diff --git a/CHANGELOG.md b/CHANGELOG.md
index e935691c..42d0d93e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,20 @@ GitHub Release body. The format follows
 
 ### ✨ Added
 
+- **`resoio launch` runs multiple instances**: `launch` no longer refuses when a
+  Resonite is already running — start as many as you like by giving each its own
+  `--data-path` (so they don't share a database). `--name <label>` is a
+  convenience that auto-allocates an isolated data tree under
+  `~/.resonite-io/instances/<label>/` — a separate WINEPREFIX, `-DataPath` /
+  `-CachePath` / `-LogsPath`, and a private Camera IPC queue token (so concurrent
+  instances neither share Resonite data nor cross-talk on the renderer frame
+  queue). Explicit `--prefix` / `--data-path` still win over the label defaults;
+  `--name` imposes no guard. Target a specific instance with
+  `--socket ~/.resonite-io/resonite-{pid}.sock`.
+- **`resoio terminate-all`**: stop every running Resonite instance in one call
+  (`SIGTERM` → `SIGKILL` per process), printing one engine/renderer pair per
+  instance (`--format human|json`). The multi-instance counterpart to the
+  single-instance `terminate` (whose pid-only output is unchanged).
 - **Typed Resonite launch options (`resoio.LaunchOptions`)**: pass Resonite's
   own command-line launch arguments to `launch(options=...)` as a typed,
   immutable value object — `data_path` (`-DataPath`), `cache_path` (`-CachePath`),
@@ -33,6 +47,22 @@ GitHub Release body. The format follows
 
 ### 🐛 Fixed
 
+- **Camera froze right after the engine and renderer came up (no `--name`, and
+  on direct Gale / Steam launches)**: the engine self-generated a Camera IPC
+  queue token at runtime that the renderer (a separately-spawned Wine child)
+  never inherited, so the two bound different queues and the client hung waiting
+  for frames. The engine no longer self-generates a token. Instead the token is
+  always placed in the environment **before exec**: `resoio launch` injects a
+  unique one per instance (named or not), and a direct Gale / Steam launch sets
+  nothing, so the engine and renderer both fall back to the same fixed default
+  queue name. Either way both ends agree on one queue. (`--name` was already
+  unaffected because it injected the token before exec.)
+- **`resoio terminate-all` reported a single instance as two**: it paired an
+  engine with its renderer only when the renderer appeared in the engine's host
+  process subtree, but Wine often reparents the renderer out of it, so one
+  instance came back as two `pid=0` rows. Pairing now keys off the Camera IPC
+  queue token the engine and renderer share (falling back to the process tree),
+  so a single instance is reported as one engine/renderer pair.
 - **`resoio launch` hung on a host install under `$HOME`**: the renderer never
   started (and the engine waited forever) when launching from a Steam install
   beneath `$HOME`. umu/Proton's game-drive feature maps `$HOME` onto a Wine drive
diff --git a/docs/cli.md b/docs/cli.md
index f4a93940..c5119be8 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -29,19 +29,29 @@ resoio --help
 | `resoio contact` | Contact | unary | Browse and manage contacts (friends) via nested subcommands: `list` (`--search` / `--filter all\|accepted\|requests` / `--include-hidden`), `get`, `search` (`--exact`), `add` (`--username`), `accept`, `remove`. `list` hides dash-hidden (ignored / blocked) contacts by default; `--include-hidden` shows them. The mutating ops (`add` / `accept` / `remove`) write the real cloud contact list. |
 | `resoio auth` | Auth | unary | Resonite cloud sign-in via nested subcommands: `login` (credential positional; password via env/stdin/prompt, never a flag), `logout`, `status`. |
 | `resoio cursor` | Cursor | unary | Set / center / get / release the desktop cursor. `set` and `center` hold the position until `release`. |
-| `resoio launch` | — (umu-launcher) | local process | Start Resonite (engine + renderer) via umu-launcher and print both host PIDs. `-e/--exe` / `RESONITE_EXE` and `-p/--profile` / `MOD_PATH` select the install + mod profile; `--vanilla` skips the mod. `--prefix` (`WINEPREFIX`) and `--proton-path` (`PROTONPATH`, default `GE-Proton`) pick the Wine prefix and Proton build. `--data-path` / `--cache-path` / `--logs-path` relocate Resonite's database / cache / logs; any other Resonite launch option goes after `--` (e.g. `-- -Screen -Verbose`). Non-gRPC. |
-| `resoio terminate` | — (signals) | local process | Force-stop Resonite by killing the engine + renderer (`SIGTERM` → `SIGKILL`). Takes `[resonite_pid] [renderer_pid]` (from `launch`) or auto-detects the single running instance. Non-gRPC. |
+| `resoio launch` | — (umu-launcher) | local process | Start Resonite (engine + renderer) via umu-launcher and print both host PIDs. `-e/--exe` / `RESONITE_EXE` and `-p/--profile` / `MOD_PATH` select the install + mod profile; `--vanilla` skips the mod. `--prefix` (`WINEPREFIX`) and `--proton-path` (`PROTONPATH`, default `GE-Proton`) pick the Wine prefix and Proton build. `--data-path` / `--cache-path` / `--logs-path` relocate Resonite's database / cache / logs; any other Resonite launch option goes after `--` (e.g. `-- -Screen -Verbose`). Never refuses when an instance is already running — run several at once by giving each a distinct `--data-path` (and prefix), or use `--name <label>` to auto-allocate an isolated tree under `~/.resonite-io/instances/<label>/` (own WINEPREFIX + data + Camera queue). Non-gRPC. |
+| `resoio terminate` | — (signals) | local process | Force-stop a single Resonite instance by killing the engine + renderer (`SIGTERM` → `SIGKILL`). Takes `[resonite_pid] [renderer_pid]` (from `launch`) or auto-detects the single running instance. Non-gRPC. |
+| `resoio terminate-all` | — (signals) | local process | Force-stop **every** running Resonite instance (`SIGTERM` → `SIGKILL` per process); prints one engine/renderer pair per instance (`--format human\|json`). The multi-instance counterpart to `terminate`. Non-gRPC. |
 | `resoio shutdown` | Lifecycle | unary | Ask the engine to quit gracefully (`Lifecycle.Shutdown`). Best-effort — on Linux the engine often hangs during teardown and never exits, so follow up with `terminate` when you need a guaranteed stop. Prints the engine's host PID (from `Info`). |
 
 `record` is the Resonite → Python capture command (it pulls Camera and Speaker), while `mic`
 is its independent Python → Resonite counterpart.
 
-`launch` / `terminate` are **local process control** (no gRPC). `launch` spawns the
-umu-launcher chain and waits until the **engine** (`resonite_pid`) and **renderer**
-(`renderer_pid`) host processes appear, printing both; it refuses to start a second instance.
-`terminate` signals those two PIDs (`SIGTERM` → `SIGKILL`); given no PIDs it auto-detects the
-single running instance (and errors if it finds more than one). Because they work from the host
-process table they run before the UDS exists and regardless of whether the client is reachable.
+`launch` / `terminate` / `terminate-all` are **local process control** (no gRPC). `launch` spawns
+the umu-launcher chain and waits until the **engine** (`resonite_pid`) and **renderer**
+(`renderer_pid`) host processes appear, printing both. It **never refuses** because another
+instance is already running — to run **several side by side**, give each launch its own
+`--data-path` (so the instances don't share a Resonite database). `--name <label>` is a
+convenience that auto-allocates an isolated tree under `~/.resonite-io/instances/<label>/` (its
+own WINEPREFIX, `-DataPath` / `-CachePath` / `-LogsPath`, and a private Camera IPC queue so the
+instances never cross-talk on the renderer queue); explicit `--prefix` / `--data-path` still win
+over the label defaults, and `--name` imposes no guard. Each engine binds its own
+`resonite-{pid}.sock`, so target a specific instance with
+`--socket ~/.resonite-io/resonite-{pid}.sock` (or `RESONITE_IO_SOCKET`). `terminate` signals one
+instance's two PIDs (`SIGTERM` → `SIGKILL`); given no PIDs it auto-detects the single running
+instance (and errors if it finds more than one — use explicit PIDs or `terminate-all`).
+`terminate-all` stops every instance at once. Because they work from the host process table they
+run before the UDS exists and regardless of whether the client is reachable.
 `shutdown`, by contrast, is a pure gRPC call (`Lifecycle.Shutdown`) that asks a **running**
 engine to quit gracefully — use it when the client is up and reachable. It is best-effort,
 though: on Linux (including the dev container) FrooxEngine frequently hangs during teardown and
@@ -182,9 +192,17 @@ resoio launch --format json     # {"resonite_pid": ..., "renderer_pid": ...}
 # Pick a specific Wine prefix and Proton build
 resoio launch --prefix ~/prefixes/resonite --proton-path GE-Proton
 
-# Stop it — by the PIDs from launch, or auto-detect the running instance
+# Run two instances side by side. --name auto-allocates isolated data trees;
+# or separate them yourself with --data-path. Then talk to one by its socket.
+resoio launch --name a            # {"resonite_pid": 12345, ...}
+resoio launch --name b            # {"resonite_pid": 23456, ...}
+resoio launch --data-path ~/res-c/data --prefix ~/res-c/pfx   # manual isolation
+resoio --socket ~/.resonite-io/resonite-12345.sock ping
+
+# Stop it — by the PIDs from launch, auto-detect the single instance, or stop every instance
 resoio terminate 12345 12399
 resoio terminate
+resoio terminate-all --format json   # [{"resonite_pid": ..., "renderer_pid": ...}, ...]
 
