diff --git a/docs/specs/dor-browser.md b/docs/specs/dor-browser.md
index 8f04a96ff..35f29bb00 100644
--- a/docs/specs/dor-browser.md
+++ b/docs/specs/dor-browser.md
@@ -44,11 +44,14 @@ Invariants on the flat persisted `BrowserPanelParams`:
 - **Agent-browser session state is flat** (`session`, `wsPort`, `binaryPath`,
   `syncEngaged`, `key`), never nested. Pop-out is not a param — it derives from
   `renderMode` once, at controller construction.
+- **`contextPortKey` is declared and persisted like any other param.** Only a
+  Surface the pane context menu opened for a port carries it, and reuse looks
+  one up by it ([Pane Context Menu Connect](#pane-context-menu-connect)).
 - **Never move a browser Surface's DOM, and never let a minimize unmount it**
   (rationale): Lath never re-parents its leaf div, and a minimize **parks** it
   (`docs/specs/tiling-engine.md` → "Parked leaves"), so the document returns with
-  scroll, form, and script state intact. A restart is still a cold load — only
-  `url` persists.
+  scroll, form, and script state intact. A restart is still a cold load: every
+  param above survives it, no document state does.
 
 Source of truth: `lib/src/components/wall/BrowserPanel.tsx` (`BrowserPanelParams`), `lib/src/components/wall/browser-surface.ts`,
 `lib/src/components/Wall.tsx` (`replaceSurface`), `lib/src/components/wall/agent-browser-surface-controller.ts`
@@ -57,11 +60,10 @@ Source of truth: `lib/src/components/wall/BrowserPanel.tsx` (`BrowserPanelParams
 ## Placement And Lifetime
 
 **Both CLI entry points share one placement rule** (`createContentSurface`):
-replace an untouched *terminal* caller in place, else split next to the reference
-surface. **Never replace a reference that already has a browser** — web content is
-not destroyed to make room. A replacement transfers the target Surface's
-`surface:N` ref to the new browser Surface id. `dor iframe` also takes
-`--surface`, `--minimize`, `--json`.
+replace an untouched, helper-less *terminal* caller in place, else split next to
+the reference surface. **Never replace a reference that already has a browser** —
+web content is not destroyed to make room. A replacement transfers the target
+Surface's `surface:N` ref to the new browser Surface id.
 
 **Both open focus-neutrally**, like `dor ensure`, with one exception: replacing
 the pane the user is currently selected on moves selection to the replacement
@@ -129,16 +131,17 @@ Source of truth: `lib/src/components/wall/SurfacePaneHeader.tsx`,
 ## Dev-Server Chip
 
 For loopback URLs (`localhost`, `*.localhost`, `127.0.0.1`, `::1`) the header
-registers interest in the port. **One scan loop per Window, over every mounted
-Wall's terminal panes and minimized doors** — each Wall registers its Surfaces as
-a candidate source, since the wanted-port store and the resolutions are
-window-wide. It reads `PlatformAdapter.getOpenPorts(id)` and **shows a chip only
-when exactly one terminal owns that port**; zero or two-plus leave it unsettled,
-so a dev server that starts later still matches, and a Wall arriving or leaving
-re-validates what had settled. **Match only binds that serve localhost** —
-loopback or any-interface (`0.0.0.0`, `::`), never a specific non-loopback bind.
-Scanning is debounced, idle-scheduled, and polls only while a wanted port is
-unmatched; reload revalidates optimistically.
+registers interest in the port, and `PlatformAdapter.getOpenPorts(id)` resolves
+it against terminal panes and minimized doors.
+
+- **One scan loop per Window**, over every mounted Wall's Surfaces; the
+  wanted-port store and the resolutions are window-wide.
+- **Show a chip only when exactly one terminal owns that port**; zero or
+  two-plus leave it unsettled, so a later dev server still matches.
+- **Match only binds that serve localhost** — loopback or any-interface
+  (`0.0.0.0`, `::`), never a specific non-loopback bind.
+- **The scan stays decorative and off the hot path**, so it may never pile onto
+  a tab open or poll forever.
 
 Source of truth: `lib/src/components/wall/use-dev-server-ports.ts`,
 `lib/src/components/wall/port-url.ts` (`servesLoopback`),
@@ -158,8 +161,9 @@ Source of truth: `openContextPort` in `lib/src/components/Wall.tsx`; `listenerUr
 
 ## Display Modal And Render Swaps
 
-**Must make the Display modal the sole GUI for render mode and screencast
-resolution.** It splits the Browser Chrome icon pair across its nesting: the
+**Must make the Display modal the GUI for render mode and screencast
+resolution**, the pop-out stub's own Pop back in aside. It splits the Browser
+Chrome icon pair across its nesting: the
 robot rides the `ab-screencast` parent, each nested resolution row carrying only
 its presentation glyph.
 
@@ -210,8 +214,10 @@ Spawning External Binaries).
 
 ### Managed identity
 
-- Default is `--key default`; `--key <name>` must match `[A-Za-z0-9._-]+`.
-  `--key`, raw `--session`, `--surface` are mutually exclusive.
+- Default is `--key default`; **`--key <name>` must match `[A-Za-z0-9._-]+`**,
+  because it becomes part of a session name that becomes a filesystem path.
+  **`--key`, raw `--session`, and `--surface` are mutually exclusive** — naming
+  a browser twice is a mistake, never a precedence question.
 - **A key is namespaced by the Workspace that holds the browser** —
   `dormouse.<workspaceId>.<name>`, the Workspace's *stable* id so a strip reorder
   renames nothing — and `dormouse.1.<name>` for a bare Wall, which has no
@@ -291,29 +297,23 @@ refreshes only when the driving command completes**
 (for a slow page, after the load; rationale), so every commit clears the title
 until `tabs` refreshes, even at the same URL.
 
-**Two-stage paint.** A changed stream JPEG paints at once as a **provisional
-frame** — the first image, and 250ms after pointer input (continuous movement
-extends the window) — then a crisp device-resolution `agentBrowserScreenshot`
-replaces it (rationale). The provisional frame is CSS-resolution (rationale).
-Rules that keep the two paths honest:
+**Two-stage paint.** A changed stream JPEG paints at once as a CSS-resolution
+**provisional frame** — the first image, and 250ms after pointer input
+(continuous movement extends the window) — then a crisp device-resolution
+`agentBrowserScreenshot` replaces it (rationale):
 
-- **Both paths are latest-only**: a newer pulse cancels an older provisional
-  decode; a provisional paint during an in-flight capture marks it stale.
-- **No capture may start inside the provisional window** (rationale) — one
-  settled shot at its end, and continued pointer input pushes the window out.
+- **Both paths are latest-only.**
+- **No capture may start inside the provisional window** (rationale).
 - **Must leave the loop dirty when capture or bitmap decode becomes stale**
-  (rationale); an unpainted pulse alone must not suppress a crisp draw.
-  Pinned by `agent-browser-screenshot-loop.test.ts`.
-- Byte-identical heartbeat frames and crisp captures are dropped before drawing.
-  **That dedup assumes the crisp loop is the only canvas writer, so any other
-  painter must bump the draw generation** in its key — re-attach and every
-  provisional paint do (rationale).
+  (rationale). Pinned by `agent-browser-screenshot-loop.test.ts`.
+- **Any canvas writer but the crisp loop must bump the draw generation** in its
+  key, or the byte-identical-frame dedup drops its paint (rationale).
 - **A host without `agentBrowserScreenshot` paints every changed provisional
   frame as its final image** rather than showing only the placeholder.
 
 High-rate `[ab-panel]`/`[agent-browser]` console diagnostics sit behind the
-`dormouse.flags.abDebugLogs` localStorage flag, read once at module load (reload
-to apply); `debugSnapshot()`'s ring is always on.
+`dormouse.flags.abDebugLogs` localStorage flag, read lazily and memoized on the
+first log (reload to apply); `debugSnapshot()`'s ring is always on.
 
 Input rules:
 
@@ -325,12 +325,13 @@ Input rules:
   `key.charCodeAt(0)`** (`.` is char 46 = VK_DELETE, so periods would otherwise
   become Delete presses).
 - Local paste is replayed as per-character key input.
-- macOS select-all/copy/cut use the host `agentBrowserEdit` channel, since those
-  chords do not survive CDP input, and fall through to the page where the host
-  has none. Undo/redo is not emulated.
+- **Select-all/copy/cut go through the host `agentBrowserEdit` channel on every
+  platform**, since those chords do not survive CDP input; every shipped host
+  implements it. Undo/redo is not emulated.
 
-Tabs live in the agent-browser surface: header-integrated for one, an in-body
-strip for two or more, select/close through `agentBrowserCommand`.
+Tabs live in the agent-browser surface: **the in-body strip renders only at two
+or more**, one tab getting the ordinary URL header and nothing tab-shaped.
+Select/close go through `agentBrowserCommand`.
 
 Source of truth: `lib/src/components/wall/AgentBrowserPanel.tsx` (`toDevice`, the
 tab strip), `lib/src/components/wall/agent-browser-surface-controller.ts`, `lib/src/components/wall/agent-browser-connection.ts`,
@@ -341,29 +342,25 @@ shared by the stream and `tab list --json`).
 ### Pop-Out
 
 `ab-popout` relaunches the same session headed, because Chrome fixes
-headed/headless at daemon launch. The pane becomes a stub with Pop back in, plus
-Bring to front where a host implements `agentBrowserBringToFront`; while the
-window is still opening (a relaunch in flight, or an eager pane without its
-session) the stub offers neither. **State carried in v1 is only the active
+headed/headless at daemon launch. The pane becomes a stub with Pop back in;
+while the window is still opening (a relaunch in flight, or an eager pane
+without its session) the stub offers nothing. **State carried in v1 is only the active
 non-blank URL**: other tabs, DOM state, scroll, form inputs, session storage,
 cookies/logins do not survive.
 
-Host sequence: run `close`, **then terminate the daemon by its pid file**
-(`$AGENT_BROWSER_SOCKET_DIR/<session>.pid`, default `~/.agent-browser`) **and
-wait for it to exit** (rationale), then reopen. **Never wait for the page to
-load** (rationale): every launch — pop-out, pop-in, `agentBrowserOpen` —
-resolves once the *relaunched* daemon is up (a pid file naming a pid other than
-the killed one, and a `<session>.stream` file naming a port that accepts a
-connection), asking `stream status` only after `open` returns. **A non-zero
-`open` exit with the daemon up is a page still loading, not a failed launch**;
-only a launch without a published port fails, including after a zero exit;
-`agentBrowserOpen` then closes its spawn. **A headed session is tracked for
-shutdown before its launch**, so a window whose page never loads is still
-closed. **Never query the daemon during the close/reopen gap** (rationale), host and controller
-park/recovery paths alike, so **Dormouse supplies the active-tab URL and the
-host trusts it**. Once `open` returns, only a still-current relaunch best-effort
-closes stray `about:blank` tabs, **and only while a real page is open**, so it
-never closes the sole tab (rationale).
+Host sequence: run `close`, **then terminate the daemon by its pid file and wait
+for it to exit** (rationale), then reopen. **Never wait for the page to load**
+(rationale): every launch — pop-out, pop-in, `agentBrowserOpen` — resolves once
+the *relaunched* daemon is up, asking `stream status` only after `open` returns.
+**A non-zero `open` exit with the daemon up is a page still loading, not a
+failed launch**; only a launch without a published port fails, including after a
+zero exit; `agentBrowserOpen` then closes its spawn. **A headed session is
+tracked for shutdown before its launch**, so a window whose page never loads is
+still closed. **Never query the daemon during the close/reopen gap**
+(rationale), host and controller park/recovery paths alike, so **Dormouse
+supplies the active-tab URL and the host trusts it**. Once `open` returns, only
+a still-current relaunch best-effort closes stray `about:blank` tabs, **and only
+while a real page is open**, so it never closes the sole tab (rationale).
 
