From 4fe29bb931a9e177fb04d49b7e606fae2e5d0407 Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:41:49 +0000
Subject: [PATCH 1/7] =?UTF-8?q?feat(mod/camera):=20Camera=20IPC=20queue=20?=
 =?UTF-8?q?=E5=90=8D=E3=82=92=20env-override=20=E5=8C=96=E3=81=97=E5=A4=9A?=
 =?UTF-8?q?=E9=87=8D=E8=B5=B7=E5=8B=95=E3=81=AE=E8=A1=9D=E7=AA=81=E3=82=92?=
 =?UTF-8?q?=E9=98=B2=E3=81=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

engine ↔ renderer の Camera frame queue 名が固定 (resonite-io-camera-frames) で、
多重起動すると engine 同士が同名 queue を奪い合い renderer がクロス接続する問題を解消。

- IpcSocketPaths.QueueName を const から env-override 付き static プロパティへ
  (RESONITE_IO_CAMERA_QUEUE。GrpcHost.ResolveSocketPath と同じ「env → 既定」パターン)。
  未設定時は従来固定名に fallback し単一起動は完全後方互換。
- ResoniteIOPlugin.Load() で env 未設定時のみインスタンス固有 token を生成・set。
  renderer は engine の子プロセス (RenderSystem.StartRenderer の Process.Start) として
  env を継承するため両側が同じ token を読む。token set は renderer spawn より前の
  最早期 Load() で行う必要がある (OnEngineReady では間に合わない)。
- renderer prebuilt を再生成 (IpcSocketPaths は prebuilt hash の入力)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 mod/prebuilt/renderer.sha256                  |   2 +-
 mod/prebuilt/renderer/ResoniteIO.Renderer.dll | Bin 12800 -> 12800 bytes
 mod/prebuilt/renderer/ResoniteIO.Renderer.pdb | Bin 10332 -> 10332 bytes
 .../renderer/ResoniteIO.RendererShared.dll    | Bin 8192 -> 8704 bytes
 .../IpcSocketPaths.cs                         |  21 ++++++++-
 mod/src/ResoniteIO/ResoniteIOPlugin.cs        |  21 +++++++++
 .../IpcSocketPaths/IpcSocketPathsTests.cs     |  44 ++++++++++++++++++
 7 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs

diff --git a/mod/prebuilt/renderer.sha256 b/mod/prebuilt/renderer.sha256
index 7bec8480..4b584a04 100644
--- a/mod/prebuilt/renderer.sha256
+++ b/mod/prebuilt/renderer.sha256
@@ -1 +1 @@
-6ca5f47b4593c3c561b6f3ec1ee4a50ec645fe8a30d7a98c7a780acf6b04fc89
+3ac72c3fdc00061147c7419fb86086612876f2cec2135e72ff1a4472df20818f
diff --git a/mod/prebuilt/renderer/ResoniteIO.Renderer.dll b/mod/prebuilt/renderer/ResoniteIO.Renderer.dll
index 6928936e1ae1eda4ded6fceef30a5a4fa0129fd6..003066ed185efc45bd22e18a138007f6ebc66dcd 100644
GIT binary patch
delta 2851
zcmY*b3s6+o8UD_>_nx~fxbjvM5kz6}6<!NcZI!6SR}_N5M>Nd}7>Q#*z&4edh0%nR
z8Y*7%P?Jv3G{)8>#+@3RF-@(t(>67oPSY7ps~JbzNTXw$cE&N$Ouut>hfa6re)s>r
z|3Clv?|;uZyWLIQO?#fT>%|Yd2X<$RwF5_23C9zn(8;X<R(g4Iy0=CYibuU35fN3M
zkZI1o34rjnPOXgA$~09LtOoq)xd7zj9rx4T5ddu2HHz4N-a=b@r;Rof6${#3>b>AA
zC_6;8BZcwXoy=0@*!?Xf`Ryktwtq-)c2DIj6wN)D$GDF9-YwravB2{u6o<Y^!OoOj
z$(&_k&<V0yzwFX8w`V(Oi#b|tVA|#2sCY3!uQg$uSnTyBES<JQ$A6_#0o5^=c5vxP
zg4Sg;FXu3wd4yei{l!_=n9~YAKu7Cx!qi9N&ilQ^{t0y}D77C@XluQXmXtv)bg&q;
zBSZH>c9~mDR$9)ae0jM)7TNwehqjlyXjA4vTbFw?63e`Q_-84Td7T$boFi(z=EOWv
z=k+EQecko}`A-3DyxR%1>pR<9o_MT-F9DtG>B}y)hw71>1+YWNuX$+k0^W1UJH4BU
zg;|wk9Eh>;E0K4}tInH|G$pdi5wuw-qE@A=kYj7SDkr<6v5L7Ba;;8V!LiRf3g5Fd
zRvBzC_$Px229HZUw$$!r%tx-q52Qx;G&YJ}$B&t!$qrzv`hd7d4n;%&Ph&_ZgrI}o
zcQm@H*9oB2r-N$oOE(ph)fX(qWui<Bsu$tM^UhwMAA>}NIcCb&%`{&!1K)>F=d5AQ
z0E!%)=TSMtxjuI_CK|j!j3_)}CceTH0h}~-{YvNojhtSgl~t#r)BOVD(CQ4ch$a*N
zi7C`_>+Kx8!)MLGJfrurbluO#H9+tSk&GY7=iJZ;yUjjn#<vim^9CCqBH<DyJ7|~%
zW+59b&#P*B*hI2QrP(M1Ajp2=oL4)LiZobc`ZZQ#48H}~=&q0jSZ>!7-*p;f9_Fhx
z#OwBYDG*U%Vh5VF{S;bwEAee19_MZnSgKYK)5VtffIR$Eb<keue204fh_|6TM{Ji3
z-3JZ6<7}r_Pa`l_?vM&QU5)z?mbJOM7tf5nrxeRvJ;HjWh@fqR?&i?Q2%{7IBTP5)
zl@Yd=zQ4v8$~lRJc|10N9y}@g$X<@KGwhp%>-jNXwuyXoa*VAO2c(6_jX3?9GbkNg
zo1&e67i|nxxNDfM`w0250_}SSMdD5A;#lGTBK-&kHS57$aZ>s*FV2SSWF%sBoIS_|
znFJKYBKw#z3F(nIJ;qg>gs@?;MkS%;|JYW;cJlq2H0;L$E((cZy=+j&<s$KGy=aiD
z7fW0(HZi9-r-c;bJ-~xRU<r#^2p5rsJR9yQffS-b7SYcV@2O;z7_2f_ZE&%{I)iHr
zhKUN_C1&7X#PMh`N`m;xH;Mhw-V~v;Wr+`cGx&)2)LeEj;#)}NW8aJjj^d`h8YSW`
z@hCEV+AbibGxRAc8SXAri%aOE-5~pk6CDqO^u9<O;QL-9?zn@*zqxN<0R8q`*l#A@
zkGHum!eX{BYVb7m8s9l)SgZcP{MB|JBI&5}T`(ywv7*<-HIwK%6OC1G;gqR&KQ{4g
z4H`U!b!^=kd?Oxt2fxKXRUdIT_e?gFvl`h*QB%Yf^!la~Uvo>uMdk^K$tK${E{R2A
zdd!Yszr9xUi04F;7^bvI>}R{W#GtsMdc;xD?>x)FFUgn0DRI(wh%vAD-llgM&$nTG
z#zez7!VJUQy2?Dpdtv~evh+K6L7f$Mm{akIH}i>k;NoMRe#<aH>T`90oPtOydSoG{
zqQ#!cwR&34<Z*J2I3CxC`M61(hS}Cklwl=tHp0aDc!Idp==H?;co=UG{ltYll6qvL
zQ5ucXh(^3=?KH|xqwJ*ek#!gkM>ycHkq%S((mKPzhpe-hgh}>Uljw?3t{Ua4QH0Pj
zme4U4?H*}~%?R50LKiV8wfBs{E5sftERE}M3;*G{*&!<NBqoY^qF&hD-mJ9b!t>lD
z+(jdw--si|cBqcw#)*CQdaY@*=U(Ub(HkiCn;P>Bo14zS9cDg%6u&TW3EZp`xu05j
z{eag%bU1CFNP4Wf^ILV>nzuDC4{wQfW&Fh%wYaUZzO`|4b7yV1b5nHX_+27;G5hzH
z?EbMgFll<!%^S3m8-70S=D~vSyw@JQef-~_oPIw#G`UI4VR-?6t|J06klKCD@49xj
z^reQKTqyzp1u3$V<>+K#Wu$ap6gilX1D`J;R|w6cD+?}&VAF=?;!vnD914dj!e!;f
zp|XmS$_<TG<)KhzMR};Hw5qBsR93ptTN%8N@!qS?4?#RotN%gh-?+{i{Xe6+XpD22
z)@5&fQGW8(!5g2Y|14|CySG0*k>9`Pgtw<?eQ8|$-R-!j6D556`_%*6{yeTq%se(@
zQLJ?uYqXs^ke4Z{q7_pwh=F2XG%&rwTG50JXht#rEQGjR!bE*l5X(?*^fIy%R5Gp+
kRn&B3B{gj|p_Ez`V?(@3vC;GH+a}k|il!9b;vDXO0WEDa82|tP

delta 2726
zcmY*a4NR5S8Gg?BzVF=2MXvlPiU<W!xcrD*FBfpm7G|v=SgB5joi^cjg>}6QrVF)r
zvAAlPwX)CDlGbL7H5F&f^e!tVbB=V~Pa3ODW20+za~e~cwWP^R>wcO&=Wxfedvl)i
zKF|A}_xzu4plzV-$U(a+xO#B-&|=XtJpK)l<O)&X1l9vzcXMTlyImBB$K8D*Dr#II
z)0|hb0O2+lRmK`+nhNz?w9q{-2Y~GAtpR-fe!!M{l88ORMt9E%4LWKj=upso(VHK7
zpK5Ok<DYWUS1QLo+!@U4xuZj+gKp<g5qqI%>Od~zdcWpQdl!kdt}mf1ypDpMF83s}
zm-_-v;30CkNB7**$mTPShz%6q2qeV^v%`%fEE2WuP(poiosR!fr2?w=0os8Lvk4;g
zG;d@xoteVKk9=hr3l+MpKm#3-jfA4d;?CV}oiFQ=hbi^E!;r`dT2cnI(96N7{`q<>
z<Q`Ma$V$uUly5xjn~Chn_i)ya6O@@~WTU%0G30*it5PQO5jT+dRk6u!Ps|mK?t#R@
zHD7puyuCo17x;)JZ_D?3I-mSjFE;@VT+_?izjX^1X8>Fw<gMRY_aN&M@^1H&#Da_p
zvILfe@sh||vNXEO=PZlXIf6C^ir1_{k3zDo@rq3M%tak@E2LT-w!-Ju1xMjYgT)4G
z4ZdaYpHh2&B6ZuPb|39GJQ~kSjkk>5D*7BBO2szYk5+Y__!W6FD*X5XP6~xEbm$pJ
z<2|Auo4q=y5wCetk*@y1p?u6l>2TFC_;A44<@LcODwLWopY!UrpP06{JUZuk=JX@e
z(Rnt@lkDpXbwB>CG+v?|Rd~#F{2o*Ial(x2mqIsqh}|nhIO;`ccBa^Un~8ka4Dqg7
zXJ_Lm2b7I!qxY#kN3Ud;1_=Hkl5s?Kd&0A9iYufU*Pp%{R$&#X1P?Fi^W1<iEHDe1
zkQY=9Jv>BYg-Wv|_#wz%aW1$?{sqw{Prb}XwY`Zr?rfI12&=8cKiS)*z<1S7VlSGB
zd(lpu=j|l^98VC}sCuo4&Ukz-j;jdmN~f3lz^r%MK(^Q|w+%dRaLn0FukJ-47?pie
zp~Iu`D0a%m96j@A7fvh1IX2C*K?a)_!T1i6MgPxtc$Vo^J3h+}GxEb3hJ5y6p_;D)
zun%2wh|FCwH$Cb%jvp_baWsh+rG>x6S&4I;FU;*_+IL5^FjC=PhUr0$k)O)fzGqP=
z#-#_R3jP=ALm;5pK71<9N*}7@?4+HHL^Q?OX7`P`NySey(;UnzoQZ#dCvpy&4Vzhv
zIq3W^bEoGnh*oe@B|gyGj<wuwi3z>wNY$Gi*O!=>b4+Q$GTwe(e}N4=*X!V6Nx-xc
zNFgd@5Pc{lCL?HYmBAW=bp{_XxE<3`1~ro?^bzOdGh!w>jgla4dY5q0+M6PDx(so~
zyPOl6Ru6EQTD<G1oToC5Kif?Ricg8-xaZM!g0~6t7`c~<$Fm<b;yQ+C*UH1h6vxFV
zz0qT=2DydX#fP3z;vYOGFpL5FG)7FvBN*i=Zx-3!n89CBFY>;{6b<SUI|$iB#B%Rd
zli@lC^pd!3@_fWRK6M)B%y38WD0gPm;5qEz%1z>aaXV^4@8OU5s~RF6;x$-|FF23I
zu+%bf6J6dC;sH-kTw|iJSZdNu;gYBoC2{+Q_M>8ocAFUHI(=V^i1$>#7!?D~ezqEt
zN5vU2;(e7d1Kyv}yTbbm+Si#OI)xF_Sf5C}2Is^uu5r}&a8O+k_n1_1t~)tbKWgzl
z->L>=Nc|R8%VkJKzbrrz+U-)F#0go7G)xjR@fTtqrijI;v`P^|BXKo$64#=OSg-Xc
zwy;`@Z{nv!A90;Y+G><mqqL$G<JO>228}XE<+3$qlrf`>QTg1OWZPG*H?aiS_M0Zp
zO{3g0$}OV^p<^teV=NKWGqA+B`KibgdJv;hyC)6aB=$>TY21Nn{GBge#H~!rD!9NK
z!7DTS`>lB0*bdbNyd^WgUGAQ=)roKOuISqWc-+af%#4d-%qR(b0q)~HiLgA!@<Qxx
z+EEcZHvgIvi)KC}&SqV-M93Y@PtRP=*)`)kXh#q0<>)ZA=Do4EbKbR*Pd=6Q&gpIE
zYmdD=cJ6nPiOJZhrES9J%W;HX`cnrc-R%6Vlq(_|S=sP<6LN%@pE7VI){uWy1VXE-
zI@(%0+RLlT!Y#p2Wm{$Y%20S^MR`lvs&GqrMKILd5-w}6a2o<wgF{z7n}FEZsK46!
z>+<w^7W1Hx@TaGl#-d-ZJM`Ugw-)9l7hfK|Yt^rL@Yk8WRZslBR=5WXcdm?!_Wf~@
zsjFV!u>S1C{@cw3zxm+Ha4mDhf19+OGn|_)YGS2DS4GTUQekZhVHK*l7;Rjh4lYJH
zSsB0HEqr%EsH9#=btUaEv4Z{<`d68Va&jHjOf5{c9Tl#-VwY^IilvlIi{UcQe*odi
B94i0-

diff --git a/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb b/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb
index bbcc8224115bed9319025022c344e01558ae3d0f..e6ea817e86ae6ab0f3c4bccc23c478627688e7bf 100644
GIT binary patch
delta 202
zcmV;*05$*IP~1?Ed?n+d?CTV@8A`YJ=dvS?kg~m?mAC)^0037X0tg8T00031001|U
zp%(#BvAK-}AO#BoOA!E3Jsw;`nZG!eSuA3QmIR8u2>#01cuA)>W0PhERw!g*WiT~0
zV_`L6H8x>0G%z(YHZeD1V>vW6H8(aiHDoe5IWsjgGG?>n1`Y!lp?#~j06+o&nj<6}
z2t|iZtuPH}?r3`=lZ+%8A1-8UYybcOaZ<hM0Du4hKuwLW>>dbCzi6(cuV#S2vqB0Q
E9xbgz>i_@%

delta 202
zcmV;*05$*IP~1?Ed?hQ;q4fhxJw(16b2x0rNCAq~@wfm00037X0tg8T00031001_T
zp%(#AvAK-}AP}}KK^(B=kv$3Pp-(NQK|;;)IoTuvLI7h@!RQZrL6c?%Rwy$$IA&yH
zW@R)uFg0Q^GdE;6Wim50GBz|~FgZ11G&V6aVPZ8fWj3?q1`Y!lSABWB06+o&4NJes
zcmXp&q{ch2|CKchlZ+%8A1-8UYybcOc4^0>0Du4hAdGLoI#Pf}l2pUB8x5=kvqB0Q
E9v~z`AOHXW

diff --git a/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll b/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll
index f1a9c510fa1cf098cfe4c962efe1a8bef8732a6e..7527aeb534f46df469b005b616e951c87ba2ac21 100644
GIT binary patch
delta 2293
zcmb7`du&ui7{$-r7u#*wZXcBLlI=rU+JZ~B+ob`L<xOKKlt-aa({9@>RG`?}k|qMX
z1Ox<ZC>M(ujYuI82`?K68VHXD0ullkC4`8AB*Yqws2Ct7#xv8k#6P{w{N_97`|jMi
zbMMY=G#H(>eRF2hywkmi9e0uGi5FfVora^&bOt&;t8g7J2Ifd32)K=ojFg0GAc6Xn
zA6Q^#Xa#nq$Z@&{)AF#T+gn7w7;2voIl^OqFEWSpas+wIV$)z^Vm1&>0)%~TaG-mx
zc2+M)@oE^!v<W0Np99{=9R@g^RzaM#ayX+juhskq?K~?Fw%f{{lxqQ5Yk{5YC(3w!
zOLIfxk~igbu5)&|g5JXUcsh`?rk6EyVd*sX4j0g7H(5E65mK=wv&p$9vhgJFa>_4Y
z&*^Z+eOlJ)Y_djrz;C*Y0SiBCKN=PqbjiQPH6sxkPqi>X>(DLC)mPKsrAaPOY|>Uo
zD4Z&ht*jGjh$})4u|`iMKQtvD2+0GA0*QtbF2yv`!WmVwN!7ogoP#QEH)Q2_^DooF
z2<2xh{>pke<p3hG6Y_3^8()Zev!q{5<b6oRyJRkz6O)SfPL-u{@+nI7waV$d(>SW5
z#wtvQfdN=Ywa8qBg`DhQj6$i|Bt~JI-b%I@ZK5I?jNmPHNv0I}j5Bac@tk6wkWRAV
z0p&cwS~}awif98bP!Zi@tP|zYT|&k)l=GswLCp2Y8{3$EnX4nP_&=(;Uu_Z*fwq3R
zO$co2SDUCh`;}ay{e8-DRo}tfp_uwyspBzq#gw_zF?C3(3o*4o$lTSK+F*7H5y7`H
zxe%1N)2BG^52#Wzz@rmQ*e@J-tkgzyiz6Zq*E3~qBSx4fg%gjJdLY)Ar>T}_$=pS(
zF?&QjcE(h_DBv&lnNppOk=7-VfQX(gOFJF;lrFeq>K$>N&yEilKk$KTI7RBX$;WNr
zBx$0GuZ)Eqj0Yg3Do+`*zK=aB{)J}=Tx5-gJLL0tfP7bQ+2H*rv9mCQbYe8=#yG_i
z#mS1Lisg!xiXp`Y(!x4&5Z6e?sW`6};2e&bUR<UVzzw7sljxU;8H}eJ<@{;Onj08n
zR3kE+iPtG!HCmatZ*IUn$c5@fv-pSu$<jFP9S6A^q~a*!bR6gVJRV<?6Y-1;B9Ch~
z4X<(OXJM(xK_OP?V-b(LVk}b7OAdoW8;dL?k@=`3eQ49hMlb<yQ%uDU@@18nulNcs
zYEw~*d!&=BRdKC~*Q<DaEMA7+wJzm!DW?m|FhuWBPLFbW=mhn<%DJa_pBvsi4I&~h
zAcUkY^6-EhiY2;7IT?yU#mS1*iXp|Q;yT4Wik~QYG&xQ+`B2N`2D2USVK?6r!4;Id
z=MDWEzB?xruX#)<jwvn{GTv<7A}b;JvG~sZGd|zcxP2tqBNIla@5L1Q@-_T-`vvwQ
z$?C32XcJ>*hFhjLu4-sr*|;Ly*isQ{ZV1&Z4`WHVrK-F&+!`(mtq7y4E?ggKUEb1t
zd!W!0`+c6s6S{A^gTncI5Ia42vVgrP`Mhu3JZ@|A`4KEbDHbrUVn2tRipiKwJ&%1A
z%DLT5R}DUUL~3EOKydcEM;^Z5C_A(C@V+DU(X)0z%I-LQfN&WQE|+~FWs%qWKL@vm
zrGCm!l}pb>99z8ZfXn_W^;B+MP1x)A*M|Hde{slH<n{ZC#|3I?ON#vdKyi`3uCS!U
z=l2!X+lL38C<3+~?Rp<#_FQiA;CB>mex%*<;~zWZVyCd>u(dPSo^E%hWx5-;q=a8O
zQdzot=a!!yIqRp`m(rRFV`gP#%#>rtKfZCZ{m$v@#ZMmu@5KHAkV8L_v8N*=P3tYT
z*AL!mdxr1pcBMD#bLvooFud^dua;YjU$tV=ha%<sP|Q6dz`9zL(36z`dNQixPp^c3
ZKE^)A_1)Kom1tT*pgU>!Bhlft{sGfGwE6%5

