diff --git a/docs/specs/dor-browser.md b/docs/specs/dor-browser.md
index 8a433713a..ef0733b96 100644
--- a/docs/specs/dor-browser.md
+++ b/docs/specs/dor-browser.md
@@ -42,9 +42,14 @@ Invariants on the flat persisted `BrowserPanelParams`:
   Agent-browser mirrors the newest http(s) active tab URL into it — the host
   relaunches at nothing else; iframe persists only navigations initiated by
   Dormouse chrome.
-- **Must keep automation state flat** (`session`, `wsPort`, `binaryPath`,
-  `syncEngaged`, `key`, plus Playwright `cwd`/`nativeIdentity`), never nested. Pop-out is not a param — it derives from
-  `renderMode` once, at controller construction.
+- **Must keep automation state flat** (`session`, `launchSession`,
+  `launchFallback`, `binaryPath`, `syncEngaged`, `key`, plus Playwright
+  `cwd`/`nativeIdentity`), never nested but for a `launchFallback` restore's
+  params. Pop-out is not a param — it derives from `renderMode`
+  once, at controller construction.
+- **Never carry a stream port in params**: the port `dor ab` reads, or the one
+  the Playwright host's `attach` answers for `dor pw`, goes straight to the
+  Surface's controller (rationale).
 - **`contextPortKey` is declared and persisted like any other param.** Only a
   Surface the pane context menu opened for a port carries it, and reuse looks
   one up by it ([Pane Context Menu Connect](#pane-context-menu-connect)).
@@ -58,7 +63,7 @@ Invariants on the flat persisted `BrowserPanelParams`:
 
 Source of truth: `lib/src/components/wall/BrowserPanel.tsx` (`BrowserPanelParams`), `lib/src/components/wall/browser-surface.ts`,
 `lib/src/components/Wall.tsx` (`replaceSurface`), `lib/src/components/wall/agent-browser-surface-controller.ts`
-(`rememberRestorableUrl`), `lib/src/components/wall/IframePanel.tsx` (`applyFrameUrl`).
+(`rememberRestorableUrl`, `handOverBrowserPort`), `lib/src/components/wall/IframePanel.tsx` (`applyFrameUrl`).
 
 ## Placement And Lifetime
 
@@ -77,20 +82,21 @@ Surface lifetime owns backing resources:
 - **Must retain the mounted DOM when minimizing.** Agent-browser connection
   parking follows [Agent-Browser Connection](#agent-browser-connection).
   **Must unpark a doored pane before killing it**, so its DOM dies with the Surface.
-- **Killing an agent-browser-rendered pane — or swapping away from that renderer
-  — must mark the session closed, run `agent-browser close` through
-  `closeAgentBrowserSession`, then dispose the surface controller**
-  (`disposeAgentBrowserSurfaceController`) and every client resource it holds.
-- A popped-out window closing normally auto-reverts to headless; **the
-  closed-session mark keeps a Dormouse-initiated kill/swap from resurrecting
-  it**.
+- **Killing an automated pane — or swapping away from that renderer — must go
+  through `closeBrowserSurface`**: it closes the session through the controller
+  (or from params when none holds it) and releases every client resource.
+  **Work that lands after the close closes what it brought up.**
+- **A Workspace transfer releases its browser controllers without closing their
+  sessions**; the destination attaches to them, or opens the same named session
+  a launch was opening. **An abandoned launch closes only a session the host
+  minted.**
 - Iframe proxy grants are reclaimed by the proxy idle sweep, not a per-surface
   teardown hook.
 
 Source of truth: `lib/src/components/Wall.tsx` (`createContentSurface`'s `focusNeutral`,
-`settleAddSelection`, `killPaneImmediately`, `closeAgentBrowserSession`,
-`replaceSurface`), `lib/src/components/wall/agent-browser-sessions.ts`,
-`lib/src/components/wall/agent-browser-surface-controller.ts`,
+`settleAddSelection`, `killPaneImmediately`, `replaceSurface`),
+`closeBrowserSurface` in `lib/src/components/wall/agent-browser-surface-controller.ts`,
+`prepareWorkspaceTransfer` in `lib/src/components/wall/workspace-transfer.ts`,
 `lib/src/host/iframe-proxy.ts` (`GRANT_IDLE_TTL_MS`, `MAX_GRANTS`).
 
 ## Browser Chrome
@@ -157,9 +163,9 @@ Source of truth: `lib/src/components/wall/use-dev-server-ports.ts`,
 
 **Must offer System browser, Iframe, and each automation provider’s screencast and popout for the selected port**, disabling unavailable host capabilities with a reason. Opening a browser from context always preserves the source terminal, including an untouched one.
 
-**Must reuse targets per source, port, and provider**: each provider’s screencast and popout share a browser session and switch display modes. Reattach minimized targets and recreate closed ones. System browser follows the OS opener's behavior.
+**Must reuse targets per source, port, and provider**: each provider’s screencast and popout share a browser session and switch display modes. **A reuse is one intent, `setRenderMode(mode, { url })`, reaching the Surface's controller by id** (`requestBrowserRenderMode`), so a mode switch relaunches at the port's page rather than racing a navigation into it, even in an unmounted Door. Reattach minimized targets and recreate closed ones. System browser follows the OS opener's behavior.
 
-**Must create automated browser Surfaces eagerly without a session**, binding the returned session only after the host launch succeeds; failures are reported in context. A launch completing after its eager Surface has closed releases its browser session. Concurrent requests for the same target are serialized.
+**Must create automated browser Surfaces at once with the URL and no session**, their controller launching ([Agent-Browser Connection](#agent-browser-connection)); a failure is reported in context and closes the pane (`launchFallback: 'close'`). Concurrent requests for the same target are serialized.
 
 Source of truth: `openContextPort` in `lib/src/components/Wall.tsx`; `listenerUrlsByPort` in `lib/src/components/wall/port-url.ts`; `TerminalContextView` in `lib/src/components/wall/TerminalContextView.tsx`.
 
@@ -191,15 +197,15 @@ size landed**, so a resize transient is not read as an external override.
 
 | From -> To | Behavior |
 | --- | --- |
-| `iframe` -> `ab-screencast` / `ab-popout` | **The pane swaps at once** to a session-less agent-browser pane — inert, so it cannot race the boot (rationale) — while the host spawns a fresh `gui-<hex>` session at the current URL via `agentBrowserOpen` and hands over `{session, wsPort, binaryPath}` as **one** params refresh. `ab-popout` spawns headed in one shot, so the surface mounts already popped out. A spawn that rejects or yields no session restores the iframe; a Surface minimized meanwhile receives either outcome through its Door, while one killed meanwhile closes a spawned session. Hidden/inert without that capability. **A non-http(s) `url` refuses the swap** — the same `browserSurfaceUrl` check the iframe sink applies. |
+| `iframe` or the other provider -> `ab-*` / `pw-*` | **The pane swaps at once** to a session-less pane whose controller launches at the current URL, headed for a popout (rationale). **A failed launch restores the previous renderer in place** (`launchFallback: { restore }`), even minimized: the embed, or the previous provider reopened in its own session, keeping its `key` (rationale). Inert without the capability. **A non-http(s) `url` refuses the swap** — the same `browserSurfaceUrl` check the iframe sink applies. |
 | `ab-screencast` <-> `ab-popout` | Same Surface id and session, headed/headless relaunch in the surface controller; preserves only the active URL. |
 | `ab-*` -> `iframe` | Uses canonical `params.url`; with multiple tabs, requires the user to press `c` in the warning overlay, because only the active tab survives. |
 
 Source of truth: `lib/src/components/wall/AgentBrowserScreenModal.tsx`,
 `offeredRenderModes` in `lib/src/components/wall/browser-automation.ts`,
 `lib/src/components/wall/agent-browser-surface-controller.ts` (`screenActions`, sync effects,
-pop-out/pop-in), `lib/src/components/Wall.tsx` (`onSwapRenderMode`), Storybook
-`lib/src/stories/AgentBrowserScreenModal.stories.tsx`.
+pop-out/pop-in, `closeLanded`), `lib/src/components/Wall.tsx` (`onSwapRenderMode`), Storybook
+`lib/src/stories/AgentBrowserScreenModal.stories.tsx`. Pinned by `restores a failed provider swap minimized meanwhile in place` in `lib/src/components/Wall.test.tsx`.
 
 ## Agent-Browser Renderer
 
@@ -216,7 +222,8 @@ only pop-out's kill-then-relaunch changes the mode ([Pop-Out](#pop-out)).
 
 The binary comes from `DORMOUSE_AGENT_BROWSER_BIN` or `PATH`; `dor ab` resolves
 an absolute `binaryPath` for the host, which may not share the terminal's shell
-PATH. **Both `dor ab` and the host must spawn `agent-browser` through
+PATH; **a GUI launch passes the one a `dor ab` Surface last resolved, and
+remembers the one it ran**. **Both `dor ab` and the host must spawn `agent-browser` through
 `spawnAndCapture`** (`dor-lib-common`), never raw `child_process` — the Windows
 `.cmd`-shim recipe applies even to that absolute path (`docs/specs/dor-cli.md` →
 Spawning External Binaries).
@@ -250,7 +257,7 @@ Spawning External Binaries).
   agent-browser-rendered Surface** — an `iframe`-rendered Surface has a browser
   but no session to drive.
 - **One agent-browser session maps to one Dormouse surface.** Re-running `dor ab`
-  for an existing session refreshes `wsPort`/`binaryPath` and reuses the pane, as
+  for an existing session hands its port over, refreshes `binaryPath` and reuses the pane, as
   does a `--surface`-addressed run — not an invariant, though: a surface killed
   or render-swapped mid-command leaves the trailing request to mint a fresh pane
   (rationale).
@@ -264,44 +271,68 @@ Source of truth: `sessionForKey` in `dor-lib-common/src/agent-browser.ts`,
 ### Agent-Browser Connection
 
 A surface-id-keyed controller registry (mirroring `terminal-lifecycle.ts`) owns
-one `AgentBrowserConnection` for `{ session, streamPort, binaryPath }` plus its
-screenshot loop. **The controller is Surface-scoped, not panel-scoped** — it
-survives panel unmount (layout churn, StrictMode). **Must keep the daemon/session
-alive while parked**, releasing viewer resources as specified below; killing
-or swapping away disposes the controller too. **A view must key its controller
-by provider as well as Surface id, and the registry must replace one driving
-the other provider**: a minimized pane stays mounted while a failed
-cross-provider swap is restored in place, and a controller's provider is fixed
-for its life.
-
-**A controller whose params carry no `session` must stay inert** — no connection,
-no `stream status`, and **never derive the session from `key`**, which is what
-[Pane Context Menu Connect](#pane-context-menu-connect) leans on to keep the
-eager pane from racing the daemon boot.
+one `AgentBrowserConnection` plus its screenshot loop. **The controller is
+Surface-scoped, not panel-scoped** — it survives panel unmount. **Must keep the
+daemon/session alive while parked.** **A view must key its controller by
+provider as well as Surface id, and the registry must replace one driving the
+other provider**: a minimized pane stays mounted while a failed cross-provider
+swap is restored in place, and a controller's provider is fixed for its life.
+**A view whose controller was released takes a new one on its next params
+change, never on the release itself** (a kill's, as its fade starts).
+
+**Phase.** The controller holds one `Phase`; the stream connection and CDP
+observer exist exactly in `live`. A hidden headless pane enters `parked` in
+place of `live`; a `dor` handover moves any phase but `launching` and
+`relaunching` to its port; a new `session` in params rebinds.
+
+| Phase | State | Next |
+| --- | --- | --- |
+| `idle` | No view has started it | `launching` without a session; `live` at a handed-over port; else `attaching` with its page |
+| `launching` | Opening `url`, in `launchSession` when set, then binding the session answered | `live` at the answered port, else `attaching`; `ended` |
+| `attaching` | Asking `agentBrowserAttach` where the session streams | `live`; `ended` |
+| `live` | Streaming from its port | `parked` (hidden ≥1s, headless); `relaunching`; `ended` when a headless stream drops (rationale); `attaching` with no page when an unpark's port fails |
+| `parked` | Stream released; daemon up at its port | `live` at that port on unpark (rationale); `relaunching` |
+| `relaunching` | Headed↔headless relaunch | `live` at the host's port; else `attaching` with its page, headless |
+| `ended` | No browser; `error` says why | `relaunching`; a navigation rebinds, with its page |
+| `disposed` | Released; `closed` if its session was | — |
+
+- **Every daemon command must pass one gate (`driver`), open only in `live`,
+  and after an unpark only once its stream opens** — chrome and Display modal
+  actions, tabs, sync-to-pane, `get cdp-url`, edit chords, screenshots
+  (rationale).
+- **A navigation asked for outside `live` is kept as the one latest intent**,
+  run on the next `live`; **so is a pop-out or pop-in asked before the browser
+  is bound** (`idle`, `launching`, `attaching`), run as a relaunch, and so is
+  a new `url` in params while `launching` (rationale). **A launch or relaunch
+  opens the pending page itself; one the host opened never loads again**
+  (rationale).
+- **The controller never asks a daemon-spawning CLI verb for a port**: ports
+  come from a launch or relaunch answer, a `dor` handover, or `attach`.
+- **A failed first launch is reported once to the Wall, which applies the
+  Surface's `launchFallback`**: `close` the pane, `embed` (a Tool's iframe), or
+  `{ restore }` the params a swap replaced. A param cleared on success, it
+  survives a restore mid-launch (rationale). **A launch into a
+  named session waits out a close of that session still in flight**, held open
+  by any work of the closed Surface still landing (rationale).
+- **Params predating the controller's own `session` or `renderMode` write are
+  ignored until they show it back.**
+- **One relaunch at a time, only of a bound browser** (`live`, `parked`,
+  `ended`). **A relaunch leaves `live` before headedness changes** (rationale).
 
 **Parking.** A Lath leaf is always mounted, so nothing else stops a hidden pane's
 ~20Hz stream and per-pulse screenshot loop (rationale). A pane that goes
 off-screen — or whose view unmounts — parks after a ~1s debounce: connection and
 screenshot loop disposed, daemon/session alive, daemon-side streaming stopping on
-its own because clients trigger it. Rules park and recovery must not break:
+its own because clients trigger it.
 
-- **Parking clears the "this stream port opened live" marker**, so a reattach
-  that fails to reconnect can ask `stream status` and adopt a port that changed
-  while the pane was hidden.
 - **An unpark keeps the last good frame on screen**, re-priming from the stream's
   re-broadcast frame/tabs; a fresh reattach mounts a blank canvas and shows the
   placeholder until the first screenshot.
+- **A resize made while not `live` is pushed on the next `live`.**
 - **Never park a popped-out pane**: its stream/CDP observer must keep running for
   window-close auto-revert, even while minimized.
 - **Never set `AGENT_BROWSER_IDLE_TIMEOUT_MS`** for Dormouse-managed sessions —
   daemon self-exit when idle would defeat "alive while parked".
-- **Never query the daemon mid-relaunch** — see [Pop-Out](#pop-out).
-- **A relaunch in flight drops the stream and CDP observer at once**, shows a
-  relaunching placeholder, and reconnects only to the port the host hands back
-  (rationale). **One relaunch at a time**: a pop-out or pop-in issued during
-  one is ignored; a session-less pane has nothing to relaunch.
-- **A `{session, wsPort, binaryPath}` refresh reconciles its session even at the
-  live port**, with no `stream status`.
 
 The stream carries frames, status, tab snapshots, `url`, and native
 `input_mouse` / `input_keyboard` input. **Control envelopes dispatch at any
@@ -348,10 +379,14 @@ Input rules:
 
 Tabs live in the agent-browser surface: **the in-body strip renders only at two
 or more**, one tab getting the ordinary URL header and nothing tab-shaped.
-Select/close go through `agentBrowserCommand`.
+Select/close go through `agentBrowserCommand`. The daemon gate is pinned by
+`reaches no daemon from the header, Display modal, tabs, sync or edit chords
+mid-relaunch` in `lib/src/components/wall/agent-browser-surface-controller.test.ts`.
 
 Source of truth: `lib/src/components/wall/AgentBrowserPanel.tsx` (`toDevice`, the
-tab strip), `lib/src/components/wall/agent-browser-surface-controller.ts`, `lib/src/components/wall/agent-browser-connection.ts`,
+tab strip, placeholders), `lib/src/components/wall/agent-browser-surface-controller.ts`
+(`Phase`, `driver`, `launch`, `attach`, `whenBrowserLaunched`), `onBrowserLaunchFailed` in `lib/src/components/Wall.tsx`,
+`lib/src/components/wall/agent-browser-connection.ts`,
 `lib/src/components/wall/agent-browser-screenshot-loop.ts`, `lib/src/components/wall/agent-browser-input.ts`,
 `lib/src/components/wall/use-surface-visibility.ts`, `lib/src/lib/agent-browser-tab.ts` (the tab record
 shared by the stream and `tab list --json`).
@@ -360,8 +395,8 @@ shared by the stream and `tab list --json`).
 
 `ab-popout` relaunches the same session headed, because Chrome fixes
 headed/headless at daemon launch. The pane becomes a stub with Pop back in;
-while the window is still opening (a relaunch in flight, or an eager pane
-without its session) the stub offers nothing. **State carried in v1 is only the last
+while the window is still opening (a launch, attach or relaunch in flight) the
+stub offers nothing. **State carried in v1 is only the last
 http(s) active URL**: other tabs, DOM state, scroll, form inputs, session storage,
 cookies/logins do not survive.
 
@@ -374,8 +409,8 @@ failed launch**; only a launch without a published port fails, including after a
 zero exit; `agentBrowserOpen` then closes its spawn. **A headed session is
 tracked for shutdown before its launch**, so a window whose page never loads is
 still closed. **Never query the daemon during the close/reopen gap**
-(rationale), host and controller park/recovery paths alike, so **Dormouse
-supplies the active-tab URL and the host trusts it**. Once `open` returns, only
+(rationale) — host-side, and in the controller through its daemon gate — so
+**Dormouse supplies the active-tab URL and the host trusts it**. Once `open` returns, only
 a still-current relaunch best-effort closes stray `about:blank` tabs, **and only
 while a real page is open**, so it never closes the sole tab (rationale).
 
@@ -398,10 +433,10 @@ sidecar/Rust adapter.
 | --- | --- |
 | `agentBrowserCommand` | Navigation, tab, viewport/device, `get cdp-url` and `close` commands, one shape per verb. |
 | `agentBrowserScreenshot` | One device-resolution JPEG/PNG frame. VS Code structured-clones the bytes; standalone passes Rust the capture's temp-file **path** over the sidecar stdio, for Rust to read (rationale). **One capture per session and format in flight**: a request made meanwhile joins it — never one from before the session's close or relaunch — and the capture's spawn is killed past 30s. |
-| `agentBrowserStreamStatus` | Current stream port, for stale-`wsPort` recovery. |
+| `agentBrowserAttach` | The live stream port from `<session>.pid` / `<session>.stream` and a port probe, never spawning. Only a gone daemon, for a caller naming a page, is relaunched there (headed on request), answering `relaunched`; one up but not streaming is left alone. Concurrent attaches join. |
 | `agentBrowserEdit` | select-all/copy/cut via fixed host-owned JS plus an OS clipboard write. |
 | `getAgentBrowserStreamUrl` | Direct stream URL, or the VS Code relay URL. |
-| `agentBrowserOpen` | Spawn a GUI-owned session for iframe -> agent-browser; resolves when the daemon is up, not when the page loads ([Pop-Out](#pop-out)). |
+| `agentBrowserOpen` | Open a URL in a new GUI session, or a caller-named one (a live daemon navigates); resolves when the daemon is up, not when the page loads ([Pop-Out](#pop-out)). |
 | `agentBrowserPopOut` / `agentBrowserPopIn` | Headed/headless relaunch. |
 
 **Every adapter must wait past agent-browser's 25s action timeout for a
@@ -448,7 +483,7 @@ Source of truth: `lib/src/host/agent-browser-host.ts` (`runWithBinaryFallback`),
 
 **Must scope managed keys by provider and Dormouse workspace.** Managed bindings retain unique native session names. The first command reserves its cwd and executable for two minutes while binding the Surface; concurrent first commands share the reservation, and one that succeeds without a viewer (a non-Chromium browser) keeps it until a Surface binds. Successful bindings remove reservations; Surfaces retain cwd/executable for later commands, including relative paths. `--session` bypasses managed-key addressing and uses the caller's native project scope. `--surface` requires a Playwright renderer. GUI Connect inherits the source terminal's cwd; a swap without one uses the host cwd.
 
-**Must discover the native session in its CLI project scope and connect using that installation's matching Playwright client.** Accept only a unique registry entry matching session, workspace and library, with a local pipe endpoint and Chromium engine. Never load modules from the registry's library path. The host derives the client from the validated CLI installation. Raw sessions reuse Surfaces by that native identity, including callers in different subdirectories of one project. Native CLI tabs and the pane share the selected tab; the host polls tab selection and metadata every 750ms while viewed, broadcasting only changes, and the current state to each connecting viewer. Screenshots reuse tab state for up to 750ms; explicit host controls refresh immediately. A native launch updates headed shutdown ownership and the pane's display mode. **Must apply that host-reported mode in the controller before the new viewer port**, so sync never sizes a headed window; ignore it mid-relaunch, and until params show the controller's own last mode write.
+**Must discover the native session in its CLI project scope and connect using that installation's matching Playwright client.** Accept only a unique registry entry matching session, workspace and library, with a local pipe endpoint and Chromium engine. Never load modules from the registry's library path. The host derives the client from the validated CLI installation. Raw sessions reuse Surfaces by that native identity, including callers in different subdirectories of one project. **`attach` relaunches at the page only when the registry lists no browser for the session**, answering `relaunched`, never one it cannot view; `dor pw`'s binding attaches with no page. Native CLI tabs and the pane share the selected tab; the host polls tab selection and metadata every 750ms while viewed, broadcasting only changes, and the current state to each connecting viewer. Screenshots reuse tab state for up to 750ms; explicit host controls refresh immediately. A native launch updates headed shutdown ownership and the pane's display mode. **Must apply that host-reported mode in the controller before the new viewer port**, so sync never sizes a headed window, except mid-relaunch or as an echo ([Agent-Browser Connection](#agent-browser-connection)).
 
 **Must expose only fixed host operations.** Navigation, tabs, viewport/device, screenshots, editing and close are validated host-side (commands by the shared parser above); arbitrary CLI arguments, JavaScript and CDP methods are unavailable through the webview channel. The trusted `dor pw` process retains native passthrough. Executable hints use the same filename/exact-host-override boundary as agent-browser, with `playwright-cli` as the accepted name; `dor pw` applies it to the executable a binding returns (`docs/specs/dor-cli.md` → Playwright Surface Addressing).
 
diff --git a/docs/specs/dor-browser.rationale.md b/docs/specs/dor-browser.rationale.md
index 86e723e47..5da80696b 100644
--- a/docs/specs/dor-browser.rationale.md
+++ b/docs/specs/dor-browser.rationale.md
@@ -6,6 +6,8 @@
 
 **What moving a browser Surface's DOM would cost.** A re-parented `<iframe>` reloads, losing scroll, form contents, live scripts, and any open WebSocket. A screencast canvas that moves mid-click breaks click synthesis, whose device coordinates were computed against the old box. Parking the leaf instead of unmounting it makes minimize/reattach free rather than a reload.
 
+**Why no stream port is a param.** It is ephemeral, and a persisted one was always wrong after a restart (static reading, 2026-09): the Playwright port is the host's own in-process viewer server, so every restored Playwright pane failed three connects (immediate, +2 s, +4 s) and read "ended" after ~6 s; an agent-browser one after a reboot named nothing, and the stale-port recovery that followed asked `stream status`, which starts a daemon at `about:blank` — the pane showed a blank page while its header still named the real one. The recovery machinery that existed only for stale ports (`maybeRecoverStalePort`, two generation counters, a "this port opened live" marker) went with it. Kept as an unpersisted param, `wsPort` still needed seven scrubs across four files, and the params diff could not see the same port handed over twice (review, 2026-09).
+
 ## Browser Chrome
 
 **Why the robot is independent of presentation.** Agent visibility is the
@@ -22,18 +24,18 @@ views without weakening that first signal.
 
 **Why the eager pane is created before `agent-browser open` runs.** A cold daemon boot is 1–3s, and a menu that closes on a pane appearing three seconds later reads as a click that did nothing.
 
-**Why a session-less eager pane is inert.** `maybeRecoverStalePort` returns early when params carry no `session`, so the pane spawns no CLI of its own — no `stream status` fired at a still-booting daemon, no race with the `open` behind it.
-
 **Why the eager pane shows its own placeholder.** The idle placeholder asks for `dor ab open <url>`, telling the user to repeat the action they just took instead of naming the pane's actual state.
 
-**Why the handover is a single params refresh.** Setting `session` is what reconciles the controller and connects it, so landing it ahead of `wsPort`/`binaryPath` — or before `agent-browser open` has returned — connects against a daemon that is not up. Handing it over even after a failed `open` lets the placeholder name what it is waiting for; the menu that would have reported the error closed long ago.
-
-The persisted `wsPort` mirror can lag the controller's already-live port after a buffered write, so a simultaneous session change still reconciles when setting that port itself is a no-op.
+**Why a reuse is one intent.** Revealing the target and then asking for its mode and its URL separately sent `open <url>` in the same tick as a pop-out began its close/reopen, deterministically: the navigation raced the relaunch, which had already captured the old URL.
 
 ## Display Modal And Render Swaps
 
 **Why the iframe swap is eager.** The same 1–3s daemon boot as the context-menu connect, behind a modal that has already closed; and while the swap awaited `open`, a slow page held the iframe on screen for the whole load and a timed-out `open` dropped the swap silently — leaving an orphan `gui-<hex>` browser nobody could see or close.
 
+**Why the Surface's controller launches, not the Wall.** The launch-and-bind existed four times — Tool swap, iframe/cross-provider swap, context-menu port, Tool serving — each with its own "still wanted?" predicate and failure rule, racing the controller it handed a session to. Because the launch lived in a Wall closure rather than on the Surface, a session-less pane that was persisted, or whose webview reloaded mid-launch, restored session-less forever, and Tool serving still blocked on the page load (static reading, 2026-09).
+
+**Why a failed swap's restore reopens the previous session.** A fresh `gui-<hex>` session kept a `key` badge that `dor ab --key` no longer resolved to, and the next command opened a second pane.
+
 ## Agent-Browser Renderer
 
 **Why one-session-one-surface is not an invariant.** `dor ab` forwards the user's command and then runs `stream status` before it asks the host for a surface, so a surface killed or render-swapped inside that window is gone by the time the trailing request arrives — and the session behind it is still live and needs somewhere to render.
@@ -54,7 +56,23 @@ The persisted `wsPort` mirror can lag the controller's already-live port after a
 
 **Why every non-crisp painter must bump the draw generation.** The byte-dedup compares an incoming capture against the last crisp draw. A resting page whose crisp bytes match that draw dedups to a no-op and strands the pane on the blurry provisional frame; a freshly re-attached canvas mounts blank and has the same problem.
 
-**Why the connection is dropped at relaunch start rather than left to fail.** The host closes the browser and kills the daemon, so the old socket's close is certain. Left connected, its three reconnect failures flagged the pane "ended" about three seconds into a pop-in that a slow page could hold open for 25s, and the popped-out CDP observer's `get cdp-url` — issued the moment `poppedOut` flipped — landed in the close→reopen gap, where a daemon command spawns a competing headless daemon that the headed relaunch then reattaches to.
+**Why the connection is dropped at relaunch start rather than left to fail.** The host closes the browser and kills the daemon, so the old socket's close is certain. Left connected, its three reconnect failures flagged the pane "ended" about three seconds into a pop-in that a slow page could hold open for 25s, and the popped-out CDP observer's `get cdp-url` — issued the moment `poppedOut` flipped — landed in the close→reopen gap, where a daemon command spawns a competing headless daemon that the headed relaunch then reattaches to. The same holds for flipping headedness before leaving `live`: the observer would start, gate open, in the gap.
+
+**Why one daemon gate, not a check per call site.** The rule against daemon commands in the relaunch gap was a `relaunching` flag each caller had to check, and most did not (static reading, 2026-09): the header's back/forward/reload/URL edit, the Display modal's device and custom viewport, tab clicks, sync-to-pane (reached by a resize once a pop-in had already flipped `poppedOut`), and Cmd-A/C/X all reached the daemon mid-relaunch. The lifecycle behind it was a dozen flags whose invariants lived in five predicates.
+
+**Why an unpark streams from its parked port first, and attaches with no page.** Asking the host first cost every unpark an attach round trip (a pid and stream-file read plus a port probe) before the first frame, for a daemon that almost never moves while hidden (review, 2026-09). When it did move, or went away: a daemon gone while the pane was hidden is the same failure as one gone while visible, which the pane shows as ended; relaunching it on unpark would hide that failure and undo a `dor ab close` made meanwhile. A restore has no such history, so it reopens the page.
+
+**Why a dropped headless stream ends.** While a drop only flagged the connection lost, the phase stayed `live` and the gate open, so a URL-bar navigation ran `open`, which started a daemon on a port the controller never learned; the placeholder read "ended" off three separate signals (review, 2026-09). Attach never spawns, so leaving `live` loses nothing a navigation or `dor` handover cannot reach again.
+
+**Why a launch opens the pending page itself.** A navigation out of `ended` relaunched a gone daemon at that page through `attach`, then ran `open` for it again on `live`: the page reloaded right after its first load, dropping any state it had set up and repeating a non-idempotent GET (review of #775, 2026-09). The controller cannot tell a relaunch from a found daemon on its own, since both answer a port, so `attach` says which. A launch carrying the previous page instead loaded that page first and then navigated away from it.
+
+**Why the launch-failure policy is a param.** Its four creators each awaited an in-memory waiter with its own liveness check, so a pane persisted mid-launch — or whose webview reloaded — then failed, showed "ended" instead of its creator's fallback (review, 2026-09).
+
+**Why a launch waits out its session's close.** A failed swap's restore reopens the previous provider's session, whose `close` was issued at swap time; a fast failure (no Playwright installed) lands before that close does, so a reopen racing it was closed under the restored pane. A Tool re-run relaunching the `tool.<leafId>` session its last run closed meets the same race. So does a Surface closed while its own launch, relaunch or relaunching attach into the session was in flight: that work closed the session when it landed, after the next launch into the name had opened it, and a close issued before the launch had bound the session registered nothing to wait on. The Tool serving loop that awaited each open never overlapped two launches; its replacement does (review of #775, 2026-09).
+
+**Why a new `url` mid-launch is a navigation.** Tool serving stopped awaiting the launch, so an announcement landing mid-launch wrote a new `url` with the session still unbound; nothing rebound, the launch went live on the old page, and serving had already recorded the announcement, so the pane was never re-framed (review of #775, 2026-09).
+
+**Why an unpark drives nothing until its stream opens.** The unpark entered `live` at once, so sync-to-pane and a pending navigation ran before the parked port was proven. With the daemon gone while hidden (`dor ab close`, a crash) and the pane resized meanwhile, as restoring a Door does, `set viewport` started a fresh `about:blank` daemon through the CLI, and the failed stream's attach then streamed it instead of ending (review of #775, 2026-09).
 
 **Why `url` is tracked separately from `tabs`.** Measured against agent-browser 0.31.1 (2026-09): on `open`, the stream sends `tabs` (about:blank), then `url` naming the target at navigation commit, and refreshes `tabs` only when the CLI command completes — after `load`. During a slow load the tab list still named the previous page, so a pop-out issued then relaunched the page before the one being loaded.
 
diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index bffbc4cb3..c5c0cdd57 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -604,9 +604,9 @@ and the host applies two gates in order:
   pw-screencast) — drive it with dor pw --surface surface:2`, or for an iframe
   `… open its page with dor ab open <its url>`.
 
-Neither gate covers an agent-browser Surface the context menu created eagerly,
-whose daemon boot has not yet named it ([dor-browser.md](dor-browser.md) → Pane
-Context Menu Connect): capability and renderer but no session, failing with
+Neither gate covers an agent-browser Surface whose launch has not yet named its
+session ([dor-browser.md](dor-browser.md) → Agent-Browser Connection):
+capability and renderer but no session, failing with
 `surface 'surface:2' has no agent-browser session yet`.
 
 Like every handle target, `--surface` requires a live control endpoint.
diff --git a/docs/specs/dor-tool.md b/docs/specs/dor-tool.md
index 977c39ac6..191606ad7 100644
--- a/docs/specs/dor-tool.md
+++ b/docs/specs/dor-tool.md
@@ -109,13 +109,12 @@ Source of truth: `createToolHost` in `lib/src/host/tool-host.ts`; `FileToolTrust
 - **Must poll unbound Tools every 1.5 seconds while their command runs.** Reset settle memory and retire browser resources when the observed command-run id changes, even when the command text is unchanged; an initial observation preserves an imported live binding. (rationale)
 - **Must let a changed announced port or path override a committed conflict or browser**, but only after a matching scan. An unchanged announcement never undoes URL-bar navigation. (rationale)
 - **Must stop ordinary port scans once a browser or conflict is committed.** An unannounced additional port appearing after settle is not detected.
-- **Must display the browser destination before awaiting agent-browser startup**, clearing the existing session/stream binding during a reopen as well. Keep the session-less renderer inert and block Workspace transfer until the binding arrives. Close any browser session whose Tool disappeared or changed command during startup.
-- **Must reuse an existing browser session and its binary path when an announcement changes its destination.**
+- **Must display the browser destination at once and leave the launch to the Surface's controller** (`docs/specs/dor-browser.md` → Agent-Browser Connection), in the session the Tool has or else its own `tool.<leafId>`, falling back to the embed. Block Workspace transfer until the session binds.
 - **Must retain a runtime re-key within the Tool's namespace**, following [Identity and dedupe](#identity-and-dedupe).
 
 Reserved: **Must derive a Tool's URL again on cold restore**, compatible with future `prespawn_port` and `DORMOUSE_TOOL_PORT` in scope **dor-tools**; [Persistence and hosts](#persistence-and-hosts) owns the saved projection.
 
-Source of truth: `useToolServing` in `lib/src/components/wall/use-tool-serving.ts`; `attachAgentBrowserSession` in `lib/src/components/wall/tool-browser-session.ts`; `listenerUrlsByPort` in `lib/src/components/wall/port-url.ts`. Tests: `lib/src/components/wall/use-tool-serving.test.tsx`.
+Source of truth: `useToolServing` in `lib/src/components/wall/use-tool-serving.ts`; `toolBrowserLaunchParams` in `lib/src/components/wall/browser-surface.ts`; `listenerUrlsByPort` in `lib/src/components/wall/port-url.ts`. Tests: `lib/src/components/wall/use-tool-serving.test.tsx`.
 
 ## Lifecycle
 
diff --git a/docs/specs/tiling-engine.md b/docs/specs/tiling-engine.md
index dbb3c4138..058a8b3b5 100644
--- a/docs/specs/tiling-engine.md
+++ b/docs/specs/tiling-engine.md
@@ -190,7 +190,7 @@ Source of truth: `createAnimator` in `lib/src/lib/lath/animator.ts`; the animato
 **Every pane body / header component takes plain `PaneProps` and never sees the engine**, `use-pane-chrome` / `use-surface-visibility` included:
 
 - **Read side**: `PaneProps` — `{ id, title, params, parked? }`, supplied by LathHost straight from `leafMeta`, parked leaves included; a meta commit re-renders the leaf, so params stay live either way.
-- **Write side**: `PaneWriteContext` (`{ setTitle(id, t), updateParams(id, patch) }`), provided by the Wall over the store (`lath.store.setTitle` / `lath.store.updateParams`); the `wsPort`-refresh and render-swap flows route through the same seam. The value is stable per mount; the `AgentBrowserPanel` controller sink captures it once.
+- **Write side**: `PaneWriteContext` (`{ setTitle(id, t), updateParams(id, patch) }`), provided by the Wall over the store (`lath.store.setTitle` / `lath.store.updateParams`); the `dor` params refresh and render-swap flows route through the same seam. The value is stable per mount; the `AgentBrowserPanel` controller sink captures it once.
 - **Visibility**: a mounted leaf is engine-visible unless **parked**, so `parked` is the one non-meta pane prop and absent means "not parked" — right for anything rendered outside LathHost. `useSurfaceVisibility(parked)` folds it with document visibility and the Wall's Workspace being the visible one (`docs/specs/layout.md` → "Workspaces"), so a backgrounded window, a hidden Workspace, and a minimized browser or Tool Surface all gate streaming while the session stays alive.
 - **Terminal sizing**: `TerminalResizeContext` gates fitting; `docs/specs/layout.md` → "Animations" owns the rule.
 - `use-pane-chrome` registers the pane's root element in `PaneElementsContext`, for the overlays to measure, and nothing else — there is no CSS spawn-animation to trigger.
diff --git a/lib/src/components/Wall.test.tsx b/lib/src/components/Wall.test.tsx
index ab14f6094..c504e2b6b 100644
--- a/lib/src/components/Wall.test.tsx
+++ b/lib/src/components/Wall.test.tsx
@@ -15,7 +15,8 @@ import { Wall } from './Wall';
 import * as helpers from '../lib/helper-terminal';
 import * as agentBrowserScreen from './wall/agent-browser-screen';
 import { getAgentBrowserScreenController } from './wall/agent-browser-screen';
-import { getAgentBrowserSurfaceController } from './wall/agent-browser-surface-controller';
+import { disposeAllAgentBrowserSurfaceControllers, getAgentBrowserSurfaceController } from './wall/agent-browser-surface-controller';
+import { forgetLaunchBinaryPaths } from './wall/browser-automation';
 import * as browserAutomation from './wall/browser-automation';
 import { setDevServerResolution } from './wall/agent-browser-ports';
 import { setPlatform } from '../lib/platform';
@@ -78,6 +79,10 @@ afterEach(() => {
   // The activity store is Window-global, so a ring or TODO left on a pane id
   // would wear its alarm overlay in every later test that renders that id.
   clearTerminalActivity();
+  // Browser controllers outlive the Wall that mounted them, like the ring
+  // above, and so does the binary path `dor ab` last resolved.
+  disposeAllAgentBrowserSurfaceControllers();
+  forgetLaunchBinaryPaths();
 });
 
 const flush = (): Promise<void> => harness.flush();
@@ -783,6 +788,98 @@ describe('Wall on the Lath engine', () => {
     }
   });
 
+  it('pops out a reused context-port browser at the port, never navigating into the relaunch', async () => {
+    const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(false);
+    const helperSpy = vi.spyOn(helpers, 'openHelper').mockResolvedValue({ id: 'context-helper', parentId: 'pane-a', command: '', status: 'preserved' });
+    const command = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
+    const popOut = vi.fn(() => new Promise<never>(() => {}));
+    Object.assign(fake, {
+      agentBrowserOpen: vi.fn(async () => ({ ok: true, session: 'second', wsPort: 1 })),
+      agentBrowserAttach: vi.fn(async () => ({ ok: true, wsPort: 4321 })),
+      agentBrowserCommand: command,
+      agentBrowserPopOut: popOut,
+    });
+    try {
+      // The port's browser, navigated away from the port's page since.
+      await act(async () => {
+        root.render(<Wall initialMode="command" restoredLathLayout={{
+          version: 1,
+          tree: { root: { kind: 'split', dir: 'row', children: [
+            { node: { kind: 'leaf', id: 'pane-a' }, weight: 0.5 },
+            { node: { kind: 'leaf', id: 'port-ab' }, weight: 0.5 },
+          ] } },
+          leafMeta: {
+            'pane-a': { component: 'terminal', tabComponent: 'terminal', title: 'shell' },
+            'port-ab': { component: 'browser', tabComponent: 'surface', title: 'localhost:5173', params: {
+              surfaceType: 'browser', renderMode: 'ab-screencast', session: 'restored', url: 'http://localhost:5173/elsewhere', contextPortKey: 'pane-a:5173:agent',
+            } },
+          },
+        }} />);
+      });
+      await flush();
+      if (!fake.hasPty('pane-a')) fake.spawnPty('pane-a');
+      fake.setOpenPorts('pane-a', [{ protocol: 'tcp', family: 'IPv4', address: '127.0.0.1', port: 5173, pid: 100, processName: 'vite' }]);
+      await act(async () => {
+        container.querySelector<HTMLElement>('[data-pane-header-for="pane-a"]')!.dispatchEvent(new MouseEvent('contextmenu', {
+          bubbles: true, cancelable: true, clientX: 10, clientY: 10,
+        }));
+      });
+      await flush();
+      command.mockClear();
+      await act(async () => {
+        document.querySelector<HTMLButtonElement>('[data-terminal-context] button[aria-label="Open in agent-browser popout"]')!.click();
+      });
+      await flush();
+
+      // One relaunch, at the port — not at the page it was on, with the port's
+      // `open` queued behind it.
+      expect(leafCount()).toBe(2);
+      expect(popOut).toHaveBeenCalledExactlyOnceWith('restored', expect.objectContaining({ url: 'http://localhost:5173/' }), undefined);
+      expect(command).not.toHaveBeenCalledWith('restored', ['open', 'http://localhost:5173/'], undefined);
+    } finally {
+      helperSpy.mockRestore();
+      untouchedSpy.mockRestore();
+    }
+  });
+
+  it('pops out a restored context-port Door at the port', async () => {
+    const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(false);
+    const helperSpy = vi.spyOn(helpers, 'openHelper').mockResolvedValue({ id: 'context-helper', parentId: 'pane-a', command: '', status: 'preserved' });
+    const popOut = vi.fn(() => new Promise<never>(() => {}));
+    Object.assign(fake, {
+      agentBrowserOpen: vi.fn(async () => ({ ok: true, session: 'second', wsPort: 1 })),
+      agentBrowserAttach: vi.fn(async () => ({ ok: true, wsPort: 4321 })),
+      agentBrowserCommand: vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' })),
+      agentBrowserPopOut: popOut,
+    });
+    try {
+      await act(async () => {
+        root.render(<Wall initialPaneIds={['pane-a']} initialMode="command" initialDoors={[{
+          id: 'restored-ab', title: 'localhost:5173', component: 'browser', tabComponent: 'surface',
+          params: { surfaceType: 'browser', renderMode: 'ab-screencast', session: 'restored', url: 'http://localhost:5173/elsewhere', contextPortKey: 'pane-a:5173:agent' },
+        }]} />);
+      });
+      await flush();
+      if (!fake.hasPty('pane-a')) fake.spawnPty('pane-a');
+      fake.setOpenPorts('pane-a', [{ protocol: 'tcp', family: 'IPv4', address: '127.0.0.1', port: 5173, pid: 100, processName: 'vite' }]);
+      await act(async () => {
+        container.querySelector<HTMLElement>('[data-pane-header-for="pane-a"]')!.dispatchEvent(new MouseEvent('contextmenu', {
+          bubbles: true, cancelable: true, clientX: 10, clientY: 10,
+        }));
+      });
+      await flush();
+      await act(async () => {
+        document.querySelector<HTMLButtonElement>('[data-terminal-context] button[aria-label="Open in agent-browser popout"]')!.click();
+      });
+      await flush();
+
+      expect(popOut).toHaveBeenCalledExactlyOnceWith('restored', expect.objectContaining({ url: 'http://localhost:5173/' }), undefined);
+    } finally {
+      helperSpy.mockRestore();
+      untouchedSpy.mockRestore();
+    }
+  });
+
   it('names Playwright when a context-menu Playwright launch fails', async () => {
     const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(false);
     // The mocked TerminalPane registers no terminal, so the helper would report
@@ -811,6 +908,8 @@ describe('Wall on the Lath engine', () => {
 
       expect(playwright).toHaveBeenCalledWith(expect.objectContaining({ op: 'open', url: 'http://localhost:5173/' }));
       expect(document.querySelector('[data-terminal-context] [role="alert"]')?.textContent).toBe('Could not open Playwright');
+      // The pane made for it goes with the failure.
+      expect(leafCount()).toBe(1);
     } finally {
       helperSpy.mockRestore();
       untouchedSpy.mockRestore();
@@ -829,7 +928,7 @@ describe('Wall on the Lath engine', () => {
     });
     (fake as PlatformAdapter).agentBrowserCommand = agentBrowserCommand;
     (fake as PlatformAdapter).agentBrowserOpen = vi.fn(() => openResult);
-    (fake as PlatformAdapter).agentBrowserStreamStatus = vi.fn(async () => ({ ok: true, wsPort: 4321 }));
+    (fake as PlatformAdapter).agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 4321 }));
 
     try {
       await act(async () => {
@@ -937,10 +1036,11 @@ describe('Wall on the Lath engine', () => {
       await act(async () => { eagerLeaf.querySelector<HTMLButtonElement>('[aria-label="Minimize"]')!.click(); });
       await flush();
 
-      // Playwright is not installed: the Door comes back as agent-browser.
+      // Playwright is not installed: the Door comes back as agent-browser, in
+      // the session it had.
       await act(async () => { pwOpen.resolve({ ok: false, error: 'playwright-cli is not installed' }); });
       await flush();
-      expect(relaunch).toHaveBeenCalledWith('http://localhost:5173/', { headed: false }, undefined);
+      expect(relaunch).toHaveBeenCalledWith('http://localhost:5173/', { headed: false, session: 'ab-live' }, undefined);
       expect(getAgentBrowserSurfaceController(eagerId)?.provider).toBe('agent-browser');
       expect(getAgentBrowserScreenController(eagerId)?.snapshot().renderMode).toBe('ab-screencast');
     } finally {
@@ -948,6 +1048,43 @@ describe('Wall on the Lath engine', () => {
     }
   });
 