 While popped out, Dormouse keeps a stream/CDP observer for same-tab URL/header
 updates and headed-window close auto-revert. **Hosts must cancel pending
@@ -389,7 +386,6 @@ sidecar/Rust adapter.
 | `getAgentBrowserStreamUrl` | Direct stream URL, or the VS Code relay URL. |
 | `agentBrowserOpen` | Spawn a GUI-owned session for iframe -> agent-browser; resolves when the daemon is up, not when the page loads ([Pop-Out](#pop-out)). |
 | `agentBrowserPopOut` / `agentBrowserPopIn` | Headed/headless relaunch. |
-| `agentBrowserBringToFront` | Optional; no host implements it today. |
 
 **Host-side validation is the security boundary:** every `agentBrowserCommand`
 implementation must enforce the shared allowlist; the CLI is not trusted to
@@ -404,11 +400,8 @@ candidates run. The webview applies the same predicate before storing or sending
 one.
 
 **Screenshots are captured into a private per-process directory, and it is
-removed** (rationale): an `0700` `mkdtemp` with an unguessable file name. The
-byte-returning capture unlinks its file once the bytes are in memory;
-`closePoppedOut` drops the directory, with a `process.once('exit')` backstop. **A
-tmpdir that cannot be created is answered `{ ok: false }` and retried on the next
-capture, never memoized.**
+removed** (rationale). **A tmpdir that cannot be created is answered
+`{ ok: false }` and retried on the next capture, never memoized.**
 
 **VS Code must reach the stream through a loopback relay** — the agent-browser
 stream server rejects `vscode-webview://` origins. The relay grants one
@@ -481,13 +474,10 @@ Source of truth: `lib/src/components/wall/IframePanel.tsx`,
 
 ### Iframe Shim
 
-**Must send these fixed, never-user-provided shim messages to the app:**
-
-- `leader`: dual-tap Meta/Shift leader chord; relayed from nested documents.
-- `pointerdown`: genuine click, used to select/focus the pane; relayed.
-- `location`: outer-document history/hash/page events and uncancelled same-frame
-  anchor clicks; never relayed from nested documents.
-- `open-window`: intercepted `target=_blank` anchor or `window.open` URL; relayed.
+**Must send four fixed, never-user-provided message kinds to the app and nothing
+else** — `leader`, `pointerdown`, `location`, `open-window`. **`location` is
+never relayed from a nested document**; the other three are. **`open-window`
+intercepts every anchor target but `_self`**, plus `window.open`.
 
 **Only `http:` and `https:` reach a browser Surface, re-checked at the sink.**
 `open-window` and the control socket's `surface.iframe` go through
@@ -516,9 +506,8 @@ Source of truth: `lib/src/host/iframe-proxy-rewrite.ts` (`iframeShim`),
 - **`IframePanel` must apply `transform: translateZ(0)` to its immediate
   container**, or Chromium offsets out-of-process iframe pointer events from a
   far-away compositing ancestor.
-- **Every framed page is sandboxed, proxied or raw** (rationale); the `sandbox`
-  omits `allow-top-navigation` to block framebusting, allowing scripts,
-  same-origin (within the frame's own origin), forms, popups, modals, downloads.
+- **Every framed page is sandboxed, proxied or raw** (rationale), and the
+  `sandbox` omits `allow-top-navigation` to block framebusting.
 - **The `allow` attribute grants no device or clipboard-read permission** —
   `autoplay`, `clipboard-write`, `fullscreen` only. (rationale)
 
@@ -603,8 +592,7 @@ Source of truth: `lib/src/lib/platform/iframe-proxy-types.ts`,
   controller on kill/swap.
 - Process-backed targets are owned by the **dor-tools** scope
   (`docs/specs/dor-tool.md` `## Future`), which subsumes the plugin/backend
-  target axis formerly staged here. (That scope's C1 phase also depends on the
-  teardown hook above.)
+  target axis formerly staged here.
 - Optional terminal-side "this port is viewed by surface:N" indicator.
 - Replace the spawn-per-shot CLI screenshot with a persistent host-side CDP
   capture channel. Measured against agent-browser 0.27.3 (headless, attach dance
diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index 4df784f95..4e2bdebe2 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -75,7 +75,8 @@ PowerShell, which never read it.
 **A caller cwd must leave the MSYS drive form before it goes on the wire.** Git
 Bash exports `PWD` as a POSIX path (`/c/Users/…`) that win32 `path.resolve`
 would mangle into `C:\c\Users\…` and match no Surface; `msysToWindowsCwd` folds
-it back to a native path, backing `dor ensure --cwd` and `dor list --cwd`.
+it back to a native path, under every command that resolves a caller cwd
+(`ensure`, `list`, `tool`, `open`, `skill`).
 
 Source of truth: `dor/bin/dor`, `dor/bin/dor.cmd`, `scripts/stage-dor-cli.mjs`,
 `withoutInheritedMsysOriginalPath` in `standalone/sidecar/pty-core.js`,
@@ -89,21 +90,13 @@ Source of truth: `dor/bin/dor`, `dor/bin/dor.cmd`, `scripts/stage-dor-cli.mjs`,
 `spawnAndCapture` from `dor-lib-common`, never raw `node:child_process`
 `spawn`** — `dor ab` driving `agent-browser`, the agent-browser host running
 tab/eval/screenshot commands, and anything added later. It is the only code
-`dor` and the `lib` host share, and owns three concerns:
-
-- **cross-spawn, not raw spawn** — Node's own `spawn` cannot reach a Windows
-  `.cmd` PATH shim by either route (rationale); cross-spawn resolves through
-  `PATH`/`PATHEXT`, routes `.cmd`/`.bat` through `cmd.exe` with correct argument
-  escaping, and passes through untouched on POSIX. **Never forward an argument
-  containing a literal `%VAR%`** — `cmd.exe` expands it through a `.cmd` shim,
-  an unavoidable batch limitation; today's forwarded arguments carry none.
-- **`windowsHide`.** Without it every `.cmd` shim flashes a focus-stealing
-  console window, once per screenshot stream-frame pulse (rationale).
-- **Resolve on `exit`, not `close`, with an exit-time snapshot** — the
-  `agent-browser open` daemon leaves a `close`-only wait hanging forever on
-  Windows (rationale). `spawnAndCapture` waits for `close` but falls back to
-  `exit` after a short grace, snapshotting the output at `exit` so the daemon's
-  later scribbles stay out.
+`dor` and the `lib` host share, and it owns the Windows recipe: cross-spawn
+rather than Node's own `spawn`, `windowsHide`, and resolution on `exit` with an
+exit-time output snapshot (rationale).
+
+**Never forward an argument containing a literal `%VAR%`** — `cmd.exe` expands
+it through a `.cmd` shim, an unavoidable batch limitation; today's forwarded
+arguments carry none.
 
 **`spawnAndCapture` never throws:** a spawn-level failure resolves as
 `{ ok: false, error }`, including synchronous argv-validation errors
@@ -145,16 +138,10 @@ Control direction: `dor` → sidecar JSON-lines net socket → Rust command/even
 bridge → `TauriAdapter` `CustomEvent("dormouse:control-request")` → Wall
 handler, and back along the same hops.
 
-**A request naming a Workspace or a Window is routed to the window holding
-it** (`--workspace`, or `dor list --window <label>`), whichever window the
-caller sits in; one naming neither goes to the
-window that owns its `DORMOUSE_SURFACE_ID`, and one naming no Surface to the
-focused window. A target the registry cannot place — an unknown ref, or a name
-two windows use — reaches the caller's own window, which refuses it by name.
-**A Surface no window owns fails** — `No Dormouse window owns surface '<id>'` —
-rather than being handed to a sibling, which would act on the wrong terminal.
-**A cancel follows its own request** to the window holding it
-(`docs/specs/standalone.md` → Routing).
+Routing precedence, the refusal for a Surface no window owns, and a cancel
+following its own request belong to `docs/specs/standalone.md` → Routing. **A
+target the registry cannot place — an unknown ref, or a name two windows use —
+reaches the caller's own window, which refuses it by name.**
 
 ### VS Code
 
@@ -180,49 +167,29 @@ a request with no surface id goes to the first active router.
 ### Control-channel security
 
 The shared control server protects the Surface API against local interposition
-(rationale):
-
-**The server picks the path, and picks it unguessably.** POSIX:
-`<tmpdir>/dormouse-dor-<uid>/<8 random bytes>.sock`, the parent directory
-created `0700` and checked before every bind — a real directory, not a symlink,
-owned by this uid, at exactly mode `0700`. One of ours that is merely loose gets
-tightened; anything else **stands the channel down** (the same predicate as
-`peerDirIsSafe()`). 8 random bytes rather than 16, so the POSIX path clears
-macOS's `sun_path` cap (rationale). Windows: `\\.\pipe\dormouse-dor-<8 random
-bytes>` — its machine-wide namespace has no directory to harden, leaving only
-unpredictability. **Neither spelling may derive from the PID**, which is
-enumerable and recycled.
-
-**Must authenticate both peers before sending a Surface request; never send the
-token on the wire.** The server speaks first with a challenge
-nonce; the client answers `HMAC-SHA256(token, "dor-control/client <nonce>")` and
-a nonce of its own; the server answers `HMAC-SHA256(token, "dor-control/server
-<nonce>")` before the client sends any request (rationale). **A peer that fails
-its half is hung up on with no reply** (rationale); a connection that says
-nothing at all is dropped after 10s. **Both sides must compare proofs in
-constant time** (SHA-256 digests through `timingSafeEqual`), never a
-short-circuiting string compare. The two proof domains are mirrored between
-client and server, pinned by `lib/src/lib/mirrored-constants.test.ts`.
-
-**A lost bind is fatal to the channel, never to the host.** Neither host exits,
-but **the token stops at the process that owns the server** (rationale):
-`pty-host.js` and the sidecar delete both control variables from their own
-environment on startup and re-attach them to spawned shells only once `ready`
-resolves, each as above. When the bind is lost — a squatted Windows pipe name,
-an unsafe socket directory, an uncleanable socket file — the variables stay
-gone. **Both hosts hold their spawn path until `ready` settles** (2s ceiling) so
-the first terminal cannot race the bind.
+(rationale). `docs/specs/security-local.md` → "The dor control socket" owns the
+unguessable path and its four-part `0700` directory predicate, the never-from-a-PID
+rule, the token that never crosses the wire, the constant-time proof compare,
+and the stand-down that keeps both control variables out of every spawned shell
+when a bind is lost — two of them as audited `FAIL IF` lines. What only this
+spec carries:
+
+- **The POSIX socket name is 8 random bytes rather than 16**, so the path clears
+  macOS's `sun_path` cap (rationale).
+- **A connection that says nothing at all is dropped after 10s.**
+- The two proof domains are mirrored between client and server, pinned by
+  `lib/src/lib/mirrored-constants.test.ts`.
+- **Both hosts must hold their spawn path until `ready` settles** (2s ceiling),
+  so the first terminal cannot race the bind.
 
 ### Deadlines And Cancellation
 
-Each request carries the client's own `timeoutMs` on the wire; the control
-server treats it as a hint and sets a timer at the client's deadline plus 10s.
 **Every valid request must preserve `host ceiling < client socket < server
-reaper`,** so a server timeout can never turn the host's normal timeout result
-into a transport error. `dor await` accepts a host ceiling of at most 24h, its
-socket deadline is 5s later, and the maximum server deadline is therefore 24h +
-15s. Absent or nonsense hints (non-finite, ≤ 0, or above 24h + 5s) fall back to
-the server default of 65s, which clears the longest fixed client deadline (`dor
+reaper`.** The client's own `timeoutMs` travels on the wire as a hint and the
+server timer sits 10s above it. `dor await`'s host ceiling is at most 24h, its
+socket deadline 5s later, the maximum server deadline therefore 24h + 15s;
+absent or nonsense hints (non-finite, ≤ 0, or above 24h + 5s) fall back to the
+server default of 65s, which clears the longest fixed client deadline (`dor
 ensure --restart` at 60s).
 