delta 1974
zcmY+Fd2AI`6vn?h%j?3UbfX)K-JpdwwY;U}u}CYGf&^Ni#a2n$*Uc1+2o!?R@LIuY
zu^{b)Y9T_gR3brxv=EJuloW6w28oLPgR(@T#y^N5Vq#+a?&(X7lbqk2?>l$yJ9p;J
zoA$Eyk^`@2?r8mN5aHt%GSeriLLiAo<hc2vzvtxom|8zjp^XwC*6PVfaMuHF>Utkg
z<zyK7POZv`9+^rjoss11Re37KIj3^eOy@_HnYxcN=wms<fQ{H}pfVOvPF!m7aHTP7
zI*VM{i+{I)tX)8j3%IZIb!}T)pMQ3nT*@E3#3ZYF9o&=Ih|bHaSCsKQo!aNT<H`w5
zr_#O0G4wj7Fcc$=5y8l3SPboHt-}m!gJ=GRscV1>7mOjxg+-?3b=7N4!DU|RLX6R5
zx{zg7(BEii<_OD-iV($35f7CvbjcJ)l%Ar}yu-`tY|T%U=F38bJ7zRugh`|eugI9E
zW&BKWc1a$z^vJ)hGqwve#Lp&mv&9-*REWK+Sahp7c7SqRP2mc(;`&(onaya$>!|)@
zg8_LYS`CRZxyC4}ZPpGv!MhcK4yrVJ2ddd-GG@bV7pvK*GZ&KO)?;dYdkIR(Z$l#T
zC^GPa@S<?8(oVeaeQ_S5jLrdaeS0g)$*oFrndHA%PpZmvy{68TZr(eEn*XW#3AIWo
z?3_@cwUn<-NL}okQ2KrhjjPB3vxc<~!s=B~XTxg0t!o#;>IG4k!>UT@+E-y!Zf~Ia
zF087tp^Eb6xMbh;REZhj(T6SAq$2S^R3|#sb`^!MGj**Kx2#<%8V^L>QziCps^_wF
z?FvflF6U@eYUqZ&U%6psYqu}*4pj^@g)@AP2Hqr1^z)Um@DgdGj?dnOYUU9L%E%Bm
zFL#KrQ#h*k0J=EFzySGQ9-+4Yx-G>QN#Fm}5KqyVL&jpBFd!@yt`M#f)(V5dR?>wI
zaw>0t&J%Ia%*REv*@gImPBE_IS93A_)oK~@6l)Ep%b4q2OFi?|Y9sy7qt<qc_v}5m
zjTV*9?qcySU-d+sV4i|g+?w<85xEHW$r5DoE|#G{<-mhHvjCHDL=_+bC&+2ILT2F_
znTKSf0A3W43$c`3ib`^&`0Iqvgs{h0ibfnIqsd0e8ztW@`R;JO38#%gaR$X1#3p=i
zjEOTQ&KRA4j9cQ|7T!fX=Y-PpE1{|8;<#a|G|V#7>4c6N8B!<_mI~{IL1DYFLpUHj
zCQLW<MD^rJBNHLMaR<30xH)j#?Bl6R*lX*&O<1FJzS2HK*5Z&dINo&X+_Rj$?%cF~
zJWhZ7Pt?!}kA8g4-81~9d#4)S9HY$P_P8a=xf;L3nVc}1zyayqn@1O{ZC}<~HFkE|
z<WrVYme}vyOMFUsdJ{d)v8inlxrj1zG0DkJI-lze%x`IGY-#q*FZ4Ie^A<N1H+#H(
zPm!;oFyL?S70vSo8~laMMNVY$IZyog;0V;JO5F>;92nszX+;0?hY#JXZXt)^;aA9$
z?EI0O8T-wP%ip?p_>r=qyXRaVU;0!z*(qB*VY6*k*wk~s{a3_5?Qb{A7hFy2=?H(t
z^wfuSp5Bv@WbE@hKc&1e9Fw-ytnebhUD$#qKGqgA!$(yJKN|Sbc=<2g#AxPz^wRU7
li1h~612V!#tw#mv`RO*JX!zQUfMJ~W568{CuX+ky{{rAYU$_7O

diff --git a/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs b/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
index 0f6c7592..ee5b336f 100644
--- a/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
+++ b/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
@@ -1,3 +1,5 @@
+using System;
+
 namespace ResoniteIO.RendererShared;
 
 /// <summary>
@@ -13,7 +15,24 @@ public static class IpcSocketPaths
 {
     public const string OwnerId = "net.mlshukai.resonite-io.camera";
 
-    public const string QueueName = "resonite-io-camera-frames";
+    /// <summary><see cref="QueueName"/> を上書きする環境変数名。</summary>
+    /// <remarks>
+    /// 多重起動時に各インスタンスの queue を分離するための逃げ道。engine プロセスが
+    /// 起動最早期 (<c>ResoniteIOPlugin.Load</c>) でこの env を set し、renderer は
+    /// engine の子プロセスとして同じ値を継承するため、両側が同じ token を読む。
+    /// 未設定時は従来固定名 (<see cref="_defaultQueueName"/>) に fallback し、
+    /// 単一起動・既存デプロイの挙動を保つ。<c>GrpcHost.ResolveSocketPath</c> と同じ
+    /// 「env override → 既定値」パターン。
+    /// </remarks>
+    public const string QueueNameEnvVar = "RESONITE_IO_CAMERA_QUEUE";
+
+    private const string _defaultQueueName = "resonite-io-camera-frames";
+
+    /// <summary>共有メモリ queue の名前。<see cref="QueueNameEnvVar"/> で上書き可能。</summary>
+    public static string QueueName =>
+        Environment.GetEnvironmentVariable(QueueNameEnvVar) is { Length: > 0 } overridden
+            ? overridden
+            : _defaultQueueName;
 
     public const string FrameMessageId = "frame";
 
diff --git a/mod/src/ResoniteIO/ResoniteIOPlugin.cs b/mod/src/ResoniteIO/ResoniteIOPlugin.cs
index 836eead6..8d6e68ae 100644
--- a/mod/src/ResoniteIO/ResoniteIOPlugin.cs
+++ b/mod/src/ResoniteIO/ResoniteIOPlugin.cs
@@ -81,6 +81,27 @@ public override void Load()
     {
         Log = base.Log;
 
+        // 多重起動時の Camera IPC queue 衝突を防ぐため、インスタンス固有の queue token を
+        // 生成して自プロセス env に set する。renderer は engine の子プロセス
+        // (RenderSystem.StartRenderer の Process.Start, UseShellExecute=false) として
+        // この env を継承するので両側が同じ token を読む。renderer spawn は engine 起動の
+        // 早い段階 (OnEngineReady より前) なので set は必ず Load() で行う必要がある。
+        // launcher が外から token を注入済みならそれを尊重 (上書きしない)。
+        // QueueNameEnvVar は const のためインライン化され RendererShared を早期ロードしない。
+        if (
+            string.IsNullOrEmpty(
+                Environment.GetEnvironmentVariable(RendererShared.IpcSocketPaths.QueueNameEnvVar)
+            )
+        )
+        {
+            var token = "resonite-io-camera-" + Guid.NewGuid().ToString("N");
+            Environment.SetEnvironmentVariable(
+                RendererShared.IpcSocketPaths.QueueNameEnvVar,
+                token
+            );
+            Log.LogInfo($"Camera IPC queue token generated: {token}");
+        }
+
         // resolver は Core 型に触れる前に attach する必要があるため、ManualLogSource を
         // 直接渡し ILogSink を経由しない (上記 remarks 参照)。
         var pluginDirectory =
diff --git a/mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs b/mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs
new file mode 100644
index 00000000..a546e5f2
--- /dev/null
+++ b/mod/tests/ResoniteIO.Core.Tests/IpcSocketPaths/IpcSocketPathsTests.cs
@@ -0,0 +1,44 @@
+using System;
+using ResoniteIO.RendererShared;
+using Xunit;
+
+namespace ResoniteIO.Core.Tests.IpcSocketPaths;
+
+/// <summary>
+/// <see cref="ResoniteIO.RendererShared.IpcSocketPaths.QueueName"/> の env-override 解決を
+/// 検証する。多重起動時に engine が token を env へ流し、renderer が継承して同名を読む経路の
+/// 単体保証。env は process-global なので単一テスト内で set/clear を直列化し、元値を復元する。
+/// </summary>
+public sealed class IpcSocketPathsTests
+{
+    /// <summary>env 未設定なら従来固定名、設定すればその値を返す。</summary>
+    [Fact]
+    public void QueueName_honours_env_override_and_falls_back_to_default()
+    {
+        var original = Environment.GetEnvironmentVariable(
+            RendererShared.IpcSocketPaths.QueueNameEnvVar
+        );
+        try
+        {
+            Environment.SetEnvironmentVariable(RendererShared.IpcSocketPaths.QueueNameEnvVar, null);
+            Assert.Equal("resonite-io-camera-frames", RendererShared.IpcSocketPaths.QueueName);
+
+            Environment.SetEnvironmentVariable(
+                RendererShared.IpcSocketPaths.QueueNameEnvVar,
+                "resonite-io-camera-instance-a"
+            );
+            Assert.Equal("resonite-io-camera-instance-a", RendererShared.IpcSocketPaths.QueueName);
+
+            // 空文字は「未設定」と同じ扱いで fallback する。
+            Environment.SetEnvironmentVariable(RendererShared.IpcSocketPaths.QueueNameEnvVar, "");
+            Assert.Equal("resonite-io-camera-frames", RendererShared.IpcSocketPaths.QueueName);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(
+                RendererShared.IpcSocketPaths.QueueNameEnvVar,
+                original
+            );
+        }
+    }
+}

From 95972a7516116885e0842eed7021f2c2448e65df Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:42:23 +0000
Subject: [PATCH 2/7] =?UTF-8?q?feat(python/launcher):=20--name=20=E3=81=A7?=
 =?UTF-8?q?=E3=83=87=E3=83=BC=E3=82=BF=E5=88=86=E9=9B=A2=E3=81=97=E3=81=9F?=
 =?UTF-8?q?=E5=A4=9A=E9=87=8D=E8=B5=B7=E5=8B=95=E3=81=A8=20terminate-all?=
 =?UTF-8?q?=20=E3=82=92=E5=86=8D=E5=AE=9F=E8=A3=85?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

以前撤回 (b8f51c6) した多重起動を、データ分離忘れと IPC 衝突を解消して再実装。

launch:
- name=<label> で instances/<label>/{prefix,data,cache,logs} を自動採番し、
  WINEPREFIX / -DataPath / -CachePath / -LogsPath を分離 (明示値 > ラベル自動 > 既定)。
  RESONITE_IO_CAMERA_QUEUE にラベル由来 token を注入し Camera queue を分離。
- name 無しは従来の単一起動挙動を温存 (global already-running guard)。
- name 指定時は per-label lock (instances/<label>/launch.lock) で同ラベル二重起動のみ拒否。
- _wait_for_single を _wait_for_new (PID 集合差分) に戻し、他インスタンス稼働中でも
  本 launch が spawn した個体だけを返す。label はサニタイズ (path traversal 防止)。
- CLI: resoio launch --name <label>。

terminate-all:
- terminate_all() を list[LaunchResult] で復元 (engine と子 renderer をペアリング、
  孤立 renderer も kill)。単一 terminate は pid-only のまま不変。
- 新コマンド resoio terminate-all (--format human|json)。

real OS プロセス (mock 禁止) で _wait_for_new / ラベル分離 / lock guard / terminate_all /
CLI 配線を検証。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 python/src/resoio/__init__.py                 |   2 +
 python/src/resoio/cli/__init__.py             |   2 +
 python/src/resoio/cli/launch.py               |  11 +
 python/src/resoio/cli/terminate_all.py        |  66 ++++
 python/src/resoio/launcher.py                 | 276 +++++++++++++++--
 python/tests/resoio/cli/test_launch.py        |  40 +++
 python/tests/resoio/cli/test_terminate_all.py | 148 +++++++++
 python/tests/resoio/test_api_contract.py      |   1 +
 python/tests/resoio/test_launcher.py          | 287 ++++++++++++++++++
 9 files changed, 810 insertions(+), 23 deletions(-)
 create mode 100644 python/src/resoio/cli/terminate_all.py
 create mode 100644 python/tests/resoio/cli/test_terminate_all.py

diff --git a/python/src/resoio/__init__.py b/python/src/resoio/__init__.py
index 36957666..f47e3993 100644
--- a/python/src/resoio/__init__.py
+++ b/python/src/resoio/__init__.py
@@ -49,6 +49,7 @@
     LaunchResult,
     launch,
     terminate,
+    terminate_all,
 )
 from resoio.lifecycle import LifecycleClient, shutdown
 from resoio.locomotion import (
@@ -165,5 +166,6 @@
     "launch",
     "shutdown",
     "terminate",
+    "terminate_all",
     "wait_for_ready",
 ]
diff --git a/python/src/resoio/cli/__init__.py b/python/src/resoio/cli/__init__.py
index 60f368f6..edf45279 100644
--- a/python/src/resoio/cli/__init__.py
+++ b/python/src/resoio/cli/__init__.py
@@ -39,6 +39,7 @@
     session,
     shutdown,
     terminate,
+    terminate_all,
     wait,
     world,
 )
@@ -66,6 +67,7 @@
     launch,
     shutdown,
     terminate,
+    terminate_all,
 ]
 
 
diff --git a/python/src/resoio/cli/launch.py b/python/src/resoio/cli/launch.py
index 23bb5924..a91a5d64 100644
--- a/python/src/resoio/cli/launch.py
+++ b/python/src/resoio/cli/launch.py
@@ -64,6 +64,16 @@ def register(
             "path. Default: GE-Proton."
         ),
     )
+    parser.add_argument(
+        "--name",
+        default=None,
+        help=(
+            "Instance label for multi-launch. Allocates an isolated data tree "
+            "(WINEPREFIX + data/cache/logs) and a private camera queue under "
+            "~/.resonite-io/instances/<name>/, so several instances run side by "
+            "side without sharing data. Omit for the single-instance default."
+        ),
+    )
     parser.add_argument(
         "--data-path",
         default=None,
@@ -117,6 +127,7 @@ async def _run(args: argparse.Namespace) -> int:
             extra_args=args.args,
             prefix=args.prefix,
             proton_path=args.proton_path,
+            name=args.name,
             wait_timeout=args.timeout,
         )
     except LauncherError as exc:
diff --git a/python/src/resoio/cli/terminate_all.py b/python/src/resoio/cli/terminate_all.py
new file mode 100644
index 00000000..e5e61c32
--- /dev/null
+++ b/python/src/resoio/cli/terminate_all.py
@@ -0,0 +1,66 @@
+"""``resoio terminate-all`` subcommand: stop every running Resonite instance.
+
+The multi-instance counterpart to ``resoio terminate`` (which targets a single
+instance). Detects all engine + renderer processes for the configured install
+and stages ``SIGTERM`` -> ``SIGKILL`` on each, printing the engine/renderer pairs
+it signalled. Unlike the pid-only ``terminate``, this returns a *list* and so
+carries ``--format human|json`` for machine-readable output.
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import sys
+
+from resoio.cli import output
+
+
+def register(
+    subparsers: argparse._SubParsersAction[argparse.ArgumentParser],  # pyright: ignore[reportPrivateUsage]
+    common: argparse.ArgumentParser,
+) -> None:
+    """Register the ``terminate-all`` subparser on the top-level parser."""
+    parser = subparsers.add_parser(
+        "terminate-all",
+        parents=[common],
+        help="Stop every running Resonite instance (SIGTERM -> SIGKILL); lists pairs.",
+        description=(
+            "Force-stop all running Resonite clients by signalling each engine and "
+            "renderer process. The multi-instance counterpart to 'resoio terminate'. "
+            "Idempotent (already-dead PIDs are skipped). Prints one engine/renderer "
+            "pair per instance signalled, or 'no running Resonite instances found'."
+        ),
+    )
+    parser.add_argument(
+        "--timeout",
+        type=float,
+        default=3.0,
+        help="Seconds to wait after SIGTERM before SIGKILL, per PID (default: 3).",
+    )
+    output.add_format_argument(parser)
+    parser.set_defaults(func=_run)
+
+
+async def _run(args: argparse.Namespace) -> int:
+    # Defer the heavy import (psutil) to keep `resoio --help` fast.
+    from resoio.launcher import LauncherError, terminate_all
+
+    try:
+        results = await asyncio.to_thread(terminate_all, timeout=args.timeout)
+    except LauncherError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+
+    if output.is_structured(args.format):
+        # list[LaunchResult] -> [{"resonite_pid": .., "renderer_pid": ..}, ...].
+        output.emit(results, args.format)
+        return 0
+
+    if not results:
+        print("no running Resonite instances found")
+        return 0
+    for result in results:
+        print(f"resonite_pid={result.resonite_pid} renderer_pid={result.renderer_pid}")
+    print(f"terminated {len(results)} instance(s)")
+    return 0
diff --git a/python/src/resoio/launcher.py b/python/src/resoio/launcher.py
index 33c09b39..3faaf1df 100644
--- a/python/src/resoio/launcher.py
+++ b/python/src/resoio/launcher.py
@@ -35,11 +35,13 @@
 import enum
 import logging
 import os
+import re
+import secrets
 import shutil
 import subprocess
 import time
 from collections.abc import Callable, Sequence
-from dataclasses import dataclass, fields
+from dataclasses import dataclass, fields, replace
 from pathlib import Path
 from typing import cast
 
@@ -53,6 +55,7 @@
     "LauncherError",
     "launch",
     "terminate",
+    "terminate_all",
 ]
 
 _logger = logging.getLogger(__name__)
@@ -535,6 +538,7 @@ def _build_command(
     options: LaunchOptions | None = None,
     prefix: str | None = None,
     proton_path: str | None = None,
+    camera_queue: str | None = None,
 ) -> tuple[list[str], dict[str, str], str | None]:
     """Build the umu-run argv, environment, and log path.
 