 # ... or ask a running engine to quit gracefully over gRPC (prints the engine host PID)
 resoio shutdown
diff --git a/mod/prebuilt/renderer.sha256 b/mod/prebuilt/renderer.sha256
index 7bec8480..8c9ff3d1 100644
--- a/mod/prebuilt/renderer.sha256
+++ b/mod/prebuilt/renderer.sha256
@@ -1 +1 @@
-6ca5f47b4593c3c561b6f3ec1ee4a50ec645fe8a30d7a98c7a780acf6b04fc89
+f040d1a69a647e02875f9781701a71d39ddd869d25e9347c89bdb75b80942405
diff --git a/mod/prebuilt/renderer/ResoniteIO.Renderer.dll b/mod/prebuilt/renderer/ResoniteIO.Renderer.dll
index 6928936e..71419626 100644
Binary files a/mod/prebuilt/renderer/ResoniteIO.Renderer.dll and b/mod/prebuilt/renderer/ResoniteIO.Renderer.dll differ
diff --git a/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb b/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb
index bbcc8224..d00c97f5 100644
Binary files a/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb and b/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb differ
diff --git a/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll b/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll
index f1a9c510..5c8a5215 100644
Binary files a/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll and b/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll differ
diff --git a/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs b/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
index 0f6c7592..34c0fa04 100644
--- a/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
+++ b/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
@@ -1,3 +1,5 @@
+using System;
+
 namespace ResoniteIO.RendererShared;
 
 /// <summary>
@@ -13,7 +15,29 @@ public static class IpcSocketPaths
 {
     public const string OwnerId = "net.mlshukai.resonite-io.camera";
 
-    public const string QueueName = "resonite-io-camera-frames";
+    /// <summary><see cref="QueueName"/> を上書きする環境変数名。</summary>
+    /// <remarks>
+    /// 多重起動時に各インスタンスの queue を分離するための逃げ道。token は exec 前に
+    /// env へ載せる必要がある: engine が runtime に <c>Environment.SetEnvironmentVariable</c>
+    /// で set しても、その値は別プロセスとして起動する renderer に届かず、engine/renderer
+    /// が別 queue を掴んで client が frame 待ちでハングする。
+    /// <list type="bullet">
+    ///   <item><c>resoio launch</c> 経由: Python launcher が起動前に instance 固有 token を
+    ///   注入し、engine と renderer (Wine 子プロセス) が同じ env を継承して queue を分離する。</item>
+    ///   <item>Gale / Steam 直接起動: 何も set されず、engine/renderer 双方が固定名
+    ///   (<see cref="_defaultQueueName"/>) に fallback して一致する (単一インスタンス)。</item>
+    /// </list>
+    /// <c>GrpcHost.ResolveSocketPath</c> と同じ「env override → 既定値」パターン。
+    /// </remarks>
+    public const string QueueNameEnvVar = "RESONITE_IO_CAMERA_QUEUE";
+
+    private const string _defaultQueueName = "resonite-io-camera-frames";
+
+    /// <summary>共有メモリ queue の名前。<see cref="QueueNameEnvVar"/> で上書き可能。</summary>
+    public static string QueueName =>
+        Environment.GetEnvironmentVariable(QueueNameEnvVar) is { Length: > 0 } overridden
+            ? overridden
+            : _defaultQueueName;
 
     public const string FrameMessageId = "frame";
 
diff --git a/mod/src/ResoniteIO/ResoniteIOPlugin.cs b/mod/src/ResoniteIO/ResoniteIOPlugin.cs
index 836eead6..9db8db25 100644
--- a/mod/src/ResoniteIO/ResoniteIOPlugin.cs
+++ b/mod/src/ResoniteIO/ResoniteIOPlugin.cs
@@ -81,6 +81,15 @@ public override void Load()
     {
         Log = base.Log;
 
+        // Camera IPC queue token (RESONITE_IO_CAMERA_QUEUE) はここでは生成しない。
+        // engine が runtime に Environment.SetEnvironmentVariable で set しても、その値は
+        // 別プロセスとして起動する renderer に届かず (engine/renderer が別 queue を掴んで
+        // client が frame 待ちでハングする)。代わりに token は exec 前に env へ載せる:
+        //   - `resoio launch` 経由: launcher が起動前に instance 固有 token を注入し、
+        //     engine と renderer (Wine 子プロセス) が同じ env を継承して queue を分離する。
+        //   - Gale / Steam 直接起動: 何も set されず、両側が IpcSocketPaths.QueueName の
+        //     固定デフォルト名に fallback して一致する (単一インスタンス)。
+
         // resolver は Core 型に触れる前に attach する必要があるため、ManualLogSource を
         // 直接渡し ILogSink を経由しない (上記 remarks 参照)。
         var pluginDirectory =
diff --git a/mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs b/mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs
new file mode 100644
index 00000000..a546e5f2
--- /dev/null
+++ b/mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs
@@ -0,0 +1,44 @@
+using System;
+using ResoniteIO.RendererShared;
+using Xunit;
+
+namespace ResoniteIO.Core.Tests.IpcSocketPaths;
+
+/// <summary>
+/// <see cref="ResoniteIO.RendererShared.IpcSocketPaths.QueueName"/> の env-override 解決を
+/// 検証する。多重起動時に engine が token を env へ流し、renderer が継承して同名を読む経路の
+/// 単体保証。env は process-global なので単一テスト内で set/clear を直列化し、元値を復元する。
+/// </summary>
+public sealed class IpcSocketPathsTests
+{
+    /// <summary>env 未設定なら従来固定名、設定すればその値を返す。</summary>
+    [Fact]
+    public void QueueName_honours_env_override_and_falls_back_to_default()
+    {
+        var original = Environment.GetEnvironmentVariable(
+            RendererShared.IpcSocketPaths.QueueNameEnvVar
+        );
+        try
+        {
+            Environment.SetEnvironmentVariable(RendererShared.IpcSocketPaths.QueueNameEnvVar, null);
+            Assert.Equal("resonite-io-camera-frames", RendererShared.IpcSocketPaths.QueueName);
+
+            Environment.SetEnvironmentVariable(
+                RendererShared.IpcSocketPaths.QueueNameEnvVar,
+                "resonite-io-camera-instance-a"
+            );
+            Assert.Equal("resonite-io-camera-instance-a", RendererShared.IpcSocketPaths.QueueName);
+
+            // 空文字は「未設定」と同じ扱いで fallback する。
+            Environment.SetEnvironmentVariable(RendererShared.IpcSocketPaths.QueueNameEnvVar, "");
+            Assert.Equal("resonite-io-camera-frames", RendererShared.IpcSocketPaths.QueueName);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(
+                RendererShared.IpcSocketPaths.QueueNameEnvVar,
+                original
+            );
+        }
+    }
+}
diff --git a/python/src/resoio/__init__.py b/python/src/resoio/__init__.py
index 36957666..f47e3993 100644
--- a/python/src/resoio/__init__.py
+++ b/python/src/resoio/__init__.py
@@ -49,6 +49,7 @@
     LaunchResult,
     launch,
     terminate,
+    terminate_all,
 )
 from resoio.lifecycle import LifecycleClient, shutdown
 from resoio.locomotion import (
@@ -165,5 +166,6 @@
     "launch",
     "shutdown",
     "terminate",
+    "terminate_all",
     "wait_for_ready",
 ]
diff --git a/python/src/resoio/cli/__init__.py b/python/src/resoio/cli/__init__.py
index 60f368f6..edf45279 100644
--- a/python/src/resoio/cli/__init__.py
+++ b/python/src/resoio/cli/__init__.py
@@ -39,6 +39,7 @@
     session,
     shutdown,
     terminate,
+    terminate_all,
     wait,
     world,
 )
@@ -66,6 +67,7 @@
     launch,
     shutdown,
     terminate,
+    terminate_all,
 ]
 
 
diff --git a/python/src/resoio/cli/launch.py b/python/src/resoio/cli/launch.py
index 23bb5924..a91a5d64 100644
--- a/python/src/resoio/cli/launch.py
+++ b/python/src/resoio/cli/launch.py
@@ -64,6 +64,16 @@ def register(
             "path. Default: GE-Proton."
         ),
     )
+    parser.add_argument(
+        "--name",
+        default=None,
+        help=(
+            "Instance label for multi-launch. Allocates an isolated data tree "
+            "(WINEPREFIX + data/cache/logs) and a private camera queue under "
+            "~/.resonite-io/instances/<name>/, so several instances run side by "
+            "side without sharing data. Omit for the single-instance default."
+        ),
+    )
     parser.add_argument(
         "--data-path",
         default=None,
@@ -117,6 +127,7 @@ async def _run(args: argparse.Namespace) -> int:
             extra_args=args.args,
             prefix=args.prefix,
             proton_path=args.proton_path,
+            name=args.name,
             wait_timeout=args.timeout,
         )
     except LauncherError as exc:
diff --git a/python/src/resoio/cli/terminate_all.py b/python/src/resoio/cli/terminate_all.py
new file mode 100644
index 00000000..e5e61c32
--- /dev/null
+++ b/python/src/resoio/cli/terminate_all.py
@@ -0,0 +1,66 @@
+"""``resoio terminate-all`` subcommand: stop every running Resonite instance.
+
+The multi-instance counterpart to ``resoio terminate`` (which targets a single
+instance). Detects all engine + renderer processes for the configured install
+and stages ``SIGTERM`` -> ``SIGKILL`` on each, printing the engine/renderer pairs
+it signalled. Unlike the pid-only ``terminate``, this returns a *list* and so
+carries ``--format human|json`` for machine-readable output.
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import sys
+
+from resoio.cli import output
+
+
+def register(
+    subparsers: argparse._SubParsersAction[argparse.ArgumentParser],  # pyright: ignore[reportPrivateUsage]
+    common: argparse.ArgumentParser,
+) -> None:
+    """Register the ``terminate-all`` subparser on the top-level parser."""
+    parser = subparsers.add_parser(
+        "terminate-all",
+        parents=[common],
+        help="Stop every running Resonite instance (SIGTERM -> SIGKILL); lists pairs.",
+        description=(
+            "Force-stop all running Resonite clients by signalling each engine and "
+            "renderer process. The multi-instance counterpart to 'resoio terminate'. "
+            "Idempotent (already-dead PIDs are skipped). Prints one engine/renderer "
+            "pair per instance signalled, or 'no running Resonite instances found'."
+        ),
+    )
+    parser.add_argument(
+        "--timeout",
+        type=float,
+        default=3.0,
+        help="Seconds to wait after SIGTERM before SIGKILL, per PID (default: 3).",
+    )
+    output.add_format_argument(parser)
+    parser.set_defaults(func=_run)
+
+
+async def _run(args: argparse.Namespace) -> int:
+    # Defer the heavy import (psutil) to keep `resoio --help` fast.
+    from resoio.launcher import LauncherError, terminate_all
+
+    try:
+        results = await asyncio.to_thread(terminate_all, timeout=args.timeout)
+    except LauncherError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+
+    if output.is_structured(args.format):
+        # list[LaunchResult] -> [{"resonite_pid": .., "renderer_pid": ..}, ...].
+        output.emit(results, args.format)
+        return 0
+
+    if not results:
+        print("no running Resonite instances found")
+        return 0
+    for result in results:
+        print(f"resonite_pid={result.resonite_pid} renderer_pid={result.renderer_pid}")
+    print(f"terminated {len(results)} instance(s)")
+    return 0
diff --git a/python/src/resoio/launcher.py b/python/src/resoio/launcher.py
index 33c09b39..8c7cc600 100644
--- a/python/src/resoio/launcher.py
+++ b/python/src/resoio/launcher.py
@@ -35,11 +35,13 @@
 import enum
 import logging
 import os
+import re
+import secrets
 import shutil
 import subprocess
 import time
 from collections.abc import Callable, Sequence
-from dataclasses import dataclass, fields
+from dataclasses import dataclass, fields, replace
 from pathlib import Path
 from typing import cast
 
