
+    await serving
+
+    const start = Date.now()
+    await shutdown.close(server)
+    const elapsed = Date.now() - start
+
+    // Bounded: teardown does not wait for a client that will never finish.
+    expect(elapsed).toBeLessThan(graceMs + 1000)
+    // The grace timer actually ran rather than resolving for some other
+    // reason (e.g. inFlight being empty from the start).
+    expect(elapsed).toBeGreaterThanOrEqual(graceMs - 5)
+    expect(served.res?.destroyed).toBe(true)
+
+    req.destroy()
+  })
+
+  it('does not wait out the grace window when nothing is in flight', async () => {
+    const graceMs = 2_000
+    const shutdown = createCoiServerShutdown(graceMs)
+    server = http.createServer((req, res) => { shutdown.trackRequest(res) })
+    await new Promise<void>((resolve) => server!.listen(0, '127.0.0.1', () => resolve()))
+
+    const start = Date.now()
+    await shutdown.close(server)
+    const elapsed = Date.now() - start
+
+    expect(elapsed).toBeLessThan(graceMs)
+  })
+})
diff --git a/packages/devtools/src/main/services/workbench-coi-shutdown.ts b/packages/devtools/src/main/services/workbench-coi-shutdown.ts
new file mode 100644
index 00000000..9b35aa3c
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-shutdown.ts
@@ -0,0 +1,108 @@
+/**
+ * Shutdown bookkeeping for the workbench COI bridge, at two levels.
+ *
+ * A project window's bridge is closed as part of that window's teardown, which
+ * awaits it. Two things pull against each other at that moment. `/__fs/watch`
+ * is an SSE stream that only ever ends when its client disconnects, so waiting
+ * on it waits on the editor being destroyed in the same breath — the window
+ * hangs. Dropping every socket outright instead loses a `/__fs/write` whose
+ * body is still arriving, which is the file the user just saved.
+ *
+ * So neither extreme: {@link CoiServerShutdown.drain} ends the streams this
+ * owner started, lets a request already being served finish, and returns once
+ * it has — or once the grace window expires, so teardown is bounded no matter
+ * what a client does. The shared listener behind every window (see
+ * workbench-coi-host.ts) then uses {@link CoiServerShutdown.close}, which adds
+ * the server close and takes the sockets that outlived it.
+ */
+import type http from 'node:http'
+
+/** How long a request already in flight may hold up the window's teardown. */
+const DEFAULT_GRACE_MS = 2_000
+
+export interface CoiServerShutdown {
+  /** A live `/__fs/watch` stream, with the call that ends it server-side. */
+  trackWatchStream: (res: http.ServerResponse, endStream: () => void) => void
+  /** A one-shot request whose response must be allowed to land. */
+  trackRequest: (res: http.ServerResponse) => void
+  /**
+   * True once {@link drain} has started. The owner refuses new requests from
+   * here on: this bridge is bound to a window that is going away, and a
+   * request accepted now would act on a project the user has closed.
+   */
+  readonly closing: boolean
+  /**
+   * End the tracked streams and wait for the tracked one-shot responses to
+   * land, bounded by the grace window. Leaves the listener alone — one window
+   * going away must not take the shared server with it.
+   */
+  drain: () => Promise<void>
+  /** {@link drain}, plus closing the server and taking any surviving sockets. */
+  close: (server: http.Server) => Promise<void>
+}
+
+export function createCoiServerShutdown(graceMs: number = DEFAULT_GRACE_MS): CoiServerShutdown {
+  const watchStreams = new Set<() => void>()
+  const inFlight = new Set<http.ServerResponse>()
+  let onDrained: (() => void) | null = null
+  let closing = false
+
+  const drain = (): Promise<void> =>
+    new Promise<void>((resolve) => {
+      closing = true
+      for (const endStream of watchStreams) endStream()
+      watchStreams.clear()
+      // Nothing is being served: the sockets that remain are a client's to
+      // keep alive, and waiting on them is waiting on nobody.
+      if (inFlight.size === 0) {
+        resolve()
+        return
+      }
+      let deadline: ReturnType<typeof setTimeout> | null = null
+      const finish = (): void => {
+        onDrained = null
+        if (deadline) clearTimeout(deadline)
+        resolve()
+      }
+      const expire = (): void => {
+        // The grace window is up and something is still mid-request — a client
+        // that stalled halfway through a body, most likely. Destroying it here
+        // is the point: the handler still holds the closing window's project,
+        // so a body that lands minutes from now would write into a project the
+        // user has closed, and the socket would outlive the window on the
+        // shared listener.
+        for (const res of [...inFlight]) res.destroy()
+        inFlight.clear()
+        finish()
+      }
+      deadline = setTimeout(expire, graceMs)
+      onDrained = finish
+    })
+
+  return {
+    get closing() {
+      return closing
+    },
+    trackWatchStream(res, endStream) {
+      watchStreams.add(endStream)
+      res.on('close', () => watchStreams.delete(endStream))
+    },
+    trackRequest(res) {
+      inFlight.add(res)
+      res.on('close', () => {
+        inFlight.delete(res)
+        if (inFlight.size === 0) onDrained?.()
+      })
+    },
+    drain,
+    async close(server) {
+      // Stop accepting first, so nothing new arrives during the drain; the
+      // callback only fires once every connection is gone, which is why the
+      // sockets are taken below rather than waited on.
+      const closed = new Promise<void>((resolve) => server.close(() => resolve()))
+      await drain()
+      server.closeAllConnections()
+      await closed
+    },
+  }
+}
diff --git a/packages/devtools/src/main/services/workbench-coi-static.test.ts b/packages/devtools/src/main/services/workbench-coi-static.test.ts
new file mode 100644
index 00000000..93c328ec
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-static.test.ts
@@ -0,0 +1,166 @@
+/**
+ * `serveStaticFile` decides the response from a `stat` and only then opens a
+ * read stream. Between the two the file can vanish or lose permissions, and
+ * the stream reports that asynchronously — after the 200 and its
+ * Content-Length are already on the wire, so no status can still be changed.
+ * An unhandled 'error' on a stream is an uncaught exception in the main
+ * process, which would take every project window down over one missing file,
+ * so the stream's failure has to end as a destroyed socket instead.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import fs from 'node:fs/promises'
+import http from 'node:http'
+import net from 'node:net'
+import os from 'node:os'
+import path from 'node:path'
+import { PassThrough } from 'node:stream'
+
+// Held in `vi.hoisted` because the mock factory below is hoisted above this
+// file's own bindings and would read an ordinary `let` in its temporal dead
+// zone. Only `createReadStream` is swapped, and only while a test asks for it:
+// realpath/stat still hit the real filesystem, so the code under test takes
+// its normal path up to the point where the stream fails.
+const streamHook = vi.hoisted(() => ({ override: null as ((realFile: string) => PassThrough) | null }))
+
+vi.mock('node:fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:fs')>()
+  const createReadStream = ((...args: unknown[]) =>
+    streamHook.override
+      ? streamHook.override(String(args[0]))
+      : (actual.createReadStream as unknown as (...a: unknown[]) => unknown)(...args)) as typeof actual.createReadStream
+  // `default` too: the module under test uses a default import of `node:fs`.
+  const patched = { ...actual, createReadStream }
+  return { ...patched, default: patched }
+})
+
+import { serveStaticFile } from './workbench-coi-static.js'
+
+const FILE_BODY = 'the whole file body'
+
+let tmpDir = ''
+let server: http.Server | null = null
+let port = 0
+
+/** Outcome of one request, including whether the response reached its end. */
+interface Outcome {
+  status: number
+  body: string
+  /** False when the socket died before the declared body arrived. */
+  completed: boolean
+}
+
+/**
+ * A response truncated mid-body never emits 'end', so completion — not just
+ * the status — is what a client can observe when the failure arrives after
+ * the header is already sent. `onFirstChunk` runs once the client has really
+ * received bytes, which is the only moment at which "the 200 is on the wire"
+ * is a fact rather than an assumption.
+ */
+function get(rawPath: string, onFirstChunk?: () => void): Promise<Outcome> {
+  return new Promise((resolve) => {
+    // `agent: false`: a keep-alive socket left in the global agent's pool
+    // would hold the test server open across the afterEach close.
+    const req = http.request({ host: '127.0.0.1', port, path: rawPath, method: 'GET', agent: false }, (res) => {
+      const chunks: Buffer[] = []
+      let first = true
+      const settle = (completed: boolean) =>
+        resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString(), completed })
+      res.on('data', (c: Buffer) => {
+        chunks.push(c)
+        if (first) { first = false; onFirstChunk?.() }
+      })
+      res.on('end', () => settle(true))
+      res.on('aborted', () => settle(false))
+      res.on('error', () => settle(false))
+    })
+    // The socket can die before any header arrives; that is still a destroyed
+    // response, not a test failure.
+    req.on('error', () => resolve({ status: 0, body: '', completed: false }))
+    req.end()
+  })
+}
+
+beforeEach(async () => {
+  streamHook.override = null
+  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'coi-static-test-'))
+  await fs.writeFile(path.join(tmpDir, 'asset.txt'), FILE_BODY)
+  server = http.createServer((req, res) => {
+    serveStaticFile(res, tmpDir, new URL(req.url ?? '/', 'http://127.0.0.1').pathname)
+  })
+  await new Promise<void>((resolve) => server!.listen(0, '127.0.0.1', () => resolve()))
+  port = (server!.address() as net.AddressInfo).port
+})
+
+afterEach(async () => {
+  streamHook.override = null
+  if (server) {
+    await new Promise<void>((resolve) => server!.close(() => resolve()))
+    server = null
+  }
+  await fs.rm(tmpDir, { recursive: true, force: true })
+})
+
+describe('serveStaticFile with a healthy file', () => {
+  it('streams the whole body with the stat size as Content-Length', async () => {
+    const res = await get('/asset.txt')
+
+    expect(res.status).toBe(200)
+    expect(res.body).toBe(FILE_BODY)
+    expect(res.completed).toBe(true)
+  })
+})
+
+describe('the read stream fails after the response header is already sent', () => {
+  it('destroys the response instead of letting the error go unhandled, and keeps serving', async () => {
+    // Content-Length was taken from the stat, so a body cut short here is
+    // exactly what a client sees when the file is unlinked or chmod'ed away
+    // between the stat and the read.
+    let injected: PassThrough | null = null
+    streamHook.override = () => {
+      injected = new PassThrough()
+      injected.write('part')
+      return injected
+    }
+
+    const outcome = await get('/asset.txt', () => {
+      // Raised from the socket's data callback, i.e. asynchronously, the way
+      // the fs layer reports a late failure: with no listener on the stream
+      // this is an uncaught exception rather than a caught error.
+      injected!.emit('error', new Error('EBADF: bad file descriptor'))
+    })
+
+    expect(outcome.status).toBe(200)
+    expect(outcome.body).toBe('part')
+    expect(outcome.completed).toBe(false)
+
+    // The listener is shared by every project window, so surviving the
+    // failure — not just answering it — is the invariant.
+    streamHook.override = null
+    const after = await get('/asset.txt')
+    expect(after.status).toBe(200)
+    expect(after.body).toBe(FILE_BODY)
+  })
+})
+
+describe('the read stream fails before any body byte is written', () => {
+  it('destroys the response rather than leaving the client waiting for a body that never comes', async () => {
+    // A file that stats but cannot be opened: the error arrives before any
+    // data, so the client never sees a complete response either way — what
+    // must not happen is the request hanging until its own timeout while the
+    // main process dies of an unhandled 'error'.
+    streamHook.override = () => {
+      const stream = new PassThrough()
+      setImmediate(() => stream.emit('error', new Error('EACCES: permission denied')))
+      return stream
+    }
+
+    const outcome = await get('/asset.txt')
+    expect(outcome.completed).toBe(false)
+    expect(outcome.body).not.toBe(FILE_BODY)
+
+    streamHook.override = null
+    const after = await get('/asset.txt')
+    expect(after.status).toBe(200)
+    expect(after.body).toBe(FILE_BODY)
+  })
+})
diff --git a/packages/devtools/src/main/services/workbench-coi-static.ts b/packages/devtools/src/main/services/workbench-coi-static.ts
new file mode 100644
index 00000000..f924d165
--- /dev/null
+++ b/packages/devtools/src/main/services/workbench-coi-static.ts
@@ -0,0 +1,84 @@
+/**
+ * Static-file serving and the cross-origin-isolation headers shared by the
+ * workbench COI host and every window's bridge.
+ *
+ * Split out of `workbench-coi-server.ts` so the host module can serve the
+ * bundle without importing the per-window bridge (which imports the host).
+ */
+import http from 'node:http'
+import nodeFs from 'node:fs'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+const MIME: Record<string, string> = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.map': 'application/json; charset=utf-8',
+  '.wasm': 'application/wasm',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.ttf': 'font/ttf',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ico': 'image/x-icon',
+}
+
+/**
+ * The workbench needs `SharedArrayBuffer` for the TS web ext-host's
+ * project-wide IntelliSense, and Chromium only serves that to a
+ * cross-origin-isolated document. Every response carries the three headers so
+ * same-origin sub-resources and workers satisfy COEP `require-corp`.
+ */
+export function setIsolationHeaders(res: http.ServerResponse): void {
+  res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
+  res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+  res.setHeader('Cross-Origin-Resource-Policy', 'same-origin')
+}
+
+/** Resolve a request pathname inside `root`, rejecting lexical traversal escapes. */
+function containedStaticPath(root: string, pathname: string): string | null {
+  const rel = pathname.replace(/^\/+/, '') || 'index.html'
+  const resolved = path.resolve(root, rel)
+  if (resolved !== root && !resolved.startsWith(root + path.sep)) return null
+  return resolved
+}
+
+/**
+ * Serve a static file under `root`: lexical containment, then `fs.realpath`
+ * BOTH the root and the resolved file before stat/stream, so a symlink inside
+ * `root` pointing outside it cannot be served (the lexical check alone follows
+ * symlinks because `stat`/`createReadStream` do). Sends the response itself.
+ */
+export function serveStaticFile(res: http.ServerResponse, root: string, pathname: string): void {
+  const candidate = containedStaticPath(root, pathname)
+  if (!candidate) { res.writeHead(403); res.end('Forbidden'); return }
+  Promise.all([fs.realpath(root), fs.realpath(candidate)])
+    .then(([realRoot, realFile]) => {
+      if (realFile !== realRoot && !realFile.startsWith(realRoot + path.sep)) {
+        res.writeHead(403); res.end('Forbidden'); return
+      }
+      nodeFs.stat(realFile, (err, stat) => {
+        if (err || !stat.isFile()) { res.writeHead(404); res.end('Not Found'); return }
+        res.writeHead(200, {
+          'Content-Type': MIME[path.extname(realFile)] ?? 'application/octet-stream',
+          'Content-Length': stat.size,
+          'Cache-Control': 'no-store',
+        })
+        // Stream the realpath'd file (already resolved to its real on-disk
+        // location, so a symlink inside the root cannot redirect it outside).
+        const stream = nodeFs.createReadStream(realFile)
+        // The file can vanish or lose permissions between the stat and the
+        // open. The stream reports that asynchronously, once the 200 and the
+        // Content-Length are already on the wire, so no status can be changed
+        // — and an unhandled 'error' on a stream is an uncaught exception in
+        // the main process. Take the socket instead, which is what a client
+        // sees for a truncated body anyway.
+        stream.on('error', () => { res.destroy() })
+        stream.pipe(res)
+      })
+    })
+    .catch(() => { if (!res.headersSent) { res.writeHead(404); res.end('Not Found') } })
+}
diff --git a/packages/devtools/src/main/services/workbench-context.ts b/packages/devtools/src/main/services/workbench-context.ts
index 25b8d952..dc3c0906 100644
--- a/packages/devtools/src/main/services/workbench-context.ts
+++ b/packages/devtools/src/main/services/workbench-context.ts
@@ -20,7 +20,11 @@ import {
   type ConnectionRegistry,
 } from '@dimina-kit/electron-deck/main'
 import type { SenderPolicy } from '../utils/ipc-registry.js'
-import { createWorkbenchSenderPolicy } from '../utils/sender-policy.js'
+import {
+  createWorkbenchOwnedSenderCheck,
+  createWorkbenchSenderPolicy,
+} from '../utils/sender-policy.js'
+import type { AppServices } from './app-services.js'
 import { defaultAdapter } from './default-adapter.js'
 import {
   createRendererNotifier,
@@ -175,6 +179,15 @@ export interface WorkbenchContext extends RuntimeContext {
    */
   senderPolicy: SenderPolicy
 
+  /**
+   * The subset of `senderPolicy` this context structurally OWNS — its own
+   * window's renderer, its settings window and the overlay views mounted
+   * inside it. Excludes the app-wide trusted-window map, which no single
+   * context can claim. `createWindowContextRouter` uses it to decide which
+   * window a message actually came from.
+   */
+  ownsSender: SenderPolicy
+
   /**
    * Reference-counted map of `webContents.id` → live registration count for
    * host-owned BrowserWindows registered as trusted senders via
@@ -183,13 +196,21 @@ export interface WorkbenchContext extends RuntimeContext {
    * single `closed` event, which zeroes the count outright) to un-trust it.
    * Consulted by `createWorkbenchSenderPolicy` in addition to the static
    * main-window / overlay checks.
+   *
+   * Supplied by {@link AppServices} when the caller has one: the host
+   * registers its window against the application, so the same map backs every
+   * context.
    */
   trustedWindowSenderIds: Map<number, number>
 
   /**
-   * Per-context registry of host-registered simulator custom APIs. Populated
-   * via `instance.registerSimulatorApi`; read by the simulator IPC handlers.
-   * One registry per context — no process-global crosstalk.
+   * Registry of host-registered simulator custom APIs. Populated via
+   * `instance.registerSimulatorApi`; read by the simulator IPC handlers.
+   *
+   * Supplied by {@link AppServices} when the caller has one, and therefore
+   * shared across contexts: the host registers each handler once, so a window
+   * opened afterwards must still answer those `wx.*` calls. A context built
+   * without app services (focused unit tests) gets its own registry.
    */
   simulatorApis: SimulatorApiRegistry
 
@@ -328,6 +349,13 @@ export interface CreateContextOptions
   mainWindow: BrowserWindow
   preloadPath: string
   rendererDir: string
+  /**
+   * Services owned by the application rather than by this window. When
+   * present their instances are adopted instead of constructing per-context
+   * ones, so every window shares the host's single registration. Optional so
+   * focused unit tests can still build a stand-alone context.
+   */
+  appServices?: AppServices
   brandingProvider?: WorkbenchContext['brandingProvider']
   /** Host-supplied project list backend. Defaults to LocalProjectsProvider. */
   projectsProvider?: ProjectsProvider
@@ -377,8 +405,9 @@ export function createWorkbenchContext(opts: CreateContextOptions): WorkbenchCon
   ctx.connections = createConnectionRegistry()
   ctx.cdpSessionBroker = createCdpSessionBroker({ connections: ctx.connections })
   ctx.registry.add(() => ctx.cdpSessionBroker.dispose())
-  ctx.trustedWindowSenderIds = new Map<number, number>()
-  ctx.simulatorApis = createSimulatorApiRegistry()
+  ctx.trustedWindowSenderIds =
+    opts.appServices?.trustedWindowSenderIds ?? new Map<number, number>()
+  ctx.simulatorApis = opts.appServices?.simulatorApis ?? createSimulatorApiRegistry()
   ctx.simulatorUiExtensions = createSimulatorUiExtensionRegistry()
   ctx.registry.add(() => ctx.simulatorUiExtensions.clear())
   ctx.windows = createWindowService(opts.mainWindow)
@@ -402,16 +431,16 @@ export function createWorkbenchContext(opts: CreateContextOptions): WorkbenchCon
   // at call time through the live context, which structurally satisfies the
   // helper's narrow OpenSettingsWindowDeps.
   ctx.openSettings = () => openSettingsWindow(ctx)
-  ctx.projectsProvider = opts.projectsProvider ?? createLocalProjectsProvider()
-  ctx.projectTemplates = resolveTemplates(
-    BUILTIN_TEMPLATES,
-    opts.projectTemplates ?? [],
-    opts.builtinTemplates ?? 'all',
-  )
+  ctx.projectsProvider =
+    opts.appServices?.projectsProvider ?? opts.projectsProvider ?? createLocalProjectsProvider()
+  ctx.projectTemplates =
+    opts.appServices?.projectTemplates ??
+    resolveTemplates(BUILTIN_TEMPLATES, opts.projectTemplates ?? [], opts.builtinTemplates ?? 'all')
   ctx.customCreateProjectDialog = opts.customCreateProjectDialog
   ctx.customEditProjectDialog = opts.customEditProjectDialog
   ctx.onBeforeOpenProject = opts.onBeforeOpenProject
   ctx.workspace = createWorkspaceService(ctx)
+  ctx.ownsSender = createWorkbenchOwnedSenderCheck(ctx)
   ctx.senderPolicy = createWorkbenchSenderPolicy(ctx)
   return ctx
 }
diff --git a/packages/devtools/src/main/services/workspace/workspace-referer.ts b/packages/devtools/src/main/services/workspace/workspace-referer.ts
new file mode 100644
index 00000000..5676aa8c
--- /dev/null
+++ b/packages/devtools/src/main/services/workspace/workspace-referer.ts
@@ -0,0 +1,37 @@
+import type { ProjectSession } from '../../../shared/types.js'
+import {
+  clearSimulatorServicewechatReferer,
+  setSimulatorServicewechatReferer,
+} from '../simulator/referer.js'
+
+/**
+ * The forced `servicewechat.com` Referer is stored per project partition, so
+ * every workspace call must name the project it is acting for. Both helpers
+ * therefore take the session and project path explicitly: a workspace that
+ * reached for its own mutable `currentSession` after resetting it would clear
+ * nothing, and one that passed no project at all would be asking to wipe a
+ * partition that belongs to whichever project happens to be open elsewhere.
+ */
+
+/** Forces this project's Referer. No-op for a session without a usable appId. */
+export function applyRefererForSession(session: ProjectSession, projectPath: string): void {
+  const appInfo = session.appInfo as { appId?: string; version?: string }
+  if (!appInfo || typeof appInfo.appId !== 'string' || appInfo.appId.length === 0) return
+  setSimulatorServicewechatReferer(
+    appInfo.appId,
+    typeof appInfo.version === 'string' ? appInfo.version : undefined,
+    projectPath,
+  )
+}
+
+/**
+ * Clears only this project's own entry. Call BEFORE the caller resets its
+ * session/path state, otherwise there is no partition left to name.
+ */
+export function clearRefererForSession(
+  session: ProjectSession | null,
+  projectPath: string,
+): void {
+  if (!session) return
+  clearSimulatorServicewechatReferer(session.appInfo.appId, projectPath)
+}
diff --git a/packages/devtools/src/main/services/workspace/workspace-service.ts b/packages/devtools/src/main/services/workspace/workspace-service.ts
index c9f345fb..be74b513 100644
--- a/packages/devtools/src/main/services/workspace/workspace-service.ts
+++ b/packages/devtools/src/main/services/workspace/workspace-service.ts
@@ -11,10 +11,7 @@ import type {
 } from '../projects/project-repository.js'
 import type { ProjectPatch, ProjectsProvider } from '../projects/types.js'
 import { DEFAULT_COMPILE_CONFIG } from '../projects/types.js'
-import {
-  clearSimulatorServicewechatReferer,
-  setSimulatorServicewechatReferer,
-} from '../simulator/referer.js'
+import { applyRefererForSession, clearRefererForSession } from './workspace-referer.js'
 import { loadWorkbenchSettings } from '../settings/index.js'
 import { createOpLock } from './op-lock.js'
 // Thumbnail FS helpers are now consumed via LocalProjectsProvider; the
@@ -165,7 +162,7 @@ export function createWorkspaceService(ctx: WorkbenchContext): WorkspaceService
     const release = await opLock.acquire()
     try {
       if (!opLock.isOwner(mySeq)) return true
-      clearSimulatorServicewechatReferer()
+      clearRefererForSession(currentSession, currentProjectPath)
       // Switching projects tears down the embedded workbench editor (mirrors one
       // project's disk; saves would else hit the wrong project) AND the native
       // simulator (its 'destroyed' hook owns the bridge session). Back-to-list
@@ -236,21 +233,12 @@ export function createWorkspaceService(ctx: WorkbenchContext): WorkspaceService
       })
       return { session }
     } catch (err) {
-      clearSimulatorServicewechatReferer()
+      // No appId resolved for this attempt; the outgoing project's own entry
+      // was already cleared by runOpenTeardown, so there is nothing to clear.
       return { error: String(err) }
     }
   }
 
-  function applyRefererFromSession(session: ProjectSession): void {
-    const appInfo = session.appInfo as { appId?: string; version?: string }
-    if (appInfo && typeof appInfo.appId === 'string' && appInfo.appId.length > 0) {
-      setSimulatorServicewechatReferer(
-        appInfo.appId,
-        typeof appInfo.version === 'string' ? appInfo.version : undefined,
-      )
-    }
-  }
-
   // Delegate to the host-injected (or default LocalProjectsProvider)
   // ProjectsProvider on the context. When the host omits an optional method,
   // we apply a safe documented default — never silently fall back to
@@ -367,7 +355,7 @@ export function createWorkspaceService(ctx: WorkbenchContext): WorkspaceService
         if (provider.updateLastOpened) provider.updateLastOpened(projectPath)
       })
       bestEffort('sendStatus', () => sendStatus('ready', '编译完成'))
-      bestEffort('applyReferer', () => applyRefererFromSession(session))
+      bestEffort('applyReferer', () => applyRefererForSession(session, projectPath))
 
       return {
         success: true,
@@ -402,7 +390,7 @@ export function createWorkspaceService(ctx: WorkbenchContext): WorkspaceService
         // Invalidate the active session's onLog BEFORE teardown starts — lines
         // flushed by the dying compile worker must not reach the panel.
         logGeneration++
-        clearSimulatorServicewechatReferer()
+        clearRefererForSession(currentSession, currentProjectPath)
         await disposeSession()
         // Record the root being torn down BEFORE clearing it, so a teardown/
         // debounced write already in flight can still be accepted against it.
diff --git a/packages/devtools/src/main/utils/ipc-context-source.ts b/packages/devtools/src/main/utils/ipc-context-source.ts
new file mode 100644
index 00000000..127a7842
--- /dev/null
+++ b/packages/devtools/src/main/utils/ipc-context-source.ts
@@ -0,0 +1,53 @@
+import type { WebContents } from 'electron'
+import type { SenderPolicy } from './ipc-registry.js'
+
+/**
+ * Resolves which window context owns an incoming IPC sender.
+ *
+ * `register*Ipc` takes one of these instead of a bare context so a single
+ * handler body serves both shapes: one window (every accepted sender maps to
+ * that window's context) and several windows (each message is answered by the
+ * context of the window it actually came from).
+ */
+export interface IpcContextSource<T> {
+  /**
+   * Set only by the adapter over a context that carries no `senderPolicy` —
+   * narrow test contexts. It keeps {@link IpcRegistry} in its policy-less mode
+   * (accept every sender, skip the main-frame check), so wrapping such a
+   * context in a source is not itself a trust change.
+   */
+  readonly ungated?: boolean
+  /** The context owning `sender`, or null when no context claims it. */
+  resolve(sender: WebContents): T | null
+  /** Every context this source can hand out. */
+  list(): T[]
+}
+
+/**
+ * What every `register*Ipc` accepts: a router covering all live windows, or a
+ * single context standing in for itself.
+ */
+export type IpcInput<T> = T | IpcContextSource<T>
+
+/** Structural test: a source exposes both members, a context exposes neither. */
+export function isIpcContextSource<T>(value: unknown): value is IpcContextSource<T> {
+  if (value == null || typeof value !== 'object') return false
+  const candidate = value as Partial<IpcContextSource<T>>
+  return typeof candidate.resolve === 'function' && typeof candidate.list === 'function'
+}
+
+/**
+ * Accept either a source or a single context. A single context gates on its
+ * own `senderPolicy` — the same predicate a policy-only registry applies — and
+ * owns every sender that predicate accepts. A context without a policy stays
+ * ungated so narrow test contexts keep the behaviour a bare registry gave them.
+ */
+export function toIpcContextSource<T extends { senderPolicy?: SenderPolicy }>(
+  input: T | IpcContextSource<T>,
+): IpcContextSource<T> {
+  if (isIpcContextSource<T>(input)) return input
+  const ctx = input as T
+  const policy = ctx.senderPolicy
+  if (!policy) return { ungated: true, resolve: () => ctx, list: () => [ctx] }
+  return { resolve: (sender) => (policy(sender) ? ctx : null), list: () => [ctx] }
+}
diff --git a/packages/devtools/src/main/utils/ipc-registry.ts b/packages/devtools/src/main/utils/ipc-registry.ts
index 22b9ac30..83da9743 100644
--- a/packages/devtools/src/main/utils/ipc-registry.ts
+++ b/packages/devtools/src/main/utils/ipc-registry.ts
@@ -1,10 +1,12 @@
 import type { IpcMainEvent, IpcMainInvokeEvent, WebContents } from 'electron'
 import { ipcMain } from 'electron'
 import {
+  addMuxedInvokeHandler,
   isMainFrameIpcSender,
   type Disposable,
   type IpcSenderPolicy,
 } from '@dimina-kit/electron-deck/main'
+import type { IpcContextSource } from './ipc-context-source.js'
 import { IpcValidationError } from './ipc-schema.js'
 import { createLogger } from './logger.js'
 