 **Some requests outlive their client.** When a socket closes with entries still
@@ -294,7 +261,7 @@ Invariants:
 - **Bare numeric targets and `pane:N` are not Surface handles.** Pane refs stay
   reserved for future layout-only commands.
 - Text list output defaults to refs; commands that list handles accept
-  `--id-format refs|ids|both` (`uuids` is a compatibility alias for `ids`). JSON
+  `--id-format refs|ids|both`. JSON
   list output always includes both refs and stable ids.
 - `workspace:<n>` selects a container and is **stable**: `n` is the number of
   the Workspace's registry-minted id (`docs/specs/standalone.md` → "Workspace
@@ -366,10 +333,8 @@ order.
 **Port enumeration is opt-in.** With `includePorts` set (`dor list --ports` /
 `--port`) the host scans each terminal Surface's process tree
 (`docs/specs/dor-browser.md` → Dev-Server Chip), shelling out (`lsof` /
-`Get-NetTCPConnection`). **One listing costs one
-scan where the adapter can batch it** (`PlatformAdapter.getOpenPortsMany`), and
-`getOpenPorts(id)` per Surface in parallel where it cannot — so a listing
-spanning Workspaces does not multiply a synchronous host scan by its row count.
+`Get-NetTCPConnection`). **One listing costs one scan where the adapter can
+batch it** (`PlatformAdapter.getOpenPortsMany`).
 **A `--all` listing never forwards `includePorts` to a Wall**, scanning once for
 every Workspace's terminals instead. A remote paired session reports none, and
 any error degrades to an empty list rather than failing the call.
@@ -405,9 +370,8 @@ Where `stricli` cannot express a shape, a command may declare narrow,
 snapshot-tested `findReplace` / `remove` help patches (`root` / `command-usage`
 / `command-detail` scope, `HELP_PATTERN_TOKENS` syntax) — not a general docs
 renderer. **stricli's default `--help-all`/`-H` integration must stay
-unregistered**: it bypasses those patches and prints raw usage lines
-contradicting what the commands accept, leaving `--help`/`-h` the single
-documented help surface. `dor --version`/`-v` (sole argument only) is rewritten
+unregistered**, leaving `--help`/`-h` the single documented help surface.
+`dor --version`/`-v` (sole argument only) is rewritten
 to `dor version`, and `ab` to `agent-browser`, before parsing.
 
 The spec keeps the behavior help cannot express:
@@ -421,7 +385,7 @@ The spec keeps the behavior help cannot express:
 | `await` | **Must name `--until quiet\|exit`; never infer it.** Timeout 1–86400 whole seconds, default 600; `alert.md` owns wake semantics. |
 | `kill` | **Must select exactly one confirmation mode.** Conditional text needs four non-whitespace characters and must match `read`; browser Surfaces are killable. |
 | `iframe`, `agent-browser` / `ab` | `dor-browser.md` owns the renderers; see [target resolution](#browser-open-target-resolution) and [addressing](#agent-browser-surface-addressing). The passthrough is intercepted before stricli parses it. |
-| `list` | Filters are ANDed client-side; `--port` filters terminals (browser Surfaces never match) and implies the opt-in detail scan, `--ports` only requests it. **Owns every Workspace read**: `--workspace` narrows to one, `--all` groups every Workspace's rows under its header — **every Workspace keeps its header**, including one a filter emptied, so the text listing and the JSON `workspaces` array name the same Workspaces — `--workspaces` is the overview, and the three cannot be combined. **`--all --json` adds `caller_workspace_ref` / `focused_workspace_ref`** beside the `_surface_ref` pair, which under `--all` names a `surface:N` every Workspace has; the `_surface_id` halves stay unique. **`--workspaces` takes `--json` and nothing else**, by an allowlist, so a flag added to `list` is refused there until it is named. |
+| `list` | Filters are ANDed client-side; `--port` filters terminals (browser Surfaces never match) and implies the opt-in detail scan, `--ports` only requests it. **Owns every Workspace read**: `--workspace` narrows to one, `--all` groups every Workspace's rows under its header — **every Workspace keeps its header**, including one a filter emptied, so the text listing and the JSON `workspaces` array name the same Workspaces — `--workspaces` is the overview, and the three cannot be combined. **`--all --json` adds `caller_workspace_ref` / `focused_workspace_ref`** beside the `_surface_ref` pair, which under `--all` names a `surface:N` every Workspace has; the `_surface_id` halves stay unique. **`--workspaces` takes `--json` and `--window` and nothing else**, by an allowlist, so a flag added to `list` is refused there until it is named. |
 | `workspace` | **Mutation only** ([dor workspace](#dor-workspace)). |
 | `app` | Standalone only ([dor app](#dor-app)). |
 | `skill` | Prints the bundled skill or installs its bootstrap stub; [Agent Skill](#agent-skill) owns the contract. |
@@ -438,8 +402,8 @@ identity, singleton Workspace/Window refs, and Host identity/runtime paths — b
 Activity/state filters are staged (see [Future](#future)).
 
 **Every command that acts on a Surface accepts `--workspace <ref>`** — `split`,
-`ensure`, `read`, `send`, `await`, `kill`, `iframe`, and the `dor ab`
-passthrough, which intercepts it beside its identity flags — naming the
+`ensure`, `read`, `send`, `await`, `kill`, `iframe`, `tool`, `open`, and the
+`dor ab` passthrough, which intercepts it beside its identity flags — naming the
 Workspace its targets resolve in and, for a creating verb, the Workspace the new
 Surface joins.
 
@@ -462,7 +426,7 @@ Wall (Handle Model), and each takes a `workspace:<n|name>` target except `new`:
 | `rename <ref> <name>` | Renames the Workspace only — no Surface title (`docs/specs/layout.md` → "Workspaces"). |
 | `close <ref> [--force]` | **Refuses, raising no confirmation, when the Workspace holds a touched or running Surface** unless `--force` — the caller is a command, not someone watching the Wall, exactly as `dor kill` archives silently. A Workspace whose close meets another already in flight and one whose Wall never registers (`still mounting`, after the routing retry — closing past it would leave its Sessions running with nothing holding them) refuse too. Member Surfaces close through the closure coordinator, and a refusal leaves the Workspace open and the user where they were (`docs/specs/notepad.md` → "Closure"). |
 | `switch <ref>` | Activates it. |
-| `move <ref> [--window <label\|new>] [--index <n>] [--dangerously-destroy-iframe-page-state]` | To another Window (`new` tears out), a strip position, or both — with both, the position is in the target's strip; the Window handling it runs the same transfer the strip's drag does (`docs/specs/standalone.md` → Transfer), with no pointer to place the tab by. **Answers `moved` only once the target Window has adopted the Workspace**; one handed back (the target closed mid-transfer, or never answered) is an error naming the reason, and the Workspace stays where it was. **Refuses a move between Windows while the Workspace holds a plain iframe Surface unless the flag is passed**, naming them: the page state is lost (`docs/specs/layout.md` → Workspaces). A host with one Window reorders only. |
+| `move <ref> [--window <label\|new>] [--index <n>] [--dangerously-destroy-iframe-page-state]` | The Window handling it runs the same transfer the strip's drag does (`docs/specs/standalone.md` → Transfer), with no pointer to place the tab by. **Answers `moved` only once the target Window has adopted the Workspace.** **Refuses a move between Windows while the Workspace holds a plain iframe Surface unless the flag is passed**, naming them: the page state is lost (`docs/specs/layout.md` → Workspaces). A host with one Window reorders only. |
 
 **Each verb ships as one action of one command**, not a route map: the published
 CLI reference renders one help page per top-level command
@@ -565,13 +529,11 @@ in `dor/src/protocol.ts`, the `surface.resolveOpen` handler in
 rather than a session the caller must already know — the same handle addressing
 terminal verbs use (`dor read surface:3`).
 
-**`--surface` is a third mutually exclusive identity flag beside `--key` and
-`--session`** — naming a browser twice is a mistake, never a precedence
-question, so any two of the three fail (`--key and --surface are mutually
-exclusive`). It changes *addressing* only: every other argument is still
-forwarded verbatim, and the host-side subcommand allowlist is untouched. **A
-managed `--key` must match `[A-Za-z0-9._-]+`**, because it becomes part of a
-session name that becomes a filesystem path.
+`--surface` is the third of the mutually exclusive identity flags
+(`docs/specs/dor-browser.md` → Managed identity); any two of the three fail
+(`--key and --surface are mutually exclusive`). It changes *addressing* only:
+every other argument is still forwarded verbatim, and the host-side subcommand
+allowlist is untouched.
 
 **Resolution is host-side**, mirroring `surface.resolveOpen`: the CLI sends the
 handle to `surface.resolveAgentBrowser` and forwards the session it gets back.
@@ -593,10 +555,7 @@ whose daemon boot has not yet named it ([dor-browser.md](dor-browser.md) → Pan
 Context Menu Connect): capability and renderer but no session, failing with
 `surface 'surface:2' has no agent-browser session yet`.
 
-Because the session comes from the surface rather than a key, **`--surface` is
-the only way to drive a GUI-spawned `dormouse.1.gui-<hex>` session**, which no
-`--key` can name ([dor-browser.md](dor-browser.md) → Managed identity). Like
-every handle target, it requires a live control endpoint.
+Like every handle target, `--surface` requires a live control endpoint.
 
 Source of truth: `extractSessionFlags` / `resolveSession` in
 `dor/src/commands/agent-browser.ts`, `resolveAgentBrowser` in
@@ -621,22 +580,16 @@ is an implicit key that also lets an agent adopt a command the user started by
 hand. Only browser Surfaces carry an explicit join key (`dor ab --key <name>`),
 because their session is held externally by `agent-browser`.
 
-| Workflow | How the shipped CLI does it |
-| --- | --- |
-| Share a dev server | `dor ensure -- npm dev` reuses a command already live in the same resolved cwd; `dor ab open surface:N` / `dor iframe surface:N` then resolves that terminal's port in one step. Two-step form: `dor list --command "npm dev" --cwd . --ports`, then `dor ab open http://localhost:<port>`. |
-| Launch a sub-agent | `dor split -- codex` returns `surface:N`, then `dor send surface:N …` and `dor read surface:N`. |
-| Wait on a sub-agent | `dor await surface:5 --until quiet && dor read surface:5`, instead of a `dor list` polling loop. |
-| Client / server browser testing | `dor ab --key client open <url>` and `--key server` create or reuse two independent browser Surfaces. |
-| Multi-worktree, same command | Two worktrees each run `dor ensure -- npm dev`; the resolved cwd keeps them distinct for `dor list --command "npm dev" --cwd <worktree>`. |
-| Long-running background job | `dor ensure --minimize -- npm test -- --watch` keeps a watcher out of the layout, and `dor list --command …` rediscovers it after churn. |
-| Port-owner handoff | `dor list --port 5173` returns the terminal owning the socket; `dor ab --key client open http://localhost:5173` binds the browser side. |
-| Safe cleanup | `dor list --command "npm dev" --cwd .`, then `dor kill <ref> --confirm-if-read <text>` on a ref from that listing. |
+The worked examples — dev-server sharing, sub-agent launch and await, paired
+browser keys, multi-worktree, minimized watchers, port-owner handoff, safe
+cleanup — are `dor/skill.md`'s "## Recipes", which ships with the CLI
+([Agent Skill](#agent-skill)).
 
 ## Agent Skill
 
 `dor/skill.md` is the agent skill: instructions teaching a coding agent inside a
-Dormouse terminal to drive it through `dor` — the Agent Workflows above, recast
-as a targeting model plus recipes. Distribution splits into content and
+Dormouse terminal to drive it through `dor` — a targeting model plus the recipes
+[Agent Workflows](#agent-workflows) points at. Distribution splits into content and
 bootstrap so each is exactly as stable as it needs to be:
 
 - **Content ships with the CLI.** `scripts/generate-dor-skill.mjs` (prebuild,
diff --git a/docs/specs/dor-tool.md b/docs/specs/dor-tool.md
index ac82d908f..b59a84c1b 100644
--- a/docs/specs/dor-tool.md
+++ b/docs/specs/dor-tool.md
@@ -33,7 +33,7 @@ Source of truth: `surfaceKindFromParams` / `isToolParams` in `lib/src/components
 
 **Must resolve a named Tool from the nearest ancestor `dormouse.yml`, then fall back to user Tools when that name is absent.** `--global` skips project discovery. Malformed project files fail lookup. If only the user file exists, an unknown name reports that file and its Tool names. The host owns discovery, bounded reads, YAML parsing, and substitutions; the renderer receives the resolved result. Canonical field shapes are `ToolEntry` in `lib/src/host/tool-registry.ts`.
 