+  it('gives a pane restored mid-launch its creator\'s fallback when the launch fails', async () => {
+    const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(true);
+    Object.assign(fake, {
+      agentBrowserOpen: vi.fn(async () => ({ ok: false, error: 'agent-browser binary not found' })),
+      agentBrowserCommand: vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' })),
+    });
+    try {
+      // Persisted before either launch answered: a new-tab pane, and a swap
+      // away from the embed.
+      await act(async () => {
+        root.render(<Wall
+          restoredLathLayout={{ version: 1, tree: { root: { kind: 'split', dir: 'row', children: [
+            { node: { kind: 'leaf', id: 'new-tab' }, weight: 0.5 },
+            { node: { kind: 'leaf', id: 'swapped' }, weight: 0.5 },
+          ] } }, leafMeta: {
+            'new-tab': { component: 'browser', tabComponent: 'surface', title: 'accounts.example', params: {
+              surfaceType: 'browser', renderMode: 'ab-screencast', url: 'https://accounts.example/', launchFallback: 'close',
+            } },
+            'swapped': { component: 'browser', tabComponent: 'surface', title: 'localhost:5173', params: {
+              surfaceType: 'browser', renderMode: 'ab-screencast', url: 'http://localhost:5173/',
+              launchFallback: { restore: { surfaceType: 'browser', renderMode: 'iframe', url: 'http://localhost:5173/' } },
+            } },
+          } }}
+          initialMode="command"
+        />);
+      });
+      await flush();
+      await flush();
+
+      expect(container.querySelector('[data-lath-leaf="new-tab"]')).toBeNull();
+      expect(container.querySelector('[data-lath-leaf="swapped"]')).not.toBeNull();
+      expect(getAgentBrowserScreenController('swapped')?.snapshot().renderMode).toBe('iframe');
+    } finally {
+      untouchedSpy.mockRestore();
+    }
+  });
+
   it('hands an eager render-swap session to a Surface minimized during launch', async () => {
     const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(true);
     let resolveOpen!: (result: { ok: boolean; session?: string; wsPort?: number; binaryPath?: string }) => void;
@@ -1041,6 +1178,89 @@ describe('Wall on the Lath engine', () => {
     }
   });
 
+  it('restores a failed provider swap minimized meanwhile in place, reopening the previous browser under its own key', async () => {
+    const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(false);
+    const defaultSession = sessionForKey('default');
+    const events: string[] = [];
+    let failPlaywright!: (result: { ok: boolean; error?: string }) => void;
+    let landClose!: () => void;
+    Object.assign(fake, {
+      agentBrowserAttach: vi.fn(async () => ({ ok: true, wsPort: 4321 })),
+      agentBrowserCommand: vi.fn(async (session: string, args: string[]) => {
+        events.push(`${args.join(' ')} ${session}`);
+        if (args[0] === 'close') {
+          await new Promise<void>((resolve) => { landClose = resolve; });
+          events.push('close landed');
+        }
+        return { exitCode: 0, stdout: '', stderr: '' };
+      }),
+      agentBrowserOpen: vi.fn(async (url: string, opts: { session?: string }) => {
+        events.push(`open ${opts.session} ${url}`);
+        return { ok: true, session: opts.session, wsPort: 5555 };
+      }),
+      playwright: vi.fn((request: { op: string }) => (request.op === 'open'
+        ? new Promise((resolve) => { failPlaywright = resolve; })
+        : Promise.resolve({ ok: true }))),
+    });
+    try {
+      await act(async () => {
+        root.render(<Wall initialMode="command" restoredLathLayout={{
+          version: 1,
+          tree: { root: { kind: 'split', dir: 'row', children: [
+            { node: { kind: 'leaf', id: 'pane-a' }, weight: 0.5 },
+            { node: { kind: 'leaf', id: 'keyed-ab' }, weight: 0.5 },
+          ] } },
+          leafMeta: {
+            'pane-a': { component: 'terminal', tabComponent: 'terminal', title: 'shell' },
+            'keyed-ab': { component: 'browser', tabComponent: 'surface', title: 'default', params: {
+              surfaceType: 'browser', renderMode: 'ab-screencast', session: defaultSession, key: 'default', url: 'http://localhost:5173/',
+            } },
+          },
+        }} />);
+      });
+      await flush();
+
+      await act(async () => { getAgentBrowserScreenController('keyed-ab')?.actions.setRenderMode?.('pw-screencast'); });
+      await flush();
+      const eagerId = Array.from(container.querySelectorAll<HTMLElement>('[data-lath-leaf]'))
+        .map((leaf) => leaf.dataset.lathLeaf!).find((leafId) => leafId !== 'pane-a')!;
+      expect(eagerId).not.toBe('keyed-ab');
+      await act(async () => {
+        container.querySelector<HTMLElement>(`[data-lath-leaf="${eagerId}"]`)!.querySelector<HTMLButtonElement>('[aria-label="Minimize"]')!.click();
+      });
+      await flush();
+
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      await act(async () => { failPlaywright({ ok: false, error: 'playwright-cli was not found' }); });
+      await flush();
+      warn.mockRestore();
+      expect(events).toEqual([`close ${defaultSession}`]);
+      await act(async () => { landClose(); });
+      await flush();
+
+      // Back to agent-browser in the Door it was minimized to, reopened in the
+      // session its key names once that session's close has landed…
+      expect(container.querySelector(`[data-door-id="${eagerId}"]`)).not.toBeNull();
+      expect(events).toEqual([`close ${defaultSession}`, 'close landed', `open ${defaultSession} http://localhost:5173/`]);
+      expect(await dispatchResolveAgentBrowser(eagerId)).toMatchObject({ ok: true, result: { session: defaultSession } });
+      // …so `dor ab --key default` drives it rather than opening a second pane.
+      let reused: { ok: boolean; result?: { status: string; surfaceId: string } } | undefined;
+      await act(async () => {
+        window.dispatchEvent(new CustomEvent('dormouse:control-request', {
+          detail: {
+            method: SURFACE_CONTROL_METHODS.agentBrowser,
+            params: { key: 'default', session: defaultSession, wsPort: 5555, surface: 'surface:1' },
+            respond: (r: typeof reused) => { reused = r; },
+          },
+        }));
+      });
+      await flush();
+      expect(reused).toMatchObject({ ok: true, result: { status: 'existing', surfaceId: eagerId } });
+    } finally {
+      untouchedSpy.mockRestore();
+    }
+  });
+
   it('restores an eager render swap to iframe when launch rejects', async () => {
     const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(true);
     (fake as PlatformAdapter).agentBrowserOpen = vi.fn(async () => {
@@ -1127,13 +1347,48 @@ describe('Wall on the Lath engine', () => {
 
       await act(async () => { controller()?.actions.setRenderMode?.('ab-screencast'); });
       await flush();
-      expect(open).toHaveBeenCalledWith('http://localhost:6006/', {}, undefined);
+      expect(open).toHaveBeenCalledWith('http://localhost:6006/', { headed: false, session: 'dormouse.1.tool.tool-a' }, undefined);
     } finally {
       offered.mockRestore();
       act(() => terminalRegistry.removeTerminalPaneState('tool-a'));
     }
   });
 
+  it('gives a Tool its embed back when its swap to agent-browser cannot launch', async () => {
+    Object.assign(fake, { agentBrowserOpen: vi.fn(async () => ({ ok: false, error: 'agent-browser binary not found' })) });
+    terminalRegistry.applyTerminalSemanticEvents('tool-a', [
+      { type: 'commandLine', commandLine: 'pnpm storybook' },
+      { type: 'commandStart' },
+    ]);
+    try {
+      await act(async () => {
+        root.render(<Wall
+          restoredLathLayout={{
+            version: 1,
+            tree: { root: { kind: 'leaf', id: 'tool-a' } },
+            leafMeta: {
+              'tool-a': {
+                component: 'tool', tabComponent: 'tool', title: 'storybook',
+                params: {
+                  surfaceType: 'tool', command: 'pnpm storybook', cwd: '/repo', toolName: 'storybook',
+                  toolRender: 'iframe', toolPort: 'announced', renderMode: 'iframe', url: 'http://localhost:6006/',
+                },
+              },
+            },
+          }}
+          initialMode="command"
+        />);
+      });
+      await flush();
+      await act(async () => { getAgentBrowserScreenController('tool-a')?.actions.setRenderMode?.('ab-screencast'); });
+      await flush();
+      expect(fake.agentBrowserOpen).toHaveBeenCalledWith('http://localhost:6006/', { headed: false, session: 'dormouse.1.tool.tool-a' }, undefined);
+      expect(getAgentBrowserScreenController('tool-a')?.snapshot().renderMode).toBe('iframe');
+    } finally {
+      act(() => terminalRegistry.removeTerminalPaneState('tool-a'));
+    }
+  });
+
   it.each([
     ['ab-screencast', 'agent-browser'],
     ['pw-screencast', 'Playwright'],
@@ -3840,7 +4095,7 @@ describe('Wall on the Lath engine', () => {
 
   it('names the command that drives a browser run by the other provider', async () => {
     (fake as PlatformAdapter).playwright = vi.fn(async (request: { op: string }) => (
-      request.op === 'streamStatus' ? { ok: true, wsPort: 4555 } : { ok: true }
+      request.op === 'attach' ? { ok: true, wsPort: 4555 } : { ok: true }
     ));
     (fake as PlatformAdapter).agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
     const untouchedSpy = vi.spyOn(terminalRegistry, 'isUntouched').mockReturnValue(false);
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 6f5f8f306..83aba5e0e 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -24,11 +24,9 @@ const RemotePairingModalHost = lazy(() =>
   })),
 );
 import { getAgentBrowserScreenController } from './wall/agent-browser-screen';
-import { markAgentBrowserSessionClosed } from './wall/agent-browser-sessions';
-import { automationProvider, browserPlatform, browserSessionKey, isPopout, LaunchBinaryPath, PROVIDER_LABEL, type AutomationRenderMode } from './wall/browser-automation';
-import { isAllowedBinaryFor } from '../lib/agent-browser-binary';
+import { automationProvider, browserPlatform, PROVIDER_LABEL } from './wall/browser-automation';
 import { isToolRender } from '../lib/platform/tool-types';
-import { disposeAgentBrowserSurfaceController } from './wall/agent-browser-surface-controller';
+import { closeBrowserSurface, requestBrowserRenderMode, whenBrowserLaunched } from './wall/agent-browser-surface-controller';
 import { KILL_CONFIRM_MS, KILL_SHAKE_MS, KillConfirmOverlay, randomKillChar, type ConfirmKill } from './KillConfirm';
 import { NotepadArchiveFailureModal, type NotepadArchiveFailure } from './NotepadArchiveFailure';
 import { messageOf } from '../lib/errors';
@@ -61,7 +59,6 @@ import {
   deriveSurfaceLabel,
 } from '../lib/terminal-state';
 import { getPlatform } from '../lib/platform';
-import type { AgentBrowserOpenResult } from '../lib/platform/types';
 import type {
   Surface as DorSurface,
   ResolvedSplitDirection as DorResolvedSplitDirection,
@@ -83,6 +80,9 @@ import { useDynamicPalette } from '../lib/themes/use-dynamic-palette';
 import {
   resolveRenderMode,
   agentBrowserSessionFromParams,
+  launchFallbackFromParams,
+  toolBrowserLaunchParams,
+  type LaunchFallback,
   browserDisplayModeFromParams,
   browserUrlFromParams,
   isBrowserParams,
@@ -217,39 +217,6 @@ function compareBySurfaceRef(a: DorSurface, b: DorSurface): number {
     - (surfaceRefNumber(b.ref) ?? Number.MAX_SAFE_INTEGER);
 }
 
-/** Killing or swapping away from an agent-browser surface closes its session —
- *  surface lifetime and browser lifetime are bound (spec → Lifecycle). No-op
- *  for other surface types. */
-function closeAgentBrowserSession(params: unknown): void {
-  const session = agentBrowserSessionFromParams(params);
-  if (!session) return;
-  const { renderMode, cwd, binaryPath } = params as { renderMode?: unknown; cwd?: string; binaryPath?: unknown };
-  const provider = automationProvider(renderMode);
-  if (!provider) return;
-  // Mark before issuing the close so a popped-out surface's auto-revert sees
-  // the impending teardown and doesn't relaunch the session we're killing.
-  markAgentBrowserSessionClosed(browserSessionKey(session, provider, cwd));
-  browserPlatform(provider, cwd).agentBrowserCommand?.(
-    session,
-    ['close'],
-    // Checked, not merely typed: these params come off the persisted session
-    // blob, and `binaryPath` names a program the host will spawn
-    // (`lib/src/lib/agent-browser-binary.ts`).
-    isAllowedBinaryFor(provider, binaryPath) ? binaryPath : undefined,
-  ).catch(() => {});
-}
-
-/** The params binding a browser Surface to the `session` a GUI launch returned. */
-function boundBrowserParams(session: string, result: AgentBrowserOpenResult, cwd: string | undefined) {
-  return {
-    session,
-    cwd: result.cwd ?? cwd,
-    nativeIdentity: result.nativeIdentity,
-    ...(result.wsPort !== undefined ? { wsPort: result.wsPort } : {}),
-    ...(result.binaryPath !== undefined ? { binaryPath: result.binaryPath } : {}),
-  };
-}
-
 function ShellSpawnNotice({
   notice,
   paneElements,
@@ -706,8 +673,7 @@ export function Wall({
       // teardown lands here: the throwaway was created straight into a door.
       const door = doorsRef.current.find(d => d.id === id);
       if (!door) return;
-      closeAgentBrowserSession(lath.getMeta(id)?.params);
-      disposeAgentBrowserSurfaceController(id);
+      closeBrowserSurface(id, lath.getMeta(id)?.params);
       // Destroy the Door: drop the meta the store kept for it and, if it was parked,
       // unmount the DOM (and any iframe document still running inside it) with it.
       lath.store.forgetLeaf(id);
@@ -730,11 +696,10 @@ export function Wall({
       fireEvent({ type: 'kill', id });
       return;
     }
-    const params = nav.paneParams(id);
-    closeAgentBrowserSession(params);
-    // Release the surface's client-side controller (connection, loops, timers,
-    // screen registration). A safe no-op for iframe/terminal surfaces.
-    disposeAgentBrowserSurfaceController(id);
+    // Close its browser session and release the client-side controller
+    // (connection, loops, timers, screen registration). A safe no-op for
+    // iframe/terminal surfaces.
+    closeBrowserSurface(id, nav.paneParams(id));
     // Two-phase kill (docs/specs/tiling-engine.md → "Animation"): fade the pane in
     // place (a last-pane kill also shrinks it toward the bottom-right), then commit
     // `remove` once the fade completes — survivors tween into the reclaimed space.
@@ -1546,13 +1511,12 @@ export function Wall({
     return { ok: true, value: { id: newId, ref: surfaceRefForId(newId), status: 'created' } };
   }, [generatePaneId, minimizePane, surfaceRefForId, transferSurfaceRef, lath, settleAddSelection, nav]);
 
-  const launchBinaryPath = useRef(new LaunchBinaryPath()).current;
-
   /**
    * Replace a content surface's renderer in place, preserving its slot
    * (docs/specs/dor-browser.md → "Display Modal And Render Swaps"): an atomic
-   * identity swap that closes the old surface's session if any and selects the new.
-   * The generalized form of createContentSurface's replace-untouched-terminal branch.
+   * identity swap that closes the old surface's session if any and selects the
+   * new. The generalized form of createContentSurface's replace-untouched-terminal
+   * branch.
    */
   const replaceSurface = useCallback((oldId: string, next: {
     params: Record<string, unknown>;
@@ -1561,10 +1525,9 @@ export function Wall({
     const oldParams = nav.paneParams(oldId);
     const oldVisible = nav.hasPane(oldId);
     if (!oldVisible) return null;
-    closeAgentBrowserSession(oldParams);
-    // The old renderer's controller is going away with this swap; release its
-    // client-side resources (no-op for a non-agent-browser surface).
-    disposeAgentBrowserSurfaceController(oldId);
+    // The old renderer goes away with this swap: its session and its
+    // controller's client-side resources (no-op for a non-automated surface).
+    void closeBrowserSurface(oldId, oldParams);
     // A browser Surface has no helper; the terminal's goes with the old id.
     closeHelperParent(oldId);
     const newId = generatePaneId();
@@ -1664,7 +1627,6 @@ export function Wall({
     closeSurface,
     revealSurface,
     isClosingWorkspace: useCallback(() => closingWorkspaceRef.current, []),
-    launchBinaryPath,
     workspaceRef: useCallback(() => workspaceRefFor(effectiveWorkspaceId), [effectiveWorkspaceId]),
     // The raw prop, not `effectiveWorkspaceId`: a bare Wall keeps the unscoped
     // agent-browser session names (docs/specs/dor-browser.md → Managed identity).
@@ -1913,23 +1875,6 @@ export function Wall({
 
   // --- Wall actions (for tab buttons) ---
 
-  /** Launch the browser `mode` names at `url` and bind its session to the eager
-   *  Surface `eagerId` (docs/specs/dor-browser.md → Pane Context Menu Connect),
-   *  or close the session when that Surface is gone by then. Answers the
-   *  launch's error, leaving the eager Surface to the caller. */
-  const bindLaunch = useCallback(async (eagerId: string, mode: AutomationRenderMode, url: string, cwd?: string): Promise<string | null> => {
-    const provider = automationProvider(mode)!;
-    const open = browserPlatform(provider, cwd).agentBrowserOpen;
-    if (!open) return `${PROVIDER_LABEL[provider]} is unavailable on this host`;
-    const result = await open(url, { headed: isPopout(mode) }, launchBinaryPath.get(provider));
-    if (!result.ok || !result.session) return result.error ?? `Could not open ${PROVIDER_LABEL[provider]}`;
-    launchBinaryPath.remember(provider, result.binaryPath);
-    const binding = boundBrowserParams(result.session, result, cwd);
-    if (!lath.getMeta(eagerId) || lath.isDying(eagerId)) closeAgentBrowserSession({ renderMode: mode, ...binding });
-    else updateSurfaceParams(eagerId, binding);
-    return null;
-  }, [launchBinaryPath, lath, updateSurfaceParams]);
-
   const wallActions: WallActions = useMemo(() => ({
     onKill: (id: string) => {
       // The confirm keystroke must reach the Wall, not the pane's xterm.
@@ -2039,28 +1984,11 @@ export function Wall({
         const url = browserUrlFromParams(params);
         const platform = getPlatform();
         if (!url || (mode === 'ab-screencast' && !platform.agentBrowserOpen)) return;
-        closeAgentBrowserSession(params);
-        disposeAgentBrowserSurfaceController(id);
-        lath.store.updateParams(id, {
-          toolRender: mode, renderMode: mode, url,
-          session: undefined, wsPort: undefined, syncEngaged: mode === 'ab-screencast',
-        });
-        if (mode === 'ab-screencast') {
-          const runId = getTerminalPaneState(id).currentCommand?.id;
-          void platform.agentBrowserOpen!(url, {}, launchBinaryPath.get('agent-browser')).then(result => {
-            const current = lath.getMeta(id)?.params;
-            if (!current || lath.isDying(id) || current.renderMode !== mode || current.url !== url || getTerminalPaneState(id).currentCommand?.id !== runId) {
-              if (result.session) closeAgentBrowserSession({ renderMode: mode, session: result.session, binaryPath: result.binaryPath });
-              return;
-            }
-            if (result.ok && result.session) {
-              lath.store.updateParams(id, { session: result.session, wsPort: result.wsPort, binaryPath: result.binaryPath });
-            } else lath.store.updateParams(id, { toolRender: 'iframe', renderMode: 'iframe', syncEngaged: false });
-          }).catch(() => {
-            const current = lath.getMeta(id)?.params;
-            if (current?.renderMode === mode && current.url === url && !current.session) lath.store.updateParams(id, { toolRender: 'iframe', renderMode: 'iframe', syncEngaged: false });
-          });
-        }
+        closeBrowserSurface(id, params);
+        // The Tool's browser launches itself, in the Tool's own session.
+        lath.store.updateParams(id, mode === 'ab-screencast'
+          ? { toolRender: mode, syncEngaged: true, ...toolBrowserLaunchParams(id, params ?? {}, url) }
+          : { toolRender: mode, renderMode: mode, url, session: undefined, launchSession: undefined, launchFallback: undefined, syncEngaged: false });
         return;
       }
 
@@ -2080,17 +2008,12 @@ export function Wall({
       }
 
       // iframe or the other provider → a live automated browser (screencast or
-      // popout): the host must spawn a session for the URL (absent ⇒ inert, like
-      // other host-gated affordances). A popout spawns headed directly so the new
-      // surface mounts already popped-out (no headless launch + immediate
-      // relaunch flash).
-      //
-      // The swap lands NOW: the old renderer is replaced by a session-less
-      // automated pane — inert, so it cannot race the daemon boot — whose
-      // placeholder names what it is waiting for, and the daemon hands it
-      // `{session, wsPort, binaryPath}` as one params refresh. Same shape as the
-      // pane context menu's connect (docs/specs/dor-browser.md → "Pane Context
-      // Menu Connect").
+      // popout): absent a host that can launch one, inert like other
+      // host-gated affordances. The swap lands NOW: the old renderer is
+      // replaced by a session-less automated pane, whose controller launches
+      // the browser at the URL — headed for a popout, so it mounts already
+      // popped out — and binds the session it answers with
+      // (docs/specs/dor-browser.md → "Display Modal And Render Swaps").
       const provider = automationProvider(mode);
       const currentProvider = automationProvider(currentRenderMode);
       if (currentRenderMode !== null && provider !== null && provider !== currentProvider) {
@@ -2102,7 +2025,6 @@ export function Wall({
         // a real Chromium tab — which `dor ab open` refuses at the CLI
         // (`normalizeConcreteOpenUrl`). Same guard, so both sinks agree.
         const cwd = typeof params?.cwd === 'string' ? params.cwd : undefined;
-        const platform = browserPlatform(provider, cwd);
         // `browserSurfaceUrl('')` is already null (normalizeNavUrl returns ''
         // for empty input), so one branch covers both dead ends — and warning
         // matches the ab-* -> iframe branch above, whose own no-URL refusal is
@@ -2113,65 +2035,23 @@ export function Wall({
           console.warn(`[dormouse] cannot swap surface '${id}' to ${PROVIDER_LABEL[provider]}: ${why}`);
           return;
         }
-        if (!platform.agentBrowserOpen) return;
-        const headed = isPopout(mode);
-        const title = hostPathDisplay(url, true);
-        const eagerId = replaceSurface(id, {
-          params: { surfaceType: 'browser', renderMode: mode, url, cwd, syncEngaged: true },
-          title,
-        });
-        if (!eagerId) return;
-        const eagerDoorExists = () => doorsRef.current.some((door) => door.id === eagerId);
-        const eagerSurfaceExists = () => (
-          !!lath.getMeta(eagerId) && (lath.store.has(eagerId) || eagerDoorExists())
-        );
-        const restorePrevious = () => {
-          if (lath.isDying(eagerId)) return;
-          const previousParams = { ...params, surfaceType: 'browser', renderMode: currentRenderMode, url, session: undefined, wsPort: undefined };
-          let restored: string | undefined;
-          if (lath.store.has(eagerId)) {
-            restored = replaceSurface(eagerId, { params: previousParams, title }) ?? undefined;
-          } else if (eagerDoorExists() && lath.getMeta(eagerId)) {
-            disposeAgentBrowserSurfaceController(eagerId);
-            lath.store.updateParams(eagerId, previousParams);
-            lath.store.setTitle(eagerId, title);
-            restored = eagerId;
-          }
-          // Back to the iframe, or relaunch the previous provider's browser.
-          if (!restored || !currentProvider) return;
-          const restoredId = restored;
-          const previousBinaryPath = typeof params?.binaryPath === 'string' ? params.binaryPath : undefined;
-          void browserPlatform(currentProvider, cwd)
-            .agentBrowserOpen?.(url, { headed: isPopout(currentRenderMode) }, previousBinaryPath)
-            .then((r) => {
-              if (!r.session) return;
-              const bound = boundBrowserParams(r.session, r, cwd);
-              if (r.ok && lath.getMeta(restoredId) && !lath.isDying(restoredId)) updateSurfaceParams(restoredId, bound);
-              else closeAgentBrowserSession({ renderMode: currentRenderMode, ...bound });
-            })
-            .catch((error) => console.warn('[dormouse] could not restore browser provider:', error));
+        if (!browserPlatform(provider, cwd).agentBrowserOpen) return;
+        // A browser that cannot come up gives the previous renderer back in
+        // place, even minimized meanwhile, at the URL: the embed, or the
+        // previous provider reopened in its own session, so its key and handle
+        // still name it.
+        const previousSession = agentBrowserSessionFromParams(params);
+        const restore = {
+          ...params,
+          surfaceType: 'browser',
+          renderMode: currentRenderMode,
+          url,
+          session: undefined,
+          ...(previousSession ? { launchSession: previousSession } : {}),
         };
-        platform.agentBrowserOpen(url, { headed }, launchBinaryPath.get(provider)).then((res) => {
-          if (!res.ok || !res.session) {
-            console.warn(`[dormouse] failed to swap surface '${id}' to ${PROVIDER_LABEL[provider]}:`, res.error ?? '(no session)');
-            // Nothing came up to bind: give the iframe back if the eager Surface
-            // still exists, whether it is visible or minimized meanwhile.
-            restorePrevious();
-            return;
-          }
-          launchBinaryPath.remember(provider, res.binaryPath);
-          const bound = boundBrowserParams(res.session, res, cwd);
-          // A Door is a retained Surface even though it is outside the visible
-          // tree. Close only when the eager Surface was genuinely destroyed (or
-          // its visible pane is mid-fade); otherwise hand the session to its meta.
-          if (!eagerSurfaceExists() || lath.isDying(eagerId)) {
-            closeAgentBrowserSession({ renderMode: mode, ...bound });
-            return;
-          }
-          updateSurfaceParams(eagerId, bound);
-        }).catch((err) => {
-          console.warn(`[dormouse] failed to swap surface '${id}' to ${PROVIDER_LABEL[provider]}:`, err);
-          restorePrevious();
+        replaceSurface(id, {
+          params: { surfaceType: 'browser', renderMode: mode, url, cwd, syncEngaged: true, launchFallback: { restore } satisfies LaunchFallback },
+          title: hostPathDisplay(url, true),
         });
       }
     },
@@ -2182,27 +2062,40 @@ export function Wall({
       const reference = buildDorSurfaces().find((s) => s.id === id);
       if (!reference) return;
       const agentBrowser = !!iframeRefusal(url) && !!getPlatform().agentBrowserOpen;
-      const created = createContentSurface({
+      createContentSurface({
         minimized: false,
+        // A launch that fails takes its pane with it.
         params: agentBrowser
-          ? { surfaceType: 'browser', renderMode: 'ab-screencast', url, syncEngaged: true }
+          ? { surfaceType: 'browser', renderMode: 'ab-screencast', url, syncEngaged: true, launchFallback: 'close' satisfies LaunchFallback }
           : { surfaceType: 'browser', renderMode: 'iframe', url },
         reference,
         title: hostPathDisplay(url, true),
       });
-      if (!agentBrowser || !created.ok) return;
-      const eagerId = created.value.id;
-      void bindLaunch(eagerId, 'ab-screencast', url).catch(messageOf).then((failure) => {
-        if (!failure) return;
-        console.warn(`[dormouse] could not open ${url} in agent-browser:`, failure);
-        if (lath.getMeta(eagerId) && !lath.isDying(eagerId)) void closeSurfaceRef.current(eagerId, 'silent');
-      });
+    },
+    onBrowserLaunchFailed: (id, error) => {
+      // The one liveness check every creator's fallback shares.
+      const params = lath.getMeta(id)?.params;
+      const fallback = launchFallbackFromParams(params);
+      if (!fallback || lath.isDying(id) || isSurfaceClosing(id)) return;
+      console.warn(`[dormouse] browser surface '${id}' could not launch:`, error);
+      if (fallback === 'close') {
+        void closeSurfaceRef.current(id, 'silent');
+        return;
+      }
+      // The failed controller goes; the pane stays, as the embed or the
+      // renderer the swap replaced.
+      void closeBrowserSurface(id, params);
+      if (fallback === 'embed') {
+        lath.store.updateParams(id, { toolRender: 'iframe', renderMode: 'iframe', syncEngaged: false, launchSession: undefined, launchFallback: undefined });
+      } else {
+        lath.store.setMeta(id, browserLeafMeta(hostPathDisplay(browserUrlFromParams(fallback.restore) ?? '', true), fallback.restore));
+      }
     },
     resolveSurfaceRef: surfaceRefForId,
     onResolveToolApproval: (id: string, choice: 'upstream' | 'folder' | 'decline' | 'retry') => {
       void resolveToolApproval(id, choice);
     },
-  }), [addSplitPanel, minimizePane, enterTerminalMode, exitTerminalMode, requestKill, replaceSurface, buildDorSurfaces, createContentSurface, surfaceRefForId, updateSurfaceParams, resolveToolApproval, bindLaunch, lath, nav]);
+  }), [addSplitPanel, minimizePane, enterTerminalMode, exitTerminalMode, requestKill, replaceSurface, buildDorSurfaces, createContentSurface, surfaceRefForId, resolveToolApproval, lath, nav]);
   const contextPortLaunches = useRef(new Map<string, Promise<void>>());
   const openContextPort = useCallback(async (id: string, entry: PortUrlEntry, mode: PortMode): Promise<void> => {
     if (mode === 'system') { getPlatform().openExternal?.(entry.url); return; }
@@ -2221,28 +2114,31 @@ export function Wall({
       const existing = findSurfaceByParams(params => (params as { contextPortKey?: unknown } | undefined)?.contextPortKey === key);
       if (existing) {
         revealSurface(existing.id);
-        if (mode !== 'iframe') {
-          const controller = getAgentBrowserScreenController(existing.id);
-          controller?.actions.setRenderMode?.(mode);
-          controller?.chromeActions.navigate(entry.url);
-        } else updateSurfaceParams(existing.id, { url: entry.url });
+        // One intent: a pop-out/pop-in relaunch opens the URL rather than
+        // racing a navigation into its close/reopen gap — reaching the
+        // Surface's controller even before a revealed Door mounts it.
+        if (mode !== 'iframe') requestBrowserRenderMode(existing.id, lath.getMeta(existing.id)?.params ?? {}, mode, { url: entry.url });
+        else updateSurfaceParams(existing.id, { url: entry.url });
         return;
       }
       if (provider && !platform?.agentBrowserOpen) throw new Error(`${PROVIDER_LABEL[provider]} is unavailable on this host`);
       const created = createContentSurface({ minimized: false, reference, preserveSource: true,
-        params: { surfaceType: 'browser', renderMode: mode, url: entry.url, cwd, syncEngaged: true, contextPortKey: key }, title: hostPathDisplay(entry.url, true) });
+        params: {
+          surfaceType: 'browser', renderMode: mode, url: entry.url, cwd, syncEngaged: true, contextPortKey: key,
+          // The pane launches its own browser; a failure takes it along.
+          ...(provider ? { launchFallback: 'close' satisfies LaunchFallback } : {}),
+        },
+        title: hostPathDisplay(entry.url, true) });
       if (!created.ok) throw new Error(created.message);
+      const launched = mode === 'iframe' ? null : whenBrowserLaunched(created.value.id);
       enterTerminalMode(created.value.id);
-      if (mode === 'iframe') return;
-      const failure = await bindLaunch(created.value.id, mode, entry.url, cwd);
-      if (failure) {
-        await closeSurface(created.value.id);
-        throw new Error(failure);
-      }
+      // Reported in context.
+      const failure = await launched;
+      if (failure) throw new Error(failure);
     })();
     contextPortLaunches.current.set(key, operation);
     try { await operation; } finally { contextPortLaunches.current.delete(key); }
-  }, [buildDorSurfaces, findSurfaceByParams, createContentSurface, enterTerminalMode, closeSurface, bindLaunch, revealSurface, updateSurfaceParams]);
+  }, [buildDorSurfaces, findSurfaceByParams, createContentSurface, enterTerminalMode, revealSurface, updateSurfaceParams, lath]);
   const contextActions = useMemo(() => ({
     id: contextSourceId,
     mounted: terminalContext,
@@ -2278,7 +2174,7 @@ export function Wall({
   // Engine-directed writes for the pane props contract (docs/specs/tiling-engine.md
   // → "Pane props contract"): route a pane/header's title / params writes to the
   // engine's per-leaf metadata. Memoized so the sink handed to panels via context
-  // keeps a stable identity. The render-swap and wsPort-refresh param writes in
+  // keeps a stable identity. The render-swap and binary-refresh param writes in
   // Wall.tsx above route through the same engine.
   const paneWrite = useMemo<PaneWriteActions>(() => ({
     setTitle: (id, title) => lath.store.setTitle(id, title),
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index cdbf781b7..fde24393e 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -579,7 +579,7 @@ describe('WorkspaceWindow', () => {
       });
     });
     await flush();
-    expect(playwright).toHaveBeenCalledWith(expect.objectContaining({ op: 'streamStatus', session: 'late' }));
+    expect(playwright).toHaveBeenCalledWith(expect.objectContaining({ op: 'attach', session: 'late' }));
     await act(async () => { expect(await handle.closeAll('silent')).toBeNull(); });
     await act(async () => status.resolve({ ok: true, wsPort: 4321, headed: false }));
     await flush();
diff --git a/lib/src/components/wall/AgentBrowserPanel.test.tsx b/lib/src/components/wall/AgentBrowserPanel.test.tsx
index c5374ca16..603515449 100644
--- a/lib/src/components/wall/AgentBrowserPanel.test.tsx
+++ b/lib/src/components/wall/AgentBrowserPanel.test.tsx
@@ -5,15 +5,18 @@ import { act, StrictMode } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { FakePtyAdapter, setPlatform } from '../../lib/platform';
-import type { AgentBrowserPopResult, AgentBrowserStreamStatusResult, PlatformAdapter } from '../../lib/platform/types';
+import type { AgentBrowserPopResult, AgentBrowserAttachResult, PlatformAdapter } from '../../lib/platform/types';
 import type { PaneProps } from './pane-props';
 import { AgentBrowserPanel, HIDDEN_PARK_DELAY_MS } from './AgentBrowserPanel';
 import { getAgentBrowserScreenController } from './agent-browser-screen';
 import {
+  closeBrowserSurface,
   disposeAgentBrowserSurfaceController,
   disposeAllAgentBrowserSurfaceControllers,
   getAgentBrowserSurfaceController,
+  handOverBrowserPort,
 } from './agent-browser-surface-controller';
+import type { RenderMode } from './agent-browser-screen';
 import { ModeContext, PaneWriteContext, SelectedIdContext, WallActionsContext, WorkspaceActiveContext, type PaneWriteActions } from './wall-context';
 import { stubWallActions as stubActions } from './wall-test-utils';
 
@@ -39,7 +42,9 @@ class ResizeObserverMock {
 
 
 function paneProps(id: string, params: TestPanelParams = DEFAULT_PARAMS): PaneProps {
-  return { id, title: 'Browser', params };
+  const props = { id, title: 'Browser', params };
+  handOverFixturePort(props);
+  return props;
 }
 
 // The panel's title/param writes route through PaneWriteContext now; forward
@@ -96,11 +101,23 @@ afterEach(() => {
   // 'ab-panel', so release them or the next test would reuse a stale controller
   // bound to old platform mocks.
   disposeAllAgentBrowserSurfaceControllers();
+  handedOver.clear();
   container.remove();
   vi.restoreAllMocks();
   setPlatform(new FakePtyAdapter());
 });
 
+// `dor` hands a stream port straight to the Surface's controller, never
+// through params. These fixtures carry it in their params, so hand each new one
+// over the way the Wall does, with the params the command refreshed.
+const handedOver = new Map<string, number>();
+function handOverFixturePort({ id, params }: PaneProps): void {
+  const fixture = params as TestPanelParams | undefined;
+  if (fixture?.wsPort === undefined || handedOver.get(id) === fixture.wsPort) return;
+  handedOver.set(id, fixture.wsPort);
+  handOverBrowserPort(id, { ...fixture, renderMode: fixture.renderMode as RenderMode | undefined }, fixture.wsPort);
+}
+
 async function renderPanel(
   props: PaneProps = paneProps('ab-panel'),
   updateParameters: (patch: Record<string, unknown>) => void = () => {},
@@ -149,14 +166,14 @@ describe('AgentBrowserPanel render mode controller', () => {
       ok: true,
       wsPort: 3456,
     }));
-    const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async (): Promise<AgentBrowserStreamStatusResult> => ({
+    const attach = vi.fn<PlatformAdapter['agentBrowserAttach']>(async (): Promise<AgentBrowserAttachResult> => ({
       ok: true,
       wsPort: 1234,
     }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopOut' | 'agentBrowserStreamStatus'>;
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopOut' | 'agentBrowserAttach'>;
     platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
     platform.agentBrowserPopOut = popOut;
-    platform.agentBrowserStreamStatus = streamStatus;
+    platform.agentBrowserAttach = attach;
     setPlatform(platform);
 
     await renderPanel(paneProps('ab-panel'), updateParameters);
@@ -178,10 +195,10 @@ describe('AgentBrowserPanel render mode controller', () => {
       ok: true,
       wsPort: 4567,
     }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopIn' | 'agentBrowserStreamStatus'>;
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopIn' | 'agentBrowserAttach'>;
     platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
     platform.agentBrowserPopIn = popIn;
-    platform.agentBrowserStreamStatus = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
+    platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
     setPlatform(platform);
 
     await renderPanel(
@@ -206,10 +223,10 @@ describe('AgentBrowserPanel render mode controller', () => {
       ok: true,
       wsPort: 4567,
     }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopIn' | 'agentBrowserStreamStatus'>;
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopIn' | 'agentBrowserAttach'>;
     platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
     platform.agentBrowserPopIn = popIn;
-    platform.agentBrowserStreamStatus = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
+    platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
     setPlatform(platform);
 
     await renderPanel(
@@ -241,9 +258,9 @@ describe('AgentBrowserPanel render mode controller', () => {
 
   it('mirrors popped-out stream tab URL updates when the stream reports id instead of tabId', async () => {
     const updateParameters = vi.fn();
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserStreamStatus'>;
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserAttach'>;
     platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
-    platform.agentBrowserStreamStatus = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
+    platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
     setPlatform(platform);
 
     await renderPanel(
@@ -269,12 +286,12 @@ describe('AgentBrowserPanel render mode controller', () => {
 
   it('mirrors popped-out manual navigation from CDP target events', async () => {
     const updateParameters = vi.fn();
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserStreamStatus'>;
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserAttach'>;
     platform.agentBrowserCommand = vi.fn(async (_session, args) => {
       if (args.join(' ') === 'get cdp-url') return { exitCode: 0, stdout: 'ws://127.0.0.1:9222/devtools/browser/test', stderr: '' };
       return { exitCode: 0, stdout: '', stderr: '' };
     });
-    platform.agentBrowserStreamStatus = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
+    platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 1234 }));
     setPlatform(platform);
 
     await renderPanel(
@@ -421,30 +438,6 @@ describe('AgentBrowserPanel render mode controller', () => {
     expect(getAgentBrowserScreenController('ab-panel')?.chrome().url).toBe('https://github.com/diffplug/dormouse');
   });
 
-  it('does not recover a stale port through stream status after that port opened live', async () => {
-    const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async (): Promise<AgentBrowserStreamStatusResult> => ({
-      ok: true,
-      wsPort: 2222,
-    }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus'>;
-    platform.agentBrowserStreamStatus = streamStatus;
-    setPlatform(platform);
-
-    await renderPanel(paneProps('ab-panel', { surfaceType: 'browser', session: 'browser-session', wsPort: 1111 }));
-
-    await act(async () => {
-      await Promise.resolve();
-    });
-    streamStatus.mockClear();
-
-    await act(async () => {
-      WebSocketMock.instances.at(-1)?.emitMessage(JSON.stringify({ type: 'status', connected: false, screencasting: false }));
-      await Promise.resolve();
-    });
-
-    expect(streamStatus).not.toHaveBeenCalled();
-  });
-
   it('swaps straight to iframe with no extra tabs (no confirm gate)', async () => {
     const onSwapRenderMode = vi.fn();
     await act(async () => {
@@ -573,7 +566,8 @@ describe('AgentBrowserPanel across a provider change', () => {
     withBothProviders();
     await renderPanel(paneProps('swap-panel', pw));
     const failed = getAgentBrowserSurfaceController('swap-panel')!;
-    await renderPanel(paneProps('swap-panel', ab));
+    // No port handover, which would acquire the controller itself.
+    await renderPanel(paneProps('swap-panel', { ...ab, wsPort: undefined }));
     await act(async () => { await Promise.resolve(); });
     expect(getAgentBrowserSurfaceController('swap-panel')).not.toBe(failed);
     expect(getAgentBrowserScreenController('swap-panel')?.snapshot().renderMode).toBe('ab-screencast');
@@ -582,6 +576,31 @@ describe('AgentBrowserPanel across a provider change', () => {
   });
 });
 
+describe('AgentBrowserPanel after its controller is released', () => {
+  it('takes a fresh controller for the params that follow, and none for the release alone', async () => {
+    const attach = vi.fn<PlatformAdapter['agentBrowserAttach']>(async () => ({ ok: true, wsPort: 4402 }));
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserAttach'>;
+    platform.agentBrowserAttach = attach;
+    platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
+    setPlatform(platform);
+    const first = { surfaceType: 'browser', renderMode: 'ab-screencast', session: 'first-run', wsPort: 4400 };
+    await renderPanel(paneProps('released-panel', first));
+    const released = getAgentBrowserSurfaceController('released-panel');
+
+    // A kill releases it as the pane starts to fade: nothing comes back.
+    await act(async () => { await closeBrowserSurface('released-panel', first); });
+    expect(getAgentBrowserSurfaceController('released-panel')).toBeNull();
+
+    // A Tool's next run names a new session on the same Surface.
+    await renderPanel(paneProps('released-panel', { surfaceType: 'browser', renderMode: 'ab-screencast', session: 'next-run' }));
+    await act(async () => { await Promise.resolve(); });
+    const next = getAgentBrowserSurfaceController('released-panel');
+    expect(next).not.toBeNull();
+    expect(next).not.toBe(released);
+    expect(attach).toHaveBeenCalledWith('next-run', expect.anything(), undefined);
+  });
+});
+
 describe('AgentBrowserPanel visibility parking', () => {
   // Three things hide a surface (`useSurfaceVisibility`): a backgrounded window,
   // a hidden Workspace, and a PARKED leaf — minimized, so mounted but out of the
@@ -698,26 +717,6 @@ describe('AgentBrowserPanel visibility parking', () => {
     expect(liveStreamSocket(4321)?.readyState).toBe(1);
   });
 
-  it('never queries stream status while parked', async () => {
-    const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async () => ({ ok: false }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus'>;
-    platform.agentBrowserStreamStatus = streamStatus;
-    setPlatform(platform);
-
-    // No wsPort ⇒ the stale-port recovery effect is the code path that would
-    // query the daemon; the parked guard must suppress it.
-    const { setVisible } = await renderVisibilityPanel({
-      surfaceType: 'browser', session: 'browser-session',
-    });
-    await act(async () => { await vi.advanceTimersByTimeAsync(0); });
-    streamStatus.mockClear();
-
-    await act(async () => { setVisible(false); });
-    await act(async () => { await vi.advanceTimersByTimeAsync(HIDDEN_PARK_DELAY_MS + 50); });
-
-    expect(streamStatus).not.toHaveBeenCalled();
-  });
-
   it('reconnects and repaints from the stream when it becomes visible again', async () => {
     const screenshot = vi.fn(async () => ({ ok: false as const, error: 'test' }));
     const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserScreenshot'>;
diff --git a/lib/src/components/wall/AgentBrowserPanel.tsx b/lib/src/components/wall/AgentBrowserPanel.tsx
index 77a9d3b8c..71f96927c 100644
--- a/lib/src/components/wall/AgentBrowserPanel.tsx
+++ b/lib/src/components/wall/AgentBrowserPanel.tsx
@@ -7,7 +7,7 @@ import { isEditableTarget } from '../../lib/dom';
 import type { RenderMode } from './agent-browser-screen';
 import { tabDisplayTitle } from './browser-url';
 import { resolveRenderMode } from './browser-surface';
-import { automationCli, automationProvider } from './browser-automation';
+import { automationCli, surfaceProvider } from './browser-automation';
 import { MOUSE_BUTTONS, MOUSE_BUTTON_MASKS, modifiers } from './agent-browser-input';
 import {
   acquireAgentBrowserSurfaceController,
@@ -45,7 +45,7 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
   usePaneChrome(id, elRef);
 
   const session = params?.session;
-  const wsPort = params?.wsPort;
+  const launchSession = params?.launchSession;
   const binaryPath = params?.binaryPath;
   const url = params?.url;
   const key = params?.key;
@@ -54,26 +54,28 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
   // poppedOut is derived from the canonical renderMode the shell passes; fall
   // back to resolving it from params for a direct mount (tests) / legacy blob.
   const seededMode = renderModeProp ?? resolveRenderMode(params);
-  const provider = automationProvider(seededMode) ?? 'agent-browser';
+  const provider = surfaceProvider(seededMode);
   const cli = automationCli(provider);
 