@@ -70,24 +72,43 @@ function summarizeSender(sender: WebContents): string {
  * possibly null) from a frame-unaware unit-test stub (neither present) and only
  * skip the check for the latter (the sender-id white-list still gates tests).
  */
+/** Internal marker for "this sender is not allowed on this channel". */
+const REJECT = Symbol('ipc-reject')
+
+// Channel multiplexing (one real `ipcMain.handle` per channel, dispatched to
+// whichever per-window registration claims the sender — needed because the
+// storage, WXML and AppData panels each register their channels once per
+// window) is shared with dimina-electron-runtime's bridge router; see
+// @dimina-kit/electron-deck/main's ipc-mux.ts for the mux itself.
+
 /**
  * Tiny fluent helper that wraps every `ipcMain.handle` / `ipcMain.on` with a
  * matching removeHandler/removeListener registered into an internal registry.
  *
- * Each `register*Ipc(ctx)` returns one of these as a Disposable so the
+ * Each `register*Ipc(...)` returns one of these as a Disposable so the
  * workbench-level registry can dispose all built-in handlers in one shot.
  *
- * If a {@link SenderPolicy} is provided, every incoming invocation is gated:
- * - `handle`: rejected senders cause the invoke promise to reject with
- *   `Error('IPC sender rejected for channel <channel>')`.
- * - `on`: rejected senders are silently dropped (the original listener is
- *   never called).
- * In both cases a single `console.warn` is emitted with the channel name
- * and a short sender summary. Without a policy the wrapper is a no-op,
- * preserving backwards compatibility for unit tests and callers that
- * opted out.
+ * The constructor takes either a {@link SenderPolicy} (trust only: is this
+ * sender allowed?) or an {@link IpcContextSource} (trust plus ownership: which
+ * window context does this sender belong to?). With either, every incoming
+ * invocation is gated:
+ * - `handle` / `handleRouted`: rejected senders cause the invoke promise to
+ *   reject with `Error('IPC sender rejected for channel <channel>')`.
+ * - `on` / `onRouted`: rejected senders are silently dropped (the original
+ *   listener is never called).
+ * - `handleSync` / `handleSyncRouted`: rejected senders get a structured
+ *   `{ ok: false, code: 'EREJECTED', … }` returnValue, because sendSync blocks
+ *   the renderer until one is set.
+ * In every case a single `console.warn` is emitted with the channel name and a
+ * short sender summary. With no policy — or a source that declares itself
+ * `ungated` — the wrapper is a pass-through, preserving backwards
+ * compatibility for unit tests and callers that opted out.
+ *
+ * The `*Routed` variants hand the owning context to the handler as its first
+ * argument. `TCtx` is `never` unless the registry was built from a source, so
+ * they are unusable (and unreachable) on a policy-only registry.
  */
-export class IpcRegistry implements Disposable {
+export class IpcRegistry<TCtx = never> implements Disposable {
   // Every cleanup is a synchronous ipcMain.removeHandler/removeListener call,
   // so dispose() can (and must) run them all before returning: callers
   // `dispose()` without awaiting and rely on every channel being unregistered
@@ -95,53 +116,95 @@ export class IpcRegistry implements Disposable {
   // live until a later microtask.
   private cleanups: Array<() => void> = []
   private _disposed = false
+  private readonly policy: SenderPolicy | null
+  private readonly source: IpcContextSource<TCtx> | null
+  /** False reproduces the policy-less pass-through exactly: no main-frame
+   * check, and a synchronous handler keeps its synchronous return value. */
+  private readonly gated: boolean
 
-  constructor(private policy?: SenderPolicy) {}
+  constructor(policyOrSource?: SenderPolicy | IpcContextSource<TCtx>) {
+    const isPolicy = typeof policyOrSource === 'function'
+    this.policy = isPolicy ? policyOrSource : null
+    this.source = policyOrSource != null && !isPolicy ? policyOrSource : null
+    this.gated = this.policy != null || (this.source != null && !this.source.ungated)
+  }
 
-  handle(channel: string, fn: HandleFn): this {
-    const policy = this.policy
+  /** Trust gate and owner resolution for one incoming message. */
+  private admit(event: IpcMainEvent | IpcMainInvokeEvent): TCtx | typeof REJECT {
+    const source = this.source
+    if (source) {
+      // An ungated source always claims the sender, so the frame check — part
+      // of the trust gate, not of ownership — stays off with it.
+      if (source.ungated) return source.resolve(event.sender) as TCtx
+      if (!isMainFrameIpcSender(event)) return REJECT
+      const ctx = source.resolve(event.sender)
+      return ctx == null ? REJECT : ctx
+    }
+    // A bare policy answers trust only, so the accepted branch carries no
+    // context; `TCtx` is `never` in that mode, so no handler can observe it.
+    if (!this.policy) return undefined as TCtx
+    return this.policy(event.sender) && isMainFrameIpcSender(event)
+      ? (undefined as TCtx)
+      : REJECT
+  }
+
+  private warnRejected(channel: string, sender: WebContents): void {
+    console.warn(`[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`)
+  }
+
+  private addInvokeHandler(
+    channel: string,
+    invoke: (ctx: TCtx, event: IpcMainInvokeEvent, args: unknown[]) => unknown,
+  ): this {
     // The gate is `async` so a rejected sender surfaces as a *rejected
     // promise* (the invoke-result contract) rather than a synchronous throw —
     // synchronous throws can escape callers that wrap the result in
     // `Promise.resolve(...)` instead of `await`-ing it directly.
-    const guarded: HandleFn = policy
+    const guarded: HandleFn = this.gated
       ? async (event: IpcMainInvokeEvent, ...args: unknown[]) => {
-          const sender = event.sender
-          if (!policy(sender) || !isMainFrameIpcSender(event)) {
-            console.warn(
-              `[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`,
-            )
+          const ctx = this.admit(event)
+          if (ctx === REJECT) {
+            this.warnRejected(channel, event.sender)
             throw new Error(`IPC sender rejected for channel ${channel}`)
           }
-          return (fn as (e: IpcMainInvokeEvent, ...a: unknown[]) => unknown)(event, ...args)
+          return invoke(ctx, event, args)
         }
-      : fn
-    ipcMain.handle(channel, guarded)
-    this.cleanups.push(() => ipcMain.removeHandler(channel))
+      : (event: IpcMainInvokeEvent, ...args: unknown[]) =>
+          invoke(this.admit(event) as TCtx, event, args)
+    this.cleanups.push(addMuxedInvokeHandler(ipcMain, channel, {
+      claims: (event) => this.admit(event) !== REJECT,
+      handle: guarded,
+    }))
     return this
   }
 
-  /**
-   * Register a SYNCHRONOUS `ipcRenderer.sendSync` handler. Unlike {@link on}
-   * (fire-and-forget), the renderer is blocked until we set `event.returnValue`,
-   * so `fn` MUST be synchronous and return the value to hand back. The sender
-   * policy gates it like {@link handle}; a rejected sender or a thrown error
-   * yields a structured `{ ok: false, code, message }` returnValue instead of
-   * the silent drop `on` uses, so the blocked renderer always gets an answer.
-   */
-  handleSync(channel: string, fn: (event: IpcMainEvent, ...args: unknown[]) => unknown): this {
-    const policy = this.policy
+  handle(channel: string, fn: HandleFn): this {
+    const raw = fn as (e: IpcMainInvokeEvent, ...a: unknown[]) => unknown
+    return this.addInvokeHandler(channel, (_ctx, event, args) => raw(event, ...args))
+  }
+
+  /** {@link handle} answered by the context that owns the calling sender. */
+  handleRouted(
+    channel: string,
+    fn: (ctx: TCtx, event: IpcMainInvokeEvent, ...args: unknown[]) => unknown,
+  ): this {
+    return this.addInvokeHandler(channel, (ctx, event, args) => fn(ctx, event, ...args))
+  }
+
+  private addSyncHandler(
+    channel: string,
+    invoke: (ctx: TCtx, event: IpcMainEvent, args: unknown[]) => unknown,
+  ): this {
     const listener = (event: IpcMainEvent, ...args: unknown[]) => {
       const syncEvent = event as IpcMainEvent & { returnValue: unknown }
-      // Everything — including the policy check — runs inside the try so EVERY
-      // path sets `event.returnValue`. sendSync blocks the renderer until it is
+      // Everything — including the gate — runs inside the try so EVERY path
+      // sets `event.returnValue`. sendSync blocks the renderer until it is
       // set, so an unset value (e.g. a throwing policy fn) would hang the
       // renderer forever; the catch guarantees a sentinel instead.
       try {
-        if (policy && (!policy(event.sender) || !isMainFrameIpcSender(event))) {
-          console.warn(
-            `[ipc] sender rejected for channel '${channel}' (${summarizeSender(event.sender)})`,
-          )
+        const ctx = this.admit(event)
+        if (ctx === REJECT) {
+          this.warnRejected(channel, event.sender)
           syncEvent.returnValue = {
             ok: false,
             code: 'EREJECTED',
@@ -149,7 +212,7 @@ export class IpcRegistry implements Disposable {
           }
           return
         }
-        syncEvent.returnValue = fn(event, ...args)
+        syncEvent.returnValue = invoke(ctx, event, args)
       } catch (err) {
         reportListenerError(channel, err)
         const code = (err as NodeJS.ErrnoException)?.code
@@ -165,12 +228,30 @@ export class IpcRegistry implements Disposable {
     return this
   }
 
-  on(channel: string, fn: ListenerFn): this {
-    const policy = this.policy
-    const raw = fn as (e: IpcMainEvent, ...a: unknown[]) => unknown
-    const safeInvoke = (event: IpcMainEvent, args: unknown[]) => {
+  /**
+   * Register a SYNCHRONOUS `ipcRenderer.sendSync` handler. Unlike {@link on}
+   * (fire-and-forget), the renderer is blocked until we set `event.returnValue`,
+   * so `fn` MUST be synchronous and return the value to hand back.
+   */
+  handleSync(channel: string, fn: (event: IpcMainEvent, ...args: unknown[]) => unknown): this {
+    return this.addSyncHandler(channel, (_ctx, event, args) => fn(event, ...args))
+  }
+
+  /** {@link handleSync} answered by the context that owns the calling sender. */
+  handleSyncRouted(
+    channel: string,
+    fn: (ctx: TCtx, event: IpcMainEvent, ...args: unknown[]) => unknown,
+  ): this {
+    return this.addSyncHandler(channel, (ctx, event, args) => fn(ctx, event, ...args))
+  }
+
+  private addListener(
+    channel: string,
+    invoke: (ctx: TCtx, event: IpcMainEvent, args: unknown[]) => unknown,
+  ): this {
+    const safeInvoke = (ctx: TCtx, event: IpcMainEvent, args: unknown[]) => {
       try {
-        const ret = raw(event, ...args)
+        const ret = invoke(ctx, event, args)
         if (isThenable(ret)) {
           // Async listeners would otherwise leak rejections into Electron's
           // event loop as `UnhandledPromiseRejection`. Funnel them into the
@@ -181,23 +262,35 @@ export class IpcRegistry implements Disposable {
         reportListenerError(channel, err)
       }
     }
-    const guarded: ListenerFn = policy
+    const guarded: ListenerFn = this.gated
       ? (event: IpcMainEvent, ...args: unknown[]) => {
-          const sender = event.sender
-          if (!policy(sender) || !isMainFrameIpcSender(event)) {
-            console.warn(
-              `[ipc] sender rejected for channel '${channel}' (${summarizeSender(sender)})`,
-            )
+          const ctx = this.admit(event)
+          if (ctx === REJECT) {
+            this.warnRejected(channel, event.sender)
             return
           }
-          safeInvoke(event, args)
+          safeInvoke(ctx, event, args)
         }
-      : (event: IpcMainEvent, ...args: unknown[]) => safeInvoke(event, args)
+      : (event: IpcMainEvent, ...args: unknown[]) =>
+          safeInvoke(this.admit(event) as TCtx, event, args)
     ipcMain.on(channel, guarded)
     this.cleanups.push(() => ipcMain.removeListener(channel, guarded))
     return this
   }
 
+  on(channel: string, fn: ListenerFn): this {
+    const raw = fn as (e: IpcMainEvent, ...a: unknown[]) => unknown
+    return this.addListener(channel, (_ctx, event, args) => raw(event, ...args))
+  }
+
+  /** {@link on} answered by the context that owns the calling sender. */
+  onRouted(
+    channel: string,
+    fn: (ctx: TCtx, event: IpcMainEvent, ...args: unknown[]) => unknown,
+  ): this {
+    return this.addListener(channel, (ctx, event, args) => fn(ctx, event, ...args))
+  }
+
   dispose(): Promise<void> {
     // Synchronous drain (LIFO, idempotent): every channel is unregistered
     // before this returns; the promise only carries aggregated errors.
diff --git a/packages/devtools/src/main/utils/sender-policy.ts b/packages/devtools/src/main/utils/sender-policy.ts
index be6ca2ce..7b5c3be6 100644
--- a/packages/devtools/src/main/utils/sender-policy.ts
+++ b/packages/devtools/src/main/utils/sender-policy.ts
@@ -35,6 +35,27 @@ import type { SenderPolicy } from './ipc-registry.js'
  */
 export function createWorkbenchSenderPolicy(
   ctx: Pick<WorkbenchContext, 'windows' | 'views' | 'trustedWindowSenderIds'>,
+): SenderPolicy {
+  const ownsSender = createWorkbenchOwnedSenderCheck(ctx)
+  return (sender: WebContents) => {
+    if (ownsSender(sender)) return true
+    if (sender.isDestroyed()) return false
+    // Host-registered trusted windows (registerTrustedWindow). The map is
+    // app-wide, so this is the one accepted sender no single context owns.
+    return ctx.trustedWindowSenderIds.has(sender.id)
+  }
+}
+
+/**
+ * The senders this context structurally OWNS: its own main-window renderer,
+ * its own settings window and the overlay views mounted inside it. Deliberately
+ * excludes `trustedWindowSenderIds` — that map is shared by the whole app, so
+ * every context would claim the same host window and ownership would stop being
+ * unique. `createWindowContextRouter` routes on this check first for exactly
+ * that reason.
+ */
+export function createWorkbenchOwnedSenderCheck(
+  ctx: Pick<WorkbenchContext, 'windows' | 'views'>,
 ): SenderPolicy {
   return (sender: WebContents) => {
     if (sender.isDestroyed()) return false
@@ -45,9 +66,6 @@ export function createWorkbenchSenderPolicy(
     // Standalone settings BrowserWindow renderer
     if (ctx.windows.isSettingsWindowSender(sender.id)) return true
 
-    // Host-registered trusted windows (registerTrustedWindow)
-    if (ctx.trustedWindowSenderIds.has(sender.id)) return true
-
     // Settings overlay view (mounted inside the main window)
     const settingsViewId = ctx.views.getSettingsWebContentsId()
     if (settingsViewId != null && sender.id === settingsViewId) return true
diff --git a/packages/devtools/src/main/windows/main-window/create.ts b/packages/devtools/src/main/windows/main-window/create.ts
index 79c2d085..9e6324e2 100644
--- a/packages/devtools/src/main/windows/main-window/create.ts
+++ b/packages/devtools/src/main/windows/main-window/create.ts
@@ -11,6 +11,14 @@ export interface WindowOptions {
   minWidth?: number
   minHeight?: number
   indexHtml: string
+  /**
+   * Query string appended to the loaded `file://` URL. This is how a window
+   * receives its own bootstrap identity (the workbench window reads the project
+   * it belongs to from here), so the renderer entry knows what to mount without
+   * a round-trip. Survives navigation-hardening: that check matches on the
+   * `file://` prefix only and ignores the query (see navigation-hardening.ts).
+   */
+  query?: Record<string, string>
   /**
    * Auto-show the window on `ready-to-show` in non-test envs. Defaults to
    * `true`. `false` lets a login-gating host keep the window hidden and call
@@ -19,6 +27,18 @@ export interface WindowOptions {
   autoShow?: boolean
 }
 
+/**
+ * Shows `win` the way the current env expects: `showInactive()` in test env
+ * so e2e windows don't steal focus, `show()` otherwise. Shared by this
+ * module's own `ready-to-show` handler and by the workbench window manager's
+ * reveal-after-hook-and-paint gate (`workbench-window.ts`), so the two reveal
+ * paths can never pick different show methods.
+ */
+export function revealMainWindow(win: BrowserWindow): void {
+  if (process.env.NODE_ENV === 'test') win.showInactive()
+  else win.show()
+}
+
 export function createMainWindow(opts: WindowOptions): BrowserWindow {
   const mainWindow = new BrowserWindow({
     width: opts.width ?? 1280,
@@ -42,14 +62,10 @@ export function createMainWindow(opts: WindowOptions): BrowserWindow {
     const isTest = process.env.NODE_ENV === 'test'
     // Visibility is governed by `autoShow` in BOTH envs. A login-gating host
     // opts out via `autoShow: false` and reveals the window itself once auth
-    // passes — don't flash an un-authed window. The env only chooses HOW to
-    // show: test uses showInactive() so e2e windows don't steal focus, prod
-    // uses show(). The framework must never force-show when the host opted
-    // out, in test env either (that would fight the host's own reveal handler).
-    if (opts.autoShow !== false) {
-      if (isTest) mainWindow.showInactive()
-      else mainWindow.show()
-    }
+    // passes — don't flash an un-authed window. The framework must never
+    // force-show when the host opted out, in test env either (that would
+    // fight the host's own reveal handler).
+    if (opts.autoShow !== false) revealMainWindow(mainWindow)
     // Don't auto-open a detached DevTools for the devtools UI shell itself —
     // it's noise for normal use (the mini-app's Console lives in the embedded
     // right-panel DevTools, not here). Opt in via env for debugging the shell.
@@ -64,7 +80,7 @@ export function createMainWindow(opts: WindowOptions): BrowserWindow {
   // route every popup through the OS browser. See navigation-hardening.ts.
   applyNavigationHardening(mainWindow.webContents, rendererDir)
 
-  mainWindow.loadFile(opts.indexHtml)
+  mainWindow.loadFile(opts.indexHtml, opts.query ? { query: opts.query } : undefined)
 
   const container = new View()
   const mainWebView = mainWindow.contentView as WebContentsView
diff --git a/packages/devtools/src/main/windows/main-window/devtools-shortcut.test.ts b/packages/devtools/src/main/windows/main-window/devtools-shortcut.test.ts
new file mode 100644
index 00000000..75cfc824
--- /dev/null
+++ b/packages/devtools/src/main/windows/main-window/devtools-shortcut.test.ts
@@ -0,0 +1,156 @@
+/**
+ * DEVTOOLS SHORTCUT OWNERSHIP (CommandOrControl+Shift+I) across windows.
+ *
+ * `globalShortcut` is process-wide: registering the same accelerator twice is
+ * refused by Electron, so a per-window registration would hand the shortcut
+ * permanently to whichever window wired up first. Every other window's press
+ * would then open THAT window's DevTools — and when the owning window closed
+ * and unregistered, the accelerator would go dead for the windows still open.
+ *
+ * Invariant: one process-wide registration, shared by every window, whose
+ * target is resolved at press time from the focused window. It survives any
+ * single window's disposal and is released only when the last one goes.
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+
+const stubs = vi.hoisted(() => ({
+  registered: new Map<string, () => void>(),
+  registerCalls: [] as string[],
+  unregisterCalls: [] as string[],
+  focused: null as unknown,
+}))
+
+vi.mock('electron', () => {
+  const globalShortcut = {
+    // Mirrors Electron: a second register() of a live accelerator fails.
+    register: vi.fn((accelerator: string, callback: () => void) => {
+      stubs.registerCalls.push(accelerator)
+      if (stubs.registered.has(accelerator)) return false
+      stubs.registered.set(accelerator, callback)
+      return true
+    }),
+    unregister: vi.fn((accelerator: string) => {
+      stubs.unregisterCalls.push(accelerator)
+      stubs.registered.delete(accelerator)
+    }),
+    unregisterAll: vi.fn(() => {
+      stubs.registered.clear()
+    }),
+  }
+  class BrowserWindow {
+    static getFocusedWindow = vi.fn(() => stubs.focused)
+  }
+  return { globalShortcut, BrowserWindow, default: {} }
+})
+
+const ACCELERATOR = 'CommandOrControl+Shift+I'
+
+type AnyFn = (...args: unknown[]) => unknown
+
+function makeWindow() {
+  const listeners = new Map<string, Set<AnyFn>>()
+  return {
+    webContents: { openDevTools: vi.fn() },
+    contentView: { children: [] as unknown[] },
+    getContentSize: () => [800, 600],
+    on(event: string, fn: AnyFn) {
+      let set = listeners.get(event)
+      if (!set) listeners.set(event, (set = new Set()))
+      set.add(fn)
+      return this
+    },
+    removeListener(event: string, fn: AnyFn) {
+      listeners.get(event)?.delete(fn)
+      return this
+    },
+  }
+}
+
+type FakeWindow = ReturnType<typeof makeWindow>
+
+let wireMainWindowEvents: typeof import('./events.js').wireMainWindowEvents
+
+beforeEach(async () => {
+  // Fresh module graph per test: the shortcut's process-wide ownership is
+  // module-level state, so it must not leak between cases.
+  vi.resetModules()
+  stubs.registered.clear()
+  stubs.registerCalls.length = 0
+  stubs.unregisterCalls.length = 0
+  stubs.focused = null
+  ;({ wireMainWindowEvents } = await import('./events.js'))
+})
+
+function press(): void {
+  const callback = stubs.registered.get(ACCELERATOR)
+  if (!callback) throw new Error(`${ACCELERATOR} is not registered — nothing would happen on press`)
+  callback()
+}
+
+function wire(win: FakeWindow) {
+  return wireMainWindowEvents(win as unknown as Electron.BrowserWindow, {})
+}
+
+describe('DevTools accelerator across multiple windows', () => {
+  it('opens the FOCUSED window\'s DevTools, not the window that wired up first', () => {
+    const listWindow = makeWindow()
+    const projectWindow = makeWindow()
+    wire(listWindow)
+    wire(projectWindow)
+
+    stubs.focused = projectWindow
+    press()
+
+    expect(
+      projectWindow.webContents.openDevTools,
+      'pressing the shortcut in a project window must open that window\'s DevTools',
+    ).toHaveBeenCalledWith({ mode: 'detach' })
+    expect(
+      listWindow.webContents.openDevTools,
+      'the window that happened to wire up first must not capture the shortcut',
+    ).not.toHaveBeenCalled()
+  })
+
+  it('registers the process-wide accelerator exactly once for many windows', () => {
+    wire(makeWindow())
+    wire(makeWindow())
+    wire(makeWindow())
+
+    expect(
+      stubs.registerCalls.filter((a) => a === ACCELERATOR),
+      'the accelerator is a process-wide singleton — repeat registrations can only fail',
+    ).toHaveLength(1)
+  })
+
+  it('keeps the shortcut alive after one window is disposed, and releases it with the last', () => {
+    const listWindow = makeWindow()
+    const projectWindow = makeWindow()
+    const listWiring = wire(listWindow)
+    const projectWiring = wire(projectWindow)
+
+    void listWiring.dispose()
+
+    expect(
+      stubs.registered.has(ACCELERATOR),
+      'a window closing must not strip the shortcut from the windows still open',
+    ).toBe(true)
+    stubs.focused = projectWindow
+    press()
+    expect(projectWindow.webContents.openDevTools).toHaveBeenCalledWith({ mode: 'detach' })
+
+    void projectWiring.dispose()
+    expect(
+      stubs.registered.has(ACCELERATOR),
+      'the last window releases the process-wide accelerator',
+    ).toBe(false)
+  })
+
+  it('is a no-op when nothing is focused', () => {
+    const win = makeWindow()
+    wire(win)
+    stubs.focused = null
+
+    expect(() => press()).not.toThrow()
+    expect(win.webContents.openDevTools).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/devtools/src/main/windows/main-window/events.ts b/packages/devtools/src/main/windows/main-window/events.ts
index b4cdc31e..56083e1d 100644
--- a/packages/devtools/src/main/windows/main-window/events.ts
+++ b/packages/devtools/src/main/windows/main-window/events.ts
@@ -1,9 +1,34 @@
-import type { BrowserWindow, WebContentsView } from 'electron'
-import { globalShortcut } from 'electron'
+import type { WebContentsView } from 'electron'
+import { BrowserWindow, globalShortcut } from 'electron'
 // eslint-disable-next-line no-restricted-syntax -- grandfathered(workbench-context): shrink-only
 import type { WorkbenchContext } from '../../services/workbench-context.js'
 import { DisposableRegistry, type Disposable, toDisposable } from '@dimina-kit/electron-deck/main'
 
+const DEVTOOLS_ACCELERATOR = 'CommandOrControl+Shift+I'
+let devToolsShortcutHolders = 0
+
+/**
+ * Claims a share of the ONE process-wide DevTools accelerator. `globalShortcut`
+ * is a process singleton: a per-window registration is refused for every window
+ * after the first, which would give that first window the shortcut for the
+ * whole app and kill it outright when that window closed. So the accelerator is
+ * registered once, opens whichever window is focused when it is pressed, and is
+ * released only when the last holder lets go — a later window can then claim it
+ * again. `unregisterAll()` in lifecycle stays as a process-exit safety net.
+ */
+function acquireDevToolsShortcut(): Disposable {
+  if (devToolsShortcutHolders === 0) {
+    globalShortcut.register(DEVTOOLS_ACCELERATOR, () => {
+      BrowserWindow.getFocusedWindow()?.webContents.openDevTools({ mode: 'detach' })
+    })
+  }
+  devToolsShortcutHolders += 1
+  return toDisposable(() => {
+    devToolsShortcutHolders -= 1
+    if (devToolsShortcutHolders === 0) globalShortcut.unregister(DEVTOOLS_ACCELERATOR)
+  })
+}
+
 export interface MainWindowEventState {
   context?: WorkbenchContext
   onResize?: () => void
@@ -41,18 +66,7 @@ export function wireMainWindowEvents(
     }))
   }
 
-  // DevTools shortcut: scoped to this main window so its disposal is tied
-  // to ctx.registry. `unregisterAll()` in lifecycle remains as a process-exit
-  // safety net.
-  const devToolsAccelerator = 'CommandOrControl+Shift+I'
-  const registered = globalShortcut.register(devToolsAccelerator, () => {
-    win.webContents.openDevTools({ mode: 'detach' })
-  })
-  if (registered) {
-    registry.add(toDisposable(() => {
-      globalShortcut.unregister(devToolsAccelerator)
-    }))
-  }
+  registry.add(acquireDevToolsShortcut())
 
   return registry
 }
diff --git a/packages/devtools/src/main/windows/main-window/index.ts b/packages/devtools/src/main/windows/main-window/index.ts
index b33aa5d9..ec82df82 100644
--- a/packages/devtools/src/main/windows/main-window/index.ts
+++ b/packages/devtools/src/main/windows/main-window/index.ts
@@ -1,4 +1,4 @@
-export { createMainWindow } from './create.js'
+export { createMainWindow, revealMainWindow } from './create.js'
 export type { WindowOptions } from './create.js'
 export { wireMainWindowEvents } from './events.js'
 export type { MainWindowEventState } from './events.js'
diff --git a/packages/devtools/src/preload/runtime/host-sidebar-advertiser.test.ts b/packages/devtools/src/preload/runtime/host-sidebar-advertiser.test.ts
index 781e1229..48048648 100644
--- a/packages/devtools/src/preload/runtime/host-sidebar-advertiser.test.ts
+++ b/packages/devtools/src/preload/runtime/host-sidebar-advertiser.test.ts
@@ -35,11 +35,16 @@ describe('installHostSidebarAdvertiserWhenReady', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    // Host-loaded sidebar content: the document the warning is written for.
+    // jsdom's own document is `about:blank`, which the runtime treats as the
+    // view's un-navigated document and deliberately never warns about.
+    vi.stubGlobal('location', { href: 'file:///sidebar-content.html' })
   })
 
   afterEach(() => {
     document.body.replaceChildren()
     setReadyState(originalReadyState)
+    vi.unstubAllGlobals()
   })
 
   // Reproduces the real production race: the React sidebar app (see
@@ -94,6 +99,56 @@ describe('installHostSidebarAdvertiserWhenReady', () => {
     )
   })
 