@@ -53,6 +55,7 @@
     "LauncherError",
     "launch",
     "terminate",
+    "terminate_all",
 ]
 
 _logger = logging.getLogger(__name__)
@@ -75,14 +78,21 @@
 _ENGINE_ARGV0_SUFFIX: str = os.path.join("dotnet-runtime", "dotnet")
 _RENDERER_ARGV0_SUFFIX: str = os.path.join("Renderer", "Renderite.Renderer.exe")
 
+# Env var carrying the per-instance Camera IPC queue token shared by an engine and
+# its renderer (mirrors C# ``IpcSocketPaths.QueueNameEnvVar``). :func:`launch`
+# injects a unique value per instance *before exec* so it lands in both processes'
+# environment (the renderer inherits it as the engine's Wine child);
+# :func:`terminate_all` reads it back to pair an engine with its renderer.
+_CAMERA_QUEUE_ENV: str = "RESONITE_IO_CAMERA_QUEUE"
+
 
 class LauncherError(RuntimeError):
     """A ``resoio launch`` / ``terminate`` operation could not be completed.
 
     Raised for actionable conditions: Resonite.exe / the mod not found, no
-    ``umu-run`` on PATH, an instance already running, more than one instance
-    detected (the single-instance assumption is violated), or the engine /
-    renderer not appearing before the timeout.
+    ``umu-run`` on PATH, more than one new engine / renderer appearing from a
+    single launch, ``terminate`` finding more than one instance where exactly one
+    is expected, or the engine / renderer not appearing before the timeout.
     """
 
 
@@ -535,6 +545,7 @@ def _build_command(
     options: LaunchOptions | None = None,
     prefix: str | None = None,
     proton_path: str | None = None,
+    camera_queue: str | None = None,
 ) -> tuple[list[str], dict[str, str], str | None]:
     """Build the umu-run argv, environment, and log path.
 
@@ -572,6 +583,14 @@ def _build_command(
     # PROTONPATH は GE-Proton のような論理名も取るので abspath しない (WINEPREFIX のみ abspath)。
     if prefix is not None:
         env["WINEPREFIX"] = os.path.abspath(prefix)
+    # Per-instance Camera IPC queue token. :func:`launch` always injects one
+    # (named or not) so the engine and its renderer agree on the queue: setting it
+    # here, before exec, lands it in both processes' env (the renderer inherits it
+    # as the engine's Wine child). The engine mod only self-generates a token when
+    # this is unset — i.e. for a launch that did not go through this launcher (Gale
+    # / Steam directly), where setting the env at runtime is the only option left.
+    if camera_queue is not None:
+        env[_CAMERA_QUEUE_ENV] = camera_queue
     log_path: str | None = None
 
     if not vanilla:
@@ -618,23 +637,34 @@ def _build_command(
 # ---------------------------------------------------------------------------
 
 
-def _wait_for_single(
-    finder: Callable[[], list[int]], label: str, deadline: float, poll_interval: float
+def _wait_for_new(
+    finder: Callable[[], list[int]],
+    before: set[int],
+    label: str,
+    deadline: float,
+    poll_interval: float,
 ) -> int:
-    """Poll ``finder`` until it returns exactly one PID; return it.
+    """Poll until a PID not in ``before`` appears; return it.
+
+    The ``before`` set difference identifies the individual process *this* launch
+    spawned, so it works even when other instances of the same install are already
+    running (the argv0-based finders cannot tell two instances apart). For a
+    single launch with nothing else running, ``before`` is empty and this is
+    equivalent to "wait for exactly one". More than one new PID = an unexpected
+    concurrent launch, which is an error.
 
-    Raises :class:`LauncherError` if more than one is ever seen (the
-    single-instance assumption is violated) or if none appears by ``deadline``.
+    Raises :class:`LauncherError` if more than one new PID appears or if none
+    appears by ``deadline``.
     """
     while True:
-        pids = finder()
-        if len(pids) > 1:
+        new = [pid for pid in finder() if pid not in before]
+        if len(new) > 1:
             raise LauncherError(
-                f"multiple {label} processes detected ({pids}); expected exactly "
-                "one. Stop the extra Resonite instances and retry."
+                f"multiple new {label} processes appeared ({new}); "
+                "expected exactly one from this launch."
             )
-        if len(pids) == 1:
-            return pids[0]
+        if len(new) == 1:
+            return new[0]
         if time.monotonic() >= deadline:
             raise LauncherError(
                 f"timed out waiting for the Resonite {label} process to appear. "
@@ -644,6 +674,73 @@ def _wait_for_single(
         time.sleep(poll_interval)
 
 
+# ---------------------------------------------------------------------------
+# Instance isolation (multi-launch)
+# ---------------------------------------------------------------------------
+
+# Instance labels become directory names and a Camera-IPC queue token, so keep
+# them to a filesystem- and shell-safe charset and forbid path traversal.
+_INSTANCE_NAME_RE = re.compile(r"\A[A-Za-z0-9][A-Za-z0-9_-]*\Z")
+
+
+def _validate_instance_name(name: str) -> None:
+    """Reject instance names that are unsafe as a directory / queue token."""
+    if not _INSTANCE_NAME_RE.match(name):
+        raise LauncherError(
+            f"invalid instance name {name!r}: use only letters, digits, '-' and "
+            "'_' (and it must start with a letter or digit)."
+        )
+
+
+def _instances_base_dir() -> str:
+    """Base directory holding per-instance ``<label>/`` data trees.
+
+    ``RESONITE_IO_INSTANCES_DIR`` overrides the default ``~/.resonite-io/instances``.
+    The gRPC socket dir is separate (``~/.resonite-io/``, pid-named per engine).
+    """
+    return os.environ.get("RESONITE_IO_INSTANCES_DIR") or str(
+        Path.home() / ".resonite-io" / "instances"
+    )
+
+
+def _resolve_instance_paths(
+    name: str,
+    prefix: str | None,
+    options: LaunchOptions | None,
+) -> tuple[str, LaunchOptions, str]:
+    """Create the per-label data tree and fill any unset isolation path.
+
+    ``--name`` is purely a convenience for auto-allocating the isolation paths —
+    it never gates launching. Lays out
+    ``<instances_base>/<name>/{prefix,data,cache,logs}`` and resolves each of the
+    WINEPREFIX / ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots with the
+    precedence **explicit caller value > label-auto > unset**. Returns the
+    effective WINEPREFIX, the (possibly updated) options, and a per-launch Camera
+    IPC queue token so each instance's renderer frames stay on a private queue.
+    """
+    instance_dir = Path(_instances_base_dir()) / name
+    subdirs = {sub: instance_dir / sub for sub in ("prefix", "data", "cache", "logs")}
+    for path in subdirs.values():
+        path.mkdir(parents=True, exist_ok=True)
+
+    effective_prefix = prefix if prefix is not None else str(subdirs["prefix"])
+    opts = options or LaunchOptions()
+    opts = replace(
+        opts,
+        data_path=opts.data_path
+        if opts.data_path is not None
+        else str(subdirs["data"]),
+        cache_path=(
+            opts.cache_path if opts.cache_path is not None else str(subdirs["cache"])
+        ),
+        logs_path=opts.logs_path
+        if opts.logs_path is not None
+        else str(subdirs["logs"]),
+    )
+    token = f"resonite-io-camera-{name}-{secrets.token_hex(4)}"
+    return effective_prefix, opts, token
+
+
 def launch(
     *,
     resonite_exe: str | None = None,
@@ -653,6 +750,7 @@ def launch(
     extra_args: Sequence[str] = (),
     prefix: str | None = None,
     proton_path: str | None = None,
+    name: str | None = None,
     wait_timeout: float = 60.0,
     poll_interval: float = 0.5,
 ) -> LaunchResult:
@@ -681,6 +779,17 @@ def launch(
         proton_path: Proton build (``PROTONPATH``) — a compat-tools name like
             ``GE-Proton`` or a path. ``None`` resolves it from ``PROTONPATH``,
             then ``GE-Proton``.
+        name: Convenience label for **multi-launch**. Purely auto-allocates an
+            isolated data tree under ``RESONITE_IO_INSTANCES_DIR`` (default
+            ``~/.resonite-io/instances/<name>/``): the WINEPREFIX and the
+            ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots are auto-filled
+            from it (explicit ``prefix`` / ``options`` values still win). It does
+            **not** gate launching. ``None`` simply leaves those paths at their
+            defaults — run several instances yourself by passing a distinct
+            ``--data-path`` (and prefix) per launch. Either way ``launch`` always
+            injects a unique per-instance Camera IPC queue token (so the engine and
+            renderer agree on the queue and concurrent instances do not cross-talk),
+            and never refuses just because another instance is already running.
         wait_timeout: Seconds to wait for both processes to appear.
         poll_interval: Seconds between process-table polls.
 