   // The surface-scoped controller: get-or-create, keyed by surface id. Survives
   // this component's unmount (minimize, layout churn, StrictMode). Keyed by
   // provider too: a minimized pane keeps this view mounted while its Wall
-  // restores a failed cross-provider swap in place, disposing the controller
-  // it held, and the restored provider needs its own. A same-provider disposal
-  // only ever precedes the pane going away (a kill's fade), where re-acquiring
-  // would leave a live controller behind for a dead Surface.
+  // restores a failed cross-provider swap in place, and the restored provider
+  // needs its own. One released under this view is replaced when params next
+  // change (`generation`), never on the release itself: a kill releases it as
+  // the pane starts to fade, where re-acquiring would leave a live controller
+  // behind for a dead Surface.
+  const [generation, setGeneration] = useState(0);
   const controller = useMemo(
     () => acquireAgentBrowserSurfaceController(id, { ...params, renderMode: seededMode }),
     // Later param changes flow through updateParams below (acquire is
     // get-or-create and ignores params when the controller already exists).
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [id, provider],
+    [id, provider, generation],
   );
 
   const snapshot = useSyncExternalStore(controller.subscribe, controller.snapshot);
-  const { tabs, status, connectionLost, hasFrame, poppedOut, relaunching, streamPort } = snapshot;
+  const { tabs, status, hasFrame, poppedOut, phase, error } = snapshot;
 
   // Gated on the same Workspace-aware visibility the streaming body reads, so a
   // Workspace left in passthrough on a browser pane stops forwarding (and
@@ -99,8 +101,9 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
   // one only for Playwright, whose native `open` can change headedness outside
   // Dormouse (`followParamsHeadedness`).
   useEffect(() => {
-    controller.updateParams({ session, wsPort, binaryPath, url, syncEngaged, key, cwd, renderMode: seededMode });
-  }, [controller, session, wsPort, binaryPath, url, syncEngaged, key, cwd, seededMode]);
+    if (controller.released) setGeneration((current) => current + 1);
+    else controller.updateParams({ session, launchSession, binaryPath, url, syncEngaged, key, cwd, renderMode: seededMode });
+  }, [controller, session, launchSession, binaryPath, url, syncEngaged, key, cwd, seededMode]);
 
   // Lend the controller this view's live DOM bindings. Last attach wins; the
   // detach is identity-guarded inside the controller so a stale StrictMode
@@ -120,6 +123,7 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
         if (controller.snapshot().tabs.length >= 2) setPendingRenderSwap(mode);
         else actionsRef.current.onSwapRenderMode(id, mode);
       },
+      launchFailed: (error) => actionsRef.current.onBrowserLaunchFailed?.(id, error),
     });
     return () => handle.detach();
     // The sink closes over `paneWrite` + `id`, both stable for a mounted pane
@@ -321,20 +325,27 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
 
   // --- placeholder state (derived from the snapshot) ---
 
+  // The browser is on its way — a launch, an attach, or a relaunch whose new
+  // stream is not yet known — not a session that ended.
+  const opening = phase === 'idle' || phase === 'launching' || phase === 'attaching' || phase === 'relaunching';
   const placeholder = (() => {
-    // Session-less: the pane context menu's eager connect pane, on screen before
-    // the daemon boots (docs/specs/dor-browser.md → Pane Context Menu Connect).
-    // It is mid-boot, not idle — telling the user to run `dor ab open` here would
-    // ask them to redo the click they just made.
-    if (!session) return 'Connecting to browser session…';
+    // Mid-launch: the pane is on screen before its browser is up. It is
+    // mid-boot, not idle — telling the user to run `dor ab open` here would ask
+    // them to redo the click they just made.
+    if (phase === 'launching') return 'Opening the browser…';
     // Mid pop-in: the headed browser is closed by design and the headless one
     // is booting — not a session that ended.
-    if (relaunching) return 'Relaunching browser…';
+    if (phase === 'relaunching') return 'Relaunching browser…';
     // Addressed to this pane: a bare `dor ab open` drives the caller's default
     // key, which for a keyed or GUI-launched pane is some other browser.
     const command = `${cli} --surface ${actions.resolveSurfaceRef(id)} open <url>`;
-    if (!streamPort) return `Waiting for the browser — run ${command}`;
-    if (connectionLost || status?.connected === false) {
+    // A pane whose launch never named a session has no browser to drive yet.
+    if (phase === 'ended' && error) {
+      return session
+        ? `The browser could not be opened (${error}) — run ${command} to retry, or close this surface.`
+        : `The browser could not be opened (${error}).`;
+    }
+    if (phase === 'ended') {
       return `The browser session ended — run ${command} to restart it, or close this surface.`;
     }
     if (!hasFrame) {
@@ -400,14 +411,14 @@ export function AgentBrowserPanel({ id, params: rawParams, parked, renderMode: r
             if (interactiveRef.current) e.preventDefault();
           }}
         />
-        {poppedOut ? (
+        {poppedOut && phase !== 'ended' ? (
           // Popped out to a headed OS window — the pane is a clean stub. While
-          // the window is still being opened (a relaunch in flight, or an eager
-          // swap whose daemon has not yet named its session) there is nothing to
-          // pop back in, so the affordance waits with it.
+          // the window is still being opened (a launch, attach or relaunch in
+          // flight) there is nothing to pop back in, so the affordance waits
+          // with it.
           <div className="flex flex-col items-center gap-3 px-4 text-center text-sm text-muted">
-            <div>{!session || relaunching ? 'Opening the browser window…' : 'This browser is running in a separate window.'}</div>
-            {session && !relaunching && <div className="flex gap-2 text-xs">
+            <div>{opening ? 'Opening the browser window…' : 'This browser is running in a separate window.'}</div>
+            {!opening && <div className="flex gap-2 text-xs">
               <button
                 type="button"
                 onMouseDown={(e) => e.stopPropagation()}
diff --git a/lib/src/components/wall/BrowserPanel.tsx b/lib/src/components/wall/BrowserPanel.tsx
index 72b19aaca..36b3f59f2 100644
--- a/lib/src/components/wall/BrowserPanel.tsx
+++ b/lib/src/components/wall/BrowserPanel.tsx
@@ -25,9 +25,13 @@ export type BrowserPanelParams = {
   url?: string;
   cwd?: string;
   nativeIdentity?: string;
+  /** Bound once the browser is up; absent while the Surface's controller
+   *  launches it (docs/specs/dor-browser.md → "Agent-Browser Connection"). */
   session?: string;
+  /** With no `session`, the one the launch opens `url` in: a Tool's own, or
+   *  the previous provider's when a failed swap restores it. */
+  launchSession?: string;
   key?: string;
-  wsPort?: number;
   binaryPath?: string;
   syncEngaged?: boolean;
   /** Set only on a Surface the pane context menu opened for a port, as
diff --git a/lib/src/components/wall/agent-browser-connection.ts b/lib/src/components/wall/agent-browser-connection.ts
index 6f2a53a5f..41575b5aa 100644
--- a/lib/src/components/wall/agent-browser-connection.ts
+++ b/lib/src/components/wall/agent-browser-connection.ts
@@ -52,9 +52,7 @@ export interface AgentBrowserSnapshot {
   streamPort: number;
   tabs: AgentBrowserTab[];
   status: AgentBrowserStreamStatus | null;
-  connectionLost: boolean;
   lastError?: string;
-  livePortOpened: boolean;
 }
 
 export type AgentBrowserConnectionEvent =
@@ -131,8 +129,6 @@ export class AgentBrowserConnection {
       streamPort: deps.streamPort,
       tabs: [],
       status: null,
-      connectionLost: false,
-      livePortOpened: false,
     };
     this.connect();
   }
@@ -203,7 +199,7 @@ export class AgentBrowserConnection {
     this.socket = new WebSocket(wsUrl);
     this.socket.onopen = () => {
       this.failures = 0;
-      this.patch({ connection: 'open', connectionLost: false, livePortOpened: true });
+      this.patch({ connection: 'open' });
       this.log(`[ab-panel] stream open ${JSON.stringify({ wsPort: this.deps.streamPort })}`);
       this.debug('open');
       this.emit({ type: 'connection-open', port: this.deps.streamPort });
@@ -224,7 +220,7 @@ export class AgentBrowserConnection {
       this.lastTabsSig = '';
       if (this.disposed) return;
       this.failures += 1;
-      if (this.failures >= 3) this.patch({ connection: 'failed', connectionLost: true });
+      if (this.failures >= 3) this.patch({ connection: 'failed' });
       else this.patch({ connection: 'closed' });
       const data = { wsPort: this.deps.streamPort, failures: this.failures, code: ev.code, reason: ev.reason, wasClean: ev.wasClean };
       this.log(`[ab-panel] stream close ${JSON.stringify(data)}`);
@@ -315,7 +311,7 @@ export class AgentBrowserConnection {
         ...(typeof msg.viewportWidth === 'number' ? { viewportWidth: msg.viewportWidth } : {}),
         ...(typeof msg.viewportHeight === 'number' ? { viewportHeight: msg.viewportHeight } : {}),
       };
-      this.patch({ status, connectionLost: msg.connected === false });
+      this.patch({ status });
       this.emit({ type: 'status', status });
     } else if (msg.type === 'tabs' && Array.isArray(msg.tabs)) {
       this.handleTabs(parseAgentBrowserTabs(msg.tabs));
diff --git a/lib/src/components/wall/agent-browser-screen.ts b/lib/src/components/wall/agent-browser-screen.ts
index c8f8b0136..2f21e05ab 100644
--- a/lib/src/components/wall/agent-browser-screen.ts
+++ b/lib/src/components/wall/agent-browser-screen.ts
@@ -50,9 +50,11 @@ export interface ScreenActions {
   /** Swap this surface's render backend in place, preserving the target
    *  (docs/specs/dor-browser.md → "Display Modal And Render Swaps"). This is
    *  the single entry point for every mode, including `popout` (relaunch headed
-   *  — docs/specs/dor-browser.md → "Pop-Out"). Absent until the
-   *  swap is wired; the modal hides its Render section without it. */
-  setRenderMode?(mode: RenderMode): void;
+   *  — docs/specs/dor-browser.md → "Pop-Out"). With `url`, the Surface also
+   *  goes there — a relaunch opens it, so no navigation races the relaunch.
+   *  Absent until the swap is wired; the modal hides its Render section
+   *  without it. */
+  setRenderMode?(mode: RenderMode, opts?: { url?: string }): void;
 }
 
 /** What the browser-chrome header reads about the active tab
diff --git a/lib/src/components/wall/agent-browser-screenshot-loop.test.ts b/lib/src/components/wall/agent-browser-screenshot-loop.test.ts
index fbad286d7..3656bc6d9 100644
--- a/lib/src/components/wall/agent-browser-screenshot-loop.test.ts
+++ b/lib/src/components/wall/agent-browser-screenshot-loop.test.ts
@@ -2,7 +2,7 @@
  * @vitest-environment jsdom
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { FakePtyAdapter, setPlatform } from '../../lib/platform';
+import { FakePtyAdapter, getPlatform, setPlatform } from '../../lib/platform';
 import type { AgentBrowserScreenshotResult, PlatformAdapter } from '../../lib/platform/types';
 import { createScreenshotLoop } from './agent-browser-screenshot-loop';
 
@@ -34,8 +34,7 @@ describe('screenshot loop byte dedup', () => {
     setScreenshot(screenshot);
     const draw = vi.fn();
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
     });
@@ -62,8 +61,7 @@ describe('screenshot loop byte dedup', () => {
     const draw = vi.fn();
     let generation = 0;
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
       getDrawGeneration: () => generation,
@@ -95,8 +93,7 @@ describe('screenshot loop backpressure', () => {
     const draw = vi.fn();
     let provisionalGeneration = 0;
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
       getProvisionalGeneration: () => provisionalGeneration,
@@ -131,8 +128,7 @@ describe('screenshot loop backpressure', () => {
     let provisionalGeneration = 0;
     let provisionalDeadline = 0;
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
       getProvisionalGeneration: () => provisionalGeneration,
@@ -166,8 +162,7 @@ describe('screenshot loop backpressure', () => {
     const draw = vi.fn();
     let provisionalGeneration = 0;
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
       getProvisionalGeneration: () => provisionalGeneration,
@@ -202,8 +197,7 @@ describe('screenshot loop backpressure', () => {
     const draw = vi.fn();
     let provisionalGeneration = 0;
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
       getProvisionalGeneration: () => provisionalGeneration,
@@ -245,8 +239,7 @@ describe('screenshot loop behind a blocking command', () => {
     setScreenshot(screenshot as unknown as PlatformAdapter['agentBrowserScreenshot']);
     const draw = vi.fn();
     const loop = createScreenshotLoop({
-      getSession: () => 'sess',
-      getBinaryPath: () => undefined,
+      capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null,
       isCapable: () => true,
       draw,
     });
@@ -286,7 +279,7 @@ describe('screenshot loop behind a blocking command', () => {
     const screenshot = vi.fn(() => new Promise<AgentBrowserScreenshotResult>((resolve) => { releases.push(resolve); }));
     setScreenshot(screenshot as unknown as PlatformAdapter['agentBrowserScreenshot']);
     vi.spyOn(console, 'warn').mockImplementation(() => {});
-    const loop = createScreenshotLoop({ getSession: () => 'sess', getBinaryPath: () => undefined, isCapable: () => true, draw: vi.fn() });
+    const loop = createScreenshotLoop({ capture: (opts) => getPlatform().agentBrowserScreenshot?.('sess', opts) ?? null, isCapable: () => true, draw: vi.fn() });
 
     loop.pulse();
     await vi.advanceTimersByTimeAsync(300);
diff --git a/lib/src/components/wall/agent-browser-screenshot-loop.ts b/lib/src/components/wall/agent-browser-screenshot-loop.ts
index c1c0acfa7..164682278 100644
--- a/lib/src/components/wall/agent-browser-screenshot-loop.ts
+++ b/lib/src/components/wall/agent-browser-screenshot-loop.ts
@@ -1,4 +1,4 @@
-import { getPlatform } from '../../lib/platform';
+import type { AgentBrowserScreenshotResult } from '../../lib/platform/types';
 
 // Fast non-cryptographic hash (djb2, xor length) over the raw screenshot bytes —
 // the byte analogue of the connection's frame dedup. A static page the daemon
@@ -11,9 +11,9 @@ function djb2Bytes(bytes: Uint8Array): number {
 }
 
 export interface ScreenshotLoopDeps {
-  getPlatform?: () => Pick<ReturnType<typeof getPlatform>, 'agentBrowserScreenshot'>;
-  getSession: () => string | undefined;
-  getBinaryPath: () => string | undefined;
+  /** Start one host capture, or null when none can be taken now — the
+   *  controller's daemon gate decides. */
+  capture: (opts: { format: 'jpeg'; quality: number }) => Promise<AgentBrowserScreenshotResult> | null;
   isCapable: () => boolean;
   draw: (bitmap: ImageBitmap) => void;
   /** A monotonic draw-target generation. Included in the byte-dedup key so a
@@ -125,19 +125,18 @@ export function createScreenshotLoop(deps: ScreenshotLoopDeps): ScreenshotLoop {
   };
 
   const take = () => {
-    const platform = (deps.getPlatform ?? getPlatform)();
-    const session = deps.getSession();
-    if (!platform.agentBrowserScreenshot || !session) return;
+    const capture = deps.capture({ format: 'jpeg', quality: 85 });
+    if (!capture) return;
     inFlight = true;
     dirty = false;
     const mySeq = ++seq;
     const provisionalAtStart = deps.getProvisionalGeneration?.() ?? 0;
     lastStart = performance.now();
-    deps.log?.(`[agent-browser] screenshot start ${JSON.stringify({ session, seq: mySeq })}`);
+    deps.log?.(`[agent-browser] screenshot start ${JSON.stringify({ seq: mySeq })}`);
     const stalled = () => performance.now() - lastStart > STALL_WARNING_MS;
-    platform.agentBrowserScreenshot(session, { format: 'jpeg', quality: 85 }, deps.getBinaryPath()).then((res) => {
+    capture.then((res) => {
       const elapsedMs = performance.now() - lastStart;
-      deps.log?.(`[agent-browser] screenshot done ${JSON.stringify({ session, seq: mySeq, ok: res.ok, bytes: res.bytes?.byteLength ?? 0, elapsedMs: Math.round(elapsedMs), stalled: stalled(), dirty })}`);
+      deps.log?.(`[agent-browser] screenshot done ${JSON.stringify({ seq: mySeq, ok: res.ok, bytes: res.bytes?.byteLength ?? 0, elapsedMs: Math.round(elapsedMs), stalled: stalled(), dirty })}`);
       avgMs = avgMs * 0.6 + Math.min(elapsedMs, overdueAfterMs()) * 0.4;
       inFlight = false;
       // A provisional stream frame painted during this capture is visibly newer.
@@ -160,7 +159,7 @@ export function createScreenshotLoop(deps: ScreenshotLoopDeps): ScreenshotLoop {
       }
       if (dirty) schedule();
     }).catch((err) => {
-      console.warn(`[agent-browser] screenshot error ${JSON.stringify({ session, seq: mySeq, stalled: stalled() })}:`, err);
+      console.warn(`[agent-browser] screenshot error ${JSON.stringify({ seq: mySeq, stalled: stalled() })}:`, err);
       inFlight = false;
       if (dirty) schedule();
     });
diff --git a/lib/src/components/wall/agent-browser-sessions.test.ts b/lib/src/components/wall/agent-browser-sessions.test.ts
deleted file mode 100644
index 276838408..000000000
--- a/lib/src/components/wall/agent-browser-sessions.test.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { afterEach, describe, expect, it } from 'vitest';
-import {
-  clearAgentBrowserSessionClosed,
-  isAgentBrowserSessionClosed,
-  markAgentBrowserSessionClosed,
-} from './agent-browser-sessions';
-
-afterEach(() => {
-  // Module state is process-global; reset the names this suite touches.
-  clearAgentBrowserSessionClosed('dormouse.1.gui-abc');
-  clearAgentBrowserSessionClosed('dormouse.1.default');
-});
-
-describe('agent-browser session teardown guard', () => {
-  it('reports a session as closed only after it is marked', () => {
-    expect(isAgentBrowserSessionClosed('dormouse.1.gui-abc')).toBe(false);
-    markAgentBrowserSessionClosed('dormouse.1.gui-abc');
-    expect(isAgentBrowserSessionClosed('dormouse.1.gui-abc')).toBe(true);
-  });
-
-  it('clears the mark when a new surface re-takes the session name', () => {
-    // Kill marks the name closed; a later `dor ab` re-creating the same managed
-    // name must clear it so the new surface's auto-revert is live again.
-    markAgentBrowserSessionClosed('dormouse.1.default');
-    expect(isAgentBrowserSessionClosed('dormouse.1.default')).toBe(true);
-    clearAgentBrowserSessionClosed('dormouse.1.default');
-    expect(isAgentBrowserSessionClosed('dormouse.1.default')).toBe(false);
-  });
-
-  it('tracks sessions independently', () => {
-    markAgentBrowserSessionClosed('dormouse.1.gui-abc');
-    expect(isAgentBrowserSessionClosed('dormouse.1.default')).toBe(false);
-    expect(isAgentBrowserSessionClosed('dormouse.1.gui-abc')).toBe(true);
-  });
-});
diff --git a/lib/src/components/wall/agent-browser-sessions.ts b/lib/src/components/wall/agent-browser-sessions.ts
deleted file mode 100644
index 099dd929e..000000000
--- a/lib/src/components/wall/agent-browser-sessions.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Tracks agent-browser sessions Dormouse has *deliberately* closed (a pane kill,
- * or a render-swap away from the screencast/popout backend), so a popped-out
- * surface's auto-revert doesn't resurrect a session that's being torn down.
- *
- * The race (docs/specs/dor-browser.md → "Pop-Out"):
- * killing or swapping a popped-out surface issues `agent-browser … close`, which
- * drops the headed stream. The panel's auto-revert reads that dropped stream as
- * "the user closed the window" and relaunches the session headless — bringing
- * back a session (and process) that was meant to die. Marking the session closed
- * *before* issuing the close lets the auto-revert stand down.
- *
- * A managed session name can be re-created later (e.g. `dor ab` re-opening
- * `dormouse.1.default` after a kill), so a freshly-mounted panel clears the mark
- * for its session — the flag means "this specific live surface is going away,"
- * not "this name is forever dead."
- */
-const closedSessions = new Set<string>();
-
-/** Mark a session as being closed by Dormouse (call before issuing `close`). */
-export function markAgentBrowserSessionClosed(session: string): void {
-  closedSessions.add(session);
-}
-
-/** Clear the mark — a new surface is taking ownership of this session name. */
-export function clearAgentBrowserSessionClosed(session: string): void {
-  closedSessions.delete(session);
-}
-
-/** Whether Dormouse is deliberately tearing this session down right now. */
-export function isAgentBrowserSessionClosed(session: string): boolean {
-  return closedSessions.has(session);
-}
diff --git a/lib/src/components/wall/agent-browser-surface-controller.test.ts b/lib/src/components/wall/agent-browser-surface-controller.test.ts
index a058a03f5..1eb76eeb9 100644
--- a/lib/src/components/wall/agent-browser-surface-controller.test.ts
+++ b/lib/src/components/wall/agent-browser-surface-controller.test.ts
@@ -3,14 +3,20 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { FakePtyAdapter, setPlatform } from '../../lib/platform';
-import type { PlatformAdapter } from '../../lib/platform/types';
+import type { AgentBrowserAttachResult, AgentBrowserOpenResult, AgentBrowserPopResult, PlatformAdapter } from '../../lib/platform/types';
 import { PLAYWRIGHT_TEXT_INPUT_MAX } from '../../lib/platform/browser-automation';
 import { getAgentBrowserScreenController } from './agent-browser-screen';
+import { forgetLaunchBinaryPaths, launchBinaryPath, rememberLaunchBinaryPath } from './browser-automation';
 import {
   HIDDEN_PARK_DELAY_MS,
   PROVISIONAL_INPUT_WINDOW_MS,
   acquireAgentBrowserSurfaceController,
+  closeBrowserSurface,
   disposeAgentBrowserSurfaceController,
+  handOverBrowserPort,
+  whenBrowserLaunched,
+  type AgentBrowserSurfaceController,
+  type AgentBrowserSurfaceParams,
   disposeAllAgentBrowserSurfaceControllers,
   getAgentBrowserSurfaceController,
   type AgentBrowserViewSink,
@@ -63,6 +69,7 @@ function makeSink(): AgentBrowserViewSink & {
   updateParameters: ReturnType<typeof vi.fn>;
   setTitle: ReturnType<typeof vi.fn>;
   requestRenderSwap: ReturnType<typeof vi.fn>;
+  launchFailed: ReturnType<typeof vi.fn>;
 } {
   return {
     canvas: document.createElement('canvas'),
@@ -70,9 +77,22 @@ function makeSink(): AgentBrowserViewSink & {
     updateParameters: vi.fn(),
     setTitle: vi.fn(),
     requestRenderSwap: vi.fn(),
+    launchFailed: vi.fn(),
   };
 }
 
+/** A controller whose first start streams from `port`, as `dor ab` hands
+ *  one over. */
+function withPort(id: string, params: AgentBrowserSurfaceParams, port: number): AgentBrowserSurfaceController {
+  const controller = acquireAgentBrowserSurfaceController(id, params);
+  controller.handOver(port);
+  return controller;
+}
+
+/** The pages a controller opened with a daemon command, in order. */
+const opens = (platform: Pick<PlatformAdapter, 'agentBrowserCommand'>) =>
+  vi.mocked(platform.agentBrowserCommand!).mock.calls.filter(([, args]) => args[0] === 'open').map(([, args]) => args[1]);
+
 const streamSockets = (port: number) =>
   WebSocketMock.instances.filter((ws) => ws.url === `ws://127.0.0.1:${port}`);
 const streamSocket = (port: number) => streamSockets(port).at(-1);
@@ -91,6 +111,7 @@ beforeEach(() => {
 
 afterEach(() => {
   disposeAllAgentBrowserSurfaceControllers();
+  forgetLaunchBinaryPaths();
   vi.restoreAllMocks();
   setPlatform(new FakePtyAdapter());
 });
@@ -115,7 +136,7 @@ describe('registry idempotency', () => {
 
 describe('view attachment', () => {
   it('attach → detach → attach keeps a single connection (StrictMode-safe)', async () => {
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 4321 });
+    const controller = withPort('id', { session: 'sess' }, 4321);
     const first = makeSink();
     const h1 = controller.attachView(first);
     await flushMicrotasks();
@@ -133,7 +154,7 @@ describe('view attachment', () => {
   });
 
   it("a stale handle's detach is a no-op once a newer view has attached", async () => {
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 4321 });
+    const controller = withPort('id', { session: 'sess' }, 4321);
     const first = makeSink();
     const h1 = controller.attachView(first);
     await flushMicrotasks();
@@ -172,7 +193,7 @@ describe('provisional stream paint', () => {
     const sink = makeSink();
     const drawImage = vi.fn();
     sink.canvas.getContext = vi.fn(() => ({ drawImage })) as unknown as typeof sink.canvas.getContext;
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 4321 });
+    const controller = withPort('id', { session: 'sess' }, 4321);
     controller.attachView(sink);
     await flushMicrotasks();
     const frame = async (label: string) => {
@@ -331,7 +352,7 @@ describe('sync-to-pane', () => {
       .map((call) => (call as unknown as [string, string[]])[1])
       .filter((args) => args[0] === 'set' && args[1] === 'viewport');
 
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 4321 });
+    const controller = withPort('id', { session: 'sess' }, 4321);
     controller.attachView(sink);
     await flushMicrotasks();
     // Sync is engaged by default, so attaching sized the browser to the pane.
@@ -356,6 +377,50 @@ describe('sync-to-pane', () => {
   });
 });
 
+describe('sync-to-pane while parked', () => {
+  it('pushes a resize made behind a hidden pane once it is live again', async () => {
+    vi.useFakeTimers();
+    try {
+      const command = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
+      const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserAttach'>;
+      platform.agentBrowserCommand = command;
+      platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 4321 }));
+      setPlatform(platform);
+      const observers: ResizeObserverCallback[] = [];
+      vi.stubGlobal('ResizeObserver', class {
+        constructor(callback: ResizeObserverCallback) { observers.push(callback); }
+        observe() {}
+        disconnect() {}
+      });
+      const sink = makeSink();
+      let size = { width: 800, height: 600 };
+      sink.viewport.getBoundingClientRect = () => ({ ...size }) as DOMRect;
+      const viewports = () => command.mock.calls
+        .map((call) => (call as unknown as [string, string[]])[1])
+        .filter((args) => args[1] === 'viewport');
+
+      const controller = withPort('id', { session: 'sess' }, 4321);
+      controller.attachView(sink);
+      await vi.advanceTimersByTimeAsync(0);
+      controller.setVisible(false);
+      await vi.advanceTimersByTimeAsync(HIDDEN_PARK_DELAY_MS + 50);
+      expect(controller.isParked()).toBe(true);
+
+      size = { width: 1000, height: 700 };
+      observers.at(-1)?.([{ contentRect: { width: 1000, height: 700 } } as ResizeObserverEntry], {} as ResizeObserver);
+      await vi.advanceTimersByTimeAsync(250);
+      expect(viewports().at(-1)).toEqual(['set', 'viewport', '800', '600', '1']);
+
+      // Unparked at the same port: the size it missed still goes out.
+      controller.setVisible(true);
+      await vi.advanceTimersByTimeAsync(0);
+      expect(viewports().at(-1)).toEqual(['set', 'viewport', '1000', '700', '1']);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});
+
 describe('parking', () => {
   beforeEach(() => vi.useFakeTimers());
   afterEach(() => vi.useRealTimers());
@@ -368,7 +433,7 @@ describe('parking', () => {
     // Give the draw path a bitmap so hasFrame can flip true without a real canvas.
     vi.stubGlobal('createImageBitmap', vi.fn(async () => ({ width: 4, height: 4, close: vi.fn() })));
 
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 4321 });
+    const controller = withPort('id', { session: 'sess' }, 4321);
     const sink = makeSink();
     const handle = controller.attachView(sink);
     await vi.advanceTimersByTimeAsync(0);
@@ -404,7 +469,7 @@ describe('re-attach repaint', () => {
       setPlatform(platform);
       vi.stubGlobal('createImageBitmap', vi.fn(async () => ({ width: 4, height: 4, close: vi.fn() })));
 
-      const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 4321 });
+      const controller = withPort('id', { session: 'sess' }, 4321);
       const first = makeSink();
       const h1 = controller.attachView(first);
       await vi.advanceTimersByTimeAsync(0);
@@ -436,9 +501,9 @@ describe('param-write buffering', () => {
 
     // Popped out ⇒ exempt from parking, so a detached (minimized) pane keeps its
     // stream observer and can still record a URL change.
-    const controller = acquireAgentBrowserSurfaceController('id', {
-      session: 'sess', wsPort: 1111, renderMode: 'ab-popout', url: 'https://google.com/',
-    });
+    const controller = withPort('id', {
+      session: 'sess', renderMode: 'ab-popout', url: 'https://google.com/',
+    }, 1111);
     const first = makeSink();
     const handle = controller.attachView(first);
     await flushMicrotasks();
@@ -460,7 +525,7 @@ describe('param-write buffering', () => {
 
 describe('updateParams', () => {
   it('does not loop when the view echoes a param the controller just wrote', async () => {
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+    const controller = withPort('id', { session: 'sess' }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -475,168 +540,526 @@ describe('updateParams', () => {
 
     // The view feeds the echoed url back; the controller already has it, so no
     // re-write and no reconnect.
-    controller.updateParams({ session: 'sess', wsPort: 1111, url: 'https://example.com/' });
+    controller.updateParams({ session: 'sess', url: 'https://example.com/' });
     expect(sink.updateParameters.mock.calls.length).toBe(writesBefore);
     expect(streamSockets(1111).length).toBe(1);
   });
 
-  it('reconciles a changed session when its params port already matches the live port', async () => {
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopOut'>;
+});
+
+describe('launch', () => {
+  type Open = PlatformAdapter['agentBrowserOpen'];
+  function launchPlatform(open: NonNullable<Open>) {
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserOpen' | 'agentBrowserCommand' | 'agentBrowserAttach'>;
+    platform.agentBrowserOpen = vi.fn(open);
     platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
-    platform.agentBrowserPopOut = vi.fn(async () => ({ ok: true, wsPort: 2222 }));
+    platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 9999 }));
+    setPlatform(platform);
+    return platform;
+  }
+
+  it('a session-less pane opens its page, binds the session the host answers with, and streams', async () => {
+    const platform = launchPlatform(async () => ({ ok: true, session: 'dormouse.1.gui-abc', wsPort: 4321, binaryPath: '/usr/bin/agent-browser' }));
+    const launched = whenBrowserLaunched('id');
+    // A restored pane whose launch never landed is the same pane.
+    const controller = acquireAgentBrowserSurfaceController('id', {
+      renderMode: 'ab-screencast', url: 'https://page.example/', binaryPath: '/usr/bin/agent-browser',
+    });
+    const sink = makeSink();
+    controller.attachView(sink);
+    expect(controller.snapshot().phase).toBe('launching');
+    await flushMicrotasks();
+
+    expect(platform.agentBrowserOpen).toHaveBeenCalledExactlyOnceWith('https://page.example/', { headed: false }, '/usr/bin/agent-browser');
+    expect(sink.updateParameters).toHaveBeenCalledWith({ session: 'dormouse.1.gui-abc', binaryPath: '/usr/bin/agent-browser' });
+    expect(streamSocket(4321)?.readyState).toBe(1);
+    expect(platform.agentBrowserAttach).not.toHaveBeenCalled();
+    expect(await launched).toBeNull();
+    // Driven as the session it bound.
+    getAgentBrowserScreenController('id')!.chromeActions.reload();
+    expect(platform.agentBrowserCommand).toHaveBeenLastCalledWith('dormouse.1.gui-abc', ['reload'], '/usr/bin/agent-browser');
+
+    // Params that predate that write — a remounted view feeding them before its
+    // flush — do not take the session away and launch again.
+    controller.updateParams({ renderMode: 'ab-screencast', url: 'https://page.example/' });
+    controller.updateParams({ renderMode: 'ab-screencast', url: 'https://page.example/', session: 'dormouse.1.gui-abc' });
+    await flushMicrotasks();
+    expect(platform.agentBrowserOpen).toHaveBeenCalledTimes(1);
+    expect(streamSockets(4321)).toHaveLength(1);
+  });
+
+  it('opens in the session params name, headed for a pop-out, and binds it', async () => {
+    const platform = launchPlatform(async () => ({ ok: true, session: 'dormouse.1.tool.t', wsPort: 4321 }));
+    const controller = acquireAgentBrowserSurfaceController('id', {
+      renderMode: 'ab-popout', url: 'http://localhost:6006/', launchSession: 'dormouse.1.tool.t',
+    });
+    const sink = makeSink();
+    controller.attachView(sink);
+    await flushMicrotasks();
+    expect(platform.agentBrowserOpen).toHaveBeenCalledWith('http://localhost:6006/', { headed: true, session: 'dormouse.1.tool.t' }, undefined);
+    expect(sink.updateParameters).toHaveBeenCalledWith({ session: 'dormouse.1.tool.t', launchSession: undefined, launchFallback: undefined });
+  });
+
+  it('a failed launch says why, in the pane and to whoever awaited it', async () => {
+    const platform: PlatformAdapter = new FakePtyAdapter();
+    platform.playwright = vi.fn(async () => ({ ok: false }));
     setPlatform(platform);
+    const launched = whenBrowserLaunched('pw');
+    const controller = acquireAgentBrowserSurfaceController('pw', { renderMode: 'pw-screencast', url: 'https://page.example/' });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    expect(await launched).toBe('Could not open Playwright');
+    expect(controller.snapshot()).toMatchObject({ phase: 'ended', error: 'Could not open Playwright' });
+    expect(WebSocketMock.instances).toHaveLength(0);
+  });
 
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'old-session', wsPort: 1111 });
+  it('a Surface closed mid-launch closes the browser that comes up, and its waiter hears it is gone', async () => {
+    let answer!: (res: { ok: boolean; session?: string; wsPort?: number }) => void;
+    const platform = launchPlatform(() => new Promise((resolve) => { answer = resolve; }));
+    const launched = whenBrowserLaunched('id');
+    const controller = acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://page.example/' });
     controller.attachView(makeSink());
     await flushMicrotasks();
 
-    // The relaunch adopts 2222 immediately, but params.wsPort remains 1111
-    // until the view's buffered write echoes back through updateParams.
-    getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout');
+    closeBrowserSurface('id', { surfaceType: 'browser', renderMode: 'ab-screencast', url: 'https://page.example/' });
+    expect(await launched).toBeNull();
+    expect(platform.agentBrowserCommand).not.toHaveBeenCalled();
+
+    answer({ ok: true, session: 'dormouse.1.gui-late', wsPort: 4321 });
+    await flushMicrotasks();
+    expect(platform.agentBrowserCommand).toHaveBeenCalledExactlyOnceWith('dormouse.1.gui-late', ['close'], undefined);
+    expect(WebSocketMock.instances).toHaveLength(0);
+  });
+
+  it('a navigation out of a failed launch launches at its page, and loads it once', async () => {
+    const answers = [{ ok: false, error: 'boom' }, { ok: true, session: 'dormouse.1.gui-n', wsPort: 4321 }];
+    const platform = launchPlatform(async () => answers.shift()!);
+    acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://page.example/' }).attachView(makeSink());
+    await flushMicrotasks();
+
+    getAgentBrowserScreenController('id')!.chromeActions.navigate('https://next.example/');
+    await flushMicrotasks();
+    expect(platform.agentBrowserOpen).toHaveBeenLastCalledWith('https://next.example/', { headed: false }, undefined);
+    expect(streamSocket(4321)?.readyState).toBe(1);
+    expect(opens(platform)).toEqual([]);
+  });
+
+  it('a Tool re-framed while its browser opens goes to the new page once live', async () => {
+    let answer!: (res: AgentBrowserOpenResult) => void;
+    const platform = launchPlatform(() => new Promise((resolve) => { answer = resolve; }));
+    const controller = acquireAgentBrowserSurfaceController('id', {
+      renderMode: 'ab-screencast', url: 'http://localhost:6006/', launchSession: 'dormouse.1.tool.t',
+    });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+
+    // A new announcement: the same session, another page.
+    controller.updateParams({ renderMode: 'ab-screencast', url: 'http://localhost:6007/docs', launchSession: 'dormouse.1.tool.t' });
+    answer({ ok: true, session: 'dormouse.1.tool.t', wsPort: 4321 });
+    await flushMicrotasks();
+    expect(streamSocket(4321)?.readyState).toBe(1);
+    expect(opens(platform)).toEqual(['http://localhost:6007/docs']);
+  });
+
+  it('ignores params that predate the session its launch bound', async () => {
+    const platform = launchPlatform(async () => ({ ok: true, session: 'dormouse.1.gui-abc', wsPort: 4321 }));
+    const controller = acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://page.example/' });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+
+    // A remounted view feeds the params it rendered with, before the write shows.
+    controller.updateParams({ renderMode: 'ab-screencast', url: 'https://page.example/' });
     await flushMicrotasks();
-    const oldSessionSocket = streamSocket(2222);
-    expect(oldSessionSocket?.readyState).toBe(1);
-    expect(streamSockets(2222)).toHaveLength(1);
+    expect(platform.agentBrowserOpen).toHaveBeenCalledOnce();
+    expect(streamSocket(4321)?.readyState).toBe(1);
+  });
+
+  it('never closes the session a launch opened when the Surface has since bound it', async () => {
+    let answer!: (res: { ok: boolean; session?: string; wsPort?: number }) => void;
+    const platform = launchPlatform(() => new Promise((resolve) => { answer = resolve; }));
+    const controller = acquireAgentBrowserSurfaceController('id', {
+      renderMode: 'ab-screencast', url: 'http://localhost:6006/', launchSession: 'dormouse.1.tool.t',
+    });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+
+    controller.updateParams({ renderMode: 'ab-screencast', url: 'http://localhost:6006/', session: 'dormouse.1.tool.t' });
+    controller.handOver(4321);
+    answer({ ok: true, session: 'dormouse.1.tool.t', wsPort: 4321 });
+    await flushMicrotasks();
+    expect(platform.agentBrowserCommand).not.toHaveBeenCalledWith('dormouse.1.tool.t', ['close'], undefined);
+    expect(streamSocket(4321)?.readyState).toBe(1);
+  });
 
-    // The echo also hands over a new session. Since 2222 is already the live
-    // port, setStreamPort no-ops; session reconciliation must still replace the
-    // old-session connection with one keyed to new-session.
-    controller.updateParams({ session: 'new-session', wsPort: 2222 });
+  it('launches with the binary `dor ab` last resolved, and remembers the one it ran', async () => {
+    const platform = launchPlatform(async () => ({ ok: true, session: 'dormouse.1.gui-b', wsPort: 4321, binaryPath: '/opt/ab/agent-browser' }));
+    rememberLaunchBinaryPath('agent-browser', '/usr/local/bin/agent-browser');
+    acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://page.example/' }).attachView(makeSink());
     await flushMicrotasks();
+    expect(platform.agentBrowserOpen).toHaveBeenCalledWith('https://page.example/', { headed: false }, '/usr/local/bin/agent-browser');
+    expect(launchBinaryPath('agent-browser')).toBe('/opt/ab/agent-browser');
+  });
 
-    expect(oldSessionSocket?.readyState).toBe(3);
-    expect(streamSockets(2222)).toHaveLength(2);
+  it('tells the Wall about a failed launch, once a view is attached to hear it', async () => {
+    launchPlatform(async () => ({ ok: false, error: 'boom' }));
+    const controller = acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://page.example/' });
+    const first = makeSink();
+    const handle = controller.attachView(first);
+    handle.detach();
+    await flushMicrotasks();
+    expect(first.launchFailed).not.toHaveBeenCalled();
+    const second = makeSink();
+    controller.attachView(second);
+    expect(second.launchFailed).toHaveBeenCalledExactlyOnceWith('boom');
+  });
+
+  it('a launch released without a close leaves a session it named, and closes one the host minted', async () => {
+    const answers: Array<(res: { ok: boolean; session?: string; wsPort?: number }) => void> = [];
+    const platform = launchPlatform(() => new Promise((resolve) => { answers.push(resolve); }));
+    const named = acquireAgentBrowserSurfaceController('named', { renderMode: 'ab-screencast', url: 'https://page.example/', launchSession: 'dormouse.1.tool.t' });
+    named.attachView(makeSink());
+    const minted = acquireAgentBrowserSurfaceController('minted', { renderMode: 'ab-screencast', url: 'https://page.example/' });
+    minted.attachView(makeSink());
+    await flushMicrotasks();
+
+    // A Workspace transfer: the destination opens the same named session.
+    disposeAgentBrowserSurfaceController('named');
+    disposeAgentBrowserSurfaceController('minted');
+    answers[0]({ ok: true, session: 'dormouse.1.tool.t', wsPort: 4321 });
+    answers[1]({ ok: true, session: 'dormouse.1.gui-x', wsPort: 4322 });
+    await flushMicrotasks();
+    expect(platform.agentBrowserCommand).toHaveBeenCalledExactlyOnceWith('dormouse.1.gui-x', ['close'], undefined);
+  });
+
+  it('a controller released before it ever started still settles its waiter', async () => {
+    launchPlatform(async () => ({ ok: true }));
+    const launched = whenBrowserLaunched('id');
+    acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://page.example/' });
+    disposeAgentBrowserSurfaceController('id');
+    expect(await launched).toBeNull();
+  });
+
+  it('a Surface killed before its view ever mounted still settles its waiter', async () => {
+    launchPlatform(async () => ({ ok: true }));
+    const launched = whenBrowserLaunched('never-mounted');
+    closeBrowserSurface('never-mounted', { surfaceType: 'browser', renderMode: 'ab-screencast', url: 'https://page.example/' });
+    expect(await launched).toBeNull();
   });
 });
 
-describe('stale-port recovery gating', () => {
-  it('stays fully inert for a session-less pane until params deliver the session', async () => {
-    const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async () => ({ ok: true, wsPort: 2222 }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus'>;
-    platform.agentBrowserStreamStatus = streamStatus;
+describe('a closed Surface and the next launch into its session', () => {
+  // A Tool swapped to its embed and back, or re-framed after its dev server
+  // restarts, while its browser was still coming up: the Surface closes, and
+  // the next launch opens the same `tool.<leafId>` session.
+  const session = 'dormouse.1.tool.t';
+  type Pending<T> = { resolve: (value: T) => void };
+  function hostPlatform() {
+    const pending = { open: [] as Pending<AgentBrowserOpenResult>[], popOut: [] as Pending<AgentBrowserPopResult>[], attach: [] as Pending<AgentBrowserAttachResult>[] };
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserOpen' | 'agentBrowserCommand' | 'agentBrowserAttach' | 'agentBrowserPopOut' | 'agentBrowserPopIn'>;
+    platform.agentBrowserOpen = vi.fn(() => new Promise<AgentBrowserOpenResult>((resolve) => { pending.open.push({ resolve }); }));
+    platform.agentBrowserAttach = vi.fn(() => new Promise<AgentBrowserAttachResult>((resolve) => { pending.attach.push({ resolve }); }));
+    platform.agentBrowserPopOut = vi.fn(() => new Promise<AgentBrowserPopResult>((resolve) => { pending.popOut.push({ resolve }); }));
+    platform.agentBrowserPopIn = vi.fn(async () => ({ ok: true, wsPort: 5555 }));
+    platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
     setPlatform(platform);
+    return { platform, pending };
+  }
+  /** Close `id` mid-flight, start the next launch into `session`, and check it
+   *  waits for the first to land and close the session again. */
+  async function expectNextLaunchWaits(
+    { platform }: ReturnType<typeof hostPlatform>,
+    id: string,
+    land: () => void,
+  ) {
+    // Closes stay unanswered until released, so the wait is for the answer.
+    const answerCloses: Array<() => void> = [];
+    vi.mocked(platform.agentBrowserCommand!).mockImplementation((_session, args) => new Promise((resolve) => {
+      const answer = () => resolve({ exitCode: 0, stdout: '', stderr: '' });
+      if (args[0] === 'close') answerCloses.push(answer);
+      else answer();
+    }));
+    const closesOfSession = () => vi.mocked(platform.agentBrowserCommand!).mock.calls
+      .filter(([name, args]) => name === session && args[0] === 'close').length;
+    const nextOpen = () => vi.mocked(platform.agentBrowserOpen!).mock.calls.filter(([, opts]) => opts.session === session).length;
+    const opensBefore = nextOpen();
+    void closeBrowserSurface(id, {});
+    acquireAgentBrowserSurfaceController('next', { renderMode: 'ab-screencast', url: 'http://localhost:6006/', launchSession: session })
+      .attachView(makeSink());
+    const closesBefore = closesOfSession();
+    answerCloses.splice(0).forEach((answer) => answer());
+    // Every promise chain settled, not a fixed number of turns.
+    const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+    await settle();
+    expect(nextOpen()).toBe(opensBefore);
+
+    // It lands, and closes the session again: the next launch waits for that answer too.
+    land();
+    await settle();
+    expect(closesOfSession()).toBe(closesBefore + 1);
+    expect(nextOpen()).toBe(opensBefore);
+    answerCloses.splice(0).forEach((answer) => answer());
+    await vi.waitFor(() => expect(nextOpen()).toBe(opensBefore + 1));
+  }
 
-    // The pane context menu's instant connect mounts its surface WITHOUT a
-    // session precisely so nothing here can race the daemon boot — no recovery
-    // query, no socket (docs/specs/dor-browser.md → Pane Context Menu Connect).
-    // Deriving the session from `key` would silently reintroduce the race.
-    const controller = acquireAgentBrowserSurfaceController('id', { key: 'default', url: 'http://localhost:5173/' });
-    const sink = makeSink();
-    controller.attachView(sink);
+  it('waits for a launch that was opening it', async () => {
+    const host = hostPlatform();
+    acquireAgentBrowserSurfaceController('first', { renderMode: 'ab-screencast', url: 'http://localhost:6006/', launchSession: session })
+      .attachView(makeSink());
     await flushMicrotasks();
-    expect(streamStatus).not.toHaveBeenCalled();
-    expect(WebSocketMock.instances).toHaveLength(0);
+    await expectNextLaunchWaits(host, 'first', () => host.pending.open[0].resolve({ ok: true, session, wsPort: 4321 }));
+  });
 