+  // The sidebar WCV holds an empty document until the host loads content into
+  // it, and this preload runs there too. Nobody authored that document, so a
+  // missing root there is not an authoring mistake — warning about it prints
+  // on every single app start.
+  it('stays silent on the view\'s own blank document, which carries no slot content', () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    vi.stubGlobal('location', { href: 'about:blank' })
+
+    setReadyState('complete')
+    installHostSidebarAdvertiserWhenReady()
+    window.dispatchEvent(new Event('load'))
+
+    expect(mockedCreateSizeAdvertiser).not.toHaveBeenCalled()
+    expect(warnSpy).not.toHaveBeenCalled()
+
+    warnSpy.mockRestore()
+  })
+
+  // A concurrent React root commits its first render on a scheduler task that
+  // can land after `load`; the verdict has to wait for the main thread to run
+  // out of that work, or the healthy mount races the warning.
+  it('stays silent when the root mounts after load but before the main thread goes idle', async () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const idleCallbacks: Array<() => void> = []
+    vi.stubGlobal('requestIdleCallback', (cb: () => void) => { idleCallbacks.push(cb); return 1 })
+
+    setReadyState('loading')
+    installHostSidebarAdvertiserWhenReady()
+    document.dispatchEvent(new Event('DOMContentLoaded'))
+
+    setReadyState('complete')
+    window.dispatchEvent(new Event('load'))
+    expect(warnSpy).not.toHaveBeenCalled()
+
+    // The framework's own commit lands between load and the idle verdict.
+    const root = mountSidebarRoot()
+    for (const cb of idleCallbacks) cb()
+    expect(warnSpy).not.toHaveBeenCalled()
+
+    // The observer delivers on a microtask, after the idle verdict above.
+    await Promise.resolve()
+    await Promise.resolve()
+    expect(mockedCreateSizeAdvertiser).toHaveBeenCalledWith(
+      root,
+      expect.objectContaining({ axis: 'inline' }),
+    )
+
+    warnSpy.mockRestore()
+  })
+
   it('warns and does not install when the sidebar root never appears', () => {
     const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {})
 
diff --git a/packages/devtools/src/preload/runtime/wait-for-slot-root.ts b/packages/devtools/src/preload/runtime/wait-for-slot-root.ts
index 70824c9f..f7cad3c0 100644
--- a/packages/devtools/src/preload/runtime/wait-for-slot-root.ts
+++ b/packages/devtools/src/preload/runtime/wait-for-slot-root.ts
@@ -11,10 +11,13 @@
  * The "root is missing" warning exists for downstream authors who forgot the
  * element entirely, so it must not fire on the healthy async-mount path — a
  * warning printed on every normal load is noise that trains its readers to
- * ignore it. It is therefore withheld until the document has finished loading
- * (`window.load`, a real event rather than a guessed delay) with the root
- * still absent; the observer stays armed either way, so a root that mounts
- * even later is still picked up.
+ * ignore it. Two conditions gate it, both signals rather than guessed delays:
+ * the document must be one the host actually loaded content into (not the
+ * view's own blank document), and it must have finished loading AND run out of
+ * pending work (`window.load`, then an idle callback — a framework's first
+ * commit is normal-priority work, so it always lands before idle). The
+ * observer stays armed either way, so a root that mounts even later is still
+ * picked up.
  */
 export function whenSlotRootReady(
   selector: string,
@@ -22,6 +25,13 @@ export function whenSlotRootReady(
   install: (root: HTMLElement) => void,
 ): void {
   function attempt(): void {
+    // The slot's WebContentsView holds its own empty document until the host
+    // loads content into it, and this preload runs there too. That document
+    // has no author: a missing root in it is not a mistake anyone made, and
+    // warning about it fires on every app start. The observer below still gets
+    // armed, so content that does arrive is picked up.
+    const authored = location.href !== 'about:blank' && location.href !== ''
+
     const root = document.querySelector<HTMLElement>(selector)
     if (root) {
       install(root)
@@ -38,11 +48,29 @@ export function whenSlotRootReady(
     })
     observer.observe(document.documentElement, { childList: true, subtree: true })
 
+    // Re-queries rather than trusting `installed`: the observer delivers on a
+    // microtask, so a root that is already in the DOM may not have been
+    // installed yet — it is present either way, which is what the warning is
+    // about.
     const warnIfStillMissing = (): void => {
-      if (!installed) console.warn(missingWarning)
+      if (installed || !authored || document.querySelector(selector)) return
+      console.warn(missingWarning)
+    }
+
+    // `load` alone is too early a verdict: a concurrent React root commits its
+    // first render on a scheduler task that can land after it, and the warning
+    // would then race the healthy mount it is supposed to ignore. Idle
+    // callbacks run only once the main thread has no pending work of that
+    // kind, so a root still absent then is genuinely absent. The timeout is
+    // the cap for a page that never goes idle, not the mechanism.
+    const decide = (): void => {
+      const idle = (globalThis as { requestIdleCallback?: (cb: () => void, opts?: { timeout: number }) => number })
+        .requestIdleCallback
+      if (typeof idle === 'function') idle(warnIfStillMissing, { timeout: 5_000 })
+      else warnIfStillMissing()
     }
-    if (document.readyState === 'complete') warnIfStillMissing()
-    else window.addEventListener('load', warnIfStillMissing, { once: true })
+    if (document.readyState === 'complete') decide()
+    else window.addEventListener('load', decide, { once: true })
   }
 
   if (document.readyState === 'loading') {
diff --git a/packages/devtools/src/renderer/entries/workbench/index.html b/packages/devtools/src/renderer/entries/workbench/index.html
new file mode 100644
index 00000000..fdecc6f3
--- /dev/null
+++ b/packages/devtools/src/renderer/entries/workbench/index.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8" />
+  <!--
+    CSP: deliberately permissive (B5 phase). Inline JS/CSS + eval are kept for
+    dev tooling / nodeIntegration:true; connect-src spans http/ws because
+    automation, MCP, and the simulator dev server all open sockets. Tighten in
+    C-phase once the preload bridge removes the need for `unsafe-*`.
+  -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob: http: https:; connect-src 'self' http: https: ws: wss:;" />
+  <title>Dimina DevTools</title>
+  <style>
+    /*
+     * The React tree always occupies the full window. Main-process overlays
+     * (the simulator's Chromium DevTools WebContentsView, the console, and the
+     * workbench editor WebContentsView) are positioned to match measured
+     * placeholder rects inside the React tree (see useViewAnchor /
+     * createPlacementAnchor in project-runtime.tsx).
+     */
+    html, body, #root { margin: 0; padding: 0; }
+    html, body { width: 100vw; height: 100vh; overflow: hidden; }
+    #root {
+      position: fixed;
+      inset: 0;
+      overflow: hidden;
+    }
+  </style>
+</head>
+<body>
+  <div id="root"></div>
+  <script type="module" src="./main.tsx"></script>
+</body>
+</html>
diff --git a/packages/devtools/src/renderer/entries/workbench/main.tsx b/packages/devtools/src/renderer/entries/workbench/main.tsx
new file mode 100644
index 00000000..a2bf5b2d
--- /dev/null
+++ b/packages/devtools/src/renderer/entries/workbench/main.tsx
@@ -0,0 +1,57 @@
+import { useEffect } from 'react'
+import ReactDOM from 'react-dom/client'
+import '../../design.css'
+import { ProjectRuntime } from '@/modules/main/features/project-runtime/project-runtime'
+import type { Project } from '@/shared/types'
+import { ensurePlacementGenerationSeeded } from '../../shared/renderer-placement-generation'
+
+/** Surface a fatal boot failure without mounting React — see the `.catch()` below. */
+function renderFatalStartupError(err: unknown): void {
+  console.error('[devtools] fatal: could not allocate a placement-generation seed before first render', err)
+  const root = document.getElementById('root')
+  if (root) root.textContent = 'Dimina DevTools failed to start. Please restart the app.'
+}
+
+/**
+ * Each project window's identity comes entirely from its URL — main opens it
+ * with `?path=…&name=…` (see WindowChannel.OpenProjectWindow) rather than
+ * pushing the record over IPC, so a freshly-created window can render
+ * synchronously off `location.search` without waiting on a round-trip.
+ * `name` falls back to `path` so a malformed/missing name never blanks the
+ * title bar.
+ */
+function parseProjectFromQuery(): Project | null {
+  const params = new URLSearchParams(location.search)
+  const path = params.get('path')
+  if (!path) return null
+  return { name: params.get('name') || path, path }
+}
+
+function MissingProjectError() {
+  return (
+    <div style={{ padding: 24, fontFamily: 'sans-serif' }}>
+      无法打开项目：窗口地址缺少 path 参数。请关闭此窗口并从项目列表重新打开。
+    </div>
+  )
+}
+
+function WorkbenchApp({ project }: { project: Project | null }) {
+  useEffect(() => {
+    if (project) document.title = project.name
+  }, [project])
+
+  if (!project) return <MissingProjectError />
+  return <ProjectRuntime project={project} />
+}
+
+// See entries/main/main.tsx for why the placement-generation seed must be
+// resolved before the first render — the same invariant applies here since
+// ProjectRuntime draws from the same shared generation sequence
+// (renderer-placement-generation.ts) as the list window.
+const project = parseProjectFromQuery()
+
+ensurePlacementGenerationSeeded()
+  .then(() => {
+    ReactDOM.createRoot(document.getElementById('root')!).render(<WorkbenchApp project={project} />)
+  })
+  .catch(renderFatalStartupError)
diff --git a/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.test.ts b/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.test.ts
index 00739ead..f5c915e6 100644
--- a/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.test.ts
+++ b/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.test.ts
@@ -9,8 +9,12 @@
  * gone — visibility is now the dock tree's panel membership.
  *
  * Public contract under test (see ./use-layout-store.ts):
- * - Hydrates `dockTree` from `localStorage['dimina-devtools.layout.v1']`,
- *   falling back to DEFAULT_LAYOUT_STATE (`dockTree: null`, alignment `left`,
+ * - Records are per project: every project window shares one `file://` origin,
+ *   so the layout is keyed by project path and one project never overwrites
+ *   another's.
+ * - Hydrates `dockTree` from the project's record, from the pre-split shared
+ *   record `localStorage['dimina-devtools.layout.v1']` when the project has none
+ *   yet, and from DEFAULT_LAYOUT_STATE (`dockTree: null`, alignment `left`,
  *   position `inEditor`) on missing / corrupt / wrong-typed input.
  * - `setDockTree` updates state and persists; setting the same value is a no-op
  *   (identity preserved); a write failure is swallowed.
@@ -22,12 +26,13 @@ import { renderHook, act } from '@testing-library/react'
 
 import { useLayoutStore, DEFAULT_LAYOUT_STATE } from './use-layout-store'
 
+/** The pre-split shared record, now only ever read as a seed. */
 const STORAGE_KEY = 'dimina-devtools.layout.v1'
 
-function persisted(): unknown {
-  const raw = window.localStorage.getItem(STORAGE_KEY)
-  return raw == null ? null : JSON.parse(raw)
-}
+const PROJECT_A = '/Users/dev/工作/alpha project'
+const PROJECT_B = '/Users/dev/projects/beta'
+const TREE_A = '{"version":1,"root":{"kind":"tabs","id":"a","panels":["editor"],"active":"editor"}}'
+const TREE_B = '{"version":1,"root":{"kind":"tabs","id":"b","panels":["simulator"],"active":"simulator"}}'
 
 beforeEach(() => {
   window.localStorage.clear()
@@ -47,7 +52,7 @@ describe('useLayoutStore — hydration / sanitization', () => {
 
     let result: ReturnType<typeof renderHook<ReturnType<typeof useLayoutStore>, unknown>>['result']
     expect(() => {
-      ;({ result } = renderHook(() => useLayoutStore()))
+      ;({ result } = renderHook(() => useLayoutStore(PROJECT_A)))
     }).not.toThrow()
 
     expect(result!.current.state).toEqual(DEFAULT_LAYOUT_STATE)
@@ -58,7 +63,7 @@ describe('useLayoutStore — hydration / sanitization', () => {
   it('defaults dockTree to null when the persisted blob omits it', () => {
     window.localStorage.setItem(STORAGE_KEY, JSON.stringify({}))
 
-    const { result } = renderHook(() => useLayoutStore())
+    const { result } = renderHook(() => useLayoutStore(PROJECT_A))
 
     expect(result.current.state).toEqual({ dockTree: null, simulatorAlignment: 'left', devtoolsPosition: 'inEditor' })
   })
@@ -69,7 +74,7 @@ describe('useLayoutStore — hydration / sanitization', () => {
   it('rejects a non-string dockTree, replacing it with null', () => {
     window.localStorage.setItem(STORAGE_KEY, JSON.stringify({ dockTree: 123 }))
 
-    const { result } = renderHook(() => useLayoutStore())
+    const { result } = renderHook(() => useLayoutStore(PROJECT_A))
 
     expect(result.current.state).toEqual({ dockTree: null, simulatorAlignment: 'left', devtoolsPosition: 'inEditor' })
   })
@@ -80,7 +85,7 @@ describe('useLayoutStore — hydration / sanitization', () => {
     const stored = { dockTree: '{"version":1,"root":{"kind":"tabs","id":"g","panels":["editor"],"active":"editor"}}' }
     window.localStorage.setItem(STORAGE_KEY, JSON.stringify(stored))
 
-    const { result } = renderHook(() => useLayoutStore())
+    const { result } = renderHook(() => useLayoutStore(PROJECT_A))
 
     expect(result.current.state).toEqual({ ...stored, simulatorAlignment: 'left', devtoolsPosition: 'inEditor' })
   })
@@ -90,8 +95,8 @@ describe('useLayoutStore — setDockTree and persistence', () => {
   // Regression: persisting a dock tree must update state AND write to
   // localStorage so the layout survives a reload. A missing persistence effect
   // would silently drop the saved layout on next mount.
-  it('persists a new dockTree and writes it to localStorage', () => {
-    const { result } = renderHook(() => useLayoutStore())
+  it('persists a new dockTree and restores it on the next mount', () => {
+    const { result, unmount } = renderHook(() => useLayoutStore(PROJECT_A))
     expect(result.current.state.dockTree).toBeNull()
 
     const tree = '{"version":1,"root":{"kind":"tabs","id":"g","panels":["editor"],"active":"editor"}}'
@@ -100,7 +105,11 @@ describe('useLayoutStore — setDockTree and persistence', () => {
     })
 
     expect(result.current.state.dockTree).toBe(tree)
-    expect(persisted()).toMatchObject({ dockTree: tree })
+    expect(window.localStorage.length).toBeGreaterThan(0)
+
+    unmount()
+    const { result: reopened } = renderHook(() => useLayoutStore(PROJECT_A))
+    expect(reopened.current.state.dockTree).toBe(tree)
   })
 
   // Regression: setting the SAME serialized value must be a no-op (identity
@@ -108,7 +117,7 @@ describe('useLayoutStore — setDockTree and persistence', () => {
   // does not trigger a redundant re-render / write loop.
   it('returns the same state object when the dockTree value is unchanged', () => {
     const tree = '{"version":1,"root":{"kind":"tabs","id":"g","panels":["editor"],"active":"editor"}}'
-    const { result } = renderHook(() => useLayoutStore())
+    const { result } = renderHook(() => useLayoutStore(PROJECT_A))
 
     act(() => {
       result.current.setDockTree(tree)
@@ -131,7 +140,7 @@ describe('useLayoutStore — setDockTree and persistence', () => {
         throw new DOMException('QuotaExceededError', 'QuotaExceededError')
       })
 
-    const { result } = renderHook(() => useLayoutStore())
+    const { result } = renderHook(() => useLayoutStore(PROJECT_A))
     const tree = '{"version":1,"root":{"kind":"tabs","id":"g","panels":["editor"],"active":"editor"}}'
 
     expect(() => {
@@ -144,3 +153,103 @@ describe('useLayoutStore — setDockTree and persistence', () => {
     expect(setItemSpy).toHaveBeenCalled()
   })
 })
+
+describe('useLayoutStore — per-project isolation', () => {
+  // Every project window loads the same file:// origin, so one shared key means
+  // two open projects overwrite each other's dock layout. Each project must keep
+  // its own record: what one window drags/collapses stays in that window, and
+  // reopening a project restores ITS layout, not the last window that saved.
+  it('keeps one project layout out of another project, in both directions', () => {
+    const { result: a } = renderHook(() => useLayoutStore(PROJECT_A))
+    act(() => {
+      a.current.setDockTree(TREE_A)
+    })
+
+    // A second project window opens while A is still up: it must start from the
+    // default layout, not inherit A's.
+    const { result: b } = renderHook(() => useLayoutStore(PROJECT_B))
+    expect(b.current.state.dockTree).toBeNull()
+
+    act(() => {
+      b.current.setDockTree(TREE_B)
+      b.current.setSimulatorAlignment('right')
+    })
+
+    // Reopening each project restores its own layout, unaffected by the other.
+    const { result: reopenedA } = renderHook(() => useLayoutStore(PROJECT_A))
+    expect(reopenedA.current.state).toEqual({
+      dockTree: TREE_A,
+      simulatorAlignment: 'left',
+      devtoolsPosition: 'inEditor',
+    })
+
+    const { result: reopenedB } = renderHook(() => useLayoutStore(PROJECT_B))
+    expect(reopenedB.current.state).toEqual({
+      dockTree: TREE_B,
+      simulatorAlignment: 'right',
+      devtoolsPosition: 'inEditor',
+    })
+  })
+
+  // Upgrade path: the single pre-split record is the layout the user last chose,
+  // so it seeds any project that has no record yet. It must stay readable — a
+  // project saving its own layout may not consume or rewrite it, otherwise the
+  // first window to move a splitter decides every other project's starting point.
+  it('seeds projects from the legacy shared record and leaves that record intact', () => {
+    const legacy = JSON.stringify({ dockTree: TREE_A, devtoolsPosition: 'belowSimulator' })
+    window.localStorage.setItem(STORAGE_KEY, legacy)
+
+    const { result: a } = renderHook(() => useLayoutStore(PROJECT_A))
+    expect(a.current.state).toEqual({
+      dockTree: TREE_A,
+      simulatorAlignment: 'left',
+      devtoolsPosition: 'belowSimulator',
+    })
+
+    act(() => {
+      a.current.setDockTree(TREE_B)
+    })
+
+    const { result: b } = renderHook(() => useLayoutStore(PROJECT_B))
+    expect(b.current.state.dockTree).toBe(TREE_A)
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBe(legacy)
+  })
+
+  // A window with no project bound yet must not fall back to one shared key —
+  // that is the bug in a different disguise. It stays in memory: the layout works
+  // for the session and nothing is written or read across windows.
+  it('keeps layout in memory only when the window has no project identity', () => {
+    const { result } = renderHook(() => useLayoutStore(null))
+    act(() => {
+      result.current.setDockTree(TREE_A)
+    })
+
+    expect(result.current.state.dockTree).toBe(TREE_A)
+    expect(window.localStorage.length).toBe(0)
+
+    const { result: other } = renderHook(() => useLayoutStore(''))
+    expect(other.current.state.dockTree).toBeNull()
+  })
+
+  // One record per project would grow without bound across a machine's lifetime
+  // and eventually hit the localStorage quota. Oldest saves are dropped first, so
+  // the projects a user actually works on keep their layout.
+  it('evicts the least recently saved project once the record cap is exceeded', () => {
+    const paths = Array.from({ length: 40 }, (_, i) => `/Users/dev/projects/p${i}`)
+    for (const path of paths) {
+      const { result, unmount } = renderHook(() => useLayoutStore(path))
+      act(() => {
+        result.current.setDockTree(`{"id":"${path}"}`)
+      })
+      unmount()
+    }
+
+    const { result: newest } = renderHook(() => useLayoutStore(paths[paths.length - 1]))
+    expect(newest.current.state.dockTree).toBe(`{"id":"${paths[paths.length - 1]}"}`)
+
+    const { result: oldest } = renderHook(() => useLayoutStore(paths[0]))
+    expect(oldest.current.state.dockTree).toBeNull()
+
+    expect(window.localStorage.length).toBeLessThanOrEqual(32)
+  })
+})
diff --git a/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.ts b/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.ts
index 080c27ff..37c9a497 100644
--- a/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.ts
+++ b/packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-layout-store.ts
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useRef, useState } from 'react'
 
 /** Which side of the root row the simulator column sits on. */
 export type SimulatorAlignment = 'left' | 'right'
@@ -28,31 +28,122 @@ export const DEFAULT_LAYOUT_STATE: LayoutState = {
   devtoolsPosition: 'inEditor',
 }
 
-const STORAGE_KEY = 'dimina-devtools.layout.v1'
+/**
+ * The pre-split single record, from when devtools showed every project in ONE
+ * workbench window. Read-only from here on: it seeds any project that has no
+ * record of its own, so an upgrading user keeps the layout they had. Nothing
+ * writes or deletes it — a project consuming it would hand its own layout to
+ * every other project that opens later, which is the shared-record bug again.
+ */
+const LEGACY_STORAGE_KEY = 'dimina-devtools.layout.v1'
 
-function load(): LayoutState {
+/** Prefix of the per-project records; the suffix is `projectKey()`. */
+const STORAGE_KEY_PREFIX = 'dimina-devtools.layout.p.'
+
+/**
+ * How many project records survive. Every project a user ever opens would
+ * otherwise add one for the lifetime of the machine and eventually hit the
+ * localStorage quota. Evicting the least recently saved keeps the projects
+ * actually being worked on; an evicted project reopens on the default layout.
+ */
+const MAX_PROJECT_RECORDS = 24
+
+/**
+ * A persisted record: the layout plus the identity it belongs to and when it
+ * was written. `projectPath` guards against a `projectKey` hash collision (two
+ * paths landing on one key degrade to "no record", never to a shared layout);
+ * `savedAt` is the eviction order.
+ */
+interface StoredLayout extends LayoutState {
+  projectPath: string
+  savedAt: number
+}
+
+/**
+ * Storage key for a project. Project paths are unbounded in length and carry
+ * arbitrary characters, so they are hashed rather than spliced into the key;
+ * `StoredLayout.projectPath` re-checks identity on read. Mirrors the hash the
+ * main process uses to fold a project path into its session partition key.
+ */
+function projectKey(projectPath: string): string {
+  let h = 5381
+  for (let i = 0; i < projectPath.length; i++) {
+    h = ((h << 5) + h + projectPath.charCodeAt(i)) >>> 0
+  }
+  return `${STORAGE_KEY_PREFIX}${h.toString(36)}`
+}
+
+function sanitize(parsed: Partial<LayoutState>): LayoutState {
+  return {
+    dockTree: typeof parsed.dockTree === 'string' ? parsed.dockTree : null,
+    simulatorAlignment: parsed.simulatorAlignment === 'right' ? 'right' : 'left',
+    devtoolsPosition:
+      parsed.devtoolsPosition === 'belowSimulator' || parsed.devtoolsPosition === 'rightOfSimulator'
+        ? parsed.devtoolsPosition
+        : 'inEditor',
+  }
+}
+
+function readRecord(key: string): Partial<StoredLayout> | null {
   try {
-    const raw = window.localStorage.getItem(STORAGE_KEY)
-    if (!raw) return DEFAULT_LAYOUT_STATE
-    const parsed = JSON.parse(raw) as Partial<LayoutState>
-    return {
-      dockTree: typeof parsed.dockTree === 'string' ? parsed.dockTree : null,
-      simulatorAlignment: parsed.simulatorAlignment === 'right' ? 'right' : 'left',
-      devtoolsPosition:
-        parsed.devtoolsPosition === 'belowSimulator' || parsed.devtoolsPosition === 'rightOfSimulator'
-          ? parsed.devtoolsPosition
-          : 'inEditor',
-    }
+    const raw = window.localStorage.getItem(key)
+    if (!raw) return null
+    const parsed = JSON.parse(raw) as unknown
+    return parsed && typeof parsed === 'object' ? (parsed as Partial<StoredLayout>) : null
   } catch {
-    return DEFAULT_LAYOUT_STATE
+    return null
   }
 }
 
-function save(state: LayoutState) {
+/**
+ * Hydrate a project's layout. An unidentified window (no project bound yet)
+ * gets the defaults and never touches storage — falling back to one shared key
+ * there would re-create the cross-project clobbering.
+ */
+function load(projectPath: string | null | undefined): LayoutState {
+  if (!projectPath) return DEFAULT_LAYOUT_STATE
+  const own = readRecord(projectKey(projectPath))
+  if (own && own.projectPath === projectPath) return sanitize(own)
+  return sanitize(readRecord(LEGACY_STORAGE_KEY) ?? {})
+}
+
+/**
+ * Monotonic write stamp. `Date.now()` alone ties when several projects are
+ * saved inside the same millisecond, which would make eviction order arbitrary
+ * within a window; bumping past the last stamp keeps it strictly increasing.
+ */
+let lastSavedAt = 0
+
+function save(projectPath: string | null | undefined, state: LayoutState) {
+  if (!projectPath) return
+  lastSavedAt = Math.max(Date.now(), lastSavedAt + 1)
+  const record: StoredLayout = { ...state, projectPath, savedAt: lastSavedAt }
   try {
-    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(state))
+    window.localStorage.setItem(projectKey(projectPath), JSON.stringify(record))
   } catch {
     /* localStorage quota / disabled — silently fall back to in-memory */
+    return
+  }
+  evictOldest()
+}
+
+/** Drop the oldest records down to `MAX_PROJECT_RECORDS`. */
+function evictOldest() {
+  try {
+    const records: { key: string; savedAt: number }[] = []
+    for (let i = 0; i < window.localStorage.length; i++) {
+      const key = window.localStorage.key(i)
+      if (!key?.startsWith(STORAGE_KEY_PREFIX)) continue
+      const savedAt = readRecord(key)?.savedAt
+      records.push({ key, savedAt: typeof savedAt === 'number' ? savedAt : 0 })
+    }
+    if (records.length <= MAX_PROJECT_RECORDS) return
+    records.sort((a, b) => a.savedAt - b.savedAt)
+    for (const { key } of records.slice(0, records.length - MAX_PROJECT_RECORDS)) {
+      window.localStorage.removeItem(key)
+    }
+  } catch {
+    /* storage disabled — nothing to reclaim */
   }
 }
 
@@ -63,12 +154,31 @@ export interface LayoutStoreApi {
   setDevtoolsPosition: (position: DevtoolsPosition) => void
 }
 
-export function useLayoutStore(): LayoutStoreApi {
-  const [state, setState] = useState<LayoutState>(load)
+/**
+ * Dock layout for ONE project, persisted per project.
+ *
+ * Every project window loads the same `file://` origin and therefore shares one
+ * localStorage, so the record has to be keyed by the project the window is
+ * showing — otherwise two open projects overwrite each other's layout and any
+ * project reopens with whichever window saved last. `projectPath` is the
+ * identity: the window is opened for a path and has it before the first render,
+ * whereas the manifest `appId` only arrives once the session opens, which is
+ * after the dock model is seeded from this state.
+ */
+export function useLayoutStore(projectPath: string | null | undefined): LayoutStoreApi {
+  const [state, setState] = useState<LayoutState>(() => load(projectPath))
+  const loadedFor = useRef(projectPath)
 
   useEffect(() => {
-    save(state)
-  }, [state])
+    // A window that swaps projects in place must re-hydrate before it persists,
+    // or the previous project's layout would be written under the new identity.
+    if (loadedFor.current !== projectPath) {
+      loadedFor.current = projectPath
+      setState(load(projectPath))
+      return
+    }
+    save(projectPath, state)
+  }, [projectPath, state])
 
   const setDockTree = useCallback((serialized: string | null) => {
     setState((prev) => (prev.dockTree === serialized ? prev : { ...prev, dockTree: serialized }))
diff --git a/packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx b/packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx
index 7b157c76..25ff6e5e 100644
--- a/packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx
+++ b/packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx
@@ -63,7 +63,7 @@ export function ProjectRuntime({ project }: ProjectRuntimeProps) {
   const controller = useProjectRuntimeController({ projectPath: project.path })
   const { session, device, simulator, panelData, rightPane, popover } = controller
 
-  const layout = useLayoutStore()
+  const layout = useLayoutStore(project.path)
   const { state: layoutState } = layout
 
