diff --git a/app/static/js/services/nativeBridgeService.js b/app/static/js/services/nativeBridgeService.js
index d7aec79..1643d19 100644
--- a/app/static/js/services/nativeBridgeService.js
+++ b/app/static/js/services/nativeBridgeService.js
@@ -86,12 +86,14 @@
      * 1. LOAD NEW INSTRUMENT INTO BRIDGE (VST3 / VST2 / SF2 / SF3 / SFZ)
      * instrumentType: 'VST3' | 'VST2' | 'SF2' | 'SF3' | 'SFZ'
      * channel: MIDI channel to assign this instrument to (A10 multi-instance).
+     * NOTE: sends a PANIC (all notes off) first so held notes never stick across a hot-swap.
      */
     loadInstrument: async function (filePath, instrumentType, channel) {
       this.activeInstrumentType = instrumentType;
       console.log('[BridgeService] Loading ' + instrumentType + ' asset: ' + filePath + ' ch=' + channel);
       if (!this._tauri()) return false;
       try {
+        await window.__TAURI__.core.invoke('transport_control', { kind: 'panic' });
         await window.__TAURI__.core.invoke('load_native_instrument', {
           path: filePath,
           instrumentType: INSTRUMENT_TYPE[instrumentType] !== undefined ? INSTRUMENT_TYPE[instrumentType] : 0,
diff --git a/app/templates/index.html b/app/templates/index.html
index d27d853..44ee2cd 100644
--- a/app/templates/index.html
+++ b/app/templates/index.html
@@ -39,7 +39,7 @@
     <script src="/static/js/services/storage.js?v=202608038200"></script>
     <script src="/static/js/services/soundfontStorage.js?v=202607271016"></script>
     <script src="/static/js/services/soundfontPlayer.js?v=202608101800"></script>
-    <script src="/static/js/services/nativeBridgeService.js?v=202608112200"></script>
+    <script src="/static/js/services/nativeBridgeService.js?v=202608141800"></script>
     <script src="/static/js/services/bridgeAudioNode.js?v=202608121700"></script>
     <script src="/static/js/services/unifiedMidiRouter.js?v=202608112200"></script>
     <script src="/static/js/services/audioRoutingEngine.js?v=202608112200"></script>
@@ -50,7 +50,7 @@
     <script src="/static/js/services/midiExtractor.js?v=202607281052"></script>
     <script src="/static/js/services/promptTemplateManager.js?v=202607281039"></script>
     <script src="/static/js/services/undoRedoEngine.js?v=202607290941"></script>
-    <script src="/static/js/app.precompiled.js?v=202608141030" defer></script>
+    <script src="/static/js/app.precompiled.js?v=202608141730" defer></script>
     <link rel="stylesheet" href="/static/css/styles.css?v=202607271016">
     <style>
         :root {
diff --git a/install/daw_vst_bridge.exe b/install/daw_vst_bridge.exe
index cebf116..91881a7 100644
Binary files a/install/daw_vst_bridge.exe and b/install/daw_vst_bridge.exe differ
diff --git a/native_bridge/_main_dump.txt b/native_bridge/_main_dump.txt
new file mode 100644
index 0000000..840183d
--- /dev/null
+++ b/native_bridge/_main_dump.txt
@@ -0,0 +1,1286 @@
+// native_bridge/src/main.cpp
+// Entry point of daw_vst_bridge.exe — opens shared memory created by the DAW
+// (Rust/Tauri side), runs the real-time MIDI->audio loop, watches the parent.
+#include "INativeInstrument.h"
+#include "SharedMemoryIPC.h"
+#include "NativeInstrumentEngine.h"
+
+#ifdef _WIN32
+#include <windows.h>
+#include <mmsystem.h>
+#include <process.h>
+#include <thread>
+#else
+#include <unistd.h>
+#include <cstdlib>
+#include <thread>
+#endif
+
+#include <chrono>
+#include <algorithm>
+#include <atomic>
+#include <cctype>
+#include <condition_variable>
+#include <cstring>
+#include <deque>
+#include <functional>
+#include <iostream>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <vector>
+
+// --- platform helpers -------------------------------------------------------
+static bool parent_alive(uint32_t pid) {
+#ifdef _WIN32
+    HANDLE h = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
+    if (!h) return false;
+    CloseHandle(h);
+    return true;
+#else
+    return pid == 0 || (kill(pid, 0) == 0);
+#endif
+}
+
+static void sleep_ms(uint32_t ms) {
+#ifdef _WIN32
+    Sleep(ms);
+#else
+    std::this_thread::sleep_for(std::chrono::milliseconds(ms));
+#endif
+}
+
+#ifdef _WIN32
+// Native VST editor windows registry — global de WM_DESTROY (chay tren worker
+// thread cua channel tao window) co the don map. USERDATA luu channel+1 (KHONG
+// luu con tro inst truc tiep: assign() thay inst moi moi lan load — con tro cu
+// bi huy → WM_DESTROY tren con tro dangling → crash/hang bridge).
