@@ -90,6 +90,15 @@ const [{ id }, { kbName }] = await Promise.all([params, searchParams])
 
 Only keep awaits sequential when a later call genuinely uses an earlier result, or when the ordering is deliberate (rate-limited batches, retry loops, write-then-read).
 
+## Carry exact lifecycle ownership across async boundaries
+
+When asynchronous work can outlive an execution, session, or resource instance, capture its
+opaque ownership token before the first `await` and pass that exact token through completion and
+error cleanup. Never re-adopt the current owner from delayed cleanup: a replacement may now own
+the same scope. End the lifecycle by exact-token match, and clear shared state only when that end
+succeeds. Current-owner adoption is reserved for synchronous user actions that explicitly stop
+the current lifecycle.
+
 ## Prefetch dynamic destination lists on intent
 
 For long lists of dynamic destinations, do not viewport-prefetch every row and do not assume
@@ -99,6 +108,12 @@ server state with the consumer's shared React Query options. A short, cancelable
 avoids drive-by downloads. Do not treat `touchstart` as intent because it also begins scrolling;
 let the actual unmodified click start the data request.
 
+A speculative failure must not poison a later visit when the app default disables
+`retryOnMount`: remove only that exact failed query while it is inactive, keep failures visible
+to mounted consumers, and set the shared options to `retryOnMount: true` so a quick-click failure
+can recover after the user leaves and returns. Never carry placeholder data between protected
+resource keys (for example, workspace A to workspace B); an explicit loading state is truthful.
+
 If a continuity-focused surface intentionally omits `loading.tsx` so the current view remains
 mounted until its peer is ready, the intent path must warm both the full route and its critical
 data. Otherwise keep the loading boundary so dynamic navigation remains responsive.
 
@@ -104,6 +104,11 @@ Adding a new settings page:
 2. Render the component inside the shell's `effectiveSection` switch in
    `settings/[section]/settings.tsx`.
 3. Build the component body inside `<SettingsPanel>` — no shell, no title block.
+4. When a real second consumer or server boundary needs it, extract client-safe React Query options;
+   otherwise keep them with the hook. Approved intent warmers reuse those exact options and must keep
+   `check-tool-registry-boundary` green. Warm only authorized destinations, preserve the current
+   section during the transition, and follow `sim-react-performance.md` recovery rules; never render
+   temporary default data that will be replaced after load.
 
 ## Text-scale tokens (no literal pixel sizes)
 
 
@@ -55,6 +55,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.sha }}
 
       # Prerelease versions carry their environment in the tag: -dev.N is a
@@ -340,10 +341,18 @@ jobs:
             exit 1
           fi
           export GH_TOKEN
-          if ! gh release view "$VERSION" --repo "$RELEASE_REPOSITORY" >/dev/null; then
+          if ! RELEASE_ID="$(
+            gh release view "$VERSION" --repo "$RELEASE_REPOSITORY" \
+              --json databaseId --jq '.databaseId'
+          )"; then
             echo "::error::Release $VERSION does not exist in $RELEASE_REPOSITORY."
             exit 1
           fi
+          if ! [[ "$RELEASE_ID" =~ ^[0-9]+$ ]]; then
+            echo "::error::Release $VERSION returned an invalid database ID."
+            exit 1
+          fi
+          RELEASE_JSON="$(gh api "repos/${RELEASE_REPOSITORY}/releases/${RELEASE_ID}")"
           SEMVER="${VERSION#v}"
           ARTIFACTS=(
             "apps/desktop/release/Sim-${SEMVER}-universal.dmg"
@@ -354,11 +363,10 @@ jobs:
           )
           upload_or_verify() {
             local ARTIFACT="$1"
-            local NAME SIZE DIGEST RELEASE_JSON REMOTE REMOTE_SIZE REMOTE_DIGEST
+            local NAME SIZE DIGEST REMOTE REMOTE_SIZE REMOTE_DIGEST
             NAME="$(basename "$ARTIFACT")"
             SIZE="$(stat -f%z "$ARTIFACT")"
             DIGEST="sha256:$(shasum -a 256 "$ARTIFACT" | awk '{print $1}')"
-            RELEASE_JSON="$(gh api "repos/${RELEASE_REPOSITORY}/releases/tags/${VERSION}")"
             REMOTE="$(jq -c --arg name "$NAME" '.assets[] | select(.name == $name)' <<< "$RELEASE_JSON")"
             if [ -n "$REMOTE" ]; then
               REMOTE_SIZE="$(jq -r '.size' <<< "$REMOTE")"
 