   // Dock model + registry are owned HERE (lifted out of DockableLayout) so the
diff --git a/packages/devtools/src/renderer/modules/main/main-edit-dialog.test.tsx b/packages/devtools/src/renderer/modules/main/main-edit-dialog.test.tsx
index 4d064c3e..a8590990 100644
--- a/packages/devtools/src/renderer/modules/main/main-edit-dialog.test.tsx
+++ b/packages/devtools/src/renderer/modules/main/main-edit-dialog.test.tsx
@@ -22,7 +22,6 @@ const api = vi.hoisted(() => ({
   listProjects: vi.fn(),
   getThumbnail: vi.fn(),
   getBranding: vi.fn(),
-  notifyWindowScreen: vi.fn(),
   onWindowNavigateBack: vi.fn(() => () => {}),
   onWindowOpenProject: vi.fn(() => () => {}),
   onProjectCreateSubmitted: vi.fn(() => () => {}),
diff --git a/packages/devtools/src/renderer/modules/main/main-open-project-window.test.tsx b/packages/devtools/src/renderer/modules/main/main-open-project-window.test.tsx
new file mode 100644
index 00000000..0dc1fec9
--- /dev/null
+++ b/packages/devtools/src/renderer/modules/main/main-open-project-window.test.tsx
@@ -0,0 +1,77 @@
+/**
+ * Main no longer switches to an in-tree `ProjectRuntime` page — opening a
+ * project asks main to spawn a standalone workbench window instead, and the
+ * list screen stays mounted throughout (see entries/workbench/main.tsx for
+ * the window that renders `ProjectRuntime`).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { render, screen, fireEvent, waitFor } from '@testing-library/react'
+import type { Project } from '@/shared/types'
+
+const project: Project = { name: 'Alpha', path: '/abs/alpha', lastOpened: null }
+
+const api = vi.hoisted(() => ({
+  listProjects: vi.fn(),
+  getThumbnail: vi.fn(),
+  getBranding: vi.fn(),
+  onWindowNavigateBack: vi.fn((_handler: () => void) => () => {}),
+  onWindowOpenProject: vi.fn((_handler: (p: { name: string; path: string }) => void) => () => {}),
+  onProjectCreateSubmitted: vi.fn(() => () => {}),
+  openProjectWindow: vi.fn(() => Promise.resolve()),
+  publishPlacementSnapshot: vi.fn(() => Promise.resolve()),
+  onHostSidebarWidthChanged: vi.fn(() => () => {}),
+  getHostSidebarWidth: vi.fn(() => Promise.resolve(0)),
+  onHostSidebarCategorySelected: vi.fn(() => () => {}),
+}))
+
+vi.mock('@/shared/api', () => api)
+vi.mock('@dimina-kit/view-anchor', () => ({ useViewAnchor: () => () => {} }))
+
+import Main from './main'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  api.listProjects.mockResolvedValue([project])
+  api.getThumbnail.mockResolvedValue(null)
+  api.getBranding.mockResolvedValue(undefined)
+  api.getHostSidebarWidth.mockResolvedValue(0)
+})
+
+async function renderMainWithProject() {
+  const result = render(<Main />)
+  await screen.findByText('Alpha')
+  return result
+}
+
+describe('Main: opening a project spawns a workbench window instead of switching pages', () => {
+  it('clicking a project card asks main to open a workbench window, and the list stays mounted', async () => {
+    await renderMainWithProject()
+
+    fireEvent.click(screen.getByText('Alpha').closest('[data-qd-card]')!)
+
+    expect(api.openProjectWindow).toHaveBeenCalledWith(project)
+    // No in-tree page switch: the list screen (and this card) is still there.
+    expect(screen.getByText('Alpha')).toBeInTheDocument()
+  })
+
+  it('forwards a main-pushed open (MCP project_open) to openProjectWindow', async () => {
+    await renderMainWithProject()
+    const pushHandler = api.onWindowOpenProject.mock.calls[0][0]
+
+    pushHandler({ name: 'Beta', path: '/abs/beta' })
+
+    expect(api.openProjectWindow).toHaveBeenCalledWith({ name: 'Beta', path: '/abs/beta' })
+  })
+
+  it('refreshes the project list when a workbench window reports navigate-back (its close)', async () => {
+    await renderMainWithProject()
+    const navigateBackHandler = api.onWindowNavigateBack.mock.calls[0][0]
+    const callsBefore = api.listProjects.mock.calls.length
+
+    navigateBackHandler()
+
+    await waitFor(() =>
+      expect(api.listProjects.mock.calls.length).toBeGreaterThan(callsBefore),
+    )
+  })
+})
diff --git a/packages/devtools/src/renderer/modules/main/main.tsx b/packages/devtools/src/renderer/modules/main/main.tsx
index 5899d4b8..8ecd6233 100644
--- a/packages/devtools/src/renderer/modules/main/main.tsx
+++ b/packages/devtools/src/renderer/modules/main/main.tsx
@@ -1,6 +1,5 @@
 import { useState, useEffect } from 'react'
 import { ProjectListScreen } from '@/modules/main/features/project-list/project-list-screen'
-import { ProjectRuntime } from '@/modules/main/features/project-runtime/project-runtime'
 import {
   addProject,
   chooseProjectDirectory,
@@ -10,12 +9,12 @@ import {
   getThumbnail,
   listProjects,
   listTemplates,
-  notifyWindowScreen,
   onProjectCreateSubmitted,
   onWindowNavigateBack,
   onWindowOpenProject,
   openCreateProjectDialog,
   openEditProjectDialog,
+  openProjectWindow,
   removeProject,
   showProjectCreateDialog,
   updateProject,
@@ -23,17 +22,12 @@ import {
 import { ProjectEditDialog } from '@/shared/components/project-edit-dialog'
 import type { Project, ProjectPatch } from '@/shared/types'
 
-const DEFAULT_APP_NAME = 'Dimina DevTools'
-
 export default function Main() {
-  const [page, setPage] = useState('list')
-  const [currentProject, setCurrentProject] = useState<Project | null>(null)
   const [projectList, setProjectList] = useState<Project[]>([])
   const [thumbnails, setThumbnails] = useState<Record<string, string | null>>({})
   const [editingProject, setEditingProject] = useState<Project | null>(null)
   const [savingEdit, setSavingEdit] = useState(false)
   const [editError, setEditError] = useState<string | null>(null)
-  const [appName, setAppName] = useState(DEFAULT_APP_NAME)
 
   async function loadProjects() {
     setProjectList(await listProjects())
@@ -44,7 +38,6 @@ export default function Main() {
     getBranding()
       .then((b) => {
         if (b?.appName) {
-          setAppName(b.appName)
           document.title = b.appName
         }
       })
@@ -60,29 +53,21 @@ export default function Main() {
     ).then((entries) => setThumbnails(Object.fromEntries(entries)))
   }, [projectList])
 
-  // Report our top-level screen to main so its window-close decision knows
-  // whether to return to the project list or quit. Fires on entry (including a
-  // failed open, which parks on the project screen) and on every change.
-  useEffect(() => {
-    notifyWindowScreen(page === 'project' ? 'project' : 'list')
-  }, [page])
-
+  // Fired when the user asks to come back to the project list (菜单「打开项目」)
+  // so the list reflects anything that changed while they were in a workbench
+  // window (e.g. lastOpened).
   useEffect(() => {
-    const off = onWindowNavigateBack(() => {
-      document.title = appName
-      setPage('list')
-      setCurrentProject(null)
+    return onWindowNavigateBack(() => {
       listProjects().then(setProjectList)
     })
-    return off
-  }, [appName])
+  }, [])
 
-  // Main-pushed open (MCP project_open): same path as a user click — mounting
-  // ProjectRuntime (keyed by path) is what compiles and attaches the simulator.
+  // Main-pushed open (MCP project_open): same path as a user click — asking
+  // main to spawn a workbench window is what compiles and attaches the
+  // simulator.
   useEffect(() => {
     return onWindowOpenProject((p) => {
-      setCurrentProject({ name: p.name, path: p.path })
-      setPage('project')
+      openProjectWindow({ name: p.name, path: p.path })
     })
   }, [])
 
@@ -251,35 +236,28 @@ export default function Main() {
   }
 
   function handleOpen(p: Project) {
-    setCurrentProject(p)
-    setPage('project')
-  }
-
-  if (page === 'list') {
-    return (
-      <>
-        <ProjectListScreen
-          projects={projectList}
-          onAdd={handleAdd}
-          onCreate={handleCreate}
-          onOpen={handleOpen}
-          onEdit={handleEdit}
-          onRemove={handleRemove}
-          thumbnails={thumbnails}
-        />
-        <ProjectEditDialog
-          open={editingProject !== null}
-          project={editingProject}
-          error={editError}
-          submitting={savingEdit}
-          onSubmit={handleEditSubmit}
-          onCancel={handleEditCancel}
-        />
-      </>
-    )
+    openProjectWindow(p)
   }
 
   return (
-    <ProjectRuntime key={currentProject?.path} project={currentProject!} />
+    <>
+      <ProjectListScreen
+        projects={projectList}
+        onAdd={handleAdd}
+        onCreate={handleCreate}
+        onOpen={handleOpen}
+        onEdit={handleEdit}
+        onRemove={handleRemove}
+        thumbnails={thumbnails}
+      />
+      <ProjectEditDialog
+        open={editingProject !== null}
+        project={editingProject}
+        error={editError}
+        submitting={savingEdit}
+        onSubmit={handleEditSubmit}
+        onCancel={handleEditCancel}
+      />
+    </>
   )
 }
diff --git a/packages/devtools/src/renderer/shared/api/view-api.ts b/packages/devtools/src/renderer/shared/api/view-api.ts
index ce3a2663..bb04512e 100644
--- a/packages/devtools/src/renderer/shared/api/view-api.ts
+++ b/packages/devtools/src/renderer/shared/api/view-api.ts
@@ -1,4 +1,4 @@
-import type { CompileConfig, ProjectType } from '@/shared/types'
+import type { CompileConfig, Project, ProjectType } from '@/shared/types'
 import type { NativeDeviceInfo } from '../../../shared/ipc-channels'
 import {
   SimulatorChannel,
@@ -217,14 +217,13 @@ export function onWindowOpenProject(
 }
 
 /**
- * Report the current top-level screen to main so its window-close decision
- * knows whether to return to the project list or quit the app. Call on every
- * screen change, including entering a project (BEFORE the open resolves — a
- * failed open then leaves main's mirror = 'project', so closing returns to the
- * list instead of quitting). Fire-and-forget.
+ * Ask main to open `project` in its own standalone workbench window
+ * (`entries/workbench/`), replacing the old in-place `page: 'project'` switch
+ * inside the list window. Fire-and-forget from the caller's perspective — the
+ * new window reports its own screen state once it boots.
  */
-export function notifyWindowScreen(screen: 'list' | 'project'): void {
-  void invoke<void>(WindowChannel.ScreenState, screen)
+export function openProjectWindow(project: Project): Promise<void> {
+  return invoke<void>(WindowChannel.OpenProjectWindow, project)
 }
 
 /**
diff --git a/packages/devtools/src/shared/ipc-channels.ts b/packages/devtools/src/shared/ipc-channels.ts
index db41b200..b93b1f19 100644
--- a/packages/devtools/src/shared/ipc-channels.ts
+++ b/packages/devtools/src/shared/ipc-channels.ts
@@ -292,13 +292,10 @@ export const DialogChannel = {
 export const WindowChannel = {
   NavigateBack: 'window:navigateBack',
   OpenProject: 'window:openProject',
-  // Renderer → main: the renderer's current top-level screen ('project' when
-  // inside a project screen, 'list' on the project list / landing). The
-  // renderer pushes this on every screen change, including the moment it enters
-  // a project — BEFORE the open resolves — so a FAILED open (no session) still
-  // leaves main's mirror = 'project'. The window-close decision reads it so
-  // closing a stuck/failed project returns to the list instead of quitting.
-  ScreenState: 'window:screenState',
+  // Renderer → main invoke: open `project` in its own standalone workbench
+  // window (`entries/workbench/`), replacing the old in-place `page: 'project'`
+  // switch inside the list window's React tree.
+  OpenProjectWindow: 'window:openProjectWindow',
 } as const
 
 // ── App ──────────────────────────────────────────────────────────────────
diff --git a/packages/devtools/src/shared/project-window-types.ts b/packages/devtools/src/shared/project-window-types.ts
new file mode 100644
index 00000000..6891cf56
--- /dev/null
+++ b/packages/devtools/src/shared/project-window-types.ts
@@ -0,0 +1,44 @@
+import type { WorkbenchHostInstance } from './types.js'
+
+/**
+ * One project window, handed to the host hooks that act on a single project:
+ * `setupProjectWindow` on the way in and `onBeforeClose` on the way out.
+ */
+export interface ProjectWindowRef {
+  /** Absolute path of the project this window was opened for. */
+  path: string
+  /** Display name the open supplied, when it supplied one. */
+  name?: string
+  /** The window itself. */
+  window: import('electron').BrowserWindow
+  /**
+   * This window's own context — the one holding its session and views. Same
+   * type as {@link WorkbenchHostInstance.context}, borrowed from there rather
+   * than named again so this file keeps its single WorkbenchContext reference.
+   */
+  context: WorkbenchHostInstance['context']
+}
+
+/**
+ * The project window being closed. Named separately from
+ * {@link ProjectWindowRef} because `onBeforeClose` documents it under this
+ * name; the shape is the same.
+ */
+export type ClosingProjectWindow = ProjectWindowRef
+
+/** Overrides for the windows opened projects get, not for the project list. */
+export interface ProjectWindowConfig {
+  /**
+   * Whether the framework shows a project window on its own. Defaults to
+   * `true`: once `setupProjectWindow` has resolved AND the window's own
+   * `ready-to-show` has fired (whichever finishes second), the framework
+   * reveals it. `false` is a permanent opt-out — the framework never shows
+   * that window on its own, no matter what the hook does or how many times
+   * `ready-to-show` fires; the host must call `show()` itself.
+   *
+   * Independent of `window.autoShow`, which governs only the project-list
+   * window: a host that keeps the list hidden behind its own startup flow
+   * still wants the project windows opened afterwards to appear on screen.
+   */
+  autoShow?: boolean
+}
diff --git a/packages/devtools/src/shared/types.ts b/packages/devtools/src/shared/types.ts
index 699a8e70..52107b24 100644
--- a/packages/devtools/src/shared/types.ts
+++ b/packages/devtools/src/shared/types.ts
@@ -1,6 +1,9 @@
 import type { OpenProjectOptions } from '@dimina-kit/devkit'
 import type { SimulatorApiHandler } from '../main/services/simulator/custom-apis.js'
 import type { MiniappSessionAppInfo } from '../main/runtime/miniapp-runtime.js'
+import type { ClosingProjectWindow, ProjectWindowConfig, ProjectWindowRef } from './project-window-types.js'
+
+export type { ClosingProjectWindow, ProjectWindowConfig, ProjectWindowRef }
 
 /**
  * The HAND-WRITTEN narrow contract handed to a host `menuBuilder` — the
@@ -30,7 +33,7 @@ export interface MenuContext {
   notify: {
     /** Broadcast compile-status transitions to the main renderer. */
     projectStatus: (payload: { status: string; message: string; hotReload?: boolean }) => void
-    /** Ask the main renderer to navigate back to its landing screen (打开项目). */
+    /** Bring the project-list window forward and refresh it (打开项目). */
     windowNavigateBack: () => void
   }
 }
@@ -58,7 +61,7 @@ export interface ProjectSession {
 }
 
 export interface CompilationAdapter {
-  openProject(opts: Omit<OpenProjectOptions, 'containerDir' | 'outputDir'>): Promise<ProjectSession>
+  openProject(opts: Omit<OpenProjectOptions, 'containerDir' | 'outputDir' | 'outputRoot'>): Promise<ProjectSession>
 }
 
 export type BuiltinPanelId = 'wxml' | 'console' | 'appdata' | 'storage'
@@ -200,10 +203,11 @@ export interface WorkbenchHostInstance {
   ): import('@dimina-kit/electron-deck/main').Disposable
 