@@ -688,19 +797,26 @@ def launch(
         The :class:`LaunchResult` with the engine and renderer host PIDs.
 
     Raises:
-        LauncherError: Resonite.exe / the mod / ``umu-run`` is missing, an
-            instance is already running, more than one engine/renderer is
-            detected, or a process did not appear before ``wait_timeout``.
+        LauncherError: Resonite.exe / the mod / ``umu-run`` is missing, more than
+            one new engine/renderer appears from this launch, or a process did not
+            appear before ``wait_timeout``. Launch never refuses because another
+            instance is already running — that is the caller's choice.
     """
     exe = _resolve_resonite_exe(resonite_exe)
     install_dir = os.path.dirname(os.path.realpath(exe))
 
-    already = _find_engine_pids(install_dir)
-    if already:
-        raise LauncherError(
-            f"Resonite is already running (engine pid(s) {already}). Stop it first "
-            "with `resoio terminate` before launching a new instance."
-        )
+    # Always inject a unique Camera IPC queue token so the engine and its renderer
+    # bind the same queue. A named launch derives it from the label data tree; an
+    # unnamed launch gets a random one. The token MUST be in the env before exec:
+    # the engine mod would otherwise self-generate one at runtime, which the
+    # renderer (a Wine child) never inherits, so the two bind different queues and
+    # the client freezes after both processes start.
+    camera_queue: str
+    if name is not None:
+        _validate_instance_name(name)
+        prefix, options, camera_queue = _resolve_instance_paths(name, prefix, options)
+    else:
+        camera_queue = f"resonite-io-camera-{secrets.token_hex(8)}"
 
     argv, env, log_path = _build_command(
         exe,
@@ -711,9 +827,16 @@ def launch(
         options=options,
         prefix=prefix,
         proton_path=proton_path,
+        camera_queue=camera_queue,
     )
     _logger.info("launching Resonite: %s (cwd=%s)", " ".join(argv), install_dir)
 
+    # Snapshot existing engine/renderer PIDs so _wait_for_new can pick out the
+    # ones this launch spawns by set difference (argv0 matching cannot tell two
+    # instances of the same install apart).
+    before_engines = set(_find_engine_pids(install_dir))
+    before_renderers = set(_find_renderer_pids(install_dir))
+
     # Detach fully: new session + closed stdio so the parent (CLI / caller) can
     # exit without signalling Resonite. PROTON_SET_GAME_DRIVE=0 (set in
     # _build_command) suppresses umu's game-drive mapping of $HOME onto a Wine
@@ -739,11 +862,19 @@ def launch(
             log_handle.close()
 