-**Must read user Tools from `$XDG_CONFIG_HOME/dormouse/dormouse.yml` when that environment value is absolute, otherwise `~/.config/dormouse/dormouse.yml`.** Both local hosts use this location. User Tools require no project grant; malformed or unreadable user configuration fails lookup. Project and user Tools occupy separate reuse scopes.
+**Must read user Tools from `$XDG_CONFIG_HOME/dormouse/dormouse.yml` only when that environment value is absolute**, else `~/.config/dormouse/dormouse.yml`; both local hosts use this location. User Tools require no project grant; malformed or unreadable user configuration fails lookup. Project and user Tools occupy separate reuse scopes.
 
 | Field | Behavior |
 | --- | --- |
@@ -44,6 +44,7 @@ Source of truth: `surfaceKindFromParams` / `isToolParams` in `lib/src/components
 
 - **Must reject unknown `prespawn_*` fields and unknown substitutions**; unknown ordinary fields produce warnings. `$PROJECT_ROOT` is the declaring directory, `$CWD` the caller's resolved directory, and `$TARGET` the canonical local file input. (rationale)
 - **Must preserve scalar `prespawn_dedupe` as a one-element literal list**, never interpret it as a command to execute. Reserve separate fields for future computed keys. (rationale)
+- **Must reject an empty `prespawn_dedupe` list, and `$TARGET` in a `prespawn_dedupe` whose `run` is a shell-command string** — a string `run` takes no inputs, so there is no target to key on.
 - **Must warn when a repo-local key omits `$PROJECT_ROOT`, or a `$TARGET` run has a key without `$TARGET`.** Allow intentional cross-checkout or cross-file dedupe.
 - **Must reject `$PROJECT_ROOT` in user configuration**, which has no project root.
 
@@ -79,7 +80,7 @@ Source of truth: `queueToolSpawn` / the `surface.tool` handler in `lib/src/compo
 4. **Must require `trust-recorded` before re-resolving the named entry**, then stage the command, renderer, port strategy, and key before exposing its terminal. Rejected grants or failed re-resolution retain approval and display an error until retry; blank reasons use a fallback. Closed Surfaces must not start later or show stale errors.
 5. **Must recheck the resolved key before launching an approved Tool**, honoring its original `--fresh` intent. Close a redundant approval through the ordinary close coordinator before revealing or restarting the match; a failed closure retains the approval and sends no command.
 6. **Must close a declined approval through the ordinary close coordinator and record no denial.** Archive failure may retain the pane. (rationale)
-7. **Must record each grant as its own atomically written file**, so hosts sharing one state directory never lock or merge.
+7. **Must record each grant as its own atomically written file** under the host's state directory, so hosts sharing one never lock or merge. **A host that supplies no state directory keeps grants in memory for that process only**, rather than inventing a location the user cannot find to revoke.
 8. **Never content-hash grants or re-prompt solely because the config changed.** (rationale)
 
 **Must offer Retry and Close after post-grant lookup failure**, preserving the error with no PTY. Retry repeats only lookup; Close retains permission; the footer states both. **Never restore pending approval once launch clears its marker**, including after PTY/minimization failure.
@@ -149,19 +150,19 @@ Source of truth: `toolCommand` in `dor/src/commands/tool.ts`; `dor/test/snapshot
 
 **Must accept exactly one existing local regular file for `dor open`**, resolved by the `$TARGET` rules in [Declaring tools](#declaring-tools).
 
-**Must select the first matching entry of the user file's ordered `open` list**, whose entries contain `match` and `tool`. `--tool` explicitly selects a handler. Every association must name an argument-list Tool in that same user file or `builtin:file`. Never discover project configuration during this lookup; project `open` rules are ignored with a warning during explicit project-tool lookup.
+**Must select the first matching entry of the user file's ordered `open` list.** Every association must name an argument-list Tool in that same user file or `builtin:file`. **Never discover project configuration during this lookup**; project `open` rules are ignored with a warning during explicit project-tool lookup.
 
-**Must match patterns without `/` against the canonical filename, and patterns with `/` against both paths relative to the canonical CWD and canonical absolute paths**, separators normalized to `/`, with bundled picomatch: case-sensitive, dotfiles only by explicit pattern. Use the supplied CWD if canonicalization fails; matching never changes the Tool's run directory or `$CWD`. A miss names the user config path and suggests `--tool`. (rationale)
+**Must use the supplied CWD when canonicalization fails**, and never let matching change the Tool's run directory or `$CWD`. A miss names the user config path and suggests `--tool`. (rationale)
 
 **Must pass the canonical file path as the selected Tool's one input.** Reuse follows [Identity and dedupe](#identity-and-dedupe), `$TARGET` in the key providing per-file identity; placement follows [Take-over](#take-over).
 
 **Must reject declared Tool names beginning with `builtin:` in either configuration scope.** Built-in handler names cannot be shadowed.
 
-**Must use `builtin:file` for supported files when no user rule matches.** An explicit unknown handler or malformed user configuration fails without fallback. Selecting `builtin:file` for an unsupported format reports that limitation and suggests a user Tool. Built-in identity is the canonical file path in its own scope, separate from user and project Tools.
+**Must fail without fallback on an explicit unknown handler or malformed user configuration**; `builtin:file` named for an unsupported format reports that limitation and suggests a user Tool. Built-in identity is the canonical file path in its own scope, separate from user and project Tools.
 
 **Must prefer known extensions over filename-based text fallbacks; source extensions remain escaped previews.**
 
-**Must run the built-in viewer as a Tool-owned `dor` process**, serving HTML, images, media, and escaped text/source previews. Markdown is source text; custom viewers may render it. Text previews and HTML/CSS dependency inspection are limited to 8 MiB per file. Text/source previews grant only their opened file and skip dependency inspection. (rationale) Oversized HTML and referenced CSS still stream without dependency inspection. The grant contains at most 256 files: the opened document and statically referenced relative HTML/CSS assets within its directory tree; exceeding that bound fails the open without serving a partial grant. Never expand the grant through root-relative, external, or dynamic references; requests can read only granted paths.
+**Must run the built-in viewer as a Tool-owned `dor` process.** Text/source previews grant only their opened file and skip dependency inspection. (rationale) Oversized HTML and referenced CSS still stream without dependency inspection. **The grant contains at most 256 files** — the opened document and statically referenced relative HTML/CSS assets within its directory tree — and exceeding that bound fails the open without serving a partial grant. **Never expand the grant through root-relative, external, or dynamic references**; requests can read only granted paths.
 
 **Must require a user Tool for PDFs**, including files named `README.pdf`. (rationale)
 
@@ -202,6 +203,7 @@ Source of truth: `toolTakesOverCaller` / `toolRerunsInCaller` / `callerStillPlac
 **Must consume OSC 367 at the PTY owner's parser**, including malformed and unknown verbs, and emit no reply. `serve` and `state` are implemented verbs. The escape registry is `docs/specs/terminal-escapes.md`.
 
 - **Must sanitize and bound the payload before retaining it.** `ToolAnnounce` / `parseToolAnnounce` and `ToolState` / `parseToolState` own the field shapes and validation limits.
+- **Must reject a payload naming a version this contract does not speak.** `state` requires `v: 1`; `serve` reads an omitted `v` as 1 and refuses any other value — a future v2's rejection path.
 - **Must treat an optional serve `path` as a path/query on the discovered port, never as another authority.** Accept at most 2,048 characters starting with one `/`, with no backslash, ASCII whitespace/control, or DEL; invalid paths are ignored and the default is `/`. The port still must belong to the designated Session's process tree. Live binding memory includes the path; durable saves omit it.
 - **Must forward parsed announcements, state reports, and command-start resets in stream order to the owning renderer.** A start clears the previous command's announcement and unsaved state; later reports in that chunk survive. Standalone uses `terminal:protocolEvents`; VS Code uses nullable `terminal:toolAnnounce` and `terminal:toolState` scoped to the owning webview, with null clearing the corresponding record. The fake adapter applies locally.
 - **Must reconstruct announcements, state, and resets from raw replay without emitting replies**, preserving transferred announcements when since-mark replay has no command start, and clear the renderer record on Session disposal. Ordinary terminal announcements stay inert.
@@ -261,16 +263,16 @@ Source of truth: `PersistedToolMetadata` in `lib/src/lib/session-types.ts`; `sav
   rehydrate-from-args + `persist: "never"`: every stateless tool, no new API,
   no Windows question.
 - **D2 — dehydrate/rehydrate.** The `367;dehydrate` verb +
-  `DORMOUSE_DEHYDRATE`; the `dehydrate` flag is reserved in the serve payload
-  from the shipped `serve` payload. The Windows graceful-stop is needed here
-  only.
+  `DORMOUSE_DEHYDRATE`, opted into by the `dehydrate` flag the shipped `serve`
+  payload already reserves. The Windows graceful-stop is needed here only.
 - **The announced `name`.** Wire the reserved [OSC 367](#osc-367) `name` into
   the title-candidates channel and `dor list`'s location column.
 - **Later** — `prespawn_*` beyond the dedupe literal: a computed key, and
   `prespawn_port`. Pocket/remote browser view (rides the browser-surface
   staging in `docs/specs/remote-api.md`; reserve the kind on the wire now). An in-pane terminal/browser strip (decide against the
   glossary's reserved multiple-Surfaces-per-Pane). A `boots: web` hint if the
-  terminal flash grates. `--has terminal` / `--has browser` for `dor list`.
+  terminal flash grates. `--has terminal` / `--has browser` *filter flags* for
+  `dor list`, whose rows already carry the fields.
 
 ### Dehydrate and rehydrate
 
diff --git a/docs/specs/dor-tool.rationale.md b/docs/specs/dor-tool.rationale.md
index 6b6f93b22..76753ab57 100644
--- a/docs/specs/dor-tool.rationale.md
+++ b/docs/specs/dor-tool.rationale.md
@@ -42,42 +42,16 @@ A hardcoded Storybook port can disagree with the port it obtains under contentio
 
 ### September 2026 innerdogfood QC record
 
-The `dor-tool-qc` run began at `4c7f9012` and used the real standalone sidecar,
-staged CLI, PTYs, and iframe proxy. At that historical baseline the Tools flag
-could reject creation and standalone `dor open` split; both behaviors were
-subsequently superseded by always-enabled Tools and eligible inline opening.
-
-Observed passes covered project approval (pending dedupe, decline/re-prompt,
-folder-only permission, failed spawn without a PTY, repair and Retry); literal
-argv and canonical symlink targets; three concurrent keyed invocations sharing
-one Tool, fresh instances, idle/fast-command restart with stable refs; automatic
-single-port serving, three-port refusal, and announced port/path selection.
-User-rule ordering and explicit overrides worked; malformed user configuration
-failed, and project associations did not intercept file opens. Text/Markdown
-source, HTML/CSS/image, SVG, audio, and awkward filenames rendered; URL,
-directory, missing/unsupported-file and oversized-text cases failed usefully.
-
-Approval controls remained usable at 249×203 pixels. Terminal Context,
-minimize/reveal, exit/refocus, and iframe/screencast round trips passed. A clean
-harness reload preserved every ID, kind, URL, and Workspace; cross-Workspace
-identity stayed scoped. The four final viewer processes and earlier fixture
-listeners exited when their Tools closed; both owned harnesses stopped and
-private credential captures were deleted.
-
-Full `pnpm test` and `pnpm build` passed during the run, plus 139 focused UI
-checks. The PDF-policy follow-up passed 168 CLI tests, 20 host dispatch/proxy
-tests, and spec/public-doc lints; staged hosts contained no PDF renderer assets.
-These counts describe that run, not the current test inventory.
-
-One development-state reset made Tools appear as terminals while root tests
-and builds ran beside the harness. Investigation confirmed that
-`e2e-lint-selftest` temporarily mutates Vite inputs, including invalid root
-package JSON; the exact metadata-loss trigger was not captured. A clean
-restart and stable-build reload passed. This run did not exercise Tool transfer,
-native-window movement, native Tauri/VS Code rendering, Windows shells, or cold
-restore. Screenshots and raw JSON were local ignored artifacts, not portable
-verification evidence. The reusable recipe is `docs/testing/dor-tool-qc.md`.
-
+The `dor-tool-qc` run (from `4c7f9012`, on the real standalone sidecar, staged
+CLI, PTYs, and iframe proxy) exercised project approval, keyed reuse, serving,
+open-rule dispatch, and the built-in viewer's formats and failures. Two findings
+constrain later edits: at that baseline the Tools feature flag could reject
+creation and standalone `dor open` split, both since superseded by
+always-enabled Tools and eligible inline opening; and Chromium's native PDF
+plugin failed inside the normal iframe sandbox (see "Opening local files"). The
+run did not cover Tool transfer, native-window movement, native Tauri/VS Code
+rendering, Windows shells, or cold restore. The reusable recipe is
+`docs/testing/dor-tool-qc.md`.
 