-    // The background boot hands over {session, wsPort} in one params write,
-    // which is what brings the stream up.
-    controller.updateParams({ key: 'default', url: 'http://localhost:5173/', session: 'sess', wsPort: 1111 });
+  it('a launch released while it waits opens nothing', async () => {
+    const host = hostPlatform();
+    acquireAgentBrowserSurfaceController('first', { renderMode: 'ab-screencast', url: 'http://localhost:6006/', launchSession: session })
+      .attachView(makeSink());
     await flushMicrotasks();
-    expect(streamSocket(1111)?.readyState).toBe(1);
+    void closeBrowserSurface('first', {});
+    acquireAgentBrowserSurfaceController('next', { renderMode: 'ab-screencast', url: 'http://localhost:6006/', launchSession: session })
+      .attachView(makeSink());
+    await flushMicrotasks();
+    // Swapped away again before the first launch landed.
+    void closeBrowserSurface('next', {});
+    host.pending.open[0].resolve({ ok: true, session, wsPort: 4321 });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(host.platform.agentBrowserOpen).toHaveBeenCalledOnce();
   });
 
-  it('never queries stream status while parked', async () => {
-    vi.useFakeTimers();
-    try {
-      const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async () => ({ ok: false }));
-      const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus'>;
-      platform.agentBrowserStreamStatus = streamStatus;
-      setPlatform(platform);
-
-      // No wsPort ⇒ the recovery path is what would query the daemon.
-      const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess' });
-      const sink = makeSink();
-      controller.attachView(sink);
-      await vi.advanceTimersByTimeAsync(0);
-      streamStatus.mockClear();
+  it('waits for a pop-out that was relaunching it', async () => {
+    const host = hostPlatform();
+    const first = withPort('first', { session, url: 'http://localhost:6006/' }, 1111);
+    first.attachView(makeSink());
+    await flushMicrotasks();
+    first.setRenderMode('ab-popout');
+    await expectNextLaunchWaits(host, 'first', () => host.pending.popOut[0].resolve({ ok: true, wsPort: 4321 }));
+  });
 
-      controller.setVisible(false);
-      await vi.advanceTimersByTimeAsync(HIDDEN_PARK_DELAY_MS + 50);
-      expect(controller.isParked()).toBe(true);
-      expect(streamStatus).not.toHaveBeenCalled();
-    } finally {
-      vi.useRealTimers();
-    }
+  it('waits for an attach that was relaunching it', async () => {
+    const host = hostPlatform();
+    acquireAgentBrowserSurfaceController('first', { session, url: 'http://localhost:6006/' }).attachView(makeSink());
+    await flushMicrotasks();
+    expect(host.platform.agentBrowserAttach).toHaveBeenCalled();
+    await expectNextLaunchWaits(host, 'first', () => host.pending.attach[0].resolve({ ok: true, wsPort: 4321, relaunched: true }));
   });
+});
 
-  it('does not recover a stale port through stream status after that port opened live', async () => {
-    const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async () => ({ ok: true, wsPort: 2222 }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus'>;
-    platform.agentBrowserStreamStatus = streamStatus;
+describe('attach', () => {
+  function attachPlatform(attach: PlatformAdapter['agentBrowserAttach']) {
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserAttach' | 'agentBrowserCommand'>;
+    platform.agentBrowserAttach = vi.fn(attach);
+    platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
     setPlatform(platform);
+    return platform;
+  }
 
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+  it('a restored pane attaches at the page and presentation it had', async () => {
+    const platform = attachPlatform(async () => ({ ok: true, wsPort: 2222 }));
+    const controller = acquireAgentBrowserSurfaceController('id', {
+      session: 'sess', renderMode: 'ab-popout', url: 'https://restored.example/',
+    });
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
-    streamStatus.mockClear();
 
-    // The live port dropping is a stream failure, not a stale persisted port.
-    streamSocket(1111)?.emitMessage(JSON.stringify({ type: 'status', connected: false, screencasting: false }));
+    expect(platform.agentBrowserAttach).toHaveBeenCalledExactlyOnceWith('sess', { url: 'https://restored.example/', headed: true }, undefined);
+    expect(streamSocket(2222)?.readyState).toBe(1);
+  });
+
+  it('streams from a port `dor` hands over, out of `ended` too', async () => {
+    attachPlatform(async () => ({ ok: false, error: 'not running' }));
+    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', url: 'https://page.example/' });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    expect(controller.snapshot().phase).toBe('ended');
+
+    handOverBrowserPort('id', { session: 'sess', url: 'https://page.example/' }, 4321);
     await flushMicrotasks();
-    expect(streamStatus).not.toHaveBeenCalled();
+    expect(controller.snapshot().phase).toBe('live');
+    expect(streamSocket(4321)?.readyState).toBe(1);
+  });
+
+  it('a browser that cannot be reopened says why', async () => {
+    attachPlatform(async () => ({ ok: false, error: 'agent-browser binary not found' }));
+    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', url: 'https://restored.example/' });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    expect(controller.snapshot()).toMatchObject({ phase: 'ended', error: 'agent-browser binary not found' });
+    expect(WebSocketMock.instances).toHaveLength(0);
+  });
+
+  /** A live pane on 1111, parked. */
+  async function parkedAt1111(attach: PlatformAdapter['agentBrowserAttach']) {
+    const platform = attachPlatform(attach);
+    const controller = withPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
+    controller.attachView(makeSink());
+    await vi.advanceTimersByTimeAsync(0);
+    expect(streamSocket(1111)?.readyState).toBe(1);
+    controller.setVisible(false);
+    await vi.advanceTimersByTimeAsync(HIDDEN_PARK_DELAY_MS + 50);
+    expect(controller.isParked()).toBe(true);
+    expect(streamSocket(1111)?.readyState).toBe(3);
+    return { platform, controller };
+  }
+
+  it('never attaches while parked, and an unpark whose port still answers asks the host nothing', async () => {
+    vi.useFakeTimers();
+    try {
+      const { platform, controller } = await parkedAt1111(async () => ({ ok: true, wsPort: 2222 }));
+      // Hidden and shown again, a headless pane never left `live` for its view.
+      expect(controller.snapshot().phase).toBe('live');
+      controller.setVisible(true);
+      await vi.advanceTimersByTimeAsync(0);
+      expect(streamSockets(1111)).toHaveLength(2);
+      expect(streamSocket(1111)?.readyState).toBe(1);
+      expect(platform.agentBrowserAttach).not.toHaveBeenCalled();
+    } finally {
+      vi.useRealTimers();
+    }
   });
 
-  it('clears live-port memory while parked so unpark can recover a changed stream port', async () => {
+  it('an unpark whose port fails asks the host, without a page, where the stream moved', async () => {
     vi.useFakeTimers();
     try {
-      const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async () => ({ ok: true, wsPort: 2222 }));
-      const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus'>;
-      platform.agentBrowserStreamStatus = streamStatus;
-      setPlatform(platform);
+      const { platform, controller } = await parkedAt1111(async () => ({ ok: true, wsPort: 2222 }));
+      WebSocketMock.failPorts.add(1111);
+      controller.setVisible(true);
+      await vi.advanceTimersByTimeAsync(0);
+      // Without a page: a daemon gone while hidden has ended, it is not
+      // relaunched behind the user's back.
+      expect(platform.agentBrowserAttach).toHaveBeenCalledExactlyOnceWith('sess', { url: undefined, headed: false }, undefined);
+      expect(streamSocket(2222)?.readyState).toBe(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 
-      const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+  it.each([
+    ['answers', true, false],
+    ['answers, with a page asked for meanwhile', true, true],
+    ['has gone away', false, true],
+  ])('an unpark drives nothing until the port it parked at %s', async (_name, answers, askedMeanwhile) => {
+    vi.useFakeTimers();
+    try {
+      const platform = attachPlatform(async () => ({ ok: false, error: 'not running' }));
       const sink = makeSink();
+      let size = { width: 800, height: 600 };
+      sink.viewport.getBoundingClientRect = () => ({ ...size }) as DOMRect;
+      const controller = withPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
       controller.attachView(sink);
       await vi.advanceTimersByTimeAsync(0);
-      expect(streamSocket(1111)?.readyState).toBe(1);
-      streamStatus.mockClear();
-
       controller.setVisible(false);
       await vi.advanceTimersByTimeAsync(HIDDEN_PARK_DELAY_MS + 50);
       expect(controller.isParked()).toBe(true);
+      // While hidden: the Door comes back at another size, and a page is asked for.
+      size = { width: 1000, height: 700 };
+      getAgentBrowserScreenController('id')!.chromeActions.navigate('https://next.example/');
+      vi.mocked(platform.agentBrowserCommand!).mockClear();
 
-      WebSocketMock.failPorts.add(1111);
+      // A daemon gone meanwhile would be started again by any CLI command.
+      if (!answers) WebSocketMock.failPorts.add(1111);
       controller.setVisible(true);
-      await vi.advanceTimersByTimeAsync(0);
+      // Asked for before the stream opens: kept, like any navigation the gate refuses.
+      if (askedMeanwhile) getAgentBrowserScreenController('id')!.chromeActions.navigate('https://later.example/');
+      await vi.advanceTimersByTimeAsync(250);
+      if (answers) {
+        expect(vi.mocked(platform.agentBrowserCommand!).mock.calls.map(([, args]) => args)).toEqual([
+          ['set', 'viewport', '1000', '700', '1'],
+          ['open', askedMeanwhile ? 'https://later.example/' : 'https://next.example/'],
+        ]);
+      } else {
+        expect(platform.agentBrowserCommand).not.toHaveBeenCalled();
+        expect(platform.agentBrowserAttach).toHaveBeenCalledExactlyOnceWith('sess', { url: undefined, headed: false }, undefined);
+        expect(controller.snapshot().phase).toBe('ended');
+      }
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 
-      await vi.advanceTimersByTimeAsync(2000);
-      await vi.advanceTimersByTimeAsync(4000);
+  it('an unpark the host cannot place ends', async () => {
+    vi.useFakeTimers();
+    try {
+      const { controller } = await parkedAt1111(async () => ({ ok: false, error: 'not running' }));
+      WebSocketMock.failPorts.add(1111);
+      controller.setVisible(true);
       await vi.advanceTimersByTimeAsync(0);
-
-      expect(streamStatus).toHaveBeenCalledWith('sess', undefined);
-      expect(sink.updateParameters).toHaveBeenCalledWith({ wsPort: 2222 });
+      expect(controller.snapshot()).toMatchObject({ phase: 'ended', error: undefined });
     } finally {
       vi.useRealTimers();
     }
   });
 
+  it('a headless browser that drops ends, reached again only through attach or a handed-over port', async () => {
+    const platform = attachPlatform(async () => ({ ok: true, wsPort: 3333 }));
+    const controller = withPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    const socket = streamSocket(1111)!;
+    // Not yet reported connected: still coming up, not gone.
+    socket.emitMessage(JSON.stringify({ type: 'status', connected: false, screencasting: false }));
+    expect(controller.snapshot().phase).toBe('live');
+    socket.emitMessage(JSON.stringify({ type: 'status', connected: true, screencasting: true }));
+    socket.emitMessage(JSON.stringify({ type: 'status', connected: false, screencasting: false }));
+    expect(controller.snapshot().phase).toBe('ended');
+    expect(socket.readyState).toBe(3);
+    expect(platform.agentBrowserAttach).not.toHaveBeenCalled();
+
+    // `dor ab open` brings it back on the port it had.
+    handOverBrowserPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
+    await flushMicrotasks();
+    expect(controller.snapshot().phase).toBe('live');
+    expect(streamSockets(1111)).toHaveLength(2);
+
+    // Ended again, a URL-bar navigation attaches — never a daemon command, which
+    // would start a daemon on a port nobody learns. Its daemon was still up, so
+    // attach only found it: the page opens once live.
+    streamSocket(1111)!.emitMessage(JSON.stringify({ type: 'status', connected: true, screencasting: true }));
+    streamSocket(1111)!.emitMessage(JSON.stringify({ type: 'status', connected: false, screencasting: false }));
+    getAgentBrowserScreenController('id')!.chromeActions.navigate('https://next.example/');
+    expect(platform.agentBrowserCommand).not.toHaveBeenCalledWith('sess', ['open', 'https://next.example/'], undefined);
+    expect(platform.agentBrowserAttach).toHaveBeenCalledExactlyOnceWith('sess', { url: 'https://next.example/', headed: false }, undefined);
+    await flushMicrotasks();
+    expect(streamSocket(3333)?.readyState).toBe(1);
+    expect(opens(platform)).toEqual(['https://next.example/']);
+  });
+
+  it('a navigation that relaunches a gone daemon loads its page once', async () => {
+    const platform = attachPlatform(async () => ({ ok: false, error: 'not running' }));
+    acquireAgentBrowserSurfaceController('id', { session: 'sess', url: 'https://page.example/' }).attachView(makeSink());
+    await flushMicrotasks();
+    vi.mocked(platform.agentBrowserAttach!).mockResolvedValue({ ok: true, wsPort: 3333, relaunched: true });
+
+    getAgentBrowserScreenController('id')!.chromeActions.navigate('https://next.example/');
+    await flushMicrotasks();
+    expect(platform.agentBrowserAttach).toHaveBeenLastCalledWith('sess', { url: 'https://next.example/', headed: false }, undefined);
+    expect(streamSocket(3333)?.readyState).toBe(1);
+    expect(opens(platform)).toEqual([]);
+  });
+
   it('does not query the daemon while a relaunch is in flight', async () => {
-    const streamStatus = vi.fn<PlatformAdapter['agentBrowserStreamStatus']>(async () => ({ ok: true, wsPort: 9999 }));
-    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserStreamStatus' | 'agentBrowserCommand' | 'agentBrowserPopOut'>;
-    platform.agentBrowserStreamStatus = streamStatus;
-    platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
-    // A pop-out whose promise never settles pins `relaunching` true.
-    platform.agentBrowserPopOut = vi.fn(() => new Promise(() => {}));
-    setPlatform(platform);
+    const platform = attachPlatform(async () => ({ ok: true, wsPort: 9999 }));
+    const popOut = vi.fn(() => new Promise<never>(() => {}));
+    Object.assign(platform, { agentBrowserPopOut: popOut });
 
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+    const controller = withPort('id', { session: 'sess' }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
 
     getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout');
-    streamStatus.mockClear();
+    vi.mocked(platform.agentBrowserCommand!).mockClear();
 
-    // A stream drop mid-relaunch must not spawn a competing daemon via recovery.
+    // A stream drop mid-relaunch must not spawn a competing daemon.
     streamSocket(1111)?.emitMessage(JSON.stringify({ type: 'status', connected: false, screencasting: false }));
     await flushMicrotasks();
-    expect(streamStatus).not.toHaveBeenCalled();
+    expect(platform.agentBrowserAttach).not.toHaveBeenCalled();
+    expect(platform.agentBrowserCommand).not.toHaveBeenCalled();
   });
 });
 
 describe('dispose', () => {
   it('tears down the socket, timers, and screen registration', async () => {
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+    const controller = withPort('id', { session: 'sess' }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -653,13 +1076,62 @@ describe('dispose', () => {
   });
 });
 
+describe('closeBrowserSurface', () => {
+  function closePlatform() {
+    let resolvePopOut!: (res: { ok: boolean; wsPort?: number }) => void;
+    const platform = new FakePtyAdapter() as FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopOut'>;
+    platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
+    platform.agentBrowserPopOut = vi.fn(() => new Promise((r) => { resolvePopOut = r; }));
+    setPlatform(platform);
+    const closes = () => vi.mocked(platform.agentBrowserCommand!).mock.calls.filter(([, args]) => args[0] === 'close');
+    return { platform, closes, resolvePopOut: (res: { ok: boolean; wsPort?: number }) => resolvePopOut(res) };
+  }
+
+  it('closes the session again when a relaunch in flight brings its daemon back', async () => {
+    const { closes, resolvePopOut } = closePlatform();
+    const controller = withPort('id', { session: 'sess' }, 1111);
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout');
+
+    closeBrowserSurface('id', { renderMode: 'ab-popout', session: 'sess' });
+    expect(closes()).toHaveLength(1);
+    expect(getAgentBrowserSurfaceController('id')).toBeNull();
+
+    resolvePopOut({ ok: true, wsPort: 3456 });
+    await flushMicrotasks();
+    expect(closes()).toHaveLength(2);
+    expect(streamSockets(3456)).toHaveLength(0);
+  });
+
+  it('a release that closes nothing leaves a relaunch in flight to whoever holds the session next', async () => {
+    const { closes, resolvePopOut } = closePlatform();
+    const controller = withPort('id', { session: 'sess' }, 1111);
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout');
+
+    disposeAgentBrowserSurfaceController('id');
+    resolvePopOut({ ok: true, wsPort: 3456 });
+    await flushMicrotasks();
+    expect(closes()).toHaveLength(0);
+  });
+
+  it('closes a session no controller holds from its params, with only a checked binary', async () => {
+    const { platform } = closePlatform();
+    closeBrowserSurface('never-mounted', { surfaceType: 'browser', renderMode: 'ab-screencast', session: 'sess', binaryPath: '/usr/bin/curl' });
+    closeBrowserSurface('iframe', { surfaceType: 'browser', renderMode: 'iframe', url: 'http://localhost:5173/' });
+    expect(platform.agentBrowserCommand).toHaveBeenCalledExactlyOnceWith('sess', ['close'], undefined);
+  });
+});
+
 describe('relaunch (pop-out / pop-in)', () => {
-  type RelaunchPlatform = FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopOut' | 'agentBrowserPopIn' | 'agentBrowserStreamStatus'>;
+  type RelaunchPlatform = FakePtyAdapter & Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserPopOut' | 'agentBrowserPopIn' | 'agentBrowserAttach'>;
   function relaunchPlatform(): RelaunchPlatform & { resolvePopOut: (res: { ok: boolean; wsPort?: number }) => void } {
     const platform = new FakePtyAdapter() as RelaunchPlatform;
     let resolvePopOut!: (res: { ok: boolean; wsPort?: number }) => void;
     platform.agentBrowserCommand = vi.fn(async () => ({ exitCode: 0, stdout: '', stderr: '' }));
-    platform.agentBrowserStreamStatus = vi.fn(async () => ({ ok: true, wsPort: 9999 }));
+    platform.agentBrowserAttach = vi.fn(async () => ({ ok: true, wsPort: 9999 }));
     platform.agentBrowserPopOut = vi.fn(() => new Promise<{ ok: boolean; wsPort?: number }>((r) => { resolvePopOut = r; }));
     platform.agentBrowserPopIn = vi.fn(async () => ({ ok: true, wsPort: 5555 }));
     setPlatform(platform);
@@ -668,7 +1140,7 @@ describe('relaunch (pop-out / pop-in)', () => {
 
   it('drops the stream up front and connects to the host\'s port only once the relaunch ends', async () => {
     const platform = relaunchPlatform();
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+    const controller = withPort('id', { session: 'sess' }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -680,7 +1152,7 @@ describe('relaunch (pop-out / pop-in)', () => {
     // The host is about to close this browser and kill its daemon: the old
     // socket is released now rather than left to fail into "ended"/recovery.
     expect(old?.readyState).toBe(3);
-    expect(controller.snapshot().relaunching).toBe(true);
+    expect(controller.snapshot().phase).toBe('relaunching');
     expect(controller.snapshot().poppedOut).toBe(true);
     // No daemon command while the relaunch is in flight: not even the popped-out
     // CDP observer's `get cdp-url`.
@@ -688,16 +1160,16 @@ describe('relaunch (pop-out / pop-in)', () => {
 
     platform.resolvePopOut({ ok: true, wsPort: 3456 });
     await flushMicrotasks();
-    expect(controller.snapshot().relaunching).toBe(false);
+    expect(controller.snapshot().phase).toBe('live');
     expect(streamSockets(3456).length).toBe(1);
     expect(streamSockets(1111).length).toBe(1);
     expect(platform.agentBrowserCommand).toHaveBeenCalledWith('sess', ['get', 'cdp-url'], undefined);
-    expect(platform.agentBrowserStreamStatus).not.toHaveBeenCalled();
+    expect(platform.agentBrowserAttach).not.toHaveBeenCalled();
   });
 
   it('ignores a second pop-out or pop-in while one is in flight', async () => {
     const platform = relaunchPlatform();
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111 });
+    const controller = withPort('id', { session: 'sess' }, 1111);
     controller.attachView(makeSink());
     await flushMicrotasks();
 
@@ -716,22 +1188,23 @@ describe('relaunch (pop-out / pop-in)', () => {
     expect(platform.agentBrowserPopIn).toHaveBeenCalledTimes(1);
   });
 
-  it('pop-in on a session-less popped-out pane is a no-op', async () => {
+  it('pop-in while the first launch is in flight is a no-op', async () => {
     const platform = relaunchPlatform();
-    const controller = acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-popout' });
+    Object.assign(platform, { agentBrowserOpen: vi.fn(() => new Promise<never>(() => {})) });
+    const controller = acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-popout', url: 'https://page.example/' });
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
 
     controller.popIn();
     expect(platform.agentBrowserPopIn).not.toHaveBeenCalled();
-    expect(controller.snapshot().poppedOut).toBe(true);
+    expect(controller.snapshot()).toMatchObject({ poppedOut: true, phase: 'launching' });
     expect(sink.updateParameters).not.toHaveBeenCalledWith({ renderMode: 'ab-screencast' });
   });
 
   it('a relaunch carries the URL the stream committed, not the one the last tabs snapshot reported', async () => {
     const platform = relaunchPlatform();
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111, url: 'https://before.example/' });
+    const controller = withPort('id', { session: 'sess', url: 'https://before.example/' }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -753,7 +1226,7 @@ describe('relaunch (pop-out / pop-in)', () => {
 
   it('relaunches at the last page the host can reopen, not a file: or data: tab', async () => {
     const platform = relaunchPlatform();
-    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', wsPort: 1111, url: 'https://before.example/' });
+    const controller = withPort('id', { session: 'sess', url: 'https://before.example/' }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -769,9 +1242,9 @@ describe('relaunch (pop-out / pop-in)', () => {
   });
 
   it('clears a stale title when navigation commits at the same URL', async () => {
-    const controller = acquireAgentBrowserSurfaceController('id', {
-      session: 'sess', wsPort: 1111, url: 'https://same.example/',
-    });
+    const controller = withPort('id', {
+      session: 'sess', url: 'https://same.example/',
+    }, 1111);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -795,17 +1268,186 @@ describe('relaunch (pop-out / pop-in)', () => {
     expect(sink.setTitle).toHaveBeenCalledTimes(titleWrites);
   });
 
-  it('a single {session, wsPort} handover connects once and asks the daemon nothing', async () => {
+  it('reaches no daemon from the header, Display modal, tabs, sync or edit chords mid-relaunch, and carries a navigation to the new browser', async () => {
     const platform = relaunchPlatform();
-    const controller = acquireAgentBrowserSurfaceController('id', { renderMode: 'ab-screencast', url: 'https://x.example/' });
+    const edit = vi.fn(async () => ({ ok: true }));
+    Object.assign(platform, { agentBrowserEdit: edit });
+    const observers: ResizeObserverCallback[] = [];
+    vi.stubGlobal('ResizeObserver', class {
+      constructor(callback: ResizeObserverCallback) { observers.push(callback); }
+      observe() {}
+      disconnect() {}
+    });
+    vi.useFakeTimers();
+    try {
+      const controller = withPort('id', { session: 'sess' }, 1111);
+      const sink = makeSink();
+      let size = { width: 800, height: 600 };
+      sink.viewport.getBoundingClientRect = () => ({ ...size }) as DOMRect;
+      controller.attachView(sink);
+      await vi.advanceTimersByTimeAsync(0);
+      streamSocket(1111)?.emitMessage(JSON.stringify({
+        type: 'tabs',
+        tabs: [
+          { tabId: 't1', title: 'One', url: 'https://one.example/', active: true },
+          { tabId: 't2', title: 'Two', url: 'https://two.example/', active: false },
+        ],
+      }));
+      const screen = getAgentBrowserScreenController('id')!;
+      screen.actions.setRenderMode?.('ab-popout');
+      vi.mocked(platform.agentBrowserCommand!).mockClear();
+
+      screen.chromeActions.back();
+      screen.chromeActions.forward();
+      screen.chromeActions.reload();
+      screen.chromeActions.navigate('https://first.example/');
+      screen.chromeActions.navigate('https://latest.example/');
+      screen.actions.applyDevice('iPhone 16 Pro');
+      screen.actions.applyViewport(1024, 768, 2);
+      screen.actions.engageSync();
+      const [first, second] = controller.snapshot().tabs;
+      controller.selectTab(second);
+      controller.closeTab(first);
+      size = { width: 900, height: 700 };
+      observers.at(-1)?.([{ contentRect: { width: 900, height: 700 } } as ResizeObserverEntry], {} as ResizeObserver);
+      await vi.advanceTimersByTimeAsync(250);
+      controller.handleKeyDownLike({ key: 'a', code: 'KeyA', metaKey: true, ctrlKey: false, altKey: false, shiftKey: false });
+      await vi.advanceTimersByTimeAsync(0);
+      expect(platform.agentBrowserCommand).not.toHaveBeenCalled();
+      expect(edit).not.toHaveBeenCalled();
+
+      // The relaunch lands: only the latest navigation runs, once.
+      platform.resolvePopOut({ ok: true, wsPort: 3456 });
+      await vi.advanceTimersByTimeAsync(0);
+      const opens = vi.mocked(platform.agentBrowserCommand!).mock.calls.filter(([, args]) => args[0] === 'open');
+      expect(opens).toEqual([['sess', ['open', 'https://latest.example/'], undefined]]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('keeps sync-to-pane out of a pop-in gap, and re-syncs once the headless browser streams', async () => {
+    const platform = relaunchPlatform();
+    let resolvePopIn!: (res: { ok: boolean; wsPort?: number }) => void;
+    platform.agentBrowserPopIn = vi.fn(() => new Promise((r) => { resolvePopIn = r; }));
+    const controller = withPort('id', { session: 'sess', renderMode: 'ab-popout' }, 1111);
+    const sink = makeSink();
+    sink.viewport.getBoundingClientRect = () => ({ width: 800, height: 600 }) as DOMRect;
+    controller.attachView(sink);
+    await flushMicrotasks();
+
+    controller.popIn();
+    // Headless already, as far as the view is concerned — but not yet live.
+    expect(controller.snapshot().poppedOut).toBe(false);
+    window.dispatchEvent(new Event('resize'));
+    getAgentBrowserScreenController('id')!.actions.engageSync();
+    const viewports = () => vi.mocked(platform.agentBrowserCommand!).mock.calls.filter(([, args]) => args[1] === 'viewport');
+    expect(viewports()).toEqual([]);
+
+    resolvePopIn({ ok: true, wsPort: 5555 });
+    await flushMicrotasks();
+    expect(viewports()).toEqual([['sess', ['set', 'viewport', '800', '600', '1'], undefined]]);
+  });
+
+  it('a pop-out asked for with a page relaunches there instead of navigating into the gap', async () => {
+    const platform = relaunchPlatform();
+    const controller = withPort('id', { session: 'sess', url: 'https://before.example/' }, 1111);
     controller.attachView(makeSink());
     await flushMicrotasks();
-    expect(WebSocketMock.instances.length).toBe(0);
+    vi.mocked(platform.agentBrowserCommand!).mockClear();
 
-    controller.updateParams({ session: 'sess', wsPort: 4321, url: 'https://x.example/' });
+    // The pane context menu's reuse of an existing port target.
+    getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout', { url: 'http://localhost:5173/' });
+    expect(platform.agentBrowserPopOut).toHaveBeenCalledWith('sess', expect.objectContaining({ url: 'http://localhost:5173/' }), undefined);
+    platform.resolvePopOut({ ok: true, wsPort: 3456 });
     await flushMicrotasks();
-    expect(streamSockets(4321).length).toBe(1);
-    expect(platform.agentBrowserStreamStatus).not.toHaveBeenCalled();
+    expect(platform.agentBrowserCommand).not.toHaveBeenCalledWith('sess', ['open', 'http://localhost:5173/'], undefined);
+  });
+
+  it('a navigation to the page a relaunch is opening loads it once', async () => {
+    const platform = relaunchPlatform();
+    const controller = withPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+
+    getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout');
+    getAgentBrowserScreenController('id')!.chromeActions.navigate('https://page.example/');
+    platform.resolvePopOut({ ok: true, wsPort: 3456 });
+    await flushMicrotasks();
+    expect(platform.agentBrowserPopOut).toHaveBeenCalledWith('sess', expect.objectContaining({ url: 'https://page.example/' }), undefined);
+    expect(opens(platform)).toEqual([]);
+  });
+
+  it.each([
+    ['the page asked for while it was parked', undefined, 'https://next.example/'],
+    ['the page it asks for, over one asked for earlier', 'http://localhost:5173/', 'http://localhost:5173/'],
+  ])('a pop-out from a parked pane opens %s, once', async (_name, asked, opened) => {
+    vi.useFakeTimers();
+    try {
+      const platform = relaunchPlatform();
+      const controller = withPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
+      controller.attachView(makeSink());
+      await vi.advanceTimersByTimeAsync(0);
+      controller.setVisible(false);
+      await vi.advanceTimersByTimeAsync(HIDDEN_PARK_DELAY_MS + 50);
+      expect(controller.isParked()).toBe(true);
+
+      getAgentBrowserScreenController('id')!.chromeActions.navigate('https://next.example/');
+      getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout', asked ? { url: asked } : undefined);
+      expect(platform.agentBrowserPopOut).toHaveBeenCalledWith('sess', expect.objectContaining({ url: opened }), undefined);
+      platform.resolvePopOut({ ok: true, wsPort: 3456 });
+      await vi.advanceTimersByTimeAsync(0);
+      expect(opens(platform)).toEqual([]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('keeps a pop-out asked for before the browser is bound, and runs it with its page once live', async () => {
+    const platform = relaunchPlatform();
+    let attached!: (res: { ok: boolean; wsPort?: number }) => void;
+    platform.agentBrowserAttach = vi.fn(() => new Promise((resolve) => { attached = resolve; }));
+    const controller = acquireAgentBrowserSurfaceController('id', { session: 'sess', url: 'https://page.example/' });
+    // Before any view mounts it, as for a Door the context menu reveals.
+    controller.setRenderMode('ab-popout', { url: 'http://localhost:5173/' });
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    expect(platform.agentBrowserAttach).toHaveBeenCalled();
+    expect(platform.agentBrowserPopOut).not.toHaveBeenCalled();
+
+    attached({ ok: true, wsPort: 1111 });
+    await flushMicrotasks();
+    expect(platform.agentBrowserPopOut).toHaveBeenCalledExactlyOnceWith('sess', expect.objectContaining({ url: 'http://localhost:5173/' }), undefined);
+  });
+
+  it('a failed pop-out comes back in the pane, relaunching headless at its page if no daemon came up', async () => {
+    const platform = relaunchPlatform();
+    const controller = withPort('id', { session: 'sess', url: 'https://page.example/' }, 1111);
+    const sink = makeSink();
+    controller.attachView(sink);
+    await flushMicrotasks();
+
+    getAgentBrowserScreenController('id')?.actions.setRenderMode?.('ab-popout');
+    platform.resolvePopOut({ ok: false });
+    await flushMicrotasks();
+    expect(platform.agentBrowserAttach).toHaveBeenCalledExactlyOnceWith('sess', { url: 'https://page.example/', headed: false }, undefined);
+    expect(sink.updateParameters).toHaveBeenLastCalledWith({ renderMode: 'ab-screencast' });
+    expect(controller.snapshot()).toMatchObject({ poppedOut: false, phase: 'live' });
+    expect(streamSocket(9999)?.readyState).toBe(1);
+  });
+
+  it('a `dor ab` re-run handing over a new port reconnects there and asks the daemon nothing', async () => {
+    const platform = relaunchPlatform();
+    const controller = withPort('id', { session: 'sess', url: 'https://x.example/' }, 1111);
+    controller.attachView(makeSink());
+    await flushMicrotasks();
+    expect(streamSocket(1111)?.readyState).toBe(1);
+
+    controller.handOver(4321);
+    await flushMicrotasks();
+    expect(streamSocket(1111)?.readyState).toBe(3);
+    expect(streamSockets(4321)).toHaveLength(1);
+    expect(platform.agentBrowserAttach).not.toHaveBeenCalled();
   });
 });
 
@@ -818,7 +1460,7 @@ describe('Playwright provider', () => {
     const pasted = `${'x'.repeat(PLAYWRIGHT_TEXT_INPUT_MAX + 10)}\r\nend`;
     platform.readClipboardText = vi.fn(async () => pasted);
     setPlatform(platform);
-    const controller = acquireAgentBrowserSurfaceController('pw', { renderMode: 'pw-screencast', session: 's', wsPort: 4321 });
+    const controller = withPort('pw', { renderMode: 'pw-screencast', session: 's' }, 4321);
     controller.attachView(makeSink());
     await flushMicrotasks();
 
@@ -839,7 +1481,7 @@ describe('Playwright provider', () => {
       : { ok: true });
     setPlatform(platform);
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
-    const controller = acquireAgentBrowserSurfaceController('pw', { renderMode: 'pw-screencast', session: 's' });
+    const controller = withPort('pw', { renderMode: 'pw-screencast', session: 's' }, 4321);
     controller.attachView(makeSink());
     getAgentBrowserScreenController('pw')!.chromeActions.reload();
     await flushMicrotasks();
@@ -855,7 +1497,7 @@ describe('Playwright provider', () => {
       ? { ok: true, url: `ws://127.0.0.1:${request.port}` }
       : { ok: true, exitCode: 0, stdout: '', stderr: '', wsPort: 4321 });
     setPlatform(platform);
-    const controller = acquireAgentBrowserSurfaceController('pw', { renderMode: 'pw-screencast', session: 'shared-name', cwd: '/first-project', wsPort: 4321 });
+    const controller = withPort('pw', { renderMode: 'pw-screencast', session: 'shared-name', cwd: '/first-project' }, 4321);
     const sink = makeSink();
     controller.attachView(sink);
     await flushMicrotasks();
@@ -866,7 +1508,7 @@ describe('Playwright provider', () => {
     expect(getAgentBrowserScreenController('pw')!.snapshot().renderMode).toBe('pw-screencast');
     getAgentBrowserScreenController('pw')!.actions.setRenderMode?.('ab-screencast');
     expect(sink.requestRenderSwap).toHaveBeenCalledWith('ab-screencast');
-    controller.updateParams({ renderMode: 'pw-popout', session: 'shared-name', cwd: '/first-project', wsPort: 4322 });
+    controller.updateParams({ renderMode: 'pw-popout', session: 'shared-name', cwd: '/first-project' });
     expect(getAgentBrowserScreenController('pw')!.snapshot().renderMode).toBe('pw-popout');
   });
 });
diff --git a/lib/src/components/wall/agent-browser-surface-controller.ts b/lib/src/components/wall/agent-browser-surface-controller.ts
index 40b82c614..3a0917290 100644
--- a/lib/src/components/wall/agent-browser-surface-controller.ts
+++ b/lib/src/components/wall/agent-browser-surface-controller.ts
@@ -1,13 +1,14 @@
 /**
  * Surface-scoped browser lifecycle; see docs/specs/dor-browser.md →
  * "Agent-Browser Connection". The registry survives panel unmount and is
- * disposed by Wall on kill/render swap. Disposal releases client resources
- * only; Wall owns daemon teardown.
+ * released by Wall on kill/render swap: `closeBrowserSurface` closes the
+ * session too, `disposeAgentBrowserSurfaceController` only the client side.
  */
-import type { PlatformAdapter } from '../../lib/platform/types';
+import type { AgentBrowserAttachResult, AgentBrowserCommandResult, AgentBrowserOpenResult } from '../../lib/platform/types';
 import { isBrowsableUrl, playwrightTextInputs, type BrowserAutomationProvider } from '../../lib/platform/browser-automation';
 import { isAllowedBinaryFor } from '../../lib/agent-browser-binary';
 import { readTextFromClipboard } from '../../lib/clipboard';
+import { messageOf } from '../../lib/errors';
 import { isAbDebugLogsEnabled } from '../../lib/feature-flags';
 import {
   registerAgentBrowserScreen,
@@ -25,14 +26,15 @@ import {
   automationMode,
   automationProvider,
   browserPlatform,
-  browserSessionKey,
   isPopout,
   offeredRenderModes,
   PROVIDER_LABEL,
+  launchBinaryPath,
+  rememberLaunchBinaryPath,
+  surfaceProvider,
   type BrowserPlatform,
 } from './browser-automation';
-import { isToolParams } from './browser-surface';
-import { clearAgentBrowserSessionClosed, isAgentBrowserSessionClosed } from './agent-browser-sessions';
+import { agentBrowserSessionFromParams, isToolParams } from './browser-surface';
 import {
   EDIT_OPS,
   SPECIAL_KEYS,
@@ -129,16 +131,19 @@ export type KeyLike = {
   shiftKey: boolean;
 };
 
-/** Canonical persisted params for a browser surface, as the view reads them.
- *  Pop-out is deliberately absent: it is derived from `renderMode`, never stored
+/** Canonical params for a browser surface, as the view reads them. Pop-out is
+ *  deliberately absent: it is derived from `renderMode`, never stored; nor is
+ *  the stream port, which `dor` hands straight to the controller
  *  (docs/specs/dor-browser.md → "Canonical Params"). */
 export interface AgentBrowserSurfaceParams {
   surfaceType?: string;
   renderMode?: RenderMode;
   cwd?: string;
   session?: string;
+  /** With no `session`, the one the launch opens `url` in; absent, the host
+   *  mints one. */
+  launchSession?: string;
   key?: string;
-  wsPort?: number;
   binaryPath?: string;
   url?: string;
   syncEngaged?: boolean;
@@ -157,6 +162,40 @@ function allowedBinaryPath(candidate: unknown, provider: BrowserAutomationProvid
   return isAllowedBinaryFor(provider, candidate) ? candidate : undefined;
 }
 
+/**
+ * Where the Surface's browser is in its life (docs/specs/dor-browser.md →
+ * "Agent-Browser Connection" has the transition table). The stream connection
+ * exists exactly in `live`, and so does every daemon command (`driver`).
+ */
+type Phase =
+  /** Constructed; no view has started it yet. */
+  | { k: 'idle' }
+  /** No session yet: opening `url` in a browser whose session binds on
+   *  success — in `session` when the launch names one. */
+  | { k: 'launching'; session?: string }
+  /** The session's stream port is being asked of the host (`attach`). */
+  | { k: 'attaching' }
+  /** Streaming from `port`. `seen`: the stream has reported its browser
+   *  connected, so a later drop means it went away — a headed window closed.
+   *  `resumed`: an unpark reconnecting to the port it parked at, not yet
+   *  proven there — nothing drives the daemon until its stream opens, since a
+   *  CLI command would start a new one if it went away while hidden. */
+  | { k: 'live'; port: number; seen: boolean; resumed: boolean }
+  /** Hidden long enough to shed the stream; the daemon stays up at `port`. */
+  | { k: 'parked'; port: number }
+  /** A headed↔headless relaunch is in flight: the host closes the browser and
+   *  kills its daemon before reopening on a new port. */
+  | { k: 'relaunching' }
+  /** Nothing to show: the browser went away, or `error` kept it from opening. */
+  | { k: 'ended'; error?: string }
+  /** Released; `closed` when its session was closed with it, so work still in
+   *  flight closes whatever it brings back up. */
+  | { k: 'disposed'; closed: boolean };
+
+export type BrowserSurfacePhase = Phase['k'];
+
+type Driver = { platform: BrowserPlatform; session: string; binaryPath: string | undefined };
+
 /** The live DOM bindings a mounted view lends the controller. `attachView`
  *  wires these; `detach()` returns them. */
 export interface AgentBrowserViewSink {
@@ -173,23 +212,24 @@ export interface AgentBrowserViewSink {
    *  typed-confirm gate and the Wall's `onSwapRenderMode` are view concerns; the
    *  view reads tabs from the snapshot and decides. */
   requestRenderSwap(mode?: RenderMode): void;
+  /** The first launch failed: the Wall applies the Surface's `launchFallback`. */
+  launchFailed(error: string): void;
 }
 
 /** The single view-facing snapshot, consumed via `useSyncExternalStore`. Only
- *  fields the view actually renders live here — parked state is read by tests via
- *  `isParked()`, and session comes straight from params, so neither belongs in
- *  the snapshot (keeping `parked` out also avoids a wasted re-render per park). */
+ *  what the view renders lives here — session comes straight from params — and
+ *  `phase` is the view's projection: a headless pane that parks or re-attaches
+ *  still shows its last frame, so it reads `live` then, rather than re-rendering
+ *  on every hide and show (`isParked()` answers tests). */
 export interface AgentBrowserViewSnapshot {
   tabs: StreamTab[];
   status: StreamStatus | null;
-  connectionLost: boolean;
   hasFrame: boolean;
+  /** Headed: the browser is (or is being opened as) a separate OS window. */
   poppedOut: boolean;
-  /** A headed↔headless relaunch is in flight: the old stream is gone by design
-   *  and the new one is not yet known, so the view shows neither "ended" nor
-   *  a pop-in/pop-out affordance. */
-  relaunching: boolean;
-  streamPort: number | undefined;
+  phase: BrowserSurfacePhase;
+  /** Why the browser could not be opened, while `phase` is `ended`. */
+  error: string | undefined;
 }
 
 const EMPTY_TABS: StreamTab[] = [];
@@ -204,61 +244,64 @@ export class AgentBrowserSurfaceController {
   private get platform(): BrowserPlatform {
     return this.platformCache ??= browserPlatform(this.provider, this.cwd);
   }
-  private sessionKey(session: string) { return browserSessionKey(session, this.provider, this.cwd); }
   /** Gates the render modes offered; see `ensureStarted`. */
   private readonly isTool: boolean;
-  /** What `setRenderMode` accepts, fixed at start with the host's capabilities. */
-  private renderModes: readonly RenderMode[] = [];
+  /** What `setRenderMode` accepts, fixed on first use with the host's
+   *  capabilities. Never a popout or another provider for a tool, whose
+   *  `render` is `iframe` or `ab-screencast`: the swap would tear the browser
+   *  down and re-derive the same screencast, so asking for a native window would
+   *  get a reload (`docs/specs/dor-tool.md` -> Declaring tools). */
+  private renderModesCache: readonly RenderMode[] | null = null;
+  private get renderModes(): readonly RenderMode[] {
+    return this.renderModesCache ??= offeredRenderModes(this.isTool, this.provider);
+  }
+
+  private phase: Phase = { k: 'idle' };
+  /** The presentation this Surface shows: a separate OS window, or in the pane.
+   *  Seeded from `renderMode`; changed by a relaunch (optimistically, reverted
+   *  if it fails) or, for Playwright, by a native relaunch the host reports. */
+  private headed: boolean;
 
   // --- params (mirrors of the persisted blob) ---
   private session: string | undefined;
+  private launchSession: string | undefined;
   private binaryPath: string | undefined;
-  private wsPort: number | undefined;
+  /** A port handed over before the first start, which then streams from it. */
+  private initialPort: number | undefined;
   private paramsUrl: string | undefined;
   private paramsKey: string | null;
   private paramsSyncEngaged: boolean | undefined;
 
-  // --- stream connection ---
-  // The `streamPort` the connection targets: seeded from params.wsPort, then
-  // driven by recovery / relaunch. Distinct from `wsPort` (the param mirror).
-  private streamPort: number | undefined;
-  private recoverySeq = 0;
+  // --- stream connection (exists only while live) ---
   private connection: AgentBrowserConnection | null = null;
   private screenshotLoop: ScreenshotLoop | null = null;
   private connectionUnsub: (() => void) | null = null;
   private connectionKey: string | null = null;
-  // The `session:streamPort` the connection last (re)connected to. An unpark
+  // The `session:port` the connection last (re)connected to. An unpark
   // reconnects to the same identity, so the last good frame is still valid and
   // must not be blanked to the placeholder; only a real identity change resets
   // hasFrame.
   private lastConnectedIdentity: string | null = null;
-  private liveStreamPort: number | null = null;
+  /** The port of the last live/parked phase, whose viewport sync still holds. */
+  private boundPort: number | undefined;
 
   // --- view state (the snapshot) ---
   private status: StreamStatus | null = null;
   private hasFrame = false;
-  private connectionLost = false;
   private tabs: StreamTab[] = EMPTY_TABS;
-  private poppedOut: boolean;
-  private parked = false;
-
-  // --- relaunch orchestration ---
-  // Gate auto-revert: only treat a dropped stream as "window closed" once the
-  // headed stream has actually connected (avoids reverting mid-relaunch).
-  private headedConnected = false;
-  // True while a headed↔headless relaunch is in flight. The host closes the
-  // current browser and kills its daemon before reopening on a new port, so the
-  // connection is dropped up front (reconcileConnection) rather than left to
-  // fail: its close would otherwise read as "the headed window closed" (an
-  // auto-revert mid-pop-out) or as a stale port (a recovery `stream status`
-  // that spawns a competing daemon — the daemon is deliberately not up). The
-  // CDP observer waits for the same reason. The host hands back the port.
-  private relaunching = false;
 