@@ -572,6 +576,13 @@ def _build_command(
     # PROTONPATH は GE-Proton のような論理名も取るので abspath しない (WINEPREFIX のみ abspath)。
     if prefix is not None:
         env["WINEPREFIX"] = os.path.abspath(prefix)
+    # Per-instance Camera IPC queue token (multi-launch). The engine mod also
+    # self-generates one in its earliest load hook when this is unset, so single
+    # launches stay on the default queue; injecting it here keeps the token
+    # deterministic (label-derived) and lets the renderer child inherit the same
+    # value through the shared Wine session env.
+    if camera_queue is not None:
+        env["RESONITE_IO_CAMERA_QUEUE"] = camera_queue
     log_path: str | None = None
 
     if not vanilla:
@@ -618,23 +629,34 @@ def _build_command(
 # ---------------------------------------------------------------------------
 
 
-def _wait_for_single(
-    finder: Callable[[], list[int]], label: str, deadline: float, poll_interval: float
+def _wait_for_new(
+    finder: Callable[[], list[int]],
+    before: set[int],
+    label: str,
+    deadline: float,
+    poll_interval: float,
 ) -> int:
-    """Poll ``finder`` until it returns exactly one PID; return it.
+    """Poll until a PID not in ``before`` appears; return it.
 
-    Raises :class:`LauncherError` if more than one is ever seen (the
-    single-instance assumption is violated) or if none appears by ``deadline``.
+    The ``before`` set difference identifies the individual process *this* launch
+    spawned, so it works even when other instances of the same install are already
+    running (the argv0-based finders cannot tell two instances apart). For a
+    single launch with nothing else running, ``before`` is empty and this is
+    equivalent to "wait for exactly one". More than one new PID = an unexpected
+    concurrent launch, which is an error.
+
+    Raises :class:`LauncherError` if more than one new PID appears or if none
+    appears by ``deadline``.
     """
     while True:
-        pids = finder()
-        if len(pids) > 1:
+        new = [pid for pid in finder() if pid not in before]
+        if len(new) > 1:
             raise LauncherError(
-                f"multiple {label} processes detected ({pids}); expected exactly "
-                "one. Stop the extra Resonite instances and retry."
+                f"multiple new {label} processes appeared ({new}); "
+                "expected exactly one from this launch."
             )
-        if len(pids) == 1:
-            return pids[0]
+        if len(new) == 1:
+            return new[0]
         if time.monotonic() >= deadline:
             raise LauncherError(
                 f"timed out waiting for the Resonite {label} process to appear. "
@@ -644,6 +666,106 @@ def _wait_for_single(
         time.sleep(poll_interval)
 
 
+# ---------------------------------------------------------------------------
+# Instance isolation (multi-launch)
+# ---------------------------------------------------------------------------
+
+# Instance labels become directory names and a Camera-IPC queue token, so keep
+# them to a filesystem- and shell-safe charset and forbid path traversal.
+_INSTANCE_NAME_RE = re.compile(r"\A[A-Za-z0-9][A-Za-z0-9_-]*\Z")
+
+
+def _validate_instance_name(name: str) -> None:
+    """Reject instance names that are unsafe as a directory / queue token."""
+    if not _INSTANCE_NAME_RE.match(name):
+        raise LauncherError(
+            f"invalid instance name {name!r}: use only letters, digits, '-' and "
+            "'_' (and it must start with a letter or digit)."
+        )
+
+
+def _instances_base_dir() -> str:
+    """Base directory holding per-instance ``<label>/`` data trees.
+
+    ``RESONITE_IO_INSTANCES_DIR`` overrides the default ``~/.resonite-io/instances``.
+    The gRPC socket dir is separate (``~/.resonite-io/``, pid-named per engine).
+    """
+    return os.environ.get("RESONITE_IO_INSTANCES_DIR") or str(
+        Path.home() / ".resonite-io" / "instances"
+    )
+
+
+def _resolve_instance_paths(
+    name: str,
+    instance_dir: Path,
+    prefix: str | None,
+    options: LaunchOptions | None,
+) -> tuple[str, LaunchOptions, str]:
+    """Create the per-label data tree and fill any unset isolation path.
+
+    Lays out ``<instance_dir>/{prefix,data,cache,logs}`` and resolves each of the
+    WINEPREFIX / ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots with the
+    precedence **explicit caller value > label-auto > unset**. Returns the
+    effective WINEPREFIX, the (possibly updated) options, and a per-launch Camera
+    IPC queue token so each instance's renderer frames stay on a private queue.
+    """
+    subdirs = {sub: instance_dir / sub for sub in ("prefix", "data", "cache", "logs")}
+    for path in subdirs.values():
+        path.mkdir(parents=True, exist_ok=True)
+
+    effective_prefix = prefix if prefix is not None else str(subdirs["prefix"])
+    opts = options or LaunchOptions()
+    opts = replace(
+        opts,
+        data_path=opts.data_path
+        if opts.data_path is not None
+        else str(subdirs["data"]),
+        cache_path=(
+            opts.cache_path if opts.cache_path is not None else str(subdirs["cache"])
+        ),
+        logs_path=opts.logs_path
+        if opts.logs_path is not None
+        else str(subdirs["logs"]),
+    )
+    token = f"resonite-io-camera-{name}-{secrets.token_hex(4)}"
+    return effective_prefix, opts, token
+
+
+def _instance_lock_path(instance_dir: Path) -> Path:
+    return instance_dir / "launch.lock"
+
+
+def _reject_if_instance_running(instance_dir: Path, name: str) -> None:
+    """Raise if this label's engine (recorded in ``launch.lock``) is still
+    alive.
+
+    A stale lock (no file, unreadable, or a PID that is gone / belongs
+    to a non-engine process after PID reuse) is treated as free-to-
+    launch. This guards only the *same* label against a double launch;
+    different labels are independent and may run concurrently.
+    """
+    try:
+        recorded = int(_instance_lock_path(instance_dir).read_text().strip())
+    except (OSError, ValueError):
+        return
+    try:
+        proc = psutil.Process(recorded)
+    except psutil.NoSuchProcess:
+        return
+    if _argv0_endswith(proc, _ENGINE_ARGV0_SUFFIX):
+        raise LauncherError(
+            f"Resonite instance {name!r} is already running (engine pid "
+            f"{recorded}). Stop it with `resoio terminate` (or `resoio "
+            "terminate-all`) before relaunching this instance."
+        )
+
+
+def _write_instance_lock(instance_dir: Path, engine_pid: int) -> None:
+    """Record this label's engine PID so a later same-label launch can detect
+    it."""
+    _instance_lock_path(instance_dir).write_text(str(engine_pid))
+
+
 def launch(
     *,
     resonite_exe: str | None = None,
@@ -653,6 +775,7 @@ def launch(
     extra_args: Sequence[str] = (),
     prefix: str | None = None,
     proton_path: str | None = None,
+    name: str | None = None,
     wait_timeout: float = 60.0,
     poll_interval: float = 0.5,
 ) -> LaunchResult:
@@ -681,6 +804,17 @@ def launch(
         proton_path: Proton build (``PROTONPATH``) — a compat-tools name like
             ``GE-Proton`` or a path. ``None`` resolves it from ``PROTONPATH``,
             then ``GE-Proton``.
+        name: Instance label for **multi-launch**. When given, an isolated data
+            tree is allocated under ``RESONITE_IO_INSTANCES_DIR`` (default
+            ``~/.resonite-io/instances/<name>/``): the WINEPREFIX and the
+            ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots are auto-filled
+            from it (explicit ``prefix`` / ``options`` values still win), and a
+            per-instance Camera IPC queue token is injected so concurrent
+            instances do not share Resonite data or cross-talk on the camera
+            queue. Relaunching the *same* label while it is still running is
+            rejected. ``None`` keeps the legacy single-instance behaviour: shared
+            default paths and a guard that refuses to start if any engine is
+            already running.
         wait_timeout: Seconds to wait for both processes to appear.
         poll_interval: Seconds between process-table polls.
 
@@ -689,17 +823,30 @@ def launch(
 
     Raises:
         LauncherError: Resonite.exe / the mod / ``umu-run`` is missing, an
-            instance is already running, more than one engine/renderer is
-            detected, or a process did not appear before ``wait_timeout``.
+            instance is already running (the unnamed guard, or the same label),
+            more than one new engine/renderer appears from this launch, or a
+            process did not appear before ``wait_timeout``.
     """
     exe = _resolve_resonite_exe(resonite_exe)
     install_dir = os.path.dirname(os.path.realpath(exe))
 
-    already = _find_engine_pids(install_dir)
-    if already:
-        raise LauncherError(
-            f"Resonite is already running (engine pid(s) {already}). Stop it first "
-            "with `resoio terminate` before launching a new instance."
+    camera_queue: str | None = None
+    instance_dir: Path | None = None
+    if name is None:
+        # Legacy single-instance guard: refuse to start beside any running engine.
+        already = _find_engine_pids(install_dir)
+        if already:
+            raise LauncherError(
+                f"Resonite is already running (engine pid(s) {already}). Stop it "
+                "first with `resoio terminate`, or pass name=... / --name to launch "
+                "an isolated additional instance."
+            )
+    else:
+        _validate_instance_name(name)
+        instance_dir = Path(_instances_base_dir()) / name
+        _reject_if_instance_running(instance_dir, name)
+        prefix, options, camera_queue = _resolve_instance_paths(
+            name, instance_dir, prefix, options
         )
 
     argv, env, log_path = _build_command(
@@ -711,9 +858,16 @@ def launch(
         options=options,
         prefix=prefix,
         proton_path=proton_path,
+        camera_queue=camera_queue,
     )
     _logger.info("launching Resonite: %s (cwd=%s)", " ".join(argv), install_dir)
 
+    # Snapshot existing engine/renderer PIDs so _wait_for_new can pick out the
+    # ones this launch spawns by set difference (argv0 matching cannot tell two
+    # instances of the same install apart).
+    before_engines = set(_find_engine_pids(install_dir))
+    before_renderers = set(_find_renderer_pids(install_dir))
+
     # Detach fully: new session + closed stdio so the parent (CLI / caller) can
     # exit without signalling Resonite. PROTON_SET_GAME_DRIVE=0 (set in
     # _build_command) suppresses umu's game-drive mapping of $HOME onto a Wine
@@ -739,12 +893,22 @@ def launch(
             log_handle.close()
 
     deadline = time.monotonic() + wait_timeout
-    resonite_pid = _wait_for_single(
-        lambda: _find_engine_pids(install_dir), "engine", deadline, poll_interval
+    resonite_pid = _wait_for_new(
+        lambda: _find_engine_pids(install_dir),
+        before_engines,
+        "engine",
+        deadline,
+        poll_interval,
     )
-    renderer_pid = _wait_for_single(
-        lambda: _find_renderer_pids(install_dir), "renderer", deadline, poll_interval
+    renderer_pid = _wait_for_new(
+        lambda: _find_renderer_pids(install_dir),
+        before_renderers,
+        "renderer",
+        deadline,
+        poll_interval,
     )
+    if instance_dir is not None:
+        _write_instance_lock(instance_dir, resonite_pid)
     _logger.info(
         "Resonite launched: resonite_pid=%d renderer_pid=%d", resonite_pid, renderer_pid
     )
@@ -834,3 +998,69 @@ def terminate(
         else 0
     )
     return LaunchResult(resonite_pid=killed_engine, renderer_pid=killed_renderer)
+
+
+def _engine_child_renderer(engine_pid: int, renderer_pids: set[int]) -> int | None:
+    """The renderer host PID parented under ``engine_pid``, if any.
+
+    Resonite's engine spawns the renderer (``RenderSystem.StartRenderer`` →
+    ``Process.Start``), so the renderer usually appears somewhere in the engine's
+    host process subtree. Used only to *group* a kill into engine/renderer pairs;
+    grouping is best-effort and never affects which processes get killed.
+    """
+    try:
+        children = psutil.Process(engine_pid).children(recursive=True)
+    except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+        return None
+    for child in children:
+        if child.pid in renderer_pids:
+            return child.pid
+    return None
+
+
+def terminate_all(*, timeout: float = 3.0) -> list[LaunchResult]:
+    """Stop **every** running Resonite instance and return the pairs signalled.
+
+    Unlike :func:`terminate` (a single instance), this detects all engine and
+    renderer processes for the configured install and stages ``SIGTERM`` →
+    ``SIGKILL`` on each. Engines are grouped with their child renderer where the
+    process tree makes that visible; any renderer without a matching engine is
+    still killed and reported on its own (``resonite_pid=0``). Idempotent: PIDs
+    already gone are skipped and excluded from the result.
+
+    Args:
+        timeout: Seconds to wait after ``SIGTERM`` before ``SIGKILL`` (per PID).
+
+    Returns:
+        One :class:`LaunchResult` per instance actually signalled, in detection
+        order; an empty list means nothing was running.
+
+    Raises:
+        LauncherError: a detected PID is alive but is no longer the expected
+            Resonite process (a reused PID).
+    """
+    install_dir = _install_dir_for_detection()
+    renderers = set(_find_renderer_pids(install_dir))
+    paired: set[int] = set()
+    results: list[LaunchResult] = []
+
+    for engine_pid in _find_engine_pids(install_dir):
+        child = _engine_child_renderer(engine_pid, renderers)
+        killed_engine = _kill_pid(engine_pid, _ENGINE_ARGV0_SUFFIX, "engine", timeout)
+        killed_renderer = 0
+        if child is not None:
+            paired.add(child)
+            killed_renderer = _kill_pid(
+                child, _RENDERER_ARGV0_SUFFIX, "renderer", timeout
+            )
+        if killed_engine or killed_renderer:
+            results.append(
+                LaunchResult(resonite_pid=killed_engine, renderer_pid=killed_renderer)
+            )
+
+    for renderer_pid in sorted(renderers - paired):
+        killed = _kill_pid(renderer_pid, _RENDERER_ARGV0_SUFFIX, "renderer", timeout)
+        if killed:
+            results.append(LaunchResult(resonite_pid=0, renderer_pid=killed))
+
+    return results
diff --git a/python/tests/resoio/cli/test_launch.py b/python/tests/resoio/cli/test_launch.py
index 088af3d2..ba4cf3bd 100644
--- a/python/tests/resoio/cli/test_launch.py
+++ b/python/tests/resoio/cli/test_launch.py
@@ -180,3 +180,43 @@ def _fake_launch(**kwargs: object):
 
     assert rc == 0
     assert captured["options"] == LaunchOptions()
+
+
+async def test_launch_forwards_name(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+):
+    # --name on the CLI must reach launch() as name= so the launcher allocates an
+    # isolated per-instance data tree.
+    captured: dict[str, object] = {}
+
+    def _fake_launch(**kwargs: object):
+        captured.update(kwargs)
+        from resoio.launcher import LaunchResult
+
+        return LaunchResult(resonite_pid=11, renderer_pid=22)
+
+    monkeypatch.setattr("resoio.launcher.launch", _fake_launch)
+    args = _build_parser().parse_args(["launch", "--vanilla", "--name", "agent1"])
+    rc = await _amain(args)
+
+    assert rc == 0
+    assert captured["name"] == "agent1"
+
+
+async def test_launch_passes_none_name_when_unset(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+):
+    # Without --name, launch() receives name=None (single-instance default).
+    captured: dict[str, object] = {}
+
+    def _fake_launch(**kwargs: object):
+        captured.update(kwargs)
+        from resoio.launcher import LaunchResult
+
+        return LaunchResult(resonite_pid=11, renderer_pid=22)
+
+    monkeypatch.setattr("resoio.launcher.launch", _fake_launch)
+    rc = await _amain(_build_parser().parse_args(["launch", "--vanilla"]))
+
+    assert rc == 0
+    assert captured["name"] is None
diff --git a/python/tests/resoio/cli/test_terminate_all.py b/python/tests/resoio/cli/test_terminate_all.py
new file mode 100644
index 00000000..4ee9ec33
--- /dev/null
+++ b/python/tests/resoio/cli/test_terminate_all.py
@@ -0,0 +1,148 @@
+"""Tests for the ``resoio terminate-all`` CLI command (multi-instance kill).
+
+``terminate-all`` force-stops every running Resonite instance. Per
+testing-strategy we drive the real CLI dispatch (``_build_parser`` -> ``_amain``)
+against **real dummy processes** (copies of ``sleep`` at the install-relative
+argv[0] paths the launcher matches), not mocks. The kill logic itself is covered
+in ``test_launcher.py``; here we pin the CLI contract: the human summary, the
+``--format json`` document shape, and the empty-state message.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import time
+from collections.abc import Callable, Iterator
+from pathlib import Path
+
+import pytest
+
+from resoio.cli import _amain, _build_parser
+from resoio.launcher import _find_engine_pids, _find_renderer_pids
+
+_SLEEP = shutil.which("sleep") or "/bin/sleep"
+
+
+def _make_install(tmp_path: Path) -> Path:
+    install = tmp_path / "resonite"
+    (install / "dotnet-runtime").mkdir(parents=True)
+    shutil.copy(_SLEEP, install / "dotnet-runtime" / "dotnet")
+    (install / "dotnet-runtime" / "dotnet").chmod(0o755)
+    (install / "Renderer").mkdir(parents=True)
+    shutil.copy(_SLEEP, install / "Renderer" / "Renderite.Renderer.exe")
+    (install / "Renderer" / "Renderite.Renderer.exe").chmod(0o755)
+    (install / "Resonite.exe").write_text("")
+    return install
+
+
+@pytest.fixture
+def spawn() -> Iterator[Callable[..., int]]:
+    procs: list[subprocess.Popen[bytes]] = []
+
+    def _spawn(path: Path, *args: str) -> int:
+        proc = subprocess.Popen(
+            [str(path), *args], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+        )
+        procs.append(proc)
+        return proc.pid
+
+    yield _spawn
+
+    for proc in procs:
+        if proc.poll() is None:
+            proc.kill()
+        try:
+            proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            pass
+
+
+def _wait_count(finder: Callable[[], list[int]], count: int, timeout: float = 5.0):
+    deadline = time.monotonic() + timeout
+    while len(finder()) != count and time.monotonic() < deadline:
+        time.sleep(0.02)
+
+
+async def test_terminate_all_human_summarises_killed_instances(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    spawn: Callable[..., int],
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_count(lambda: _find_engine_pids(str(install)), 2)
+    _wait_count(lambda: _find_renderer_pids(str(install)), 2)
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all"]))
+
+    assert rc == 0
+    out = capsys.readouterr().out
+    assert "terminated" in out
+    assert "instance" in out
+    _wait_count(lambda: _find_engine_pids(str(install)), 0)
+    assert _find_engine_pids(str(install)) == []
+    assert _find_renderer_pids(str(install)) == []
+
+
+async def test_terminate_all_json_emits_pair_list(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    spawn: Callable[..., int],
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_count(lambda: _find_engine_pids(str(install)), 1)
+    _wait_count(lambda: _find_renderer_pids(str(install)), 1)
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all", "--format", "json"]))
+
+    assert rc == 0
+    payload = json.loads(capsys.readouterr().out)
+    assert isinstance(payload, list)
+    # Every entry has the engine/renderer pair keys, and across the list every
+    # signalled PID is a positive int.
+    signalled: set[int] = set()
+    for entry in payload:
+        assert set(entry) == {"resonite_pid", "renderer_pid"}
+        signalled |= {entry["resonite_pid"], entry["renderer_pid"]}
+    signalled.discard(0)
+    assert all(pid > 0 for pid in signalled)
+    assert signalled  # at least one process was reported
+
+
+async def test_terminate_all_reports_nothing_when_absent(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all"]))
+
+    assert rc == 0
+    assert "no running Resonite instances found" in capsys.readouterr().out
+
+
+async def test_terminate_all_empty_json_is_empty_list(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+):
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+
+    rc = await _amain(_build_parser().parse_args(["terminate-all", "--format", "json"]))
+
+    assert rc == 0
+    assert json.loads(capsys.readouterr().out) == []
diff --git a/python/tests/resoio/test_api_contract.py b/python/tests/resoio/test_api_contract.py
index ea958105..a92a2cc6 100644
--- a/python/tests/resoio/test_api_contract.py
+++ b/python/tests/resoio/test_api_contract.py
@@ -118,6 +118,7 @@
     "launch",
     "shutdown",
     "terminate",
+    "terminate_all",
     "wait_for_ready",
 )
 
diff --git a/python/tests/resoio/test_launcher.py b/python/tests/resoio/test_launcher.py
index f89288f3..3b06ed5c 100644
--- a/python/tests/resoio/test_launcher.py
+++ b/python/tests/resoio/test_launcher.py
@@ -13,6 +13,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import dataclasses
 import os
 import shutil
@@ -34,10 +35,17 @@
     _build_command,
     _find_engine_pids,
     _find_renderer_pids,
+    _instance_lock_path,
+    _reject_if_instance_running,
+    _resolve_instance_paths,
     _resolve_mod_path,
     _resolve_resonite_exe,
+    _validate_instance_name,
+    _wait_for_new,
+    _write_instance_lock,
     launch,
     terminate,
+    terminate_all,
 )
 