   /**
-   * Registers a simulator custom API into THIS context's registry, callable
-   * from mini-program code as `wx.<name>(params)`. The registration joins
-   * `context.registry`, so it is released when the context is disposed.
-   * The returned Disposable removes only the registration it created.
+   * Registers a simulator custom API, callable from mini-program code as
+   * `wx.<name>(params)`. The registry is app-level: one registration serves
+   * every project window, including windows opened afterwards, and no window
+   * closing revokes it. It lives until the app is disposed or the returned
+   * Disposable revokes it — which removes only the registration it created.
    */
   registerSimulatorApi(
     name: string,
@@ -297,16 +301,44 @@ export interface WorkbenchAppConfig extends WorkbenchConfig {
   rendererDir?: string
   /** Enable or disable built-in IPC module groups. Defaults to all enabled. */
   modules?: Partial<Record<BuiltinModuleId, boolean>>
-  /** Window sizing overrides for the main devtools window. */
+  /** Window sizing overrides for the project-list window. */
   window?: WorkbenchWindowConfig
+  /** Overrides for the windows opened projects get. */
+  projectWindow?: ProjectWindowConfig
   /** Absolute path to a window/taskbar icon (png or ico). macOS uses the app bundle icon. */
   icon?: string
   /** Custom menu builder. Should call Menu.setApplicationMenu(). If omitted, the default dimina-devtools menu is installed. */
   menuBuilder?: (mainWindow: import('electron').BrowserWindow, menuContext: MenuContext) => void
   /** Called after window and context are created but before start() resolves. Use to register custom IPC handlers. */
   onSetup?: (instance: WorkbenchHostInstance) => void | Promise<void>
-  /** Called before window close when a session is active. Session disposal happens automatically after this hook. */
-  onBeforeClose?: (instance: WorkbenchHostInstance) => void | Promise<void>
+  /**
+   * Called once per project window, after the framework has wired that window
+   * up and before the open resolves. `opened.context` is THAT window's own
+   * context, which is why per-project registration belongs here: `onSetup`
+   * only ever sees `instance.context`, the project list's, so a registration
+   * made there reaches no project window.
+   *
+   * Awaited, and unlike `onBeforeClose` it can fail the open: a rejection
+   * tears the half-built window down and reaches whoever asked for it.
+   */
+  setupProjectWindow?: (
+    instance: WorkbenchHostInstance,
+    opened: ProjectWindowRef,
+  ) => void | Promise<void>
+  /**
+   * Called when a project window is closing, before the framework disposes it.
+   * `closing` says WHICH project is going away and carries that window's own
+   * context — `instance.context` is always the project list's, which owns no
+   * session, so with several windows open it cannot tell them apart. A hook
+   * that only declares `instance` still type-checks.
+   *
+   * Awaited, but not a veto: a rejection is logged and the window is disposed
+   * regardless.
+   */
+  onBeforeClose?: (
+    instance: WorkbenchHostInstance,
+    closing: ClosingProjectWindow,
+  ) => void | Promise<void>
   /**
    * Called before a project is opened, BEFORE any side effect (session
    * teardown, compile, dev-server). Use to gate the open on login/permission
diff --git a/packages/devtools/vite.config.ts b/packages/devtools/vite.config.ts
index 5fd6fa41..3cd7bce1 100644
--- a/packages/devtools/vite.config.ts
+++ b/packages/devtools/vite.config.ts
@@ -35,6 +35,7 @@ export default defineConfig({
       external: ['electron', 'path', 'fs', 'os', 'url', 'child_process'],
       input: {
         index: resolve(rendererRoot, 'entries/main/index.html'),
+        workbench: resolve(rendererRoot, 'entries/workbench/index.html'),
         popover: resolve(rendererRoot, 'entries/popover/index.html'),
         settings: resolve(rendererRoot, 'entries/settings/index.html'),
         tooltip: resolve(rendererRoot, 'entries/tooltip/index.html'),
diff --git a/packages/dimina-electron-runtime/src/index.ts b/packages/dimina-electron-runtime/src/index.ts
index d379db08..3c292390 100644
--- a/packages/dimina-electron-runtime/src/index.ts
+++ b/packages/dimina-electron-runtime/src/index.ts
@@ -261,13 +261,18 @@ export async function createElectronRuntime(
     closing = true
     const viewSession = embeddedSession
     const compileSession = compilerSession
+    // Capture the outgoing project's identity before the fields below reset —
+    // clearing needs THIS project's appId+path to target its own partition
+    // entry, not whatever the next project happens to be.
+    const closingAppId = compileSession?.appInfo.appId
+    const closingProjectPath = projectPath
     readyStatusOff?.()
     readyStatusOff = null
     miniappSession = null
     embeddedSession = null
     compilerSession = null
     projectPath = ''
-    clearSimulatorServicewechatReferer()
+    clearSimulatorServicewechatReferer(closingAppId, closingProjectPath)
     try {
       const errors: unknown[] = []
       if (viewSession) {
@@ -340,7 +345,7 @@ export async function createElectronRuntime(
           throw new Error('compiler adapter returned a session without appInfo.appId')
         }
         compilerSession = session
-        setSimulatorServicewechatReferer(session.appInfo.appId)
+        setSimulatorServicewechatReferer(session.appInfo.appId, undefined, projectPath)
         latestUrl = buildSimulatorUrl(
           session.port,
           session.appInfo.appId,
diff --git a/packages/dimina-electron-runtime/src/main/ipc/bridge-router-ipc-mux.ts b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-ipc-mux.ts
new file mode 100644
index 00000000..9d515f42
--- /dev/null
+++ b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-ipc-mux.ts
@@ -0,0 +1,64 @@
+/**
+ * Process-wide multiplexing for the bridge router's `ipcMain` channels.
+ *
+ * `installBridgeRouter` is per-window assembly: every workbench window gets its
+ * own router closure over its own `RouterState`. `ipcMain.handle` accepts
+ * exactly ONE handler per channel process-wide and throws on a second, and
+ * `event.returnValue` on a sync channel is single-valued — so with several
+ * windows open the invoke channels would fail to install and the sync reply
+ * would come from whichever router answered last. The mux (shared with
+ * devtools' own per-window panel services — see
+ * @dimina-kit/electron-deck/main's ipc-mux.ts) installs a single real
+ * registration per channel and dispatches each message to the router that
+ * owns the calling webContents.
+ */
+
+import { ipcMain } from 'electron'
+import type { BrowserWindow, WebContents } from 'electron'
+import {
+  addMuxedInvokeHandler as muxInvoke,
+  addMuxedSyncListener as muxSync,
+  windowHostsWebContents,
+  type InvokeMuxEntry,
+  type SyncMuxEntry,
+} from '@dimina-kit/electron-deck/main'
+
+// The mux takes `ipcMain` from its caller so that nothing in
+// @dimina-kit/electron-deck/main imports a value from `electron`; this package
+// already does, so it binds the real one here.
+export const addMuxedInvokeHandler = (channel: string, entry: InvokeMuxEntry): (() => void) =>
+  muxInvoke(ipcMain, channel, entry)
+export const addMuxedSyncListener = (channel: string, entry: SyncMuxEntry): (() => void) =>
+  muxSync(ipcMain, channel, entry)
+
+/**
+ * The webContents ledgers a router keeps. A sender recorded in any of them was
+ * bound by THIS router, so it belongs to it — this is what makes the hidden
+ * service-host window (a standalone BrowserWindow, hosted by no workbench
+ * window) resolve to the router that spawned it.
+ */
+export interface RouterSenderLedger {
+  serviceWcIdToAppSessionId: Map<number, string>
+  simulatorWcIdToAppSessionIds: Map<number, Set<string>>
+  wcIdToBridgeId: Map<number, string>
+}
+
+/**
+ * Whether the router holding `ledger` and driving `win` owns `wc`.
+ *
+ * The ledgers answer for senders the router already knows (render guests,
+ * simulator, and the out-of-window service host). The window check answers for
+ * a sender's FIRST message — a spawn arrives from the device shell before any
+ * ledger entry exists, but that shell is always inside its own window.
+ */
+export function routerOwnsSender(
+  ledger: RouterSenderLedger,
+  win: BrowserWindow | undefined,
+  wc: WebContents | undefined,
+): boolean {
+  if (!wc || wc.isDestroyed()) return false
+  if (ledger.serviceWcIdToAppSessionId.has(wc.id)) return true
+  if (ledger.simulatorWcIdToAppSessionIds.has(wc.id)) return true
+  if (ledger.wcIdToBridgeId.has(wc.id)) return true
+  return windowHostsWebContents(win, wc)
+}
diff --git a/packages/dimina-electron-runtime/src/main/ipc/bridge-router-multi-window.test.ts b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-multi-window.test.ts
new file mode 100644
index 00000000..64fcb615
--- /dev/null
+++ b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-multi-window.test.ts
@@ -0,0 +1,412 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const electronStubs = vi.hoisted(() => {
+  type SyncListener = (...args: unknown[]) => void
+  const handlers = new Map<string, (event: unknown, ...args: unknown[]) => unknown>()
+  const syncListeners = new Map<string, SyncListener[]>()
+  const sync = {
+    on(channel: string, listener: SyncListener) {
+      const list = syncListeners.get(channel) ?? []
+      list.push(listener)
+      syncListeners.set(channel, list)
+    },
+    removeListener(channel: string, listener: SyncListener) {
+      const list = syncListeners.get(channel)
+      if (!list) return
+      const at = list.indexOf(listener)
+      if (at !== -1) list.splice(at, 1)
+    },
+    listenerCount: (channel: string) => syncListeners.get(channel)?.length ?? 0,
+    emit(channel: string, ...args: unknown[]) {
+      for (const listener of [...(syncListeners.get(channel) ?? [])]) listener(...args)
+    },
+    removeAllListeners() {
+      syncListeners.clear()
+    },
+  }
+  const ipcMain = {
+    handle(channel: string, fn: (event: unknown, ...args: unknown[]) => unknown) {
+      // Verbatim Electron behaviour: one handler per channel, process-wide.
+      if (handlers.has(channel)) {
+        throw new Error(`Attempted to register a second handler for '${channel}'`)
+      }
+      handlers.set(channel, fn)
+    },
+    removeHandler(channel: string) {
+      handlers.delete(channel)
+    },
+    on(channel: string, listener: (...args: unknown[]) => void) {
+      sync.on(channel, listener)
+      return ipcMain
+    },
+    removeListener(channel: string, listener: (...args: unknown[]) => void) {
+      sync.removeListener(channel, listener)
+      return ipcMain
+    },
+    listenerCount: (channel: string) => sync.listenerCount(channel),
+  }
+  // A protocol registrar (the default `protocol`, or a session's) tracks what is
+  // currently installed so a test can tell "handler replaced" from "handler
+  // removed", and can run the live handler.
+  const makeProtocolStub = () => {
+    const installed = new Map<string, (request: { url: string }) => unknown>()
+    return {
+      installed,
+      handle: vi.fn((scheme: string, fn: (request: { url: string }) => unknown) => {
+        installed.set(scheme, fn)
+      }),
+      unhandle: vi.fn((scheme: string) => {
+        installed.delete(scheme)
+      }),
+      registerSchemesAsPrivileged: vi.fn(),
+    }
+  }
+  const protocolStub = makeProtocolStub()
+  const sessions = new Map<string, { protocol: ReturnType<typeof makeProtocolStub> }>()
+  const fromPartition = (partition: string) => {
+    let sess = sessions.get(partition)
+    if (!sess) {
+      sess = {
+        protocol: makeProtocolStub(),
+        setPermissionRequestHandler: vi.fn(),
+        webRequest: { onBeforeSendHeaders: vi.fn(), onHeadersReceived: vi.fn() },
+      } as unknown as { protocol: ReturnType<typeof makeProtocolStub> }
+      sessions.set(partition, sess)
+    }
+    return sess
+  }
+  return { handlers, sync, ipcMain, protocolStub, sessions, fromPartition }
+})
+
+vi.mock('electron', () => ({
+  app: { isReady: () => true, on: vi.fn(), getLocale: () => 'zh-CN' },
+  BrowserWindow: class {},
+  ipcMain: electronStubs.ipcMain,
+  protocol: electronStubs.protocolStub,
+  session: { fromPartition: electronStubs.fromPartition },
+  webContents: { fromId: () => null, getAllWebContents: () => [] },
+  default: {},
+}))
+
+const dmbResourceSpy = vi.hoisted(() => vi.fn())
+vi.mock('../services/dmb-resource/handle-request.js', () => ({
+  handleDmbResourceRequest: (input: { sdkRoot: string }) => {
+    dmbResourceSpy(input)
+    return Promise.resolve(new Response(input.sdkRoot))
+  },
+}))
+
+import { BRIDGE_CHANNELS as C } from '../../shared/bridge-channels.js'
+import type { NativeHostConfig } from '../../shared/bridge-channels.js'
+import type { NativeDeviceInfo } from '../../shared/runtime-types.js'
+import {
+  SHARED_MINIAPP_PARTITION,
+  __resetMiniappSessionConfigForTests,
+} from '../services/views/miniapp-partition.js'
+import { routerOwnsSender } from './bridge-router-ipc-mux.js'
+import { installBridgeRouter } from './bridge-router.js'
+import type { RuntimeContext } from '../runtime-context.js'
+
+let nextWcId = 1
+
+interface FakeWc {
+  id: number
+  isDestroyed: () => boolean
+  send: ReturnType<typeof vi.fn>
+  hostWebContents?: FakeWc
+}
+
+function fakeWc(host?: FakeWc): FakeWc {
+  return { id: nextWcId++, isDestroyed: () => false, send: vi.fn(), hostWebContents: host }
+}
+
+class FakeRegistry {
+  private readonly disposers: Array<() => unknown> = []
+  add(value: { dispose(): unknown } | (() => unknown)) {
+    const dispose = typeof value === 'function' ? value : () => value.dispose()
+    this.disposers.push(dispose)
+    return { dispose }
+  }
+  async dispose() {
+    for (const dispose of this.disposers.reverse()) await dispose()
+    this.disposers.length = 0
+  }
+}
+
+interface FakeView {
+  children: FakeView[]
+  webContents?: FakeWc
+}
+
+interface TestCtx {
+  ctx: RuntimeContext
+  windowWc: FakeWc
+  contentView: FakeView
+  projectPath: ReturnType<typeof vi.fn>
+  registry: FakeRegistry
+}
+
+const assets = {
+  root: '/runtime/dist',
+  simulatorDir: '/runtime/dist/simulator',
+  simulatorPreloadPath: '/runtime/dist/preload/simulator.cjs',
+  renderHostHtmlPath: '/runtime/dist/render-host/pageFrame.html',
+  renderHostPreloadPath: '/runtime/dist/render-host/preload.cjs',
+  serviceHostHtmlPath: '/runtime/dist/service-host/service.html',
+  serviceHostPreloadPath: '/runtime/dist/service-host/preload.cjs',
+}
+
+const openCtxs: TestCtx[] = []
+
+function makeCtx(label: string): TestCtx {
+  const windowWc = fakeWc()
+  const contentView: FakeView = { children: [] }
+  // `getProjectPath` is the first ctx-owned call `handleSpawn` makes, so a
+  // throwing spy names the router that actually took the invoke.
+  const projectPath = vi.fn(() => {
+    throw new Error(`spawn-probe:${label}`)
+  })
+  const registry = new FakeRegistry()
+  const ctx = {
+    apiNamespaces: [],
+    // Each window resolves its own runtime dist, so `sdkRoot` names the router
+    // that served a dmb-resource request.
+    assets: { ...assets, root: `/runtime/${label}` },
+    workspace: {
+      getSession: () => null,
+      getProjectPath: projectPath,
+      isClosing: () => false,
+    },
+    windows: {
+      mainWindow: {
+        webContents: windowWc,
+        isDestroyed: () => false,
+        contentView,
+        on: vi.fn(),
+        off: vi.fn(),
+        removeListener: vi.fn(),
+      },
+    },
+    registry,
+    connections: { acquire: vi.fn(), get: vi.fn() },
+    simulatorApis: { invoke: vi.fn(async () => label), list: () => [] },
+    events: { emit: vi.fn(), on: vi.fn(), off: vi.fn() },
+  } as unknown as RuntimeContext
+  const entry: TestCtx = { ctx, windowWc, contentView, projectPath, registry }
+  openCtxs.push(entry)
+  return entry
+}
+
+function invokeSpawn(sender: FakeWc): Promise<unknown> {
+  const handler = electronStubs.handlers.get(C.SPAWN)
+  if (!handler) throw new Error(`no handler on ${C.SPAWN}`)
+  return Promise.resolve(handler({ sender }, { appId: 'app-1', pagePath: 'pages/index/index' }))
+}
+
+beforeEach(() => {
+  nextWcId = 1
+})
+
+afterEach(async () => {
+  for (const entry of openCtxs.splice(0)) await entry.registry.dispose()
+  electronStubs.handlers.clear()
+  electronStubs.sync.removeAllListeners()
+  electronStubs.protocolStub.handle.mockClear()
+  electronStubs.protocolStub.unhandle.mockClear()
+  electronStubs.protocolStub.installed.clear()
+  electronStubs.sessions.clear()
+  dmbResourceSpy.mockClear()
+  __resetMiniappSessionConfigForTests()
+})
+
+describe('installBridgeRouter across several workbench windows', () => {
+  it('installs twice in one process without colliding on the invoke channels', () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    expect(() => installBridgeRouter(b.ctx)).not.toThrow()
+  })
+
+  it('routes SPAWN from a <webview> guest to the router owning its window', async () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+
+    // Default architecture: the simulator is a `<webview>` guest, so the guest's
+    // `hostWebContents` is its window's renderer.
+    await expect(invokeSpawn(fakeWc(b.windowWc))).rejects.toThrow('spawn-probe:B')
+    expect(a.projectPath).not.toHaveBeenCalled()
+
+    // The router installed FIRST must still get its own window's traffic.
+    await expect(invokeSpawn(fakeWc(a.windowWc))).rejects.toThrow('spawn-probe:A')
+    expect(b.projectPath).toHaveBeenCalledTimes(1)
+  })
+
+  it('routes SPAWN from a WebContentsView child to the router owning its window', async () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+
+    // native-host architecture: the simulator is a WebContentsView attached to
+    // the window's contentView, nested one level below the root view.
+    const viewWc = fakeWc()
+    b.contentView.children.push({ children: [{ children: [], webContents: viewWc }] })
+    await expect(invokeSpawn(viewWc)).rejects.toThrow('spawn-probe:B')
+    expect(a.projectPath).not.toHaveBeenCalled()
+
+    // The router installed FIRST must still get its own window's view traffic.
+    const viewWcA = fakeWc()
+    a.contentView.children.push({ children: [{ children: [], webContents: viewWcA }] })
+    await expect(invokeSpawn(viewWcA)).rejects.toThrow('spawn-probe:A')
+
+    // A `<webview>` guest nested inside that WebContentsView resolves the same way.
+    const nestedGuest = fakeWc(viewWc)
+    await expect(invokeSpawn(nestedGuest)).rejects.toThrow('spawn-probe:B')
+    expect(a.projectPath).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps the surviving router serving after the other one is disposed', async () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+
+    await a.registry.dispose()
+    expect(electronStubs.handlers.has(C.SPAWN)).toBe(true)
+    await expect(invokeSpawn(fakeWc(b.windowWc))).rejects.toThrow('spawn-probe:B')
+
+    await b.registry.dispose()
+    expect(electronStubs.handlers.has(C.SPAWN)).toBe(false)
+    expect(electronStubs.handlers.has(C.PAGE_OPEN)).toBe(false)
+    expect(electronStubs.handlers.has(C.SIMULATOR_API)).toBe(false)
+  })
+
+  it('answers SIMULATOR_API from the router owning the sender', async () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+
+    const handler = electronStubs.handlers.get(C.SIMULATOR_API)!
+    await handler({ sender: fakeWc(a.windowWc) }, { name: 'x', params: {} })
+    expect(a.ctx.simulatorApis.invoke).toHaveBeenCalledTimes(1)
+    expect(b.ctx.simulatorApis.invoke).not.toHaveBeenCalled()
+  })
+
+  it('falls back to the newest router for a sender no window hosts', async () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+
+    await expect(invokeSpawn(fakeWc())).rejects.toThrow('spawn-probe:B')
+    expect(a.projectPath).not.toHaveBeenCalled()
+  })
+
+  it('answers the NATIVE_HOST_ENABLED sync query from the sender own router', () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+
+    const deviceA = { name: 'device-A' } as unknown as NativeDeviceInfo
+    const deviceB = { name: 'device-B' } as unknown as NativeDeviceInfo
+    a.ctx.bridge!.setDevice(deviceA)
+    b.ctx.bridge!.setDevice(deviceB)
+
+    const event = { sender: fakeWc(a.windowWc), returnValue: undefined as unknown }
+    electronStubs.sync.emit(C.NATIVE_HOST_ENABLED, event)
+    expect((event.returnValue as NativeHostConfig).device).toBe(deviceA)
+  })
+})
+
+describe('dmb-resource protocol across several workbench windows', () => {
+  const dmbHandlers = () =>
+    electronStubs.protocolStub.handle.mock.calls.filter(([scheme]) => scheme === 'dmb-resource')
+
+  it('installs one process-wide handler no matter how many routers exist', () => {
+    installBridgeRouter(makeCtx('A').ctx)
+    installBridgeRouter(makeCtx('B').ctx)
+
+    expect(dmbHandlers()).toHaveLength(1)
+    expect(electronStubs.protocolStub.installed.has('dmb-resource')).toBe(true)
+    const shared = electronStubs.sessions.get(SHARED_MINIAPP_PARTITION)!
+    expect(shared.protocol.installed.has('dmb-resource')).toBe(true)
+  })
+
+  it('keeps serving the first window after the second one closes', async () => {
+    makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(openCtxs[0]!.ctx)
+    installBridgeRouter(b.ctx)
+
+    await b.registry.dispose()
+
+    // The surviving window's guests still resolve `dmb-resource://…`, and they
+    // resolve against THEIR router (own sdkRoot, own session ledger).
+    const handler = electronStubs.protocolStub.installed.get('dmb-resource')
+    expect(handler).toBeTypeOf('function')
+    await handler!({ url: 'dmb-resource://bridge-a/appA/main/pages/index/index.js' })
+    expect(dmbResourceSpy).toHaveBeenCalledTimes(1)
+    expect(dmbResourceSpy.mock.calls[0]![0]).toMatchObject({ sdkRoot: '/runtime/A' })
+  })
+
+  it('unhandles the scheme only when the last router is gone', async () => {
+    const a = makeCtx('A')
+    const b = makeCtx('B')
+    installBridgeRouter(a.ctx)
+    installBridgeRouter(b.ctx)
+    const shared = electronStubs.sessions.get(SHARED_MINIAPP_PARTITION)!
+
+    await b.registry.dispose()
+    expect(electronStubs.protocolStub.installed.has('dmb-resource')).toBe(true)
+    expect(shared.protocol.installed.has('dmb-resource')).toBe(true)
+
+    await a.registry.dispose()
+    expect(electronStubs.protocolStub.installed.has('dmb-resource')).toBe(false)
+    expect(shared.protocol.installed.has('dmb-resource')).toBe(false)
+  })
+})
+
+describe('routerOwnsSender', () => {
+  const emptyLedger = () => ({
+    serviceWcIdToAppSessionId: new Map<number, string>(),
+    simulatorWcIdToAppSessionIds: new Map<number, Set<string>>(),
+    wcIdToBridgeId: new Map<number, string>(),
+  })
+  const window = (wc: FakeWc, contentView: FakeView = { children: [] }) => ({
+    webContents: wc,
+    contentView,
+    isDestroyed: () => false,
+  }) as unknown as Parameters<typeof routerOwnsSender>[1]
+
+  it('claims the hidden service-host window through the session ledger', () => {
+    const ledger = emptyLedger()
+    const serviceWc = fakeWc()
+    ledger.serviceWcIdToAppSessionId.set(serviceWc.id, 'session-1')
+    // The service host is a standalone BrowserWindow: no workbench window hosts
+    // it, so only the ledger can attribute it.
+    const owns = routerOwnsSender(ledger, window(fakeWc()), serviceWc as never)
+    expect(owns).toBe(true)
+  })
+
+  it('claims a render guest through the bridge ledger', () => {
+    const ledger = emptyLedger()
+    const renderWc = fakeWc()
+    ledger.wcIdToBridgeId.set(renderWc.id, 'bridge-1')
+    expect(routerOwnsSender(ledger, window(fakeWc()), renderWc as never)).toBe(true)
+  })
+
+  it('refuses a sender that is neither in the ledger nor in the window', () => {
+    expect(routerOwnsSender(emptyLedger(), window(fakeWc()), fakeWc() as never)).toBe(false)
+  })
+
+  it('refuses a destroyed sender', () => {
+    const wc = { ...fakeWc(), isDestroyed: () => true }
+    const ledger = emptyLedger()
+    ledger.wcIdToBridgeId.set(wc.id, 'bridge-1')
+    expect(routerOwnsSender(ledger, window(fakeWc()), wc as never)).toBe(false)
+  })
+})
diff --git a/packages/dimina-electron-runtime/src/main/ipc/bridge-router-protocol-mux.test.ts b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-protocol-mux.test.ts
new file mode 100644
index 00000000..e2e47f02
--- /dev/null
+++ b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-protocol-mux.test.ts
@@ -0,0 +1,159 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+const electronStubs = vi.hoisted(() => {
+  const makeProtocolStub = () => {
+    const installed = new Map<string, (request: { url: string }) => unknown>()
+    return {
+      installed,
+      handle: vi.fn((scheme: string, fn: (request: { url: string }) => unknown) => {
+        installed.set(scheme, fn)
+      }),
+      unhandle: vi.fn((scheme: string) => {
+        installed.delete(scheme)
+      }),
+    }
+  }
+  const protocolStub = makeProtocolStub()
+  const sessions = new Map<string, { protocol: ReturnType<typeof makeProtocolStub> }>()
+  const fromPartition = (partition: string) => {
+    let sess = sessions.get(partition)
+    if (!sess) {
+      sess = { protocol: makeProtocolStub() }
+      sessions.set(partition, sess)
+    }
+    return sess
+  }
+  return { protocolStub, sessions, fromPartition }
+})
+
+vi.mock('electron', () => ({
+  protocol: electronStubs.protocolStub,
+  session: { fromPartition: electronStubs.fromPartition },
+  default: {},
+}))
+
+import {
+  SHARED_MINIAPP_PARTITION,
+  __resetMiniappSessionConfigForTests,
+  configureMiniappSession,
+} from '../services/views/miniapp-partition.js'
+import { addMuxedDmbResourceHandler } from './bridge-router-protocol-mux.js'
+
+const SCHEME = 'dmb-resource'
+const PROJECT_PARTITION = 'persist:miniapp-project-a'
+
+const disposers: Array<() => void> = []
+
+/** A router that owns exactly the named bridgeIds and reports itself by label. */
+function addRouter(label: string, ownedBridgeIds: string[]) {
+  const served: string[] = []
+  const dispose = addMuxedDmbResourceHandler({
+    claims: (requestUrl) => ownedBridgeIds.includes(new URL(requestUrl).hostname),
+    handle: async (request) => {
+      served.push(new URL(request.url).hostname)
+      return new Response(label)
+    },
+  })
+  disposers.push(dispose)
+  return { label, served, dispose }
+}
+
+function liveHandler(registrar = electronStubs.protocolStub) {
+  const handler = registrar.installed.get(SCHEME)
+  expect(handler).toBeTypeOf('function')
+  return handler as (request: { url: string }) => Promise<Response>
+}
+
+async function request(bridgeId: string, registrar = electronStubs.protocolStub): Promise<string> {
+  const response = await liveHandler(registrar)({ url: `dmb-resource://${bridgeId}/app/main/x.js` })
+  return response.text()
+}
+
+afterEach(() => {
+  for (const dispose of disposers.splice(0)) dispose()
+  electronStubs.protocolStub.handle.mockClear()
+  electronStubs.protocolStub.unhandle.mockClear()
+  electronStubs.protocolStub.installed.clear()
+  electronStubs.sessions.clear()
+  __resetMiniappSessionConfigForTests()
+})
+
+describe('addMuxedDmbResourceHandler', () => {
+  it('installs the scheme once for any number of routers', () => {
+    addRouter('A', ['bridge-a'])
+    addRouter('B', ['bridge-b'])
+
+    expect(electronStubs.protocolStub.handle).toHaveBeenCalledTimes(1)
+    expect(electronStubs.sessions.get(SHARED_MINIAPP_PARTITION)!.protocol.handle)
+      .toHaveBeenCalledTimes(1)
+  })
+
+  it('serves each bridgeId from the router that owns it', async () => {
+    const a = addRouter('A', ['bridge-a'])
+    const b = addRouter('B', ['bridge-b'])
+
+    // The FIRST-registered router must still get its own bridgeId once a newer
+    // router exists — that is the cross-window mix-up this mux prevents.
+    await expect(request('bridge-a')).resolves.toBe('A')
+    await expect(request('bridge-b')).resolves.toBe('B')
+    expect(a.served).toEqual(['bridge-a'])
+    expect(b.served).toEqual(['bridge-b'])
+  })
+
+  it('hands an unowned bridgeId to the newest router so it answers as before', async () => {
+    addRouter('A', ['bridge-a'])
+    addRouter('B', ['bridge-b'])
+
+    await expect(request('bridge-gone')).resolves.toBe('B')
+  })
+
+  it('serves the shared and per-project partitions with the same dispatch', async () => {
+    addRouter('A', ['bridge-a'])
+    addRouter('B', ['bridge-b'])
+    configureMiniappSession(PROJECT_PARTITION)
+
+    const shared = electronStubs.sessions.get(SHARED_MINIAPP_PARTITION)!
+    const project = electronStubs.sessions.get(PROJECT_PARTITION)!
+    await expect(request('bridge-a', shared.protocol)).resolves.toBe('A')
+    await expect(request('bridge-a', project.protocol)).resolves.toBe('A')
+    await expect(request('bridge-b', project.protocol)).resolves.toBe('B')
+  })
+
+  it('keeps the surviving router serving after another router is disposed', async () => {
+    const a = addRouter('A', ['bridge-a'])
+    const b = addRouter('B', ['bridge-b'])
+    configureMiniappSession(PROJECT_PARTITION)
+
+    b.dispose()
+
+    expect(electronStubs.protocolStub.installed.has(SCHEME)).toBe(true)
+    await expect(request('bridge-a')).resolves.toBe('A')
+    const project = electronStubs.sessions.get(PROJECT_PARTITION)!
+    await expect(request('bridge-a', project.protocol)).resolves.toBe('A')
+    expect(a.served).toEqual(['bridge-a', 'bridge-a'])
+  })
+
+  it('unhandles every registrar only when the last router is disposed', () => {
+    const a = addRouter('A', ['bridge-a'])
+    const b = addRouter('B', ['bridge-b'])
+    configureMiniappSession(PROJECT_PARTITION)
+    const shared = electronStubs.sessions.get(SHARED_MINIAPP_PARTITION)!
+    const project = electronStubs.sessions.get(PROJECT_PARTITION)!
+
+    b.dispose()
+    expect(shared.protocol.installed.has(SCHEME)).toBe(true)
+    expect(project.protocol.installed.has(SCHEME)).toBe(true)
+
+    a.dispose()
+    expect(electronStubs.protocolStub.installed.has(SCHEME)).toBe(false)
+    expect(shared.protocol.installed.has(SCHEME)).toBe(false)
+    expect(project.protocol.installed.has(SCHEME)).toBe(false)
+  })
+
+  it('reinstalls after the last router leaves and a new one arrives', async () => {
+    addRouter('A', ['bridge-a']).dispose()
+    addRouter('C', ['bridge-c'])
+
+    await expect(request('bridge-c')).resolves.toBe('C')
+  })
+})
diff --git a/packages/dimina-electron-runtime/src/main/ipc/bridge-router-protocol-mux.ts b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-protocol-mux.ts
new file mode 100644
index 00000000..c9adee21
--- /dev/null
+++ b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-protocol-mux.ts
@@ -0,0 +1,95 @@
+/**
+ * Process-wide multiplexing for the `dmb-resource://` protocol handler.
+ *
+ * The scheme is served from registrars that are shared by the whole process —
+ * the default `protocol`, the shared miniapp partition, and every per-project
+ * partition session — but the handler itself has to resolve the requested
+ * bridgeId against ONE router's session ledger. With a router per workbench
+ * window, installing per router would let the newest window's handler answer
+ * every window's requests (the older window's bridgeIds resolve to nothing),
+ * and the first window to close would unhandle the scheme for all of them.
+ *
+ * So the real handler is installed once and dispatches per request: the entry
+ * whose router can resolve the request's bridgeId serves it, carrying its own
+ * `sdkRoot` and session ledger. Registrars are torn down only when the last
+ * entry is gone.
+ */
+
+import { protocol, session as electronSession } from 'electron'
+import type { Session } from 'electron'
+import {
+  registerMiniappSessionConfigurator,
+  SHARED_MINIAPP_PARTITION,
+} from '../services/views/miniapp-partition.js'
+
+const SCHEME = 'dmb-resource'
+
+export interface DmbResourceMuxEntry {
+  /** Whether this router owns the session named by the request URL's bridgeId. */
+  claims: (requestUrl: string) => boolean
+  handle: (request: GlobalRequest) => Promise<Response>
+}
+
+const entries: DmbResourceMuxEntry[] = []
+let uninstall: (() => void) | null = null
+
+function install(): () => void {
+  const handler = (request: GlobalRequest): Promise<Response> => {
+    // Newest-first, then newest as the fallback: a request no router claims is
+    // answered by the most recent one, which produces the same "bridge session
+    // not found" response a single router produced before this mux existed.
+    let chosen = entries[entries.length - 1]!
+    for (let i = entries.length - 1; i >= 0; i--) {
+      if (entries[i]!.claims(request.url)) {
+        chosen = entries[i]!
+        break
+      }
+    }
+    return chosen.handle(request)
+  }
+
+  const sharedSession = electronSession.fromPartition(SHARED_MINIAPP_PARTITION)
+  try { protocol.unhandle(SCHEME) } catch {}
+  try { sharedSession.protocol.unhandle(SCHEME) } catch {}
+  protocol.handle(SCHEME, handler)
+  sharedSession.protocol.handle(SCHEME, handler)
+
+  // Per-project partition sessions need the SAME handler so each project's
+  // render/service can load `dmb-resource://…`. One configurator covers every
+  // partition (current + future) for every router.
+  const perProjectSessions = new Set<Session>()
+  const unregisterConfigurator = registerMiniappSessionConfigurator((sess) => {
+    if (perProjectSessions.has(sess)) return
+    perProjectSessions.add(sess)
+    try { sess.protocol.unhandle(SCHEME) } catch {}
+    sess.protocol.handle(SCHEME, handler)
+  })
+
+  return () => {
+    unregisterConfigurator()
+    try { protocol.unhandle(SCHEME) } catch {}
+    try { sharedSession.protocol.unhandle(SCHEME) } catch {}
+    for (const sess of perProjectSessions) {
+      try { sess.protocol.unhandle(SCHEME) } catch {}
+    }
+    perProjectSessions.clear()
+  }
+}
+
+/**
+ * Register one router on the `dmb-resource://` scheme. Returns the disposer for
+ * THIS registration; the scheme itself is unhandled only when the last one goes.
+ */
+export function addMuxedDmbResourceHandler(entry: DmbResourceMuxEntry): () => void {
+  entries.push(entry)
+  uninstall ??= install()
+  return () => {
+    const at = entries.indexOf(entry)
+    if (at !== -1) entries.splice(at, 1)
+    if (entries.length === 0 && uninstall) {
+      const dispose = uninstall
+      uninstall = null
+      dispose()
+    }
+  }
+}
diff --git a/packages/dimina-electron-runtime/src/main/ipc/bridge-router-service-invoke-page.test.ts b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-service-invoke-page.test.ts
new file mode 100644
index 00000000..4aae40c3
--- /dev/null
+++ b/packages/dimina-electron-runtime/src/main/ipc/bridge-router-service-invoke-page.test.ts
@@ -0,0 +1,497 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const electronStubs = vi.hoisted(() => {
+  type SyncListener = (...args: unknown[]) => void
+  const handlers = new Map<string, (event: unknown, ...args: unknown[]) => unknown>()
+  const syncListeners = new Map<string, SyncListener[]>()
+  const sync = {
+    on(channel: string, listener: SyncListener) {
+      const list = syncListeners.get(channel) ?? []
+      list.push(listener)
+      syncListeners.set(channel, list)
+    },
+    removeListener(channel: string, listener: SyncListener) {
+      const list = syncListeners.get(channel)
+      if (!list) return
+      const at = list.indexOf(listener)
+      if (at !== -1) list.splice(at, 1)
+    },
+    listenerCount: (channel: string) => syncListeners.get(channel)?.length ?? 0,
+    emit(channel: string, ...args: unknown[]) {
+      for (const listener of [...(syncListeners.get(channel) ?? [])]) listener(...args)
+    },
+    removeAllListeners() {
+      syncListeners.clear()
+    },
+  }
+  const ipcMain = {
+    handle(channel: string, fn: (event: unknown, ...args: unknown[]) => unknown) {
+      // Verbatim Electron behaviour: one handler per channel, process-wide.
+      if (handlers.has(channel)) {
+        throw new Error(`Attempted to register a second handler for '${channel}'`)
+      }
+      handlers.set(channel, fn)
+    },
+    removeHandler(channel: string) {
+      handlers.delete(channel)
+    },
+    on(channel: string, listener: (...args: unknown[]) => void) {
+      sync.on(channel, listener)
+      return ipcMain
+    },
+    removeListener(channel: string, listener: (...args: unknown[]) => void) {
+      sync.removeListener(channel, listener)
+      return ipcMain
+    },
+    listenerCount: (channel: string) => sync.listenerCount(channel),
+  }
+  const makeProtocolStub = () => ({
+    handle: vi.fn(),
+    unhandle: vi.fn(),
+    registerSchemesAsPrivileged: vi.fn(),
+  })
+  const protocolStub = makeProtocolStub()
+  const fromPartition = () => ({
+    protocol: makeProtocolStub(),
+    setPermissionRequestHandler: vi.fn(),
+    webRequest: { onBeforeSendHeaders: vi.fn(), onHeadersReceived: vi.fn() },
+  })
+  return { handlers, sync, ipcMain, protocolStub, fromPartition }
+})
+
+vi.mock('electron', () => ({
+  app: { isReady: () => true, on: vi.fn(), getLocale: () => 'zh-CN' },
+  BrowserWindow: class {},
+  ipcMain: electronStubs.ipcMain,
+  protocol: electronStubs.protocolStub,
+  session: { fromPartition: electronStubs.fromPartition },
+  webContents: { fromId: () => null, getAllWebContents: () => [] },
+  default: {},
+}))
+
+vi.mock('../services/dmb-resource/handle-request.js', () => ({
+  handleDmbResourceRequest: () => Promise.resolve(new Response('')),
+}))
+
+// The webContents/window fakes live in the hoisted block because the
+// service-host module mock below constructs one, and mock factories are
+// hoisted above the module body.
+const fakes = vi.hoisted(() => {
+  let nextWcId = 1
+  const makeWc = (host?: unknown) => ({
+    id: nextWcId++,
+    isDestroyed: () => false,
+    send: vi.fn(),
+    on: vi.fn(),
+    once: vi.fn(),
+    removeListener: vi.fn(),
+    executeJavaScript: vi.fn(() => Promise.resolve()),
+    close: vi.fn(),
+    hostWebContents: host,
+  })
+  const windows: Array<{ webContents: ReturnType<typeof makeWc> }> = []
+  const createWindow = () => {
+    const win = {
+      webContents: makeWc(),
+      isDestroyed: () => false,
+      close: vi.fn(),
+      on: vi.fn(),
+      once: vi.fn(),
+      removeListener: vi.fn(),
+    }
+    windows.push(win)
+    return win
+  }
+  const reset = () => {
+    nextWcId = 1
+    windows.length = 0
+  }
+  return { makeWc, windows, createWindow, reset }
+})
+
+// A spawn constructs a real hidden BrowserWindow and navigates it. The router
+// only ever `send`s to its webContents and hangs listeners on it, so a fake
+// window carries the whole spawn without an Electron runtime.
+vi.mock('../windows/service-host-window/create.js', () => ({
+  createServiceHostWindow: () => fakes.createWindow(),
+  navigateServiceHost: () => Promise.resolve(),
+  buildServiceHostSpawnUrl: () => 'file:///service.html',
+  serviceHostSpec: () => ({}),
+}))
+
+import { BRIDGE_CHANNELS as C, SIMULATOR_EVENTS as E } from '../../shared/bridge-channels.js'
+import type {
+  ApiCallPayload,
+  MessageEnvelope,
+  NavActionPayload,
+  PageOpenResult,
+  SpawnResult,
+} from '../../shared/bridge-channels.js'
+import { __resetMiniappSessionConfigForTests } from '../services/views/miniapp-partition.js'
+import { installBridgeRouter } from './bridge-router.js'
+import type { RuntimeContext } from '../runtime-context.js'
+
+type FakeWc = ReturnType<typeof fakes.makeWc>
+
+const ROOT_PAGE = 'pages/index/index'
+const DETAIL_PAGE = 'pages/detail/detail'
+
+const APP_CONFIG = {
+  app: { entryPagePath: ROOT_PAGE, pages: [ROOT_PAGE, DETAIL_PAGE] },
+  modules: {},
+}
+
+class FakeRegistry {
+  private readonly disposers: Array<() => unknown> = []
+  add(value: { dispose(): unknown } | (() => unknown)) {
+    const dispose = typeof value === 'function' ? value : () => value.dispose()
+    this.disposers.push(dispose)
+    return { dispose }
+  }
+  async dispose() {
+    for (const dispose of this.disposers.reverse()) await dispose()
+    this.disposers.length = 0
+  }
+}
+
+const openRegistries: FakeRegistry[] = []
+
+function makeCtx(): { ctx: RuntimeContext; simulatorWc: FakeWc } {
+  const windowWc = fakes.makeWc()
+  // The simulator is a <webview> guest of the workbench window, which is how
+  // the ipc mux attributes its SPAWN/PAGE_OPEN traffic to this router.
+  const simulatorWc = fakes.makeWc(windowWc)
+  const registry = new FakeRegistry()
+  openRegistries.push(registry)
+  const ctx = {
+    apiNamespaces: [],
+    assets: {
+      root: '/runtime/dist',
+      simulatorDir: '/runtime/dist/simulator',
+      simulatorPreloadPath: '/runtime/dist/preload/simulator.cjs',
+      renderHostHtmlPath: '/runtime/dist/render-host/pageFrame.html',
+      renderHostPreloadPath: '/runtime/dist/render-host/preload.cjs',
+      serviceHostHtmlPath: '/runtime/dist/service-host/service.html',
+      serviceHostPreloadPath: '/runtime/dist/service-host/preload.cjs',
+    },
+    workspace: {
+      getSession: () => null,
+      getProjectPath: () => '/project',
+      isClosing: () => false,
+    },
+    windows: {
+      mainWindow: {
+        webContents: windowWc,
+        isDestroyed: () => false,
+        contentView: { children: [] },
+        on: vi.fn(),
+        off: vi.fn(),
+        removeListener: vi.fn(),
+      },
+    },
+    registry,
+    connections: {
+      acquire: () => ({ own: vi.fn() }),
+      get: vi.fn(),
+      reset: vi.fn(),
+    },
+    simulatorApis: { invoke: vi.fn(), list: () => [], has: () => false },
+    events: { emit: vi.fn(), on: vi.fn(), off: vi.fn() },
+  } as unknown as RuntimeContext
+  return { ctx, simulatorWc }
+}
+
+function invokeHandler(channel: string, sender: FakeWc, payload: unknown): Promise<unknown> {
+  const handler = electronStubs.handlers.get(channel)
+  if (!handler) throw new Error(`no handler on ${channel}`)
+  return Promise.resolve(handler({ sender }, payload))
+}
+
+function emitSync(channel: string, sender: FakeWc, payload: unknown): void {
+  electronStubs.sync.emit(channel, { sender }, payload)
+}
+
+/** Everything `wc.send` was given on `channel`, oldest first. */
+function sendsOn(wc: FakeWc, channel: string): unknown[] {
+  return wc.send.mock.calls.filter(call => call[0] === channel).map(call => call[1])
+}
+
+/** The `triggerCallback` bodies that actually reached the service host. */
+function serviceCallbacks(serviceWc: FakeWc): Array<{ id: unknown; args: unknown }> {
+  return sendsOn(serviceWc, C.TO_SERVICE)
+    .map(payload => (payload as { msg: MessageEnvelope }).msg)
+    .filter(msg => msg.type === 'triggerCallback')
+    .map(msg => msg.body as unknown as { id: unknown; args: unknown })
+}
+
+/** Drive a container API the way the service-host preload does: one fixed bridgeId for the window's whole life. */
+// Verbatim what the service preload sends: no page id of its own. The host
+// serves the whole page stack, so a call that concerns one page names it in
+// `msg.body.bridgeId`; these calls name none.
+function serviceInvokeApi(serviceWc: FakeWc, body: Record<string, unknown>): void {
+  emitSync(C.SERVICE_INVOKE, serviceWc, {
+    msg: { type: 'invokeAPI', target: 'container', body },
+  })
+}
+
+interface Session {
+  simulatorWc: FakeWc
+  serviceWc: FakeWc
+  rootBridgeId: string
+  rootRenderWc: FakeWc
+  detailBridgeId: string
+  detailRenderWc: FakeWc
+}
+
+/**
+ * A session whose page stack is root + one navigated-to page, both with a live
+ * render guest, with the DeviceShell already reporting the navigated-to page as
+ * the top of the stack.
+ */
+async function bootTwoPageSession(): Promise<Session> {
+  const { ctx, simulatorWc } = makeCtx()
+  installBridgeRouter(ctx)
+
+  const { serviceWc, rootBridgeId, rootRenderWc, appSessionId, newBridgeId, newRenderWc } =
+    await spawnRootAndOpenSecond(simulatorWc, 'app-1')
+
+  emitSync(C.ACTIVE_PAGE, simulatorWc, { appSessionId, bridgeId: newBridgeId })
+
+  return { simulatorWc, serviceWc, rootBridgeId, rootRenderWc, detailBridgeId: newBridgeId, detailRenderWc: newRenderWc }
+}
+
+/** Close the session's root page through the simulator's own PAGE_CLOSE — the teardown reLaunch/redirectTo/switchTab reach. */
+function closeRootPage(s: Session): void {
+  emitSync(C.PAGE_CLOSE, s.simulatorWc, { bridgeId: s.rootBridgeId })
+}
+
+/** The render guest's self-announcement that binds its webContents to a page session. */
+function announceRenderGuest(wc: FakeWc, bridgeId: string): void {
+  emitSync(C.RENDER_INVOKE, wc, {
+    bridgeId,
+    msg: { type: 'renderHostReady', target: 'container', body: { bridgeId } },
+  })
+}
+
+interface RootOnlySession {
+  simulatorWc: FakeWc
+  serviceWc: FakeWc
+  rootBridgeId: string
+  rootRenderWc: FakeWc
+}
+
+/** Spawns appId's root page on an already-installed router, with its render guest bound. */
+async function spawnRoot(simulatorWc: FakeWc, appId: string): Promise<Omit<RootOnlySession, 'simulatorWc'> & { appSessionId: string }> {
+  const spawn = await invokeHandler(C.SPAWN, simulatorWc, {
+    appId,
+    pagePath: ROOT_PAGE,
+    resourceBaseUrl: 'http://127.0.0.1:65535/',
+  }) as SpawnResult
+  const serviceWc = fakes.windows[fakes.windows.length - 1]!.webContents
+  const rootRenderWc = fakes.makeWc()
+  announceRenderGuest(rootRenderWc, spawn.bridgeId)
+  return { serviceWc, rootBridgeId: spawn.bridgeId, rootRenderWc, appSessionId: spawn.appSessionId }
+}
+
+/** spawnRoot, then navigates to a second page with its own render guest bound — no ACTIVE_PAGE report yet. */
+async function spawnRootAndOpenSecond(
+  simulatorWc: FakeWc,
+  appId: string,
+): Promise<Omit<RootOnlySession, 'simulatorWc'> & { appSessionId: string; newBridgeId: string; newRenderWc: FakeWc }> {
+  const root = await spawnRoot(simulatorWc, appId)
+  const opened = await invokeHandler(C.PAGE_OPEN, simulatorWc, {
+    appSessionId: root.appSessionId,
+    pagePath: DETAIL_PAGE,
+  }) as PageOpenResult
+  const newRenderWc = fakes.makeWc()
+  announceRenderGuest(newRenderWc, opened.bridgeId)
+  return { ...root, newBridgeId: opened.bridgeId, newRenderWc }
+}
+
+/** A fresh session with only its root page, root render guest bound, no navigation and no ACTIVE_PAGE report yet. */
+async function bootRootOnlySession(appId = 'app-1'): Promise<RootOnlySession> {
+  const { ctx, simulatorWc } = makeCtx()
+  installBridgeRouter(ctx)
+  return { simulatorWc, ...await spawnRoot(simulatorWc, appId) }
+}
+
+/** Two independent app sessions sharing one simulator webview, each with only its root page. */
+async function bootTwoIndependentSessions(): Promise<{ a: RootOnlySession; b: RootOnlySession }> {
+  const { ctx, simulatorWc } = makeCtx()
+  installBridgeRouter(ctx)
+  const a = { simulatorWc, ...await spawnRoot(simulatorWc, 'app-1') }
+  const b = { simulatorWc, ...await spawnRoot(simulatorWc, 'app-2') }
+  return { a, b }
+}
+
+interface ReLaunchGapSession {
+  serviceWc: FakeWc
+  rootRenderWc: FakeWc
+  newBridgeId: string
+  newRenderWc: FakeWc
+}
+
+/**
+ * A session mid-reLaunch: the old root and a newly opened page both have live
+ * render guests, but root has just closed and the shell has not yet reported
+ * the new page as ACTIVE_PAGE. PAGE_CLOSE refuses to close a session's sole
+ * page (that is DISPOSE's job), so this gap only exists once a second page is
+ * already open to close root against — the same shape reLaunch produces
+ * before the shell catches up.
+ */
+async function bootReLaunchGapSession(): Promise<ReLaunchGapSession> {
+  const { ctx, simulatorWc } = makeCtx()
+  installBridgeRouter(ctx)
+
+  const { serviceWc, rootBridgeId, rootRenderWc, newBridgeId, newRenderWc } =
+    await spawnRootAndOpenSecond(simulatorWc, 'app-1')
+
+  emitSync(C.PAGE_CLOSE, simulatorWc, { bridgeId: rootBridgeId })
+
+  return { serviceWc, rootRenderWc, newBridgeId, newRenderWc }
+}
+
+beforeEach(() => {
+  vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response(JSON.stringify(APP_CONFIG)))))
+})
+
+afterEach(async () => {
+  for (const registry of openRegistries.splice(0)) await registry.dispose()
+  electronStubs.handlers.clear()
+  electronStubs.sync.removeAllListeners()
+  electronStubs.protocolStub.handle.mockClear()
+  electronStubs.protocolStub.unhandle.mockClear()
+  fakes.reset()
+  vi.unstubAllGlobals()
+  __resetMiniappSessionConfigForTests()
+})
+
+describe('service→container messages after the session root page is gone', () => {
+  it('still acts on the surviving page and answers the caller', async () => {
+    const s = await bootTwoPageSession()
+    closeRootPage(s)
+
+    serviceInvokeApi(s.serviceWc, {
+      name: 'pageScrollTo',
+      params: { scrollTop: 120, success: 'cb-success', complete: 'cb-complete' },
+    })
+
+    expect(s.detailRenderWc.executeJavaScript).toHaveBeenCalledTimes(1)
+    expect(s.rootRenderWc.executeJavaScript).not.toHaveBeenCalled()
+    expect(serviceCallbacks(s.serviceWc)).toEqual([
+      { id: 'cb-success', args: { errMsg: 'pageScrollTo:ok' } },
+      { id: 'cb-complete', args: { errMsg: 'pageScrollTo:ok' } },
+    ])
+  })
+
+  it('still navigates, naming the surviving page as the navigation source', async () => {
+    const s = await bootTwoPageSession()
+    closeRootPage(s)
+
+    serviceInvokeApi(s.serviceWc, {
+      name: 'navigateTo',
+      params: { url: `/${DETAIL_PAGE}`, success: 'cb-success' },
+    })
+
+    const navActions = sendsOn(s.simulatorWc, E.NAV_ACTION) as NavActionPayload[]
+    expect(navActions).toHaveLength(1)
+    expect(navActions[0]!.name).toBe('navigateTo')
+    expect(navActions[0]!.bridgeId).toBe(s.detailBridgeId)
+  })
+
+  it('completes a simulator-served API round trip back to the service host', async () => {
+    const s = await bootTwoPageSession()
+    closeRootPage(s)
+
+    serviceInvokeApi(s.serviceWc, {
+      name: 'getSystemInfo',
+      params: { success: 'cb-success', complete: 'cb-complete' },
+    })
+
+    const apiCalls = sendsOn(s.simulatorWc, E.API_CALL) as ApiCallPayload[]
+    expect(apiCalls).toHaveLength(1)
+    expect(apiCalls[0]!.bridgeId).toBe(s.detailBridgeId)
+
+    emitSync(C.API_RESPONSE, s.simulatorWc, {
+      appSessionId: apiCalls[0]!.appSessionId,
+      requestId: apiCalls[0]!.requestId,
+      ok: true,
+      result: { brand: 'devtools' },
+    })
+
+    expect(serviceCallbacks(s.serviceWc)).toEqual([
+      { id: 'cb-success', args: { brand: 'devtools' } },
+      { id: 'cb-complete', args: { brand: 'devtools' } },
+    ])
+  })
+})
+
+// Every case below drives the same pageScrollTo call; only who it should
+// reach (or whether it should reach anyone) varies.
+const SCROLL_PARAMS = { scrollTop: 40, success: 'cb-success', complete: 'cb-complete' }
+const SCROLL_OK_CALLBACKS = [
+  { id: 'cb-success', args: { errMsg: 'pageScrollTo:ok' } },
+  { id: 'cb-complete', args: { errMsg: 'pageScrollTo:ok' } },
+]
+
+describe('service→container routing: msg.body.bridgeId vs. the session’s reported top of stack', () => {
+  it('routes to the page msg.body.bridgeId names even when another page is the reported top', async () => {
+    const s = await bootTwoPageSession() // ACTIVE_PAGE already reports detail as top
+
+    serviceInvokeApi(s.serviceWc, { bridgeId: s.rootBridgeId, name: 'pageScrollTo', params: SCROLL_PARAMS })
+
+    expect(s.rootRenderWc.executeJavaScript).toHaveBeenCalledTimes(1)
+    expect(s.detailRenderWc.executeJavaScript).not.toHaveBeenCalled()
+  })
+
+  it('falls back to the reported top of stack when the named page id is already closed', async () => {
+    const s = await bootTwoPageSession()
+    closeRootPage(s) // root is gone; ACTIVE_PAGE already named detail as top
+
+    // bridgeId names a page that no longer exists.
+    serviceInvokeApi(s.serviceWc, { bridgeId: s.rootBridgeId, name: 'pageScrollTo', params: SCROLL_PARAMS })
+
+    expect(s.detailRenderWc.executeJavaScript).toHaveBeenCalledTimes(1)
+    expect(serviceCallbacks(s.serviceWc)).toEqual(SCROLL_OK_CALLBACKS)
+  })
+
+  it('routes an unnamed call to the root page while the shell has never reported ACTIVE_PAGE', async () => {
+    const s = await bootRootOnlySession()
+
+    serviceInvokeApi(s.serviceWc, { name: 'pageScrollTo', params: SCROLL_PARAMS })
+
+    expect(s.rootRenderWc.executeJavaScript).toHaveBeenCalledTimes(1)
+    expect(serviceCallbacks(s.serviceWc)).toEqual(SCROLL_OK_CALLBACKS)
+  })
+
+  it('drops an unnamed call without throwing once the root is gone and no new top has been reported', async () => {
+    const s = await bootReLaunchGapSession()
+
+    expect(() => serviceInvokeApi(s.serviceWc, { name: 'pageScrollTo', params: SCROLL_PARAMS })).not.toThrow()
+
+    expect(s.rootRenderWc.executeJavaScript).not.toHaveBeenCalled()
+    expect(s.newRenderWc.executeJavaScript).not.toHaveBeenCalled()
+    expect(serviceCallbacks(s.serviceWc)).toEqual([])
+  })
+
+  it('routes to a page already open but not yet reported active, in the reLaunch gap after the old root closes', async () => {
+    const s = await bootReLaunchGapSession()
+
+    // An unnamed call would have nothing to fall back to here (see previous
+    // test) — naming the new page directly must still land.
+    serviceInvokeApi(s.serviceWc, { bridgeId: s.newBridgeId, name: 'pageScrollTo', params: SCROLL_PARAMS })
+
+    expect(s.newRenderWc.executeJavaScript).toHaveBeenCalledTimes(1)
+    expect(serviceCallbacks(s.serviceWc)).toEqual(SCROLL_OK_CALLBACKS)
+  })
+
+  it('does not resolve a bridgeId that belongs to another app session', async () => {
+    const { a, b } = await bootTwoIndependentSessions()
+
+    // b.rootBridgeId names a real page, but in the other session.
+    serviceInvokeApi(a.serviceWc, { bridgeId: b.rootBridgeId, name: 'pageScrollTo', params: SCROLL_PARAMS })
+
+    expect(a.rootRenderWc.executeJavaScript).toHaveBeenCalledTimes(1)
+    expect(b.rootRenderWc.executeJavaScript).not.toHaveBeenCalled()
+  })
+})
diff --git a/packages/dimina-electron-runtime/src/main/ipc/bridge-router.ts b/packages/dimina-electron-runtime/src/main/ipc/bridge-router.ts
index e643698f..297cc9ff 100644
--- a/packages/dimina-electron-runtime/src/main/ipc/bridge-router.ts
+++ b/packages/dimina-electron-runtime/src/main/ipc/bridge-router.ts
@@ -1,4 +1,4 @@
-import { app, BrowserWindow, ipcMain, protocol, session as electronSession, webContents } from 'electron'
+import { app, BrowserWindow, ipcMain, webContents } from 'electron'
 import type { IpcMainEvent, IpcMainInvokeEvent, WebContents } from 'electron'
 import path from 'node:path'
 import { pathToFileURL } from 'node:url'
@@ -6,6 +6,8 @@ import { BRIDGE_CHANNELS as C, SIMULATOR_EVENTS as E, deviceInfoToHostEnv } from
 import type { NativeDeviceInfo, SyncStorageChange } from '../../shared/runtime-types.js'
 import { apiCallWatchdogMs, isPersistentSimulatorApi } from '../../shared/simulator-api-metadata.js'
 import { resolveRuntimeAssetPaths } from '../utils/paths.js'
+import { addMuxedInvokeHandler, addMuxedSyncListener, routerOwnsSender } from './bridge-router-ipc-mux.js'
+import { addMuxedDmbResourceHandler } from './bridge-router-protocol-mux.js'
 import { createSessionListenerBag } from './session-listener-bag.js'
 import type { SessionListenerBag } from './session-listener-bag.js'
 import type {
@@ -40,6 +42,7 @@ import type { ConnectionRegistry, DebugTap, Disposable } from '@dimina-kit/elect
 import { createDebugTap } from '@dimina-kit/electron-deck/main'
 import { startDiminaResourceServer, type DiminaResourceServer } from '../services/dimina-resource-server.js'
 import { handleDmbResourceRequest } from '../services/dmb-resource/handle-request.js'
+import type { DmbResourceSession } from '../services/dmb-resource/handle-request.js'
 import { buildRenderHostDocumentUrl } from '../services/dmb-resource/render-host-url.js'
 import {
   buildServiceHostSpawnUrl,
@@ -48,10 +51,6 @@ import {
   serviceHostSpec,
 } from '../windows/service-host-window/create.js'
 import { ServiceHostPool } from '../services/service-host-pool/pool.js'
-import {
-  registerMiniappSessionConfigurator,
-  SHARED_MINIAPP_PARTITION,
-} from '../services/views/miniapp-partition.js'
 import { createConsoleForwarder, type GuestConsoleEntry } from '../services/console-forward/index.js'
 import { createDiagnosticsBus } from '../services/diagnostics/index.js'
 import {
@@ -330,9 +329,6 @@ interface PageSession {
   supersededRenderWcIds: Set<number>
 }
 