     deadline = time.monotonic() + wait_timeout
-    resonite_pid = _wait_for_single(
-        lambda: _find_engine_pids(install_dir), "engine", deadline, poll_interval
+    resonite_pid = _wait_for_new(
+        lambda: _find_engine_pids(install_dir),
+        before_engines,
+        "engine",
+        deadline,
+        poll_interval,
     )
-    renderer_pid = _wait_for_single(
-        lambda: _find_renderer_pids(install_dir), "renderer", deadline, poll_interval
+    renderer_pid = _wait_for_new(
+        lambda: _find_renderer_pids(install_dir),
+        before_renderers,
+        "renderer",
+        deadline,
+        poll_interval,
     )
     _logger.info(
         "Resonite launched: resonite_pid=%d renderer_pid=%d", resonite_pid, renderer_pid
@@ -834,3 +965,124 @@ def terminate(
         else 0
     )
     return LaunchResult(resonite_pid=killed_engine, renderer_pid=killed_renderer)
+
+
+def _instance_token(pid: int) -> str | None:
+    """The Camera IPC queue token in ``pid``'s environment, or ``None``.
+
+    An engine and its renderer share ``RESONITE_IO_CAMERA_QUEUE`` because
+    :func:`launch` injects a unique value per instance *before exec*, so it lands
+    in both processes' ``/proc/<pid>/environ`` (the renderer inherits it as the
+    engine's Wine child). This is the reliable key for pairing an engine with its
+    renderer in :func:`terminate_all`: the renderer is **not** always under the
+    engine in the host process tree (Wine reparents it), so the tree heuristic can
+    miss the pair and report one instance as two. ``None`` for a process without
+    the token (e.g. a launch that did not go through this launcher).
+    """
+    try:
+        token = psutil.Process(pid).environ().get(_CAMERA_QUEUE_ENV)
+    except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+        return None
+    return token or None
+
+
+def _engine_child_renderer(engine_pid: int, renderer_pids: set[int]) -> int | None:
+    """The renderer host PID parented under ``engine_pid``, if any.
+
+    Resonite's engine spawns the renderer (``RenderSystem.StartRenderer`` →
+    ``Process.Start``), so the renderer *sometimes* appears in the engine's host
+    process subtree. This is the **fallback** pairing for a renderer that carries
+    no Camera IPC queue token (see :func:`_instance_token`); used only to *group* a
+    kill into engine/renderer pairs, never to decide which processes get killed.
+    """
+    try:
+        children = psutil.Process(engine_pid).children(recursive=True)
+    except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+        return None
+    for child in children:
+        if child.pid in renderer_pids:
+            return child.pid
+    return None
+
+
+def _match_renderer(
+    engine_pid: int,
+    renderers: list[int],
+    renderers_by_token: dict[str, list[int]],
+    paired: set[int],
+) -> int | None:
+    """Pick the renderer belonging to ``engine_pid``, skipping ``paired`` ones.
+
+    Primary key is the shared Camera IPC queue token (reliable across Wine's
+    process-tree reparenting); falls back to the engine's host-process subtree for
+    a token-less instance. Returns ``None`` when no renderer can be attributed.
+    """
+    token = _instance_token(engine_pid)
+    if token is not None:
+        for candidate in renderers_by_token.get(token, ()):
+            if candidate not in paired:
+                return candidate
+    return _engine_child_renderer(engine_pid, set(renderers) - paired)
+
+
+def terminate_all(*, timeout: float = 3.0) -> list[LaunchResult]:
+    """Stop **every** running Resonite instance and return the pairs signalled.
+
+    Unlike :func:`terminate` (a single instance), this detects all engine and
+    renderer processes for the configured install and stages ``SIGTERM`` →
+    ``SIGKILL`` on each. Engines are paired with their renderer by the shared
+    Camera IPC queue token (see :func:`_instance_token`; a single instance is one
+    pair, not two ``pid=0`` rows), falling back to the host process tree for a
+    token-less instance; any renderer that still has no matching engine is killed
+    and reported on its own (``resonite_pid=0``). Idempotent: PIDs already gone are
+    skipped and excluded from the result.
+
+    Args:
+        timeout: Seconds to wait after ``SIGTERM`` before ``SIGKILL`` (per PID).
+
+    Returns:
+        One :class:`LaunchResult` per instance actually signalled, in detection
+        order; an empty list means nothing was running.
+
+    Raises:
+        LauncherError: a detected PID is alive but is no longer the expected
+            Resonite process (a reused PID).
+    """
+    install_dir = _install_dir_for_detection()
+    engines = _find_engine_pids(install_dir)
+    renderers = _find_renderer_pids(install_dir)
+    results: list[LaunchResult] = []
+    paired: set[int] = set()
+
+    # Index renderers by their instance token so an engine can claim the renderer
+    # that shares its Camera IPC queue — the renderer is not reliably under the
+    # engine in the host process tree (Wine reparents it), so the token is what
+    # keeps a single instance from being reported as two ``pid=0`` rows.
+    renderers_by_token: dict[str, list[int]] = {}
+    for renderer_pid in renderers:
+        token = _instance_token(renderer_pid)
+        if token is not None:
+            renderers_by_token.setdefault(token, []).append(renderer_pid)
+
+    for engine_pid in engines:
+        renderer_pid = _match_renderer(
+            engine_pid, renderers, renderers_by_token, paired
+        )
+        killed_engine = _kill_pid(engine_pid, _ENGINE_ARGV0_SUFFIX, "engine", timeout)
+        killed_renderer = 0
+        if renderer_pid is not None:
+            paired.add(renderer_pid)
+            killed_renderer = _kill_pid(
+                renderer_pid, _RENDERER_ARGV0_SUFFIX, "renderer", timeout
+            )
+        if killed_engine or killed_renderer:
+            results.append(
+                LaunchResult(resonite_pid=killed_engine, renderer_pid=killed_renderer)
+            )
+
+    for renderer_pid in sorted(set(renderers) - paired):
+        killed = _kill_pid(renderer_pid, _RENDERER_ARGV0_SUFFIX, "renderer", timeout)
+        if killed:
+            results.append(LaunchResult(resonite_pid=0, renderer_pid=killed))
+
+    return results
diff --git a/python/tests/e2e/gale_launch.py b/python/tests/e2e/gale_launch.py
new file mode 100644
index 00000000..e2ef5da8
--- /dev/null
+++ b/python/tests/e2e/gale_launch.py
@@ -0,0 +1,219 @@
+"""E2E: a Gale / Steam direct launch (no injected queue env) still gets frames.
+
+Regression guard for the Camera IPC queue-agreement bug. When Resonite is
+started **directly from Gale or Steam** — not through ``resoio.launch`` — the
+ResoniteIO launcher never runs, so ``RESONITE_IO_CAMERA_QUEUE`` is **not**
+injected into the environment. The fix under test makes both the engine mod and
+the renderer plugin fall back to the *same fixed default queue name* in that
+case, so they still agree on one queue and Camera frames flow.
+
+The old, broken behaviour: with the env unset the engine self-generated a random
+token at runtime, which the renderer (a Wine child started independently) never
+inherited. The two then bound *different* /dev/shm IPC queues, the renderer
+delivered frames onto a queue nobody read, and ``CameraClient.shot`` hung
+forever (client freeze). So:
+
+    * one delivered Camera frame == the engine actually rendered AND the frame
+      travelled through the IPC queue to the renderer and back to us, which can
+      only happen if both ends bound the *same* queue. A single non-empty frame
+      is therefore proof of queue agreement.
+    * if this test hangs / times out instead, the engine and renderer are on
+      different queues again — either runtime self-generation crept back in or
+      the fixed-default fallback is broken on one side.
+
+To faithfully reproduce a Gale launch we cannot use ``resoio.launch`` (it now
+*always* injects a queue token). Instead we drive the launcher's own
+``_build_command`` with ``camera_queue=None`` — exactly the mod-loaded
+(non-vanilla) umu/doorstop chain Gale uses, minus the queue env — and PID-diff
+the engine + renderer into existence the same way ``launch`` does. We also pop
+``RESONITE_IO_CAMERA_QUEUE`` out of the child env defensively, so a value
+lingering in the container environment cannot mask a self-generation regression.
+
+Like ``tests/e2e/launcher.py`` and ``tests/e2e/multi_instance.py`` this manages
+Resonite's lifecycle itself (the no-env startup *is* the scenario), so it does
+**not** use the ``resonite_session`` fixture. ``RESONITE_EXE`` / ``MOD_PATH``
+come from the container environment (compose); the ``require_mod_deployed``
+autouse fixture skips when the mod is not deployed.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import glob
+import os
+import subprocess
+import time
+from datetime import datetime
+from pathlib import Path
+
+import numpy as np
+import psutil
+from PIL import Image
+
+from resoio import CameraClient, ConnectionClient, terminate
+from resoio._client import socket_path_for_pid
+from resoio.launcher import (
+    _CAMERA_QUEUE_ENV,
+    _build_command,
+    _find_engine_pids,
+    _find_renderer_pids,
+    _wait_for_new,
+)
+from tests.helpers import mark_e2e
+
+ARTIFACT_ROOT = Path(__file__).parent / "e2e_artifacts"
+SOCKET_DIR = Path.home() / ".resonite-io"
+
+_LAUNCH_TIMEOUT_S = 120.0
+_SOCKET_APPEAR_TIMEOUT_S = 120.0
+_KILL_TIMEOUT_S = 30.0
+_POLL_S = 1.0
+
+
+def _resonite_exe() -> str:
+    return os.environ.get("RESONITE_EXE", "/opt/resonite/Resonite.exe")
+
+
+def _install_dir() -> str:
+    return os.path.dirname(os.path.realpath(_resonite_exe()))
+
+
+def _mod_path() -> str:
+    return os.environ.get("MOD_PATH", "/workspace/gale")
+
+
+def _wait_for_pid_socket(pid: int, timeout_s: float) -> Path | None:
+    """Wait for the engine ``pid``'s conventional ``resonite-{pid}.sock``."""
+    target = Path(socket_path_for_pid(pid))
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if target.exists():
+            return target
+        time.sleep(_POLL_S)
+    return None
+
+
+async def _ping_and_shot(socket_path: Path, out_path: Path) -> np.ndarray:
+    """Ping the instance on its socket, then capture one Camera frame from it.
+
+    The ``shot`` is the load-bearing assertion: it only returns once a frame has
+    made the engine -> IPC queue -> renderer -> client round trip, so it hangs
+    (and the test times out) if the engine and renderer bound different queues.
+    """
+    async with ConnectionClient(socket_path=str(socket_path)) as conn:
+        await conn.ping("gale-launch")
+    async with CameraClient(socket_path=str(socket_path)) as cam:
+        frame = await cam.shot()
+    rgb = np.ascontiguousarray(frame.pixels[..., :3])
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    Image.fromarray(rgb, mode="RGB").save(out_path)
+    return rgb
+
+
+def _spawn_gale_like(install_dir: str) -> subprocess.Popen[bytes]:
+    """Start the mod-loaded umu/doorstop chain **without** a queue env token.
+
+    Mirrors a Gale / Steam direct launch: the same non-vanilla command
+    ``resoio.launch`` builds, except ``camera_queue=None`` so no
+    ``RESONITE_IO_CAMERA_QUEUE`` is injected. The env var is also popped from the
+    child environment defensively, so a value left over in the container cannot
+    hide a self-generation regression. Spawned detached like ``launch`` does.
+    """
+    argv, env, log_path = _build_command(
+        _resonite_exe(),
+        install_dir,
+        _mod_path(),
+        vanilla=False,
+        extra_args=(),
+        camera_queue=None,
+    )
+    # Faithful Gale launch: the queue env must be genuinely absent so the mod has
+    # to fall back to the fixed default queue name (the behaviour under test).
+    env.pop(_CAMERA_QUEUE_ENV, None)
+    assert _CAMERA_QUEUE_ENV not in env, (
+        f"{_CAMERA_QUEUE_ENV} must be unset to simulate a Gale launch"
+    )
+
+    stdout: object = subprocess.DEVNULL
+    if log_path is not None:
+        stdout = open(log_path, "ab")
+    try:
+        return subprocess.Popen(  # noqa: S603 - argv built from validated paths
+            argv,
+            cwd=install_dir,
+            env=env,
+            stdin=subprocess.DEVNULL,
+            stdout=stdout,  # pyright: ignore[reportArgumentType]
+            stderr=subprocess.STDOUT,
+            start_new_session=True,
+        )
+    finally:
+        if log_path is not None:
+            stdout.close()  # pyright: ignore[reportAttributeAccessIssue]
+
+
+class TestGaleLaunch:
+    @mark_e2e
+    def test_direct_gale_launch_without_queue_env_still_delivers_frames(self) -> None:
+        install = _install_dir()
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        out_dir = ARTIFACT_ROOT / f"gale_launch_{timestamp}"
+
+        # Clean slate: stop anything left over and drop stale sockets.
+        terminate()
+        for sock in glob.glob(str(SOCKET_DIR / "resonite-*.sock")):
+            Path(sock).unlink(missing_ok=True)
+
+        # Snapshot existing engine/renderer PIDs so _wait_for_new can pick out
+        # the ones this Gale-like launch spawns by set difference.
+        before_engines = set(_find_engine_pids(install))
+        before_renderers = set(_find_renderer_pids(install))
+
+        _spawn_gale_like(install)
+
+        deadline = time.monotonic() + _LAUNCH_TIMEOUT_S
+        resonite_pid = _wait_for_new(
+            lambda: _find_engine_pids(install),
+            before_engines,
+            "engine",
+            deadline,
+            _POLL_S,
+        )
+        renderer_pid = _wait_for_new(
+            lambda: _find_renderer_pids(install),
+            before_renderers,
+            "renderer",
+            deadline,
+            _POLL_S,
+        )
+        try:
+            print(f"gale-like launch: engine={resonite_pid} renderer={renderer_pid}")
+            assert resonite_pid > 0
+            assert renderer_pid > 0
+            assert resonite_pid != renderer_pid
+            assert psutil.pid_exists(resonite_pid)
+            assert psutil.pid_exists(renderer_pid)
+
+            # The engine binds its pid-named UDS once GrpcHost is up.
+            sock = _wait_for_pid_socket(resonite_pid, _SOCKET_APPEAR_TIMEOUT_S)
+            assert sock is not None, "engine never bound its UDS after Gale launch"
+
+            # The core assertion: a frame arrives even though no queue env was
+            # injected. One non-empty RGB frame == engine and renderer agreed on
+            # the (default) IPC queue; a hang here means they did not.
+            frame = asyncio.run(_ping_and_shot(sock, out_dir / "gale_launch.png"))
+            assert frame.shape[2] == 3
+            assert frame.size > 0
+        finally:
+            terminate(resonite_pid, renderer_pid)
+
+        # The host process table drains: both processes are gone.
+        deadline = time.monotonic() + _KILL_TIMEOUT_S
+        while time.monotonic() < deadline:
+            if not psutil.pid_exists(resonite_pid) and not psutil.pid_exists(
+                renderer_pid
+            ):
+                break
+            time.sleep(_POLL_S)
+        assert not psutil.pid_exists(resonite_pid)
+        assert not psutil.pid_exists(renderer_pid)
diff --git a/python/tests/e2e/launcher.py b/python/tests/e2e/launcher.py
index 3b36bbed..b092329b 100644
--- a/python/tests/e2e/launcher.py
+++ b/python/tests/e2e/launcher.py
@@ -80,13 +80,6 @@ def test_launch_returns_both_pids_then_terminate_kills_them(self) -> None:
             assert _find_engine_pids(install) == [result.resonite_pid]
             assert _find_renderer_pids(install) == [result.renderer_pid]
 