 _SLEEP = shutil.which("sleep") or "/bin/sleep"
@@ -754,3 +762,282 @@ def test_launch_refuses_when_already_running(tmp_path: Path, spawn: Callable[...
     # The already-running guard fires before umu/mod resolution, so vanilla is fine.
     with pytest.raises(LauncherError, match="already running"):
         launch(resonite_exe=str(install / "Resonite.exe"), vanilla=True)
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: _wait_for_new (PID set-difference)
+# ---------------------------------------------------------------------------
+
+
+def test_wait_for_new_returns_pid_absent_from_before(
+    tmp_path: Path, spawn: Callable[..., int]
+):
+    # An engine PID already present in `before` is ignored; only the PID spawned
+    # afterwards (the one this launch created) is returned.
+    install = _make_install(tmp_path)
+    existing = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    before = {existing}
+
+    fresh = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+
+    deadline = time.monotonic() + 5.0
+    new_pid = _wait_for_new(
+        lambda: _find_engine_pids(str(install)),
+        before,
+        "engine",
+        deadline,
+        0.02,
+    )
+
+    assert new_pid == fresh
+
+
+def test_wait_for_new_raises_when_multiple_new_appear(
+    tmp_path: Path, spawn: Callable[..., int]
+):
+    # Two engines not in `before` means an unexpected concurrent launch; the
+    # set-difference can no longer pick a single owner, so it errors.
+    install = _make_install(tmp_path)
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+
+    deadline = time.monotonic() + 5.0
+    with pytest.raises(LauncherError, match="multiple new"):
+        _wait_for_new(
+            lambda: _find_engine_pids(str(install)),
+            set(),
+            "engine",
+            deadline,
+            0.02,
+        )
+
+
+def test_wait_for_new_times_out_when_no_new_appears(tmp_path: Path):
+    # No new engine ever appears; once the deadline passes the wait gives up with
+    # a timeout error rather than blocking forever.
+    install = _make_install(tmp_path)
+    deadline = time.monotonic() - 1.0  # already expired
+
+    with pytest.raises(LauncherError, match="timed out"):
+        _wait_for_new(
+            lambda: _find_engine_pids(str(install)),
+            set(),
+            "engine",
+            deadline,
+            0.02,
+        )
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: label validation / path isolation / queue token
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("name", ["a", "agent1", "agent-1", "A_b-2", "0"])
+def test_validate_instance_name_accepts_safe(name: str):
+    _validate_instance_name(name)  # does not raise
+
+
+@pytest.mark.parametrize(
+    "name", ["", "-leading", "../escape", "a/b", "a..b", "a b", "a.b", "héllo"]
+)
+def test_validate_instance_name_rejects_unsafe(name: str):
+    with pytest.raises(LauncherError, match="invalid instance name"):
+        _validate_instance_name(name)
+
+
+def test_resolve_instance_paths_allocates_label_dirs(tmp_path: Path):
+    # With nothing explicit, the four isolation dirs are created under the label
+    # and wired into prefix + options; the token is label-derived and unique.
+    instance_dir = tmp_path / "instances" / "a"
+    prefix, opts, token = _resolve_instance_paths("a", instance_dir, None, None)
+
+    assert prefix == str(instance_dir / "prefix")
+    assert opts.data_path == str(instance_dir / "data")
+    assert opts.cache_path == str(instance_dir / "cache")
+    assert opts.logs_path == str(instance_dir / "logs")
+    for sub in ("prefix", "data", "cache", "logs"):
+        assert (instance_dir / sub).is_dir()
+    assert token.startswith("resonite-io-camera-a-")
+    # A second allocation yields a different token (private queue per launch).
+    _, _, token2 = _resolve_instance_paths("a", instance_dir, None, None)
+    assert token2 != token
+
+
+def test_resolve_instance_paths_respects_explicit_paths(tmp_path: Path):
+    # Explicit caller values win over the label-auto defaults (explicit > auto).
+    instance_dir = tmp_path / "instances" / "a"
+    explicit_opts = LaunchOptions(data_path="/custom/data")
+    prefix, opts, _ = _resolve_instance_paths(
+        "a", instance_dir, "/custom/prefix", explicit_opts
+    )
+
+    assert prefix == "/custom/prefix"
+    assert opts.data_path == "/custom/data"
+    # The unset cache/logs still fall back to the label dirs.
+    assert opts.cache_path == str(instance_dir / "cache")
+    assert opts.logs_path == str(instance_dir / "logs")
+
+
+def test_build_command_injects_camera_queue_env(tmp_path: Path, fake_umu: Path):
+    install = _make_install(tmp_path)
+    _, env_with, _ = _build_command(
+        str(install / "Resonite.exe"),
+        str(install),
+        None,
+        True,
+        (),
+        camera_queue="resonite-io-camera-a-deadbeef",
+    )
+    assert env_with["RESONITE_IO_CAMERA_QUEUE"] == "resonite-io-camera-a-deadbeef"
+
+    _, env_without, _ = _build_command(
+        str(install / "Resonite.exe"), str(install), None, True, ()
+    )
+    assert "RESONITE_IO_CAMERA_QUEUE" not in env_without
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: per-label lock guard
+# ---------------------------------------------------------------------------
+
+
+def test_reject_if_instance_running_raises_for_live_engine(
+    tmp_path: Path, spawn: Callable[..., int]
+):
+    install = _make_install(tmp_path)
+    instance_dir = tmp_path / "instances" / "a"
+    instance_dir.mkdir(parents=True)
+    engine_pid = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _write_instance_lock(instance_dir, engine_pid)
+
+    with pytest.raises(LauncherError, match="instance 'a' is already running"):
+        _reject_if_instance_running(instance_dir, "a")
+
+
+def test_reject_if_instance_running_ignores_stale_lock(tmp_path: Path):
+    # A lock pointing at a dead PID (or no lock at all) is free-to-launch.
+    instance_dir = tmp_path / "instances" / "a"
+    instance_dir.mkdir(parents=True)
+    _reject_if_instance_running(instance_dir, "a")  # no lock file -> no raise
+
+    # A PID that does not exist -> treated as stale.
+    _instance_lock_path(instance_dir).write_text("2147480000")
+    _reject_if_instance_running(instance_dir, "a")  # does not raise
+
+
+def test_launch_named_rejects_relaunch_of_same_label(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # A live lock for label "a" makes launch(name="a") refuse before spawning.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+    instance_dir = tmp_path / "instances" / "a"
+    instance_dir.mkdir(parents=True)
+    engine_pid = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _write_instance_lock(instance_dir, engine_pid)
+
+    with pytest.raises(LauncherError, match="instance 'a' is already running"):
+        launch(resonite_exe=str(install / "Resonite.exe"), vanilla=True, name="a")
+
+
+def test_launch_named_bypasses_global_guard_and_writes_lock(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # End-to-end multi-instance contract: even with one instance already running,
+    # a *named* launch must NOT raise "already running" (the global guard is for
+    # unnamed launches only). It allocates the label data tree, returns the new
+    # engine/renderer pair, and records the engine PID in the label lock.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+
+    existing_engine = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_renderer = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
+
+    engine_path = install / "dotnet-runtime" / "dotnet"
+    renderer_path = install / "Renderer" / "Renderite.Renderer.exe"
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    umu = bindir / "umu-run"
+    umu.write_text(
+        "#!/bin/sh\n"
+        f"setsid '{engine_path}' 60 </dev/null >/dev/null 2>&1 &\n"
+        f"setsid '{renderer_path}' 60 </dev/null >/dev/null 2>&1 &\n"
+        "exit 0\n"
+    )
+    umu.chmod(0o755)
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        result = launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            name="b",
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+
+        assert result.resonite_pid != existing_engine
+        assert result.renderer_pid != existing_renderer
+        # The label data tree was allocated and the lock records the new engine.
+        instance_dir = tmp_path / "instances" / "b"
+        for sub in ("prefix", "data", "cache", "logs"):
+            assert (instance_dir / sub).is_dir()
+        assert _instance_lock_path(instance_dir).read_text().strip() == str(
+            result.resonite_pid
+        )
+    finally:
+        for pid in (
+            set(_find_engine_pids(str(install)))
+            | set(_find_renderer_pids(str(install)))
+        ) - {existing_engine, existing_renderer}:
+            with contextlib.suppress(psutil.NoSuchProcess):
+                psutil.Process(pid).kill()
+
+
+# ---------------------------------------------------------------------------
+# Multi-instance: terminate_all
+# ---------------------------------------------------------------------------
+
+
+def test_terminate_all_kills_every_running_instance(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # terminate_all stops every running engine/renderer (not just a single
+    # instance) and reports each PID it signalled across the returned pairs.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    engine_a = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    engine_b = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    renderer_a = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    renderer_b = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 2)
+
+    killed = terminate_all(timeout=3.0)
+
+    signalled = {r.resonite_pid for r in killed} | {r.renderer_pid for r in killed}
+    signalled.discard(0)
+    assert signalled == {engine_a, engine_b, renderer_a, renderer_b}
+    assert _wait_pids(lambda: _find_engine_pids(str(install)), 0) == []
+    assert _wait_pids(lambda: _find_renderer_pids(str(install)), 0) == []
+
+
+def test_terminate_all_returns_empty_when_nothing_running(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    # With no instance running, terminate_all is a no-op that reports an empty
+    # list rather than erroring.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+
+    assert terminate_all(timeout=3.0) == []

From 95015f518e2ba98e51f85e0d0c92565a89d669a0 Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:42:47 +0000
Subject: [PATCH 3/7] =?UTF-8?q?test(python):=20=E5=A4=9A=E9=87=8D=E8=B5=B7?=
 =?UTF-8?q?=E5=8B=95=E3=81=AE=20e2e=20=E3=82=B7=E3=83=8A=E3=83=AA=E3=82=AA?=
 =?UTF-8?q?=E3=82=92=E8=BF=BD=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

real な 2 インスタンス (--name a / --name b) を別 WINEPREFIX/DataPath で起動し、
各 engine の resonite-{pid}.sock へ個別接続して ping + Camera screenshot を撮り、
両方がフレームを返す (Camera queue がクロストークしない) ことを検証。最後に
terminate-all で全インスタンスが host から消えることを確認する @mark_e2e シナリオ。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 python/tests/e2e/multi_instance.py | 129 +++++++++++++++++++++++++++++
 1 file changed, 129 insertions(+)
 create mode 100644 python/tests/e2e/multi_instance.py

diff --git a/python/tests/e2e/multi_instance.py b/python/tests/e2e/multi_instance.py
new file mode 100644
index 00000000..18960155
--- /dev/null
+++ b/python/tests/e2e/multi_instance.py
@@ -0,0 +1,129 @@
+"""E2E: run two real Resonite instances side by side without interference.
+
+The multi-instance contract end-to-end. Launches two labelled instances
+(``--name a`` / ``--name b``), each getting its own WINEPREFIX + DataPath and a
+private Camera IPC queue token, then proves they are independent:
+
+* both engines come up as distinct host processes with distinct UDS sockets;
+* a ``Connection.Ping`` reaches each instance on its own socket;
+* both instances deliver a Camera frame — if the renderer IPC queues had
+  collided (the old fixed queue name), one engine would starve or receive the
+  other's frames, so two successful independent shots is the cross-talk guard;
+* ``terminate_all`` then stops every instance and the host process table drains.
+
+Like ``tests/e2e/launcher.py`` this manages Resonite's lifecycle itself (the
+feature under test), so it does **not** use the ``resonite_session`` fixture.
+Each labelled instance bootstraps a *fresh* WINEPREFIX (first-run Proton setup),
+so the two launches are serialised and given a generous timeout; this scenario is
+opt-in (``@mark_e2e``) and intentionally heavy.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import glob
+import time
+from datetime import datetime
+from pathlib import Path
+
+import numpy as np
+import psutil
+from PIL import Image
+
+from resoio import launch, terminate_all
+from resoio._client import socket_path_for_pid
+from tests.helpers import mark_e2e
+
+ARTIFACT_ROOT = Path(__file__).parent / "e2e_artifacts"
+SOCKET_DIR = Path.home() / ".resonite-io"
+
+_LAUNCH_TIMEOUT_S = 240.0
+_SOCKET_APPEAR_TIMEOUT_S = 120.0
+_KILL_TIMEOUT_S = 30.0
+_POLL_S = 1.0
+
+
+def _wait_for_pid_socket(pid: int, timeout_s: float) -> Path | None:
+    """Wait for the engine ``pid``'s conventional ``resonite-{pid}.sock``."""
+    target = Path(socket_path_for_pid(pid))
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if target.exists():
+            return target
+        time.sleep(_POLL_S)
+    return None
+
+
+async def _ping_and_shot(socket_path: Path, out_path: Path) -> np.ndarray:
+    """Ping an instance on its own socket and capture one Camera frame from
+    it."""
+    from resoio import CameraClient, ConnectionClient
+
+    async with ConnectionClient(socket_path=str(socket_path)) as conn:
+        await conn.ping("multi-instance")
+    async with CameraClient(socket_path=str(socket_path)) as cam:
+        frame = await cam.shot()
+    rgb = np.ascontiguousarray(frame.pixels[..., :3])
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    Image.fromarray(rgb, mode="RGB").save(out_path)
+    return rgb
+
+
+class TestMultiInstance:
+    @mark_e2e
+    def test_two_named_instances_run_isolated_then_terminate_all(self) -> None:
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        out_dir = ARTIFACT_ROOT / f"multi_{timestamp}"
+
+        # Clean slate: stop anything left over and drop stale sockets.
+        terminate_all()
+        for sock in glob.glob(str(SOCKET_DIR / "resonite-*.sock")):
+            Path(sock).unlink(missing_ok=True)
+
+        # Serialise the two launches: each label bootstraps its own fresh
+        # WINEPREFIX, and concurrent first-run Proton setup can race.
+        a = launch(name="a", wait_timeout=_LAUNCH_TIMEOUT_S)
+        try:
+            b = launch(name="b", wait_timeout=_LAUNCH_TIMEOUT_S)
+        except Exception:
+            terminate_all()
+            raise
+
+        try:
+            print(f"a: engine={a.resonite_pid} renderer={a.renderer_pid}")
+            print(f"b: engine={b.resonite_pid} renderer={b.renderer_pid}")
+
+            # Four distinct host processes (no PID shared between the instances).
+            pids = {a.resonite_pid, a.renderer_pid, b.resonite_pid, b.renderer_pid}
+            assert len(pids) == 4, f"expected 4 distinct PIDs, got {pids}"
+            assert all(psutil.pid_exists(p) for p in pids)
+
+            # Each engine bound its own pid-named UDS.
+            sock_a = _wait_for_pid_socket(a.resonite_pid, _SOCKET_APPEAR_TIMEOUT_S)
+            sock_b = _wait_for_pid_socket(b.resonite_pid, _SOCKET_APPEAR_TIMEOUT_S)
+            assert sock_a is not None, "instance a never bound its UDS"
+            assert sock_b is not None, "instance b never bound its UDS"
+            assert sock_a != sock_b
+
+            # Both instances independently answer a ping and deliver a Camera
+            # frame on their own socket. Two successful shots = the renderer
+            # queues did not collide (the core multi-instance guarantee).
+            frame_a = asyncio.run(_ping_and_shot(sock_a, out_dir / "instance_a.png"))
+            frame_b = asyncio.run(_ping_and_shot(sock_b, out_dir / "instance_b.png"))
+            assert frame_a.shape[2] == 3
+            assert frame_b.shape[2] == 3
+            assert frame_a.size > 0 and frame_b.size > 0
+        finally:
+            results = terminate_all()
+            print(f"terminate_all killed {len(results)} instance(s)")
+
+        # The host process table drains: every instance is gone.
+        deadline = time.monotonic() + _KILL_TIMEOUT_S
+        while time.monotonic() < deadline:
+            if not any(psutil.pid_exists(p) for p in pids):
+                break
+            time.sleep(_POLL_S)
+        assert not any(psutil.pid_exists(p) for p in pids)
+
+        # Idempotent: a second sweep finds nothing.
+        assert terminate_all() == []

From 44c6be4c165659ac90503bae309fc314bc6fb43e Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:42:56 +0000
Subject: [PATCH 4/7] =?UTF-8?q?docs:=20=E5=A4=9A=E9=87=8D=E8=B5=B7?=
 =?UTF-8?q?=E5=8B=95=20(--name)=20=E3=81=A8=20terminate-all=20=E3=82=92?=
 =?UTF-8?q?=E5=8F=8D=E6=98=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docs/cli.md の launch/terminate 節と例に --name によるインスタンス分離、別 socket
ターゲティング、terminate-all を追記。CHANGELOG の Added に多重起動と terminate-all
を再掲。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md | 13 +++++++++++++
 docs/cli.md  | 30 ++++++++++++++++++++++--------
 2 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e935691c..28002438 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,19 @@ GitHub Release body. The format follows
 
 ### ✨ Added
 
+- **`resoio launch --name <label>` runs multiple isolated instances**: pass a
+  label to start a second Resonite client beside a running one. Each label gets
+  its own data tree under `~/.resonite-io/instances/<label>/` — a separate
+  WINEPREFIX, `-DataPath` / `-CachePath` / `-LogsPath`, and a private Camera IPC
+  queue token (so concurrent instances neither share Resonite data nor cross-talk
+  on the renderer frame queue). Explicit `--prefix` / `--data-path` still win over
+  the label defaults; relaunching the same label while it runs is refused.
+  Without `--name`, `launch` keeps the single-instance guard. Target a specific
+  instance with `--socket ~/.resonite-io/resonite-{pid}.sock`.
+- **`resoio terminate-all`**: stop every running Resonite instance in one call
+  (`SIGTERM` → `SIGKILL` per process), printing one engine/renderer pair per
+  instance (`--format human|json`). The multi-instance counterpart to the
+  single-instance `terminate` (whose pid-only output is unchanged).
 - **Typed Resonite launch options (`resoio.LaunchOptions`)**: pass Resonite's
   own command-line launch arguments to `launch(options=...)` as a typed,
   immutable value object — `data_path` (`-DataPath`), `cache_path` (`-CachePath`),
diff --git a/docs/cli.md b/docs/cli.md
index f4a93940..90dbb1a0 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -29,18 +29,26 @@ resoio --help
 | `resoio contact` | Contact | unary | Browse and manage contacts (friends) via nested subcommands: `list` (`--search` / `--filter all\|accepted\|requests` / `--include-hidden`), `get`, `search` (`--exact`), `add` (`--username`), `accept`, `remove`. `list` hides dash-hidden (ignored / blocked) contacts by default; `--include-hidden` shows them. The mutating ops (`add` / `accept` / `remove`) write the real cloud contact list. |
 | `resoio auth` | Auth | unary | Resonite cloud sign-in via nested subcommands: `login` (credential positional; password via env/stdin/prompt, never a flag), `logout`, `status`. |
 | `resoio cursor` | Cursor | unary | Set / center / get / release the desktop cursor. `set` and `center` hold the position until `release`. |
-| `resoio launch` | — (umu-launcher) | local process | Start Resonite (engine + renderer) via umu-launcher and print both host PIDs. `-e/--exe` / `RESONITE_EXE` and `-p/--profile` / `MOD_PATH` select the install + mod profile; `--vanilla` skips the mod. `--prefix` (`WINEPREFIX`) and `--proton-path` (`PROTONPATH`, default `GE-Proton`) pick the Wine prefix and Proton build. `--data-path` / `--cache-path` / `--logs-path` relocate Resonite's database / cache / logs; any other Resonite launch option goes after `--` (e.g. `-- -Screen -Verbose`). Non-gRPC. |
-| `resoio terminate` | — (signals) | local process | Force-stop Resonite by killing the engine + renderer (`SIGTERM` → `SIGKILL`). Takes `[resonite_pid] [renderer_pid]` (from `launch`) or auto-detects the single running instance. Non-gRPC. |
+| `resoio launch` | — (umu-launcher) | local process | Start Resonite (engine + renderer) via umu-launcher and print both host PIDs. `-e/--exe` / `RESONITE_EXE` and `-p/--profile` / `MOD_PATH` select the install + mod profile; `--vanilla` skips the mod. `--prefix` (`WINEPREFIX`) and `--proton-path` (`PROTONPATH`, default `GE-Proton`) pick the Wine prefix and Proton build. `--data-path` / `--cache-path` / `--logs-path` relocate Resonite's database / cache / logs; any other Resonite launch option goes after `--` (e.g. `-- -Screen -Verbose`). `--name <label>` runs a **second instance** isolated under `~/.resonite-io/instances/<label>/` (own WINEPREFIX + data + Camera queue). Non-gRPC. |
+| `resoio terminate` | — (signals) | local process | Force-stop a single Resonite instance by killing the engine + renderer (`SIGTERM` → `SIGKILL`). Takes `[resonite_pid] [renderer_pid]` (from `launch`) or auto-detects the single running instance. Non-gRPC. |
+| `resoio terminate-all` | — (signals) | local process | Force-stop **every** running Resonite instance (`SIGTERM` → `SIGKILL` per process); prints one engine/renderer pair per instance (`--format human\|json`). The multi-instance counterpart to `terminate`. Non-gRPC. |
 | `resoio shutdown` | Lifecycle | unary | Ask the engine to quit gracefully (`Lifecycle.Shutdown`). Best-effort — on Linux the engine often hangs during teardown and never exits, so follow up with `terminate` when you need a guaranteed stop. Prints the engine's host PID (from `Info`). |
 
 `record` is the Resonite → Python capture command (it pulls Camera and Speaker), while `mic`
 is its independent Python → Resonite counterpart.
 