 The September 2026 integration reuses Terminal Context for the Tool's primary terminal. The auxiliary helper's automatic refresh, Reset, and Promote semantics do not describe a serving command, whose Session also owns the browser and remote terminal identity. Sharing the presentation avoids introducing a second navigation mechanism or a second shell.
 
@@ -89,8 +63,7 @@ A CSS source preview escapes its contents, so its URLs cannot load assets. Scann
 
 Keeping the built-in viewer in the Tool's process tree reuses port discovery, kill, restart, and Workspace transfer. An OSC path carries the per-run URL capability without saving that secret in the restart command. Holding the selected file descriptors bounds what the server can read after launch; it trades automatic replacement-file refresh for a grant whose contents cannot widen through path replacement.
 
-
-The VS Code host supports Node 18, which lacks native glob matching. Bundled picomatch keeps association behavior the same across hosts. Patterns with separators test both the CWD-relative and canonical absolute path: files above the CWD otherwise start with `../` and can miss patterns intended to cover an absolute directory. Canonicalization also gives symlink aliases one matching identity.
+The VS Code host supports Node 18, which lacks native glob matching. Bundled picomatch keeps association behavior the same across hosts. Patterns with separators test both the CWD-relative and canonical absolute path: files above the CWD otherwise start with `../` and can miss patterns intended to cover an absolute directory. Canonicalization also gives symlink aliases one matching identity. Canonicalizing only the target mixed physical and logical paths under a symlinked CWD, so relative slash patterns missed files inside that directory. An absolute target can still be opened after its caller's CWD disappears; matching falls back to the supplied directory in that case.
 
 ## Take-over
 
@@ -115,7 +88,3 @@ A derived URL or browser daemon binding belongs to one execution. Reusing it aft
 Routing `dor tool` to a native editor on one host would change its result from a Surface handle to a host-specific side effect. Native file opening remains a separate operation.
 
 A Workspace transfer carries the live browser binding separately from its durable record. The arrival record can reach disk while the windows coordinate, whereas the content channel stays in memory; reusing the saved-record projection alone would reopen a Tool browser and lose its current page state. Pending approvals and unfinished browser startup still own asynchronous work in the source window, so the move waits for the user to resolve the approval or retry after startup.
-
-## Opening local files
-
-The VS Code host supports Node 18, which lacks native glob matching. Bundled picomatch keeps association behavior the same across hosts. Patterns with separators test both the CWD-relative and canonical absolute path: files above the CWD otherwise start with `../` and can miss patterns intended to cover an absolute directory. Canonicalization also gives symlink aliases one matching identity. Canonicalizing only the target mixed physical and logical paths under a symlinked CWD, so relative slash patterns missed files inside that directory. An absolute target can still be opened after its caller's CWD disappears; matching falls back to the supplied directory in that case.
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index e1700805b..ecb1dc76f 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -209,7 +209,7 @@ not a create: a Workspace that arrives mounts from the record it brought.
 plain iframe or serving iframe Tool's document cannot leave its webview, so it reopens at its
 saved URL, and a Workspace holding one — Doored ones included — asks with the
 Close's typed confirmation before it leaves; agent-browser Surfaces reconnect and ask
-nothing (`iframeSurfaceIds` on the Wall handle; `standalone/src/workspace-drag.test.ts`).
+nothing (`iframeSurfaceRefs` on the Wall handle; `standalone/src/workspace-drag.test.ts`).
 
 **Must show drag refusals over Window content in a dialog** until dismissal, retry, or Workspace departure. Source of truth: `onDropOnOtherWindow` in `standalone/src/workspace-drag.ts`; `lib/src/components/WorkspaceStrip.test.tsx`.
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 7443bbf16..90c5a2c28 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -454,9 +454,9 @@ Source of truth: `route` in `standalone/src-tauri/src/routing.rs`,
   broadcasting rang every sibling's AlertManager for a pane none of them shows.
   `Destroyed` SIGTERMs whatever the departing window still owned, which is what
   the close ack-timeout path never killed.
-- **A `dor` request naming a Surface no window owns is answered with an error**,
-  never handed to a sibling — acting on the wrong terminal is worse than failing
-  (`docs/specs/dor-cli.md` → Standalone).
+- **A `dor` request naming a Surface no window owns is answered with an error**
+  — `No Dormouse window owns surface '<id>'` — never handed to a sibling, since
+  acting on the wrong terminal is worse than failing.
 - **`pty_request_init`, `pty_graceful_kill` and `capture_agent_recovery` target
   the invoking window's own PTYs**, and take no ids at all: a window tearing down
   must not interrupt or kill a sibling's terminals, and a set it could name is a
diff --git a/dor/src/commands/list.ts b/dor/src/commands/list.ts
index 1335e965f..616f43a95 100644
--- a/dor/src/commands/list.ts
+++ b/dor/src/commands/list.ts
@@ -70,7 +70,7 @@ JSON output (--json) always includes both stable ids and refs, and each row carr
 
 --all lists every Workspace of this Window, grouped under a Workspace header — every Workspace keeps its header, including one holding nothing and one the filters emptied. Rows keep their own Workspace-scoped surface:N refs, so several groups have a surface:1, but only the active Workspace's selection carries the focus marker; each JSON row adds workspace_ref, and the payload adds a workspaces array plus caller_workspace_ref/focused_workspace_ref, because caller_surface_ref/focused_surface_ref then name a ref several groups share (the _id halves stay unique). Target a row from another Workspace by its stable id, or pass --workspace.
 
---workspaces prints the Workspace overview instead of any Surface: one row per Workspace with the active marker, its name, [ringing]/[todo] when any member Surface is, and [attention N] for the number owing it. It takes no other flag but --json.
+--workspaces prints the Workspace overview instead of any Surface: one row per Workspace with the active marker, its name, [ringing]/[todo] when any member Surface is, and [attention N] for the number owing it. It takes --json and --window, and no other flag.
 
 Text output:
   * surface:1  terminal  -              paned  ~/projects/site  pnpm dev  :5173
diff --git a/dor/src/commands/shared.ts b/dor/src/commands/shared.ts
index f978b42b9..d997fd625 100644
--- a/dor/src/commands/shared.ts
+++ b/dor/src/commands/shared.ts
@@ -53,7 +53,6 @@ export function isIdFormat(value: string): value is IdFormat {
 
 export function parseIdFormat(value: string): IdFormat {
   if (isIdFormat(value)) return value;
-  if (value === 'uuids') return 'ids';
   throw new SyntaxError(`invalid --id-format '${value}'`);
 }
 
@@ -170,7 +169,7 @@ export function msysToWindowsCwd(pwd: string, platform: string): string {
 // travel in the request. Prefer the shell's PWD (injectable, matches what the
 // user sees) and fall back to the process cwd. resolvePath canonicalizes both the
 // default and a relative/absolute path into one absolute path the host can key on.
-// Shared by `dor ensure --cwd` and `dor list --cwd`.
+// Shared by `ensure`, `list`, `tool`, `open`, and `skill`.
 export function callerWorkingDirectory(flag: string | undefined, env: CliEnv | undefined): string {
   const base = msysToWindowsCwd(env?.PWD ?? process.cwd(), process.platform);
   return resolvePath(base, flag ?? '.');
diff --git a/dor/src/protocol.ts b/dor/src/protocol.ts
index 1f43462de..a5f1d822a 100644
--- a/dor/src/protocol.ts
+++ b/dor/src/protocol.ts
@@ -97,21 +97,24 @@ export function spansWorkspaces(method: string, params?: Record<string, unknown>
 export interface ParsedWorkspaceRef {
   /** The target as written, trimmed — what an error message quotes back. */
   target: string;
-  /** 1-based strip position when the ref reads as a number, else null. */
-  position: number | null;
-  /** The Workspace name it reads as otherwise; empty when it is positional. */
+  /** The number the ref reads as, else null. What that number *means* is the
+   *  resolving host's business: a registry host matches it against the
+   *  Workspace's minted id, a host without one falls back to the strip
+   *  position. Named for the reading, not for either resolution. */
+  number: number | null;
+  /** The Workspace name it reads as otherwise; empty when it is numeric. */
   name: string;
 }
 
-const POSITIONAL_WORKSPACE_REF = /^[1-9]\d*$/;
+const NUMERIC_WORKSPACE_REF = /^[1-9]\d*$/;
 
 /** Split a `workspace:<n|name>` target into its readings. A ref that reads as a
- *  number is positional, never a name. */
+ *  number is a number, never a name. */
 export function parseWorkspaceRef(ref: string): ParsedWorkspaceRef {
   const target = ref.trim();
   const bare = (target.startsWith('workspace:') ? target.slice('workspace:'.length) : target).trim();
-  const positional = POSITIONAL_WORKSPACE_REF.test(bare);
-  return { target, position: positional ? Number(bare) : null, name: positional ? '' : bare };
+  const numeric = NUMERIC_WORKSPACE_REF.test(bare);
+  return { target, number: numeric ? Number(bare) : null, name: numeric ? '' : bare };
 }
 
 /** A control request as it travels over a transport, correlated by `requestId`. */
diff --git a/dor/test/cli-output.test.mjs b/dor/test/cli-output.test.mjs
index 6eb4e8b70..75625e2c3 100644
--- a/dor/test/cli-output.test.mjs
+++ b/dor/test/cli-output.test.mjs
@@ -1635,14 +1635,6 @@ test('list id-format ids output', async () => {
   );
 });
 
-test('list accepts uuids as an id-format compatibility alias', async () => {
-  const ids = await runCli(['list', '--id-format', 'ids'], { client: fixtureClient(), env: listEnv });
-  const uuids = await runCli(['list', '--id-format', 'uuids'], { client: fixtureClient(), env: listEnv });
-  assert.equal(uuids.stdout, ids.stdout);
-  assert.equal(uuids.stderr, '');
-  assert.equal(uuids.exitCode, 0);
-});
-
 test('list json schema includes ids and refs regardless of id-format', async () => {
   const result = await runCli(['list', '--json', '--id-format', 'ids'], { client: fixtureClient(), env: listEnv });
   assert.equal(result.exitCode, 0);
diff --git a/dor/test/snapshots/help/list.md b/dor/test/snapshots/help/list.md
index 7ad89f368..fc4aa5169 100644
--- a/dor/test/snapshots/help/list.md
+++ b/dor/test/snapshots/help/list.md
@@ -24,7 +24,7 @@ JSON output (--json) always includes both stable ids and refs, and each row carr
 
 --all lists every Workspace of this Window, grouped under a Workspace header — every Workspace keeps its header, including one holding nothing and one the filters emptied. Rows keep their own Workspace-scoped surface:N refs, so several groups have a surface:1, but only the active Workspace's selection carries the focus marker; each JSON row adds workspace_ref, and the payload adds a workspaces array plus caller_workspace_ref/focused_workspace_ref, because caller_surface_ref/focused_surface_ref then name a ref several groups share (the _id halves stay unique). Target a row from another Workspace by its stable id, or pass --workspace.
 
---workspaces prints the Workspace overview instead of any Surface: one row per Workspace with the active marker, its name, [ringing]/[todo] when any member Surface is, and [attention N] for the number owing it. It takes no other flag but --json.
+--workspaces prints the Workspace overview instead of any Surface: one row per Workspace with the active marker, its name, [ringing]/[todo] when any member Surface is, and [attention N] for the number owing it. It takes --json and --window, and no other flag.
 