-            # Relaunching while running is refused (single-instance guard).
-            try:
-                launch(wait_timeout=5.0)
-                raise AssertionError("expected launch to refuse a second instance")
-            except Exception as exc:  # noqa: BLE001
-                assert "already running" in str(exc)
-
             # Once the mod binds its UDS the engine is rendering; grab a shot.
             sock = _wait_for_socket(_SOCKET_APPEAR_TIMEOUT_S)
             assert sock is not None, "engine never bound its UDS after launch"
diff --git a/python/tests/e2e/multi_instance.py b/python/tests/e2e/multi_instance.py
new file mode 100644
index 00000000..18960155
--- /dev/null
+++ b/python/tests/e2e/multi_instance.py
@@ -0,0 +1,129 @@
+"""E2E: run two real Resonite instances side by side without interference.
+
+The multi-instance contract end-to-end. Launches two labelled instances
+(``--name a`` / ``--name b``), each getting its own WINEPREFIX + DataPath and a
+private Camera IPC queue token, then proves they are independent:
+
+* both engines come up as distinct host processes with distinct UDS sockets;
+* a ``Connection.Ping`` reaches each instance on its own socket;
+* both instances deliver a Camera frame — if the renderer IPC queues had
+  collided (the old fixed queue name), one engine would starve or receive the
+  other's frames, so two successful independent shots is the cross-talk guard;
+* ``terminate_all`` then stops every instance and the host process table drains.
+
+Like ``tests/e2e/launcher.py`` this manages Resonite's lifecycle itself (the
+feature under test), so it does **not** use the ``resonite_session`` fixture.
+Each labelled instance bootstraps a *fresh* WINEPREFIX (first-run Proton setup),
+so the two launches are serialised and given a generous timeout; this scenario is
+opt-in (``@mark_e2e``) and intentionally heavy.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import glob
+import time
+from datetime import datetime
+from pathlib import Path
+
+import numpy as np
+import psutil
+from PIL import Image
+
+from resoio import launch, terminate_all
+from resoio._client import socket_path_for_pid
+from tests.helpers import mark_e2e
+
+ARTIFACT_ROOT = Path(__file__).parent / "e2e_artifacts"
+SOCKET_DIR = Path.home() / ".resonite-io"
+
+_LAUNCH_TIMEOUT_S = 240.0
+_SOCKET_APPEAR_TIMEOUT_S = 120.0
+_KILL_TIMEOUT_S = 30.0
+_POLL_S = 1.0
+
+
+def _wait_for_pid_socket(pid: int, timeout_s: float) -> Path | None:
+    """Wait for the engine ``pid``'s conventional ``resonite-{pid}.sock``."""
+    target = Path(socket_path_for_pid(pid))
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if target.exists():
+            return target
+        time.sleep(_POLL_S)
+    return None
+
+
+async def _ping_and_shot(socket_path: Path, out_path: Path) -> np.ndarray:
+    """Ping an instance on its own socket and capture one Camera frame from
+    it."""
+    from resoio import CameraClient, ConnectionClient
+
+    async with ConnectionClient(socket_path=str(socket_path)) as conn:
+        await conn.ping("multi-instance")
+    async with CameraClient(socket_path=str(socket_path)) as cam:
+        frame = await cam.shot()
+    rgb = np.ascontiguousarray(frame.pixels[..., :3])
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    Image.fromarray(rgb, mode="RGB").save(out_path)
+    return rgb
+
+
+class TestMultiInstance:
+    @mark_e2e
+    def test_two_named_instances_run_isolated_then_terminate_all(self) -> None:
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        out_dir = ARTIFACT_ROOT / f"multi_{timestamp}"
+
+        # Clean slate: stop anything left over and drop stale sockets.
+        terminate_all()
+        for sock in glob.glob(str(SOCKET_DIR / "resonite-*.sock")):
+            Path(sock).unlink(missing_ok=True)
+
+        # Serialise the two launches: each label bootstraps its own fresh
+        # WINEPREFIX, and concurrent first-run Proton setup can race.
+        a = launch(name="a", wait_timeout=_LAUNCH_TIMEOUT_S)
+        try:
+            b = launch(name="b", wait_timeout=_LAUNCH_TIMEOUT_S)
+        except Exception:
+            terminate_all()
+            raise
+
+        try:
+            print(f"a: engine={a.resonite_pid} renderer={a.renderer_pid}")
+            print(f"b: engine={b.resonite_pid} renderer={b.renderer_pid}")
+
+            # Four distinct host processes (no PID shared between the instances).
+            pids = {a.resonite_pid, a.renderer_pid, b.resonite_pid, b.renderer_pid}
+            assert len(pids) == 4, f"expected 4 distinct PIDs, got {pids}"
+            assert all(psutil.pid_exists(p) for p in pids)
+
+            # Each engine bound its own pid-named UDS.
+            sock_a = _wait_for_pid_socket(a.resonite_pid, _SOCKET_APPEAR_TIMEOUT_S)
+            sock_b = _wait_for_pid_socket(b.resonite_pid, _SOCKET_APPEAR_TIMEOUT_S)
+            assert sock_a is not None, "instance a never bound its UDS"
+            assert sock_b is not None, "instance b never bound its UDS"
+            assert sock_a != sock_b
+
+            # Both instances independently answer a ping and deliver a Camera
+            # frame on their own socket. Two successful shots = the renderer
+            # queues did not collide (the core multi-instance guarantee).
+            frame_a = asyncio.run(_ping_and_shot(sock_a, out_dir / "instance_a.png"))
+            frame_b = asyncio.run(_ping_and_shot(sock_b, out_dir / "instance_b.png"))
+            assert frame_a.shape[2] == 3
+            assert frame_b.shape[2] == 3
+            assert frame_a.size > 0 and frame_b.size > 0
+        finally:
+            results = terminate_all()
+            print(f"terminate_all killed {len(results)} instance(s)")
+
+        # The host process table drains: every instance is gone.
+        deadline = time.monotonic() + _KILL_TIMEOUT_S
+        while time.monotonic() < deadline:
+            if not any(psutil.pid_exists(p) for p in pids):
+                break
+            time.sleep(_POLL_S)
+        assert not any(psutil.pid_exists(p) for p in pids)
+
+        # Idempotent: a second sweep finds nothing.
+        assert terminate_all() == []
diff --git a/python/tests/resoio/cli/test_launch.py b/python/tests/resoio/cli/test_launch.py
index 088af3d2..a9297557 100644
--- a/python/tests/resoio/cli/test_launch.py
+++ b/python/tests/resoio/cli/test_launch.py
@@ -2,50 +2,19 @@
 
 The happy path (spawning umu-run and waiting a real Resonite into existence)
 needs a live Resonite and lives in the e2e suite (``tests/e2e/launcher.py``).
-Here we pin the CLI contract: the error path (a missing exe and an
-already-running instance both render :class:`resoio.launcher.LauncherError` to
-stderr and exit 1, triggered with real conditions — a missing path and a real
-dummy process — no mocks), and the argparse-to-call plumbing for ``--prefix`` /
-``--proton-path`` (verified by stubbing our own first-party ``launch`` and
-capturing the kwargs it was called with).
+Here we pin the CLI contract: the error path (a missing exe renders
+:class:`resoio.launcher.LauncherError` to stderr and exits 1, triggered with a
+real missing path — no mocks), and the argparse-to-call plumbing for ``--prefix``
+/ ``--proton-path`` / ``--name`` (verified by stubbing our own first-party
+``launch`` and capturing the kwargs it was called with).
 """
 
 from __future__ import annotations
 
-import shutil
-import subprocess
-import time
-from collections.abc import Callable, Iterator
-from pathlib import Path
-
 import pytest
 
 from resoio.cli import _amain, _build_parser
-from resoio.launcher import LaunchOptions, _find_engine_pids
-
-_SLEEP = shutil.which("sleep") or "/bin/sleep"
-
-
-@pytest.fixture
-def spawn() -> Iterator[Callable[..., int]]:
-    procs: list[subprocess.Popen[bytes]] = []
-
-    def _spawn(path: Path, *args: str) -> int:
-        proc = subprocess.Popen(
-            [str(path), *args], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
-        )
-        procs.append(proc)
-        return proc.pid
-
-    yield _spawn
-
-    for proc in procs:
-        if proc.poll() is None:
-            proc.kill()
-        try:
-            proc.wait(timeout=5)
-        except subprocess.TimeoutExpired:
-            pass
+from resoio.launcher import LaunchOptions
 
 
 async def test_launch_missing_exe_errors(
@@ -57,29 +26,6 @@ async def test_launch_missing_exe_errors(
     assert "not found" in capsys.readouterr().err
 
 
-async def test_launch_refuses_when_already_running(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-    spawn: Callable[..., int],
-    capsys: pytest.CaptureFixture[str],
-):
-    install = tmp_path / "resonite"
-    (install / "dotnet-runtime").mkdir(parents=True)
-    shutil.copy(_SLEEP, install / "dotnet-runtime" / "dotnet")
-    (install / "dotnet-runtime" / "dotnet").chmod(0o755)
-    (install / "Resonite.exe").write_text("")
-    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
-
-    spawn(install / "dotnet-runtime" / "dotnet", "60")
-    deadline = time.monotonic() + 5.0
-    while not _find_engine_pids(str(install)) and time.monotonic() < deadline:
-        time.sleep(0.02)
-
-    rc = await _amain(_build_parser().parse_args(["launch", "--vanilla"]))
-    assert rc == 1
-    assert "already running" in capsys.readouterr().err
-
-
 async def test_launch_forwards_prefix_and_proton_path(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ):
@@ -180,3 +126,43 @@ def _fake_launch(**kwargs: object):
 