@@ -34,7 +34,9 @@ src/main/           # main process (bundled to dist/main.cjs)
   browser-credentials/ # saved passwords, OS-auth gated, safeStorage at rest
   browser-sites/    # imported site directory, safeStorage at rest
   browser-import/   # one-shot import of profiles, cookies and passwords
-src/preload/        # contextBridge IPC bridge (bundled to dist/preload.cjs)
+src/preload/        # isolated renderer bridges
+  index.ts          # hosted-app contextBridge IPC bridge (dist/preload.cjs)
+  browser/          # minimal agent-browser credential helper (dist/browser-preload.cjs)
 native/             # Node-API/AppKit bridge for native macOS Help docs search
 static/             # bundled local pages (offline.html)
 e2e/                # Playwright _electron smoke suite
@@ -54,7 +56,7 @@ SIM_DESKTOP_ORIGIN=http://localhost:3000 bun run dev   # against local sim
 - `bun run type-check` / `lint:check` — standard workspace checks; CI picks these up automatically via `turbo run`.
 - `SIM_DESKTOP_USER_DATA=<dir>` isolates settings/partition state (used by e2e).
 
-Everything is bundled by esbuild into `dist/main.cjs` + `dist/preload.cjs` — including `electron-updater` and the `@sim/*` packages — so the packaged app has **no runtime node_modules** and `electron-builder` needs no lockfile/npmRebuild step (this is the deliberate workaround for Bun ↔ electron-builder friction; there is no `package-lock.json`).
+The main process and two preloads are bundled by esbuild into `dist/main.cjs`, `dist/preload.cjs`, and `dist/browser-preload.cjs`, including `electron-updater` and the `@sim/*` packages. The native `@lydell/node-pty` packages stay external so Electron can load their architecture-specific prebuilds from the packaged runtime `node_modules`; `npmRebuild` remains disabled because those Node-API prebuilds are already ABI-stable. There is no `package-lock.json`.
 
 ## Auth model (read before touching auth)
 
@@ -99,7 +101,7 @@ Overall this is **within normal thin-wrapper coupling** — every item is either
 
 Local unsigned build: `bun run package:dir` (app in `release/mac-universal/`). Signed: `bun run package:mac` with `CSC_LINK`/`CSC_KEY_PASSWORD` exported.
 
-Pre-release share (no Developer ID yet): `SIM_DESKTOP_DEFAULT_ORIGIN=https://www.dev.sim.ai bun run package:share` builds a DMG whose fresh installs default to that origin (baked at build time; official builds leave it unset → prod) and skips per-file signature timestamps. Recipients must clear quarantine once: `xattr -cr /Applications/Sim.app`.
+Local unsigned pre-release share: `SIM_DESKTOP_DEFAULT_ORIGIN=https://www.dev.sim.ai bun run package:share` builds a DMG whose fresh installs default to that origin (baked at build time; official builds leave it unset → prod) and skips per-file signature timestamps. Recipients must clear quarantine once: `xattr -cr /Applications/Sim.app`.
 
 The build also derives the app icon from `SIM_DESKTOP_DEFAULT_ORIGIN`. Every channel uses the exact production icon with its white background and black `sim` mark. Non-production channels add a thin outline using existing platform colors: dev uses orange, staging uses Loop blue, and localhost uses Workflow violet. The macOS menu-bar icon also carries a compact `D`, `S`, or `L` subscript for those environments; production remains unmarked. Native Icon Composer assets live in `build/`; `scripts/build.ts` copies the selected variant to the ignored `build/generated-icon.icon` path consumed by electron-builder. Electron-builder compiles it to `Assets.car` and derives the legacy `.icns` fallback from the same source. Matching 512px PNGs in `static/` provide the Dock icon for unpackaged runs.
 