   // --- visibility / parking ---
   private visible = true;
+  /** Hidden (or detached) for the park delay: a live pane parks. */
+  private parkRequested = false;
   private parkTimer: ReturnType<typeof setTimeout> | undefined;
 
+  /** The latest presentation and page asked for while nothing could be
+   *  driven, applied once the Surface is live: a launch, attach or relaunch
+   *  must not lose them. A launch or relaunch opens the page itself
+   *  (`launchUrl`), and a host that opened it settles it (`openedByHost`). */
+  private pendingIntent: { url?: string; headed?: boolean } = {};
+
   // --- sync-to-pane ---
   private syncEngaged: boolean;
   private device = { width: 1280, height: 720 };
@@ -309,11 +352,6 @@ export class AgentBrowserSurfaceController {
   private cdpKey: string | null = null;
   private cdpTeardown: (() => void) | null = null;
 
-  // --- stale-port recovery ---
-  // Bumped on every recovery attempt so a superseded in-flight `stream status`
-  // query is dropped (mirrors the old effect's cleanup `cancelled` flag).
-  private recoveryGen = 0;
-
   // --- view binding ---
   private sink: AgentBrowserViewSink | null = null;
   private attachToken: object | null = null;
@@ -338,35 +376,37 @@ export class AgentBrowserSurfaceController {
   // observe URL changes); flushed on the next attach.
   private pendingParams = new Map<string, unknown>();
   private pendingTitle: string | null = null;
-  // The renderMode this controller last wrote, until params show it back
-  // (`followParamsHeadedness`).
-  private unechoedRenderMode: RenderMode | null = null;
-
-  private started = false;
-  private disposed = false;
+  private pendingLaunchFailure: string | null = null;
+  /** Host work in flight that can bring the session up (`track`). */
+  private landings = new Set<Promise<void>>();
+  // The value this controller last wrote to each field it also takes from
+  // params, until params show it back. Params predating the write — buffered
+  // while detached, then fed by a remounted view before the flush, or a render
+  // (StrictMode's second effect pass) that ran before the store caught up —
+  // would otherwise undo it: flip the mode back, or read the session a launch
+  // bound as taken away and launch again.
+  private readonly unechoed = new Map<'renderMode' | 'session', unknown>();
 
   private readonly viewListeners = new Set<() => void>();
   private viewSnapshot: AgentBrowserViewSnapshot;
 
   constructor(id: string, params: AgentBrowserSurfaceParams) {
     this.id = id;
-    // An unset mode (a direct mount in tests) is agent-browser.
-    this.provider = automationProvider(params.renderMode) ?? 'agent-browser';
+    this.provider = surfaceProvider(params.renderMode);
     this.cwd = params.cwd;
     // A Surface's kind never changes over its life (a tool's capabilities come
     // and go, its identity does not), so this is safe to seed once.
     this.isTool = isToolParams(params);
     this.session = params.session;
+    this.launchSession = params.launchSession;
     this.binaryPath = allowedBinaryPath(params.binaryPath, this.provider);
-    this.wsPort = params.wsPort;
-    this.streamPort = params.wsPort;
     this.paramsUrl = params.url;
     this.paramsKey = params.key ?? null;
     this.paramsSyncEngaged = params.syncEngaged;
     this.latestRestorableUrl = isBrowsableUrl(params.url) ? params.url : undefined;
-    // poppedOut is derived from the canonical renderMode; an unset mode (a direct
-    // mount in tests) is not popped out.
-    this.poppedOut = isPopout(params.renderMode);
+    // Headedness is derived from the canonical renderMode; an unset mode (a
+    // direct mount in tests) is not popped out.
+    this.headed = isPopout(params.renderMode);
     // A fresh surface auto-engages sync (no persisted flag); a re-attached one
     // restores whatever was persisted into the layout blob.
     this.syncEngaged = params.syncEngaged ?? true;
@@ -386,33 +426,23 @@ export class AgentBrowserSurfaceController {
       applyDevice: (name) => {
         this.lastIssued = null;
         this.setSyncEngaged(false);
-        this.runAgentBrowser(['set', 'device', name]);
+        this.runCommand(['set', 'device', name]);
       },
       applyViewport: (w, h, dpr) => {
         this.lastIssued = null;
         this.setSyncEngaged(false);
-        this.runAgentBrowser(['set', 'viewport', String(w), String(h), String(dpr)]);
+        this.runCommand(['set', 'viewport', String(w), String(h), String(dpr)]);
       },
       openModal: () => openAgentBrowserScreenModal(this.id),
-      setRenderMode: (mode) => {
-        // Only what the modal could offer: the popout below never reaches the
-        // Wall's own tool guard.
-        if (!this.renderModes.includes(mode)) return;
-        // A swap to iframe or the other provider is a render swap handled by
-        // the Wall (the view owns the ≥2-tab confirm gate + onSwapRenderMode);
-        // screencast ↔ popout relaunches this same session, in-controller.
-        if (automationProvider(mode) !== this.provider) this.sink?.requestRenderSwap(mode);
-        else if (isPopout(mode)) this.popOut();
-        else if (this.poppedOut) this.popIn(); // popout → screencast
-      },
+      setRenderMode: (mode, opts) => this.setRenderMode(mode, opts),
     };
 
-    // Native history nav — issued like tab actions, through agentBrowserCommand.
+    // Native history nav — issued like tab actions, through the daemon gate.
     this.chromeActions = {
-      navigate: (url) => { if (url) this.runAgentBrowser(['open', url]); },
-      back: () => this.runAgentBrowser(['back']),
-      forward: () => this.runAgentBrowser(['forward']),
-      reload: () => this.runAgentBrowser(['reload']),
+      navigate: (url) => this.navigate(url),
+      back: () => this.runCommand(['back']),
+      forward: () => this.runCommand(['forward']),
+      reload: () => this.runCommand(['reload']),
     };
 
     this.viewSnapshot = this.buildViewSnapshot();
@@ -428,14 +458,15 @@ export class AgentBrowserSurfaceController {
   snapshot = (): AgentBrowserViewSnapshot => this.viewSnapshot;
 
   private buildViewSnapshot(): AgentBrowserViewSnapshot {
+    const phase = this.phase;
+    const shown = !this.headed && (phase.k === 'parked' || phase.k === 'attaching') ? 'live' : phase.k;
     return {
       tabs: this.tabs,
       status: this.status,
-      connectionLost: this.connectionLost,
       hasFrame: this.hasFrame,
-      poppedOut: this.poppedOut,
-      relaunching: this.relaunching,
-      streamPort: this.streamPort,
+      poppedOut: this.headed,
+      phase: shown,
+      error: phase.k === 'ended' ? phase.error : undefined,
     };
   }
 
@@ -443,19 +474,35 @@ export class AgentBrowserSurfaceController {
   // useSyncExternalStore keeps a stable reference and doesn't spin re-renders.
   private emitView(): void {
     const prev = this.viewSnapshot;
+    const next = this.buildViewSnapshot();
     if (
-      prev.tabs === this.tabs &&
-      prev.status === this.status &&
-      prev.connectionLost === this.connectionLost &&
-      prev.hasFrame === this.hasFrame &&
-      prev.poppedOut === this.poppedOut &&
-      prev.relaunching === this.relaunching &&
-      prev.streamPort === this.streamPort
+      prev.tabs === next.tabs &&
+      prev.status === next.status &&
+      prev.hasFrame === next.hasFrame &&
+      prev.poppedOut === next.poppedOut &&
+      prev.phase === next.phase &&
+      prev.error === next.error
     ) return;
-    this.viewSnapshot = this.buildViewSnapshot();
+    this.viewSnapshot = next;
     for (const listener of this.viewListeners) listener();
   }
 
+  /**
+   * Swap this Surface's render mode, going to `url` too (docs/specs/dor-browser.md
+   * → "Display Modal And Render Swaps"). Only what the modal could offer: the
+   * popout below never reaches the Wall's own tool guard. A swap to iframe or
+   * the other provider is a render swap handled by the Wall (the view owns the
+   * ≥2-tab confirm gate + onSwapRenderMode); screencast ↔ popout relaunches
+   * this same session, in-controller, carrying the page asked for rather than
+   * racing a navigation into it.
+   */
+  setRenderMode(mode: RenderMode, opts?: { url?: string }): void {
+    if (!this.renderModes.includes(mode)) return;
+    if (automationProvider(mode) !== this.provider) this.sink?.requestRenderSwap(mode);
+    else if (isPopout(mode) !== this.headed) this.relaunch(isPopout(mode), opts?.url);
+    else if (opts?.url) this.navigate(opts.url);
+  }
+
   getDeviceSize(): { width: number; height: number } {
     return this.device;
   }
@@ -463,16 +510,7 @@ export class AgentBrowserSurfaceController {
   // --- one-time start (from the first attach; keeps side effects out of render) ---
 
   private ensureStarted(): void {
-    if (this.started || this.disposed) return;
-    this.started = true;
-    // Never a popout or another provider for a tool, whose `render` is `iframe`
-    // or `ab-screencast`: the swap would tear the browser down and re-derive
-    // the same screencast, so asking for a native window would get a reload
-    // (`docs/specs/dor-tool.md` -> Declaring tools).
-    this.renderModes = offeredRenderModes(this.isTool, this.provider);
-    // This surface owns its session again — clear any teardown mark a prior
-    // surface (re-using the same managed name) left behind, so auto-revert works.
-    if (this.session) clearAgentBrowserSessionClosed(this.sessionKey(this.session));
+    if (this.phase.k !== 'idle') return;
     this.watchDpr();
     this.registration = registerAgentBrowserScreen(this.id, {
       snapshot: this.computeScreenSnapshot(),
@@ -484,8 +522,8 @@ export class AgentBrowserSurfaceController {
     });
     this.lastPublishedScreen = null;
     this.publishScreen();
-    this.reconcile();
-    this.maybeRecoverStalePort();
+    this.bind(this.initialPort);
+    this.initialPort = undefined;
   }
 
   // A display-scale (DPR) change resizes nothing, so the pane's ResizeObserver
@@ -569,26 +607,27 @@ export class AgentBrowserSurfaceController {
       sink.setTitle(this.pendingTitle);
       this.pendingTitle = null;
     }
+    if (this.pendingLaunchFailure !== null) {
+      sink.launchFailed(this.pendingLaunchFailure);
+      this.pendingLaunchFailure = null;
+    }
     // The pane-size observer fires on observe and (when syncing) debounces a
     // `set viewport`; issue once explicitly too so re-engaging at an unchanged
     // size still reclaims the viewport. issueSyncToPane no-ops when not capable.
     if (this.syncEngaged) this.issueSyncToPane();
     this.updateParkState();
-    this.reconcile();
     this.publishScreen();
     // After a (re)attach, if a live in-pane connection exists, force one capture
     // so a view remounted within the park debounce repaints instead of sitting
     // blank — the connection's own frame dedup swallows the heartbeat rebroadcast,
     // and the bumped generation defeats the screenshot loop's byte dedup.
-    if (!this.parked && !this.relaunching && !this.poppedOut && this.connection) {
-      this.screenshotLoop?.pulse();
-    }
+    if (this.phase.k === 'live' && !this.headed) this.screenshotLoop?.pulse();
     return {
       // Guard by identity: a stale handle's detach must no-op if a newer view
       // has already attached (StrictMode attach A → detach A → attach B can
       // interleave), and dispose already released everything.
       detach: () => {
-        if (this.disposed || this.attachToken !== token) return;
+        if (this.phase.k === 'disposed' || this.attachToken !== token) return;
         // A provisional decode aimed at the old canvas needs no cancelling here:
         // drawProvisionalFrame captures its sink and drops the bitmap when
         // `this.sink` has moved on, which clearing it below guarantees.
@@ -610,60 +649,55 @@ export class AgentBrowserSurfaceController {
   // --- params ---
 
   updateParams(params: AgentBrowserSurfaceParams): void {
-    if (this.disposed) return;
-    // Mirror every field first, then reconcile once: `{session, wsPort,
-    // binaryPath}` lands as a single write when a daemon boot hands over a
-    // session-less pane, and reacting per field would fire a `stream status`
-    // for the session before its port is mirrored — a CLI spawn that queues
-    // behind the daemon's in-flight `open` only to be discarded.
-    let sessionChanged = false;
-    let binaryPathChanged = false;
-    let portChanged = false;
+    if (this.phase.k === 'disposed') return;
+    // Mirror every field first, then rebind once: binding per field would bind
+    // a new session with the cwd or binary of the old.
     if (params.cwd !== undefined && params.cwd !== this.cwd) {
       this.cwd = params.cwd;
       this.platformCache = null;
     }
-    // Before the port below, so the new stream never inherits a `set viewport`
-    // meant for the old mode.
-    if (params.renderMode) this.followParamsHeadedness(params.renderMode);
-    if (params.session !== this.session) {
-      this.session = params.session;
-      if (params.session) clearAgentBrowserSessionClosed(this.sessionKey(params.session));
-      sessionChanged = true;
-    }
-    const nextBinaryPath = allowedBinaryPath(params.binaryPath, this.provider);
-    if (nextBinaryPath !== this.binaryPath) {
-      this.binaryPath = nextBinaryPath;
-      binaryPathChanged = true;
-    }
-    if (params.wsPort !== this.wsPort) {
-      this.wsPort = params.wsPort;
-      portChanged = true;
-    }
-    if (portChanged) {
-      // Mirrors the old useEffect(() => setStreamPort(wsPort), [wsPort]): a
-      // `dor ab` re-run refreshing wsPort reconnects to the new port.
-      this.setStreamPort(params.wsPort);
-    }
-    // Run this even after the port arm: the persisted params mirror (`wsPort`)
-    // can lag the already-live `streamPort`, making setStreamPort a no-op while
-    // the session identity still changes underneath that connection.
-    if (sessionChanged) {
-      this.reconcile();
-      this.emitView();
-      this.maybeRecoverStalePort();
-    } else if (binaryPathChanged) {
-      this.maybeRecoverStalePort();
-    }
+    // First, so neither a stream this rebinds nor a port handed over next
+    // (`handOverBrowserPort`) inherits a `set viewport` meant for the old mode.
+    if (params.renderMode && this.echoed('renderMode', params.renderMode)) this.followParamsHeadedness(params.renderMode);
+    const sessionChanged = this.echoed('session', params.session) && params.session !== this.session;
+    if (sessionChanged) this.session = params.session;
+    this.launchSession = params.launchSession;
+    this.binaryPath = allowedBinaryPath(params.binaryPath, this.provider);
     if (params.url !== this.paramsUrl) {
       this.paramsUrl = params.url;
-      if (isBrowsableUrl(params.url)) this.latestRestorableUrl = params.url;
+      if (isBrowsableUrl(params.url)) {
+        this.latestRestorableUrl = params.url;
+        // A new target while a launch opens the old one (a Tool re-framed):
+        // go there once live, unless the host opened it after all.
+        if (this.phase.k === 'launching') this.pendingIntent.url = params.url;
+      }
     }
     if ((params.key ?? null) !== this.paramsKey) {
       this.paramsKey = params.key ?? null;
       this.recomputeChrome();
     }
     if (params.syncEngaged !== undefined) this.paramsSyncEngaged = params.syncEngaged;
+    // Before the first attach, `ensureStarted` binds whatever has arrived.
+    if (this.phase.k !== 'idle' && sessionChanged) this.bind();
+  }
+
+  /**
+   * A port a `dor ab` / `dor pw` command just learned for this Surface's
+   * session — the same one again included — to stream from, leaving `ended`
+   * too.
+   */
+  handOver(port: number): void {
+    if (this.phase.k === 'disposed') return;
+    if (this.phase.k === 'idle') this.initialPort = port;
+    else this.adopt(port);
+  }
+
+  /** Whether params may set `field` to `value`: not while they have yet to
+   *  show this controller's own last write of it — the echo itself included. */
+  private echoed(field: 'renderMode' | 'session', value: unknown): boolean {
+    if (!this.unechoed.has(field)) return true;
+    if (this.unechoed.get(field) === value) this.unechoed.delete(field);
+    return false;
   }
 
   /**
@@ -671,23 +705,17 @@ export class AgentBrowserSurfaceController {
    * and the Wall records the host-reported mode in params
    * (`ensureAgentBrowserSurface`). Everything else that arrives here is this
    * controller's own popOut/popIn write coming back, so agent-browser ignores
-   * it, and so does a relaunch in flight. Params that have not yet shown this
-   * controller's last mode write predate it — buffered while detached, or a
-   * render (StrictMode's second effect pass) that ran before the store caught
-   * up — and would flip the mode back.
+   * it, and so does a relaunch in flight.
    */
   private followParamsHeadedness(renderMode: RenderMode): void {
-    if (this.unechoedRenderMode !== null) {
-      if (renderMode === this.unechoedRenderMode) this.unechoedRenderMode = null;
-      return;
-    }
-    if (this.provider !== 'playwright' || this.relaunching) return;
+    if (this.provider !== 'playwright' || this.phase.k === 'relaunching') return;
     const headed = isPopout(renderMode);
-    if (headed === this.poppedOut) return;
+    if (headed === this.headed) return;
     // The last status came from the old browser; auto-revert waits for the
     // new stream's own before it treats a disconnect as the window closing.
     this.setStatus(null);
-    this.setPoppedOut(headed);
+    if (this.phase.k === 'live') this.phase.seen = false;
+    this.setHeaded(headed);
   }
 
   setVisible(visible: boolean): void {
@@ -699,59 +727,261 @@ export class AgentBrowserSurfaceController {
   // Buffer a param write while detached so a minimized (view-less) controller
   // can still record URL changes; flush on the next attach.
   private writeParams(params: Record<string, unknown>): void {
-    if (typeof params.renderMode === 'string') this.unechoedRenderMode = params.renderMode as RenderMode;
+    for (const field of ['renderMode', 'session'] as const) {
+      if (typeof params[field] === 'string') this.unechoed.set(field, params[field]);
+    }
     if (this.sink) this.sink.updateParameters(params);
     else for (const [k, v] of Object.entries(params)) this.pendingParams.set(k, v);
   }
 
+  // --- phase ---
+
+  /** Enter `next`, with the stream connection and CDP observer following it. */
+  private setPhase(next: Phase): void {
+    this.phase = next;
+    if (next.k === 'live' || next.k === 'parked') {
+      // A new or restarted browser comes up at its native viewport; if sync is
+      // engaged, reclaim the pane size. Clearing lastIssued is essential — it
+      // otherwise still holds the previous browser's pane size and
+      // issueSyncToPane would no-op, leaving the fresh browser unsynced.
+      if (next.port !== this.boundPort) {
+        this.boundPort = next.port;
+        this.lastIssued = null;
+      }
+    }
+    this.reconcileConnection();
+    this.reconcileCdp();
+    this.emitView();
+    // An unpark's port is proven only once its stream opens.
+    if (next.k === 'live' && !next.resumed) this.drivable();
+  }
+
+  /** The daemon can be driven again: catch up on what waited for it. */
+  private drivable(): void {
+    // issueSyncToPane no-ops until now, so a resize made meanwhile — behind a
+    // hidden tab, or across a relaunch — is pushed now (lastIssued makes this a
+    // no-op when the pane size did not change).
+    if (this.syncEngaged) this.issueSyncToPane();
+    const { url, headed } = this.pendingIntent;
+    this.pendingIntent = {};
+    if (headed !== undefined && headed !== this.headed) this.relaunch(headed, url);
+    else if (url) this.runCommand(['open', url]);
+  }
+
+  /** (Re)bind the current params: no session launches one, a session without a
+   *  port learns it from the host, one whose port was just handed over streams
+   *  from it at once. */
+  private bind(handover?: number): void {
+    if (!this.session) this.launch();
+    else if (handover) this.goLive(handover);
+    else this.attach(true);
+  }
+
+  /** A port handed over for the bound session: stream from it. A launch or
+   *  relaunch in flight ignores it — the host's answer is the authoritative
+   *  port. */
+  private adopt(port: number): void {
+    const phase = this.phase;
+    if (phase.k === 'relaunching' || phase.k === 'launching') return;
+    if (phase.k === 'live' && phase.port === port) return;
+    if (phase.k === 'parked') this.setPhase({ k: 'parked', port });
+    else this.goLive(port);
+  }
+
+  private goLive(port: number, resumed = false): void {
+    this.setPhase(this.parkRequested && !this.headed
+      ? { k: 'parked', port }
+      : { k: 'live', port, seen: false, resumed });
+  }
+
+  /**
+   * Open this Surface's page in a new browser — in `launchSession` when params
+   * name one — and bind the session the host answers with. Every GUI-created
+   * browser Surface starts here, and so does one restored before its launch
+   * landed. Resolves once the browser is up, never waiting for the page; the
+   * Wall's `whenBrowserLaunched` hears the outcome.
+   */
+  private launch(): void {
+    const platform = this.platform;
+    const url = this.launchUrl();
+    const session = this.launchSession;
+    const phase: Phase = { k: 'launching', ...(session ? { session } : {}) };
+    this.setPhase(phase);
+    const headed = this.headed;
+    // No creation site has to remember the binary a `dor ab` surface resolved.
+    const binaryPath = this.binaryPath ?? launchBinaryPath(this.provider);
+    // A named session's close still in flight — a failed swap reopening the
+    // previous provider's — would land after this open and shut it.
+    const opening = session ? closeLanded(this.provider, this.cwd, session) : Promise.resolve();
+    // Call through the adapter instance — detaching the method drops `this`.
+    // A launch that cannot start settles as late as one that fails, so whoever
+    // created this Surface is always listening by then.
+    const opened: Promise<AgentBrowserOpenResult> = !platform.agentBrowserOpen
+      ? Promise.resolve({ ok: false, error: `${PROVIDER_LABEL[this.provider]} is unavailable on this host` })
+      : !url
+        ? Promise.resolve({ ok: false, error: 'no page to open' })
+        // Released while it waited, it opens nothing for a closed Surface.
+        : opening.then(() => this.phase === phase
+          ? platform.agentBrowserOpen!(url, { headed, ...(session ? { session } : {}) }, binaryPath)
+          : { ok: false });
+    this.track(opened
+      .catch((err: unknown): AgentBrowserOpenResult => ({ ok: false, error: messageOf(err) }))
+      .then((res) => {
+        if (this.phase !== phase) {
+          // The browser that came up belongs to nobody: close it — a session
+          // the host minted, or any once the Surface closed. A named one left
+          // otherwise is whoever holds that session next (a Workspace
+          // transfer's destination opens the same one), or this Surface's own.
+          const closed = this.phase.k === 'disposed' && this.phase.closed;
+          return res.session && (closed || !session)
+            ? closeSessionOn(this.provider, res.cwd ?? this.cwd, res.session, res.binaryPath)
+            : undefined;
+        }
+        if (!res.ok || !res.session) {
+          const error = res.error ?? `Could not open ${PROVIDER_LABEL[this.provider]}`;
+          this.setPhase({ k: 'ended', error });
+          settleLaunch(this.id, error);
+          this.reportLaunchFailure(error);
+          return;
+        }
+        rememberLaunchBinaryPath(this.provider, res.binaryPath);
+        this.session = res.session;
+        if (res.cwd !== undefined && res.cwd !== this.cwd) {
+          this.cwd = res.cwd;
+          this.platformCache = null;
+        }
+        this.binaryPath = allowedBinaryPath(res.binaryPath, this.provider) ?? allowedBinaryPath(binaryPath, this.provider);
+        this.writeParams({
+          session: res.session,
+          ...(res.cwd !== undefined ? { cwd: res.cwd } : {}),
+          ...(res.nativeIdentity !== undefined ? { nativeIdentity: res.nativeIdentity } : {}),
+          ...(this.binaryPath !== undefined ? { binaryPath: this.binaryPath } : {}),
+          // The launch is done: its session and its failure policy with it.
+          launchSession: undefined,
+          launchFallback: undefined,
+        });
+        this.launchSession = undefined;
+        this.openedByHost(url);
+        if (res.wsPort) this.goLive(res.wsPort);
+        else this.attach(false);
+        settleLaunch(this.id, null);
+        return undefined;
+      }));
+  }
+
+  /** Tell the Wall this Surface's first launch failed: it applies the
+   *  fallback the Surface's creator stored (`launchFallback`). A view that is
+   *  not attached hears it when it attaches. */
+  private reportLaunchFailure(error: string): void {
+    if (this.sink) this.sink.launchFailed(error);
+    else this.pendingLaunchFailure = error;
+  }
+
+  /** The page a launch, relaunch or relaunching attach opens: the navigation
+   *  still pending, else the page this Surface is on. */
+  private launchUrl(): string | undefined {
+    const pending = this.pendingIntent.url;
+    return isBrowsableUrl(pending) ? pending : this.currentRelaunchUrl();
+  }
+
+  /** The host opened `url` in the browser it started: a navigation pending to
+   *  that page is done, or `live` would load it a second time. */
+  private openedByHost(url: string | undefined): void {
+    if (url !== undefined && this.pendingIntent.url === url) delete this.pendingIntent.url;
+  }
+
+  /**
+   * Ask the host where the session's stream is (`attach`, which never starts a
+   * daemon to answer). With `relaunch`, a session whose daemon is gone is
+   * reopened at the page this Surface had, so a restore after a reboot comes
+   * back where it was. Without, as on an unpark whose port failed, a gone
+   * daemon is `ended`.
+   */
+  private attach(relaunch: boolean): void {
+    const session = this.session;
+    if (!session) { this.launch(); return; }
+    const platform = this.platform;
+    if (!platform.agentBrowserAttach) {
+      this.setPhase({ k: 'ended' });
+      return;
+    }
+    const phase: Phase = { k: 'attaching' };
+    this.setPhase(phase);
+    const url = relaunch ? this.launchUrl() : undefined;
+    // Call through the adapter instance — pulling the method into a bare
+    // variable would detach `this` and break its internal `requestResponse`.
+    const attached = platform.agentBrowserAttach(session, { url, headed: this.headed }, this.binaryPath)
+      .catch((err: unknown): AgentBrowserAttachResult => ({ ok: false, error: messageOf(err) }))
+      .then((res) => {
+        if (this.phase !== phase) return url ? this.closeIfClosedMeanwhile(session) : undefined;
+        // Only a gone daemon is relaunched at the page; a live one was only
+        // found, so a navigation pending to it still has to run.
+        if (res.relaunched) this.openedByHost(url);
+        if (res.ok && res.wsPort) this.goLive(res.wsPort);
+        else this.setPhase({ k: 'ended', error: relaunch ? res.error : undefined });
+        return undefined;
+      });
+    // Only one naming a page can bring the browser back up.
+    if (url) this.track(attached);
+  }
+
+  /** The Surface was closed while `session` had work in flight that can bring
+   *  its daemon back up — a relaunch, or an attach that relaunches — so close
+   *  it again once that work lands. */
+  private closeIfClosedMeanwhile(session: string): Promise<void> | undefined {
+    return this.phase.k === 'disposed' && this.phase.closed ? this.closeSession(session) : undefined;
+  }
+
+  /** Host work that can bring the session's browser up — a launch, relaunch
+   *  or relaunching attach — held until it has landed, and closed again what
+   *  it brought back for a Surface closed meanwhile (`close`). */
+  private track(work: Promise<unknown>): void {
+    const landed = work.then(() => {}, () => {});
+    this.landings.add(landed);
+    void landed.then(() => this.landings.delete(landed));
+  }
+
+  private closeSession(session: string): Promise<void> {
+    return closeSessionOn(this.provider, this.cwd, session, this.binaryPath);
+  }
+
   // --- parking ---
 
   private updateParkState(): void {
     if (this.parkTimer) { clearTimeout(this.parkTimer); this.parkTimer = undefined; }
     // Detached ⇒ hidden. Popped out is exempt: its stream/CDP observer detects a
     // headed window close and drives auto-revert, so parking it would break that.
-    const shouldPark = !this.poppedOut && (!this.visible || !this.sink);
-    if (!shouldPark) { this.setParked(false); return; }
+    const shouldPark = !this.headed && (!this.visible || !this.sink);
+    if (!shouldPark) { this.setParkRequested(false); return; }
     this.parkTimer = setTimeout(() => {
       this.parkTimer = undefined;
-      this.setParked(true);
+      this.setParkRequested(true);
     }, HIDDEN_PARK_DELAY_MS);
   }
 
   /** Whether the pane is parked (hidden/detached long enough to shed its stream).
    *  Not in the view snapshot — exposed for tests. */
   isParked(): boolean {
-    return this.parked;
+    return this.phase.k === 'parked';
   }
 
-  private setParked(parked: boolean): void {
-    if (this.parked === parked) return;
-    this.parked = parked;
+  private setParkRequested(parkRequested: boolean): void {
+    if (this.parkRequested === parkRequested) return;
+    this.parkRequested = parkRequested;
+    const phase = this.phase;
     // A parked pane holds no stream/screenshot loop; the daemon/session stays
-    // alive and re-broadcasts on reconnect. Treat unpark like a fresh mount for
-    // stale-port recovery: the daemon may have moved while no client was alive.
-    if (parked) this.liveStreamPort = null;
-    this.reconcile();
-    this.maybeRecoverStalePort();
-    // issueSyncToPane no-ops while parked, so a resize that happened behind a
-    // hidden tab was never pushed; reconcile it on unpark (lastIssued makes this
-    // a no-op when the pane size didn't actually change).
-    if (!parked && this.syncEngaged) this.issueSyncToPane();
+    // alive and re-broadcasts on reconnect. An unpark streams from the port it
+    // parked at at once, and asks the host only if that fails: the daemon may
+    // have moved while no client was alive.
+    if (parkRequested && phase.k === 'live') this.setPhase({ k: 'parked', port: phase.port });
+    else if (!parkRequested && phase.k === 'parked') this.goLive(phase.port, true);
   }
 
-  // --- reconcile: connection + CDP observer (idempotent, keyed) ---
-
-  private reconcile(): void {
-    if (this.disposed) return;
-    this.reconcileConnection();
-    this.reconcileCdp();
-  }
+  // --- stream connection (keyed; exists exactly while live) ---
 
   private reconcileConnection(): void {
-    const desired = !this.disposed && !!this.streamPort && !!this.session && !this.parked && !this.relaunching;
-    // recoverySeq forces a reconnect at the same session/port (a same-port
-    // `dor ab` refresh); it is part of the identity key so a bump re-creates.
-    const key = desired ? `${this.session}:${this.streamPort}:${this.recoverySeq}` : null;
+    const phase = this.phase;
+    const key = phase.k === 'live' ? `${this.session}:${phase.port}` : null;
     if (key === this.connectionKey) return;
 
     if (this.connection) {
@@ -763,20 +993,21 @@ export class AgentBrowserSurfaceController {
       this.screenshotLoop = null;
     }
     this.connectionKey = key;
-    if (!desired) return;
+    if (phase.k !== 'live') return;
 
     const session = this.session!;
-    const streamPort = this.streamPort!;
+    const streamPort = phase.port;
 
     // Per-connection pairing: the screenshot loop and the connection are created
     // and disposed together. The loop lives here (not in a separate effect) so a
     // reconnect always re-creates it — a disposed loop would silently drop every
     // frame pulse.
     const screenshotLoop = createScreenshotLoop({
-      getPlatform: () => this.platform,
-      getSession: () => this.session,
-      getBinaryPath: () => this.binaryPath,
-      isCapable: () => !!this.platform.agentBrowserScreenshot && !!this.session,
+      capture: (opts) => {
+        const driver = this.driver();
+        return driver?.platform.agentBrowserScreenshot?.(driver.session, opts, driver.binaryPath) ?? null;
+      },
+      isCapable: () => !!this.driver()?.platform.agentBrowserScreenshot,
       draw: this.drawBitmap,
       // A re-attach bumps drawGeneration so a fresh (blank) canvas repaints even
       // when the capture bytes are identical to the last displayed frame.
@@ -790,28 +1021,38 @@ export class AgentBrowserSurfaceController {
       streamPort,
       binaryPath: this.binaryPath,
       getStreamUrl: async (port) => (await this.platform.getAgentBrowserStreamUrl?.(port)) ?? undefined,
-      runCommand: (targetSession, args, targetBinaryPath) => this.platform.agentBrowserCommand?.(targetSession, args, targetBinaryPath)
+      runCommand: (_session, args) => this.command(args)
         ?? Promise.resolve({ exitCode: 1, stdout: '', stderr: `${PROVIDER_LABEL[this.provider]} commands unavailable` }),
-      canSelectTabs: () => !this.poppedOut && !this.relaunching,
+      canSelectTabs: () => !this.headed,
       wantFrameData: () => this.wantsProvisionalFrame(),
       log: abDebugLog,
     });
     this.connection = connection;
     this.screenshotLoop = screenshotLoop;
     this.connectionUnsub = connection.subscribe((event) => {
+      const phase = this.phase;
+      if (phase.k !== 'live') return;
       if (event.type === 'connection-open') {
-        this.liveStreamPort = event.port;
-        this.setConnectionLost(false);
+        // The port it parked at still answers: the daemon it drives is there.
+        if (phase.resumed) {
+          phase.resumed = false;
+          this.drivable();
+        }
       } else if (event.type === 'connection-close') {
-        if (event.failures >= 3) this.setConnectionLost(true);
+        // An unpark's daemon may have moved while nothing streamed.
+        if (phase.resumed) this.attach(false);
+        else if (event.failures >= 3) this.streamLost();
       } else if (event.type === 'status') {
         this.setStatus(event.status);
-        this.setConnectionLost(event.status.connected === false);
+        // A browser not yet reported connected is still coming up.
+        const lost = !event.status.connected && phase.seen;
+        if (event.status.connected) phase.seen = true;
         if (typeof event.status.viewportWidth === 'number' && typeof event.status.viewportHeight === 'number') {
           this.device = { width: event.status.viewportWidth, height: event.status.viewportHeight };
           this.maybeDisengageSync();
           this.publishScreen();
         }
+        if (lost) this.streamLost();
       } else if (event.type === 'url') {
         // A navigation committed. `tabs` catches up only when the driving
         // command completes — for a slow page, the whole load — so record it now:
@@ -825,7 +1066,7 @@ export class AgentBrowserSurfaceController {
         // Switching the active tab doesn't make the daemon emit a screencast
         // frame, and the dedup'd stream is otherwise silent on a static page, so
         // force one capture so the surface follows the tab the user just selected.
-        if (nextActiveId && nextActiveId !== prevActiveId && !this.poppedOut && !this.relaunching) {
+        if (nextActiveId && nextActiveId !== prevActiveId && !this.headed) {
           screenshotLoop.pulse();
         }
       } else if (event.type === 'frame-pulse') {
@@ -841,9 +1082,12 @@ export class AgentBrowserSurfaceController {
         if (event.data) this.drawProvisionalFrame(event.data, this.paintingForOverdue);
         this.maybeDisengageSync();
         this.publishScreen();
-        if (!this.poppedOut && !this.relaunching) screenshotLoop.pulse();
+        if (!this.headed) screenshotLoop.pulse();
       }
     });
+    // The new stream reports its own status; the last one came from whatever
+    // this Surface streamed before.
+    this.status = null;
     // Unparking reconnects to the same session/port; the last good frame is still
     // valid, so only blank to the placeholder when the identity actually changed.
     const identity = `${session}:${streamPort}`;
@@ -851,7 +1095,6 @@ export class AgentBrowserSurfaceController {
       this.lastConnectedIdentity = identity;
       this.setHasFrame(false);
     }
-    this.setConnectionLost(false);
   }
 
   private paintBitmap(bitmap: ImageBitmap): void {
@@ -890,7 +1133,7 @@ export class AgentBrowserSurfaceController {
     // than painted over the newer frame.
     const mySeq = ++this.frameDrawSeq;
     createImageBitmap(new Blob([bytes], { type: 'image/jpeg' })).then((bitmap) => {
-      if (this.disposed || mySeq !== this.frameDrawSeq || this.sink !== sink) {
+      if (this.phase.k === 'disposed' || mySeq !== this.frameDrawSeq || this.sink !== sink) {
         bitmap.close();
         return;
       }
@@ -922,24 +1165,19 @@ export class AgentBrowserSurfaceController {
   // headed window without polling.
   private reconcileCdp(): void {
     if (this.provider === 'playwright') return; // The host stream also observes headed navigation.
-    const platform = this.platform;
-    // `get cdp-url` is a daemon command: issued mid-relaunch it lands on the
-    // daemon being killed, or spawns a competing one in the gap before the
-    // headed relaunch — which then reattaches headless ("--headed ignored").
-    const desired = !this.disposed && this.poppedOut && !this.relaunching && !!this.session && !!platform.agentBrowserCommand;
-    const key = desired ? `${this.session}:${this.streamPort}` : null;
+    const phase = this.phase;
+    // `get cdp-url` is a daemon command, so it waits for `live` like every other.
+    const desired = phase.k === 'live' && this.headed && !!this.platform.agentBrowserCommand;
+    const key = desired ? `${this.session}:${phase.port}` : null;
     if (key === this.cdpKey) return;
     this.cdpTeardown?.();
     this.cdpTeardown = null;
     this.cdpKey = key;
     if (!desired) return;
-    this.cdpTeardown = this.startCdpObserver(this.session!, platform.agentBrowserCommand!);
+    this.cdpTeardown = this.startCdpObserver();
   }
 
-  private startCdpObserver(
-    session: string,
-    runCommand: NonNullable<PlatformAdapter['agentBrowserCommand']>,
-  ): () => void {
+  private startCdpObserver(): () => void {
     let disposed = false;
     let ws: WebSocket | null = null;
     let nextId = 1;
@@ -980,9 +1218,9 @@ export class AgentBrowserSurfaceController {
     const connect = async () => {
       let cdpUrl: string | null = null;
       try {
-        const result = await runCommand(session, ['get', 'cdp-url'], this.binaryPath);
-        if (result.exitCode === 0) cdpUrl = parseCdpUrl(result.stdout);
-        else abDebugLog(`[ab-panel] cdp-url failed ${JSON.stringify({ stderr: result.stderr, stdout: result.stdout })}`);
+        const result = await this.command(['get', 'cdp-url']);
+        if (result?.exitCode === 0) cdpUrl = parseCdpUrl(result.stdout);
+        else if (result) abDebugLog(`[ab-panel] cdp-url failed ${JSON.stringify({ stderr: result.stderr, stdout: result.stdout })}`);
       } catch (err) {
         abDebugLog(`[ab-panel] cdp-url error ${String(err)}`);
       }
@@ -1009,135 +1247,11 @@ export class AgentBrowserSurfaceController {
     };
   }
 
-  // A persisted panel may restore with a stale wsPort: the session is alive but
-  // the stream server restarted on a new port while VS Code/webview state kept
-  // the old one. Once the old socket is proven dead (or no port was persisted),
-  // ask the host for the current port and rewrite params so the WS reconnects.
-  private maybeRecoverStalePort(): void {
-    // Bump first so any change to the recovery inputs invalidates an in-flight
-    // query (mirrors the old effect's cleanup running on every dep change).
-    const gen = ++this.recoveryGen;
-    const session = this.session;
-    // Session-less is deliberate inertness, not just a null-guard: the pane
-    // context menu's eager connect creates its surface WITHOUT a session
-    // precisely so no recovery/CLI spawn can race the daemon boot
-    // (docs/specs/dor-browser.md → Pane Context Menu Connect). Never derive the
-    // session from `key` here — that would silently reintroduce the race.
-    if (!session) return;
-    // A parked pane must never query the daemon: a `stream status` at the wrong
-    // moment can spawn a competing daemon, and it's a pointless CLI spawn per
-    // hidden pane. Recovery resumes when the pane unparks.
-    if (this.parked) return;
-    // Critical: do NOT query the daemon mid-relaunch. A pop-out/pop-in close+kills
-    // the daemon before reopening; querying `stream status` in that window spawns
-    // a fresh COMPETING headless daemon on a different port and pins the panel to
-    // it — so the panel ends up streaming an about:blank ghost instead of the
-    // headed window. The host hands back the authoritative port when it's done.
-    if (this.relaunching) return;
-    // Once this exact port has opened, a later disconnect is a live stream
-    // failure, not a stale persisted port. Do not ask `stream status` here: the
-    // CLI can spawn a fresh daemon and reset the session, hiding the real failure
-    // and reverting the URL.
-    if (this.streamPort && this.liveStreamPort === this.streamPort) {
-      if (this.connectionLost || this.status?.connected === false) {
-        abDebugLog(`[ab-panel] stream recovery skipped for live port ${JSON.stringify({ session, wsPort: this.streamPort, connectionLost: this.connectionLost, connected: this.status?.connected })}`);
-      }
-      return;
-    }
-    if (this.streamPort && !this.connectionLost && this.status?.connected !== false) return;
-    const platform = this.platform;
-    if (!platform.agentBrowserStreamStatus) return;
-    platform.agentBrowserStreamStatus(session, this.binaryPath).then((res) => {
-      if (gen !== this.recoveryGen || this.disposed) return;
-      if (!res.ok || !res.wsPort) return;
-      this.setConnectionLost(false);
-      this.setStatus(null);
-      if (res.wsPort !== this.streamPort) {
-        this.setStreamPort(res.wsPort);
-        this.writeParams({ wsPort: res.wsPort });
-      } else {
-        this.bumpRecovery();
-      }
-    }).catch(() => {});
-  }
-
-  // The deliberate direct-port reconnect used by pop-out/pop-in (not the passive
-  // persisted-stale-port path above). Resolves true if the stream came/stayed live.
-  private reconcileStreamPort(directPort?: number): Promise<boolean> {
-    if (this.closeIfSessionMarkedClosed()) return Promise.resolve(false);
-    this.setConnectionLost(false);
-    this.setStatus(null);
-    this.setHasFrame(false);
-
-    if (directPort && directPort > 0) {
-      if (directPort !== this.streamPort) {
-        this.setStreamPort(directPort);
-        abDebugLog(`[ab-panel] subscribing to returned stream port ${JSON.stringify({ session: this.session, wsPort: directPort, previousWsPort: this.wsPort })}`);
-      }
-      if (directPort !== this.wsPort) this.writeParams({ wsPort: directPort });
-      else this.bumpRecovery();
-      return Promise.resolve(true);
-    }
-
-    const currentSession = this.session;
-    const platform = this.platform;
-    if (!currentSession || !platform.agentBrowserStreamStatus) {
-      this.bumpRecovery();
-      return Promise.resolve(false);
-    }
-
-    return platform.agentBrowserStreamStatus(currentSession, this.binaryPath).then((res) => {
-      if (this.closeIfSessionMarkedClosed(currentSession)) return false;
-      if (!res.ok || !res.wsPort) return false;
-      if (res.wsPort !== this.streamPort) {
-        this.setStreamPort(res.wsPort);
-        this.writeParams({ wsPort: res.wsPort });
-      } else {
-        this.bumpRecovery();
-      }
-      return true;
-    }).catch(() => false);
-  }
-
-  private setStreamPort(port: number | undefined): void {
-    if (port === this.streamPort) return;
-    this.streamPort = port;
-    // A new/restarted session comes up at agent-browser's native viewport; if
-    // sync is engaged, reclaim the pane size. Clearing lastIssued is essential —
-    // it otherwise still holds the previous session's pane size and
-    // issueSyncToPane would no-op, leaving the fresh browser unsynced (SCALED).
-    if (port && this.syncEngaged) {
-      this.lastIssued = null;
-      this.issueSyncToPane();
-    }
-    this.reconcile();
-    this.emitView();
-    this.maybeRecoverStalePort();
-  }
-
-  private bumpRecovery(): void {
-    this.recoverySeq += 1;
-    this.reconcileConnection();
-  }
-
   // --- view-snapshot field setters (notify on real change) ---
 
   private setStatus(status: StreamStatus | null): void {
-    const prevConnected = this.status?.connected;
     this.status = status;
     this.emitView();
-    if (status?.connected !== prevConnected) {
-      this.maybeRecoverStalePort();
-      this.maybeAutoRevert();
-    }
-  }
-
-  private setConnectionLost(connectionLost: boolean): void {
-    if (this.connectionLost === connectionLost) return;
-    this.connectionLost = connectionLost;
-    this.emitView();
-    this.maybeRecoverStalePort();
-    this.maybeAutoRevert();
   }
 
   private setHasFrame(hasFrame: boolean): void {
@@ -1154,15 +1268,14 @@ export class AgentBrowserSurfaceController {
     this.emitView();
   }
 
-  private setPoppedOut(poppedOut: boolean): void {
-    if (this.poppedOut === poppedOut) return;
-    this.poppedOut = poppedOut;
+  private setHeaded(headed: boolean): void {
+    if (this.headed === headed) return;
+    this.headed = headed;
     this.emitView();
     // Push the render-mode flip (screencast ↔ popout) to the header/modal.
     this.publishScreen();
-    this.reconcile();
+    this.reconcileCdp();
     this.updateParkState();
-    this.maybeAutoRevert();
   }
 
   private setSyncEngaged(syncEngaged: boolean): void {
@@ -1189,7 +1302,7 @@ export class AgentBrowserSurfaceController {
     // is on. Two guards: freeze while a relaunch is in flight (the active tab is
     // momentarily a blank/booting page that must not overwrite the real target),
     // and never record a URL a relaunch cannot restore (latestRestorableUrl).
-    if (!this.relaunching && url !== this.paramsUrl) {
+    if (this.phase.k !== 'relaunching' && url !== this.paramsUrl) {
       this.paramsUrl = url;
       this.writeParams({ url });
     }
@@ -1289,7 +1402,7 @@ export class AgentBrowserSurfaceController {
     // DPR can't be read back from frames, so report the density we'd sync to.
     const viewport = { w: device.width, h: device.height, dpr: displayDpr };
     const state: ScreenState = dimsMatch(viewport, paneCss) ? 'SYNCED' : 'SCALED';
-    const renderMode = automationMode(this.provider, this.poppedOut);
+    const renderMode = automationMode(this.provider, this.headed);
     return { state, viewport, paneCss, displayDpr, syncEngaged: this.syncEngaged, renderMode };
   }
 