-type ProtocolHandler = (request: GlobalRequest) => Promise<Response>
-type GlobalRequest = Parameters<typeof protocol.handle>[1] extends (request: infer T) => unknown ? T : Request
-
 interface PendingApiCall {
   appSessionId: string
   callbacks: { success?: unknown; fail?: unknown; complete?: unknown }
@@ -717,6 +713,12 @@ export function installBridgeRouter(ctx: RuntimeContext): void {
   // safe-area service can read it when a render-host guest attaches.
   let currentDevice: NativeDeviceInfo | null = null
 
+  // Every window runs its own router, so the process-wide ipcMain channels are
+  // muxed (see bridge-router-ipc-mux.ts) and each message goes to the router
+  // that owns its sender.
+  const ownsSender = (event: IpcMainEvent | IpcMainInvokeEvent): boolean =>
+    routerOwnsSender(state, ctx.windows?.mainWindow, event.sender)
+
   // Native-host enablement query. The simulator webview's preload can't read the
   // launch `process.env` (and additionalArguments don't reach webview guests),
   // nor can it compute file paths (no node:path/url in the guest preload), so it
@@ -742,8 +744,10 @@ export function installBridgeRouter(ctx: RuntimeContext): void {
     }
     event.returnValue = reply
   }
-  ipcMain.on(C.NATIVE_HOST_ENABLED, onNativeHostQuery)
-  ctx.registry.add(() => { ipcMain.removeListener(C.NATIVE_HOST_ENABLED, onNativeHostQuery) })
+  ctx.registry.add(addMuxedSyncListener(C.NATIVE_HOST_ENABLED, {
+    claims: ownsSender,
+    handle: onNativeHostQuery,
+  }))
 
   // Subscribers to render-side activity (domReady / active-page). Panels that
   // pull from the active render guest (WXML) re-read on these.
@@ -1000,15 +1004,15 @@ export function installBridgeRouter(ctx: RuntimeContext): void {
   ipcMain.on(C.PAGE_STACK, onPageStack)
   ctx.registry.add(() => { ipcMain.removeListener(C.PAGE_STACK, onPageStack) })
 
-  ipcMain.handle(C.SPAWN, async (event, opts: SpawnRequest): Promise<SpawnResult> => {
-    return handleSpawn(state, ctx, event, opts)
-  })
-  ctx.registry.add(() => { ipcMain.removeHandler(C.SPAWN) })
+  ctx.registry.add(addMuxedInvokeHandler(C.SPAWN, {
+    claims: ownsSender,
+    handle: (event, opts): Promise<SpawnResult> => handleSpawn(state, ctx, event, opts as SpawnRequest),
+  }))
 
-  ipcMain.handle(C.PAGE_OPEN, async (event, opts: PageOpenRequest): Promise<PageOpenResult> => {
-    return handlePageOpen(state, event, opts)
-  })
-  ctx.registry.add(() => { ipcMain.removeHandler(C.PAGE_OPEN) })
+  ctx.registry.add(addMuxedInvokeHandler(C.PAGE_OPEN, {
+    claims: ownsSender,
+    handle: (event, opts): Promise<PageOpenResult> => handlePageOpen(state, event, opts as PageOpenRequest),
+  }))
 
   const onPageClose = (event: IpcMainEvent, payload: PageClosePayload): void => {
     handlePageClose(state, event.sender, payload)
@@ -1122,10 +1126,13 @@ export function installBridgeRouter(ctx: RuntimeContext): void {
   ipcMain.on(C.RENDER_PUBLISH, onRenderPublish)
   ctx.registry.add(() => { ipcMain.removeListener(C.RENDER_PUBLISH, onRenderPublish) })
 
-  ipcMain.handle(C.SIMULATOR_API, async (_event, payload: { name: string; params: unknown }) => {
-    return ctx.simulatorApis.invoke(payload.name, payload.params)
-  })
-  ctx.registry.add(() => { ipcMain.removeHandler(C.SIMULATOR_API) })
+  ctx.registry.add(addMuxedInvokeHandler(C.SIMULATOR_API, {
+    claims: ownsSender,
+    handle: (_event, payload) => {
+      const call = payload as { name: string; params: unknown }
+      return ctx.simulatorApis.invoke(call.name, call.params)
+    },
+  }))
 
   const onApiResponse = (event: IpcMainEvent, payload: ApiResponsePayload): void => {
     tapIn(C.API_RESPONSE, event.sender, payload)
@@ -3142,42 +3149,22 @@ function installResourceProtocolHandlers(
   // buildRenderHostDocumentUrl places directly under the page's own package
   // path — see dmb-resource-url.ts) also serves from the runtime dist.
   // Everything else proxies to the session's resourceBaseUrl.
-  const handler: ProtocolHandler = async (request) => {
-    return handleDmbResourceRequest({
-      requestUrl: request.url,
-      sdkRoot,
-      resolveSession: (bridgeId) => {
-        const ap = resolveAppByBridgeId(state, bridgeId)
-        return ap ? { resourceBaseUrl: ap.resourceBaseUrl, appId: ap.appId, root: ap.root } : null
-      },
-    })
-  }
-
-  const simulatorSession = electronSession.fromPartition(SHARED_MINIAPP_PARTITION)
-  try { protocol.unhandle('dmb-resource') } catch {}
-  try { simulatorSession.protocol.unhandle('dmb-resource') } catch {}
-  protocol.handle('dmb-resource', handler)
-  simulatorSession.protocol.handle('dmb-resource', handler)
-
-  // Per-project partition sessions need the SAME resource handler so each
-  // project's render/service can load `dmb-resource://…`. Install on every
-  // miniapp partition (current + future); track installed sessions for teardown.
-  const perProjectSessions = new Set<Electron.Session>()
-  const unregisterConfigurator = registerMiniappSessionConfigurator((sess) => {
-    if (perProjectSessions.has(sess)) return
-    perProjectSessions.add(sess)
-    try { sess.protocol.unhandle('dmb-resource') } catch {}
-    sess.protocol.handle('dmb-resource', handler)
-  })
-
-  ctx.registry.add(() => {
-    unregisterConfigurator()
-    try { protocol.unhandle('dmb-resource') } catch {}
-    try { simulatorSession.protocol.unhandle('dmb-resource') } catch {}
-    for (const sess of perProjectSessions) {
-      try { sess.protocol.unhandle('dmb-resource') } catch {}
-    }
-  })
+  const resolveSession = (bridgeId: string): DmbResourceSession | null => {
+    const ap = resolveAppByBridgeId(state, bridgeId)
+    return ap ? { resourceBaseUrl: ap.resourceBaseUrl, appId: ap.appId, root: ap.root } : null
+  }
+
+  // The registrars this scheme lives on are process-wide, so the handler is
+  // muxed (see bridge-router-protocol-mux.ts). The request's bridgeId names the
+  // session, and only the router that owns that session can resolve it.
+  ctx.registry.add(addMuxedDmbResourceHandler({
+    claims: (requestUrl) => {
+      let bridgeId: string
+      try { bridgeId = new URL(requestUrl).hostname } catch { return false }
+      return resolveSession(bridgeId) !== null
+    },
+    handle: (request) => handleDmbResourceRequest({ requestUrl: request.url, sdkRoot, resolveSession }),
+  }))
 }
 
 function makeHostEnv(snapshot: Partial<HostEnvSnapshot> | undefined): HostEnvSnapshot {
diff --git a/packages/dimina-electron-runtime/src/main/services/console-forward/index.ts b/packages/dimina-electron-runtime/src/main/services/console-forward/index.ts
index 5e231e53..f34b8a14 100644
--- a/packages/dimina-electron-runtime/src/main/services/console-forward/index.ts
+++ b/packages/dimina-electron-runtime/src/main/services/console-forward/index.ts
@@ -97,8 +97,8 @@ export interface ConsoleForwarder extends Disposable {
    * `false`, UNLIKE `DiagnosticsBus` whose default is `true`) opts a new
    * subscriber into draining that buffer, in order, before receiving live
    * entries. Default stays non-replaying because the existing automation
-   * subscriber (`services/automation/index.ts`) wants only entries from the
-   * moment it subscribes — a history dump on an existing WS connection would
+   * subscriber (`services/automation/console-bridge.ts`) wants only entries
+   * from the moment it subscribes — a history dump on an existing WS would
    * be a surprise duplicate broadcast. `{replay:true}` exists for the global
    * console mirror, whose whole point is to catch up a standalone debug
    * window opened well after boot.
diff --git a/packages/dimina-electron-runtime/src/main/services/simulator/referer.test.ts b/packages/dimina-electron-runtime/src/main/services/simulator/referer.test.ts
new file mode 100644
index 00000000..769988aa
--- /dev/null
+++ b/packages/dimina-electron-runtime/src/main/services/simulator/referer.test.ts
@@ -0,0 +1,85 @@
+/**
+ * Guards per-project isolation of the forced page-frame Referer.
+ *
+ * Each open project runs on its own session partition (see
+ * ../views/miniapp-partition.ts); the Referer this module hands to
+ * `onBeforeSendHeaders` must be scoped to that partition. A module-level
+ * single value would let the most-recently-opened project's Referer leak
+ * onto every other concurrently open project's requests, and let any
+ * project's close/failed-compile clear every other project's Referer too.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+// miniapp-partition.ts (imported transitively to derive the partition key)
+// touches `electron` at module load — stub it so this stays a pure unit test.
+vi.mock('electron', () => ({
+  session: { fromPartition: (_p: string) => ({}) },
+}))
+
+import {
+  buildServicewechatPageFrameReferer,
+  clearSimulatorServicewechatReferer,
+  getSimulatorServicewechatReferer,
+  setSimulatorServicewechatReferer,
+} from './referer.js'
+import { miniappPartition } from '../views/miniapp-partition.js'
+
+const PROJECT_A = { appId: 'wxa1111111111111', path: '/projects/a' }
+const PROJECT_B = { appId: 'wxb2222222222222', path: '/projects/b' }
+
+beforeEach(() => {
+  // Drain whatever the previous test left behind so partitions never leak
+  // across cases.
+  clearSimulatorServicewechatReferer(PROJECT_A.appId, PROJECT_A.path)
+  clearSimulatorServicewechatReferer(PROJECT_B.appId, PROJECT_B.path)
+})
+
+describe('per-project Referer isolation', () => {
+  it('two concurrently open projects each keep their own Referer', () => {
+    setSimulatorServicewechatReferer(PROJECT_A.appId, undefined, PROJECT_A.path)
+    setSimulatorServicewechatReferer(PROJECT_B.appId, undefined, PROJECT_B.path)
+
+    const partitionA = miniappPartition(PROJECT_A.appId, PROJECT_A.path)
+    const partitionB = miniappPartition(PROJECT_B.appId, PROJECT_B.path)
+
+    // If project B's set() clobbered a shared slot, A's Referer would read
+    // back as B's appId — this is the user-visible cross-contamination bug.
+    expect(getSimulatorServicewechatReferer(partitionA)).toBe(
+      buildServicewechatPageFrameReferer(PROJECT_A.appId),
+    )
+    expect(getSimulatorServicewechatReferer(partitionB)).toBe(
+      buildServicewechatPageFrameReferer(PROJECT_B.appId),
+    )
+  })
+
+  it('clearing project A does not clear project B (still-open project keeps its Referer)', () => {
+    setSimulatorServicewechatReferer(PROJECT_A.appId, undefined, PROJECT_A.path)
+    setSimulatorServicewechatReferer(PROJECT_B.appId, undefined, PROJECT_B.path)
+
+    clearSimulatorServicewechatReferer(PROJECT_A.appId, PROJECT_A.path)
+
+    const partitionA = miniappPartition(PROJECT_A.appId, PROJECT_A.path)
+    const partitionB = miniappPartition(PROJECT_B.appId, PROJECT_B.path)
+
+    // A user closing (or failing to compile) one project must never strip the
+    // forced Referer off another project that is still running.
+    expect(getSimulatorServicewechatReferer(partitionA)).toBeNull()
+    expect(getSimulatorServicewechatReferer(partitionB)).toBe(
+      buildServicewechatPageFrameReferer(PROJECT_B.appId),
+    )
+  })
+
+  it('clearing without an appId is a no-op (nothing to target, not a global wipe)', () => {
+    setSimulatorServicewechatReferer(PROJECT_A.appId, undefined, PROJECT_A.path)
+
+    // A caller that reaches clear() before it ever learned an appId (e.g. a
+    // failed compile before appInfo resolves) has no partition to target —
+    // it must not fall back to nuking every open project's Referer.
+    clearSimulatorServicewechatReferer()
+
+    const partitionA = miniappPartition(PROJECT_A.appId, PROJECT_A.path)
+    expect(getSimulatorServicewechatReferer(partitionA)).toBe(
+      buildServicewechatPageFrameReferer(PROJECT_A.appId),
+    )
+  })
+})
diff --git a/packages/dimina-electron-runtime/src/main/services/simulator/referer.ts b/packages/dimina-electron-runtime/src/main/services/simulator/referer.ts
index a453c961..b4c37ee9 100644
--- a/packages/dimina-electron-runtime/src/main/services/simulator/referer.ts
+++ b/packages/dimina-electron-runtime/src/main/services/simulator/referer.ts
@@ -1,11 +1,21 @@
 /**
  * WeChat-style page-frame referer for HTTPS requests proxied from the runtime session.
  * Format: https://servicewechat.com/{appId}/{version}/page-frame.html
+ *
+ * Scoped per session PARTITION (see ../views/miniapp-partition.ts), not
+ * globally: each open project runs on its own `persist:miniapp-<key>`
+ * partition, so its forced Referer must not leak onto — or be wiped by —
+ * another project that happens to be open at the same time in a different
+ * BrowserWindow.
  */
 
+import { miniappPartition } from '../views/miniapp-partition.js'
+
 const DEFAULT_VERSION = 'develop'
 
-let cachedRefererUrl: string | null = null
+/** One entry per project partition; see the module doc for why this can't be
+ * a single value. */
+const refererByPartition = new Map<string, string>()
 
 export function buildServicewechatPageFrameReferer(
   appId: string,
@@ -14,18 +24,43 @@ export function buildServicewechatPageFrameReferer(
   return `https://servicewechat.com/${appId}/${version}/page-frame.html`
 }
 
-/** Called when a project session is active so protocol.handle can force Referer. */
-export function setSimulatorServicewechatReferer(appId: string, version?: string): void {
-  cachedRefererUrl = buildServicewechatPageFrameReferer(
-    appId,
-    version && version.length > 0 ? version : DEFAULT_VERSION,
+/**
+ * Called when a project session is active so protocol.handle can force
+ * Referer on THAT project's partition only. `projectPath` mirrors the
+ * project-identity fold `miniappPartition` already applies elsewhere (two
+ * different projects can declare the same appId); omitting it targets the
+ * legacy appId-only partition.
+ */
+export function setSimulatorServicewechatReferer(
+  appId: string,
+  version?: string,
+  projectPath?: string | null,
+): void {
+  const partition = miniappPartition(appId, projectPath)
+  refererByPartition.set(
+    partition,
+    buildServicewechatPageFrameReferer(
+      appId,
+      version && version.length > 0 ? version : DEFAULT_VERSION,
+    ),
   )
 }
 