+class ChannelWorker;  // fwd — WM_DESTROY posts closeGUI() to the channel worker
+static void post_close_gui(uint32_t ch, HWND hwnd);  // defined after ChannelWorker
+static std::string lower_plugin_path(uint32_t ch);      // defined after ChannelWorker
+static void unmute_if_not_closing(uint32_t y, const char* why);  // defined after ChannelWorker
+
+static InstrumentEngineManager* g_engine = nullptr;
+static std::mutex g_guiMutex;
+static std::map<uint32_t, void*> g_guiWindows;  // channel -> HWND (keep window alive)
+static std::map<HWND, uint32_t> g_hwndToCh;     // HWND -> channel (WM_DESTROY cleanup)
+static std::map<uint32_t, std::unique_ptr<ChannelWorker>>* g_workers = nullptr;
+// Same-plugin-DLL reentrancy guards: two threads inside one VST3 DLL (Nexus)
+// crash or deadlock. g_attachPaths = lowercase plugin paths whose reload/
+// createView is running on some worker — a same-path close job must not unmute
+// its channel mid-attach (the attach job owns the silence state until
+// attachView finishes). g_closeInFlight = channels whose close job
+// (closeGUI + destroy children + reload) is still inside createInstance —
+// unmuting them then would race the plugin teardown.
+static std::mutex g_attachMutex;
+static std::vector<std::string> g_attachPaths;
+static bool g_closeInFlight[16] = { false };
+// Editor-open predicate state: while a channel's VST editor is attached, EVERY
+// channel assigned the same plugin DLL path stays quiet (the worker pumps the
+// editor's window proc inside the DLL while the audio loop process()es other
+// instances of the same DLL - 2 threads in one DLL crashes Nexus on GUI clicks).
+// Count keyed by lowercased plugin path. The predicate runs on the audio thread
+// under the engine's mu_ - lock order mu_ -> g_editorMutex (never inverted).
+static std::mutex g_editorMutex;
+static std::map<std::string, int> g_editorPathCount;
+static std::string g_editorOpenPath[16];
+static bool g_editorOpen[16] = { false };
+
+// GUI attach state (CRASH FIX 0xc000041d): attachView MUST run on the MAIN
+// thread so the editor children created inside view->attached() are owned by
+// the same thread as the parent window (main pump). g_guiAttachPending = one
+// attach in flight per channel (dedupe OPEN_GUI); g_attachSilenced = the
+// same-path channels silenced by the worker job, restored by the kMsgAttach
+// handler after attach; g_editorDestroyAck = kMsgDestroy handshake for the
+// LOAD job (children are main-owned -> DestroyWindow must run on main).
+static bool g_guiAttachPending[16] = { false };
+static std::map<uint32_t, std::vector<uint32_t>> g_attachSilenced;
+static bool g_editorDestroyAck[16] = { false };
+static const UINT kMsgAttach = WM_APP + 1;
+static const UINT kMsgDestroy = WM_APP + 2;
+static std::mutex g_loadMutex;  // moved up: VstWindowProc handlers need it
+
+
+static LRESULT CALLBACK VstWindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
+    if (uMsg == WM_CLOSE) {
+        uint32_t ch = UINT32_MAX;
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            auto it = g_hwndToCh.find(hwnd);
+            if (it != g_hwndToCh.end()) ch = it->second;
+        }
+        if (ch != UINT32_MAX) {
+            // CRASH FIX (0xc000041d STATUS_FATAL_USER_CALLBACK_EXCEPTION /
+            // 0xc0000005 trong USER32, Event Log 9:47/10:20/10:22):
+            // KHONG de DefWindowProc DestroyWindow o day. Plugin editor la
+            // child cua window nay, tao TREN worker thread (view->attached()
+            // chay trong attach job) - DestroyWindow tren main thread pha huy
+            // child cross-thread -> crash USER32. Detach view tren worker
+            // (closeGUI), an window, GIU window trong registry de reuse.
+            post_close_gui(ch, hwnd);
+            ShowWindow(hwnd, SW_HIDE);
+            return 0;
+        }
+        // Window khong thuoc registry (chua dang ky) - de DefWindowProc huy.