 Text output:
   * surface:1  terminal  -              paned  ~/projects/site  pnpm dev  :5173
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index c2f77b940..d21ba0929 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -1588,7 +1588,7 @@ describe('Wall on the Lath engine', () => {
     const toolControl = vi.fn(async (request: { op: string }) => {
       if (request.op === 'trust') return { status: 'trust-recorded' };
       const common = { projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'viewer', run: ['view', '/repo/file.md'] };
-      if (calls++ === 0) return { ...common, status: 'untrusted', upstreamUrl: null };
+      if (calls++ === 0) return { ...common, status: 'untrusted', upstreamUrl: null, warnings: [] };
       if (calls === 2) return { status: 'error', message: 'The selected file is missing' };
       return { ...common, status: 'ok', render: 'iframe', port: 'auto', key: null, warnings: [] };
     });
@@ -1637,7 +1637,7 @@ describe('Wall on the Lath engine', () => {
         if (failure === 'throws') throw new Error('Permission storage is unavailable');
         return failure === 'missing' ? undefined : { status: 'error', message: 'Permission storage is unavailable' };
       }
-      return { status: 'untrusted', projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'viewer', run: 'view', upstreamUrl: 'https://example.com/repo.git' };
+      return { status: 'untrusted', projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'viewer', run: 'view', upstreamUrl: 'https://example.com/repo.git', warnings: [] };
     });
     Object.assign(fake, { toolControl });
     await act(async () => root.render(<Wall initialPaneIds={['pane-a']} />));
@@ -1665,7 +1665,7 @@ describe('Wall on the Lath engine', () => {
       if (request.op === 'trust') { trusted = true; return { status: 'trust-recorded' as const }; }
       const common = { projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'viewer', run: ['view', ...(request.args ?? [])] };
       return trusted ? { ...common, status: 'ok' as const, render: 'iframe' as const, port: 'auto' as const, key: request.args ?? [], warnings: [] }
-        : { ...common, status: 'untrusted' as const, upstreamUrl: null };
+        : { ...common, status: 'untrusted' as const, upstreamUrl: null, warnings: [] };
     });
     Object.assign(fake, { toolControl });
     await act(async () => root.render(<Wall initialPaneIds={['pane-a']} />));
@@ -1779,7 +1779,7 @@ describe('Wall on the Lath engine', () => {
       if (request.op === 'trust') { trusted = true; return { status: 'trust-recorded' as const }; }
       return trusted
         ? { ...config, status: 'ok' as const, render: 'iframe' as const, port: 'announced' as const, key: ['/repo'], warnings: [] }
-        : { ...config, status: 'untrusted' as const, upstreamUrl: null };
+        : { ...config, status: 'untrusted' as const, upstreamUrl: null, warnings: [] };
     });
     (fake as FakePtyAdapter & Pick<PlatformAdapter, 'toolControl'>).toolControl = toolControl;
     try {
@@ -1847,6 +1847,7 @@ describe('Wall on the Lath engine', () => {
     (fake as FakePtyAdapter & Pick<PlatformAdapter, 'toolControl'>).toolControl = vi.fn(async () => ({
       status: 'untrusted' as const, projectRoot: '/repo', path: '/repo/dormouse.yml',
       name: 'storybook', run: 'pnpm storybook', upstreamUrl: null,
+      warnings: [],
     }));
     const ring = () => container.querySelector('[data-ring="outline"]')?.closest('svg')?.parentElement;
     await act(async () => { root.render(<Wall initialPaneIds={['pane-a']} initialMode="command" />); });
@@ -1873,7 +1874,7 @@ describe('Wall on the Lath engine', () => {
   it.each(['', ' \t\n'])('shows a useful fallback for a blank grant failure (%j)', async message => {
     const toolControl = vi.fn(async (request: { op: string }) => request.op === 'trust'
       ? { status: 'error', message }
-      : { status: 'untrusted', projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'storybook', run: 'pnpm storybook', upstreamUrl: null });
+      : { status: 'untrusted', projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'storybook', run: 'pnpm storybook', upstreamUrl: null, warnings: [] });
     Object.assign(fake, { toolControl });
     await act(async () => root.render(<Wall initialPaneIds={['pane-a']} />));
     await flush();
@@ -1890,7 +1891,7 @@ describe('Wall on the Lath engine', () => {
   });
 
   it.each(['read error', 'unknown tool'])('retains a failed post-grant lookup with retry and quiet stale completion (%s)', async failure => {
-    const untrusted = { status: 'untrusted', projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'storybook', run: 'pnpm storybook', upstreamUrl: null };
+    const untrusted = { status: 'untrusted', projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'storybook', run: 'pnpm storybook', upstreamUrl: null, warnings: [] };
     const failed = failure === 'read error'
     ? { status: 'error', message: 'configuration temporarily unreadable' }
     : { status: 'unknown-tool', projectRoot: '/repo', path: '/repo/dormouse.yml', names: [] };
@@ -1960,6 +1961,7 @@ describe('Wall on the Lath engine', () => {
           name: 'storybook',
           run: 'pnpm storybook',
           upstreamUrl: null,
+          warnings: [],
         });
       }
       return resolvedGate.promise;
@@ -2091,6 +2093,7 @@ describe('Wall on the Lath engine', () => {
           name: 'storybook',
           run: 'pnpm storybook',
           upstreamUrl: null,
+          warnings: [],
         };
       }
       return okToolLookup(null);
@@ -2149,6 +2152,7 @@ describe('Wall on the Lath engine', () => {
       name: 'storybook',
       run: 'pnpm storybook',
       upstreamUrl: null,
+      warnings: [],
     }));
 
     await act(async () => {
@@ -2196,6 +2200,7 @@ describe('Wall on the Lath engine', () => {
       name: 'storybook',
       run: 'pnpm storybook',
       upstreamUrl: null,
+      warnings: [],
     }));
 
     await act(async () => {
@@ -2305,6 +2310,9 @@ describe('Wall on the Lath engine', () => {
   it('reports a reused minimized tool as visible after reattaching it', async () => {
     const toolId = 'tool-door';
     terminalRegistry.applyTerminalSemanticEvents(toolId, [
+      // The match runs in its own directory, not the caller's: the response has
+      // to name that one (docs/specs/dor-tool.md -> Identity and dedupe).
+      { type: 'cwd', cwd: terminalRegistry.cwdFromOsc633('/repo/packages/ui')! },
       { type: 'commandLine', commandLine: 'pnpm storybook' },
       { type: 'commandStart' },
     ]);
@@ -2337,7 +2345,7 @@ describe('Wall on the Lath engine', () => {
       await flush();
       expect(container.querySelector(`[data-door-id="${toolId}"]`)).not.toBeNull();
 
-      let response: { ok: boolean; result?: { status: string; surfaceId: string; minimized: boolean } } | undefined;
+      let response: { ok: boolean; result?: { status: string; surfaceId: string; minimized: boolean; cwd: string } } | undefined;
       await act(async () => {
         window.dispatchEvent(new CustomEvent('dormouse:control-request', {
           detail: {
@@ -2351,7 +2359,7 @@ describe('Wall on the Lath engine', () => {
 
       expect(response).toMatchObject({
         ok: true,
-        result: { status: 'existing', surfaceId: toolId, minimized: false },
+        result: { status: 'existing', surfaceId: toolId, minimized: false, cwd: '/repo/packages/ui' },
       });
       expect(container.querySelector(`[data-door-id="${toolId}"]`)).toBeNull();
       expect(container.querySelector(`[data-lath-leaf="${toolId}"]`)).not.toBeNull();
@@ -2725,6 +2733,7 @@ describe('Wall on the Lath engine', () => {
       name: 'storybook',
       run: 'pnpm storybook',
       upstreamUrl: null,
+      warnings: [],
     }));
     (fake as FakePtyAdapter & Pick<PlatformAdapter, 'toolControl'>).toolControl = toolControl;
 
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index d54b20f9e..8550ed0a9 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1008,14 +1008,15 @@ export function Wall({
     [lath],
   );
 
-  /** The members whose live document a move between Windows cannot carry. */
-  const iframeSurfaceIds = useCallback(
+  /** The members whose live document a move between Windows cannot carry, by
+   *  the ref a `dor` caller can act on. */
+  const iframeSurfaceRefs = useCallback(
     (): string[] => memberSurfaceIds().filter((id) => {
       const params = lath.getMeta(id)?.params;
       return (isBrowserParams(params) || (isToolParams(params) && browserUrlFromParams(params) !== null))
         && resolveRenderMode(params) === 'iframe';
-    }),
-    [lath, memberSurfaceIds],
+    }).map(surfaceRefForId),
+    [lath, memberSurfaceIds, surfaceRefForId],
   );
 
   /** Whether a member Surface has a PTY behind it, as against a browser view. */
@@ -1697,6 +1698,8 @@ export function Wall({
         // withholds `render` / `port` / `key` — they live only in the `ok` arm — so
         // asking again is what gives an approved tool the config its dormouse.yml
         // declared, rather than silently running it as a keyless default iframe.
+        // `resolved.warnings` is not re-reported: the untrusted answer carried
+        // the same set to the `dor` that asked, and that process has exited.
         const cwd = typeof meta?.params?.cwd === 'string' ? meta.params.cwd : pending.projectRoot;
         const resolved = await platform.toolControl?.({ op: 'lookup', name: pending.name, cwd, args: pending.args });
         if (resolved?.status !== 'ok') {
@@ -1779,7 +1782,7 @@ export function Wall({
   const methods: Omit<WallHandle, 'workspaceId'> = {
     surfaceIds: memberSurfaceIds,
     ownsSurface,
-    iframeSurfaceIds,
+    iframeSurfaceRefs,
     hasTouchedSurfaces: () => memberSurfaceIds().some((id) => {
       // A browser Surface has no "untouched" notion and always holds a page, so
       // it counts; so does a Tool, before its terminal exists to be asked. A
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index 91bbac858..b777ab1e1 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -700,7 +700,7 @@ it.each([
 });
 
 it('routes Tools to the requested Workspace and never launches after lookup races closure', async () => {
-  const lookup = { status: 'untrusted' as const, projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'storybook', run: 'pnpm storybook', upstreamUrl: null };
+  const lookup = { status: 'untrusted' as const, projectRoot: '/repo', path: '/repo/dormouse.yml', name: 'storybook', run: 'pnpm storybook', upstreamUrl: null, warnings: [] };
   const gate = Promise.withResolvers<typeof lookup>();
   const toolControl = vi.fn().mockResolvedValueOnce(lookup).mockImplementationOnce(() => gate.promise);
   Object.assign(fake, { toolControl });
diff --git a/lib/src/components/wall/AgentBrowserPanel.tsx b/lib/src/components/wall/AgentBrowserPanel.tsx
index a89630636..d8ecf3d38 100644
--- a/lib/src/components/wall/AgentBrowserPanel.tsx
+++ b/lib/src/components/wall/AgentBrowserPanel.tsx
@@ -3,7 +3,6 @@
 import { useCallback, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';
 import { clsx } from 'clsx';
 import { TERMINAL_BOTTOM_RADIUS_CLASS } from '../design';
-import { getPlatform } from '../../lib/platform';
 import { isEditableTarget } from '../../lib/dom';
 import type { RenderMode } from './agent-browser-screen';
 import { tabDisplayTitle } from './browser-url';
@@ -393,23 +392,10 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
           // Popped out to a headed OS window — the pane is a clean stub. While
           // the window is still being opened (a relaunch in flight, or an eager
           // swap whose daemon has not yet named its session) there is nothing to
-          // bring to front or pop back in, so the affordances wait with it.
+          // pop back in, so the affordance waits with it.
           <div className="flex flex-col items-center gap-3 px-4 text-center text-sm text-muted">
             <div>{!session || relaunching ? 'Opening the browser window…' : 'This browser is running in a separate window.'}</div>
             {session && !relaunching && <div className="flex gap-2 text-xs">
-              {getPlatform().agentBrowserBringToFront && (
-                <button
-                  type="button"
-                  onMouseDown={(e) => e.stopPropagation()}
-                  onClick={(e) => {
-                    e.stopPropagation();
-                    controller.bringToFront();
-                  }}
-                  className="rounded border border-border px-2.5 py-1 text-muted transition-colors hover:border-foreground hover:text-foreground"
-                >
-                  Bring to front
-                </button>
-              )}
               <button
                 type="button"
                 onMouseDown={(e) => e.stopPropagation()}
diff --git a/lib/src/components/wall/BrowserPanel.tsx b/lib/src/components/wall/BrowserPanel.tsx
index 353dd8529..957d93056 100644
--- a/lib/src/components/wall/BrowserPanel.tsx
+++ b/lib/src/components/wall/BrowserPanel.tsx
@@ -28,6 +28,12 @@ export type BrowserPanelParams = {
   wsPort?: number;
   binaryPath?: string;
   syncEngaged?: boolean;
+  /** Set only on a Surface the pane context menu opened for a port, as
+   *  `<sourceSurfaceId>:<port>:<iframe|agent>`. Reuse looks a Surface up by it,
+   *  so a second "open this port" reveals the pane the first one made rather
+   *  than stacking another (`docs/specs/dor-browser.md` → Pane Context Menu
+   *  Connect). */
+  contextPortKey?: string;
 };
 
 export function BrowserPanel(props: PaneProps & { renderNotepad?: boolean }) {
diff --git a/lib/src/components/wall/agent-browser-surface-controller.ts b/lib/src/components/wall/agent-browser-surface-controller.ts
index 97c20403e..8ae1aa40d 100644
--- a/lib/src/components/wall/agent-browser-surface-controller.ts
+++ b/lib/src/components/wall/agent-browser-surface-controller.ts
@@ -45,10 +45,10 @@ export const HIDDEN_PARK_DELAY_MS = 1000;
 export const PROVISIONAL_INPUT_WINDOW_MS = 250;
 