-`launch` / `terminate` are **local process control** (no gRPC). `launch` spawns the
-umu-launcher chain and waits until the **engine** (`resonite_pid`) and **renderer**
-(`renderer_pid`) host processes appear, printing both; it refuses to start a second instance.
-`terminate` signals those two PIDs (`SIGTERM` → `SIGKILL`); given no PIDs it auto-detects the
-single running instance (and errors if it finds more than one). Because they work from the host
+`launch` / `terminate` / `terminate-all` are **local process control** (no gRPC). `launch` spawns
+the umu-launcher chain and waits until the **engine** (`resonite_pid`) and **renderer**
+(`renderer_pid`) host processes appear, printing both. Without `--name` it is single-instance:
+it refuses to start beside a running engine. Pass `--name <label>` to run **several instances
+side by side** — each label gets an isolated data tree under `~/.resonite-io/instances/<label>/`
+(its own WINEPREFIX, `-DataPath` / `-CachePath` / `-LogsPath`, and a private Camera IPC queue so
+the instances never share data or cross-talk on the renderer queue); relaunching the same label
+while it runs is refused. Each engine binds its own `resonite-{pid}.sock`, so target a specific
+instance with `--socket ~/.resonite-io/resonite-{pid}.sock` (or `RESONITE_IO_SOCKET`).
+`terminate` signals one instance's two PIDs (`SIGTERM` → `SIGKILL`); given no PIDs it auto-detects
+the single running instance (and errors if it finds more than one — use explicit PIDs or
+`terminate-all`). `terminate-all` stops every instance at once. Because they work from the host
 process table they run before the UDS exists and regardless of whether the client is reachable.
 `shutdown`, by contrast, is a pure gRPC call (`Lifecycle.Shutdown`) that asks a **running**
 engine to quit gracefully — use it when the client is up and reachable. It is best-effort,
@@ -182,9 +190,15 @@ resoio launch --format json     # {"resonite_pid": ..., "renderer_pid": ...}
 # Pick a specific Wine prefix and Proton build
 resoio launch --prefix ~/prefixes/resonite --proton-path GE-Proton
 
-# Stop it — by the PIDs from launch, or auto-detect the running instance
+# Run two isolated instances side by side, then talk to a specific one by socket
+resoio launch --name a            # {"resonite_pid": 12345, ...}
+resoio launch --name b            # {"resonite_pid": 23456, ...}
+resoio --socket ~/.resonite-io/resonite-12345.sock ping
+
+# Stop it — by the PIDs from launch, auto-detect the single instance, or stop every instance
 resoio terminate 12345 12399
 resoio terminate
+resoio terminate-all --format json   # [{"resonite_pid": ..., "renderer_pid": ...}, ...]
 
 # ... or ask a running engine to quit gracefully over gRPC (prints the engine host PID)
 resoio shutdown

From b6215f0e25237b32fb83449c595f76cf0b7611c9 Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 11:27:02 +0000
Subject: [PATCH 5/7] =?UTF-8?q?fix(python/launcher):=20=E5=A4=9A=E9=87=8D?=
 =?UTF-8?q?=E8=B5=B7=E5=8B=95=E3=82=AC=E3=83=BC=E3=83=89=E3=82=92=E5=85=A8?=
 =?UTF-8?q?=E5=BB=83=E3=81=97=20--name=20=E3=82=92=E7=B4=94=E7=B2=8B?=
 =?UTF-8?q?=E3=81=AA=E4=BE=BF=E5=AE=9C=E6=A9=9F=E8=83=BD=E3=81=AB=E3=81=99?=
 =?UTF-8?q?=E3=82=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

--data-path を別々に渡せば多重起動できるため、PID 検出で launch を拒否するのは誤り
だった。launch は「既に起動中」で二度と拒否しない:

- name=None の global already-running guard を削除。
- per-label lock guard (launch.lock + _reject_if_instance_running /
  _write_instance_lock / _instance_lock_path) を削除。--name はデータツリーの自動採番
  と Camera queue token のみを担い、起動をゲートしない。同ラベル再起動も許可。
- _resolve_instance_paths は instance_dir を内部算出 (lock 用の外出し不要に)。
- docs/cli.md・CHANGELOG を「多重起動は --data-path で分離、--name は便宜」に更新。

real OS プロセスで「稼働中インスタンスの隣で named/unnamed launch が拒否されず新規個体を
返す」「同ラベル再起動が通る」を検証。撤回したガードのテストは削除。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                           |  19 +--
 docs/cli.md                            |  30 +++--
 python/src/resoio/launcher.py          |  87 +++---------
 python/tests/e2e/launcher.py           |   7 -
 python/tests/resoio/cli/test_launch.py |  66 +--------
 python/tests/resoio/test_launcher.py   | 180 ++++++++++++++-----------
 6 files changed, 155 insertions(+), 234 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28002438..64c0ddcd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,15 +9,16 @@ GitHub Release body. The format follows
 
 ### ✨ Added
 
-- **`resoio launch --name <label>` runs multiple isolated instances**: pass a
-  label to start a second Resonite client beside a running one. Each label gets
-  its own data tree under `~/.resonite-io/instances/<label>/` — a separate
-  WINEPREFIX, `-DataPath` / `-CachePath` / `-LogsPath`, and a private Camera IPC
-  queue token (so concurrent instances neither share Resonite data nor cross-talk
-  on the renderer frame queue). Explicit `--prefix` / `--data-path` still win over
-  the label defaults; relaunching the same label while it runs is refused.
-  Without `--name`, `launch` keeps the single-instance guard. Target a specific
-  instance with `--socket ~/.resonite-io/resonite-{pid}.sock`.
+- **`resoio launch` runs multiple instances**: `launch` no longer refuses when a
+  Resonite is already running — start as many as you like by giving each its own
+  `--data-path` (so they don't share a database). `--name <label>` is a
+  convenience that auto-allocates an isolated data tree under
+  `~/.resonite-io/instances/<label>/` — a separate WINEPREFIX, `-DataPath` /
+  `-CachePath` / `-LogsPath`, and a private Camera IPC queue token (so concurrent
+  instances neither share Resonite data nor cross-talk on the renderer frame
+  queue). Explicit `--prefix` / `--data-path` still win over the label defaults;
+  `--name` imposes no guard. Target a specific instance with
+  `--socket ~/.resonite-io/resonite-{pid}.sock`.
 - **`resoio terminate-all`**: stop every running Resonite instance in one call
   (`SIGTERM` → `SIGKILL` per process), printing one engine/renderer pair per
   instance (`--format human|json`). The multi-instance counterpart to the
diff --git a/docs/cli.md b/docs/cli.md
index 90dbb1a0..c5119be8 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -29,7 +29,7 @@ resoio --help
 | `resoio contact` | Contact | unary | Browse and manage contacts (friends) via nested subcommands: `list` (`--search` / `--filter all\|accepted\|requests` / `--include-hidden`), `get`, `search` (`--exact`), `add` (`--username`), `accept`, `remove`. `list` hides dash-hidden (ignored / blocked) contacts by default; `--include-hidden` shows them. The mutating ops (`add` / `accept` / `remove`) write the real cloud contact list. |
 | `resoio auth` | Auth | unary | Resonite cloud sign-in via nested subcommands: `login` (credential positional; password via env/stdin/prompt, never a flag), `logout`, `status`. |
 | `resoio cursor` | Cursor | unary | Set / center / get / release the desktop cursor. `set` and `center` hold the position until `release`. |
-| `resoio launch` | — (umu-launcher) | local process | Start Resonite (engine + renderer) via umu-launcher and print both host PIDs. `-e/--exe` / `RESONITE_EXE` and `-p/--profile` / `MOD_PATH` select the install + mod profile; `--vanilla` skips the mod. `--prefix` (`WINEPREFIX`) and `--proton-path` (`PROTONPATH`, default `GE-Proton`) pick the Wine prefix and Proton build. `--data-path` / `--cache-path` / `--logs-path` relocate Resonite's database / cache / logs; any other Resonite launch option goes after `--` (e.g. `-- -Screen -Verbose`). `--name <label>` runs a **second instance** isolated under `~/.resonite-io/instances/<label>/` (own WINEPREFIX + data + Camera queue). Non-gRPC. |
+| `resoio launch` | — (umu-launcher) | local process | Start Resonite (engine + renderer) via umu-launcher and print both host PIDs. `-e/--exe` / `RESONITE_EXE` and `-p/--profile` / `MOD_PATH` select the install + mod profile; `--vanilla` skips the mod. `--prefix` (`WINEPREFIX`) and `--proton-path` (`PROTONPATH`, default `GE-Proton`) pick the Wine prefix and Proton build. `--data-path` / `--cache-path` / `--logs-path` relocate Resonite's database / cache / logs; any other Resonite launch option goes after `--` (e.g. `-- -Screen -Verbose`). Never refuses when an instance is already running — run several at once by giving each a distinct `--data-path` (and prefix), or use `--name <label>` to auto-allocate an isolated tree under `~/.resonite-io/instances/<label>/` (own WINEPREFIX + data + Camera queue). Non-gRPC. |
 | `resoio terminate` | — (signals) | local process | Force-stop a single Resonite instance by killing the engine + renderer (`SIGTERM` → `SIGKILL`). Takes `[resonite_pid] [renderer_pid]` (from `launch`) or auto-detects the single running instance. Non-gRPC. |
 | `resoio terminate-all` | — (signals) | local process | Force-stop **every** running Resonite instance (`SIGTERM` → `SIGKILL` per process); prints one engine/renderer pair per instance (`--format human\|json`). The multi-instance counterpart to `terminate`. Non-gRPC. |
 | `resoio shutdown` | Lifecycle | unary | Ask the engine to quit gracefully (`Lifecycle.Shutdown`). Best-effort — on Linux the engine often hangs during teardown and never exits, so follow up with `terminate` when you need a guaranteed stop. Prints the engine's host PID (from `Info`). |
@@ -39,17 +39,19 @@ is its independent Python → Resonite counterpart.
 
 `launch` / `terminate` / `terminate-all` are **local process control** (no gRPC). `launch` spawns
 the umu-launcher chain and waits until the **engine** (`resonite_pid`) and **renderer**
-(`renderer_pid`) host processes appear, printing both. Without `--name` it is single-instance:
-it refuses to start beside a running engine. Pass `--name <label>` to run **several instances
-side by side** — each label gets an isolated data tree under `~/.resonite-io/instances/<label>/`
-(its own WINEPREFIX, `-DataPath` / `-CachePath` / `-LogsPath`, and a private Camera IPC queue so
-the instances never share data or cross-talk on the renderer queue); relaunching the same label
-while it runs is refused. Each engine binds its own `resonite-{pid}.sock`, so target a specific
-instance with `--socket ~/.resonite-io/resonite-{pid}.sock` (or `RESONITE_IO_SOCKET`).
-`terminate` signals one instance's two PIDs (`SIGTERM` → `SIGKILL`); given no PIDs it auto-detects
-the single running instance (and errors if it finds more than one — use explicit PIDs or
-`terminate-all`). `terminate-all` stops every instance at once. Because they work from the host
-process table they run before the UDS exists and regardless of whether the client is reachable.
+(`renderer_pid`) host processes appear, printing both. It **never refuses** because another
+instance is already running — to run **several side by side**, give each launch its own
+`--data-path` (so the instances don't share a Resonite database). `--name <label>` is a
+convenience that auto-allocates an isolated tree under `~/.resonite-io/instances/<label>/` (its
+own WINEPREFIX, `-DataPath` / `-CachePath` / `-LogsPath`, and a private Camera IPC queue so the
+instances never cross-talk on the renderer queue); explicit `--prefix` / `--data-path` still win
+over the label defaults, and `--name` imposes no guard. Each engine binds its own
+`resonite-{pid}.sock`, so target a specific instance with
+`--socket ~/.resonite-io/resonite-{pid}.sock` (or `RESONITE_IO_SOCKET`). `terminate` signals one
+instance's two PIDs (`SIGTERM` → `SIGKILL`); given no PIDs it auto-detects the single running
+instance (and errors if it finds more than one — use explicit PIDs or `terminate-all`).
+`terminate-all` stops every instance at once. Because they work from the host process table they
+run before the UDS exists and regardless of whether the client is reachable.
 `shutdown`, by contrast, is a pure gRPC call (`Lifecycle.Shutdown`) that asks a **running**
 engine to quit gracefully — use it when the client is up and reachable. It is best-effort,
 though: on Linux (including the dev container) FrooxEngine frequently hangs during teardown and
@@ -190,9 +192,11 @@ resoio launch --format json     # {"resonite_pid": ..., "renderer_pid": ...}
 # Pick a specific Wine prefix and Proton build
 resoio launch --prefix ~/prefixes/resonite --proton-path GE-Proton
 
-# Run two isolated instances side by side, then talk to a specific one by socket
+# Run two instances side by side. --name auto-allocates isolated data trees;
+# or separate them yourself with --data-path. Then talk to one by its socket.
 resoio launch --name a            # {"resonite_pid": 12345, ...}
 resoio launch --name b            # {"resonite_pid": 23456, ...}
+resoio launch --data-path ~/res-c/data --prefix ~/res-c/pfx   # manual isolation
 resoio --socket ~/.resonite-io/resonite-12345.sock ping
 
 # Stop it — by the PIDs from launch, auto-detect the single instance, or stop every instance
diff --git a/python/src/resoio/launcher.py b/python/src/resoio/launcher.py
index 3faaf1df..f16a0660 100644
--- a/python/src/resoio/launcher.py
+++ b/python/src/resoio/launcher.py
@@ -83,9 +83,9 @@ class LauncherError(RuntimeError):
     """A ``resoio launch`` / ``terminate`` operation could not be completed.
 
     Raised for actionable conditions: Resonite.exe / the mod not found, no
-    ``umu-run`` on PATH, an instance already running, more than one instance
-    detected (the single-instance assumption is violated), or the engine /
-    renderer not appearing before the timeout.
+    ``umu-run`` on PATH, more than one new engine / renderer appearing from a
+    single launch, ``terminate`` finding more than one instance where exactly one
+    is expected, or the engine / renderer not appearing before the timeout.
     """
 
 
@@ -697,18 +697,20 @@ def _instances_base_dir() -> str:
 
 def _resolve_instance_paths(
     name: str,
-    instance_dir: Path,
     prefix: str | None,
     options: LaunchOptions | None,
 ) -> tuple[str, LaunchOptions, str]:
     """Create the per-label data tree and fill any unset isolation path.
 
-    Lays out ``<instance_dir>/{prefix,data,cache,logs}`` and resolves each of the
+    ``--name`` is purely a convenience for auto-allocating the isolation paths —
+    it never gates launching. Lays out
+    ``<instances_base>/<name>/{prefix,data,cache,logs}`` and resolves each of the
     WINEPREFIX / ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots with the
     precedence **explicit caller value > label-auto > unset**. Returns the
     effective WINEPREFIX, the (possibly updated) options, and a per-launch Camera
     IPC queue token so each instance's renderer frames stay on a private queue.
     """
+    instance_dir = Path(_instances_base_dir()) / name
     subdirs = {sub: instance_dir / sub for sub in ("prefix", "data", "cache", "logs")}
     for path in subdirs.values():
         path.mkdir(parents=True, exist_ok=True)
@@ -731,41 +733,6 @@ def _resolve_instance_paths(
     return effective_prefix, opts, token
 
 
-def _instance_lock_path(instance_dir: Path) -> Path:
-    return instance_dir / "launch.lock"
-
-
-def _reject_if_instance_running(instance_dir: Path, name: str) -> None:
-    """Raise if this label's engine (recorded in ``launch.lock``) is still
-    alive.
-
-    A stale lock (no file, unreadable, or a PID that is gone / belongs
-    to a non-engine process after PID reuse) is treated as free-to-
-    launch. This guards only the *same* label against a double launch;
-    different labels are independent and may run concurrently.
-    """
-    try:
-        recorded = int(_instance_lock_path(instance_dir).read_text().strip())
-    except (OSError, ValueError):
-        return
-    try:
-        proc = psutil.Process(recorded)
-    except psutil.NoSuchProcess:
-        return
-    if _argv0_endswith(proc, _ENGINE_ARGV0_SUFFIX):
-        raise LauncherError(
-            f"Resonite instance {name!r} is already running (engine pid "
-            f"{recorded}). Stop it with `resoio terminate` (or `resoio "
-            "terminate-all`) before relaunching this instance."
-        )
-
-
-def _write_instance_lock(instance_dir: Path, engine_pid: int) -> None:
-    """Record this label's engine PID so a later same-label launch can detect
-    it."""
-    _instance_lock_path(instance_dir).write_text(str(engine_pid))
-
-
 def launch(
     *,
     resonite_exe: str | None = None,
@@ -804,17 +771,17 @@ def launch(
         proton_path: Proton build (``PROTONPATH``) — a compat-tools name like
             ``GE-Proton`` or a path. ``None`` resolves it from ``PROTONPATH``,
             then ``GE-Proton``.
-        name: Instance label for **multi-launch**. When given, an isolated data
-            tree is allocated under ``RESONITE_IO_INSTANCES_DIR`` (default
+        name: Convenience label for **multi-launch**. Purely auto-allocates an
+            isolated data tree under ``RESONITE_IO_INSTANCES_DIR`` (default
             ``~/.resonite-io/instances/<name>/``): the WINEPREFIX and the
             ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots are auto-filled
             from it (explicit ``prefix`` / ``options`` values still win), and a
             per-instance Camera IPC queue token is injected so concurrent
             instances do not share Resonite data or cross-talk on the camera
-            queue. Relaunching the *same* label while it is still running is
-            rejected. ``None`` keeps the legacy single-instance behaviour: shared
-            default paths and a guard that refuses to start if any engine is
-            already running.
+            queue. It does **not** gate launching. ``None`` simply leaves those
+            paths at their defaults — run several instances yourself by passing a
+            distinct ``--data-path`` (and prefix) per launch. Either way ``launch``
+            never refuses just because another instance is already running.
         wait_timeout: Seconds to wait for both processes to appear.
         poll_interval: Seconds between process-table polls.
 