     assert rc == 0
     assert captured["options"] == LaunchOptions()
+
+
+async def test_launch_forwards_name(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+):
+    # --name on the CLI must reach launch() as name= so the launcher allocates an
+    # isolated per-instance data tree.
+    captured: dict[str, object] = {}
+
+    def _fake_launch(**kwargs: object):
+        captured.update(kwargs)
+        from resoio.launcher import LaunchResult
+
+        return LaunchResult(resonite_pid=11, renderer_pid=22)
+
+    monkeypatch.setattr("resoio.launcher.launch", _fake_launch)
+    args = _build_parser().parse_args(["launch", "--vanilla", "--name", "agent1"])
+    rc = await _amain(args)
+
+    assert rc == 0
+    assert captured["name"] == "agent1"
+
+
+async def test_launch_passes_none_name_when_unset(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+):
+    # Without --name, launch() receives name=None (single-instance default).
+    captured: dict[str, object] = {}
+
+    def _fake_launch(**kwargs: object):
+        captured.update(kwargs)
+        from resoio.launcher import LaunchResult
+
+        return LaunchResult(resonite_pid=11, renderer_pid=22)
+
+    monkeypatch.setattr("resoio.launcher.launch", _fake_launch)
+    rc = await _amain(_build_parser().parse_args(["launch", "--vanilla"]))
+
+    assert rc == 0
+    assert captured["name"] is None
diff --git a/python/tests/resoio/cli/test_terminate_all.py b/python/tests/resoio/cli/test_terminate_all.py
new file mode 100644
index 00000000..4ee9ec33
--- /dev/null
+++ b/python/tests/resoio/cli/test_terminate_all.py
@@ -0,0 +1,148 @@
+"""Tests for the ``resoio terminate-all`` CLI command (multi-instance kill).
+
+``terminate-all`` force-stops every running Resonite instance. Per
+testing-strategy we drive the real CLI dispatch (``_build_parser`` -> ``_amain``)
+against **real dummy processes** (copies of ``sleep`` at the install-relative
+argv[0] paths the launcher matches), not mocks. The kill logic itself is covered
+in ``test_launcher.py``; here we pin the CLI contract: the human summary, the
+``--format json`` document shape, and the empty-state message.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import time
+from collections.abc import Callable, Iterator
+from pathlib import Path
+
+import pytest
+
+from resoio.cli import _amain, _build_parser
+from resoio.launcher import _find_engine_pids, _find_renderer_pids
+
+_SLEEP = shutil.which("sleep") or "/bin/sleep"
+
+
+def _make_install(tmp_path: Path) -> Path:
+    install = tmp_path / "resonite"
+    (install / "dotnet-runtime").mkdir(parents=True)
+    shutil.copy(_SLEEP, install / "dotnet-runtime" / "dotnet")
+    (install / "dotnet-runtime" / "dotnet").chmod(0o755)
+    (install / "Renderer").mkdir(parents=True)
+    shutil.copy(_SLEEP, install / "Renderer" / "Renderite.Renderer.exe")
+    (install / "Renderer" / "Renderite.Renderer.exe").chmod(0o755)
+    (install / "Resonite.exe").write_text("")
+    return install
+
+
+@pytest.fixture
+def spawn() -> Iterator[Callable[..., int]]:
+    procs: list[subprocess.Popen[bytes]] = []
+
+    def _spawn(path: Path, *args: str) -> int:
+        proc = subprocess.Popen(
+            [str(path), *args], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+        )
+        procs.append(proc)
+        return proc.pid
+
+    yield _spawn
+
+    for proc in procs:
+        if proc.poll() is None:
+            proc.kill()
+        try:
+            proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            pass
+
+
+def _wait_count(finder: Callable[[], list[int]], count: int, timeout: float = 5.0):
+    deadline = time.monotonic() + timeout
+    while len(finder()) != count and time.monotonic() < deadline:
+        time.sleep(0.02)
+
+
+async def test_terminate_all_human_summarises_killed_instances(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    spawn: Callable[..., int],
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_count(lambda: _find_engine_pids(str(install)), 2)
+    _wait_count(lambda: _find_renderer_pids(str(install)), 2)
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all"]))
+
+    assert rc == 0
+    out = capsys.readouterr().out
+    assert "terminated" in out
+    assert "instance" in out
+    _wait_count(lambda: _find_engine_pids(str(install)), 0)
+    assert _find_engine_pids(str(install)) == []
+    assert _find_renderer_pids(str(install)) == []
+
+
+async def test_terminate_all_json_emits_pair_list(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    spawn: Callable[..., int],
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_count(lambda: _find_engine_pids(str(install)), 1)
+    _wait_count(lambda: _find_renderer_pids(str(install)), 1)
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all", "--format", "json"]))
+
+    assert rc == 0
+    payload = json.loads(capsys.readouterr().out)
+    assert isinstance(payload, list)
+    # Every entry has the engine/renderer pair keys, and across the list every
+    # signalled PID is a positive int.
+    signalled: set[int] = set()
+    for entry in payload:
+        assert set(entry) == {"resonite_pid", "renderer_pid"}
+        signalled |= {entry["resonite_pid"], entry["renderer_pid"]}
+    signalled.discard(0)
+    assert all(pid > 0 for pid in signalled)
+    assert signalled  # at least one process was reported
+
+
+async def test_terminate_all_reports_nothing_when_absent(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all"]))
+
+    assert rc == 0
+    assert "no running Resonite instances found" in capsys.readouterr().out
+
+
+async def test_terminate_all_empty_json_is_empty_list(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all", "--format", "json"]))
+
+    assert rc == 0
+    assert json.loads(capsys.readouterr().out) == []
diff --git a/python/tests/resoio/test_api_contract.py b/python/tests/resoio/test_api_contract.py
index ea958105..a92a2cc6 100644
--- a/python/tests/resoio/test_api_contract.py
+++ b/python/tests/resoio/test_api_contract.py
@@ -118,6 +118,7 @@
     "launch",
     "shutdown",
     "terminate",
+    "terminate_all",
     "wait_for_ready",
 )
 
diff --git a/python/tests/resoio/test_launcher.py b/python/tests/resoio/test_launcher.py
index f89288f3..26873346 100644
--- a/python/tests/resoio/test_launcher.py
+++ b/python/tests/resoio/test_launcher.py
@@ -8,11 +8,12 @@
 ``<install>/Renderer/Renderite.Renderer.exe`` for the renderer). The full
 ``launch`` happy path (spawning umu-run) needs a real Resonite and lives in the
 e2e suite (``tests/e2e/launcher.py``); here we cover argument/path resolution,
-command construction, the already-running guard, and the kill/detection logic.
+command construction, per-instance isolation, and the kill/detection logic.
 """
 
 from __future__ import annotations
 
+import contextlib
 import dataclasses
 import os
 import shutil
@@ -34,10 +35,14 @@
     _build_command,
     _find_engine_pids,
     _find_renderer_pids,
+    _resolve_instance_paths,
     _resolve_mod_path,
     _resolve_resonite_exe,
+    _validate_instance_name,
+    _wait_for_new,
     launch,
     terminate,
+    terminate_all,
 )
 
 _SLEEP = shutil.which("sleep") or "/bin/sleep"
@@ -76,11 +81,12 @@ def spawn() -> Iterator[Callable[..., int]]:
     """Spawn tracked child processes and reap them at teardown."""
     procs: list[subprocess.Popen[bytes]] = []
 
-    def _spawn(path: Path | str, *args: str) -> int:
+    def _spawn(path: Path | str, *args: str, env: dict[str, str] | None = None) -> int:
         proc = subprocess.Popen(
             [str(path), *args],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
+            env=env,
         )
         procs.append(proc)
         return proc.pid
@@ -746,11 +752,389 @@ def test_terminate_no_args_errors_on_multiple_instances(
         terminate()
 