@@ -1316,14 +1429,14 @@ export class AgentBrowserSurfaceController {
 
   // Push the current pane size to the browser as a native `set viewport`.
   private issueSyncToPane(): void {
-    // A parked (hidden) pane must not drive the browser viewport: its rect can be
-    // degenerate while hidden. The unpark path reconciles any resize that happened
-    // while parked.
-    if (this.parked) return;
+    // Only a live browser is driven: a parked (hidden) pane's rect can be
+    // degenerate, and nothing reaches a daemon mid-launch or mid-relaunch. The
+    // next `live` reconciles any resize made meanwhile.
+    if (!this.driver()) return;
     // A popped-out surface is a real headed OS window the user drives directly;
     // never force its viewport to the (now-stub) pane size. Sync resumes when it
-    // pops back in — the streamPort-change reclaim re-issues against the fresh session.
-    if (this.poppedOut) return;
+    // pops back in — the new port's reclaim re-issues against the fresh session.
+    if (this.headed) return;
     // Hosts without agentBrowserCommand (e.g. the web demo) can't drive the
     // viewport; stay silent rather than warn on every resize — the surface just
     // reads SCALED.
@@ -1339,7 +1452,7 @@ export class AgentBrowserSurfaceController {
     if (prev && prev.w === w && prev.h === h && dprMatch(prev.dpr, dpr)) return;
     this.lastIssued = { w, h, dpr };
     this.syncConfirmed = false;
-    this.runAgentBrowser(['set', 'viewport', String(w), String(h), String(dpr)]);
+    this.runCommand(['set', 'viewport', String(w), String(h), String(dpr)]);
   }
 
   // Last-writer-wins: drop sync when an external `dor ab set …` takes the
@@ -1368,121 +1481,112 @@ export class AgentBrowserSurfaceController {
 
   // --- relaunch: pop-out / pop-in + auto-revert ---
 
-  private closeIfSessionMarkedClosed(targetSession: string | null | undefined = this.session): boolean {
-    if (!targetSession || !isAgentBrowserSessionClosed(this.sessionKey(targetSession))) return false;
-    this.platform.agentBrowserCommand?.(targetSession, ['close'], this.binaryPath).catch(() => {});
-    return true;
-  }
-
-  // Pop-Out: relaunch this session's browser as a native OS window. The
-  // pane becomes a stub; the stream stays connected to observe tabs/status and
-  // to auto-revert when the window closes. The new Chrome process gets a fresh
-  // stream port, which we write into params so the WS reconnects.
-  // Enter/leave the relaunch window. Entering drops the stream connection and
-  // CDP observer (reconcile gates on `relaunching`); leaving reconnects to
-  // whatever port is current, so callers set the host's port BEFORE leaving.
-  private setRelaunching(relaunching: boolean): void {
-    if (this.relaunching === relaunching) return;
-    this.relaunching = relaunching;
-    this.emitView();
-    this.reconcile();
+  popIn(): void {
+    this.relaunch(false);
   }
 
-  private popOut(): void {
-    const platform = this.platform;
+  /**
+   * Pop-Out / pop-in: relaunch this session's browser headed as a native OS
+   * window, or back headless in the pane, at `url` or the page it is on. The
+   * host closes the browser and kills its daemon before reopening on a new
+   * port, so the stream is dropped up front — its close would read as the
+   * window closing, and a daemon command in the gap spawns a competing daemon —
+   * and reconnects to the port the host hands back. One relaunch at a time, of
+   * a bound browser: anything else keeps only the navigation asked for.
+   */
+  private relaunch(headed: boolean, url?: string): void {
     const session = this.session;
-    if (!session || !platform.agentBrowserPopOut) return;
-    // One relaunch at a time: a second pop-out/pop-in while the host is mid
-    // close→kill→reopen would interleave two relaunches of one session.
-    if (this.relaunching) { abDebugLog('[ab-panel] popOut ignored: relaunch in flight'); return; }
-    if (this.closeIfSessionMarkedClosed(session)) return;
-    this.headedConnected = false;
-    this.setRelaunching(true);
-    this.setPoppedOut(true);
-    this.writeParams({ renderMode: automationMode(this.provider, true) });
-    // Pop-out failed: revert to in-pane unless the stream came back live anyway.
-    const revertUnlessLive = () => this.reconcileStreamPort().then((live) => {
-      if (!live) {
-        this.setPoppedOut(false);
-        this.writeParams({ renderMode: automationMode(this.provider, false) });
+    const platform = this.platform;
+    const k = this.phase.k;
+    const capable = headed ? !!platform.agentBrowserPopOut : !!platform.agentBrowserPopIn;
+    if (!capable || !session || (k !== 'live' && k !== 'parked' && k !== 'ended')) {
+      // Before the browser is bound, the request waits for it; one arriving
+      // mid-relaunch is dropped — one relaunch at a time.
+      if (capable && (k === 'idle' || k === 'launching' || k === 'attaching')) this.pendingIntent.headed = headed;
+      else abDebugLog(`[ab-panel] ${headed ? 'popOut' : 'popIn'} ignored in ${k}`);
+      if (url) this.navigate(url);
+      return;
+    }
+    // The page asked for is the latest navigation, superseding a pending one.
+    if (isBrowsableUrl(url)) {
+      this.latestRestorableUrl = url;
+      this.pendingIntent.url = url;
+    }
+    const target = this.launchUrl();
+    // The phase first: flipping headedness while still live would start the
+    // CDP observer, whose `get cdp-url` would land in the close/reopen gap.
+    const phase: Phase = { k: 'relaunching' };
+    this.setPhase(phase);
+    this.setHeaded(headed);
+    this.writeParams({ renderMode: automationMode(this.provider, headed) });
+    abDebugLog(`[ab-panel] ${headed ? 'popOut' : 'popIn'} -> ${JSON.stringify({ session, url: target })}`);
+    // Call through the adapter instance — detaching the method drops `this`.
+    const relaunched = headed
+      ? platform.agentBrowserPopOut!(session, { rect: paneScreenRect(this.sink?.viewport), url: target }, this.binaryPath)
+      : platform.agentBrowserPopIn!(session, { url: target }, this.binaryPath);
+    this.track(relaunched.catch((err: unknown) => ({ ok: false, wsPort: undefined, error: messageOf(err) })).then((res) => {
+      abDebugLog(`[ab-panel] relaunch result ${JSON.stringify(res)}`);
+      if (this.phase !== phase) return this.closeIfClosedMeanwhile(session);
+      if (res.ok && res.wsPort) {
+        this.openedByHost(target);
+        this.goLive(res.wsPort);
+        return undefined;
       }
-      this.setRelaunching(false);
-    });
-    // Connect to the headed window's fresh port once the relaunch returns it.
-    const url = this.currentRelaunchUrl();
-    abDebugLog(`[ab-panel] popOut -> ${JSON.stringify({ session, url })}`);
-    platform.agentBrowserPopOut(session, { rect: paneScreenRect(this.sink?.viewport), url }, this.binaryPath).then((res) => {
-      abDebugLog(`[ab-panel] popOut result ${JSON.stringify(res)}`);
-      if (this.closeIfSessionMarkedClosed(session)) { this.setRelaunching(false); return; }
-      if (!res.ok) {
-        void revertUnlessLive();
-        return;
+      // Failed: back in the pane at the page it was on, relaunching headless
+      // there if no daemon came up.
+      if (headed) {
+        this.setHeaded(false);
+        this.writeParams({ renderMode: automationMode(this.provider, false) });
       }
-      void this.reconcileStreamPort(res.wsPort);
-      this.setRelaunching(false);
-    }).catch((err) => {
-      abDebugLog(`[ab-panel] popOut error ${String(err)}`);
-      if (this.closeIfSessionMarkedClosed(session)) { this.setRelaunching(false); return; }
-      void revertUnlessLive();
-    });
+      this.attach(true);
+      return undefined;
+    }));
   }
 
-  popIn(): void {
-    const session = this.session;
-    // A session-less pane (an eager swap whose daemon is still booting) has
-    // nothing to relaunch yet; the handover lands as a params refresh.
-    if (!session) return;
-    if (this.relaunching) { abDebugLog('[ab-panel] popIn ignored: relaunch in flight'); return; }
-    if (this.closeIfSessionMarkedClosed(session)) return;
-    this.setRelaunching(true);
-    this.setPoppedOut(false);
-    this.writeParams({ renderMode: automationMode(this.provider, false) });
-    const platform = this.platform;
-    if (!platform.agentBrowserPopIn) { this.setRelaunching(false); return; }
-    // Connect to the fresh port the host returns; the current (headed) port is
-    // about to die with its daemon.
-    const url = this.currentRelaunchUrl();
-    abDebugLog(`[ab-panel] popIn -> ${JSON.stringify({ session, url })}`);
-    platform.agentBrowserPopIn(session, { url }, this.binaryPath).then((res) => {
-      abDebugLog(`[ab-panel] popIn result ${JSON.stringify(res)}`);
-      if (this.closeIfSessionMarkedClosed(session)) { this.setRelaunching(false); return; }
-      return (res.ok ? this.reconcileStreamPort(res.wsPort) : this.reconcileStreamPort())
-        .then(() => this.setRelaunching(false));
-    }).catch(() => {
-      if (this.closeIfSessionMarkedClosed(session)) { this.setRelaunching(false); return; }
-      void this.reconcileStreamPort().then(() => this.setRelaunching(false));
-    });
+  /**
+   * The stream says its browser is gone, or the stream itself is. A headless
+   * one has `ended`: the gate shuts, so nothing reaches a daemon whose port this
+   * controller would never learn. A headed one seen connected auto-reverts —
+   * its window closed, so relaunch headless in the pane; one not yet seen is
+   * still opening. A Dormouse teardown (pane kill, a render-swap away) releases
+   * the controller before it closes the session, so no stream is left to see
+   * that close.
+   */
+  private streamLost(): void {
+    const phase = this.phase;
+    if (phase.k !== 'live') return;
+    if (!this.headed) this.setPhase({ k: 'ended' });
+    else if (phase.seen) this.popIn();
   }
 
-  // Auto-revert: once the headed stream has connected, a later disconnect means
-  // the window closed → relaunch headless and resume streaming. But a disconnect
-  // also happens when Dormouse itself closes the session (pane kill, or a
-  // render-swap away from popout); the closed-session mark tells those apart so
-  // we don't resurrect a session that's being torn down.
-  private maybeAutoRevert(): void {
-    if (!this.poppedOut) { this.headedConnected = false; return; }
-    // The expected mid-relaunch drop isn't the window closing — ignore it.
-    if (this.relaunching) return;
-    if (this.status?.connected === true) this.headedConnected = true;
-    else if (this.headedConnected && (this.status?.connected === false || this.connectionLost)) {
-      if (this.session && isAgentBrowserSessionClosed(this.sessionKey(this.session))) return;
-      this.popIn();
-    }
+  // --- the daemon gate ---
+
+  /** The daemon to drive, only while `live` — and after an unpark, once its
+   *  stream opens: every command, edit and capture takes it from here, since
+   *  mid-launch, mid-attach or mid-relaunch, or for a daemon gone while hidden,
+   *  a CLI command starts a competing daemon at about:blank
+   *  (docs/specs/dor-browser.md → "Agent-Browser Connection"). Call through
+   *  `platform` — pulling a method into a bare variable would detach `this`
+   *  and break an adapter's internal `requestResponse`. */
+  private driver(): Driver | null {
+    if (this.phase.k !== 'live' || this.phase.resumed || !this.session) return null;
+    return { platform: this.platform, session: this.session, binaryPath: this.binaryPath };
   }
 
-  // --- input bridging ---
+  /** One daemon command; null when the gate refuses it or the host cannot run
+   *  one. */
+  private command(args: string[]): Promise<AgentBrowserCommandResult> | null {
+    const driver = this.driver();
+    if (!driver) abDebugLog(`[ab-panel] ${args.join(' ')} dropped in ${this.phase.k}`);
+    return driver?.platform.agentBrowserCommand?.(driver.session, args, driver.binaryPath) ?? null;
+  }
 
-  private runAgentBrowser(args: string[]): void {
-    const session = this.session;
-    if (!session) return;
-    // Call through the adapter instance — pulling the method into a bare variable
-    // would detach `this` and break its internal `requestResponse`.
-    const platform = this.platform;
-    if (!platform.agentBrowserCommand) {
+  private runCommand(args: string[]): void {
+    if (this.driver() && !this.platform.agentBrowserCommand) {
       console.warn(`[${this.provider}] this host cannot run ${PROVIDER_LABEL[this.provider]} commands; tab actions are unavailable`);
       return;
     }
-    platform.agentBrowserCommand(session, args, this.binaryPath).then((result) => {
+    this.command(args)?.then((result) => {
       if (result.exitCode !== 0) {
         console.warn(`[${this.provider}] ${args.join(' ')} failed:`, result.stderr || result.stdout || `exit ${result.exitCode}`);
       }
@@ -1491,6 +1595,25 @@ export class AgentBrowserSurfaceController {
     });
   }
 
+  /** Navigate the active tab. Asked while nothing can be driven, it is kept as
+   *  the one latest intent and run on the next `live`; an ended browser is
+   *  opened again there — attached, relaunching if its daemon is gone, or
+   *  launched when it never had a session. */
+  private navigate(url: string): void {
+    if (!url) return;
+    if (this.driver()) {
+      this.runCommand(['open', url]);
+      return;
+    }
+    if (this.phase.k === 'disposed') return;
+    this.pendingIntent.url = url;
+    if (this.phase.k !== 'ended') return;
+    if (isBrowsableUrl(url)) this.latestRestorableUrl = url;
+    this.bind();
+  }
+
+  // --- input bridging ---
+
   send(payload: Record<string, unknown>): void {
     // Typing is the most latency-sensitive input there is: its echo must not
     // wait a crisp capture round trip any more than a hover does.
@@ -1503,11 +1626,11 @@ export class AgentBrowserSurfaceController {
   }
 
   selectTab(tab: StreamTab): void {
-    if (!tab.active) this.runAgentBrowser(['tab', tab.tabId]);
+    if (!tab.active) this.runCommand(['tab', tab.tabId]);
   }
 
   closeTab(tab: StreamTab): void {
-    this.runAgentBrowser(['tab', 'close', tab.tabId]);
+    this.runCommand(['tab', 'close', tab.tabId]);
   }
 
   private sendKey(e: KeyLike, eventType: 'keyDown' | 'keyUp'): void {
@@ -1565,17 +1688,17 @@ export class AgentBrowserSurfaceController {
     // Native editing chords (select-all/copy/cut) don't fire over the stream
     // input path (CDP commands field is dropped), on any platform — Cmd on
     // macOS, Ctrl elsewhere. Route the intent through the host's purpose-built
-    // edit channel instead. Every shipped host implements `agentBrowserEdit`;
-    // the fall-through covers a host that does not (the fake adapter), so the
-    // page still gets the chord for its own JS shortcuts.
+    // edit channel instead — a daemon command, so gated like the rest. Every
+    // shipped host implements `agentBrowserEdit`; the fall-through covers a
+    // host that does not (the fake adapter), so the page still gets the chord
+    // for its own JS shortcuts.
     if (mod && !e.altKey && !e.shiftKey) {
       const op = EDIT_OPS[e.key.toLowerCase() as keyof typeof EDIT_OPS];
-      // Call through the adapter instance — detaching the method drops `this`.
-      const platform = this.platform;
-      const session = this.session;
-      if (op && platform.agentBrowserEdit && session) {
+      if (op && this.platform.agentBrowserEdit && this.session) {
+        const driver = this.driver();
+        if (!driver?.platform.agentBrowserEdit) return;
         this.openProvisionalWindow();
-        platform.agentBrowserEdit(session, op, this.binaryPath).then((r) => {
+        driver.platform.agentBrowserEdit(driver.session, op, driver.binaryPath).then((r) => {
           if (!r.ok && r.error) console.warn(`[${this.provider}] ${op} failed:`, r.error);
         }).catch((err) => console.warn(`[${this.provider}] ${op} failed:`, err));
         return;
@@ -1586,24 +1709,49 @@ export class AgentBrowserSurfaceController {
 
   // --- teardown ---
 
+  /** Close this Surface's browser session and release the controller. Work in
+   *  flight that could bring the session back up closes it again when it lands.
+   *  Returns the session closed, if any, and when the host answered. */
+  close(): { session?: string; done: Promise<void> } {
+    const phase = this.phase;
+    if (phase.k === 'disposed') return { done: Promise.resolve() };
+    const session = this.session;
+    // A launch still opening a named session brings it up after this close.
+    const named = session ?? (phase.k === 'launching' ? phase.session : undefined);
+    const landing = this.landings.size ? Promise.all(this.landings) : null;
+    this.release(true);
+    const closing = session ? this.closeSession(session) : Promise.resolve();
+    // Work in flight closes the session again once it lands; until then a
+    // launch into the same name waits for it too (`closeLanded`).
+    const done = named && landing
+      ? trackClose(this.provider, this.cwd, named, Promise.all([closing, landing]).then(() => {}))
+      : closing;
+    return { session, done };
+  }
+
+  /** Closed or disposed: nothing here runs again, and a view still mounted
+   *  acquires a new controller for the Surface's next params. */
+  get released(): boolean {
+    return this.phase.k === 'disposed';
+  }
+
+  /** Release every client-side resource, leaving the session to whoever holds it
+   *  next (a Workspace transfer's destination). */
   dispose(): void {
-    if (this.disposed) return;
-    this.disposed = true;
+    if (this.phase.k === 'disposed') return;
+    this.release(false);
+  }
+
+  private release(closed: boolean): void {
+    // A launch in flight lands on a released controller, which closes what it
+    // brings up; whoever awaited one hears that the Surface is gone.
+    settleLaunch(this.id, null);
     if (this.parkTimer) { clearTimeout(this.parkTimer); this.parkTimer = undefined; }
     this.teardownPaneSizeObserver();
     this.paneSize = null;
-    if (this.connection) {
-      this.connectionUnsub?.();
-      this.connectionUnsub = null;
-      this.connection.dispose();
-      this.connection = null;
-    }
-    this.screenshotLoop?.dispose();
-    this.screenshotLoop = null;
-    this.connectionKey = null;
-    this.cdpTeardown?.();
-    this.cdpTeardown = null;
-    this.cdpKey = null;
+    // Leaving `live` drops the connection, its screenshot loop and the CDP
+    // observer.
+    this.setPhase({ k: 'disposed', closed });
     this.dprQuery?.removeEventListener('change', this.onDprChange);
     this.dprQuery = null;
     this.registration?.dispose();
@@ -1627,7 +1775,7 @@ export function acquireAgentBrowserSurfaceController(
   id: string,
   params: AgentBrowserSurfaceParams,
 ): AgentBrowserSurfaceController {
-  const provider = automationProvider(params.renderMode) ?? 'agent-browser';
+  const provider = surfaceProvider(params.renderMode);
   const existing = registry.get(id);
   if (existing?.provider === provider) return existing;
   if (existing) {
@@ -1646,14 +1794,109 @@ export function getAgentBrowserSurfaceController(id: string): AgentBrowserSurfac
 }
 
 /** Release all CLIENT-side resources for a surface (connection, screenshot loop,
- *  CDP observer, timers, screen registration). Does NOT run `agent-browser
- *  close` — daemon/session teardown stays `closeAgentBrowserSession`'s job in
- *  Wall.tsx. A safe no-op for a surface with no controller (iframe/terminal). */
+ *  CDP observer, timers, screen registration), leaving its session running — for
+ *  a Surface whose browser lives on elsewhere. A kill or a swap away uses
+ *  `closeBrowserSurface`. A safe no-op for a surface with no controller
+ *  (iframe/terminal). */
 export function disposeAgentBrowserSurfaceController(id: string): void {
   const controller = registry.get(id);
-  if (!controller) return;
   registry.delete(id);
-  controller.dispose();
+  if (controller) controller.dispose();
+  else settleLaunch(id, null);
+}
+
+// Closes the host has not answered yet, per session, so a launch into the same
+// named session waits them out (`closeLanded`).
+const closesInFlight = new Map<string, Promise<void>>();
+const closeKey = (provider: BrowserAutomationProvider, cwd: string | undefined, session: string) => JSON.stringify([provider, cwd ?? '', session]);
+
+/**
+ * The one way a session is closed; resolves once the host answered. A close
+ * starts no daemon, so it needs no drive gate. `binaryPath` is checked, not
+ * merely typed: it may come off the persisted session blob, and names a program
+ * the host will spawn (`lib/src/lib/agent-browser-binary.ts`).
+ */
+function closeSessionOn(provider: BrowserAutomationProvider, cwd: string | undefined, session: string, binaryPath: unknown): Promise<void> {
+  return trackClose(provider, cwd, session, browserPlatform(provider, cwd)
+    .agentBrowserCommand?.(session, ['close'], allowedBinaryPath(binaryPath, provider))
+    .then(() => {}, () => {}) ?? Promise.resolve());
+}
+
+/** Record `closing` as `session`'s close in flight until it settles. */
+function trackClose(provider: BrowserAutomationProvider, cwd: string | undefined, session: string, closing: Promise<void>): Promise<void> {
+  const key = closeKey(provider, cwd, session);
+  const tracked = closing.finally(() => { if (closesInFlight.get(key) === tracked) closesInFlight.delete(key); });
+  closesInFlight.set(key, tracked);
+  return tracked;
+}
+
+/** Once every close of `session` issued so far has been answered. */
+function closeLanded(provider: BrowserAutomationProvider, cwd: string | undefined, session: string): Promise<void> {
+  return closesInFlight.get(closeKey(provider, cwd, session)) ?? Promise.resolve();
+}
+
+/** Hand `id`'s controller a port a `dor` command just learned, with the
+ *  params that command just refreshed — acquired from them if no view has
+ *  mounted it yet, so its first start streams at once. The params go first, so
+ *  a host-reported presentation or cwd applies before the new stream: sync
+ *  never sizes a headed window. */
+export function handOverBrowserPort(id: string, params: AgentBrowserSurfaceParams, port: number): void {
+  const controller = acquireAgentBrowserSurfaceController(id, params);
+  controller.updateParams(params);
+  controller.handOver(port);
+}
+
+/** Ask `id`'s browser for a render mode and a page — acquired from `params`
+ *  if no view has mounted it yet (a Door a reveal is about to mount), so the
+ *  request waits for its first start rather than being dropped. */
+export function requestBrowserRenderMode(id: string, params: AgentBrowserSurfaceParams, mode: RenderMode, opts?: { url?: string }): void {
+  acquireAgentBrowserSurfaceController(id, params).setRenderMode(mode, opts);
+}
+
+/** Close `params`'s automation session, for a Surface no controller holds.
+ *  No-op for other surface types. */
+function closeBrowserSessionFromParams(params: unknown): Promise<void> {
+  const session = agentBrowserSessionFromParams(params);
+  const { renderMode, cwd, binaryPath } = params as { renderMode?: unknown; cwd?: string; binaryPath?: unknown };
+  const provider = automationProvider(renderMode);
+  return session && provider ? closeSessionOn(provider, cwd, session, binaryPath) : Promise.resolve();
+}
+
+/**
+ * A kill or a swap away from an automated renderer: surface lifetime and browser
+ * lifetime are bound (docs/specs/dor-browser.md → "Placement And Lifetime"), so
+ * close its session and release its controller. The controller closes what it
+ * holds, and closes again after a launch or relaunch still in flight lands;
+ * `params` covers a session no controller holds. Resolves once the host
+ * answered every close. No-op for other surface types.
+ */
+export function closeBrowserSurface(id: string, params: unknown): Promise<void> {
+  const controller = registry.get(id);
+  registry.delete(id);
+  if (!controller) settleLaunch(id, null);
+  const closed = controller?.close();
+  const closing = [closed?.done ?? Promise.resolve()];
+  if (agentBrowserSessionFromParams(params) !== (closed?.session ?? null)) closing.push(closeBrowserSessionFromParams(params));
+  return Promise.all(closing).then(() => {});
+}
+
+// --- first-launch outcomes (the Wall's side of a controller-owned launch) ---
+
+const launchWaiters = new Map<string, (error: string | null) => void>();
+
+/**
+ * The outcome of the first launch of the session-less Surface `id` the caller
+ * just created: `null` once it streams — or once the Surface is gone — else why
+ * it failed. Register before the Surface can mount, and at most once per id.
+ */
+export function whenBrowserLaunched(id: string): Promise<string | null> {
+  return new Promise((resolve) => launchWaiters.set(id, resolve));
+}
+
+function settleLaunch(id: string, error: string | null): void {
+  const settle = launchWaiters.get(id);
+  launchWaiters.delete(id);
+  settle?.(error);
 }
 
 /** For tests: controllers now outlive panel unmount, so a suite reusing a
diff --git a/lib/src/components/wall/browser-automation.test.ts b/lib/src/components/wall/browser-automation.test.ts
index 7228e8655..fee468b07 100644
--- a/lib/src/components/wall/browser-automation.test.ts
+++ b/lib/src/components/wall/browser-automation.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it } from 'vitest';
 import { FakePtyAdapter, setPlatform } from '../../lib/platform';
 import type { PlatformAdapter } from '../../lib/platform/types';
-import { automationMode, automationProvider, isPopout, isScreencast, LaunchBinaryPath, offeredRenderModes } from './browser-automation';
+import { automationMode, automationProvider, forgetLaunchBinaryPaths, isPopout, isScreencast, launchBinaryPath, offeredRenderModes, rememberLaunchBinaryPath } from './browser-automation';
 import { resolveRenderMode } from './browser-surface';
 
 describe('automation render modes', () => {
@@ -27,14 +27,15 @@ describe('automation render modes', () => {
   });
 });
 
-describe('LaunchBinaryPath', () => {
+describe('launchBinaryPath', () => {
+  afterEach(forgetLaunchBinaryPaths);
+
   it('hands GUI launches only the agent-browser binary path', () => {
-    const paths = new LaunchBinaryPath();
-    paths.remember('playwright', '/opt/bin/playwright-cli');
-    expect(paths.get('agent-browser')).toBeUndefined();
-    paths.remember('agent-browser', '/opt/bin/agent-browser');
-    expect(paths.get('agent-browser')).toBe('/opt/bin/agent-browser');
-    expect(paths.get('playwright')).toBeUndefined();
+    rememberLaunchBinaryPath('playwright', '/opt/bin/playwright-cli');
+    expect(launchBinaryPath('agent-browser')).toBeUndefined();
+    rememberLaunchBinaryPath('agent-browser', '/opt/bin/agent-browser');
+    expect(launchBinaryPath('agent-browser')).toBe('/opt/bin/agent-browser');
+    expect(launchBinaryPath('playwright')).toBeUndefined();
   });
 });
 
diff --git a/lib/src/components/wall/browser-automation.ts b/lib/src/components/wall/browser-automation.ts
index 374538ed9..1938906ed 100644
--- a/lib/src/components/wall/browser-automation.ts
+++ b/lib/src/components/wall/browser-automation.ts
@@ -28,6 +28,12 @@ export function automationProvider(mode: unknown): BrowserAutomationProvider | n
   return isAutomationMode(mode) ? AUTOMATION_MODES[mode].provider : null;
 }
 
+/** The provider an automated browser Surface drives; an unset mode (a direct
+ *  mount in tests) is agent-browser. */
+export function surfaceProvider(mode: unknown): BrowserAutomationProvider {
+  return automationProvider(mode) ?? 'agent-browser';
+}
+
 export function isPopout(mode: unknown): boolean {
   return isAutomationMode(mode) && AUTOMATION_MODES[mode].headed;
 }
@@ -77,7 +83,7 @@ export function offeredRenderModes(isTool: boolean, current: BrowserAutomationPr
 
 export type BrowserPlatform = Pick<PlatformAdapter,
   | 'agentBrowserCommand' | 'agentBrowserEdit' | 'agentBrowserScreenshot'
-  | 'agentBrowserStreamStatus' | 'getAgentBrowserStreamUrl' | 'agentBrowserOpen'
+  | 'agentBrowserAttach' | 'getAgentBrowserStreamUrl' | 'agentBrowserOpen'
   | 'agentBrowserPopOut' | 'agentBrowserPopIn'
 >;
 
@@ -99,42 +105,38 @@ export function browserPlatform(provider: BrowserAutomationProvider, cwd?: strin
       if (r.bytes && !(r.bytes instanceof Uint8Array)) r.bytes = new Uint8Array(r.bytes);
       return r;
     },
-    agentBrowserStreamStatus: (session: string, binaryPath?: string) => call({ op: 'streamStatus', session, binaryPath }),
+    agentBrowserAttach: (session: string, opts: { url?: string; headed?: boolean }, binaryPath?: string) => call({ op: 'attach', session, ...opts, binaryPath }),
     getAgentBrowserStreamUrl: async (port: number) => {
       const r = await call({ op: 'streamUrl', port });
       if (!r.ok || !r.url) throw new Error(r.error ?? 'Playwright stream unavailable');
       return r.url;
     },
-    agentBrowserOpen: (url: string, opts: { headed?: boolean }, binaryPath?: string) => call({ op: 'open', url, ...opts, binaryPath }),
+    agentBrowserOpen: (url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string) => call({ op: 'open', url, ...opts, binaryPath }),
     agentBrowserPopOut: (session: string, opts: { url?: string }, binaryPath?: string) => call({ op: 'popOut', session, ...opts, binaryPath }),
     agentBrowserPopIn: (session: string, opts: { url?: string }, binaryPath?: string) => call({ op: 'popIn', session, ...opts, binaryPath }),
   };
 }
 
-/** The key of a session's closed mark (`agent-browser-sessions.ts`). Playwright
- *  session names are unique only within a CLI project scope, so they are keyed
- *  with their cwd. */
-export function browserSessionKey(session: string, provider: BrowserAutomationProvider, cwd?: string): string {
-  return provider === 'playwright' ? JSON.stringify(['playwright', cwd ?? '', session]) : session;
-}
+// The binary path a `dor ab` surface last resolved on a terminal's PATH, one per
+// webview (its Walls share one host).
+let lastAgentBrowserBinaryPath: string | undefined;
 
 /**
- * The binary path a `dor ab` surface last resolved on a terminal's PATH,
- * re-used to spawn an agent-browser for a GUI launch (an embed swapped up to a
- * screencast, a port opened from the terminal context), since the webview/host
- * PATH may not find the binary itself. Agent-browser only: the Playwright host
- * resolves its own installation on every launch.
+ * The binary path a GUI launch of `provider` passes: the one a `dor ab`
+ * surface last resolved on a terminal's PATH, since the webview/host PATH may
+ * not find the binary itself. Agent-browser only: the Playwright host resolves
+ * its own installation on every launch.
  */
-export class LaunchBinaryPath {
-  private last: string | undefined;
+export function launchBinaryPath(provider: BrowserAutomationProvider): string | undefined {
+  return provider === 'agent-browser' ? lastAgentBrowserBinaryPath : undefined;
+}
 
-  /** The binary path a GUI launch of `provider` passes. */
-  get(provider: BrowserAutomationProvider): string | undefined {
-    return provider === 'agent-browser' ? this.last : undefined;
-  }
+/** Record the binary path a `provider` session resolved or launched with. */
+export function rememberLaunchBinaryPath(provider: BrowserAutomationProvider, binaryPath: string | undefined): void {
+  if (binaryPath && provider === 'agent-browser') lastAgentBrowserBinaryPath = binaryPath;
+}
 
-  /** Record the binary path a `provider` session resolved. */
-  remember(provider: BrowserAutomationProvider, binaryPath: string | undefined): void {
-    if (binaryPath && provider === 'agent-browser') this.last = binaryPath;
-  }
+/** For tests: the memo outlives the Wall that filled it. */
+export function forgetLaunchBinaryPaths(): void {
+  lastAgentBrowserBinaryPath = undefined;
 }
diff --git a/lib/src/components/wall/browser-surface.ts b/lib/src/components/wall/browser-surface.ts
index f6a286ed2..f7df22a88 100644
--- a/lib/src/components/wall/browser-surface.ts
+++ b/lib/src/components/wall/browser-surface.ts
@@ -12,6 +12,7 @@ import {
 import { isAutomationMode } from './browser-automation';
 import type { BrowserBinding, SurfaceKind } from 'dor/commands/types';
 import { isToolKeyScope, type ToolKeyScope } from '../../lib/platform/tool-types';
+import { sessionForKey } from 'dor-lib-common/agent-browser';
 
 type BrowserParamsLike = {
   surfaceType?: unknown;
@@ -201,9 +202,8 @@ export function surfaceKindFromParams(params: unknown): SurfaceKind {
 
 /** The automation session a browser surface is bound to — the join key
  *  of the session↔surface registry — or null when the surface is not
- *  automated, or is one the context-menu connect created eagerly and the
- *  daemon has not yet named (`docs/specs/dor-browser.md` → Pane Context Menu
- *  Connect). */
+ *  automated, or its launch has not yet named one (`docs/specs/dor-browser.md`
+ *  → "Agent-Browser Connection"). */
 export function agentBrowserSessionFromParams(params: unknown): string | null {
   if (!isAgentBrowserParams(params)) return null;
   const session = asParams(params).session;
@@ -223,6 +223,34 @@ export function browserBindingFromParams(params: unknown): BrowserBinding | null
   };
 }
 
+/**
+ * What the Wall does when a Surface's first launch fails
+ * (docs/specs/dor-browser.md → "Agent-Browser Connection"), stored by whoever
+ * created it so a pane restored mid-launch still gets it: close the pane, fall
+ * a Tool back to its embed, or restore the renderer a swap replaced.
+ */
+export type LaunchFallback = 'close' | 'embed' | { restore: Record<string, unknown> };
+
+export function launchFallbackFromParams(params: unknown): LaunchFallback | null {
+  const fallback = (params as { launchFallback?: unknown } | null | undefined)?.launchFallback;
+  if (fallback === 'close' || fallback === 'embed') return fallback;
+  const restore = (fallback as { restore?: unknown } | null | undefined)?.restore;
+  return restore && typeof restore === 'object' ? { restore: restore as Record<string, unknown> } : null;
+}
+
+/** The params that launch a Tool's agent-drivable browser at `url`, in the
+ *  session it had or else its own (`tool.<leafId>`), falling back to the embed
+ *  when it cannot come up (docs/specs/dor-tool.md → Serving). */
+export function toolBrowserLaunchParams(leafId: string, params: Record<string, unknown>, url: string): Record<string, unknown> {
+  return {
+    url,
+    renderMode: 'ab-screencast',
+    session: undefined,
+    launchSession: typeof params.session === 'string' ? params.session : sessionForKey(`tool.${leafId}`),
+    launchFallback: 'embed' satisfies LaunchFallback,
+  };
+}
+
 /** The target URL a browser surface carries in its params (`dor list`); null
  *  when absent (e.g. a terminal, or a browser surface with no URL yet). */
 export function browserUrlFromParams(params: unknown): string | null {
diff --git a/lib/src/components/wall/lath-wall-engine.ts b/lib/src/components/wall/lath-wall-engine.ts
index a9b7020a6..93941a782 100644
--- a/lib/src/components/wall/lath-wall-engine.ts
+++ b/lib/src/components/wall/lath-wall-engine.ts
@@ -120,7 +120,8 @@ export function persistableLeafMeta(meta: LeafMeta): LeafMeta {
   const {
     url: _url,
     session: _session,
-    wsPort: _wsPort,
+    launchSession: _launchSession,
+    launchFallback: _launchFallback,
     renderMode: _renderMode,
     toolPortConflict: _toolPortConflict,
     toolAnnouncedPort: _toolAnnouncedPort,
diff --git a/lib/src/components/wall/tool-browser-session.ts b/lib/src/components/wall/tool-browser-session.ts
deleted file mode 100644
index f3404cea5..000000000
--- a/lib/src/components/wall/tool-browser-session.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import type { PlatformAdapter } from '../../lib/platform/types';
-/** The host capabilities this module needs — the same two the CLI path leans
- *  on, narrowed so tests can stub them without a full adapter. */
-type ConnectPlatform = Pick<PlatformAdapter, 'agentBrowserCommand' | 'agentBrowserStreamStatus'>;
-
-/**
- * Open `url` in `session` and hand `surfaceId` the resulting `{session, wsPort}`
- * as one params write for the tool serving trigger.
- *
- * The surface gets its `session` whether or not the open succeeded, so a failed
- * pane's placeholder names the session instead of sitting session-less.
- */
-export async function attachAgentBrowserSession({
-  url,
-  platform,
-  session,
-  surfaceId,
-  binaryPath,
-  refreshSurface,
-}: {
-  url: string;
-  platform: ConnectPlatform;
-  session: string;
-  surfaceId: string;
-  binaryPath?: string;
-  refreshSurface: (surfaceId: string, patch: Record<string, unknown>) => void;
-}): Promise<void> {
-  if (!platform.agentBrowserCommand) return;
-  // The CLI boots the daemon/browser if it isn't already running.
-  const opened = await platform.agentBrowserCommand(session, ['open', url], binaryPath);
-  if (opened.exitCode !== 0) {
-    refreshSurface(surfaceId, { session });
-    return;
-  }
-  // Best-effort stream port so the panel connects straight to the live screencast;
-  // if it's absent or stale the panel recovers it later, so a miss is non-fatal.
-  let wsPort: number | undefined;
-  if (platform.agentBrowserStreamStatus) {
-    const status = await platform.agentBrowserStreamStatus(session, binaryPath);
-    if (status.ok) wsPort = status.wsPort;
-  }
-  // Setting `session` connects the controller (the daemon is up now, so its
-  // recovery is safe to run).
-  refreshSurface(surfaceId, {
-    session,
-    ...(wsPort !== undefined ? { wsPort } : {}),
-  });
-}
diff --git a/lib/src/components/wall/tool-surface.test.ts b/lib/src/components/wall/tool-surface.test.ts
index 69a282974..5cfa1eefd 100644
--- a/lib/src/components/wall/tool-surface.test.ts
+++ b/lib/src/components/wall/tool-surface.test.ts
@@ -134,7 +134,8 @@ describe('tool persistence (regression: review findings 4 and 11)', () => {
       url: 'http://localhost:6006/',
       renderMode: 'ab-screencast',
       session: 'dormouse.w.tool.p1',
-      wsPort: 51234,
+      launchSession: 'dormouse.w.tool.p1',
+      launchFallback: 'embed',
     });
     expect(persistableLeafMeta(meta).params).toEqual({
       surfaceType: 'tool',
diff --git a/lib/src/components/wall/use-dor-control.ts b/lib/src/components/wall/use-dor-control.ts
index 8e70352c2..e9e0c74b9 100644
--- a/lib/src/components/wall/use-dor-control.ts
+++ b/lib/src/components/wall/use-dor-control.ts
@@ -35,6 +35,7 @@ import { isSurfaceClosing } from '../../lib/notepad/notepad-store';
 import { clearToolAnnounce } from '../../lib/tool-announce-store';
 import { isWorkspaceTransferPending } from '../../lib/window-session-aggregator';
 import { stringParam } from './dor-control-shared';
+import { handOverBrowserPort } from './agent-browser-surface-controller';
 import {
   callerStillPlaceable,
   callerStillRunnable,
@@ -44,7 +45,7 @@ import {
 } from './tool-takeover';
 import { attachSurfacePorts } from './surface-ports';
 import { browserSurfaceUrl, hostPathDisplay, iframeRefusal } from './browser-url';
-import { automationCli, automationMode, automationProvider, browserPlatform, type LaunchBinaryPath } from './browser-automation';
+import { automationCli, automationMode, automationProvider, browserPlatform, rememberLaunchBinaryPath } from './browser-automation';
 import { BrowserBindingReservations } from './browser-binding-reservations';
 import {
   agentBrowserSessionFromParams,
@@ -126,21 +127,15 @@ type EnsureAgentBrowserSurfaceResult =
   | { ok: true; status: 'created' | 'existing' | 'replaced'; surfaceId: string; surfaceRef: string; minimized: boolean }
   | { ok: false; message: string };
 
-/** Reuse-or-create an agent-browser browser surface — the surface half of
- *  `dor ab` (the control plane), and, with `session` omitted, the pane context
- *  menu's eager session-less create (docs/specs/dor-browser.md → Pane Context
- *  Menu Connect). At least one of `key` / `session` is required (it names the
- *  surface). */
+/** Reuse-or-create an automated browser surface for the session a `dor ab` /
+ *  `dor pw` command just drove — the surface half of the control plane. */
 type EnsureAgentBrowserSurface = (args: {
   provider?: BrowserAutomationProvider;
   headed?: boolean;
   nativeIdentity?: string;
   cwd?: string;
   key?: string;
-  /** Omitted for the eager connect pane, which is created session-less on
-   *  purpose so the controller stays inert until the daemon is up; the reuse
-   *  arm is skipped (there is no session to match). */
-  session?: string;
+  session: string;
   url?: string;
   wsPort?: number;
   binaryPath?: string;
@@ -546,7 +541,6 @@ export function useDorControl({
   isClosingWorkspace,
   closeSurface,
   revealSurface,
-  launchBinaryPath,
   workspaceRef,
   workspaceScope,
 }: {
@@ -597,8 +591,6 @@ export function useDorControl({
   /** Reveal a Surface (reattaching a Door first) and report whether it ended up
    *  visible. `Wall.tsx` -> `revealSurface`. */
   revealSurface: (id: string) => boolean;
-  /** The binary path a `dor ab` surface last resolved, for GUI launches. */
-  launchBinaryPath: LaunchBinaryPath;
   /** This Wall's own positional Workspace ref, reported by `dor list` so a caller
    *  learns which Workspace answered (docs/specs/dor-cli.md → "Handle Model").
    *  The Window's own ref rides beside it, so `dor list` says which Window
@@ -613,8 +605,8 @@ export function useDorControl({
    *  null. Shared with the context's port launches in Wall.tsx. */
   findSurfaceByParams: (isMatch: (params: unknown) => boolean) => { id: string; minimized: boolean } | null;
   /** Fold a params patch onto a surface (visible pane or minimized door) — the
-   *  one write path a background daemon boot uses to hand a session-less pane
-   *  its `{session, wsPort, binaryPath}`. */
+   *  one write path `dor` uses to hand an existing pane its refreshed
+   *  `binaryPath`. */
   updateSurfaceParams: (id: string, patch: Record<string, unknown>) => void;
   /** Run one `dor` request against this Wall. `dor-control-router.ts` owns the
    *  window listener that chooses which Wall's handler runs. */
@@ -711,8 +703,8 @@ export function useDorControl({
     // live metadata for panes and parked doors alike.
     const session = agentBrowserSessionFromParams(lath.getMeta(target.id)?.params);
     if (!session) {
-      // An eagerly-created connect pane whose daemon boot has not yet named
-      // it (docs/specs/dor-browser.md → Pane Context Menu Connect).
+      // A pane whose launch has not yet named its session
+      // (docs/specs/dor-browser.md → "Agent-Browser Connection").
       detail.respond({ ok: false, error: `surface '${target.ref}' has no ${provider} session yet` });
       return null;
     }
@@ -792,25 +784,27 @@ export function useDorControl({
     minimized = false,
   }) => {
     // Remember the resolved binary so an embed→screencast swap can spawn one.
-    launchBinaryPath.remember(provider, binaryPath);
+    rememberLaunchBinaryPath(provider, binaryPath);
     const refreshedParams = {
       ...(nativeIdentity ? { nativeIdentity } : {}),
       ...(provider === 'playwright' && headed !== undefined ? { renderMode: automationMode(provider, headed) } : {}),
-      ...(wsPort !== undefined ? { wsPort } : {}),
       ...(binaryPath !== undefined ? { binaryPath } : {}),
     };
+    // The stream port is no param: the command just learned it, so the
+    // Surface's controller streams from it at once, even when it is unchanged.
+    const handOver = (id: string) => {
+      if (wsPort !== undefined) handOverBrowserPort(id, lath.getMeta(id)?.params ?? {}, wsPort);
+    };
 
-    let existing: { id: string; minimized: boolean } | null = null;
-    if (session !== undefined) {
-      existing = provider === 'agent-browser'
-        ? findAgentBrowserSurface(session)
-        : findPlaywrightSurface({ key, session, nativeIdentity, cwd });
-    }
+    const existing = provider === 'agent-browser'
+      ? findAgentBrowserSurface(session)
+      : findPlaywrightSurface({ key, session, nativeIdentity, cwd });
     if (existing) {
-      // Reuse: refresh the stream port (OS-assigned, churns across session
-      // restarts) so the panel reconnects to the live stream, and the
-      // resolved binary path alongside it.
+      // Reuse: hand over the stream port (OS-assigned, churns across session
+      // restarts) so the pane reconnects to the live stream, and refresh the
+      // resolved binary path.
       updateSurfaceParams(existing.id, refreshedParams);
+      handOver(existing.id);
       return {
         ok: true,
         status: 'existing',
@@ -821,7 +815,6 @@ export function useDorControl({
     }
 
     const title = key ?? session;
-    if (title === undefined) return { ok: false, message: 'a browser surface needs a key or a session' };
     const target = reference();
     if (!target.ok) return { ok: false, message: target.message };
     const result = createContentSurface({
@@ -830,7 +823,7 @@ export function useDorControl({
         surfaceType: 'browser',
         renderMode: automationMode(provider, false),
         ...(cwd ? { cwd } : {}),
-        ...(session !== undefined ? { session } : {}),
+        session,
         ...(key !== undefined ? { key } : {}),
         ...(url !== undefined ? { url } : {}),
         ...refreshedParams,
@@ -841,6 +834,7 @@ export function useDorControl({
       focusNeutral: true,
     });
     if (!result.ok) return { ok: false, message: result.message };
+    handOver(result.value.id);
     return {
       ok: true,
       status: result.value.status,
@@ -848,7 +842,7 @@ export function useDorControl({
       surfaceRef: result.value.ref,
       minimized,
     };
-  }, [createContentSurface, findAgentBrowserSurface, findPlaywrightSurface, updateSurfaceParams, surfaceRefForId]);
+  }, [createContentSurface, findAgentBrowserSurface, findPlaywrightSurface, updateSurfaceParams, surfaceRefForId, lath]);
 