-export function clearSimulatorServicewechatReferer(): void {
-  cachedRefererUrl = null
+/**
+ * Clears only the calling project's own entry. Without an `appId` there is no
+ * partition to target, so this is a deliberate no-op rather than a global
+ * wipe — a caller that reaches this before it ever learned an appId (e.g. a
+ * compile that failed before appInfo resolved) must not strip the Referer off
+ * every other project that is still open.
+ */
+export function clearSimulatorServicewechatReferer(
+  appId?: string,
+  projectPath?: string | null,
+): void {
+  if (!appId) return
+  refererByPartition.delete(miniappPartition(appId, projectPath))
 }
 
-export function getSimulatorServicewechatReferer(): string | null {
-  return cachedRefererUrl
+export function getSimulatorServicewechatReferer(partition: string): string | null {
+  return refererByPartition.get(partition) ?? null
 }
diff --git a/packages/dimina-electron-runtime/src/main/services/views/simulator-session-policy.ts b/packages/dimina-electron-runtime/src/main/services/views/simulator-session-policy.ts
index c711f8fe..15af4bac 100644
--- a/packages/dimina-electron-runtime/src/main/services/views/simulator-session-policy.ts
+++ b/packages/dimina-electron-runtime/src/main/services/views/simulator-session-policy.ts
@@ -33,10 +33,13 @@ const CORS_OVERRIDE_HEADERS: ReadonlySet<string> = new Set([
 
 /** Apply the simulator runtime's referer + CORS webRequest policy to one
  * session. Each session installs its own listeners (a webRequest listener is
- * per-session), so this runs once per partition. */
-function applySimulatorWebRequestPolicy(simulatorSession: Session): void {
+ * per-session), so this runs once per partition. `partition` scopes the
+ * Referer lookup to THIS session's project — see referer.ts's module doc for
+ * why a single shared value would let concurrently open projects clobber
+ * each other's Referer. */
+function applySimulatorWebRequestPolicy(simulatorSession: Session, partition: string): void {
   simulatorSession.webRequest.onBeforeSendHeaders((details, callback) => {
-    const forcedReferer = getSimulatorServicewechatReferer()
+    const forcedReferer = getSimulatorServicewechatReferer(partition)
     if (forcedReferer) {
       details.requestHeaders['Referer'] = forcedReferer
     }
@@ -86,10 +89,10 @@ function clearSimulatorWebRequestPolicy(simulatorSession: Session): void {
 export function setupSimulatorSessionPolicy(): Disposable {
   const configured = new Set<Session>()
   let unregister: (() => void) | null = null
-  function install(sess: Session): void {
+  function install(sess: Session, partition: string): void {
     if (configured.has(sess)) return
     configured.add(sess)
-    applySimulatorWebRequestPolicy(sess)
+    applySimulatorWebRequestPolicy(sess, partition)
   }
 
   const cleanup = (): void => {
@@ -101,10 +104,10 @@ export function setupSimulatorSessionPolicy(): Disposable {
 
   try {
     // Shared fallback session (pre-warm pool + unknown-appId path).
-    install(session.fromPartition(SHARED_MINIAPP_PARTITION))
+    install(session.fromPartition(SHARED_MINIAPP_PARTITION), SHARED_MINIAPP_PARTITION)
     // Every per-project miniapp partition session (current + future) gets the
     // same referer/CORS policy so isolated projects load resources identically.
-    unregister = registerMiniappSessionConfigurator((sess) => install(sess))
+    unregister = registerMiniappSessionConfigurator((sess, partition) => install(sess, partition))
   } catch (error) {
     cleanup()
     throw error
diff --git a/packages/dimina-electron-runtime/vitest.config.ts b/packages/dimina-electron-runtime/vitest.config.ts
index b2361162..4b099895 100644
--- a/packages/dimina-electron-runtime/vitest.config.ts
+++ b/packages/dimina-electron-runtime/vitest.config.ts
@@ -19,5 +19,25 @@ export default defineConfig({
     // Without this a component suite leaves its trees in the document and the
     // next `screen.getBy*` finds several matches instead of one.
     globals: true,
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'text-summary', 'html', 'json-summary'],
+      reportsDirectory: './coverage',
+      // Pin the denominator to all of `src/**`, not to whatever the run
+      // happened to load. Without this, v8 only counts files an executed test
+      // imported, so the first test written for a large module drops the
+      // package's coverage by pulling that module and its whole import graph
+      // into the denominator at once — the metric would punish adding tests.
+      include: ['src/**/*.{ts,tsx}'],
+      exclude: [
+        '**/*.test.{ts,tsx}',
+        '**/__test-stubs__/**',
+        // Imports vitest and drives the ws contract suites; it ships under
+        // src/ but is test scaffolding, not runtime code.
+        'src/main/services/native-websocket/contract-harness.ts',
+        '**/*.config.*',
+        '**/*.d.ts',
+      ],
+    },
   },
 })
diff --git a/packages/electron-deck/src/main/index.ts b/packages/electron-deck/src/main/index.ts
index 92350490..a104e9eb 100644
--- a/packages/electron-deck/src/main/index.ts
+++ b/packages/electron-deck/src/main/index.ts
@@ -40,6 +40,14 @@ export {
   isMainFrameIpcSender,
   type IpcSenderPolicy,
 } from './ipc-sender.js'
+export {
+  addMuxedInvokeHandler,
+  addMuxedSyncListener,
+  type InvokeMuxEntry,
+  type MuxEntry,
+  type SyncMuxEntry,
+} from './ipc-mux.js'
+export { windowHostsWebContents } from './window-hosts.js'
 export {
   createDebugTap,
   type DebugTap,
diff --git a/packages/electron-deck/src/main/ipc-mux.test.ts b/packages/electron-deck/src/main/ipc-mux.test.ts
new file mode 100644
index 00000000..bf111fba
--- /dev/null
+++ b/packages/electron-deck/src/main/ipc-mux.test.ts
@@ -0,0 +1,383 @@
+/**
+ * Behavior tests for `addMuxedInvokeHandler` / `addMuxedSyncListener` in
+ * `./ipc-mux.ts`.
+ *
+ * A fake `ipcMain` records every `handle` / `on` / `removeHandler` /
+ * `removeListener` call so specs can pin exactly ONE real Electron
+ * registration installs per channel regardless of how many owners multiplex
+ * onto it, and that dispatch, fallback and teardown all match the module's
+ * documented contract. Never mocks the `electron` module — the module under
+ * test takes `ipcMain` as a plain argument specifically so tests do not need
+ * to.
+ *
+ * The mux's channel maps are module state with no reset hook, so every spec
+ * here must use a channel name unique within this file — reusing one makes a
+ * later spec silently register onto the earlier spec's live entry list.
+ */
+import { describe, it, expect, vi } from 'vitest'
+import type { IpcMain, IpcMainEvent, IpcMainInvokeEvent } from 'electron'
+import { addMuxedInvokeHandler, addMuxedSyncListener, type InvokeMuxEntry, type SyncMuxEntry } from './ipc-mux.js'
+
+// ── Fake ipcMain ─────────────────────────────────────────────────────────
+//
+// Tracks real registrations per channel (`handle`/`on`) and their removal, so
+// a spec can assert the real Electron surface was touched exactly once per
+// channel no matter how many mux entries share it. `invoke`/`emit` replay a
+// message through whatever handler/listener is currently installed, the same
+// way Electron would deliver an actual IPC message.
+function makeIpcMain() {
+  const handlers = new Map<string, (event: IpcMainInvokeEvent, ...args: unknown[]) => unknown>()
+  const listeners = new Map<string, (event: IpcMainEvent, ...args: unknown[]) => void>()
+  const calls: string[] = []
+
+  const fake = {
+    handle: vi.fn((channel: string, fn: (event: IpcMainInvokeEvent, ...args: unknown[]) => unknown) => {
+      calls.push(`handle:${channel}`)
+      handlers.set(channel, fn)
+    }),
+    removeHandler: vi.fn((channel: string) => {
+      calls.push(`removeHandler:${channel}`)
+      handlers.delete(channel)
+    }),
+    on: vi.fn((channel: string, fn: (event: IpcMainEvent, ...args: unknown[]) => void) => {
+      calls.push(`on:${channel}`)
+      listeners.set(channel, fn)
+    }),
+    removeListener: vi.fn((channel: string) => {
+      calls.push(`removeListener:${channel}`)
+      listeners.delete(channel)
+    }),
+    calls,
+    hasHandler: (channel: string) => handlers.has(channel),
+    hasListener: (channel: string) => listeners.has(channel),
+    invoke: (channel: string, event: IpcMainInvokeEvent, ...args: unknown[]) => {
+      const fn = handlers.get(channel)
+      if (!fn) throw new Error(`no ipcMain.handle installed for '${channel}'`)
+      return fn(event, ...args)
+    },
+    emit: (channel: string, event: IpcMainEvent, ...args: unknown[]) => {
+      const fn = listeners.get(channel)
+      if (!fn) return // mirrors real ipcMain.emit: no listener = silent no-op
+      fn(event, ...args)
+    },
+  }
+
+  // The mux takes a whole `IpcMain`, but only ever touches the four methods
+  // above. Widening the fake to `IpcMain` keeps the recorder's own members
+  // (`calls`, `invoke`, `emit`, the vi.fn mocks) fully typed at every call
+  // site — an `as any` here would silently untype the entire file instead.
+  return fake as typeof fake & IpcMain
+}
+
+/** An invoke-event stub distinguished by `sender.id`, the field real claim predicates key off. */
+function invokeEvent(senderId: number): IpcMainInvokeEvent {
+  return { sender: { id: senderId } } as unknown as IpcMainInvokeEvent
+}
+
+function syncEvent(senderId: number): IpcMainEvent {
+  return { sender: { id: senderId }, returnValue: undefined } as unknown as IpcMainEvent
+}
+
+describe('addMuxedInvokeHandler — single real registration per channel', () => {
+  it('registering three owners on the same channel calls ipcMain.handle exactly once', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-a'
+    for (let i = 0; i < 3; i++) {
+      addMuxedInvokeHandler(ipcMain, channel, { claims: () => false, handle: () => i })
+    }
+    expect(ipcMain.handle).toHaveBeenCalledTimes(1)
+    expect(ipcMain.calls.filter((c: string) => c.startsWith('handle:'))).toEqual([`handle:${channel}`])
+  })
+
+  it('two different channels each get their own real registration', () => {
+    const ipcMain = makeIpcMain()
+    addMuxedInvokeHandler(ipcMain, 'chan-c', { claims: () => true, handle: () => 1 })
+    addMuxedInvokeHandler(ipcMain, 'chan-d', { claims: () => true, handle: () => 2 })
+    expect(ipcMain.handle).toHaveBeenCalledTimes(2)
+  })
+})
+
+describe('addMuxedInvokeHandler — dispatch is newest-registration-first', () => {
+  it('the most recently registered claimant wins, not the first-registered one', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-dispatch'
+    const order: string[] = []
+    addMuxedInvokeHandler(ipcMain, channel, {
+      claims: () => true,
+      handle: () => {
+        order.push('first')
+        return 'first'
+      },
+    })
+    addMuxedInvokeHandler(ipcMain, channel, {
+      claims: () => true,
+      handle: () => {
+        order.push('second')
+        return 'second'
+      },
+    })
+    const result = ipcMain.invoke(channel, invokeEvent(1))
+    // Both entries claim every event; the LAST registered must be asked first
+    // and win, per the module's "newest-first" scan.
+    expect(result).toBe('second')
+    expect(order).toEqual(['second'])
+  })
+
+  it('dispatches by sender-scoped claim: window B never sees window A\'s handler', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-scoped'
+    addMuxedInvokeHandler(ipcMain, channel, {
+      claims: (e: IpcMainInvokeEvent) => e.sender.id === 1,
+      handle: () => 'owner-A',
+    })
+    addMuxedInvokeHandler(ipcMain, channel, {
+      claims: (e: IpcMainInvokeEvent) => e.sender.id === 2,
+      handle: () => 'owner-B',
+    })
+    expect(ipcMain.invoke(channel, invokeEvent(1))).toBe('owner-A')
+    expect(ipcMain.invoke(channel, invokeEvent(2))).toBe('owner-B')
+  })
+})
+
+describe('addMuxedInvokeHandler — unclaimed falls back to the last registration, which reports its own outcome', () => {
+  it('an event nobody claims is handled by the most recently registered entry', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-fallback'
+    addMuxedInvokeHandler(ipcMain, channel, { claims: () => false, handle: () => 'first' })
+    addMuxedInvokeHandler(ipcMain, channel, { claims: () => false, handle: () => 'last' })
+    expect(ipcMain.invoke(channel, invokeEvent(99))).toBe('last')
+  })
+
+  it('single-owner behavior matches plain ipcMain.handle: the owner\'s own rejection propagates unaltered', async () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-single-reject'
+    const boom = new Error('owner blew up')
+    addMuxedInvokeHandler(ipcMain, channel, {
+      claims: () => false,
+      handle: () => Promise.reject(boom),
+    })
+    // The mux must not swallow or replace this with its own error — it is the
+    // sole owner's promise, unaltered.
+    await expect(ipcMain.invoke(channel, invokeEvent(1))).rejects.toBe(boom)
+  })
+
+  it('single-owner synchronous throw also propagates unaltered', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-single-throw'
+    const boom = new Error('sync owner blew up')
+    addMuxedInvokeHandler(ipcMain, channel, {
+      claims: () => false,
+      handle: () => {
+        throw boom
+      },
+    })
+    expect(() => ipcMain.invoke(channel, invokeEvent(1))).toThrow(boom)
+  })
+})
+
+describe('addMuxedInvokeHandler — disposer removes only its own registration', () => {
+  it('disposing one of two entries leaves the other reachable and keeps the real handler installed', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-dispose'
+    const disposeFirst = addMuxedInvokeHandler(ipcMain, channel, { claims: () => false, handle: () => 'first' })
+    addMuxedInvokeHandler(ipcMain, channel, { claims: () => false, handle: () => 'second' })
+    disposeFirst()
+    expect(ipcMain.removeHandler).not.toHaveBeenCalled()
+    expect(ipcMain.hasHandler(channel)).toBe(true)
+    expect(ipcMain.invoke(channel, invokeEvent(1))).toBe('second')
+  })
+
+  it('disposing the last remaining entry removes the real handler and forgets the channel', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-dispose-last'
+    const dispose = addMuxedInvokeHandler(ipcMain, channel, { claims: () => true, handle: () => 'only' })
+    dispose()
+    expect(ipcMain.removeHandler).toHaveBeenCalledTimes(1)
+    expect(ipcMain.removeHandler).toHaveBeenCalledWith(channel)
+    expect(ipcMain.hasHandler(channel)).toBe(false)
+  })
+
+  it('calling a disposer twice does not remove a later owner registered in between', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-double-dispose'
+    const disposeFirst = addMuxedInvokeHandler(ipcMain, channel, { claims: () => false, handle: () => 'first' })
+    disposeFirst() // sole owner removed → genuine teardown, one real removeHandler
+    expect(ipcMain.removeHandler).toHaveBeenCalledTimes(1)
+
+    // A fresh owner registers on the now-empty channel (fresh install).
+    addMuxedInvokeHandler(ipcMain, channel, { claims: () => true, handle: () => 'fresh' })
+    expect(ipcMain.handle).toHaveBeenCalledTimes(2)
+
+    // The stale disposer belongs to the torn-down registration list, not the
+    // fresh one — calling it again must be a no-op, not a second removeHandler
+    // that would tear down the fresh owner's live registration.
+    disposeFirst()
+    expect(ipcMain.removeHandler).toHaveBeenCalledTimes(1)
+    expect(ipcMain.hasHandler(channel)).toBe(true)
+    expect(ipcMain.invoke(channel, invokeEvent(1))).toBe('fresh')
+  })
+
+  it('re-registering after full teardown reinstalls a real ipcMain.handle', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-reinstall'
+    const dispose = addMuxedInvokeHandler(ipcMain, channel, { claims: () => true, handle: () => 'a' })
+    dispose()
+    addMuxedInvokeHandler(ipcMain, channel, { claims: () => true, handle: () => 'b' })
+    expect(ipcMain.handle).toHaveBeenCalledTimes(2)
+    expect(ipcMain.invoke(channel, invokeEvent(1))).toBe('b')
+  })
+})
+
+describe('addMuxedInvokeHandler — invoking after every entry is disposed throws', () => {
+  it('a stray message on a fully-disposed channel throws instead of silently resolving', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'chan-empty-invoke'
+    const dispose = addMuxedInvokeHandler(ipcMain, channel, { claims: () => true, handle: () => 'x' })
+    // Capture the raw installed callback before disposal removes the map entry
+    // but not the (now stale) Electron registration reference we hold.
+    const rawHandle = ipcMain.handle.mock.calls[0]![1] as (event: IpcMainInvokeEvent) => unknown
+    dispose()
+    expect(() => rawHandle(invokeEvent(1))).toThrow(`No handler registered for '${channel}'`)
+  })
+})
+
+// ── Sync channel ─────────────────────────────────────────────────────────
+
+describe('addMuxedSyncListener — single real registration per channel', () => {
+  it('registering three owners on the same channel calls ipcMain.on exactly once', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-a'
+    for (let i = 0; i < 3; i++) {
+      addMuxedSyncListener(ipcMain, channel, { claims: () => false, handle: () => {} })
+    }
+    expect(ipcMain.on).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('addMuxedSyncListener — dispatch, fallback and single-writer returnValue', () => {
+  it('the newest claimant wins and is the only one to write event.returnValue', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-dispatch'
+    const seen: string[] = []
+    addMuxedSyncListener(ipcMain, channel, {
+      claims: () => true,
+      handle: (e: IpcMainEvent) => {
+        seen.push('first')
+        ;(e as unknown as { returnValue: unknown }).returnValue = 'first'
+      },
+    })
+    addMuxedSyncListener(ipcMain, channel, {
+      claims: () => true,
+      handle: (e: IpcMainEvent) => {
+        seen.push('second')
+        ;(e as unknown as { returnValue: unknown }).returnValue = 'second'
+      },
+    })
+    const event = syncEvent(1)
+    ipcMain.emit(channel, event)
+    expect(seen).toEqual(['second'])
+    expect((event as unknown as { returnValue: unknown }).returnValue).toBe('second')
+  })
+
+  it('unclaimed falls back to the most recently registered entry', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-fallback'
+    addMuxedSyncListener(ipcMain, channel, { claims: () => false, handle: () => {} })
+    let ranLast = false
+    addMuxedSyncListener(ipcMain, channel, {
+      claims: () => false,
+      handle: () => {
+        ranLast = true
+      },
+    })
+    ipcMain.emit(channel, syncEvent(1))
+    expect(ranLast).toBe(true)
+  })
+})
+
+describe('addMuxedSyncListener — disposer removes only its own registration', () => {
+  it('disposing one of two entries keeps the real listener installed and the other reachable', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-dispose'
+    let firstRan = false
+    let secondRan = false
+    const disposeFirst = addMuxedSyncListener(ipcMain, channel, {
+      claims: () => false,
+      handle: () => {
+        firstRan = true
+      },
+    })
+    addMuxedSyncListener(ipcMain, channel, {
+      claims: () => false,
+      handle: () => {
+        secondRan = true
+      },
+    })
+    disposeFirst()
+    expect(ipcMain.removeListener).not.toHaveBeenCalled()
+    ipcMain.emit(channel, syncEvent(1))
+    expect(firstRan).toBe(false)
+    expect(secondRan).toBe(true)
+  })
+
+  it('disposing the last remaining entry removes the real listener and forgets the channel', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-dispose-last'
+    const dispose = addMuxedSyncListener(ipcMain, channel, { claims: () => true, handle: () => {} })
+    dispose()
+    expect(ipcMain.removeListener).toHaveBeenCalledTimes(1)
+    expect(ipcMain.removeListener).toHaveBeenCalledWith(channel, expect.any(Function))
+    expect(ipcMain.hasListener(channel)).toBe(false)
+  })
+
+  it('calling a disposer twice does not remove a later owner registered in between', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-double-dispose'
+    const disposeFirst = addMuxedSyncListener(ipcMain, channel, { claims: () => false, handle: () => {} })
+    disposeFirst() // sole owner removed → genuine teardown, one real removeListener
+    expect(ipcMain.removeListener).toHaveBeenCalledTimes(1)
+
+    let freshRan = false
+    addMuxedSyncListener(ipcMain, channel, {
+      claims: () => true,
+      handle: () => {
+        freshRan = true
+      },
+    })
+    // The stale disposer belongs to the torn-down registration list — calling
+    // it again must not remove the fresh owner's live listener.
+    disposeFirst()
+    expect(ipcMain.removeListener).toHaveBeenCalledTimes(1)
+    ipcMain.emit(channel, syncEvent(1))
+    expect(freshRan).toBe(true)
+  })
+})
+
+describe('addMuxedSyncListener — a stray message on a fully-disposed channel does not write returnValue', () => {
+  it('the raw installed listener leaves returnValue untouched once every entry is gone', () => {
+    const ipcMain = makeIpcMain()
+    const channel = 'sync-empty'
+    const dispose = addMuxedSyncListener(ipcMain, channel, {
+      claims: () => true,
+      handle: (e: IpcMainEvent) => {
+        ;(e as unknown as { returnValue: unknown }).returnValue = 'should not happen'
+      },
+    })
+    const rawListener = ipcMain.on.mock.calls[0]![1] as (event: IpcMainEvent) => void
+    dispose()
+    const event = syncEvent(1)
+    expect(() => rawListener(event)).not.toThrow()
+    expect((event as unknown as { returnValue: unknown }).returnValue).toBeUndefined()
+  })
+})
+
+// Type-only smoke: entries conform to the exported shapes without needing a
+// cast, guarding the public `InvokeMuxEntry` / `SyncMuxEntry` surface.
+describe('exported entry types', () => {
+  it('accept a plain claims/handle object', () => {
+    const invokeEntry: InvokeMuxEntry = { claims: () => true, handle: () => 'ok' }
+    const syncEntry: SyncMuxEntry = { claims: () => true, handle: () => {} }
+    expect(typeof invokeEntry.handle).toBe('function')
+    expect(typeof syncEntry.handle).toBe('function')
+  })
+})
diff --git a/packages/electron-deck/src/main/ipc-mux.ts b/packages/electron-deck/src/main/ipc-mux.ts
new file mode 100644
index 00000000..87f7123c
--- /dev/null
+++ b/packages/electron-deck/src/main/ipc-mux.ts
@@ -0,0 +1,118 @@
+/**
+ * Per-channel IPC multiplexing, invoke and sync alike.
+ *
+ * `ipcMain.handle` accepts exactly ONE handler per channel process-wide and
+ * throws on a second, and `event.returnValue` on a sync (`ipcMain.on` +
+ * `sendSync`) channel is single-valued — but several call sites in this repo
+ * register the same channel name once per owner (a per-window panel service,
+ * a per-window bridge router) each closing over its own state. The mux
+ * installs a single real `ipcMain` registration per channel and dispatches
+ * each message to the owner that claims the calling sender, so e.g. window
+ * B's panel reads window B's data.
+ *
+ * Registrations are scanned newest-first: with a single owner this is a
+ * pass-through, matching plain `ipcMain.handle`/`ipcMain.on` semantics where
+ * re-registering a channel replaced the previous handler. The channel is
+ * unregistered only when the last owner removes its entry.
+ *
+ * The caller passes its own `ipcMain` rather than this module importing it:
+ * nothing else reachable from this package's `/main` entry imports a VALUE
+ * from `electron`, and downstream tests depend on that — a `vi.mock('electron',
+ * factory)` whose factory reaches this entry would otherwise deadlock on
+ * itself, hanging the test run at import with no timeout to break it.
+ */
+import type { IpcMain, IpcMainEvent, IpcMainInvokeEvent } from 'electron'
+
+/** One owner's registration on a channel, plus its claim on a sender. */
+export interface MuxEntry<E, R> {
+  claims: (event: E) => boolean
+  handle: (event: E, ...args: unknown[]) => R
+}
+
+export type InvokeMuxEntry = MuxEntry<IpcMainInvokeEvent, unknown>
+export type SyncMuxEntry = MuxEntry<IpcMainEvent, void>
+
+/**
+ * The claimant for `event`, or — when nobody claims it — the most recent
+ * registration. The fallback keeps single-owner behaviour intact: that owner
+ * runs its own logic and reports its own error/rejection, instead of the mux
+ * inventing one.
+ */
+function pickEntry<E, R>(entries: MuxEntry<E, R>[], event: E): MuxEntry<E, R> {
+  for (let i = entries.length - 1; i >= 0; i--) {
+    if (entries[i]!.claims(event)) return entries[i]!
+  }
+  return entries[entries.length - 1]!
+}
+
+const invokeMux = new Map<string, InvokeMuxEntry[]>()
+
+/** Register on an invoke channel; returns the disposer for THIS registration. */
+export function addMuxedInvokeHandler(
+  ipcMain: IpcMain,
+  channel: string,
+  entry: InvokeMuxEntry,
+): () => void {
+  let entries = invokeMux.get(channel)
+  if (!entries) {
+    entries = []
+    invokeMux.set(channel, entries)
+    ipcMain.handle(channel, (event: IpcMainInvokeEvent, ...args: unknown[]) => {
+      const live = invokeMux.get(channel)
+      if (!live || live.length === 0) throw new Error(`No handler registered for '${channel}'`)
+      return pickEntry(live, event).handle(event, ...args)
+    })
+  }
+  const owner = entries
+  owner.push(entry)
+  return () => {
+    const at = owner.indexOf(entry)
+    if (at !== -1) owner.splice(at, 1)
+    if (owner.length === 0 && invokeMux.get(channel) === owner) {
+      invokeMux.delete(channel)
+      ipcMain.removeHandler(channel)
+    }
+  }
+}
+
+const syncMux = new Map<string, SyncMuxEntry[]>()
+/** The installed `ipcMain.on` listener per sync channel, keyed by its entry list. */
+const syncListeners = new WeakMap<SyncMuxEntry[], (event: IpcMainEvent, ...args: unknown[]) => void>()
+
+/**
+ * Register on a synchronous (`event.returnValue`) channel; returns the
+ * disposer for THIS registration. A single listener runs per message so
+ * exactly one owner writes `returnValue`.
+ */
+export function addMuxedSyncListener(
+  ipcMain: IpcMain,
+  channel: string,
+  entry: SyncMuxEntry,
+): () => void {
+  let entries = syncMux.get(channel)
+  if (!entries) {
+    entries = []
+    syncMux.set(channel, entries)
+    const listener = (event: IpcMainEvent, ...args: unknown[]): void => {
+      const live = syncMux.get(channel)
+      if (!live || live.length === 0) return
+      pickEntry(live, event).handle(event, ...args)
+    }
+    syncListeners.set(entries, listener)
+    ipcMain.on(channel, listener)
+  }
+  const owner = entries
+  owner.push(entry)
+  return () => {
+    const at = owner.indexOf(entry)
+    if (at !== -1) owner.splice(at, 1)
+    if (owner.length === 0 && syncMux.get(channel) === owner) {
+      syncMux.delete(channel)
+      const listener = syncListeners.get(owner)
+      if (listener) {
+        ipcMain.removeListener(channel, listener)
+        syncListeners.delete(owner)
+      }
+    }
+  }
+}
diff --git a/packages/electron-deck/src/main/main-entry-electron-free.test.ts b/packages/electron-deck/src/main/main-entry-electron-free.test.ts
new file mode 100644
index 00000000..62f8f1ed
--- /dev/null
+++ b/packages/electron-deck/src/main/main-entry-electron-free.test.ts
@@ -0,0 +1,105 @@
+/**
+ * Nothing reachable from the `./main` entry may import a VALUE from `electron`.
+ *
+ * Consumers mock electron in their unit tests, and a `vi.mock('electron',
+ * factory)` whose factory transitively imports this entry deadlocks if loading
+ * the entry needs `electron` back: the run hangs at import, where neither the
+ * test nor the hook timeout applies, so it shows up as a test suite that never
+ * finishes rather than as a failure. Type-only imports erase before runtime and
+ * are fine; a module that genuinely needs `ipcMain` or `BrowserWindow` takes it
+ * from its caller (see ipc-mux.ts).
+ */
+import { describe, it, expect } from 'vitest'
+import { existsSync, readFileSync, statSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+/**
+ * Every specifier `source` loads, with the clause text that pulls it in.
+ *
+ * Side-effect (`import 'x'`), dynamic (`import('x')`) and `require('x')` forms
+ * carry no clause: none of them erase, so all three count as value imports.
+ */
+function importClauses(source: string): Array<{ clause: string; specifier: string }> {
+  const clauses: Array<{ clause: string; specifier: string }> = []
+  const fromClause = /(?:^|\n)\s*(?:import|export)([\s\S]*?)from\s*['"]([^'"]+)['"]/g
+  for (const match of source.matchAll(fromClause)) {
+    clauses.push({ clause: match[1]!, specifier: match[2]! })
+  }
+  const sideEffect = /(?:^|\n)\s*import\s*['"]([^'"]+)['"]/g
+  const called = /\b(?:import|require)\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+  for (const pattern of [sideEffect, called]) {
+    for (const match of source.matchAll(pattern)) {
+      clauses.push({ clause: '', specifier: match[1]! })
+    }
+  }
+  return clauses
+}
+
+/** True when the clause survives compilation — i.e. it is not type-only. */
+function isValueImport(clause: string): boolean {
+  const body = clause.trim()
+  if (body.startsWith('type ')) return false
+  const named = body.match(/^\{([\s\S]*)\}$/)
+  if (!named) return true
+  return named[1]!
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .some((s) => !s.startsWith('type '))
+}
+
+/** The source file a relative specifier names, or null when there is none. */
+function resolveSource(from: string, specifier: string): string | null {
+  const base = resolve(dirname(from), specifier)
+  const candidates = [base.replace(/\.js$/, '.ts'), base, `${base}.ts`, `${base}/index.ts`]
+  return candidates.find((path) => existsSync(path) && statSync(path).isFile()) ?? null
+}
+
+/** Files reachable from `entry` through relative imports, entry included. */
+function reachableFrom(entry: string): { files: Map<string, string>; unresolved: string[] } {
+  const files = new Map<string, string>()
+  const unresolved: string[] = []
+  const queue = [entry]
+  while (queue.length > 0) {
+    const file = queue.pop()!
+    if (files.has(file)) continue
+    const source = readFileSync(file, 'utf8')
+    files.set(file, source)
+    for (const { specifier } of importClauses(source)) {
+      if (!specifier.startsWith('.')) continue
+      const target = resolveSource(file, specifier)
+      if (target) queue.push(target)
+      else unresolved.push(`${file} → ${specifier}`)
+    }
+  }
+  return { files, unresolved }
+}
+
+describe('the ./main entry', () => {
+  const graph = reachableFrom(resolve(here, 'index.ts'))
+
+  it('imports no value from electron, anywhere in its module graph', () => {
+    const offenders: string[] = []
+    for (const [file, source] of graph.files) {
+      for (const { clause, specifier } of importClauses(source)) {
+        if (specifier === 'electron' && isValueImport(clause)) {
+          offenders.push(file.slice(file.indexOf('/src/') + 1))
+        }
+      }
+    }
+    expect(
+      offenders,
+      'a value import of electron here hangs any consumer test that mocks electron with a factory reaching this entry',
+    ).toEqual([])
+  })
+
+  it('has every relative import resolvable, so the walk covers the whole graph', () => {
+    expect(
+      graph.unresolved,
+      'an import this walk cannot follow is a blind spot: teach resolveSource about it',
+    ).toEqual([])
+  })
+})
diff --git a/packages/electron-deck/src/main/window-hosts.test.ts b/packages/electron-deck/src/main/window-hosts.test.ts
new file mode 100644
index 00000000..e23a6ebb
--- /dev/null
+++ b/packages/electron-deck/src/main/window-hosts.test.ts
@@ -0,0 +1,153 @@
+/**
+ * Behavior tests for `windowHostsWebContents` in `./window-hosts.ts`.
+ *
+ * The function must judge ownership across every shape a simulator/render
+ * surface can take: the window's own renderer, a `WebContentsView` nested at
+ * any depth in `contentView`, and a `<webview>` guest (reported via
+ * `hostWebContents`, itself possibly a nested view). Fakes below model only
+ * the fields the function reads (`id`, `isDestroyed()`, `webContents`,
+ * `children`, `hostWebContents`) — no Electron import.
+ */
+import { describe, it, expect } from 'vitest'
+import { windowHostsWebContents } from './window-hosts.js'
+
+interface FakeWebContents {
+  id: number
+  isDestroyed: () => boolean
+  hostWebContents?: FakeWebContents
+}
+
+interface FakeView {
+  webContents?: FakeWebContents
+  children?: FakeView[]
+}
+
+interface FakeWindow {
+  webContents?: FakeWebContents
+  contentView?: FakeView
+  isDestroyed: () => boolean
+}
+
+let nextId = 1
+function wc(opts: { destroyed?: boolean; hostWebContents?: FakeWebContents } = {}): FakeWebContents {
+  const id = nextId++
+  return {
+    id,
+    isDestroyed: () => opts.destroyed ?? false,
+    hostWebContents: opts.hostWebContents,
+  }
+}
+
+function view(webContents: FakeWebContents | undefined, children: FakeView[] = []): FakeView {
+  return { webContents, children }
+}
+
+function win(opts: { rendererDestroyed?: boolean; windowDestroyed?: boolean; contentView?: FakeView } = {}): {
+  window: FakeWindow
+  renderer: FakeWebContents
+} {
+  const renderer = wc({ destroyed: opts.rendererDestroyed })
+  return {
+    window: {
+      webContents: renderer,
+      contentView: opts.contentView,
+      isDestroyed: () => opts.windowDestroyed ?? false,
+    },
+    renderer,
+  }
+}
+
+describe('windowHostsWebContents — direct membership', () => {
+  it('the window\'s own renderer webContents belongs to that window', () => {
+    const { window, renderer } = win()
+    expect(windowHostsWebContents(window as never, renderer as never)).toBe(true)
+  })
+
+  it('a WebContentsView mounted directly in contentView belongs to the window', () => {
+    const paneWc = wc()
+    const { window } = win({ contentView: view(undefined, [view(paneWc)]) })
+    expect(windowHostsWebContents(window as never, paneWc as never)).toBe(true)
+  })
+
+  it('a WebContentsView nested several levels deep still belongs to the window', () => {
+    const deepWc = wc()
+    const tree = view(undefined, [view(undefined, [view(undefined, [view(deepWc)])])])
+    const { window } = win({ contentView: tree })
+    expect(windowHostsWebContents(window as never, deepWc as never)).toBe(true)
+  })
+
+  it('an unrelated window\'s webContents does not belong', () => {
+    const { window: windowA } = win()
+    const { renderer: rendererB } = win()
+    expect(windowHostsWebContents(windowA as never, rendererB as never)).toBe(false)
+  })
+
+  it('an unrelated webContents not present anywhere in contentView does not belong', () => {
+    const paneWc = wc()
+    const strangerWc = wc()
+    const { window } = win({ contentView: view(undefined, [view(paneWc)]) })
+    expect(windowHostsWebContents(window as never, strangerWc as never)).toBe(false)
+  })
+})
+
+describe('windowHostsWebContents — <webview> guest via hostWebContents', () => {
+  it('a guest whose host is the window\'s own renderer belongs to that window', () => {
+    const { window, renderer } = win()
+    const guest = wc({ hostWebContents: renderer })
+    expect(windowHostsWebContents(window as never, guest as never)).toBe(true)
+  })
+
+  it('a guest whose host is a nested WebContentsView belongs to that window', () => {
+    const paneWc = wc()
+    const { window } = win({ contentView: view(undefined, [view(paneWc)]) })
+    const guest = wc({ hostWebContents: paneWc })
+    expect(windowHostsWebContents(window as never, guest as never)).toBe(true)
+  })
+
+  it('a guest whose host belongs to a DIFFERENT window does not belong', () => {
+    const { window: windowA } = win()
+    const { renderer: rendererB } = win()
+    const guest = wc({ hostWebContents: rendererB })
+    expect(windowHostsWebContents(windowA as never, guest as never)).toBe(false)
+  })
+})
+
+describe('windowHostsWebContents — destroyed / missing inputs', () => {
+  it('an undefined window never hosts anything', () => {
+    const someWc = wc()
+    expect(windowHostsWebContents(undefined, someWc as never)).toBe(false)
+  })
+
+  it('a destroyed window never hosts anything, even its own former renderer', () => {
+    const { window, renderer } = win({ windowDestroyed: true })
+    expect(windowHostsWebContents(window as never, renderer as never)).toBe(false)
+  })
+
+  it('a destroyed target webContents is never judged as hosted', () => {
+    const { window, renderer } = win()
+    renderer.isDestroyed = () => true
+    expect(windowHostsWebContents(window as never, renderer as never)).toBe(false)
+  })
+
+  it('a destroyed renderer is skipped for direct membership, but nested views are still checked', () => {
+    const paneWc = wc()
+    const { window } = win({ rendererDestroyed: true, contentView: view(undefined, [view(paneWc)]) })
+    expect(windowHostsWebContents(window as never, paneWc as never)).toBe(true)
+  })
+
+  it('a destroyed view in the contentView tree is not matched even if its id would otherwise equal the target', () => {
+    const paneWc = wc({ destroyed: true })
+    const { window } = win({ contentView: view(undefined, [view(paneWc)]) })
+    // The target itself passed to the function is live; only the TREE's copy
+    // is destroyed, modeling a stale/torn-down view still linked in the tree.
+    const liveSameId: FakeWebContents = { id: paneWc.id, isDestroyed: () => false }
+    expect(windowHostsWebContents(window as never, liveSameId as never)).toBe(false)
+  })
+
+  it('a destroyed host behind a <webview> guest is not honored', () => {
+    const { window, renderer } = win()
+    renderer.isDestroyed = () => true
+    const guest = wc({ hostWebContents: renderer })
+    expect(windowHostsWebContents(window as never, guest as never)).toBe(false)
+  })
+})
diff --git a/packages/electron-deck/src/main/window-hosts.ts b/packages/electron-deck/src/main/window-hosts.ts
new file mode 100644
index 00000000..5ec818ce
--- /dev/null
+++ b/packages/electron-deck/src/main/window-hosts.ts
@@ -0,0 +1,35 @@
+/**
+ * Whether a `BrowserWindow` hosts a given `webContents`, across every shape a
+ * simulator/render surface can take: a `<webview>` guest (its embedder is
+ * reported through `hostWebContents`, which is itself either the window's own
+ * renderer or one of its WebContentsViews), or a native-host WebContentsView
+ * hanging directly off the window's `contentView` tree.
+ *
+ * Two independent call sites need this exact judgment — a per-window IPC
+ * router resolving which window a message belongs to, and a per-window
+ * storage-panel scan filtering process-global webContents events down to its
+ * own window — so it lives here as the single owner of the rule.
+ */
+import type { BrowserWindow, View, WebContents } from 'electron'
+
+function viewHostsWebContents(view: View | undefined, wcId: number): boolean {
+  if (!view) return false
+  const own = (view as { webContents?: WebContents }).webContents
+  if (own && !own.isDestroyed() && own.id === wcId) return true
+  for (const child of view.children ?? []) {
+    if (viewHostsWebContents(child, wcId)) return true
+  }
+  return false
+}
+
+/** Whether `win` hosts `wc`, per the judgment above. */
+export function windowHostsWebContents(win: BrowserWindow | undefined, wc: WebContents): boolean {
+  if (!win || win.isDestroyed() || wc.isDestroyed()) return false
+  const windowWc = win.webContents
+  const hostsDirectly = (id: number): boolean =>
+    (!!windowWc && !windowWc.isDestroyed() && windowWc.id === id)
+    || viewHostsWebContents(win.contentView, id)
+  if (hostsDirectly(wc.id)) return true
+  const host = (wc as { hostWebContents?: WebContents }).hostWebContents
+  return !!host && !host.isDestroyed() && hostsDirectly(host.id)
+}
diff --git a/packages/workbench/src/contributed-extensions.ts b/packages/workbench/src/contributed-extensions.ts
index b3c81a66..6378f7a9 100644
--- a/packages/workbench/src/contributed-extensions.ts
+++ b/packages/workbench/src/contributed-extensions.ts
@@ -14,6 +14,7 @@
  */
 import { registerExtension, ExtensionHostKind } from '@codingame/monaco-vscode-api/extensions'
 import type { ExtraTyping } from './typings-injection'
+import { HOST_BASE_URL } from './host-base-url.js'
 