@@ -822,32 +789,18 @@ def launch(
         The :class:`LaunchResult` with the engine and renderer host PIDs.
 
     Raises:
-        LauncherError: Resonite.exe / the mod / ``umu-run`` is missing, an
-            instance is already running (the unnamed guard, or the same label),
-            more than one new engine/renderer appears from this launch, or a
-            process did not appear before ``wait_timeout``.
+        LauncherError: Resonite.exe / the mod / ``umu-run`` is missing, more than
+            one new engine/renderer appears from this launch, or a process did not
+            appear before ``wait_timeout``. Launch never refuses because another
+            instance is already running — that is the caller's choice.
     """
     exe = _resolve_resonite_exe(resonite_exe)
     install_dir = os.path.dirname(os.path.realpath(exe))
 
     camera_queue: str | None = None
-    instance_dir: Path | None = None
-    if name is None:
-        # Legacy single-instance guard: refuse to start beside any running engine.
-        already = _find_engine_pids(install_dir)
-        if already:
-            raise LauncherError(
-                f"Resonite is already running (engine pid(s) {already}). Stop it "
-                "first with `resoio terminate`, or pass name=... / --name to launch "
-                "an isolated additional instance."
-            )
-    else:
+    if name is not None:
         _validate_instance_name(name)
-        instance_dir = Path(_instances_base_dir()) / name
-        _reject_if_instance_running(instance_dir, name)
-        prefix, options, camera_queue = _resolve_instance_paths(
-            name, instance_dir, prefix, options
-        )
+        prefix, options, camera_queue = _resolve_instance_paths(name, prefix, options)
 
     argv, env, log_path = _build_command(
         exe,
@@ -907,8 +860,6 @@ def launch(
         deadline,
         poll_interval,
     )
-    if instance_dir is not None:
-        _write_instance_lock(instance_dir, resonite_pid)
     _logger.info(
         "Resonite launched: resonite_pid=%d renderer_pid=%d", resonite_pid, renderer_pid
     )
diff --git a/python/tests/e2e/launcher.py b/python/tests/e2e/launcher.py
index 3b36bbed..b092329b 100644
--- a/python/tests/e2e/launcher.py
+++ b/python/tests/e2e/launcher.py
@@ -80,13 +80,6 @@ def test_launch_returns_both_pids_then_terminate_kills_them(self) -> None:
             assert _find_engine_pids(install) == [result.resonite_pid]
             assert _find_renderer_pids(install) == [result.renderer_pid]
 
-            # Relaunching while running is refused (single-instance guard).
-            try:
-                launch(wait_timeout=5.0)
-                raise AssertionError("expected launch to refuse a second instance")
-            except Exception as exc:  # noqa: BLE001
-                assert "already running" in str(exc)
-
             # Once the mod binds its UDS the engine is rendering; grab a shot.
             sock = _wait_for_socket(_SOCKET_APPEAR_TIMEOUT_S)
             assert sock is not None, "engine never bound its UDS after launch"
diff --git a/python/tests/resoio/cli/test_launch.py b/python/tests/resoio/cli/test_launch.py
index ba4cf3bd..a9297557 100644
--- a/python/tests/resoio/cli/test_launch.py
+++ b/python/tests/resoio/cli/test_launch.py
@@ -2,50 +2,19 @@
 
 The happy path (spawning umu-run and waiting a real Resonite into existence)
 needs a live Resonite and lives in the e2e suite (``tests/e2e/launcher.py``).
-Here we pin the CLI contract: the error path (a missing exe and an
-already-running instance both render :class:`resoio.launcher.LauncherError` to
-stderr and exit 1, triggered with real conditions — a missing path and a real
-dummy process — no mocks), and the argparse-to-call plumbing for ``--prefix`` /
-``--proton-path`` (verified by stubbing our own first-party ``launch`` and
-capturing the kwargs it was called with).
+Here we pin the CLI contract: the error path (a missing exe renders
+:class:`resoio.launcher.LauncherError` to stderr and exits 1, triggered with a
+real missing path — no mocks), and the argparse-to-call plumbing for ``--prefix``
+/ ``--proton-path`` / ``--name`` (verified by stubbing our own first-party
+``launch`` and capturing the kwargs it was called with).
 """
 
 from __future__ import annotations
 
-import shutil
-import subprocess
-import time
-from collections.abc import Callable, Iterator
-from pathlib import Path
-
 import pytest
 
 from resoio.cli import _amain, _build_parser
-from resoio.launcher import LaunchOptions, _find_engine_pids
-
-_SLEEP = shutil.which("sleep") or "/bin/sleep"
-
-
-@pytest.fixture
-def spawn() -> Iterator[Callable[..., int]]:
-    procs: list[subprocess.Popen[bytes]] = []
-
-    def _spawn(path: Path, *args: str) -> int:
-        proc = subprocess.Popen(
-            [str(path), *args], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
-        )
-        procs.append(proc)
-        return proc.pid
-
-    yield _spawn
-
-    for proc in procs:
-        if proc.poll() is None:
-            proc.kill()
-        try:
-            proc.wait(timeout=5)
-        except subprocess.TimeoutExpired:
-            pass
+from resoio.launcher import LaunchOptions
 
 
 async def test_launch_missing_exe_errors(
@@ -57,29 +26,6 @@ async def test_launch_missing_exe_errors(
     assert "not found" in capsys.readouterr().err
 
 
-async def test_launch_refuses_when_already_running(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-    spawn: Callable[..., int],
-    capsys: pytest.CaptureFixture[str],
-):
-    install = tmp_path / "resonite"
-    (install / "dotnet-runtime").mkdir(parents=True)
-    shutil.copy(_SLEEP, install / "dotnet-runtime" / "dotnet")
-    (install / "dotnet-runtime" / "dotnet").chmod(0o755)
-    (install / "Resonite.exe").write_text("")
-    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
-
-    spawn(install / "dotnet-runtime" / "dotnet", "60")
-    deadline = time.monotonic() + 5.0
-    while not _find_engine_pids(str(install)) and time.monotonic() < deadline:
-        time.sleep(0.02)
-
-    rc = await _amain(_build_parser().parse_args(["launch", "--vanilla"]))
-    assert rc == 1
-    assert "already running" in capsys.readouterr().err
-
-
 async def test_launch_forwards_prefix_and_proton_path(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ):
diff --git a/python/tests/resoio/test_launcher.py b/python/tests/resoio/test_launcher.py
index 3b06ed5c..3c2b5392 100644
--- a/python/tests/resoio/test_launcher.py
+++ b/python/tests/resoio/test_launcher.py
@@ -8,7 +8,7 @@
 ``<install>/Renderer/Renderite.Renderer.exe`` for the renderer). The full
 ``launch`` happy path (spawning umu-run) needs a real Resonite and lives in the
 e2e suite (``tests/e2e/launcher.py``); here we cover argument/path resolution,
-command construction, the already-running guard, and the kill/detection logic.
+command construction, per-instance isolation, and the kill/detection logic.
 """
 
 from __future__ import annotations
@@ -35,14 +35,11 @@
     _build_command,
     _find_engine_pids,
     _find_renderer_pids,
-    _instance_lock_path,
-    _reject_if_instance_running,
     _resolve_instance_paths,
     _resolve_mod_path,
     _resolve_resonite_exe,
     _validate_instance_name,
     _wait_for_new,
-    _write_instance_lock,
     launch,
     terminate,
     terminate_all,
@@ -754,16 +751,6 @@ def test_terminate_no_args_errors_on_multiple_instances(
         terminate()
 
 
-def test_launch_refuses_when_already_running(tmp_path: Path, spawn: Callable[..., int]):
-    install = _make_install(tmp_path)
-    spawn(install / "dotnet-runtime" / "dotnet", "60")
-    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
-
-    # The already-running guard fires before umu/mod resolution, so vanilla is fine.
-    with pytest.raises(LauncherError, match="already running"):
-        launch(resonite_exe=str(install / "Resonite.exe"), vanilla=True)
-
-
 # ---------------------------------------------------------------------------
 # Multi-instance: _wait_for_new (PID set-difference)
 # ---------------------------------------------------------------------------
@@ -849,11 +836,14 @@ def test_validate_instance_name_rejects_unsafe(name: str):
         _validate_instance_name(name)
 
 
-def test_resolve_instance_paths_allocates_label_dirs(tmp_path: Path):
+def test_resolve_instance_paths_allocates_label_dirs(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
     # With nothing explicit, the four isolation dirs are created under the label
     # and wired into prefix + options; the token is label-derived and unique.
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
     instance_dir = tmp_path / "instances" / "a"
-    prefix, opts, token = _resolve_instance_paths("a", instance_dir, None, None)
+    prefix, opts, token = _resolve_instance_paths("a", None, None)
 
     assert prefix == str(instance_dir / "prefix")
     assert opts.data_path == str(instance_dir / "data")
@@ -863,17 +853,18 @@ def test_resolve_instance_paths_allocates_label_dirs(tmp_path: Path):
         assert (instance_dir / sub).is_dir()
     assert token.startswith("resonite-io-camera-a-")
     # A second allocation yields a different token (private queue per launch).
-    _, _, token2 = _resolve_instance_paths("a", instance_dir, None, None)
+    _, _, token2 = _resolve_instance_paths("a", None, None)
     assert token2 != token
 
 
-def test_resolve_instance_paths_respects_explicit_paths(tmp_path: Path):
+def test_resolve_instance_paths_respects_explicit_paths(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
     # Explicit caller values win over the label-auto defaults (explicit > auto).
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
     instance_dir = tmp_path / "instances" / "a"
     explicit_opts = LaunchOptions(data_path="/custom/data")
-    prefix, opts, _ = _resolve_instance_paths(
-        "a", instance_dir, "/custom/prefix", explicit_opts
-    )
+    prefix, opts, _ = _resolve_instance_paths("a", "/custom/prefix", explicit_opts)
 
     assert prefix == "/custom/prefix"
     assert opts.data_path == "/custom/data"
@@ -901,59 +892,76 @@ def test_build_command_injects_camera_queue_env(tmp_path: Path, fake_umu: Path):
 
 
 # ---------------------------------------------------------------------------
-# Multi-instance: per-label lock guard
+# Multi-instance: launch never guards on an already-running instance
 # ---------------------------------------------------------------------------
 
 
-def test_reject_if_instance_running_raises_for_live_engine(
-    tmp_path: Path, spawn: Callable[..., int]
-):
-    install = _make_install(tmp_path)
-    instance_dir = tmp_path / "instances" / "a"
-    instance_dir.mkdir(parents=True)
-    engine_pid = spawn(install / "dotnet-runtime" / "dotnet", "60")
-    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
-    _write_instance_lock(instance_dir, engine_pid)
-
-    with pytest.raises(LauncherError, match="instance 'a' is already running"):
-        _reject_if_instance_running(instance_dir, "a")
+def _fake_umu_spawning(tmp_path: Path, engine_path: Path, renderer_path: Path) -> Path:
+    """A stand-in ``umu-run`` that detaches fresh engine + renderer copies.
 
+    ``setsid`` + ``start_new_session`` means they outlive the script, so a
+    ``launch`` PID-diff sees them as the new pair without a real Resonite.
+    """
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    umu = bindir / "umu-run"
+    umu.write_text(
+        "#!/bin/sh\n"
+        f"setsid '{engine_path}' 60 </dev/null >/dev/null 2>&1 &\n"
+        f"setsid '{renderer_path}' 60 </dev/null >/dev/null 2>&1 &\n"
+        "exit 0\n"
+    )
+    umu.chmod(0o755)
+    return bindir
 
-def test_reject_if_instance_running_ignores_stale_lock(tmp_path: Path):
-    # A lock pointing at a dead PID (or no lock at all) is free-to-launch.
-    instance_dir = tmp_path / "instances" / "a"
-    instance_dir.mkdir(parents=True)
-    _reject_if_instance_running(instance_dir, "a")  # no lock file -> no raise
 
-    # A PID that does not exist -> treated as stale.
-    _instance_lock_path(instance_dir).write_text("2147480000")
-    _reject_if_instance_running(instance_dir, "a")  # does not raise
+def _reap_extra(install: Path, keep: set[int]) -> None:
+    for pid in (
+        set(_find_engine_pids(str(install))) | set(_find_renderer_pids(str(install)))
+    ) - keep:
+        with contextlib.suppress(psutil.NoSuchProcess):
+            psutil.Process(pid).kill()
 
 
-def test_launch_named_rejects_relaunch_of_same_label(
+def test_launch_unnamed_starts_beside_a_running_instance(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
 ):
-    # A live lock for label "a" makes launch(name="a") refuse before spawning.
+    # No guard: an *unnamed* launch must start a second instance even with one
+    # already running (the caller separates data with --data-path). It returns
+    # the freshly spawned pair, identified by the before/after PID diff.
     install = _make_install(tmp_path)
     monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
-    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
-    instance_dir = tmp_path / "instances" / "a"
-    instance_dir.mkdir(parents=True)
-    engine_pid = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_engine = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_renderer = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
     _wait_pids(lambda: _find_engine_pids(str(install)), 1)
-    _write_instance_lock(instance_dir, engine_pid)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
 
-    with pytest.raises(LauncherError, match="instance 'a' is already running"):
-        launch(resonite_exe=str(install / "Resonite.exe"), vanilla=True, name="a")
+    bindir = _fake_umu_spawning(
+        tmp_path,
+        install / "dotnet-runtime" / "dotnet",
+        install / "Renderer" / "Renderite.Renderer.exe",
+    )
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        result = launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+        assert result.resonite_pid != existing_engine
+        assert result.renderer_pid != existing_renderer
+    finally:
+        _reap_extra(install, {existing_engine, existing_renderer})
 
 
-def test_launch_named_bypasses_global_guard_and_writes_lock(
+def test_launch_named_starts_beside_a_running_instance_and_allocates_tree(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
 ):
-    # End-to-end multi-instance contract: even with one instance already running,
-    # a *named* launch must NOT raise "already running" (the global guard is for
-    # unnamed launches only). It allocates the label data tree, returns the new
-    # engine/renderer pair, and records the engine PID in the label lock.
+    # A *named* launch is identical except it auto-allocates the label data tree.
+    # It still does not guard on an already-running instance (--name is a
+    # convenience, not a lock).
     install = _make_install(tmp_path)
     monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
     monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
@@ -963,18 +971,11 @@ def test_launch_named_bypasses_global_guard_and_writes_lock(
     _wait_pids(lambda: _find_engine_pids(str(install)), 1)
     _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
 
-    engine_path = install / "dotnet-runtime" / "dotnet"
-    renderer_path = install / "Renderer" / "Renderite.Renderer.exe"
-    bindir = tmp_path / "bin"
-    bindir.mkdir()
-    umu = bindir / "umu-run"
-    umu.write_text(
-        "#!/bin/sh\n"
-        f"setsid '{engine_path}' 60 </dev/null >/dev/null 2>&1 &\n"
-        f"setsid '{renderer_path}' 60 </dev/null >/dev/null 2>&1 &\n"
-        "exit 0\n"
+    bindir = _fake_umu_spawning(
+        tmp_path,
+        install / "dotnet-runtime" / "dotnet",
+        install / "Renderer" / "Renderite.Renderer.exe",
     )
-    umu.chmod(0o755)
     monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
 
     try:
@@ -985,23 +986,48 @@ def test_launch_named_bypasses_global_guard_and_writes_lock(
             wait_timeout=10.0,
             poll_interval=0.05,
         )
-
         assert result.resonite_pid != existing_engine
         assert result.renderer_pid != existing_renderer
-        # The label data tree was allocated and the lock records the new engine.
+        # The label data tree was allocated (no lock file is written).
         instance_dir = tmp_path / "instances" / "b"
         for sub in ("prefix", "data", "cache", "logs"):
             assert (instance_dir / sub).is_dir()
-        assert _instance_lock_path(instance_dir).read_text().strip() == str(
-            result.resonite_pid
+        assert not (instance_dir / "launch.lock").exists()
+    finally:
+        _reap_extra(install, {existing_engine, existing_renderer})
+
+
+def test_launch_named_relaunch_of_same_label_is_allowed(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # Re-launching the same label while it runs is NOT rejected (no per-label
+    # guard); it simply reuses the label's data tree and spawns another instance.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.setenv("RESONITE_IO_INSTANCES_DIR", str(tmp_path / "instances"))
+    existing_engine = spawn(install / "dotnet-runtime" / "dotnet", "60")
+    existing_renderer = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60")
+    _wait_pids(lambda: _find_engine_pids(str(install)), 1)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 1)
+
+    bindir = _fake_umu_spawning(
+        tmp_path,
+        install / "dotnet-runtime" / "dotnet",
+        install / "Renderer" / "Renderite.Renderer.exe",
+    )
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        result = launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            name="a",  # same label as a notional running "a"; must not raise
+            wait_timeout=10.0,
+            poll_interval=0.05,
         )
+        assert result.resonite_pid != existing_engine
     finally:
-        for pid in (
-            set(_find_engine_pids(str(install)))
-            | set(_find_renderer_pids(str(install)))
-        ) - {existing_engine, existing_renderer}:
-            with contextlib.suppress(psutil.NoSuchProcess):
-                psutil.Process(pid).kill()
+        _reap_extra(install, {existing_engine, existing_renderer})
 
 
 # ---------------------------------------------------------------------------

From 27780b54db3d4343d759825847a145de58e10c6c Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 12:01:15 +0000
Subject: [PATCH 6/7] =?UTF-8?q?fix(python/launcher):=20=E5=A4=9A=E9=87=8D?=
 =?UTF-8?q?=E8=B5=B7=E5=8B=95=E3=81=AE=20camera=20queue=20token=20?=
 =?UTF-8?q?=E3=82=92=E5=B8=B8=E3=81=AB=E6=B3=A8=E5=85=A5=E3=81=97=E3=83=9A?=
 =?UTF-8?q?=E3=82=A2=E3=83=AA=E3=83=B3=E3=82=B0=E3=82=92=20token=20?=
 =?UTF-8?q?=E5=9F=BA=E6=BA=96=E3=81=AB=E3=81=99=E3=82=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`resoio launch` を --name なしで起動すると Renderer/Engine 起動直後にフリーズする
問題と、`resoio terminate-all` が単一インスタンスを 2 つ (pid=0) と誤判定する問題を
修正する。両方とも engine↔renderer が共有する Camera IPC queue token に起因する。

- フリーズ: --name なしの launch は token を注入せず、engine mod が runtime に
  自己生成していたが、runtime set した env は Wine 子プロセス (renderer) に継承
  されず両者が別 queue を掴んでいた。launch() が --name の有無に関わらず一意の
  token を exec 前に必ず env 注入するようにし、engine と renderer が同じ queue で
  合意するようにする (--name が動いていたのは exec 前注入だったため)。
- terminate-all の誤判定: renderer は engine の host プロセス subtree に居ない
  ことがある (Wine が reparent する) ため process-tree ペアリングが取りこぼし、
  1 インスタンスが 2 行に割れていた。engine/renderer が共有する token (/proc/environ)
  でペアリングし、process-tree を fallback に残す。

env 名を `_CAMERA_QUEUE_ENV` 定数に集約。回帰テスト 2 件追加 (unnamed launch の
token 注入 / token によるペアリング)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                         |  13 +++
 python/src/resoio/launcher.py        | 129 +++++++++++++++++++++------
 python/tests/resoio/test_launcher.py |  73 ++++++++++++++-
 3 files changed, 185 insertions(+), 30 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64c0ddcd..ccf4b0b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,19 @@ GitHub Release body. The format follows
 