@@ -185,10 +187,11 @@ Raw local file bytes are never exposed through the preload bridge and cannot be
 
 ## Known caveats
 
-- Microphone and camera are denied by design (the permission matrix grants only sanitized clipboard writes to the app origin).
+- The hosted Sim renderer may request microphone access for voice input from the configured app origin; camera access remains denied. On macOS the shell also requires the operating-system microphone grant. Separately, a page in the isolated agent browser may request microphone or camera only from its main frame after a recent native user gesture; Sim then requires an explicit document-scoped prompt and the operating-system grant where applicable.
+- The built-in agent browser is not a general-purpose download manager. Its dedicated partition applies the same bounded policy to every download, including one started by a direct user click: at most 2 GiB per file, two active downloads per task, six app-wide, and a 1 GiB free-disk reserve. A rejected download appears in the browser's downloads menu; use a normal browser for an intentionally larger transfer.
 - Default Electron ships H.264/AAC/MP3 — do not swap in the codec-free ffmpeg build.
 - Third-party web analytics (GTM/GA) are blocked at the network layer by default (`blockThirdPartyAnalytics`); first-party PostHog `/ingest` is untouched.
-- `Cmd+F` find-in-page overlay is not implemented (Monaco and tables ship their own finds); revisit if users ask.
+- `Cmd+F` opens the native find overlay in built-in browser tabs. The hosted Sim workspace continues to use Monaco- and table-specific find surfaces.
 - Sign-in uses only the `127.0.0.1` loopback callback, which needs no OS registration — so it completes identically under `bun run dev` (unpackaged) and in a packaged build. There is no custom URL scheme.
 
 ## Electron upgrades
 
@@ -50,7 +50,7 @@
     "@sim/tsconfig": "workspace:*",
     "@types/micromatch": "4.0.10",
     "@types/node": "24.2.1",
-    "electron": "43.1.1",
+    "electron": "43.5.0",
     "electron-builder": "26.15.3",
     "esbuild": "0.28.1",
     "typescript": "^7.0.2",
 
@@ -10,6 +10,8 @@ const mocks = vi.hoisted(() => ({
 vi.mock('@/main/browser-agent/session', () => ({
   clearProfileStorage: mocks.clearProfileStorage,
   initSession: vi.fn(),
+  isBrowserScopeSuspended: vi.fn(() => false),
+  resolveBrowserScopeId: vi.fn((scopeId: string) => scopeId),
 }))
 
 vi.mock('@/main/browser-credentials', () => ({
@@ -18,7 +20,12 @@ vi.mock('@/main/browser-credentials', () => ({
   initFillCoordinator: vi.fn(),
 }))
 
-import { clearBrowserProfile, initDriver } from '@/main/browser-agent/driver'
+import {
+  captureBrowserToolQueueBoundary,
+  clearBrowserProfile,
+  executeTool,
+  initDriver,
+} from '@/main/browser-agent/driver'
 import type { ConfigStore } from '@/main/config'
 
 describe('clearBrowserProfile', () => {
@@ -52,4 +59,35 @@ describe('clearBrowserProfile', () => {
     expect(mocks.clearCredentials).toHaveBeenCalledTimes(2)
     expect(config.flush).toHaveBeenCalledTimes(2)
   })
+
+  it('invalidates pre-wipe authorization and retires live work before profile teardown', async () => {
+    initDriver(
+      {
+        onPageState: vi.fn(),
+        onTabsState: vi.fn(),
+        onSessionStatus: vi.fn(),
+        onFillAvailability: vi.fn(),
+      },
+      () => null
+    )
+    const boundary = captureBrowserToolQueueBoundary('chat-before-wipe')
+    expect(boundary).not.toBeNull()
+    if (!boundary) throw new Error('Expected browser tool authorization admission')
+
+    await clearBrowserProfile()
+    const staleExecution = await executeTool(
+      'chat-before-wipe',
+      'browser_list_sessions',
+      {},
+      'tool-authorized-before-wipe',
+      boundary
+    )
+
+    expect(mocks.clearProfileStorage).toHaveBeenCalledOnce()
+    expect(mocks.clearCredentials).toHaveBeenCalledOnce()
+    expect(staleExecution).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('cancelled before it started'),
+    })
+  })
 })