 // The high-rate `[ab-panel]` stream/screenshot diagnostics fire per frame
-// (~20Hz), so the flag is read ONCE at module load and cached: toggling needs a
-// reload, which is the right trade for a hot loop. The connection's always-on
-// debug ring is unaffected. `localStorage.setItem('dormouse.flags.abDebugLogs',
-// 'true')` + reload to enable.
+// (~20Hz), so the flag is read ONCE — lazily, on the first log — and memoized:
+// toggling needs a reload, which is the right trade for a hot loop. The
+// connection's always-on debug ring is unaffected.
+// `localStorage.setItem('dormouse.flags.abDebugLogs', 'true')` + reload to enable.
 let abDebugLogsEnabled: boolean | undefined;
 function abDebugLog(message: string): void {
   if (abDebugLogsEnabled === undefined) abDebugLogsEnabled = isAbDebugLogsEnabled();
@@ -804,6 +804,9 @@ export class AgentBrowserSurfaceController {
     } catch {
       return;
     }
+    // Latest-only, like the crisp loop: a newer pulse arriving while this decode
+    // is in flight bumps the sequence, and the stale bitmap is dropped rather
+    // than painted over the newer frame.
     const mySeq = ++this.frameDrawSeq;
     createImageBitmap(new Blob([bytes], { type: 'image/jpeg' })).then((bitmap) => {
       if (this.disposed || mySeq !== this.frameDrawSeq || this.sink !== sink) {
@@ -1367,12 +1370,6 @@ export class AgentBrowserSurfaceController {
     });
   }
 
-  bringToFront(): void {
-    const session = this.session;
-    if (!session) return;
-    getPlatform().agentBrowserBringToFront?.(session, this.binaryPath)?.catch(() => {});
-  }
-
   // Auto-revert: once the headed stream has connected, a later disconnect means
   // the window closed → relaunch headless and resume streaming. But a disconnect
   // also happens when Dormouse itself closes the session (pane kill, or a
@@ -1472,11 +1469,12 @@ export class AgentBrowserSurfaceController {
       });
       return;
     }
-    // macOS native editing chords (select-all/copy/cut) don't fire over the
-    // stream input path (CDP commands field is dropped). Route the intent
-    // through the host's purpose-built edit channel instead. If the host lacks
-    // it (e.g. standalone), fall through so the page still gets the chord for
-    // its own JS shortcuts.
+    // Native editing chords (select-all/copy/cut) don't fire over the stream
+    // input path (CDP commands field is dropped), on any platform — Cmd on
+    // macOS, Ctrl elsewhere. Route the intent through the host's purpose-built
+    // edit channel instead. Every shipped host implements `agentBrowserEdit`;
+    // the fall-through covers a host that does not (the fake adapter), so the
+    // page still gets the chord for its own JS shortcuts.
     if (mod && !e.altKey && !e.shiftKey) {
       const op = EDIT_OPS[e.key.toLowerCase() as keyof typeof EDIT_OPS];
       // Call through the adapter instance — detaching the method drops `this`.
diff --git a/lib/src/components/wall/use-dor-control.ts b/lib/src/components/wall/use-dor-control.ts
index d042b440b..fef341adb 100644
--- a/lib/src/components/wall/use-dor-control.ts
+++ b/lib/src/components/wall/use-dor-control.ts
@@ -988,6 +988,10 @@ export function useDorControl({
               return;
             case 'untrusted': {
               const pendingCommand = toolRunCommand(lookup.run);
+              // The config lint runs before the trust gate, and the `pending`
+              // answer below is the only one the first run of a tool ever sees
+              // — the approval that follows has no `dor` left to answer to.
+              warnings = lookup.warnings;
               if (refuseCmdShell()) return;
               // The pane appears now and asks; the command spawns only on
               // approval (docs/specs/dor-tool.md -> Trust). Nothing from the
@@ -1166,7 +1170,9 @@ export function useDorControl({
             respondTool(idle ? 'adopted' : 'existing', {
               surfaceId: match.id,
               command: matchedCommand,
-              cwd,
+              // The match's own directory, not the caller's: an `adopted`
+              // restart ran there, and an `existing` match is running there.
+              cwd: matchedCwd,
               minimized: !revealed,
             });
             return;
diff --git a/lib/src/components/wall/wall-handles.ts b/lib/src/components/wall/wall-handles.ts
index ac8cc139d..119938000 100644
--- a/lib/src/components/wall/wall-handles.ts
+++ b/lib/src/components/wall/wall-handles.ts
@@ -16,11 +16,13 @@ export interface WallHandle {
   /** The Wall's member Surfaces: visible panes ∪ Doors. */
   surfaceIds(): string[];
   ownsSurface(id: string): boolean;
-  /** Member Surfaces rendered as plain iframes, Doored ones included: the page
-   *  state a move between Windows destroys (`docs/specs/layout.md` →
-   *  Workspaces). Agent-browser Surfaces are not among them — their session
-   *  lives in the host and reconnects. */
-  iframeSurfaceIds(): string[];
+  /** Member Surfaces rendered as plain iframes, Doored ones included, as their
+   *  Workspace-stable `surface:N` refs: the page state a move between Windows
+   *  destroys (`docs/specs/layout.md` → Workspaces). Refs, not internal ids,
+   *  because the refusal naming them is read by a `dor` caller. Agent-browser
+   *  Surfaces are not among them — their session lives in the host and
+   *  reconnects. */
+  iframeSurfaceRefs(): string[];
   /** Any member terminal Session the user has typed into (the close confirmation
    *  gate, alongside `runningCount`). */
   hasTouchedSurfaces(): boolean;
@@ -89,7 +91,7 @@ export function stubWallHandle(workspaceId: WorkspaceId, overrides: Partial<Wall
     workspaceId,
     surfaceIds: () => [],
     ownsSurface: () => false,
-    iframeSurfaceIds: () => [],
+    iframeSurfaceRefs: () => [],
     hasTouchedSurfaces: () => false,
     runningCount: () => 0,
     enterSelectedPane: () => {},
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index 50f2fca74..325a70b4d 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -162,13 +162,13 @@ describe('workspace.move', () => {
   it('refuses to move a Workspace holding iframes unless told to destroy their page state', async () => {
     const second = createWorkspace({ id: 'workspace-7', name: 'build', activate: false }).id;
     handleFor(getWorkspacesSnapshot().workspaces[0].id);
-    handleFor(second, { iframeSurfaceIds: () => ['browser-1'] });
+    handleFor(second, { iframeSurfaceRefs: () => ['surface:4'] });
     const transferWorkspace = vi.fn(async () => {});
     setPlatform({ transferWorkspace } as unknown as PlatformAdapter);
 
     const refused = request('workspace.move', { workspace: 'workspace:7', toWindow: 'window:ws-2' });
     await handleWorkspaceControl(refused);
-    expect(answer(refused)).toMatch(/1 iframe Surface\(s\).*surface:browser-1.*--dangerously-destroy-iframe-page-state/);
+    expect(answer(refused)).toMatch(/1 iframe Surface\(s\).*surface:4.*--dangerously-destroy-iframe-page-state/);
     expect(transferWorkspace).not.toHaveBeenCalled();
 
     const forced = request('workspace.move', {
diff --git a/lib/src/components/wall/workspace-control.ts b/lib/src/components/wall/workspace-control.ts
index e2ffb124d..33954dab2 100644
--- a/lib/src/components/wall/workspace-control.ts
+++ b/lib/src/components/wall/workspace-control.ts
@@ -249,9 +249,9 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
         // The one thing a move between Windows cannot carry is a plain
         // iframe's document: it reopens at its saved URL, its page state gone
         // (`docs/specs/layout.md` → Workspaces). The caller says so explicitly.
-        const iframes = handle.iframeSurfaceIds();
+        const iframes = handle.iframeSurfaceRefs();
         if (iframes.length > 0 && params.dangerouslyDestroyIframePageState !== true) {
-          const refs = iframes.map((id) => `surface:${id}`).join(', ');
+          const refs = iframes.join(', ');
           detail.respond({
             ok: false,
             error: `workspace '${target.ref}' holds ${iframes.length} iframe Surface(s) whose page state a move destroys (${refs}); `
diff --git a/lib/src/host/iframe-proxy-rewrite.ts b/lib/src/host/iframe-proxy-rewrite.ts
index 3a2ddf5f8..5c82a1641 100644
--- a/lib/src/host/iframe-proxy-rewrite.ts
+++ b/lib/src/host/iframe-proxy-rewrite.ts
@@ -101,8 +101,9 @@ export function frameAncestorsCsp(embedderOrigins: string[]): string {
 //   - `location`: the proxied frame's current URL. The parent converts it back
 //     to the upstream URL and uses it to keep iframe Back/Forward/Reload chrome
 //     honest.
-//   - `open-window`: a `target=_blank` anchor or `window.open` the single-frame
-//     renderer can't honor; the parent offers it as a new pane instead.
+//   - `open-window`: an anchor with any target but `_self` (`_blank`, `_top`,
+//     `_parent`, a named frame) or a `window.open` the single-frame renderer
+//     can't honor; the parent offers it as a new pane instead.
 export function iframeShim(embedderOrigin: string): string {
   return `(function(){
   var P=window.parent;
diff --git a/lib/src/host/tool-open.test.ts b/lib/src/host/tool-open.test.ts
index 9f6eb40b5..0c2dfb9c8 100644
--- a/lib/src/host/tool-open.test.ts
+++ b/lib/src/host/tool-open.test.ts
@@ -132,3 +132,17 @@ it('still matches an absolute target when the working directory no longer exists
     status: 'ok', name: 'markdown', run: ['markdown', target],
   });
 });
+
+it('reports the user file warnings on the built-in viewer path too', async () => {
+  // Nothing in the user file runs for a built-in open, but the file was still
+  // parsed to decide that — its lint belongs to the user either way
+  // (`docs/specs/dor-tool.md` -> Opening local files).
+  await writeConfig(`tools:
+  viewer:
+    run: [view, $TARGET]
+    nonsense: 1
+`);
+  const result = await host().handle({ op: 'open', target: join(root, 'docs', 'README.md'), cwd: root });
+  expect(result).toMatchObject({ status: 'ok', scope: 'builtin' });
+  expect(result.status === 'ok' && result.warnings).toEqual([expect.stringContaining('nonsense')]);
+});
diff --git a/lib/src/host/tool-open.ts b/lib/src/host/tool-open.ts
index 95f5425ab..e2a446a1e 100644
--- a/lib/src/host/tool-open.ts
+++ b/lib/src/host/tool-open.ts
@@ -23,8 +23,11 @@ export async function resolveOpenTool(
   })?.tool;
   const entry = name && file?.tools.get(name);
   if ((!name || name === BUILTIN_FILE_TOOL) && fileViewerFormat(target)) {
+    // The built-in viewer runs no user entry, but the user file was still
+    // parsed to get here — its lint warnings are the user's to see.
     return { status: 'ok', projectRoot: request.cwd, path: '<built-in>', name: 'file', scope: 'builtin',
-      run: ['dor', VIEW_FILE_ARGV, target], key: [target], render: 'iframe', port: 'announced', warnings: [] };
+      run: ['dor', VIEW_FILE_ARGV, target], key: [target], render: 'iframe', port: 'announced',
+      warnings: file ? [...file.warnings] : [] };
   }
   if (name === BUILTIN_FILE_TOOL) return { status: 'error',
     message: `the built-in viewer does not support '${basename(target)}'; add an open rule to ${path} naming a user Tool` };
diff --git a/lib/src/host/tool-trust.test.ts b/lib/src/host/tool-trust.test.ts
index bf93f4ff3..eea9b577e 100644
--- a/lib/src/host/tool-trust.test.ts
+++ b/lib/src/host/tool-trust.test.ts
@@ -208,6 +208,29 @@ describe('lookupTool', () => {
       });
   });
 