 ### 🐛 Fixed
 
+- **`resoio launch` (without `--name`) froze right after the engine and renderer
+  came up**: an unnamed launch did not inject a Camera IPC queue token, so the
+  engine self-generated one at runtime that the renderer (a Wine child) never
+  inherited — the two bound different queues and the client hung waiting for
+  frames (`--name` was unaffected because it injects the token before exec).
+  `launch` now always injects a unique token before exec, so the engine and
+  renderer always agree on the queue.
+- **`resoio terminate-all` reported a single instance as two**: it paired an
+  engine with its renderer only when the renderer appeared in the engine's host
+  process subtree, but Wine often reparents the renderer out of it, so one
+  instance came back as two `pid=0` rows. Pairing now keys off the Camera IPC
+  queue token the engine and renderer share (falling back to the process tree),
+  so a single instance is reported as one engine/renderer pair.
 - **`resoio launch` hung on a host install under `$HOME`**: the renderer never
   started (and the engine waited forever) when launching from a Steam install
   beneath `$HOME`. umu/Proton's game-drive feature maps `$HOME` onto a Wine drive
diff --git a/python/src/resoio/launcher.py b/python/src/resoio/launcher.py
index f16a0660..8c7cc600 100644
--- a/python/src/resoio/launcher.py
+++ b/python/src/resoio/launcher.py
@@ -78,6 +78,13 @@
 _ENGINE_ARGV0_SUFFIX: str = os.path.join("dotnet-runtime", "dotnet")
 _RENDERER_ARGV0_SUFFIX: str = os.path.join("Renderer", "Renderite.Renderer.exe")
 
+# Env var carrying the per-instance Camera IPC queue token shared by an engine and
+# its renderer (mirrors C# ``IpcSocketPaths.QueueNameEnvVar``). :func:`launch`
+# injects a unique value per instance *before exec* so it lands in both processes'
+# environment (the renderer inherits it as the engine's Wine child);
+# :func:`terminate_all` reads it back to pair an engine with its renderer.
+_CAMERA_QUEUE_ENV: str = "RESONITE_IO_CAMERA_QUEUE"
+
 
 class LauncherError(RuntimeError):
     """A ``resoio launch`` / ``terminate`` operation could not be completed.
@@ -576,13 +583,14 @@ def _build_command(
     # PROTONPATH は GE-Proton のような論理名も取るので abspath しない (WINEPREFIX のみ abspath)。
     if prefix is not None:
         env["WINEPREFIX"] = os.path.abspath(prefix)
-    # Per-instance Camera IPC queue token (multi-launch). The engine mod also
-    # self-generates one in its earliest load hook when this is unset, so single
-    # launches stay on the default queue; injecting it here keeps the token
-    # deterministic (label-derived) and lets the renderer child inherit the same
-    # value through the shared Wine session env.
+    # Per-instance Camera IPC queue token. :func:`launch` always injects one
+    # (named or not) so the engine and its renderer agree on the queue: setting it
+    # here, before exec, lands it in both processes' env (the renderer inherits it
+    # as the engine's Wine child). The engine mod only self-generates a token when
+    # this is unset — i.e. for a launch that did not go through this launcher (Gale
+    # / Steam directly), where setting the env at runtime is the only option left.
     if camera_queue is not None:
-        env["RESONITE_IO_CAMERA_QUEUE"] = camera_queue
+        env[_CAMERA_QUEUE_ENV] = camera_queue
     log_path: str | None = None
 
     if not vanilla:
@@ -775,13 +783,13 @@ def launch(
             isolated data tree under ``RESONITE_IO_INSTANCES_DIR`` (default
             ``~/.resonite-io/instances/<name>/``): the WINEPREFIX and the
             ``-DataPath`` / ``-CachePath`` / ``-LogsPath`` slots are auto-filled
-            from it (explicit ``prefix`` / ``options`` values still win), and a
-            per-instance Camera IPC queue token is injected so concurrent
-            instances do not share Resonite data or cross-talk on the camera
-            queue. It does **not** gate launching. ``None`` simply leaves those
-            paths at their defaults — run several instances yourself by passing a
-            distinct ``--data-path`` (and prefix) per launch. Either way ``launch``
-            never refuses just because another instance is already running.
+            from it (explicit ``prefix`` / ``options`` values still win). It does
+            **not** gate launching. ``None`` simply leaves those paths at their
+            defaults — run several instances yourself by passing a distinct
+            ``--data-path`` (and prefix) per launch. Either way ``launch`` always
+            injects a unique per-instance Camera IPC queue token (so the engine and
+            renderer agree on the queue and concurrent instances do not cross-talk),
+            and never refuses just because another instance is already running.
         wait_timeout: Seconds to wait for both processes to appear.
         poll_interval: Seconds between process-table polls.
 
@@ -797,10 +805,18 @@ def launch(
     exe = _resolve_resonite_exe(resonite_exe)
     install_dir = os.path.dirname(os.path.realpath(exe))
 
-    camera_queue: str | None = None
+    # Always inject a unique Camera IPC queue token so the engine and its renderer
+    # bind the same queue. A named launch derives it from the label data tree; an
+    # unnamed launch gets a random one. The token MUST be in the env before exec:
+    # the engine mod would otherwise self-generate one at runtime, which the
+    # renderer (a Wine child) never inherits, so the two bind different queues and
+    # the client freezes after both processes start.
+    camera_queue: str
     if name is not None:
         _validate_instance_name(name)
         prefix, options, camera_queue = _resolve_instance_paths(name, prefix, options)
+    else:
+        camera_queue = f"resonite-io-camera-{secrets.token_hex(8)}"
 
     argv, env, log_path = _build_command(
         exe,
@@ -951,13 +967,33 @@ def terminate(
     return LaunchResult(resonite_pid=killed_engine, renderer_pid=killed_renderer)
 
 
+def _instance_token(pid: int) -> str | None:
+    """The Camera IPC queue token in ``pid``'s environment, or ``None``.
+
+    An engine and its renderer share ``RESONITE_IO_CAMERA_QUEUE`` because
+    :func:`launch` injects a unique value per instance *before exec*, so it lands
+    in both processes' ``/proc/<pid>/environ`` (the renderer inherits it as the
+    engine's Wine child). This is the reliable key for pairing an engine with its
+    renderer in :func:`terminate_all`: the renderer is **not** always under the
+    engine in the host process tree (Wine reparents it), so the tree heuristic can
+    miss the pair and report one instance as two. ``None`` for a process without
+    the token (e.g. a launch that did not go through this launcher).
+    """
+    try:
+        token = psutil.Process(pid).environ().get(_CAMERA_QUEUE_ENV)
+    except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
+        return None
+    return token or None
+
+
 def _engine_child_renderer(engine_pid: int, renderer_pids: set[int]) -> int | None:
     """The renderer host PID parented under ``engine_pid``, if any.
 
     Resonite's engine spawns the renderer (``RenderSystem.StartRenderer`` →
-    ``Process.Start``), so the renderer usually appears somewhere in the engine's
-    host process subtree. Used only to *group* a kill into engine/renderer pairs;
-    grouping is best-effort and never affects which processes get killed.
+    ``Process.Start``), so the renderer *sometimes* appears in the engine's host
+    process subtree. This is the **fallback** pairing for a renderer that carries
+    no Camera IPC queue token (see :func:`_instance_token`); used only to *group* a
+    kill into engine/renderer pairs, never to decide which processes get killed.
     """
     try:
         children = psutil.Process(engine_pid).children(recursive=True)
@@ -969,15 +1005,37 @@ def _engine_child_renderer(engine_pid: int, renderer_pids: set[int]) -> int | No
     return None
 
 
+def _match_renderer(
+    engine_pid: int,
+    renderers: list[int],
+    renderers_by_token: dict[str, list[int]],
+    paired: set[int],
+) -> int | None:
+    """Pick the renderer belonging to ``engine_pid``, skipping ``paired`` ones.
+
+    Primary key is the shared Camera IPC queue token (reliable across Wine's
+    process-tree reparenting); falls back to the engine's host-process subtree for
+    a token-less instance. Returns ``None`` when no renderer can be attributed.
+    """
+    token = _instance_token(engine_pid)
+    if token is not None:
+        for candidate in renderers_by_token.get(token, ()):
+            if candidate not in paired:
+                return candidate
+    return _engine_child_renderer(engine_pid, set(renderers) - paired)
+
+
 def terminate_all(*, timeout: float = 3.0) -> list[LaunchResult]:
     """Stop **every** running Resonite instance and return the pairs signalled.
 
     Unlike :func:`terminate` (a single instance), this detects all engine and
     renderer processes for the configured install and stages ``SIGTERM`` →
-    ``SIGKILL`` on each. Engines are grouped with their child renderer where the
-    process tree makes that visible; any renderer without a matching engine is
-    still killed and reported on its own (``resonite_pid=0``). Idempotent: PIDs
-    already gone are skipped and excluded from the result.
+    ``SIGKILL`` on each. Engines are paired with their renderer by the shared
+    Camera IPC queue token (see :func:`_instance_token`; a single instance is one
+    pair, not two ``pid=0`` rows), falling back to the host process tree for a
+    token-less instance; any renderer that still has no matching engine is killed
+    and reported on its own (``resonite_pid=0``). Idempotent: PIDs already gone are
+    skipped and excluded from the result.
 
     Args:
         timeout: Seconds to wait after ``SIGTERM`` before ``SIGKILL`` (per PID).
@@ -991,25 +1049,38 @@ def terminate_all(*, timeout: float = 3.0) -> list[LaunchResult]:
             Resonite process (a reused PID).
     """
     install_dir = _install_dir_for_detection()
-    renderers = set(_find_renderer_pids(install_dir))
-    paired: set[int] = set()
+    engines = _find_engine_pids(install_dir)
+    renderers = _find_renderer_pids(install_dir)
     results: list[LaunchResult] = []
+    paired: set[int] = set()
 
-    for engine_pid in _find_engine_pids(install_dir):
-        child = _engine_child_renderer(engine_pid, renderers)
+    # Index renderers by their instance token so an engine can claim the renderer
+    # that shares its Camera IPC queue — the renderer is not reliably under the
+    # engine in the host process tree (Wine reparents it), so the token is what
+    # keeps a single instance from being reported as two ``pid=0`` rows.
+    renderers_by_token: dict[str, list[int]] = {}
+    for renderer_pid in renderers:
+        token = _instance_token(renderer_pid)
+        if token is not None:
+            renderers_by_token.setdefault(token, []).append(renderer_pid)
+
+    for engine_pid in engines:
+        renderer_pid = _match_renderer(
+            engine_pid, renderers, renderers_by_token, paired
+        )
         killed_engine = _kill_pid(engine_pid, _ENGINE_ARGV0_SUFFIX, "engine", timeout)
         killed_renderer = 0
-        if child is not None:
-            paired.add(child)
+        if renderer_pid is not None:
+            paired.add(renderer_pid)
             killed_renderer = _kill_pid(
-                child, _RENDERER_ARGV0_SUFFIX, "renderer", timeout
+                renderer_pid, _RENDERER_ARGV0_SUFFIX, "renderer", timeout
             )
         if killed_engine or killed_renderer:
             results.append(
                 LaunchResult(resonite_pid=killed_engine, renderer_pid=killed_renderer)
             )
 
-    for renderer_pid in sorted(renderers - paired):
+    for renderer_pid in sorted(set(renderers) - paired):
         killed = _kill_pid(renderer_pid, _RENDERER_ARGV0_SUFFIX, "renderer", timeout)
         if killed:
             results.append(LaunchResult(resonite_pid=0, renderer_pid=killed))
diff --git a/python/tests/resoio/test_launcher.py b/python/tests/resoio/test_launcher.py
index 3c2b5392..26873346 100644
--- a/python/tests/resoio/test_launcher.py
+++ b/python/tests/resoio/test_launcher.py
@@ -81,11 +81,12 @@ def spawn() -> Iterator[Callable[..., int]]:
     """Spawn tracked child processes and reap them at teardown."""
     procs: list[subprocess.Popen[bytes]] = []
 
-    def _spawn(path: Path | str, *args: str) -> int:
+    def _spawn(path: Path | str, *args: str, env: dict[str, str] | None = None) -> int:
         proc = subprocess.Popen(
             [str(path), *args],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
+            env=env,
         )
         procs.append(proc)
         return proc.pid
@@ -956,6 +957,49 @@ def test_launch_unnamed_starts_beside_a_running_instance(
         _reap_extra(install, {existing_engine, existing_renderer})
 
 
+def test_launch_unnamed_injects_a_camera_queue_token(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+):
+    # Regression: an unnamed launch must inject a unique RESONITE_IO_CAMERA_QUEUE
+    # *before exec* so the engine and renderer bind the same Camera IPC queue.
+    # Without it the engine self-generates a token at runtime that the renderer
+    # (a Wine child) never inherits -> mismatched queues -> the client froze after
+    # both processes came up. The token is captured by a fake umu-run that records
+    # the env it was launched with; it must be non-empty and not the fixed default.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    monkeypatch.delenv("RESONITE_IO_CAMERA_QUEUE", raising=False)
+    env_dump = tmp_path / "umu_camera_queue.txt"
+    engine = install / "dotnet-runtime" / "dotnet"
+    renderer = install / "Renderer" / "Renderite.Renderer.exe"
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    umu = bindir / "umu-run"
+    umu.write_text(
+        "#!/bin/sh\n"
+        f'printf "%s" "$RESONITE_IO_CAMERA_QUEUE" > "{env_dump}"\n'
+        f"setsid '{engine}' 60 </dev/null >/dev/null 2>&1 &\n"
+        f"setsid '{renderer}' 60 </dev/null >/dev/null 2>&1 &\n"
+        "exit 0\n"
+    )
+    umu.chmod(0o755)
+    monkeypatch.setenv("PATH", f"{bindir}{os.pathsep}{os.environ.get('PATH', '')}")
+
+    try:
+        launch(
+            resonite_exe=str(install / "Resonite.exe"),
+            vanilla=True,
+            wait_timeout=10.0,
+            poll_interval=0.05,
+        )
+        token = env_dump.read_text()
+        assert token, "no RESONITE_IO_CAMERA_QUEUE was injected for an unnamed launch"
+        assert token != "resonite-io-camera-frames"  # not the fixed engine default
+        assert token.startswith("resonite-io-camera-")
+    finally:
+        _reap_extra(install, set())
+
+
 def test_launch_named_starts_beside_a_running_instance_and_allocates_tree(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
 ):
@@ -1067,3 +1111,30 @@ def test_terminate_all_returns_empty_when_nothing_running(
     monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
 
     assert terminate_all(timeout=3.0) == []
+
+
+def test_terminate_all_pairs_engine_and_renderer_by_camera_queue_token(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, spawn: Callable[..., int]
+):
+    # An engine and its renderer share RESONITE_IO_CAMERA_QUEUE; the renderer is
+    # not reliably a host child of the engine (Wine reparents it), so terminate_all
+    # must pair them by that token rather than the process tree. A single instance
+    # must come back as ONE pair (engine + renderer), not two pid=0 rows, and two
+    # instances must pair correctly by their distinct tokens.
+    install = _make_install(tmp_path)
+    monkeypatch.setenv("RESONITE_EXE", str(install / "Resonite.exe"))
+    env_a = {**os.environ, "RESONITE_IO_CAMERA_QUEUE": "resonite-io-camera-a-1111"}
+    env_b = {**os.environ, "RESONITE_IO_CAMERA_QUEUE": "resonite-io-camera-b-2222"}
+    engine_a = spawn(install / "dotnet-runtime" / "dotnet", "60", env=env_a)
+    renderer_a = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60", env=env_a)
+    engine_b = spawn(install / "dotnet-runtime" / "dotnet", "60", env=env_b)
+    renderer_b = spawn(install / "Renderer" / "Renderite.Renderer.exe", "60", env=env_b)
+    _wait_pids(lambda: _find_engine_pids(str(install)), 2)
+    _wait_pids(lambda: _find_renderer_pids(str(install)), 2)
+
+    killed = terminate_all(timeout=3.0)
+
+    pairs = {(r.resonite_pid, r.renderer_pid) for r in killed}
+    assert pairs == {(engine_a, renderer_a), (engine_b, renderer_b)}
+    assert _wait_pids(lambda: _find_engine_pids(str(install)), 0) == []
+    assert _wait_pids(lambda: _find_renderer_pids(str(install)), 0) == []

From a7fae62e2af159500888939c02a9b9a0e1d7d044 Mon Sep 17 00:00:00 2001
From: GesonAnko <59220704+Geson-anko@users.noreply.github.com>
Date: Thu, 25 Jun 2026 12:21:59 +0000
Subject: [PATCH 7/7] =?UTF-8?q?fix(mod/camera):=20engine=20=E3=81=AE=20que?=
 =?UTF-8?q?ue=20token=20self-gen=20=E3=82=92=E6=92=A4=E5=8E=BB=E3=81=97=20?=
 =?UTF-8?q?Gale/Steam=20=E7=9B=B4=E6=8E=A5=E8=B5=B7=E5=8B=95=E3=81=A7?=
 =?UTF-8?q?=E3=82=82=20camera=20=E3=82=92=E6=88=90=E7=AB=8B=E3=81=95?=
 =?UTF-8?q?=E3=81=9B=E3=82=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

engine が ResoniteIOPlugin.Load() で runtime に Environment.SetEnvironmentVariable した
Camera IPC queue token は、別プロセスとして起動する renderer に伝播しない。このため
resoio を介さない直接起動 (Gale/Steam) では engine が Guid token・renderer が固定デフォルト名
を掴んで別 queue になり camera がフリーズしていた (resoio 経由は launcher が exec 前に
注入するので前commitで解決済み)。

self-gen を撤去し、token は常に exec 前に env へ載せる設計へ統一する:
- resoio launch 経由: launcher が起動前に instance 固有 token を注入 (済)。
- Gale/Steam 直接起動: 何も set されず engine/renderer 双方が IpcSocketPaths の
  固定デフォルト名に fallback して一致する (単一インスタンス)。

- mod/src/ResoniteIO/ResoniteIOPlugin.cs: Load() の self-gen if-block を撤去。
- mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs: QueueNameEnvVar の remarks を
  実態 (launcher 注入 / デフォルト fallback) に更新。renderer prebuilt を再生成。
- python/tests/e2e/gale_launch.py: queue env 無しの mod launch が camera frame を返す
  e2e 回帰シナリオを追加 (_build_command(camera_queue=None) で Gale 起動を faithful に再現)。

実機 e2e で検証済み: gale_launch / launcher (no-name) / multi_instance すべて green。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  17 +-
 mod/prebuilt/renderer.sha256                  |   2 +-
 mod/prebuilt/renderer/ResoniteIO.Renderer.dll | Bin 12800 -> 12800 bytes
 mod/prebuilt/renderer/ResoniteIO.Renderer.pdb | Bin 10332 -> 10332 bytes
 .../renderer/ResoniteIO.RendererShared.dll    | Bin 8704 -> 8704 bytes
 .../IpcSocketPaths.cs                         |  17 +-
 mod/src/ResoniteIO/ResoniteIOPlugin.cs        |  28 +--
 python/tests/e2e/gale_launch.py               | 219 ++++++++++++++++++
 8 files changed, 249 insertions(+), 34 deletions(-)
 create mode 100644 python/tests/e2e/gale_launch.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ccf4b0b4..42d0d93e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,13 +47,16 @@ GitHub Release body. The format follows
 