 
-def test_launch_refuses_when_already_running(tmp_path: Path, spawn: Callable[..., int]):
+# ---------------------------------------------------------------------------
+# Multi-instance: _wait_for_new (PID set-difference)
+# ---------------------------------------------------------------------------
+
+
+def test_wait_for_new_returns_pid_absent_from_before(
+    tmp_path: Path, spawn: Callable[..., int]
+):
+    # An engine PID already present in `before` is ignored; only the PID spawned
+    # afterwards (the one this launch created) is returned.
+    install = _make_install(tmp_path)
+    existing = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    before = {existing}
+
+    fresh = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+
+    deadline = time.monotonic() + 5.0
+    new_pid = _wait_for_new(
+        lambda: _find_engine_pids(str(install)),
+        before,
+        "engine",
+        deadline,
+        0.02,
+    )
+
+    assert new_pid == fresh
+
+
+def test_wait_for_new_raises_when_multiple_new_appear(
+    tmp_path: Path, spawn: Callable[..., int]
+):
+    # Two engines not in `before` means an unexpected concurrent launch; the
+    # set-difference can no longer pick a single owner, so it errors.
     install = _make_install(tmp_path)
     spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+
+    deadline = time.monotonic() + 5.0
+    with pytest.raises(LauncherError, match="multiple new"):
+        _wait_for_new(
+            lambda: _find_engine_pids(str(install)),
+            set(),
+            "engine",
+            deadline,
+            0.02,
+        )
+
+
+def test_wait_for_new_times_out_when_no_new_appears(tmp_path: Path):
+    # No new engine ever appears; once the deadline passes the wait gives up with
+    # a timeout error rather than blocking forever.
+    install = _make_install(tmp_path)
+    deadline = time.monotonic() - 1.0  # already expired
+
+    with pytest.raises(LauncherError, match="timed out"):
+        _wait_for_new(
+            lambda: _find_engine_pids(str(install)),
+            set(),
+            "engine",
+            deadline,
+            0.02,
+        )
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: label validation / path isolation / queue token
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("name", ["a", "agent1", "agent-1", "A_b-2", "0"])
+def test_validate_instance_name_accepts_safe(name: str):
+    _validate_instance_name(name)  # does not raise
+
+
+@pytest.mark.parametrize(
+    "name", ["", "-leading", "../escape", "a/b", "a..b", "a b", "a.b", "héllo"]
+)
+def test_validate_instance_name_rejects_unsafe(name: str):
+    with pytest.raises(LauncherError, match="invalid instance name"):
+        _validate_instance_name(name)
+
+
+def test_resolve_instance_paths_allocates_label_dirs(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    # With nothing explicit, the four isolation dirs are created under the label
+    # and wired into prefix + options; the token is label-derived and unique.
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+    instance_dir = tmp_path / "instances" / "a"
+    prefix, opts, token = _resolve_instance_paths("a", None, None)
+
+    assert prefix == str(instance_dir / "prefix")
+    assert opts.data_path == str(instance_dir / "data")
+    assert opts.cache_path == str(instance_dir / "cache")
+    assert opts.logs_path == str(instance_dir / "logs")
+    for sub in ("prefix", "data", "cache", "logs"):
+        assert (instance_dir / sub).is_dir()
+    assert token.startswith("resonite-io-camera-a-")
+    # A second allocation yields a different token (private queue per launch).
+    _, _, token2 = _resolve_instance_paths("a", None, None)
+    assert token2 != token
+
+
+def test_resolve_instance_paths_respects_explicit_paths(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    # Explicit caller values win over the label-auto defaults (explicit > auto).
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+    instance_dir = tmp_path / "instances" / "a"
+    explicit_opts = LaunchOptions(data_path="/custom/data")
+    prefix, opts, _ = _resolve_instance_paths("a", "/custom/prefix", explicit_opts)
+
+    assert prefix == "/custom/prefix"
+    assert opts.data_path == "/custom/data"
+    # The unset cache/logs still fall back to the label dirs.
+    assert opts.cache_path == str(instance_dir / "cache")
+    assert opts.logs_path == str(instance_dir / "logs")
+
+
+def test_build_command_injects_camera_queue_env(tmp_path: Path, fake_umu: Path):
+    install = _make_install(tmp_path)
+    _, env_with, _ = _build_command(
+        str(install / "Resonite.exe"),
+        str(install),
+        None,
+        True,
+        (),
+        camera_queue="resonite-io-camera-a-deadbeef",
+    )
+    assert env_with["RESONITE_IO_CAMERA_QUEUE"] == "resonite-io-camera-a-deadbeef"
+
+    _, env_without, _ = _build_command(
+        str(install / "Resonite.exe"), str(install), None, True, ()
+    )
+    assert "RESONITE_IO_CAMERA_QUEUE" not in env_without
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: launch never guards on an already-running instance
+# ---------------------------------------------------------------------------
+
+
+def _fake_umu_spawning(tmp_path: Path, engine_path: Path, renderer_path: Path) -> Path:
+    """A stand-in ``umu-run`` that detaches fresh engine + renderer copies.
+
+    ``setsid`` + ``start_new_session`` means they outlive the script, so a
+    ``launch`` PID-diff sees them as the new pair without a real Resonite.
+    """
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    umu = bindir / "umu-run"
+    umu.write_text(
+        "#!/bin/sh\n"
+        f"setsid '{engine_path}' 60 </dev/null >/dev/null 2>&1 &\n"
+        f"setsid '{renderer_path}' 60 </dev/null >/dev/null 2>&1 &\n"
+        "exit 0\n"
+    )
+    umu.chmod(0o755)
+    return bindir
+
+
+def _reap_extra(install: Path, keep: set[int]) -> None:
+    for pid in (
+        set(_find_engine_pids(str(install))) | set(_find_renderer_pids(str(install)))
+    ) - keep:
+        with contextlib.suppress(psutil.NoSuchProcess):
+            psutil.Process(pid).kill()
+
+
+def test_launch_unnamed_starts_beside_a_running_instance(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # No guard: an *unnamed* launch must start a second instance even with one
+    # already running (the caller separates data with --data-path). It returns
+    # the freshly spawned pair, identified by the before/after PID diff.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    existing_engine = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_renderer = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
+
+    bindir = _fake_umu_spawning(
+        tmp_path,
+        install / "dotnet-runtime" / "dotnet",
+        install / "Renderer" / "Renderite.Renderer.exe",
+    )
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        result = launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+        assert result.resonite_pid != existing_engine
+        assert result.renderer_pid != existing_renderer
+    finally:
+        _reap_extra(install, {existing_engine, existing_renderer})
+
+
+def test_launch_unnamed_injects_a_camera_queue_token(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    # Regression: an unnamed launch must inject a unique RESONITE_IO_CAMERA_QUEUE
+    # *before exec* so the engine and renderer bind the same Camera IPC queue.
+    # Without it the engine self-generates a token at runtime that the renderer
+    # (a Wine child) never inherits -> mismatched queues -> the client froze after
+    # both processes came up. The token is captured by a fake umu-run that records
+    # the env it was launched with; it must be non-empty and not the fixed default.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.delenv("RESONITE_IO_CAMERA_QUEUE", raising=False)
+    env_dump = tmp_path / "umu_camera_queue.txt"
+    engine = install / "dotnet-runtime" / "dotnet"
+    renderer = install / "Renderer" / "Renderite.Renderer.exe"
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    umu = bindir / "umu-run"
+    umu.write_text(
+        "#!/bin/sh\n"
+        f'printf "%s" "$RESONITE_IO_CAMERA_QUEUE" > "{env_dump}"\n'
+        f"setsid '{engine}' 60 </dev/null >/dev/null 2>&1 &\n"
+        f"setsid '{renderer}' 60 </dev/null >/dev/null 2>&1 &\n"
+        "exit 0\n"
+    )
+    umu.chmod(0o755)
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+        token = env_dump.read_text()
+        assert token, "no RESONITE_IO_CAMERA_QUEUE was injected for an unnamed launch"
+        assert token != "resonite-io-camera-frames"  # not the fixed engine default
+        assert token.startswith("resonite-io-camera-")
+    finally:
+        _reap_extra(install, set())
+
+
+def test_launch_named_starts_beside_a_running_instance_and_allocates_tree(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # A *named* launch is identical except it auto-allocates the label data tree.
+    # It still does not guard on an already-running instance (--name is a
+    # convenience, not a lock).
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+
+    existing_engine = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_renderer = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
     _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
+
+    bindir = _fake_umu_spawning(
+        tmp_path,
+        install / "dotnet-runtime" / "dotnet",
+        install / "Renderer" / "Renderite.Renderer.exe",
+    )
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        result = launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            name="b",
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+        assert result.resonite_pid != existing_engine
+        assert result.renderer_pid != existing_renderer
+        # The label data tree was allocated (no lock file is written).
+        instance_dir = tmp_path / "instances" / "b"
+        for sub in ("prefix", "data", "cache", "logs"):
+            assert (instance_dir / sub).is_dir()
+        assert not (instance_dir / "launch.lock").exists()
+    finally:
+        _reap_extra(install, {existing_engine, existing_renderer})
+
+
+def test_launch_named_relaunch_of_same_label_is_allowed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # Re-launching the same label while it runs is NOT rejected (no per-label
+    # guard); it simply reuses the label's data tree and spawns another instance.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+    existing_engine = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_renderer = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
 
-    # The already-running guard fires before umu/mod resolution, so vanilla is fine.
-    with pytest.raises(LauncherError, match="already running"):
-        launch(resonite_exe=str(install / "Resonite.exe"), vanilla=True)
+    bindir = _fake_umu_spawning(
+        tmp_path,
+        install / "dotnet-runtime" / "dotnet",
+        install / "Renderer" / "Renderite.Renderer.exe",
+    )
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        result = launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            name="a",  # same label as a notional running "a"; must not raise
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+        assert result.resonite_pid != existing_engine
+    finally:
+        _reap_extra(install, {existing_engine, existing_renderer})
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: terminate_all
+# ---------------------------------------------------------------------------
+
+
+def test_terminate_all_kills_every_running_instance(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # terminate_all stops every running engine/renderer (not just a single
+    # instance) and reports each PID it signalled across the returned pairs.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    engine_a = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    engine_b = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    renderer_a = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    renderer_b = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 2)
+
+    killed = terminate_all(timeout=3.0)
+
+    signalled = {r.resonite_pid for r in killed} | {r.renderer_pid for r in killed}
+    signalled.discard(0)
+    assert signalled == {engine_a, engine_b, renderer_a, renderer_b}
+    assert _wait_pids(lambda: _find_engine_pids(str(install)), 0) == []
+    assert _wait_pids(lambda: _find_renderer_pids(str(install)), 0) == []
+
+
+def test_terminate_all_returns_empty_when_nothing_running(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    # With no instance running, terminate_all is a no-op that reports an empty
+    # list rather than erroring.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+
+    assert terminate_all(timeout=3.0) == []
+
+
+def test_terminate_all_pairs_engine_and_renderer_by_camera_queue_token(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # An engine and its renderer share RESONITE_IO_CAMERA_QUEUE; the renderer is
+    # not reliably a host child of the engine (Wine reparents it), so terminate_all
+    # must pair them by that token rather than the process tree. A single instance
+    # must come back as ONE pair (engine + renderer), not two pid=0 rows, and two
+    # instances must pair correctly by their distinct tokens.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    env_a = {**os.environ, "RESONITE_IO_CAMERA_QUEUE": "resonite-io-camera-a-1111"}
+    env_b = {**os.environ, "RESONITE_IO_CAMERA_QUEUE": "resonite-io-camera-b-2222"}
+    engine_a = spawn(install / "dotnet-runtime" / "dotnet", "60", env=env_a)
+    renderer_a = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60", env=env_a)
+    engine_b = spawn(install / "dotnet-runtime" / "dotnet", "60", env=env_b)
+    renderer_b = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60", env=env_b)
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 2)
+
+    killed = terminate_all(timeout=3.0)
+
+    pairs = {(r.resonite_pid, r.renderer_pid) for r in killed}
+    assert pairs == {(engine_a, renderer_a), (engine_b, renderer_b)}
+    assert _wait_pids(lambda: _find_engine_pids(str(install)), 0) == []
+    assert _wait_pids(lambda: _find_renderer_pids(str(install)), 0) == []