+  it('carries the same config warnings whether or not the repo is trusted', async () => {
+    // The config lint runs before the trust gate, so the first (untrusted) run
+    // is the one that has to report it — the `ok` arm is a later run's answer
+    // (`docs/specs/dor-tool.md` -> Declaring tools).
+    await write(`
+tools:
+  storybook:
+    run: pnpm storybook
+    nonsense: 1
+    prespawn_dedupe: [storybook]
+`);
+    const untrusted = await lookupTool('storybook', root, new MemoryToolTrustStore(), { resolveUpstream: noUpstream });
+    const trust = new MemoryToolTrustStore();
+    await trust.grant(folderGrantKey(root), 'folder');
+    const ok = await lookupTool('storybook', root, trust, { resolveUpstream: noUpstream });
+
+    expect(untrusted.status).toBe('untrusted');
+    expect(ok.status).toBe('ok');
+    const warnings = ok.status === 'ok' ? [...ok.file.warnings] : [];
+    expect(warnings.length).toBeGreaterThan(0);
+    expect(untrusted.status === 'untrusted' && untrusted.warnings).toEqual(warnings);
+  });
+
   it('offers the upstream when git resolves one', async () => {
     await write();
     const upstream = async () => 'https://github.com/diffplug/dormouse';
diff --git a/lib/src/host/tool-trust.ts b/lib/src/host/tool-trust.ts
index 9c795adc1..a54a4bce3 100644
--- a/lib/src/host/tool-trust.ts
+++ b/lib/src/host/tool-trust.ts
@@ -237,6 +237,9 @@ export type ToolLookup =
       /** Canonical upstream URL, or null when there is no resolvable remote —
        *  the approval UI then offers only the folder grant. */
       upstreamUrl: string | null;
+      /** The parsed file's lint warnings, the same set the `ok` arm carries:
+       *  the untrusted answer is the one the first run of a tool sees. */
+      warnings: string[];
     }
   | { status: 'error'; message: string }
   | { status: 'ok'; projectRoot: string; path: string; file: ToolFile; entry: ToolEntry; input: ToolInput };
@@ -314,5 +317,6 @@ export async function lookupTool(
     name: entry.name,
     run: input.run,
     upstreamUrl,
+    warnings: [...file.warnings],
   };
 }
diff --git a/lib/src/lib/platform/tool-types.ts b/lib/src/lib/platform/tool-types.ts
index e60767616..75b39155b 100644
--- a/lib/src/lib/platform/tool-types.ts
+++ b/lib/src/lib/platform/tool-types.ts
@@ -18,7 +18,12 @@ export type ToolKeyScope = 'user' | 'builtin';
 export const isToolKeyScope = (value: unknown): value is ToolKeyScope => value === 'user' || value === 'builtin';
 
 /** Result of resolving a tool name. `ok` carries the rendered dedupe key: the
- *  host owns `$PROJECT_ROOT`, so the webview never sees a template. */
+ *  host owns `$PROJECT_ROOT`, so the webview never sees a template.
+ *
+ *  Every outcome that parsed a configuration file carries that file's
+ *  `warnings`, so a config lint reaches the caller on the path it hits first —
+ *  an untrusted repo's `pending` answer — and not only on a later already-
+ *  trusted run (`docs/specs/dor-tool.md` -> Declaring tools). */
 export type ToolLookupResult =
   | { status: 'no-file' }
   | { status: 'unknown-tool'; projectRoot: string; path: string; names: string[] }
@@ -30,6 +35,7 @@ export type ToolLookupResult =
       run: string | readonly string[];
       /** Canonical upstream URL, or null when there is no resolvable remote. */
       upstreamUrl: string | null;
+      warnings: string[];
     }
   | { status: 'error'; message: string }
   | {
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index eb9d9d1c2..c19a935fc 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -417,8 +417,6 @@ export interface PlatformAdapter {
   // Relaunch headless (pop back in) reopening `url`, resuming the screencast;
   // returns the new stream port. Pairs with agentBrowserPopOut.
   agentBrowserPopIn?(session: string, opts: { url?: string }, binaryPath?: string): Promise<AgentBrowserPopResult>;
-  // Best-effort raise the session's headed window to the front.
-  agentBrowserBringToFront?(session: string, binaryPath?: string): Promise<void>;
 
   // PTY event listeners
   onPtyData(handler: (detail: PtyDataDetail) => void): void;
diff --git a/lib/src/lib/tool-announce.test.ts b/lib/src/lib/tool-announce.test.ts
index 3f1952325..236b9016a 100644
--- a/lib/src/lib/tool-announce.test.ts
+++ b/lib/src/lib/tool-announce.test.ts
@@ -40,6 +40,16 @@ describe('parseToolAnnounce', () => {
     expect(parseToolAnnounce('progress;{"v":1}')).toBeNull();
   });
 
+  it('refuses a serve payload naming a version it does not speak', () => {
+    // A v2 `serve` may reuse a field name for something else, so it is dropped
+    // whole rather than read as v1. An omitted `v` is the shipped v1 shape.
+    expect(parseToolAnnounce(serve({ port: 6006, v: 1 }))?.port).toBe(6006);
+    expect(parseToolAnnounce(serve({ port: 6006 }))?.port).toBe(6006);
+    for (const v of [2, 0, '1', null]) {
+      expect(parseToolAnnounce(serve({ port: 6006, v }))).toBeNull();
+    }
+  });
+
   it('never throws on malformed output', () => {
     expect(parseToolAnnounce('serve;not json')).toBeNull();
     expect(parseToolAnnounce('serve;[1,2]')).toBeNull();
diff --git a/lib/src/lib/tool-announce.ts b/lib/src/lib/tool-announce.ts
index 27fff101d..0a21daadf 100644
--- a/lib/src/lib/tool-announce.ts
+++ b/lib/src/lib/tool-announce.ts
@@ -80,6 +80,11 @@ export function parseToolPayload(content: string, verb: string): Record<string,
 export function parseToolAnnounce(content: string): ToolAnnounce | null {
   const record = parseToolPayload(content, 'serve');
   if (!record) return null;
+  // A payload that names a version this parser does not speak is refused whole
+  // rather than half-honored: a v2 `serve` may reuse a field name for something
+  // else. `v` is optional — an omitted one is v1, the shipped shape — but a
+  // stated one must be 1 (`docs/specs/dor-tool.md` -> OSC 367).
+  if (record.v !== undefined && record.v !== 1) return null;
 
   const announce: ToolAnnounce = {
     port: readPort(record.port),
diff --git a/lib/src/lib/workspace-store.ts b/lib/src/lib/workspace-store.ts
index f4913140a..64d42f721 100644
--- a/lib/src/lib/workspace-store.ts
+++ b/lib/src/lib/workspace-store.ts
@@ -284,15 +284,28 @@ export type WorkspaceRefResolution =
   | ({ ok: true } & ResolvedWorkspace)
   | { ok: false; message: string };
 
+/**
+ * The Workspace a numeric `workspace:<n>` names. On a registry host the number
+ * is the Workspace's own minted id, stable across reorders and moves between
+ * Windows — the documented behavior. The 1-based strip-position reading is the
+ * fallback for the one host with no registry, VS Code, where each Workspace is a
+ * separate webview and there is no application-wide numbering to be stable
+ * against; the branch disappears if VS Code ever gets one
+ * (`docs/specs/dor-cli.md` → "Handle Model").
+ */
+function workspaceByNumber(number: number): WorkspaceMeta | undefined {
+  return refsArePositional()
+    ? state.workspaces[number - 1]
+    : state.workspaces.find((ws) => workspaceRefNumber(ws.id) === number);
+}
+
 /** Resolve the host's canonical ref first, then an unambiguous name. */
 export function resolveWorkspaceRef(ref: string): WorkspaceRefResolution {
-  const { target, position, name } = parseWorkspaceRef(ref);
+  const { target, number, name } = parseWorkspaceRef(ref);
   const found = (meta: WorkspaceMeta): WorkspaceRefResolution =>
     ({ ok: true, ...meta, ref: workspaceRefFor(meta.id) });
-  if (position !== null) {
-    const match = refsArePositional()
-      ? state.workspaces[position - 1]
-      : state.workspaces.find((ws) => workspaceRefNumber(ws.id) === position);
+  if (number !== null) {
+    const match = workspaceByNumber(number);
     if (match) return found(match);
   } else if (name) {
     const byId = registryInstalled && state.workspaces.find((ws) => ws.id === name);
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 54ddcd7f9..a755bb00c 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -5,8 +5,8 @@
   "docs/specs/alert.md": 7250,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
-  "docs/specs/dor-browser.md": 4700,
-  "docs/specs/dor-cli.md": 6250,
+  "docs/specs/dor-browser.md": 4550,
+  "docs/specs/dor-cli.md": 5550,
   "docs/specs/dor-tool.md": 4050,
   "docs/specs/glossary.md": 2950,
   "docs/specs/hosted.md": 1050,
diff --git a/standalone/src/workspace-drag.test.ts b/standalone/src/workspace-drag.test.ts
index 57c162b71..76b80aa3d 100644
--- a/standalone/src/workspace-drag.test.ts
+++ b/standalone/src/workspace-drag.test.ts
@@ -188,7 +188,7 @@ describe("releasing the drag", () => {
   it("asks first when the Workspace holds an iframe, and moves only on the typed letter", async () => {
     resetWallHandles();
     resetWorkspaceUi();
-    registerWallHandle(stubWallHandle("ws-1", { iframeSurfaceIds: () => ["browser-1", "browser-2"] }));
+    registerWallHandle(stubWallHandle("ws-1", { iframeSurfaceRefs: () => ["browser-1", "browser-2"] }));
     hit = { label: "ws-2", x: 120, y: 9 };
     onDropOnOtherWindow("ws-1", { clientX: 900, clientY: 9 }, false);
     await settle();
@@ -205,7 +205,7 @@ describe("releasing the drag", () => {
 
   it("does not ask for a Workspace of terminals and agent-browser Surfaces", async () => {
     resetWallHandles();
-    registerWallHandle(stubWallHandle("ws-1", { iframeSurfaceIds: () => [] }));
+    registerWallHandle(stubWallHandle("ws-1", { iframeSurfaceRefs: () => [] }));
     hit = null;
     onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
     await settle();
diff --git a/standalone/src/workspace-drag.ts b/standalone/src/workspace-drag.ts
index 8c44a4c4d..65b04e831 100644
--- a/standalone/src/workspace-drag.ts
+++ b/standalone/src/workspace-drag.ts
@@ -179,7 +179,7 @@ export function onDropOnOtherWindow(
     // The one thing a move cannot carry is a plain iframe's document, Doored
     // ones included; it reopens at its saved URL. The user says so first, with
     // the same typed letter a kill takes (docs/specs/layout.md → Workspaces).
-    const iframes = getWallHandle(id)?.iframeSurfaceIds() ?? [];
+    const iframes = getWallHandle(id)?.iframeSurfaceRefs() ?? [];
     if (iframes.length > 0) {
       setPendingWorkspaceMove({ id, char: randomKillChar(), iframeCount: iframes.length, proceed: move });
       return;
diff --git a/vscode-ext/src/dor-workspace-guard.ts b/vscode-ext/src/dor-workspace-guard.ts
index d39553ebc..fd0c76766 100644
--- a/vscode-ext/src/dor-workspace-guard.ts
+++ b/vscode-ext/src/dor-workspace-guard.ts
@@ -21,8 +21,8 @@ const REFUSAL = 'Dormouse in VS Code puts each Workspace in its own webview, so'
  */
 function namesThisWebviewsWorkspace(workspace: unknown): boolean {
   if (typeof workspace !== 'string') return false;
-  const { position, name } = parseWorkspaceRef(workspace);
-  return position === 1 || name === DEFAULT_WORKSPACE_NAME;
+  const { number, name } = parseWorkspaceRef(workspace);
+  return number === 1 || name === DEFAULT_WORKSPACE_NAME;
 }
 
 /**