 
   // The request handler itself. The window listener that picks WHICH Wall runs it
@@ -1673,11 +1667,12 @@ export function useDorControl({
         if (key) browserReservations.current.confirm(key);
         const cwd = stringParam(params.cwd);
         const platform = browserPlatform(provider, cwd);
-        if (!platform.agentBrowserStreamStatus) {
+        if (!platform.agentBrowserAttach) {
           detail.respond({ ok: false, error: 'Playwright is unavailable on this host' });
           return;
         }
-        const status = await platform.agentBrowserStreamStatus(session, binaryPath);
+        // No page named: a session the command left closed is not relaunched.
+        const status = await platform.agentBrowserAttach(session, {}, binaryPath);
         if (!status.ok) {
           detail.respond({ ok: false, error: status.error ?? 'Playwright connection failed' });
           return;
diff --git a/lib/src/components/wall/use-tool-serving.test.tsx b/lib/src/components/wall/use-tool-serving.test.tsx
index c05f2f5d2..e07cfce30 100644
--- a/lib/src/components/wall/use-tool-serving.test.tsx
+++ b/lib/src/components/wall/use-tool-serving.test.tsx
@@ -17,7 +17,7 @@ import { createLathWallEngine, toolLeafMeta } from './lath-wall-engine';
 import type { OpenPort } from '../../lib/platform/types';
 
 const controllerMocks = vi.hoisted(() => ({
-  disposeAgentBrowserSurfaceController: vi.fn(),
+  closeBrowserSurface: vi.fn(),
 }));
 
 vi.mock('./agent-browser-surface-controller', () => controllerMocks);
@@ -105,27 +105,32 @@ describe('port: announced', () => {
     expect(state.params.url).toBe('http://localhost:6006/second/view');
   });
 
-  it('defers Workspace transfer until reopening an existing browser has settled', async () => {
+  it('reopens an existing browser in its own session, deferring Workspace transfer until it binds', async () => {
     const { lath, state } = toolEngine({
       ...announced, toolRender: 'ab-screencast', renderMode: 'ab-screencast',
-      session: 'existing-browser', wsPort: 9222, url: 'http://localhost:6006/', toolAnnouncedPort: 6006,
+      session: 'existing-browser', url: 'http://localhost:6006/', toolAnnouncedPort: 6006,
       binaryPath: '/opt/custom-agent-browser',
     });
-    const opened = Promise.withResolvers<{ exitCode: number; stdout: string; stderr: string }>();
-    const platform = Object.assign(new FakePtyAdapter(), {
-      getOpenPorts: vi.fn(async () => [tcp(6007)]),
-      agentBrowserCommand: vi.fn(() => opened.promise),
-    });
-    setPlatform(platform);
+    setPlatform(Object.assign(new FakePtyAdapter(), { getOpenPorts: vi.fn(async () => [tcp(6007)]) }));
     recordToolAnnounce('tool-1', { port: 6007, name: null, key: null, dehydrate: false, persist: null });
     const doorsRef = { current: [] };
     function Probe() { useToolServing({ lath, doorsRef }); return null; }
     await act(async () => root.render(<Probe />));
-    expect(state.params.url).toBe('http://localhost:6007/');
+
+    // The pane's controller opens the new destination in the session and binary
+    // it had, and binds the session once the browser is up.
+    expect(state.params).toMatchObject({ url: 'http://localhost:6007/', launchSession: 'existing-browser', binaryPath: '/opt/custom-agent-browser' });
+    expect(state.params.session).toBeUndefined();
     expect(() => captureToolParams(lath, ['tool-1'])).toThrow('Wait for the Tool browser to connect');
-    await act(async () => opened.resolve({ exitCode: 0, stdout: '', stderr: '' }));
+    state.set({ session: 'existing-browser' });
     expect(captureToolParams(lath, ['tool-1'])['tool-1'].session).toBe('existing-browser');
-    expect(platform.agentBrowserCommand).toHaveBeenCalledExactlyOnceWith('existing-browser', ['open', 'http://localhost:6007/'], '/opt/custom-agent-browser');
+  });
+
+  it('launches a first browser in the Tool\'s own session', async () => {
+    recordToolAnnounce('tool-1', { port: 6006, name: null, key: null, dehydrate: false, persist: null });
+    const { state } = await run({ ...announced, toolRender: 'ab-screencast' }, [[tcp(6006)]]);
+    expect(state.params).toMatchObject({ url: 'http://localhost:6006/', renderMode: 'ab-screencast', launchSession: 'dormouse.1.tool.tool-1' });
+    expect(state.params.session).toBeUndefined();
   });
 
   it('frames nothing without an announcement, however many ports bind', async () => {
@@ -292,24 +297,24 @@ describe('agent-browser retirement on command exit', () => {
       url: 'http://localhost:6006/',
       renderMode: 'ab-screencast',
       session: 'dormouse.1.tool-1',
-      wsPort: 43123,
       syncEngaged: true,
       binaryPath: '/opt/agent-browser',
     };
-    const { state, platform } = await run(params, [[]]);
-    const close = vi.fn(async () => ({ stdout: '', stderr: '', exitCode: 0 }));
-    platform.agentBrowserCommand = close;
+    const { state } = await run(params, [[]]);
+    controllerMocks.closeBrowserSurface.mockClear();
 
-    // The first tick ran during mount before the close stub was installed; put
-    // the browser state back, then let the next poll exercise retirement.
+    // The first tick retired the browser during mount; put the browser state
+    // back, then let the next poll exercise retirement.
     state.set(params);
     await act(async () => { await vi.advanceTimersByTimeAsync(POLL_MS); });
 
-    expect(close).toHaveBeenCalledWith('dormouse.1.tool-1', ['close'], '/opt/agent-browser');
-    expect(controllerMocks.disposeAgentBrowserSurfaceController).toHaveBeenCalledWith('tool-1');
+    // Its session is closed with its controller, from the params it had.
+    expect(controllerMocks.closeBrowserSurface).toHaveBeenCalledExactlyOnceWith('tool-1', expect.objectContaining({
+      session: 'dormouse.1.tool-1',
+      binaryPath: '/opt/agent-browser',
+    }));
     expect(state.params.url).toBeUndefined();
     expect(state.params.session).toBeUndefined();
-    expect(state.params.wsPort).toBeUndefined();
     expect(state.params.renderMode).toBeUndefined();
     expect(state.params.syncEngaged).toBeUndefined();
   });
diff --git a/lib/src/components/wall/use-tool-serving.ts b/lib/src/components/wall/use-tool-serving.ts
index 02505f7db..8b68edddd 100644
--- a/lib/src/components/wall/use-tool-serving.ts
+++ b/lib/src/components/wall/use-tool-serving.ts
@@ -14,15 +14,13 @@ import {
   isToolParams,
   namespacedToolKey,
   toolKeysEqual,
+  toolBrowserLaunchParams,
   toolPortConflictFromParams,
 } from './browser-surface';
-import { attachAgentBrowserSession } from './tool-browser-session';
 import { listenerUrlsByPort } from './port-url';
 import { getToolAnnounce } from '../../lib/tool-announce-store';
 import { validToolServePath } from '../../lib/tool-announce';
-import { sessionForKey } from 'dor-lib-common/agent-browser';
-import { markAgentBrowserSessionClosed } from './agent-browser-sessions';
-import { disposeAgentBrowserSurfaceController } from './agent-browser-surface-controller';
+import { closeBrowserSurface } from './agent-browser-surface-controller';
 import type { LathWallEngine } from './lath-wall-engine';
 import type { DooredItem } from './wall-types';
 import type { CommandRun } from '../../lib/terminal-state';
@@ -126,25 +124,18 @@ export function useToolServing({
         if (!running || runChanged) seenPorts.current.delete(leaf.id);
 
         if ((hasUrl || hasConflict) && (!running || runChanged)) {
-          const session = typeof leaf.params.session === 'string' ? leaf.params.session : null;
-          if (session) {
-            const binaryPath = typeof leaf.params.binaryPath === 'string' ? leaf.params.binaryPath : undefined;
-            // Mark before close so a popped-out/stream-loss callback cannot
-            // auto-relaunch a browser the command exit is retiring.
-            markAgentBrowserSessionClosed(session);
-            void platform.agentBrowserCommand?.(session, ['close'], binaryPath).catch(() => {});
-          }
           // The browser panel remains mounted behind the terminal half, so its
-          // controller must be disposed explicitly rather than waiting for an
-          // unmount that will not happen.
-          disposeAgentBrowserSurfaceController(leaf.id);
+          // controller must be released explicitly rather than waiting for an
+          // unmount that will not happen — closing its session with it.
+          closeBrowserSurface(leaf.id, leaf.params);
           lath.store.updateParams(leaf.id, {
             url: undefined,
             toolAnnouncedPort: undefined,
             toolAnnouncedPath: undefined,
             toolPortConflict: undefined,
             session: undefined,
-            wsPort: undefined,
+            launchSession: undefined,
+            launchFallback: undefined,
             renderMode: undefined,
             syncEngaged: undefined,
           });
@@ -221,59 +212,33 @@ export function useToolServing({
           entry = entries[0];
         }
 
-        // Frame it, under whichever renderer the tool declared. Show the
-        // destination immediately even for `ab-screencast`: the panel's
-        // session-less branch renders `Connecting to browser session…` while
-        // the daemon boots, and cannot race it (see docs/specs/dor-browser.md
-        // -> Instant create). `toolFace` tests the conflict before the url, so
-        // a stale verdict would keep the conflict forward over the browser.
-        const agentDrivable = leaf.params.toolRender === 'ab-screencast';
+        // Frame it, under whichever renderer the tool declared. `toolFace`
+        // tests the conflict before the url, so a stale verdict would keep the
+        // conflict forward over the browser.
+        //
+        // An agent-drivable tool needs a real browser behind it, bound to the
+        // tool's *own* Surface rather than a second one: a tool's browser is a
+        // param of its own leaf, which is what keeps its id stable while its
+        // capabilities come and go. Its controller launches it — reusing the
+        // session it had, which a changed destination just navigates — and
+        // binds the session once it is up; until then the pane shows the
+        // destination and Workspace transfer waits (docs/specs/dor-browser.md
+        // -> "Agent-Browser Connection").
         const url = new URL(announcedPath, entry.url).href;
-        const session = typeof leaf.params.session === 'string' ? leaf.params.session : sessionForKey(`tool.${leaf.id}`);
-        const binaryPath = typeof leaf.params.binaryPath === 'string' ? leaf.params.binaryPath : undefined;
         lath.store.updateParams(leaf.id, {
-          url,
-          renderMode: agentDrivable ? 'ab-screencast' : 'iframe',
+          ...(leaf.params.toolRender === 'ab-screencast'
+            ? toolBrowserLaunchParams(leaf.id, leaf.params, url)
+            : { url, renderMode: 'iframe' }),
           toolPortConflict: undefined,
           toolAnnouncedPort: announcedPort ?? undefined,
           toolAnnouncedPath: announcedPort === null ? undefined : announcedPath,
-          // Reopening an existing browser is also an in-flight connection:
-          // withhold its binding until open settles so a Workspace move cannot
-          // capture the old stream while this webview still owns the launch.
-          ...(agentDrivable ? { session: undefined, wsPort: undefined } : {}),
-        });
-        if (!agentDrivable) continue;
-
-        // An agent-drivable tool needs a real browser behind it. Bind the
-        // session to the tool's *own* Surface rather than creating a second
-        // one: a tool's browser is a param of its own leaf, which is what keeps
-        // its id stable while its capabilities come and go.
-        await attachAgentBrowserSession({
-          url,
-          platform,
-          session,
-          surfaceId: leaf.id,
-          binaryPath,
-          refreshSurface: (id, patch) => {
-            if (!cancelled && getTerminalPaneState(id).currentCommand?.id === run.id) lath.store.updateParams(id, patch);
-          },
         });
-        // The Surface can be killed while the daemon boots. Param writes no-op
-        // on a dead leaf, but the daemon would keep running with nothing bound
-        // to it and no teardown path — `closeAgentBrowserSession` reads a
-        // `session` param this leaf no longer has. Close it here instead
-        // (docs/specs/dor-tool.md -> Lifecycle: kill reaps the browser's
-        // resources).
-        if (cancelled || !lath.getMeta(leaf.id) || getTerminalPaneState(leaf.id).currentCommand?.id !== run.id) {
-          void platform.agentBrowserCommand?.(session, ['close'], binaryPath).catch(() => {});
-        }
       }
     };
 
-    // `getOpenPorts` shells out (lsof / PowerShell) and an agent-browser launch
-    // is seconds, either of which can outrun the interval. Without this guard a
-    // second tick re-enters a leaf whose `url` is not written yet and issues a
-    // duplicate `agent-browser open`.
+    // `getOpenPorts` shells out (lsof / PowerShell) and can outrun the
+    // interval. Without this guard a second tick re-enters a leaf whose `url`
+    // is not written yet and frames it twice.
     let ticking = false;
     const runTick = async () => {
       if (ticking) return;
diff --git a/lib/src/components/wall/wall-context.tsx b/lib/src/components/wall/wall-context.tsx
index 70b88675f..e63f2e2ef 100644
--- a/lib/src/components/wall/wall-context.tsx
+++ b/lib/src/components/wall/wall-context.tsx
@@ -70,6 +70,8 @@ export interface WallActions {
    *  window.open, surfaced by the proxy shim) becomes a new pane
    *  (docs/specs/dor-browser.md → "Iframe Shim"). */
   onOpenBrowserPane?: (id: string, url: string) => void;
+  /** A browser Surface's first launch failed: apply its `launchFallback`. */
+  onBrowserLaunchFailed?: (id: string, error: string) => void;
   /** The stable `surface:N` ref for a pane/door id (minted lazily, exactly as
    *  `dor list` assigns refs). Used by the pane context menu to show the handle. */
   resolveSurfaceRef: (id: string) => string;
diff --git a/lib/src/components/wall/workspace-transfer.test.ts b/lib/src/components/wall/workspace-transfer.test.ts
index 4c2166e19..44e7e83c9 100644
--- a/lib/src/components/wall/workspace-transfer.test.ts
+++ b/lib/src/components/wall/workspace-transfer.test.ts
@@ -17,6 +17,11 @@ vi.mock('../../lib/terminal-registry', () => ({
   releaseSession: (id: string) => void released.push(id),
 }));
 
+const disposedBrowsers: string[] = [];
+vi.mock('./agent-browser-surface-controller', () => ({
+  disposeAgentBrowserSurfaceController: (id: string) => void disposedBrowsers.push(id),
+}));
+
 const helpers = new Map<string, { id: string }>();
 const forgotten: string[] = [];
 vi.mock('../../lib/helper-terminal', () => ({
@@ -30,6 +35,7 @@ beforeEach(() => {
   resetWorkspaceUi();
   released.length = 0;
   forgotten.length = 0;
+  disposedBrowsers.length = 0;
   helpers.clear();
   clearAllNotepads();
 });
@@ -84,6 +90,7 @@ describe('prepareWorkspaceTransfer', () => {
     // The host may still refuse — the target window can close between the
     // drag's last probe and the drop — so the Workspace is exactly as it was.
     expect(released).toEqual([]);
+    expect(disposedBrowsers).toEqual([]);
     expect(getNotes('pane-a')).toHaveLength(1);
 
     prepared.commit();
@@ -97,9 +104,10 @@ describe('prepareWorkspaceTransfer', () => {
 
     expect(prepared.payload.terminalIds).toEqual(['pane-a']);
     expect(prepared.payload.allIds).toEqual(['pane-a', 'browser-b']);
-    // A browser Surface needs nothing: its agent-browser session lives in the
-    // host and the target reopens from the persisted params.
     expect(released).toEqual(['pane-a']);
+    // A browser's session lives in the host, where the target attaches to it:
+    // only this Window's viewer is released, its session left running.
+    expect(disposedBrowsers).toEqual(['pane-a', 'browser-b']);
   });
 
   it('takes an open helper with its source instead of leaking it', async () => {
diff --git a/lib/src/components/wall/workspace-transfer.ts b/lib/src/components/wall/workspace-transfer.ts
index c858bd62b..374e2ef79 100644
--- a/lib/src/components/wall/workspace-transfer.ts
+++ b/lib/src/components/wall/workspace-transfer.ts
@@ -8,6 +8,7 @@ import { snapshotNotepadForTransfer, removeSurface } from '../../lib/notepad/not
 import type { TerminalGrid } from '../../lib/terminal-transfer';
 import { forgetHelper, getHelper } from '../../lib/helper-terminal';
 import { releaseSession, serializeTerminal, getTerminalInstance } from '../../lib/terminal-registry';
+import { disposeAgentBrowserSurfaceController } from './agent-browser-surface-controller';
 import type { VolatileNotepadSnapshot } from '../../lib/notepad/types';
 import type { PersistedSession, PersistedWorkspace, WorkspaceId } from '../../lib/session-types';
 import type { WorkspaceMeta } from '../../lib/workspace-store';
@@ -124,8 +125,11 @@ export async function prepareWorkspaceTransfer(
       // Forgotten before its Session goes, so the status poller stops and the
       // source pane does not re-open the helper it no longer holds.
       for (const parentId of helpers.keys()) forgetHelper(parentId);
-      // Browser Surfaces need nothing: their agent-browser session lives in the
-      // host, and the target reopens from the persisted params.
+      // A browser's session lives in the host, and the target attaches to it
+      // from the persisted params; this Window only lets go of its viewer, or
+      // a popped-out one would keep streaming here and both would auto-revert
+      // the same window.
+      for (const id of allIds) disposeAgentBrowserSurfaceController(id);
       for (const id of terminalIds) releaseSession(id);
     },
   };
diff --git a/lib/src/host/agent-browser-host.test.ts b/lib/src/host/agent-browser-host.test.ts
index 17db52829..93080061d 100644
--- a/lib/src/host/agent-browser-host.test.ts
+++ b/lib/src/host/agent-browser-host.test.ts
@@ -51,13 +51,31 @@ async function listen(): Promise<{ port: number; server: Server }> {
   return { port: address.port, server };
 }
 
+function closeServer(server: Server): Promise<void> {
+  return new Promise<void>((resolve) => server.close(() => resolve()));
+}
+
 /** A port nothing listens on: bind, read it, release it. */
 async function closedPort(): Promise<number> {
   const { port, server } = await listen();
-  await new Promise<void>((resolve) => server.close(() => resolve()));
+  await closeServer(server);
   return port;
 }
 
+/** Point the host at a fresh state directory for each test of the suite, and
+ *  reset the spawn mock. */
+function useTempSocketDir(prefix: string): void {
+  const originalSocketDir = process.env.AGENT_BROWSER_SOCKET_DIR;
+  beforeEach(() => {
+    spawnMock.mockReset();
+    process.env.AGENT_BROWSER_SOCKET_DIR = mkdtempSync(join(tmpdir(), prefix));
+  });
+  afterEach(() => {
+    if (originalSocketDir === undefined) delete process.env.AGENT_BROWSER_SOCKET_DIR;
+    else process.env.AGENT_BROWSER_SOCKET_DIR = originalSocketDir;
+  });
+}
+
 function writeState(session: string, ext: 'pid' | 'stream', value: number): void {
   writeFileSync(join(process.env.AGENT_BROWSER_SOCKET_DIR!, `${session}.${ext}`), `${value}\n`);
 }
@@ -86,17 +104,7 @@ function enqueueSpawnResults(results: SpawnResult[]) {
 }
 
 describe('agent-browser host relaunch', () => {
-  const originalSocketDir = process.env.AGENT_BROWSER_SOCKET_DIR;
-
-  beforeEach(() => {
-    spawnMock.mockReset();
-    process.env.AGENT_BROWSER_SOCKET_DIR = mkdtempSync(join(tmpdir(), 'dormouse-ab-host-test-'));
-  });
-
-  afterEach(() => {
-    if (originalSocketDir === undefined) delete process.env.AGENT_BROWSER_SOCKET_DIR;
-    else process.env.AGENT_BROWSER_SOCKET_DIR = originalSocketDir;
-  });
+  useTempSocketDir('dormouse-ab-host-test-');
 
   it('closes a stray about:blank tab when tab list reports CLI-style id fields', async () => {
     // No pid file here (an older CLI): the port comes from `stream status` once
@@ -165,7 +173,7 @@ describe('agent-browser host relaunch', () => {
         expect(calls).toContainEqual(['--session', session, 'tab', 'close', 'blank']);
       });
     } finally {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
+      await closeServer(server);
     }
   });
 
@@ -210,7 +218,7 @@ describe('agent-browser host relaunch', () => {
 
       expect(calls.some((args) => args.includes('tab'))).toBe(false);
     } finally {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
+      await closeServer(server);
     }
   });
 
@@ -252,7 +260,7 @@ describe('agent-browser host relaunch', () => {
 
       expect(calls.some((args) => args.includes('tab'))).toBe(false);
     } finally {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
+      await closeServer(server);
     }
   });
 
@@ -296,7 +304,7 @@ describe('agent-browser host relaunch', () => {
       expect(closeCount).toBe(2);
       expect(calls.some((args) => args.includes('tab'))).toBe(false);
     } finally {
-      await new Promise<void>((resolve) => server.close(() => resolve()));
+      await closeServer(server);
     }
   });
 
@@ -349,6 +357,94 @@ describe('agent-browser host relaunch', () => {
   });
 });
 
+describe('agent-browser host attach', () => {
+  const session = 'dormouse.1.default';
+  useTempSocketDir('dormouse-ab-attach-test-');
+
+  it('reads a live daemon\'s port from its state files and spawns nothing', async () => {
+    const { port, server } = await listen();
+    try {
+      // This test process stands in for the live daemon.
+      writeState(session, 'pid', process.pid);
+      writeState(session, 'stream', port);
+      const host = createAgentBrowserHost({ writeClipboardText: vi.fn() });
+      expect(await host.attach(session, { url: 'https://example.com/' })).toEqual({ ok: true, wsPort: port });
+      expect(spawnMock).not.toHaveBeenCalled();
+    } finally {
+      await closeServer(server);
+    }
+  });
+
+  it('never relaunches a daemon that is up but not streaming, nor a gone one it has no page for', async () => {
+    const host = createAgentBrowserHost({ writeClipboardText: vi.fn() });
+    writeState(session, 'pid', process.pid);
+    writeState(session, 'stream', await closedPort());
+    expect((await host.attach(session, { url: 'https://example.com/' })).ok).toBe(false);
+
+    writeState(session, 'pid', DEAD_PID);
+    expect((await host.attach(session, {})).ok).toBe(false);
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  it('relaunches a gone daemon at the page named, headed for a pop-out, and tracks that window for shutdown', async () => {
+    writeState(session, 'pid', DEAD_PID);
+    writeState(session, 'stream', await closedPort());
+    const { port, server } = await listen();
+    const opened = deferred<SpawnResult>();
+    const calls = mockSpawnByCommand({
+      '--headed open': () => {
+        writeState(session, 'pid', DEAD_PID + 1);
+        writeState(session, 'stream', port);
+        return opened.promise;
+      },
+      close: () => ({}),
+    });
+    try {
+      const host = createAgentBrowserHost({ writeClipboardText: vi.fn() });
+      // Two panes restoring one session relaunch it once.
+      const [first, second] = await Promise.all([
+        host.attach(session, { url: 'https://example.com/', headed: true }),
+        host.attach(session, { url: 'https://example.com/', headed: true }),
+      ]);
+      // Opened at the page, so the caller has no navigation left to run.
+      expect(first).toEqual({ ok: true, wsPort: port, relaunched: true });
+      expect(second).toEqual(first);
+      expect(calls).toEqual([['--session', session, '--headed', 'open', 'https://example.com/']]);
+      // A cold start leaves no stray blank tab to sweep once `open` returns.
+      opened.resolve({});
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      expect(calls).toHaveLength(1);
+
+      await host.closePoppedOut();
+      expect(calls).toContainEqual(['--session', session, 'close']);
+    } finally {
+      await closeServer(server);
+    }
+  });
+
+  it('opens a page in a caller-named session, and refuses a malformed one', async () => {
+    const host = createAgentBrowserHost({ writeClipboardText: vi.fn() });
+    const { port, server } = await listen();
+    const calls = mockSpawnByCommand({
+      open: () => {
+        writeState('dormouse.1.tool.a', 'pid', DEAD_PID);
+        writeState('dormouse.1.tool.a', 'stream', port);
+        return {};
+      },
+      stream: () => ({ stdout: JSON.stringify({ port }) }),
+    });
+    try {
+      expect(await host.open('http://localhost:5173/', { session: 'dormouse.1.tool.a' })).toEqual({ ok: true, session: 'dormouse.1.tool.a', wsPort: port });
+      expect(calls[0]).toEqual(['--session', 'dormouse.1.tool.a', 'open', 'http://localhost:5173/']);
+      const spawned = calls.length;
+      expect(await host.open('http://localhost:5173/', { session: '../evil' })).toEqual({ ok: false, error: 'a valid session name is required' });
+      expect(calls).toHaveLength(spawned);
+    } finally {
+      await closeServer(server);
+    }
+  });
+});
+
 describe('agent-browser host screenshot transport', () => {
   // Block body (not `() => spawnMock.mockReset()`): an arrow returning the mock
   // makes vitest register it as a teardown hook and call it — a phantom spawn.
@@ -545,7 +641,7 @@ describe('agent-browser host screenshot transport', () => {
 
   // `binaryPath` crosses from the webview realm and off the persisted session
   // blob, so an unchecked one is arbitrary local execution in the extension host
-  // or the Tauri sidecar. The gate is at the spawn, so it covers streamStatus /
+  // or the Tauri sidecar. The gate is at the spawn, so it covers attach /
   // open / popOut too — the entry points the subcommand allowlist never saw.
   it('refuses a caller-supplied binary path that is not an agent-browser', async () => {
     enqueueSpawnResults([{}]);
@@ -571,17 +667,7 @@ describe('agent-browser host screenshot transport', () => {
 
 // `parseWebviewCommand` in browser-host-shared.ts says why every token is checked.
 describe('agent-browser host webview argv', () => {
-  const originalSocketDir = process.env.AGENT_BROWSER_SOCKET_DIR;
-
-  beforeEach(() => {
-    spawnMock.mockReset();
-    process.env.AGENT_BROWSER_SOCKET_DIR = mkdtempSync(join(tmpdir(), 'dormouse-ab-argv-test-'));
-  });
-
-  afterEach(() => {
-    if (originalSocketDir === undefined) delete process.env.AGENT_BROWSER_SOCKET_DIR;
-    else process.env.AGENT_BROWSER_SOCKET_DIR = originalSocketDir;
-  });
+  useTempSocketDir('dormouse-ab-argv-test-');
 
   it('runs exactly the argv shapes the webview sends', async () => {
     const shapes = [
@@ -652,7 +738,7 @@ describe('agent-browser host webview argv', () => {
       expect((await host.command(session, ['close'])).exitCode).toBe(1);
       expect((await host.edit(session, 'copy')).ok).toBe(false);
       expect((await host.screenshotToFile(session, {})).ok).toBe(false);
-      expect((await host.streamStatus(session)).ok).toBe(false);
+      expect((await host.attach(session, { url: 'https://example.com/' })).ok).toBe(false);
       expect((await host.popOut(session, { url: 'https://example.com/' })).ok).toBe(false);
       expect((await host.popIn(session, { url: 'https://example.com/' })).ok).toBe(false);
     }
diff --git a/lib/src/host/agent-browser-host.ts b/lib/src/host/agent-browser-host.ts
index 31e69e94a..c3e8ddfa2 100644
--- a/lib/src/host/agent-browser-host.ts
+++ b/lib/src/host/agent-browser-host.ts
@@ -21,10 +21,11 @@
  *    (select-all/copy/cut) the stream input path can't dispatch; copy/cut land
  *    on the OS clipboard.
  * 3. `screenshot` — captures one device-resolution frame and returns the bytes.
- * 4. `streamStatus` — reads the current stream port so restored panels recover
- *    from a stale persisted `wsPort`.
- * 5. `open` — spawns a managed namespaced session and opens a url, backing a
- *    render swap (docs/specs/dor-browser.md → "Display Modal And Render Swaps").
+ * 4. `attach` — reports a session's live stream port from its state files,
+ *    never spawning a daemon; relaunches a gone one at the page the pane had.
+ * 5. `open` — opens a url in a new managed session (or a caller-named one),
+ *    backing every GUI launch (docs/specs/dor-browser.md → "Agent-Browser
+ *    Connection").
  * 6. `popOut` / `popIn` — relaunch a session headed/headless at its live active
  *    url (Chrome's mode is fixed at launch, so this is a close + relaunch).
  * 7. `closePoppedOut` — close every still-headed window **and drop the capture
@@ -55,13 +56,13 @@ import { randomBytes } from 'crypto';
 import { isAllowedAgentBrowserBinary } from '../lib/agent-browser-binary';
 import { type AgentBrowserTab, parseAgentBrowserTabs } from '../lib/agent-browser-tab';
 import type {
+  AgentBrowserAttachResult,
   AgentBrowserCommandResult,
   AgentBrowserEditOp,
   AgentBrowserEditResult,
   AgentBrowserOpenResult,
   AgentBrowserPopResult,
   AgentBrowserScreenshotResult,
-  AgentBrowserStreamStatusResult,
 } from '../lib/platform/types';
 import { isBrowsableUrl } from '../lib/platform/browser-automation';
 import { privateCaptureDir } from './private-capture-dir';
@@ -92,7 +93,7 @@ function webviewArgv(command: WebviewCommand): string[] {
 
 // A capture can queue behind a page-loading `open` for the CLI's whole 25s
 // action timeout; past this it is wedged, and killed so it cannot pin
-// `oneCapture`. Every adapter has stopped waiting by then anyway.
+// `joinInFlight`. Every adapter has stopped waiting by then anyway.
 const CAPTURE_TIMEOUT_MS = 30_000;
 const STREAM_PORT_READ_ATTEMPTS = 4;
 const STREAM_PORT_READ_DELAY_MS = 150;
@@ -121,8 +122,8 @@ export interface AgentBrowserHost {
   edit(session: string, op: AgentBrowserEditOp, binaryPath?: string): Promise<AgentBrowserEditResult>;
   screenshot(session: string, opts: { format?: 'jpeg' | 'png'; quality?: number }, binaryPath?: string): Promise<AgentBrowserScreenshotResult>;
   screenshotToFile(session: string, opts: { format?: 'jpeg' | 'png'; quality?: number }, binaryPath?: string): Promise<AgentBrowserScreenshotFileResult>;
-  streamStatus(session: string, binaryPath?: string): Promise<AgentBrowserStreamStatusResult>;
-  open(url: string, opts: { headed?: boolean }, binaryPath?: string): Promise<AgentBrowserOpenResult>;
+  attach(session: string, opts: { url?: string; headed?: boolean }, binaryPath?: string): Promise<AgentBrowserAttachResult>;
+  open(url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string): Promise<AgentBrowserOpenResult>;
   popOut(session: string, opts: { rect?: { x: number; y: number; width: number; height: number }; url?: string }, binaryPath?: string): Promise<AgentBrowserPopResult>;
   popIn(session: string, opts: { url?: string }, binaryPath?: string): Promise<AgentBrowserPopResult>;
   closePoppedOut(): Promise<void>;
@@ -136,7 +137,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
   // close it on shutdown or it orphans (spec → "Pop-Out" lifecycle:
   // "Dormouse/editor quits → headed windows are cleaned up; no orphans").
   // Headless sessions are deliberately NOT tracked — they're left alive to
-  // reattach across webview reloads (the wsPort/stream-recovery design).
+  // reattach across webview reloads (`attach`).
   const poppedOutSessions = new Map<string, string | undefined>();
   // A relaunch returns once the daemon is streamable, while its `open` command
   // may remain pending until page load. Key the post-open blank-tab sweep so a
@@ -147,8 +148,8 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
   function beginRelaunch(session: string): number {
     const generation = ++nextRelaunchGeneration;
     relaunchGenerations.set(session, generation);
-    // The relaunched daemon's captures must not join its predecessor's.
-    forgetCaptures(session);
+    // The relaunched daemon's work must not join its predecessor's.
+    forgetInFlight(session);
     return generation;
   }
 
@@ -161,7 +162,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
   // arbitrary local execution in the extension host or the Tauri sidecar — the
   // exact escape the nonce CSP exists to prevent, and reachable without any user
   // interaction on the next launch. The argv check in `command()` does not
-  // cover it: `streamStatus`, `open` and `popOut` supply their own args and
+  // cover it: `attach`, `open` and `popOut` supply their own args and
   // take a `binaryPath` of their own. A refused path is dropped, not fatal: the
   // host's own candidates still run, so a stale or hostile value degrades to
   // "resolve it yourself" rather than to a broken surface.
@@ -279,6 +280,30 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     });
   }
 
+  function processAlive(pid: number): boolean {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false; // ESRCH (gone), or EPERM: not a daemon this user started
+    }
+  }
+
+  /** The port `<session>.stream` names, when something accepts on it. */
+  async function acceptingStreamPort(session: string): Promise<number | undefined> {
+    const port = await readStateNumber(session, 'stream');
+    return port !== undefined && await portAccepts(port) ? port : undefined;
+  }
+
+  /** The session's daemon as its state files describe it — a CLI verb would
+   *  start one to answer (docs/specs/dor-browser.md → "Pop-Out"): the pid file's
+   *  pid, whether that process is alive, and its stream port if it accepts. */
+  async function daemonState(session: string): Promise<{ pid: number | undefined; alive: boolean; wsPort?: number }> {
+    const pid = await readStateNumber(session, 'pid');
+    if (pid === undefined || !processAlive(pid)) return { pid, alive: false };
+    return { pid, alive: true, wsPort: await acceptingStreamPort(session) };
+  }
+
   /** Terminate the session's daemon and wait for it to exit. Returns the pid
    *  the pid file named (dead or not), so a relaunch can tell the daemon that
    *  replaces it from the stale state files it leaves behind. */
@@ -293,9 +318,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     // Wait for the process to actually exit (signal 0 throws once it's gone), so
     // the relaunch doesn't race a daemon that's still shutting down.
     for (let i = 0; i < 40; i++) {
-      try {
-        process.kill(pid, 0);
-      } catch {
+      if (!processAlive(pid)) {
         log(`[ab-relaunch] daemon ${pid} for ${session} exited after ${i * 50}ms`);
         return pid;
       }
@@ -338,8 +361,8 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
         return { wsPort: await readStreamPort(session, binaryPath), opened };
       }
       if (daemonUp) {
-        const port = await readStateNumber(session, 'stream');
-        if (port !== undefined && await portAccepts(port)) return { wsPort: port, opened };
+        const port = await acceptingStreamPort(session);
+        if (port !== undefined) return { wsPort: port, opened };
       }
       await delay(LAUNCH_POLL_MS);
     }
@@ -394,7 +417,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     await screenshotDir.remove();
   }
 
-  // Reused per session so we don't litter with one file per frame; `oneCapture`
+  // Reused per session so we don't litter with one file per frame; `joinInFlight`
   // keeps one capture in flight per session, so overwriting is safe. The
   // random component is per session, so the name stays stable for reuse while
   // being unguessable from the session key alone.
@@ -408,32 +431,33 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     return path.join(await screenshotDir.get(), `shot-${name}.${ext}`);
   }
 
-  // One capture per session and format at a time, whoever asks — surfaces can
-  // share a session, and a caller re-asks after its adapter's timeout. A second
-  // spawn would only queue behind the first in the daemon, then race it for
-  // the session's one capture file, so a caller asking mid-capture joins it —
-  // never one from before the session's close or relaunch. The spawn's
-  // `CAPTURE_TIMEOUT_MS` bounds how long any capture stays joinable.
-  type PendingCapture = { session: string; promise: Promise<unknown> };
-  const capturesInFlight = new Map<string, PendingCapture>();
-  function oneCapture<T>(session: string, kind: string, capture: () => Promise<T>): Promise<T> {
+  // Work a caller asking meanwhile joins rather than repeats, one per session
+  // and kind: a capture (surfaces can share a session, and a caller re-asks
+  // after its adapter's timeout; a second spawn would only queue behind the
+  // first in the daemon, then race it for the session's one capture file), or
+  // an attach (two panes restoring one session relaunch it once). Never work
+  // from before the session's close or relaunch (`forgetInFlight`); the
+  // capture spawn's `CAPTURE_TIMEOUT_MS` bounds how long one stays joinable.
+  type InFlight = { session: string; kind: string; promise: Promise<unknown> };
+  const inFlight = new Map<string, InFlight>();
+  function joinInFlight<T>(session: string, kind: string, work: () => Promise<T>): Promise<T> {
     const key = `${kind}\0${session}`;
-    const pending = capturesInFlight.get(key);
+    const pending = inFlight.get(key);
     if (pending) return pending.promise as Promise<T>;
-    const entry: PendingCapture = { session, promise: Promise.resolve() };
-    const promise = capture().finally(() => {
-      if (capturesInFlight.get(key) === entry) capturesInFlight.delete(key);
+    const entry: InFlight = { session, kind, promise: Promise.resolve() };
+    const promise = work().finally(() => {
+      if (inFlight.get(key) === entry) inFlight.delete(key);
     });
     entry.promise = promise;
-    capturesInFlight.set(key, entry);
+    inFlight.set(key, entry);
     return promise;
   }
 
-  /** Join none of `session`'s pending captures, and give its next one a fresh
-   *  file, so one still running cannot overwrite it. */
-  function forgetCaptures(session: string): void {
-    for (const [key, entry] of capturesInFlight) {
-      if (entry.session === session) capturesInFlight.delete(key);
+  /** Join none of `session`'s pending work but the `keep` kind, and give its
+   *  next capture a fresh file, so one still running cannot overwrite it. */
+  function forgetInFlight(session: string, keep?: string): void {
+    for (const [key, entry] of inFlight) {
+      if (entry.session === session && entry.kind !== keep) inFlight.delete(key);
     }
     screenshotNames.delete(session);
   }
@@ -454,7 +478,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     if (parsed.kind === 'close') {
       poppedOutSessions.delete(session);
       relaunchGenerations.delete(session);
-      forgetCaptures(session);
+      forgetInFlight(session);
     }
     return runWithBinaryFallback(['--session', session, ...webviewArgv(parsed)], binaryPath);
   }
@@ -519,7 +543,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
       return { ok: false, error: 'a valid session name is required' };
     }
     const format = captureFormat(opts.format);
-    return oneCapture(session, `file:${format}`, async (): Promise<AgentBrowserScreenshotFileResult> => {
+    return joinInFlight(session, `file:${format}`, async (): Promise<AgentBrowserScreenshotFileResult> => {
       const ext = format === 'png' ? 'png' : 'jpg';
       let out: string;
       try {
@@ -553,7 +577,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     // Joined whole, read and unlink included: a caller joining only the capture
     // would read a file the first caller has already removed.
     const format = captureFormat(opts.format);
-    return oneCapture(session, `bytes:${format}`, async (): Promise<AgentBrowserScreenshotResult> => {
+    return joinInFlight(session, `bytes:${format}`, async (): Promise<AgentBrowserScreenshotResult> => {
       const shot = await screenshotToFile(session, opts, binaryPath);
       if (!shot.ok) return { ok: false, error: shot.error };
       try {
@@ -573,36 +597,73 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     });
   }
 
-  async function streamStatus(session: string, binaryPath?: string): Promise<AgentBrowserStreamStatusResult> {
+  /** The `open` argv for `session`, tracking a headed one for shutdown before
+   *  its launch — a window whose page never loads is still closed — and
+   *  dropping a headless one. */
+  function openArgs(session: string, url: string, headed: boolean, binaryPath: string | undefined): string[] {
+    if (headed) poppedOutSessions.set(session, binaryPath);
+    else poppedOutSessions.delete(session);
+    return ['--session', session, ...(headed ? ['--headed'] : []), 'open', url];
+  }
+
+  // A launch into a daemon it did not just kill — a GUI open, or an attach
+  // relaunching a gone one — sweeps no blank tabs: only a relaunch's
+  // close+reopen leaves a stray one. Nothing coming up is the one failure,
+  // and closes whatever did (a no-op without a daemon: `close` starts none).
+  async function coldLaunch(
+    label: string,
+    session: string,
+    args: string[],
+    binaryPath: string | undefined,
+    replacedPid?: number,
+  ): Promise<{ wsPort: number } | { error: string }> {
+    const { wsPort, opened } = await launch(session, args, binaryPath, replacedPid);
+    logOpened(`${label} session=${session}`, opened);
+    if (wsPort !== undefined) return { wsPort };
+    poppedOutSessions.delete(session);
+    await runWithBinaryFallback(['--session', session, 'close'], binaryPath);
+    return { error: launchFailure(label, await opened) };
+  }
+
+  // The session's live stream port, without starting anything. A daemon that is
+  // up but not streaming is left alone — relaunching would compete with it. Only
+  // a daemon that is gone, for a caller naming the page it had, is relaunched
+  // there: headed when the pane is a pop-out.
+  async function attach(
+    session: string,
+    opts: { url?: string; headed?: boolean },
+    binaryPath?: string,
+  ): Promise<AgentBrowserAttachResult> {
     if (!isAgentBrowserSession(session)) return { ok: false, error: 'a valid session name is required' };
-    const wsPort = await readStreamPort(session, binaryPath);
-    if (!wsPort) return { ok: false, error: 'stream port unavailable' };
-    return { ok: true, wsPort };
+    return joinInFlight(session, 'attach', async (): Promise<AgentBrowserAttachResult> => {
+      const daemon = await daemonState(session);
+      if (daemon.wsPort !== undefined) return { ok: true, wsPort: daemon.wsPort };
+      if (daemon.alive) return { ok: false, error: `agent-browser session '${session}' is not streaming` };
+      const url = opts?.url;
+      if (!isBrowsableUrl(url)) return { ok: false, error: `agent-browser session '${session}' is not running` };
+      log(`[ab-relaunch] attach session=${session} is gone -> open ${url}`);
+      // An earlier relaunch's sweep must not reach this daemon, nor its captures.
+      relaunchGenerations.delete(session);
+      forgetInFlight(session, 'attach');
+      const launched = await coldLaunch('attach open', session, openArgs(session, url, !!opts.headed, binaryPath), binaryPath, daemon.pid);
+      return 'wsPort' in launched ? { ok: true, wsPort: launched.wsPort, relaunched: true } : { ok: false, error: launched.error };
+    });
   }
 
-  // Spawn a managed session and open <url> — backs swapping an iframe embed up
-  // to a live screencast (docs/specs/dor-browser.md → "Display Modal And Render Swaps"). With `headed`,
-  // the process launches headed in one shot so embed→popout doesn't open a
-  // headless browser only to tear it down.
-  async function open(url: string, opts: { headed?: boolean }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
+  // Open <url> in a new managed session, or in the caller's `session` (a Tool's
+  // own, or the one a failed swap restores) — every GUI launch
+  // (docs/specs/dor-browser.md → "Agent-Browser Connection"). A live daemon for
+  // that session just navigates. With `headed`, the process launches headed in
+  // one shot so embed→popout doesn't open a headless browser only to tear it down.
+  async function open(url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
     if (!isBrowsableUrl(url)) return { ok: false, error: 'an http(s) url is required' };
-    const session = generateGuiSession();
-    const args = ['--session', session, ...(opts?.headed ? ['--headed'] : []), 'open', url];
-    // A headed spawn is a real OS window — track it before the launch so a
-    // window whose page never finishes loading is still closed on shutdown.
-    if (opts?.headed) poppedOutSessions.set(session, binaryPath);
-    const { wsPort, opened } = await launch(session, args, binaryPath);
-    logOpened(`open session=${session}`, opened);
-    if (wsPort === undefined) {
-      poppedOutSessions.delete(session);
-      // Nothing came up to bind a surface to. Close whatever did, so a
-      // half-launched browser does not outlive the swap it was spawned for
-      // (a no-op when there is no daemon — `close` starts none).
-      await runWithBinaryFallback(['--session', session, 'close'], binaryPath);
-      const failed = await opened;
-      return { ok: false, error: launchFailure('open', failed) };
+    if (opts?.session !== undefined && !isAgentBrowserSession(opts.session)) {
+      return { ok: false, error: 'a valid session name is required' };
     }
-    return { ok: true, session, wsPort, ...(binaryPath ? { binaryPath } : {}) };
+    const session = opts?.session ?? generateGuiSession();
+    const launched = await coldLaunch('open', session, openArgs(session, url, !!opts?.headed, binaryPath), binaryPath);
+    if ('error' in launched) return { ok: false, error: launched.error };
+    return { ok: true, session, wsPort: launched.wsPort, ...(binaryPath ? { binaryPath } : {}) };
   }
 
   // Pop-out is a relaunch, not a live toggle: Chrome's headed/headless choice is
@@ -624,10 +685,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     // ignored as "daemon already running" (which would leave it headless).
     await runWithBinaryFallback(['--session', session, 'close'], binaryPath);
     const replacedPid = await killDaemon(session);
-    // A real headed OS window from here on — track it before the launch so
-    // shutdown closes it even if its page never finishes loading.
-    poppedOutSessions.set(session, binaryPath);
-    return relaunch('popOut', session, ['--session', session, '--headed', 'open', url], binaryPath, replacedPid, generation);
+    return relaunch('popOut', session, openArgs(session, url, true, binaryPath), binaryPath, replacedPid, generation);
   }
 