 interface ContributedExtension {
   dir: string
@@ -56,7 +57,7 @@ function mimeFor(file: string): string {
 export async function registerContributedExtensions(): Promise<ContributedExtensionsResult> {
   let list: ContributedExtension[]
   try {
-    const res = await fetch('/__contrib/index.json')
+    const res = await fetch(`${HOST_BASE_URL}__contrib/index.json`)
     if (!res.ok) return { count: 0, typings: [] }
     list = (await res.json()) as ContributedExtension[]
   } catch {
@@ -72,8 +73,8 @@ export async function registerContributedExtensions(): Promise<ContributedExtens
           // package.json is consumed by registerExtension itself, not as a file.
           if (file === 'package.json') continue
           // Absolute, same-origin URL — the worker ext-host fetches the entry and
-          // a root-relative path would resolve against the wrong base there.
-          const url = new URL(`/__contrib/${ext.dir}/${file}`, location.origin).toString()
+          // a relative path would resolve against the wrong base there.
+          const url = new URL(`__contrib/${ext.dir}/${file}`, HOST_BASE_URL).toString()
           reg.registerFileUrl('./' + file, url, { mimeType: mimeFor(file) })
         }
       }
@@ -111,7 +112,7 @@ async function collectTypings(ext: ContributedExtension): Promise<ExtraTyping[]>
       continue
     }
     try {
-      const res = await fetch(new URL(`/__contrib/${ext.dir}/${p}`, location.origin).toString())
+      const res = await fetch(new URL(`__contrib/${ext.dir}/${p}`, HOST_BASE_URL).toString())
       if (!res.ok) continue
       parts.push(await res.text())
     } catch (e) {
diff --git a/packages/workbench/src/host-base-url.ts b/packages/workbench/src/host-base-url.ts
new file mode 100644
index 00000000..8eaa45f3
--- /dev/null
+++ b/packages/workbench/src/host-base-url.ts
@@ -0,0 +1,12 @@
+/**
+ * Base URL of this window's bridge on the workbench COI host.
+ *
+ * Every project window's workbench is served by ONE http listener so they all
+ * share an origin (browser storage — IndexedDB, OPFS, caches, service workers
+ * — is keyed by origin, and a per-window port would give each window its own
+ * bucket that dies with it). A window is told apart by an opaque path prefix
+ * instead: `http://127.0.0.1:<port>/w/<token>/`. So the bridge base is the
+ * document's own directory, NOT `location.origin` — a root-relative `/__fs`
+ * or `/__contrib` URL would leave the prefix behind and reach no window.
+ */
+export const HOST_BASE_URL = new URL('./', location.href).toString()
diff --git a/packages/workbench/src/main.ts b/packages/workbench/src/main.ts
index 50cc7bc9..5206e1e1 100644
--- a/packages/workbench/src/main.ts
+++ b/packages/workbench/src/main.ts
@@ -14,6 +14,7 @@ import { diskMirrorSource } from './workspace/disk-workspace-source'
 import { walAuditSource } from './workspace/wal-audit'
 import type { WalAuditDegradation, WalAuditSurface } from './workspace/wal-audit'
 import type { CustomFileTypes } from './file-type-associations'
+import { HOST_BASE_URL } from './host-base-url.js'
 
 declare global {
   interface Window {
@@ -70,7 +71,7 @@ async function awaitProjectWorkspaceId(): Promise<string | undefined> {
   window.__WB_STATUS = 'awaiting-project'
   for (let attempt = 0; attempt < 60; attempt++) {
     try {
-      const res = await fetch('/__project')
+      const res = await fetch(`${HOST_BASE_URL}__project`)
       if (res.ok) {
         const { workspaceId } = (await res.json()) as { workspaceId?: string | null }
         if (workspaceId) return workspaceId
@@ -92,7 +93,7 @@ async function awaitProjectWorkspaceId(): Promise<string | undefined> {
  */
 async function loadFileTypes(): Promise<CustomFileTypes | undefined> {
   try {
-    const res = await fetch('/__filetypes')
+    const res = await fetch(`${HOST_BASE_URL}__filetypes`)
     if (!res.ok) return undefined
     return (await res.json()) as CustomFileTypes
   } catch {
@@ -128,23 +129,29 @@ async function applyDiskChangeToEditor(rel: string, content: Uint8Array | null):
 
 async function boot(): Promise<void> {
   const container = document.getElementById('workbench')!
-  // The page is served from the COI server root, so its origin is the fs bridge base.
-  const fsBaseUrl = location.origin + '/'
+  // This window's slice of the shared COI host — see host-base-url.ts.
+  const fsBaseUrl = HOST_BASE_URL
 
+  // Both are host lookups the boot cannot start without (the workspace identity
+  // is fixed when the monaco services initialize, and the associations go into
+  // the very first user config) — run them concurrently so the slow one, not
+  // their sum, gates the editor.
+  const [workspaceId, fileTypes] = await Promise.all([awaitProjectWorkspaceId(), loadFileTypes()])
+
+  // Built AFTER the identity resolves because the ledger is named after it.
+  // Every project window shares one origin, so the OPFS directory, the
+  // cross-window `BroadcastChannel` and the single-writer lock fs-core derives
+  // from `projectId` would otherwise be the SAME for two different projects
+  // open side by side — two windows writing one ledger about different trees.
   const workspace = walAuditSource(diskMirrorSource({ fsBaseUrl }), {
     fsBaseUrl,
+    projectId: workspaceId,
     applyToEditor: applyDiskChangeToEditor,
     onDegraded: (d) => {
       ;(window.__WB_SYNC_DEGRADATIONS ??= []).push(d)
     },
   })
 
-  // Both are host lookups the boot cannot start without (the workspace identity
-  // is fixed when the monaco services initialize, and the associations go into
-  // the very first user config) — run them concurrently so the slow one, not
-  // their sum, gates the editor.
-  const [workspaceId, fileTypes] = await Promise.all([awaitProjectWorkspaceId(), loadFileTypes()])
-
   const handle = await bootWorkbench({
     container,
     workspace,
diff --git a/packages/workbench/src/workspace/disk-workspace-source.ts b/packages/workbench/src/workspace/disk-workspace-source.ts
index 15da0dca..85b6decf 100644
--- a/packages/workbench/src/workspace/disk-workspace-source.ts
+++ b/packages/workbench/src/workspace/disk-workspace-source.ts
@@ -8,7 +8,11 @@ import { WORKSPACE_FILE_ROOT, mirrorDiskToFileWorkspace, flushFileWorkspaceSaveT
 import type { WorkspaceSource } from './types'
 
 export interface DiskMirrorOptions {
-  /** Base URL of the COI server exposing `/__fs/*` (usually `location.origin + '/'`). */
+  /**
+   * Base URL of the COI server exposing `__fs/*`. Every project window shares
+   * one origin and is addressed by a path prefix, so this is the document's own
+   * directory (`HOST_BASE_URL`) and never bare `location.origin`.
+   */
   fsBaseUrl: string
 }
 
diff --git a/pawl.snapshot.json b/pawl.snapshot.json
index 37ebb2d1..854aa3b4 100644
--- a/pawl.snapshot.json
+++ b/pawl.snapshot.json
@@ -2,6 +2,7 @@
   "metrics": {
     "circular-deps": {
       "direction": "lower-is-better",
+      "definition": "v1:sha256:58767aaa6b6a094e5f9faf5cb76cc73358bc9594ed34b89ae0cfb69636a86896",
       "value": 1,
       "unit": "import cycles",
       "breakdown": {
@@ -10,22 +11,22 @@
     },
     "code-duplication": {
       "direction": "lower-is-better",
-      "value": 286,
+      "definition": "v1:sha256:58767aaa6b6a094e5f9faf5cb76cc73358bc9594ed34b89ae0cfb69636a86896",
+      "value": 275,
       "unit": "duplicated lines",
       "breakdown": {
-        "packages/devtools/src/main/ipc/project-fs.ts:177↔packages/devtools/src/main/ipc/project-fs.ts:471": 12,
-        "packages/devtools/src/main/ipc/project-fs.ts:264↔packages/devtools/src/main/ipc/project-fs.ts:490": 18,
+        "packages/devtools/src/main/ipc/project-fs.ts:178↔packages/devtools/src/main/ipc/project-fs.ts:472": 12,
+        "packages/devtools/src/main/ipc/project-fs.ts:265↔packages/devtools/src/main/ipc/project-fs.ts:491": 18,
         "packages/devtools/src/main/services/mcp/tools/context-tools.ts:189↔packages/devtools/src/main/services/mcp/tools/context-tools.ts:272": 11,
         "packages/devtools/src/main/services/mcp/tools/context-tools.ts:243↔packages/devtools/src/main/services/mcp/tools/context-tools.ts:301": 10,
-        "packages/devtools/src/main/services/simulator-storage/index.ts:359↔packages/devtools/src/main/services/simulator-storage/index.ts:377": 8,
-        "packages/devtools/src/main/services/simulator-storage/index.ts:359↔packages/devtools/src/main/services/simulator-storage/index.ts:433": 8,
-        "packages/devtools/src/main/services/simulator-storage/index.ts:401↔packages/devtools/src/main/services/simulator-storage/index.ts:432": 8,
-        "packages/devtools/src/main/services/workbench-coi-server.ts:474↔packages/dimina-electron-runtime/src/main/services/dimina-resource-server.ts:30": 11,
+        "packages/devtools/src/main/services/simulator-storage/index.ts:382↔packages/devtools/src/main/services/simulator-storage/index.ts:400": 8,
+        "packages/devtools/src/main/services/simulator-storage/index.ts:382↔packages/devtools/src/main/services/simulator-storage/index.ts:456": 8,
+        "packages/devtools/src/main/services/simulator-storage/index.ts:424↔packages/devtools/src/main/services/simulator-storage/index.ts:455": 8,
+        "packages/devtools/src/main/services/workbench-coi-host.ts:172↔packages/dimina-electron-runtime/src/main/services/dimina-resource-server.ts:30": 10,
         "packages/devtools/src/preload/instrumentation/wxml.ts:23↔packages/inspect/src/inspector.ts:48": 6,
         "packages/devtools/src/preload/runtime/bridge.ts:75↔packages/inspect/src/inspector.ts:78": 17,
         "packages/devtools/src/preload/runtime/main-api-runner.ts:106↔packages/devtools/src/simulator/run-api-async.ts:177": 15,
         "packages/devtools/src/preload/runtime/main-api-runner.ts:81↔packages/devtools/src/simulator/run-api-async.ts:132": 11,
-        "packages/devtools/src/renderer/modules/main/features/project-list/project-list-screen.tsx:23↔packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx:95": 11,
         "packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-device.ts:21↔packages/devtools/src/renderer/modules/main/features/project-runtime/controllers/use-project-runtime-controller.ts:50": 22,
         "packages/devtools/src/renderer/modules/workbench-settings/mcp-settings-tab.tsx:168↔packages/devtools/src/renderer/modules/workbench-settings/workbench-settings.tsx:206": 11,
         "packages/devtools/src/simulator/simulator-api-fs.ts:438↔packages/devtools/src/simulator/simulator-api-fs.ts:457": 13,
@@ -44,41 +45,42 @@
     },
     "cognitive-complexity": {
       "direction": "lower-is-better",
+      "definition": "v1:sha256:8eea996b6a231a4aae1b2e23935d37bb5a1654cfaf9543d36b9d1fa523cee1cb",
       "value": 0,
       "unit": "issues",
       "breakdown": {}
     },
     "file-length": {
       "direction": "lower-is-better",
-      "value": 56,
+      "definition": "v1:sha256:7cd9cb6b207f34f25c6f3296ace4f69621b2010fcd555bb52682336d5f164736",
+      "value": 55,
       "unit": "files \u003e 500 lines",
       "breakdown": {
         "packages/devkit/src/compile-worker.test.ts": 1038,
-        "packages/devtools/src/main/app/app.ts": 843,
-        "packages/devtools/src/main/app/close-with-active-session.test.ts": 561,
-        "packages/devtools/src/main/app/double-close-quit.test.ts": 542,
-        "packages/devtools/src/main/app/instance-ipc-extension.test.ts": 591,
-        "packages/devtools/src/main/eslint-workbench-context-gate.test.ts": 559,
+        "packages/devtools/src/main/app/close-with-active-session.test.ts": 594,
+        "packages/devtools/src/main/app/double-close-quit.test.ts": 591,
+        "packages/devtools/src/main/app/instance-ipc-extension.test.ts": 593,
+        "packages/devtools/src/main/eslint-workbench-context-gate.test.ts": 560,
         "packages/devtools/src/main/ipc/project-fs.test.ts": 756,
-        "packages/devtools/src/main/ipc/project-fs.ts": 643,
-        "packages/devtools/src/main/ipc/projects-add-dialog.test.ts": 510,
+        "packages/devtools/src/main/ipc/project-fs.ts": 647,
+        "packages/devtools/src/main/ipc/projects-add-dialog.test.ts": 631,
         "packages/devtools/src/main/services/elements-forward/index.test.ts": 1507,
         "packages/devtools/src/main/services/elements-forward/index.ts": 628,
         "packages/devtools/src/main/services/network-forward/index.test.ts": 1881,
         "packages/devtools/src/main/services/network-forward/index.ts": 1562,
         "packages/devtools/src/main/services/service-host-pool/pool.test.ts": 995,
-        "packages/devtools/src/main/services/simulator-storage/index.ts": 685,
+        "packages/devtools/src/main/services/simulator-storage/index.ts": 711,
         "packages/devtools/src/main/services/views/host-toolbar-port-channel.test.ts": 536,
         "packages/devtools/src/main/services/views/native-simulator-devtools-host.ts": 633,
         "packages/devtools/src/preload/instrumentation/app-data.test.ts": 865,
         "packages/devtools/src/preload/instrumentation/wxml.test.ts": 741,
         "packages/devtools/src/preload/miniapp-snapshot/host.test.ts": 561,
-        "packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx": 567,
+        "packages/devtools/src/renderer/modules/main/features/project-runtime/project-runtime.tsx": 529,
         "packages/devtools/src/shared/open-in-editor.test.ts": 537,
         "packages/devtools/src/simulator/simulator-api-fs.test.ts": 743,
         "packages/devtools/src/simulator/simulator-api-fs.ts": 914,
-        "packages/devtools/src/simulator/simulator-api-media.ts": 702,
-        "packages/dimina-electron-runtime/src/main/ipc/bridge-router.ts": 3046,
+        "packages/devtools/src/simulator/simulator-api-media.ts": 870,
+        "packages/dimina-electron-runtime/src/main/ipc/bridge-router.ts": 3129,
         "packages/dimina-electron-runtime/src/simulator-ui/page-stack-controller.test.ts": 526,
         "packages/dimina-electron-runtime/src/simulator-ui/tab-bar-state.test.ts": 517,
         "packages/electron-deck/src/__cross_check__/round2-fix-cross-check.test.ts": 712,
@@ -102,41 +104,45 @@
         "packages/electron-deck/src/layout/constraints.test.ts": 727,
         "packages/electron-deck/src/layout/mutations.test.ts": 888,
         "packages/electron-deck/src/layout/serialize.test.ts": 599,
-        "packages/electron-deck/src/main/compositor.test.ts": 851,
+        "packages/electron-deck/src/main/compositor.test.ts": 848,
         "packages/electron-deck/src/main/connection.test.ts": 744,
         "packages/electron-deck/src/main/scope.test.ts": 988,
         "packages/electron-deck/src/main/view-handle.test.ts": 1062,
-        "packages/electron-deck/src/types.ts": 590,
+        "packages/electron-deck/src/types.ts": 592,
         "packages/view-anchor/src/react.test.tsx": 562,
         "packages/view-anchor/src/view-anchor.test.ts": 1171
       }
     },
     "test-coverage": {
       "direction": "higher-is-better",
-      "value": 79.39,
+      "definition": "v1:sha256:80e418812be380ccb093b21e65e8b7a24caebead75e581582ae42f77591cea14",
+      "value": 76.36,
       "unit": "% lines",
       "breakdown": {
-        "devkit": 94.17,
-        "devtools": 75.34,
-        "dimina-electron-runtime": 83.68,
-        "electron-deck": 95.34,
+        "design": 100,
+        "devkit": 94.35,
+        "devtools": 78.2,
+        "dimina-electron-runtime": 54.58,
+        "electron-deck": 95.44,
         "electron-deck/dock-react": 78.6,
         "fs-core": 99.19,
         "inspect": 77.51,
         "view-anchor": 95.28,
-        "workbench": 33.33
+        "workbench": 33.27
       },
       "tolerance": 1
     },
     "test-report": {
       "direction": "higher-is-better",
-      "value": 5242,
+      "definition": "v1:sha256:be72f5ba225862a780f10f745f8438bbdb0bc64f8451d612845a39b44e27f1c4",
+      "value": 5579,
       "unit": "passed tests",
       "breakdown": {
+        "design": 19,
         "devkit": 211,
-        "devtools": 2992,
-        "dimina-electron-runtime": 338,
-        "electron-deck": 1089,
+        "devtools": 3240,
+        "dimina-electron-runtime": 371,
+        "electron-deck": 1126,
         "electron-deck/dock-react": 96,
         "fs-core": 133,
         "inspect": 207,
@@ -146,13 +152,15 @@
     },
     "type-coverage": {
       "direction": "higher-is-better",
-      "value": 99.79,
+      "definition": "v1:sha256:be72f5ba225862a780f10f745f8438bbdb0bc64f8451d612845a39b44e27f1c4",
+      "value": 99.8,
       "unit": "%",
       "breakdown": {
+        "design": 100,
         "devkit": 99.91,
-        "devtools": 99.77,
-        "dimina-electron-runtime": 99.85,
-        "electron-deck": 99.72,
+        "devtools": 99.78,
+        "dimina-electron-runtime": 99.86,
+        "electron-deck": 99.73,
         "fs-core": 99.97,
         "inspect": 99.99,
         "view-anchor": 100,
@@ -161,6 +169,7 @@
     },
     "type-escapes": {
       "direction": "lower-is-better",
+      "definition": "v1:sha256:8b996b0a81d2112eaac660966f7243530143f6e66474a9cf879bb651348e958b",
       "value": 0,
       "unit": "issues",
       "breakdown": {}