 ### 🐛 Fixed
 
-- **`resoio launch` (without `--name`) froze right after the engine and renderer
-  came up**: an unnamed launch did not inject a Camera IPC queue token, so the
-  engine self-generated one at runtime that the renderer (a Wine child) never
-  inherited — the two bound different queues and the client hung waiting for
-  frames (`--name` was unaffected because it injects the token before exec).
-  `launch` now always injects a unique token before exec, so the engine and
-  renderer always agree on the queue.
+- **Camera froze right after the engine and renderer came up (no `--name`, and
+  on direct Gale / Steam launches)**: the engine self-generated a Camera IPC
+  queue token at runtime that the renderer (a separately-spawned Wine child)
+  never inherited, so the two bound different queues and the client hung waiting
+  for frames. The engine no longer self-generates a token. Instead the token is
+  always placed in the environment **before exec**: `resoio launch` injects a
+  unique one per instance (named or not), and a direct Gale / Steam launch sets
+  nothing, so the engine and renderer both fall back to the same fixed default
+  queue name. Either way both ends agree on one queue. (`--name` was already
+  unaffected because it injected the token before exec.)
 - **`resoio terminate-all` reported a single instance as two**: it paired an
   engine with its renderer only when the renderer appeared in the engine's host
   process subtree, but Wine often reparents the renderer out of it, so one
diff --git a/mod/prebuilt/renderer.sha256 b/mod/prebuilt/renderer.sha256
index 4b584a04..8c9ff3d1 100644
--- a/mod/prebuilt/renderer.sha256
+++ b/mod/prebuilt/renderer.sha256
@@ -1 +1 @@
-3ac72c3fdc00061147c7419fb86086612876f2cec2135e72ff1a4472df20818f
+f040d1a69a647e02875f9781701a71d39ddd869d25e9347c89bdb75b80942405
diff --git a/mod/prebuilt/renderer/ResoniteIO.Renderer.dll b/mod/prebuilt/renderer/ResoniteIO.Renderer.dll
index 003066ed185efc45bd22e18a138007f6ebc66dcd..7141962603b3c6592509230a7f6fbcd4f1c67df1 100644
GIT binary patch
delta 235
zcmZojX-JvS!Ln*)@a2s?0xAMqRQp%CY+UcWSTI0t(&A$bo7bpRFl!i@n_CzpnVO^|
z8K;;Sn;55<n_5~JnOc~bCmNcVrlgu$q#7C|n<Y>7(YV24`A>K5WDU&#ff^S1S(|_5
z`L!8zo_HJ>qCL4oGgbjAc#jP#2vRL5r+n!u%SFK$ab3R6tXlT0{zeSuKxn~Wz>vgX
z%3#8f0;G+BqzRA&;S`{(DT5_Yg%Oap0E(G2Br+HRX;YwFDp)KP$Twg}W-wz&-aJ`9
Gmk9t=szWOP

delta 235
zcmZojX-JvS!4k~a->|VqKt&*IpVZsgYKaa@g1&F~e1FgW&1+ODm^D(8QVmQ^lM_u7
zP0bRGO$<zp%?!<xk}XY4P0h_rOjC?3Esaf$jnXFjXxw1gyI|^$$r_pg0*@EIc`dS4
z(rf$o=bM!KCTyDAp&6?H6+HDFDhN`|S=Q+|vGl5xC8OS&&8%AXto|tsNernB1`MV^
zn9Ps}Bth5=NE$PkfW?i0JVOR^pt@uROQ0A?r8!Ux#7bc>0*YAz)tUma5kuPM$@;lW
E00opw=>Px#

diff --git a/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb b/mod/prebuilt/renderer/ResoniteIO.Renderer.pdb
index e6ea817e86ae6ab0f3c4bccc23c478627688e7bf..d00c97f5b89317c698cac256fd9b930a77ace10d 100644
GIT binary patch
delta 143
zcmV;A0C4}@P~1?Ed=z{HADXlJZcc_UiOAzoR4Y0DEuFEDwgn$!tT*hc%$;18XE0>T
zpQDjtzU_BnVmg2F4380KK4+6<23IIDH#ayiVl^~mVl!kkGc+?~H#IppGBr3fH(@a}
xHDqNqIAt*~V>V;6<OW6q7(vZDs{nui0Jakxv2=U^L!DUIsUyPBd9y+a8XoCpH#`6U

delta 143
zcmV;A0C4}@P~1?Ed=%rM?CTV@8A`YJ=dvS?kg~m?mAJ8xwgn#r3j#|K08u?2Ttk_^
zIF?x~VuzLlioFQ_%Gr2Hr#F*j23II#Vr4KjHDh5lVKp{kGc+(YGd3|dVq-ZpH8nRj
xG&N*0IXN>mGcsng<OW6q7;#d)=>UKL06<NRuk0QOPQPfbq_1Xxz_UUM8XnYhH#`6U

diff --git a/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll b/mod/prebuilt/renderer/ResoniteIO.RendererShared.dll
index 7527aeb534f46df469b005b616e951c87ba2ac21..5c8a5215b03617c2c6554b2d34161863bc1753ec 100644
GIT binary patch
delta 235
zcmZp0X>gg)!Qyz<diBPh6~Y4Bgk?6C)G#{FjkvK=`Ot;R%`PHym^6&c%`FU)Oifaf
zj8jaEO^j2_O)V{qOf5{z6AevFQ&LSWQVk7~&5|c`i0@!|#w&Sr@)7X>0lin*c3~WD
zK9iZVFO{~Q=bNk|QK$eF?70jT1gds*5&qySJ!5H)P2jdYo3~1wX7M*-Fb6^l1_Op9
z22%zTh7=%e3?xl}BnYPfWlb3@fhvrEv;|PioFS3H5J;N><x;_7sX)E~Lo$OIL-OYH
HvW6@G*nvYe

delta 235
zcmZp0X>gg)!BQBs_vOZ(6~Y1zzP;<;$Z`1X&seu)eOkkT%`PHym^4z7QVmQ^lM_u7
zP0bRGO$<zp%?!<xk}XY4P0h_rOjC?3Esaf$jnXD_i0@$O-mrMa<Rjt%0(o7+sru_9
zJ!ekodhvlP&1tfVM4<vyFftM<2vW`c<>IxzyL&H~{dnfEd8@=}7XK86B!*N50|rwd
zOlC*~k|1mbB#jwNz~aV0o*{!dP+c;EB~T2c(i|uTVx=$`0mUqVYE6OIh#_tBd09gi
E04Z-tW&i*H

diff --git a/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs b/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
index ee5b336f..34c0fa04 100644
--- a/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
+++ b/mod/src/ResoniteIO.RendererShared/IpcSocketPaths.cs
@@ -17,12 +17,17 @@ public static class IpcSocketPaths
 
     /// <summary><see cref="QueueName"/> を上書きする環境変数名。</summary>
     /// <remarks>
-    /// 多重起動時に各インスタンスの queue を分離するための逃げ道。engine プロセスが
-    /// 起動最早期 (<c>ResoniteIOPlugin.Load</c>) でこの env を set し、renderer は
-    /// engine の子プロセスとして同じ値を継承するため、両側が同じ token を読む。
-    /// 未設定時は従来固定名 (<see cref="_defaultQueueName"/>) に fallback し、
-    /// 単一起動・既存デプロイの挙動を保つ。<c>GrpcHost.ResolveSocketPath</c> と同じ
-    /// 「env override → 既定値」パターン。
+    /// 多重起動時に各インスタンスの queue を分離するための逃げ道。token は exec 前に
+    /// env へ載せる必要がある: engine が runtime に <c>Environment.SetEnvironmentVariable</c>
+    /// で set しても、その値は別プロセスとして起動する renderer に届かず、engine/renderer
+    /// が別 queue を掴んで client が frame 待ちでハングする。
+    /// <list type="bullet">
+    ///   <item><c>resoio launch</c> 経由: Python launcher が起動前に instance 固有 token を
+    ///   注入し、engine と renderer (Wine 子プロセス) が同じ env を継承して queue を分離する。</item>
+    ///   <item>Gale / Steam 直接起動: 何も set されず、engine/renderer 双方が固定名
+    ///   (<see cref="_defaultQueueName"/>) に fallback して一致する (単一インスタンス)。</item>
+    /// </list>
+    /// <c>GrpcHost.ResolveSocketPath</c> と同じ「env override → 既定値」パターン。
     /// </remarks>
     public const string QueueNameEnvVar = "RESONITE_IO_CAMERA_QUEUE";
 
diff --git a/mod/src/ResoniteIO/ResoniteIOPlugin.cs b/mod/src/ResoniteIO/ResoniteIOPlugin.cs
index 8d6e68ae..9db8db25 100644
--- a/mod/src/ResoniteIO/ResoniteIOPlugin.cs
+++ b/mod/src/ResoniteIO/ResoniteIOPlugin.cs
@@ -81,26 +81,14 @@ public override void Load()
     {
         Log = base.Log;
 
-        // 多重起動時の Camera IPC queue 衝突を防ぐため、インスタンス固有の queue token を
-        // 生成して自プロセス env に set する。renderer は engine の子プロセス
-        // (RenderSystem.StartRenderer の Process.Start, UseShellExecute=false) として
-        // この env を継承するので両側が同じ token を読む。renderer spawn は engine 起動の
-        // 早い段階 (OnEngineReady より前) なので set は必ず Load() で行う必要がある。
-        // launcher が外から token を注入済みならそれを尊重 (上書きしない)。
-        // QueueNameEnvVar は const のためインライン化され RendererShared を早期ロードしない。
-        if (
-            string.IsNullOrEmpty(
-                Environment.GetEnvironmentVariable(RendererShared.IpcSocketPaths.QueueNameEnvVar)
-            )
-        )
-        {
-            var token = "resonite-io-camera-" + Guid.NewGuid().ToString("N");
-            Environment.SetEnvironmentVariable(
-                RendererShared.IpcSocketPaths.QueueNameEnvVar,
-                token
-            );
-            Log.LogInfo($"Camera IPC queue token generated: {token}");
-        }
+        // Camera IPC queue token (RESONITE_IO_CAMERA_QUEUE) はここでは生成しない。
+        // engine が runtime に Environment.SetEnvironmentVariable で set しても、その値は
+        // 別プロセスとして起動する renderer に届かず (engine/renderer が別 queue を掴んで
+        // client が frame 待ちでハングする)。代わりに token は exec 前に env へ載せる:
+        //   - `resoio launch` 経由: launcher が起動前に instance 固有 token を注入し、
+        //     engine と renderer (Wine 子プロセス) が同じ env を継承して queue を分離する。
+        //   - Gale / Steam 直接起動: 何も set されず、両側が IpcSocketPaths.QueueName の
+        //     固定デフォルト名に fallback して一致する (単一インスタンス)。
 
         // resolver は Core 型に触れる前に attach する必要があるため、ManualLogSource を
         // 直接渡し ILogSink を経由しない (上記 remarks 参照)。
diff --git a/python/tests/e2e/gale_launch.py b/python/tests/e2e/gale_launch.py
new file mode 100644
index 00000000..e2ef5da8
--- /dev/null
+++ b/python/tests/e2e/gale_launch.py
@@ -0,0 +1,219 @@
+"""E2E: a Gale / Steam direct launch (no injected queue env) still gets frames.
+
+Regression guard for the Camera IPC queue-agreement bug. When Resonite is
+started **directly from Gale or Steam** — not through ``resoio.launch`` — the
+ResoniteIO launcher never runs, so ``RESONITE_IO_CAMERA_QUEUE`` is **not**
+injected into the environment. The fix under test makes both the engine mod and
+the renderer plugin fall back to the *same fixed default queue name* in that
+case, so they still agree on one queue and Camera frames flow.
+
+The old, broken behaviour: with the env unset the engine self-generated a random
+token at runtime, which the renderer (a Wine child started independently) never
+inherited. The two then bound *different* /dev/shm IPC queues, the renderer
+delivered frames onto a queue nobody read, and ``CameraClient.shot`` hung
+forever (client freeze). So:
+
+    * one delivered Camera frame == the engine actually rendered AND the frame
+      travelled through the IPC queue to the renderer and back to us, which can
+      only happen if both ends bound the *same* queue. A single non-empty frame
+      is therefore proof of queue agreement.
+    * if this test hangs / times out instead, the engine and renderer are on
+      different queues again — either runtime self-generation crept back in or
+      the fixed-default fallback is broken on one side.
+
+To faithfully reproduce a Gale launch we cannot use ``resoio.launch`` (it now
+*always* injects a queue token). Instead we drive the launcher's own
+``_build_command`` with ``camera_queue=None`` — exactly the mod-loaded
+(non-vanilla) umu/doorstop chain Gale uses, minus the queue env — and PID-diff
+the engine + renderer into existence the same way ``launch`` does. We also pop
+``RESONITE_IO_CAMERA_QUEUE`` out of the child env defensively, so a value
+lingering in the container environment cannot mask a self-generation regression.
+
+Like ``tests/e2e/launcher.py`` and ``tests/e2e/multi_instance.py`` this manages
+Resonite's lifecycle itself (the no-env startup *is* the scenario), so it does
+**not** use the ``resonite_session`` fixture. ``RESONITE_EXE`` / ``MOD_PATH``
+come from the container environment (compose); the ``require_mod_deployed``
+autouse fixture skips when the mod is not deployed.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import glob
+import os
+import subprocess
+import time
+from datetime import datetime
+from pathlib import Path
+
+import numpy as np
+import psutil
+from PIL import Image
+
+from resoio import CameraClient, ConnectionClient, terminate
+from resoio._client import socket_path_for_pid
+from resoio.launcher import (
+    _CAMERA_QUEUE_ENV,
+    _build_command,
+    _find_engine_pids,
+    _find_renderer_pids,
+    _wait_for_new,
+)
+from tests.helpers import mark_e2e
+
+ARTIFACT_ROOT = Path(__file__).parent / "e2e_artifacts"
+SOCKET_DIR = Path.home() / ".resonite-io"
+
+_LAUNCH_TIMEOUT_S = 120.0
+_SOCKET_APPEAR_TIMEOUT_S = 120.0
+_KILL_TIMEOUT_S = 30.0
+_POLL_S = 1.0
+
+
+def _resonite_exe() -> str:
+    return os.environ.get("RESONITE_EXE", "/opt/resonite/Resonite.exe")
+
+
+def _install_dir() -> str:
+    return os.path.dirname(os.path.realpath(_resonite_exe()))
+
+
+def _mod_path() -> str:
+    return os.environ.get("MOD_PATH", "/workspace/gale")
+
+
+def _wait_for_pid_socket(pid: int, timeout_s: float) -> Path | None:
+    """Wait for the engine ``pid``'s conventional ``resonite-{pid}.sock``."""
+    target = Path(socket_path_for_pid(pid))
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if target.exists():
+            return target
+        time.sleep(_POLL_S)
+    return None
+
+
+async def _ping_and_shot(socket_path: Path, out_path: Path) -> np.ndarray:
+    """Ping the instance on its socket, then capture one Camera frame from it.
+
+    The ``shot`` is the load-bearing assertion: it only returns once a frame has
+    made the engine -> IPC queue -> renderer -> client round trip, so it hangs
+    (and the test times out) if the engine and renderer bound different queues.
+    """
+    async with ConnectionClient(socket_path=str(socket_path)) as conn:
+        await conn.ping("gale-launch")
+    async with CameraClient(socket_path=str(socket_path)) as cam:
+        frame = await cam.shot()
+    rgb = np.ascontiguousarray(frame.pixels[..., :3])
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    Image.fromarray(rgb, mode="RGB").save(out_path)
+    return rgb
+
+
+def _spawn_gale_like(install_dir: str) -> subprocess.Popen[bytes]:
+    """Start the mod-loaded umu/doorstop chain **without** a queue env token.
+
+    Mirrors a Gale / Steam direct launch: the same non-vanilla command
+    ``resoio.launch`` builds, except ``camera_queue=None`` so no
+    ``RESONITE_IO_CAMERA_QUEUE`` is injected. The env var is also popped from the
+    child environment defensively, so a value left over in the container cannot
+    hide a self-generation regression. Spawned detached like ``launch`` does.
+    """
+    argv, env, log_path = _build_command(
+        _resonite_exe(),
+        install_dir,
+        _mod_path(),
+        vanilla=False,
+        extra_args=(),
+        camera_queue=None,
+    )
+    # Faithful Gale launch: the queue env must be genuinely absent so the mod has
+    # to fall back to the fixed default queue name (the behaviour under test).
+    env.pop(_CAMERA_QUEUE_ENV, None)
+    assert _CAMERA_QUEUE_ENV not in env, (
+        f"{_CAMERA_QUEUE_ENV} must be unset to simulate a Gale launch"
+    )
+
+    stdout: object = subprocess.DEVNULL
+    if log_path is not None:
+        stdout = open(log_path, "ab")
+    try:
+        return subprocess.Popen(  # noqa: S603 - argv built from validated paths
+            argv,
+            cwd=install_dir,
+            env=env,
+            stdin=subprocess.DEVNULL,
+            stdout=stdout,  # pyright: ignore[reportArgumentType]
+            stderr=subprocess.STDOUT,
+            start_new_session=True,
+        )
+    finally:
+        if log_path is not None:
+            stdout.close()  # pyright: ignore[reportAttributeAccessIssue]
+
+
+class TestGaleLaunch:
+    @mark_e2e
+    def test_direct_gale_launch_without_queue_env_still_delivers_frames(self) -> None:
+        install = _install_dir()
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        out_dir = ARTIFACT_ROOT / f"gale_launch_{timestamp}"
+
+        # Clean slate: stop anything left over and drop stale sockets.
+        terminate()
+        for sock in glob.glob(str(SOCKET_DIR / "resonite-*.sock")):
+            Path(sock).unlink(missing_ok=True)
+
+        # Snapshot existing engine/renderer PIDs so _wait_for_new can pick out
+        # the ones this Gale-like launch spawns by set difference.
+        before_engines = set(_find_engine_pids(install))
+        before_renderers = set(_find_renderer_pids(install))
+
+        _spawn_gale_like(install)
+
+        deadline = time.monotonic() + _LAUNCH_TIMEOUT_S
+        resonite_pid = _wait_for_new(
+            lambda: _find_engine_pids(install),
+            before_engines,
+            "engine",
+            deadline,
+            _POLL_S,
+        )
+        renderer_pid = _wait_for_new(
+            lambda: _find_renderer_pids(install),
+            before_renderers,
+            "renderer",
+            deadline,
+            _POLL_S,
+        )
+        try:
+            print(f"gale-like launch: engine={resonite_pid} renderer={renderer_pid}")
+            assert resonite_pid > 0
+            assert renderer_pid > 0
+            assert resonite_pid != renderer_pid
+            assert psutil.pid_exists(resonite_pid)
+            assert psutil.pid_exists(renderer_pid)
+
+            # The engine binds its pid-named UDS once GrpcHost is up.
+            sock = _wait_for_pid_socket(resonite_pid, _SOCKET_APPEAR_TIMEOUT_S)
+            assert sock is not None, "engine never bound its UDS after Gale launch"
+
+            # The core assertion: a frame arrives even though no queue env was
+            # injected. One non-empty RGB frame == engine and renderer agreed on
+            # the (default) IPC queue; a hang here means they did not.
+            frame = asyncio.run(_ping_and_shot(sock, out_dir / "gale_launch.png"))
+            assert frame.shape[2] == 3
+            assert frame.size > 0
+        finally:
+            terminate(resonite_pid, renderer_pid)
+
+        # The host process table drains: both processes are gone.
+        deadline = time.monotonic() + _KILL_TIMEOUT_S
+        while time.monotonic() < deadline:
+            if not psutil.pid_exists(resonite_pid) and not psutil.pid_exists(
+                renderer_pid
+            ):
+                break
+            time.sleep(_POLL_S)
+        assert not psutil.pid_exists(resonite_pid)
+        assert not psutil.pid_exists(renderer_pid)