   // Shared tail of pop-out/pop-in: launch, and once `open` itself returns —
@@ -676,9 +734,7 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     // to it and stay headed. Stop the daemon so the relaunch comes up headless.
     await runWithBinaryFallback(['--session', session, 'close'], binaryPath);
     const replacedPid = await killDaemon(session);
-    // The headed window is gone after the close above; back to headless.
-    poppedOutSessions.delete(session);
-    return relaunch('popIn', session, ['--session', session, 'open', url], binaryPath, replacedPid, generation);
+    return relaunch('popIn', session, openArgs(session, url, false, binaryPath), binaryPath, replacedPid, generation);
   }
 
   // Close every still-popped-out session's headed window. Called from each
@@ -704,5 +760,5 @@ export function createAgentBrowserHost(deps: AgentBrowserHostDeps): AgentBrowser
     ]);
   }
 
-  return { command, edit, screenshot, screenshotToFile, streamStatus, open, popOut, popIn, closePoppedOut };
+  return { command, edit, screenshot, screenshotToFile, attach, open, popOut, popIn, closePoppedOut };
 }
diff --git a/lib/src/host/playwright-host.lifecycle.test.ts b/lib/src/host/playwright-host.lifecycle.test.ts
index 25dc7902d..c27011afc 100644
--- a/lib/src/host/playwright-host.lifecycle.test.ts
+++ b/lib/src/host/playwright-host.lifecycle.test.ts
@@ -58,7 +58,7 @@ test('concurrent captures share one CDP attachment and detach it once on close',
 test('closing during a CDP attachment releases it without capturing', async () => {
   let complete!: (value: typeof cdp) => void;
   attach.mockImplementation(() => new Promise(resolve => { complete = resolve; }));
-  const { wsPort } = await host.request({ ...binding, op: 'streamStatus' });
+  const { wsPort } = await host.request({ ...binding, op: 'attach' });
   const capture = host.request({ ...binding, op: 'screenshot' });
   await vi.waitFor(() => expect(attach).toHaveBeenCalledTimes(1));
   const closing = host.request({ ...binding, op: 'command', args: ['close'] });
@@ -82,7 +82,7 @@ test('a viewer listener failure releases its browser connection', async () => {
     queueMicrotask(() => this.emit('error', new Error('Listener unavailable')));
     return this;
   });
-  const result = await host.request({ ...binding, op: 'streamStatus' });
+  const result = await host.request({ ...binding, op: 'attach' });
   expect(result.error).toBe('Listener unavailable');
   expect(browser.close).toHaveBeenCalledTimes(1);
 });
@@ -90,7 +90,9 @@ test('a viewer listener failure releases its browser connection', async () => {
 test('captures reuse recent tab state but refresh it when it expires', async () => {
   const now = vi.spyOn(Date, 'now').mockReturnValue(10000);
   browser.contexts = () => [{ pages: () => [page, Object.assign(new EventEmitter(), page)] }];
-  expect((await host.request({ ...binding, op: 'streamStatus' })).ok).toBe(true);
+  expect((await host.request({ ...binding, op: 'attach' })).ok).toBe(true);
+  // No viewer yet, so attach left the tab state to the first capture.
+  expect((await host.request({ ...binding, op: 'screenshot' })).ok).toBe(true);
   mocks.cli.mockClear();
   for (let i = 0; i < 10; i++) expect((await host.request({ ...binding, op: 'screenshot' })).ok).toBe(true);
   expect(mocks.cli).not.toHaveBeenCalled();
@@ -128,17 +130,17 @@ test('a native reopen in headless mode clears headed shutdown ownership', async
     }
     return result;
   });
-  expect((await host.request({ ...binding, op: 'streamStatus' })).headed).toBe(true);
+  expect((await host.request({ ...binding, op: 'attach' })).headed).toBe(true);
   browser.emit('disconnected');
   headless = true;
-  expect((await host.request({ ...binding, op: 'streamStatus' })).headed).toBe(false);
+  expect((await host.request({ ...binding, op: 'attach' })).headed).toBe(false);
   mocks.cli.mockClear();
   await host.close();
   expect(mocks.cli).not.toHaveBeenCalled();
 });
 
 test('a single-page browser refreshes without asking the CLI for its selection', async () => {
-  expect((await host.request({ ...binding, op: 'streamStatus' })).ok).toBe(true);
+  expect((await host.request({ ...binding, op: 'attach' })).ok).toBe(true);
   expect(mocks.cli.mock.calls.map(([, args]) => args[1])).toEqual(['list']);
 });
 
@@ -170,7 +172,7 @@ test('a relaunch without an http(s) page reopens blank; a GUI open still needs o
 });
 
 test.each(['attach', 'startScreencast'] as const)('a screencast whose %s fails mid-navigation is retried on the next poll', async (failing) => {
-  const { wsPort } = await host.request({ ...binding, op: 'streamStatus' });
+  const { wsPort } = await host.request({ ...binding, op: 'attach' });
   const starts = () => cdp.send.mock.calls.filter(([method]) => method === 'Page.startScreencast').length;
   if (failing === 'attach') attach.mockRejectedValueOnce(new Error('Target navigated'));
   else {
@@ -191,6 +193,63 @@ test.each(['attach', 'startScreencast'] as const)('a screencast whose %s fails m
   }
 });
 
+describe('attach', () => {
+  // The registry lists the session only once `open` has run for it.
+  let running: boolean;
+  let browserName: string;
+  beforeEach(() => {
+    running = false;
+    browserName = 'chromium';
+    mocks.cli.mockImplementation(async (_binary, args) => {
+      if (args[1] === 'open') running = true;
+      const servers = running ? [{
+        title: 'test', workspaceDir: process.cwd(), playwrightLib: process.cwd(),
+        endpoint: '/tmp/test-playwright.pipe', browser: { browserName },
+      }] : [];
+      return { ok: true, exitCode: 0, stderr: '', stdout: JSON.stringify(args[1] === 'list' ? { servers } : { result: '- 0: (current) Test' }) };
+    });
+  });
+  const verbs = () => mocks.cli.mock.calls.map(([, args]) => args[1]);
+
+  test('a live session answers its viewer port without launching', async () => {
+    running = true;
+    const attached = await host.request({ ...binding, op: 'attach', url: 'http://localhost/' });
+    expect(attached).toMatchObject({ ok: true, headed: false, wsPort: expect.any(Number) });
+    expect(attached).not.toHaveProperty('relaunched');
+    expect(verbs()).not.toContain('open');
+  });
+
+  test('a gone session relaunches at the page named, and fails without one', async () => {
+    expect((await host.request({ ...binding, op: 'attach' })).error).toBe('Playwright session is not open or has no viewable endpoint');
+    expect(verbs()).not.toContain('open');
+
+    const attached = await host.request({ ...binding, op: 'attach', url: 'http://localhost/', headed: true });
+    // Opened at the page, so the caller has no navigation left to run.
+    expect(attached).toMatchObject({ ok: true, wsPort: expect.any(Number), relaunched: true });
+    expect(mocks.cli.mock.calls.map(([, args]) => args)).toContainEqual(['--session=test', 'open', 'http://localhost/', '--browser=chromium', '--headed']);
+  });
+
+  test('refreshes tab state only for viewers already connected', async () => {
+    running = true;
+    // Two tabs, so a refresh would ask the CLI which is selected.
+    browser.contexts = () => [{ pages: () => [page, Object.assign(new EventEmitter(), page)] }];
+    expect((await host.request({ ...binding, op: 'attach' })).ok).toBe(true);
+    expect(verbs()).toEqual(['list']);
+  });
+
+  test('relaunches a session no registry entry names without closing it first', async () => {
+    expect((await host.request({ ...binding, op: 'attach', url: 'http://localhost/' })).ok).toBe(true);
+    expect(verbs()).not.toContain('close');
+  });
+
+  test('a session it cannot view is never relaunched', async () => {
+    running = true;
+    browserName = 'firefox';
+    expect((await host.request({ ...binding, op: 'attach', url: 'http://localhost/' })).ok).toBe(false);
+    expect(verbs()).not.toContain('open');
+  });
+});
+
 test('copy runs the shared edit script and never overwrites the clipboard with an empty selection', async () => {
   page.evaluate = vi.fn(async (script: unknown) => typeof script === 'string' ? '' : { width: 640, height: 480 });
   expect(await host.request({ ...binding, op: 'edit', edit: 'copy' })).toMatchObject({ ok: true, text: '' });
@@ -202,7 +261,7 @@ test('copy runs the shared edit script and never overwrites the clipboard with a
 });
 
 test('viewers get tabs, url and status only when they change, and the current state when they connect', async () => {
-  const { wsPort } = await host.request({ ...binding, op: 'streamStatus' });
+  const { wsPort } = await host.request({ ...binding, op: 'attach' });
   const sockets: WebSocket[] = [];
   const connectViewer = async () => {
     const { url } = await host.request({ op: 'streamUrl', port: wsPort! });
@@ -217,10 +276,10 @@ test('viewers get tabs, url and status only when they change, and the current st
   try {
     const first = await connectViewer();
     await vi.waitFor(() => expect(first).toEqual(['url', 'tabs', 'status']));
-    await host.request({ ...binding, op: 'streamStatus' });
-    await host.request({ ...binding, op: 'streamStatus' });
+    await host.request({ ...binding, op: 'attach' });
+    await host.request({ ...binding, op: 'attach' });
     page.url = () => 'http://localhost/next';
-    await host.request({ ...binding, op: 'streamStatus' });
+    await host.request({ ...binding, op: 'attach' });
     // A repeated state message would have arrived ahead of the navigation.
     await vi.waitFor(() => expect(first).toEqual(['url', 'tabs', 'status', 'url', 'tabs']));
     const second = await connectViewer();
@@ -232,7 +291,7 @@ test('viewers get tabs, url and status only when they change, and the current st
 });
 
 test('a long paste reaches the page whole without tripping the input backlog', async () => {
-  const { wsPort } = await host.request({ ...binding, op: 'streamStatus' });
+  const { wsPort } = await host.request({ ...binding, op: 'attach' });
   const { url } = await host.request({ op: 'streamUrl', port: wsPort! });
   const ws = new WebSocket(url!);
   ws.on('error', () => {});
diff --git a/lib/src/host/playwright-host.test.ts b/lib/src/host/playwright-host.test.ts
index 2ab0e85b8..705f1c51c 100644
--- a/lib/src/host/playwright-host.test.ts
+++ b/lib/src/host/playwright-host.test.ts
@@ -33,7 +33,7 @@ test.skipIf(!binaryPath)('real CLI: GUI launch, stream grants, native tabs, inpu
     expect(opened.ok).toBe(true);
     session = opened.session!;
     const req = { cwd, binaryPath, session };
-    const nested = await host.request({ ...req, cwd: path.join(cwd, 'nested'), op: 'streamStatus' });
+    const nested = await host.request({ ...req, cwd: path.join(cwd, 'nested'), op: 'attach' });
     expect(nested.wsPort).toBe(opened.wsPort);
     expect(nested.nativeIdentity).toBe(opened.nativeIdentity);
     const stream = await host.request({ op: 'streamUrl', port: opened.wsPort! });
@@ -45,7 +45,7 @@ test.skipIf(!binaryPath)('real CLI: GUI launch, stream grants, native tabs, inpu
     // Parking drops the viewer socket, then reconnects to the same CLI browser.
     socket.close();
     await new Promise<void>(resolve => socket!.once('close', () => resolve()));
-    expect((await host.request({ ...req, op: 'streamStatus' })).wsPort).toBe(opened.wsPort);
+    expect((await host.request({ ...req, op: 'attach' })).wsPort).toBe(opened.wsPort);
     messages.length = 0;
     const resumedStream = await host.request({ op: 'streamUrl', port: opened.wsPort! });
     socket = new WebSocket(resumedStream.url!);
@@ -74,7 +74,7 @@ test.skipIf(!binaryPath)('real CLI: GUI launch, stream grants, native tabs, inpu
     expect((await host.request({ ...req, op: 'command', args: ['eval', 'process.exit()'] })).ok).toBe(false);
     const popped = await host.request({ ...req, op: 'popOut', url });
     expect(popped.ok, popped.error).toBe(true);
-    expect((await host.request({ ...req, op: 'streamStatus' })).headed).toBe(true);
+    expect((await host.request({ ...req, op: 'attach' })).headed).toBe(true);
     await new Promise(r => setTimeout(r, 1000));
     const popTabs = await host.request({ ...req, op: 'command', args: ['tab', 'list'] });
     expect(JSON.parse(popTabs.stdout!).tabs).toHaveLength(1);
@@ -83,7 +83,7 @@ test.skipIf(!binaryPath)('real CLI: GUI launch, stream grants, native tabs, inpu
     expect(relaunched.wsPort).not.toBe(opened.wsPort);
     expect((await host.request({ op: 'streamUrl', port: opened.wsPort! })).ok).toBe(false);
     expect((await host.request({ ...req, op: 'command', args: ['close'] })).ok).toBe(true);
-    expect((await host.request({ ...req, op: 'streamStatus' })).ok).toBe(false);
+    expect((await host.request({ ...req, op: 'attach' })).ok).toBe(false);
   } finally {
     socket?.terminate();
     if (session) await host.request({ cwd, binaryPath, session, op: 'command', args: ['close'] });
diff --git a/lib/src/host/playwright-host.ts b/lib/src/host/playwright-host.ts
index fbb4a6104..bb77a0865 100644
--- a/lib/src/host/playwright-host.ts
+++ b/lib/src/host/playwright-host.ts
@@ -56,6 +56,15 @@ function realpathOrUndefined(file: string): string | undefined {
   }
 }
 
+/** The CLI registry lists no browser for the session: it is gone, not merely
+ *  unviewable. `named`: some entry carried the session's name, in another
+ *  project scope or installation, so a relaunch still closes it first. */
+class SessionNotOpenError extends Error {
+  constructor(message: string, readonly named: boolean) {
+    super(message);
+  }
+}
+
 /** `key` is the native identity: installation, CLI workspace and session. */
 type Binding = { session: string; cwd: string; install: PlaywrightInstall; workspace: string | undefined; key: string };
 function bind(session: string, cwd: string, install: PlaywrightInstall): Binding {
@@ -287,7 +296,10 @@ export function createPlaywrightHost(deps: { writeClipboardText(text: string): v
         && (s.workspaceDir || undefined) === b.workspace
         && typeof s.playwrightLib === 'string'
         && realpathOrUndefined(s.playwrightLib) === b.install.libraryPath);
-      if (matches.length !== 1) throw new Error(matches.length ? 'Ambiguous Playwright session' : 'Playwright session is not open or has no viewable endpoint');
+      if (matches.length > 1) throw new Error('Ambiguous Playwright session');
+      if (matches.length === 0) {
+        throw new SessionNotOpenError('Playwright session is not open or has no viewable endpoint', servers.some(s => s.title === b.session));
+      }
       const descriptor = matches[0];
       if (descriptor.browser?.browserName !== 'chromium') throw new Error('Dormouse currently views Chromium Playwright sessions only. The native CLI command still ran.');
       const endpoint = descriptor.endpoint ?? descriptor.pipeName;
@@ -415,9 +427,12 @@ export function createPlaywrightHost(deps: { writeClipboardText(text: string): v
     }
     const install = resolvePlaywrightInstall(request.binaryPath);
     const cwd = typeof request.cwd === 'string' && path.isAbsolute(request.cwd) ? request.cwd : process.cwd();
-    const session = request.op === 'open' ? generateGuiSession() : request.session;
+    // `open` mints a session unless the caller names one to open the page in.
+    const session = request.op === 'open' ? request.session ?? generateGuiSession() : request.session;
     if (!isPlaywrightSession(session)) throw new Error('Invalid Playwright session name');
     const b = bind(session, cwd, install);
+    const bound = (v: Viewer, extra?: Partial<PlaywrightResult>): PlaywrightResult => (
+      { ok: true, session, cwd, binaryPath: install.binary, wsPort: v.port, nativeIdentity: b.key, ...extra });
     if (request.op === 'open' || request.op === 'popOut' || request.op === 'popIn') {
       // A GUI open navigates where it was asked, so that URL must pass the
       // http(s) check. A relaunch only carries the page along: one Dormouse may
@@ -426,10 +441,30 @@ export function createPlaywrightHost(deps: { writeClipboardText(text: string): v
       if (request.op === 'open' && !isBrowsableUrl(request.url)) throw new Error('Browser navigation requires an http(s) URL');
       const url = isBrowsableUrl(request.url) ? request.url : undefined;
       const isHeaded = request.op === 'open' ? !!request.headed : request.op === 'popOut';
-      const fresh = request.op === 'open';
+      const fresh = request.op === 'open' && request.session === undefined;
       const deadline = Date.now() + REQUEST_BUDGET_MS;
-      const v = await serialize(b, () => launch(b, url, isHeaded, fresh, deadline));
-      return { ok: true, session, cwd, binaryPath: install.binary, wsPort: v.port, nativeIdentity: b.key };
+      return bound(await serialize(b, () => launch(b, url, isHeaded, fresh, deadline)));
+    }
+    // The viewer for a live session; one whose browser is gone is relaunched at
+    // `url` when the caller names it, and fails otherwise.
+    if (request.op === 'attach') {
+      const url = request.url;
+      const deadline = Date.now() + REQUEST_BUDGET_MS;
+      let relaunched = false;
+      const v = await serialize(b, async () => {
+        try {
+          return await connect(b);
+        } catch (error) {
+          if (!(error instanceof SessionNotOpenError) || !isBrowsableUrl(url)) throw error;
+          // A session no entry names has nothing to close first.
+          const launched = await launch(b, url, !!request.headed, !error.named, deadline);
+          relaunched = true;
+          return launched;
+        }
+      });
+      // A connecting viewer is sent the current state; only live ones need it now.
+      if (v.sockets.size) await refresh(v);
+      return bound(v, { headed: v.headed, ...(relaunched ? { relaunched } : {}) });
     }
     // Parsed before anything connects, so a refused command costs nothing.
     const command = request.op === 'command' ? parseWebviewCommand(request.args) : undefined;
@@ -443,10 +478,6 @@ export function createPlaywrightHost(deps: { writeClipboardText(text: string): v
       });
     }
     const v = await connect(b);
-    if (request.op === 'streamStatus') {
-      await refresh(v);
-      return { ok: true, wsPort: v.port, headed: v.headed, nativeIdentity: b.key };
-    }
     await refresh(v, request.op !== 'screenshot');
     const page = v.page;
     if (!page) throw new Error('No Playwright page is open');
diff --git a/lib/src/lib/platform/browser-automation.ts b/lib/src/lib/platform/browser-automation.ts
index 004bcd250..83ebc99f4 100644
--- a/lib/src/lib/platform/browser-automation.ts
+++ b/lib/src/lib/platform/browser-automation.ts
@@ -1,12 +1,12 @@
 /** Host-owned operations for the Playwright provider. No arbitrary code or CDP crosses this boundary. */
 export type { BrowserAutomationProvider } from 'dor/commands/types';
 export type PlaywrightRequest = { binaryPath?: string; cwd?: string } & (
-  | { op: 'open'; url: string; headed?: boolean }
+  | { op: 'open'; url: string; headed?: boolean; session?: string }
   | { op: 'streamUrl'; port: number }
   | { op: 'command'; session: string; args: string[] }
   | { op: 'edit'; session: string; edit: 'selectAll' | 'copy' | 'cut' }
   | { op: 'screenshot'; session: string; format?: 'jpeg' | 'png'; quality?: number }
-  | { op: 'streamStatus'; session: string }
+  | { op: 'attach'; session: string; url?: string; headed?: boolean }
   | { op: 'popOut' | 'popIn'; session: string; url?: string }
 );
 export interface PlaywrightResult {
@@ -22,6 +22,8 @@ export interface PlaywrightResult {
   cwd?: string;
   binaryPath?: string;
   wsPort?: number;
+  /** `attach` only: see `AgentBrowserAttachResult`. */
+  relaunched?: boolean;
   url?: string;
   bytes?: Uint8Array;
   path?: string;
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index a8ba2d488..0f758b14f 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -121,15 +121,18 @@ export interface AgentBrowserEditResult {
 
 export type { IframeProxyResult };
 
-/** Result of asking the host for the current stream status of an existing
- *  session. Used to recover persisted panels whose saved wsPort went stale
- *  across VS Code/webview reloads without exposing a generic `stream` exec
- *  channel to the webview. */
-export interface AgentBrowserStreamStatusResult {
+/** Result of attaching to a session's live stream (docs/specs/dor-browser.md →
+ *  "Agent-Browser Connection"): the port its stream serves now, found without
+ *  starting a daemon — or, when the caller named a page and the session is gone,
+ *  the port of the browser relaunched there. */
+export interface AgentBrowserAttachResult {
   headed?: boolean;
   nativeIdentity?: string;
   ok: boolean;
   wsPort?: number;
+  /** The session was gone, and the host started a browser at the caller's
+   *  `url`: that page is already open. */
+  relaunched?: boolean;
   error?: string;
 }
 
@@ -377,10 +380,10 @@ export interface PlatformAdapter {
   // Absent on hosts that can't run the binary — the panel then keeps every
   // changed stream frame as its final, lower-resolution image.
   agentBrowserScreenshot?(session: string, opts: { format?: 'jpeg' | 'png'; quality?: number }, binaryPath?: string): Promise<AgentBrowserScreenshotResult>;
-  // Reads the current stream port for an already-running session. This is a
-  // purpose-built status channel, not an agentBrowserCommand,
-  // so restored panels can recover from a stale persisted wsPort after reload.
-  agentBrowserStreamStatus?(session: string, binaryPath?: string): Promise<AgentBrowserStreamStatusResult>;
+  // The session's live stream port, read without spawning anything — a CLI
+  // verb would start a daemon to answer. With `url`, a session whose daemon is
+  // gone is relaunched there (headed with `headed`); without, it fails.
+  agentBrowserAttach?(session: string, opts: { url?: string; headed?: boolean }, binaryPath?: string): Promise<AgentBrowserAttachResult>;
   // The WebSocket URL for a session's stream port. Hosts whose webview origin
   // the agent-browser stream server rejects (VS Code) return a tokenized relay
   // URL; absent or null falls back to ws://127.0.0.1:<port>.
@@ -410,13 +413,14 @@ export interface PlatformAdapter {
   // docs/specs/dor-browser.md → "Pop-Out"). All optional
   // so hosts degrade: the modal hides whatever isn't backed by a capability.
   //
-  // Spawn a managed agent-browser session and open <url> — backs swapping an
-  // iframe embed up to a live screencast (`headed: false`) or straight to a
-  // popped-out window (`headed: true`, so embed→popout is one spawn, not a
-  // headless launch immediately torn down). `binaryPath` is the last one a
+  // Open <url> in a new managed session, or in `session` when the caller names
+  // one — the launch behind every GUI-created browser Surface, headless or
+  // straight into a popped-out window (`headed: true`, so embed→popout is one
+  // spawn, not a headless launch immediately torn down). Resolves once the
+  // browser is up, never waiting for the page. `binaryPath` is the last one a
   // `dor ab` surface resolved (a GUI-launched host's own PATH may miss the
   // binary); the host falls back to PATH / DORMOUSE_AGENT_BROWSER_BIN.
-  agentBrowserOpen?(url: string, opts: { headed?: boolean }, binaryPath?: string): Promise<AgentBrowserOpenResult>;
+  agentBrowserOpen?(url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string): Promise<AgentBrowserOpenResult>;
   // Relaunch a session's browser headed as a native OS window, reopening `url`
   // (headed/headless is fixed at launch, so this is a close+relaunch — v1
   // preserves the active tab URL). Best-effort positioned over `rect` (CSS px
diff --git a/lib/src/lib/platform/vscode-adapter.test.ts b/lib/src/lib/platform/vscode-adapter.test.ts
index 82fe34c42..fc69649c8 100644
--- a/lib/src/lib/platform/vscode-adapter.test.ts
+++ b/lib/src/lib/platform/vscode-adapter.test.ts
@@ -481,6 +481,17 @@ describe('VSCodeAdapter agent-browser replies', () => {
       expect(JSON.stringify(settled)).toMatch(/timed out/);
     }
   });
+
+  it('keeps everything an attach answers with', async () => {
+    const adapter = new VSCodeAdapter();
+    const attached = adapter.agentBrowserAttach('sess', { url: 'https://example.com/' });
+    const request = postMessage.mock.calls.map(([message]) => message).find((message) => message.type === 'agentBrowser:attach');
+    expect(request).toMatchObject({ session: 'sess', url: 'https://example.com/' });
+    windowTarget.dispatchEvent(hostMessage({
+      type: 'agentBrowser:attachResult', requestId: request.requestId, ok: true, wsPort: 4321, relaunched: true, headed: true, nativeIdentity: 'id',
+    }));
+    expect(await attached).toEqual({ ok: true, wsPort: 4321, relaunched: true, headed: true, nativeIdentity: 'id', error: undefined });
+  });
 });
 
 describe('VSCodeAdapter notepad archive', () => {
diff --git a/lib/src/lib/platform/vscode-adapter.ts b/lib/src/lib/platform/vscode-adapter.ts
index 6499ea634..2eb67f1c5 100644
--- a/lib/src/lib/platform/vscode-adapter.ts
+++ b/lib/src/lib/platform/vscode-adapter.ts
@@ -1,7 +1,7 @@
 import { PLAYWRIGHT_REQUEST_TIMEOUT_MS, type PlaywrightRequest, type PlaywrightResult } from './browser-automation';
 import { recordToolEvents } from '../tool-events';
 import type { TerminalContextRequest, TerminalContextInfo } from '../terminal-context-types';
-import type { AgentBrowserCommandResult, AgentBrowserEditOp, AgentBrowserEditResult, AgentBrowserOpenResult, AgentBrowserPopResult, AgentBrowserScreenshotResult, AgentBrowserStreamStatusResult, IframeProxyResult, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, SpawnPtyOptions, ToolControlResult, ToolHostRequest, WritePtyOptions } from './types';
+import type { AgentBrowserCommandResult, AgentBrowserEditOp, AgentBrowserEditResult, AgentBrowserOpenResult, AgentBrowserPopResult, AgentBrowserScreenshotResult, AgentBrowserAttachResult, IframeProxyResult, OpenPort, PlatformAdapter, PtyDataDetail, PtyInfo, BurrowLink, SpawnPtyOptions, ToolControlResult, ToolHostRequest, WritePtyOptions } from './types';
 import { openPortRequestTimeoutMs } from './types';
 import { createBurrowLinkClient } from '../../host/remote/link-client';
 import { createAlertClient, type AlertClientMethods } from '../../host/alert-client';
@@ -130,7 +130,7 @@ export class VSCodeAdapter implements PlatformAdapter {
     this.agentBrowserCommand = this.agentBrowserCommand.bind(this);
     this.agentBrowserEdit = this.agentBrowserEdit.bind(this);
     this.agentBrowserScreenshot = this.agentBrowserScreenshot.bind(this);
-    this.agentBrowserStreamStatus = this.agentBrowserStreamStatus.bind(this);
+    this.agentBrowserAttach = this.agentBrowserAttach.bind(this);
     this.getAgentBrowserStreamUrl = this.getAgentBrowserStreamUrl.bind(this);
     this.agentBrowserOpen = this.agentBrowserOpen.bind(this);
     this.agentBrowserPopOut = this.agentBrowserPopOut.bind(this);
@@ -414,14 +414,15 @@ export class VSCodeAdapter implements PlatformAdapter {
     return result ?? { ok: false, error: 'agent-browser screenshot timed out' };
   }
 
-  async agentBrowserStreamStatus(session: string, binaryPath?: string): Promise<AgentBrowserStreamStatusResult> {
-    const result = await this.requestResponse<AgentBrowserStreamStatusResult>(
-      'agentBrowser:streamStatus', 'agentBrowser:streamStatusResult',
-      { session, binaryPath },
-      (msg) => ({ ok: msg.ok, wsPort: msg.wsPort, error: msg.error }),
-      5000,
+  async agentBrowserAttach(session: string, opts: { url?: string; headed?: boolean }, binaryPath?: string): Promise<AgentBrowserAttachResult> {
+    // A gone session relaunches, so this waits as long as an open does.
+    const result = await this.requestResponse<AgentBrowserAttachResult>(
+      'agentBrowser:attach', 'agentBrowser:attachResult',
+      { session, url: opts.url, headed: opts.headed, binaryPath },
+      (msg) => ({ ok: msg.ok, wsPort: msg.wsPort, relaunched: msg.relaunched, headed: msg.headed, nativeIdentity: msg.nativeIdentity, error: msg.error }),
+      15000,
     );
-    return result ?? { ok: false, error: 'agent-browser stream status timed out' };
+    return result ?? { ok: false, error: 'agent-browser attach timed out' };
   }
 
   getAgentBrowserStreamUrl(port: number): Promise<string | null> {
@@ -434,9 +435,9 @@ export class VSCodeAdapter implements PlatformAdapter {
     );
   }
 
-  async agentBrowserOpen(url: string, opts: { headed?: boolean }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
+  async agentBrowserOpen(url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
     const result = await this.requestResponse<AgentBrowserOpenResult>(
-      'agentBrowser:open', 'agentBrowser:openResult', { url, headed: opts.headed, binaryPath },
+      'agentBrowser:open', 'agentBrowser:openResult', { url, headed: opts.headed, session: opts.session, binaryPath },
       (msg) => ({ ok: msg.ok, session: msg.session, wsPort: msg.wsPort, binaryPath: msg.binaryPath, error: msg.error }),
       15000,
     );
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 8875255e2..683611bdb 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -5,7 +5,7 @@
   "docs/specs/alert.md": 8150,
   "docs/specs/auto-update.md": 1150,
   "docs/specs/deploy.md": 1900,
-  "docs/specs/dor-browser.md": 6050,
+  "docs/specs/dor-browser.md": 6500,
   "docs/specs/dor-cli.md": 6300,
   "docs/specs/dor-tool.md": 4150,
   "docs/specs/glossary.md": 2950,
diff --git a/standalone/scripts/dev-agent-browser.mjs b/standalone/scripts/dev-agent-browser.mjs
index ea73b779d..0d09596aa 100644
--- a/standalone/scripts/dev-agent-browser.mjs
+++ b/standalone/scripts/dev-agent-browser.mjs
@@ -160,12 +160,12 @@ const invokeMap = {
   agent_browser_screenshot: async ({ session, format, quality, binaryPath }) => readCapture(
     await requestSidecar('agentBrowser:screenshot', { session, format, quality, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   ),
-  agent_browser_stream_status: ({ session, binaryPath }) => requestSidecar('agentBrowser:streamStatus', { session, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
+  agent_browser_attach: ({ session, url, headed, binaryPath }) => requestSidecar('agentBrowser:attach', { session, url, headed, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   tool_control: ({ request }) =>
     requestSidecar('tool:control', { request }, 'tool:result', (data) => data.result),
   git_info: ({ paths }) =>
     requestSidecar('git:info', { paths }, 'git:infoResult', (data) => data.result),
-  agent_browser_open: ({ url, headed, binaryPath }) => requestSidecar('agentBrowser:open', { url, headed, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
+  agent_browser_open: ({ url, headed, session, binaryPath }) => requestSidecar('agentBrowser:open', { url, headed, session, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   agent_browser_pop_out: ({ session, url, rect, binaryPath }) => requestSidecar('agentBrowser:popOut', { session, url, rect, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   agent_browser_pop_in: ({ session, url, binaryPath }) => requestSidecar('agentBrowser:popIn', { session, url, binaryPath }, 'agentBrowser:result', (data) => data.result, 30000),
   // Agent recovery (docs/specs/standalone.md -> "Agent recovery"). The harness
diff --git a/standalone/sidecar/main.js b/standalone/sidecar/main.js
index 09ea98a42..245e6f445 100644
--- a/standalone/sidecar/main.js
+++ b/standalone/sidecar/main.js
@@ -247,14 +247,14 @@ function handleLine(line) {
           return { result: { ok: true, mime: shot.mime, path: shot.path } };
         });
         break;
-      case 'agentBrowser:streamStatus':
+      case 'agentBrowser:attach':
         respondAsync('agentBrowser:result', data.requestId, async () => ({
-          result: await agentBrowser.streamStatus(data.session, data.binaryPath),
+          result: await agentBrowser.attach(data.session, { url: data.url, headed: data.headed }, data.binaryPath),
         }));
         break;
       case 'agentBrowser:open':
         respondAsync('agentBrowser:result', data.requestId, async () => ({
-          result: await agentBrowser.open(data.url, { headed: data.headed }, data.binaryPath),
+          result: await agentBrowser.open(data.url, { headed: data.headed, session: data.session }, data.binaryPath),
         }));
         break;
       case 'agentBrowser:popOut':
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index b0858f7c6..173d9daf8 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -1562,15 +1562,17 @@ fn agent_browser_edit(
 }
 
 #[tauri::command(async)]
-fn agent_browser_stream_status(
+fn agent_browser_attach(
     state: tauri::State<'_, SidecarState>,
     session: String,
+    url: Option<String>,
+    headed: Option<bool>,
     binary_path: Option<String>,
 ) -> Result<JsonValue, String> {
     agent_browser_forward(
         &state,
-        "agentBrowser:streamStatus",
-        serde_json::json!({ "session": session, "binaryPath": binary_path }),
+        "agentBrowser:attach",
+        serde_json::json!({ "session": session, "url": url, "headed": headed, "binaryPath": binary_path }),
     )
 }
 
@@ -1579,12 +1581,13 @@ fn agent_browser_open(
     state: tauri::State<'_, SidecarState>,
     url: String,
     headed: Option<bool>,
+    session: Option<String>,
     binary_path: Option<String>,
 ) -> Result<JsonValue, String> {
     agent_browser_forward(
         &state,
         "agentBrowser:open",
-        serde_json::json!({ "url": url, "headed": headed, "binaryPath": binary_path }),
+        serde_json::json!({ "url": url, "headed": headed, "session": session, "binaryPath": binary_path }),
     )
 }
 
@@ -4568,7 +4571,7 @@ pub fn run() {
             playwright_screenshot,
             agent_browser_edit,
             agent_browser_screenshot,
-            agent_browser_stream_status,
+            agent_browser_attach,
             agent_browser_open,
             agent_browser_pop_out,
             agent_browser_pop_in,
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index 4b1bf6b0e..c23476a8d 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -3,13 +3,13 @@ import { recordToolEvents } from '../../lib/src/lib/tool-events';
 import type { TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
 import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import type {
+  AgentBrowserAttachResult,
   AgentBrowserCommandResult,
   AgentBrowserEditOp,
   AgentBrowserEditResult,
   AgentBrowserOpenResult,
   AgentBrowserPopResult,
   AgentBrowserScreenshotResult,
-  AgentBrowserStreamStatusResult,
   IframeProxyResult,
   OpenPort,
   PlatformAdapter,
@@ -112,7 +112,7 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     this.agentBrowserCommand = this.agentBrowserCommand.bind(this);
     this.agentBrowserEdit = this.agentBrowserEdit.bind(this);
     this.agentBrowserScreenshot = this.agentBrowserScreenshot.bind(this);
-    this.agentBrowserStreamStatus = this.agentBrowserStreamStatus.bind(this);
+    this.agentBrowserAttach = this.agentBrowserAttach.bind(this);
     this.agentBrowserOpen = this.agentBrowserOpen.bind(this);
     this.agentBrowserPopOut = this.agentBrowserPopOut.bind(this);
     this.agentBrowserPopIn = this.agentBrowserPopIn.bind(this);
@@ -303,13 +303,13 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     }
   }
 
-  async agentBrowserStreamStatus(session: string, binaryPath?: string): Promise<AgentBrowserStreamStatusResult> {
-    try { return await this.host.invoke("agent_browser_stream_status", { session, binaryPath }); }
+  async agentBrowserAttach(session: string, opts: { url?: string; headed?: boolean }, binaryPath?: string): Promise<AgentBrowserAttachResult> {
+    try { return await this.host.invoke("agent_browser_attach", { session, url: opts.url, headed: opts.headed, binaryPath }); }
     catch (err) { return { ok: false, error: errMessage(err) }; }
   }
 
-  async agentBrowserOpen(url: string, opts: { headed?: boolean }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
-    try { return await this.host.invoke("agent_browser_open", { url, headed: opts.headed, binaryPath }); }
+  async agentBrowserOpen(url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
+    try { return await this.host.invoke("agent_browser_open", { url, headed: opts.headed, session: opts.session, binaryPath }); }
     catch (err) { return { ok: false, error: errMessage(err) }; }
   }
 
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index b72dc723a..37f1dd810 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -5,13 +5,13 @@ import { invoke as rawInvoke } from "@tauri-apps/api/core";
 import { open } from "@tauri-apps/plugin-shell";
 import { coalesceCwds } from "./coalesce-cwds";
 import type {
+  AgentBrowserAttachResult,
   AgentBrowserCommandResult,
   AgentBrowserEditOp,
   AgentBrowserEditResult,
   AgentBrowserOpenResult,
   AgentBrowserPopResult,
   AgentBrowserScreenshotResult,
-  AgentBrowserStreamStatusResult,
   IframeProxyResult,
   OpenPort,
   PlatformAdapter,
@@ -521,17 +521,17 @@ export class TauriAdapter implements PlatformAdapter {
     }
   }
 
-  async agentBrowserStreamStatus(session: string, binaryPath?: string): Promise<AgentBrowserStreamStatusResult> {
+  async agentBrowserAttach(session: string, opts: { url?: string; headed?: boolean }, binaryPath?: string): Promise<AgentBrowserAttachResult> {
     try {
-      return await rawInvoke<AgentBrowserStreamStatusResult>("agent_browser_stream_status", { session, binaryPath });
+      return await rawInvoke<AgentBrowserAttachResult>("agent_browser_attach", { session, url: opts.url, headed: opts.headed, binaryPath });
     } catch (err) {
       return { ok: false, error: errMessage(err) };
     }
   }
 
-  async agentBrowserOpen(url: string, opts: { headed?: boolean }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
+  async agentBrowserOpen(url: string, opts: { headed?: boolean; session?: string }, binaryPath?: string): Promise<AgentBrowserOpenResult> {
     try {
-      return await rawInvoke<AgentBrowserOpenResult>("agent_browser_open", { url, headed: opts.headed, binaryPath });
+      return await rawInvoke<AgentBrowserOpenResult>("agent_browser_open", { url, headed: opts.headed, session: opts.session, binaryPath });
     } catch (err) {
       return { ok: false, error: errMessage(err) };
     }
diff --git a/vscode-ext/src/agent-browser-host.ts b/vscode-ext/src/agent-browser-host.ts
index ac79548db..18b5712c7 100644
--- a/vscode-ext/src/agent-browser-host.ts
+++ b/vscode-ext/src/agent-browser-host.ts
@@ -32,7 +32,7 @@ const host = createAgentBrowserHost({
 export const runAgentBrowserCommand = host.command;
 export const runAgentBrowserEdit = host.edit;
 export const runAgentBrowserScreenshot = host.screenshot;
-export const runAgentBrowserStreamStatus = host.streamStatus;
+export const runAgentBrowserAttach = host.attach;
 export const runAgentBrowserOpen = host.open;
 export const runAgentBrowserPopOut = host.popOut;
 export const runAgentBrowserPopIn = host.popIn;
diff --git a/vscode-ext/src/message-router.ts b/vscode-ext/src/message-router.ts
index 523362383..7a8c59027 100644
--- a/vscode-ext/src/message-router.ts
+++ b/vscode-ext/src/message-router.ts
@@ -16,7 +16,7 @@ import type { TerminalSemanticEvent } from '../../lib/src/lib/terminal-state';
 import type { WebviewMessage, ExtensionMessage } from './message-types';
 import type { DorControlRequest } from './pty-manager';
 import { dorWorkspaceRefusal } from './dor-workspace-guard';
-import { createStreamRelayUrl, runAgentBrowserCommand, runAgentBrowserEdit, runAgentBrowserOpen, runAgentBrowserPopIn, runAgentBrowserPopOut, runAgentBrowserScreenshot, runAgentBrowserStreamStatus, runPlaywrightRequest } from './agent-browser-host';
+import { createStreamRelayUrl, runAgentBrowserAttach, runAgentBrowserCommand, runAgentBrowserEdit, runAgentBrowserOpen, runAgentBrowserPopIn, runAgentBrowserPopOut, runAgentBrowserScreenshot, runPlaywrightRequest } from './agent-browser-host';
 import { createIframeProxyUrl } from './iframe-proxy-host';
 import { toolControl } from './tool-host';
 import type { ToolHostRequest } from '../../lib/src/lib/platform/types';
@@ -703,13 +703,17 @@ export function attachRouter(
           } satisfies ExtensionMessage);
         });
         break;
-      case 'agentBrowser:streamStatus':
-        runAgentBrowserStreamStatus(
+      case 'agentBrowser:attach':
+        runAgentBrowserAttach(
           msg.session,
+          {
+            url: typeof msg.url === 'string' ? msg.url : undefined,
+            headed: msg.headed === true,
+          },
           typeof msg.binaryPath === 'string' ? msg.binaryPath : undefined,
         ).then((result) => {
           post({
-            type: 'agentBrowser:streamStatusResult', requestId: msg.requestId, ...result,
+            type: 'agentBrowser:attachResult', requestId: msg.requestId, ...result,
           } satisfies ExtensionMessage);
         });
         break;
@@ -731,7 +735,7 @@ export function attachRouter(
       case 'agentBrowser:open':
         runAgentBrowserOpen(
           typeof msg.url === 'string' ? msg.url : '',
-          { headed: msg.headed === true },
+          { headed: msg.headed === true, session: typeof msg.session === 'string' ? msg.session : undefined },
           typeof msg.binaryPath === 'string' ? msg.binaryPath : undefined,
         ).then((result) => {
           post({ type: 'agentBrowser:openResult', requestId: msg.requestId, ...result } satisfies ExtensionMessage);
diff --git a/vscode-ext/src/message-types.ts b/vscode-ext/src/message-types.ts
index 046eb223c..b1b3dc150 100644
--- a/vscode-ext/src/message-types.ts
+++ b/vscode-ext/src/message-types.ts
@@ -5,7 +5,7 @@ import type { TerminalColors, TerminalProtocolEvent } from '../../lib/src/lib/te
 import type { AlertCommand, AlertEvents } from '../../lib/src/host/alert-protocol';
 import type { PersistedAlertState } from '../../lib/src/lib/session-types';
 import type { DorControlCancelPayload, DorControlRequestPayload, DorControlResponsePayload } from '../../dor/src/protocol';
-import type { AgentBrowserStreamStatusResult, IframeProxyResult, OpenPort, ToolControlResult, ToolHostRequest } from '../../lib/src/lib/platform/types';
+import type { AgentBrowserAttachResult, IframeProxyResult, OpenPort, ToolControlResult, ToolHostRequest } from '../../lib/src/lib/platform/types';
 import type { VSCodeWorkbenchCommand } from '../../lib/src/lib/vscode-keybindings';
 import type { BurrowCommand, BurrowResult } from '../../lib/src/host/remote/service-protocol';
 import type { VolatileNotepadSnapshot } from '../../lib/src/lib/notepad/types';
@@ -28,9 +28,9 @@ export type WebviewMessage =
   | { type: 'agentBrowser:command'; session: string; args: string[]; binaryPath?: string; requestId: string }
   | { type: 'agentBrowser:edit'; session: string; op: 'selectAll' | 'copy' | 'cut'; binaryPath?: string; requestId: string }
   | { type: 'agentBrowser:screenshot'; session: string; format?: 'jpeg' | 'png'; quality?: number; binaryPath?: string; requestId: string }
-  | { type: 'agentBrowser:streamStatus'; session: string; binaryPath?: string; requestId: string }
+  | { type: 'agentBrowser:attach'; session: string; url?: string; headed?: boolean; binaryPath?: string; requestId: string }
   | { type: 'agentBrowser:getStreamUrl'; port: number; requestId: string }
-  | { type: 'agentBrowser:open'; url: string; headed?: boolean; binaryPath?: string; requestId: string }
+  | { type: 'agentBrowser:open'; url: string; headed?: boolean; session?: string; binaryPath?: string; requestId: string }
   | { type: 'agentBrowser:popOut'; session: string; url?: string; rect?: { x: number; y: number; width: number; height: number }; binaryPath?: string; requestId: string }
   | { type: 'agentBrowser:popIn'; session: string; url?: string; binaryPath?: string; requestId: string }
   | { type: 'iframe:createProxyUrl'; url: string; embedderOrigins: string[]; requestId: string }
@@ -91,7 +91,7 @@ export type ExtensionMessage =
   | { type: 'agentBrowser:commandResult'; requestId: string; exitCode: number; stdout: string; stderr: string }
   | { type: 'agentBrowser:editResult'; requestId: string; ok: boolean; text?: string; error?: string }
   | { type: 'agentBrowser:screenshotResult'; requestId: string; ok: boolean; bytes?: Uint8Array; mime?: string; error?: string }
-  | ({ type: 'agentBrowser:streamStatusResult'; requestId: string } & AgentBrowserStreamStatusResult)
+  | ({ type: 'agentBrowser:attachResult'; requestId: string } & AgentBrowserAttachResult)
   | { type: 'agentBrowser:streamUrl'; requestId: string; url: string | null }
   | { type: 'agentBrowser:openResult'; requestId: string; ok: boolean; session?: string; wsPort?: number; binaryPath?: string; error?: string }
   | { type: 'agentBrowser:popResult'; requestId: string; ok: boolean; wsPort?: number; error?: string }