+    } else if (uMsg == WM_DESTROY) {
+        // Chi xay ra khi window thuc su bi huy (khong con path chu dong nao
+        // DestroyWindow khi view dang attached). Xoa registry + detach view.
+        uint32_t ch = UINT32_MAX;
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            auto it = g_hwndToCh.find(hwnd);
+            if (it != g_hwndToCh.end()) ch = it->second;
+            g_hwndToCh.erase(hwnd);
+            for (auto it = g_guiWindows.begin(); it != g_guiWindows.end();) {
+                if (it->second == hwnd) it = g_guiWindows.erase(it);
+                else ++it;
+            }
+        }
+        if (ch != UINT32_MAX) post_close_gui(ch, hwnd);
+    } else if (uMsg == kMsgAttach) {
+        // Attach the editor view on the MAIN thread: view->attached() creates
+        // the editor children windows, and they must be owned by the SAME
+        // thread as the parent (this main pump). Attaching on the worker made
+        // children worker-owned while the parent was main-owned -> cross-
+        // thread parent/child -> USER32 0xc000041d (verified with gui_probe).
+        uint32_t ch = (uint32_t)wParam;
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            auto it = g_guiWindows.find(ch);
+            if (it != g_guiWindows.end() && it->second != hwnd) {
+                // Window replaced by a newer OPEN_GUI - stale attach, drop.
+                std::cerr << "[dbg] kMsgAttach ch=" << ch << " skipped (window replaced)" << std::endl;
+                g_guiAttachPending[ch] = false;
+                return 0;
+            }
+        }
+        auto* inst = g_engine ? g_engine->get(ch) : nullptr;
+        if (!inst || inst->hasAttachedView()) {
+            std::cerr << "[dbg] kMsgAttach ch=" << ch << " skipped (no instrument / view attached)" << std::endl;
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            g_guiAttachPending[ch] = false;
+            return 0;
+        }
+        std::vector<uint32_t> samePathSilenced;
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            auto it = g_attachSilenced.find(ch);
+            if (it != g_attachSilenced.end()) {
+                samePathSilenced = it->second;
+                g_attachSilenced.erase(it);
+            }
+        }
+        std::string gp = lower_plugin_path(ch);
+        bool ok = false;
+        {
+            // Serialize ALL plugin-DLL entry (createInstance AND createView)
+            // with other loads: two threads inside one DLL (Nexus) crash.
+            std::lock_guard<std::mutex> lg(g_loadMutex);
+            ok = inst->attachView(hwnd);
+        }
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            g_guiAttachPending[ch] = false;
+        }
+        if (!gp.empty()) {
+            std::lock_guard<std::mutex> lk(g_attachMutex);
+            auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
+            if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+        }
+        if (ok) {
+            // Editor is attached on this channel: register it globally so
+            // EVERY channel assigned the same plugin DLL path stays quiet
+            // for the whole editor-open duration (g_editorPathCount).
+            {
+                std::lock_guard<std::mutex> lk(g_editorMutex);
+                if (!gp.empty()) {
+                    g_editorOpen[ch] = true;
+                    g_editorOpenPath[ch] = gp;
+                    ++g_editorPathCount[gp];
+                }
+            }
+            std::cout << "[NativeBridge] GUI attached hwnd=" << hwnd
+                      << " plugin=" << gp << " ch=" << ch
+                      << " (channel muted while editor open)" << std::endl;
+        } else {
+            // Attach failed -> no editor running -> safe to process again.
+            g_engine->setReloading(ch, false);
+            std::cerr << "[NativeBridge] GUI attach FAILED hwnd=" << hwnd
+                      << " plugin=" << gp << std::endl;
+            PostMessageA(hwnd, WM_CLOSE, 0, 0);
+        }
+        // Restore same-path silence. Channels whose own close job is still
+        // inside createInstance stay muted - that job owns their unmute.
+        for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "openGUI");
+        return 0;
+    } else if (uMsg == kMsgDestroy) {
+        // LOAD job handshake: the editor children are main-owned - destroy
+        // them on THIS (main) thread, then acknowledge so the worker can
+        // assign() the new instrument.
+        uint32_t ch = (uint32_t)wParam;
+        if (auto* i = g_engine ? g_engine->get(ch) : nullptr) {
+            std::lock_guard<std::mutex> lg(g_loadMutex);
+            i->closeGUI();
+            while (HWND c = FindWindowExA(hwnd, nullptr, nullptr, nullptr))
+                DestroyWindow(c);
+            ShowWindow(hwnd, SW_HIDE);
+        }
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            g_editorDestroyAck[ch] = true;
+        }
+        return 0;
+    }
+    return DefWindowProcA(hwnd, uMsg, wParam, lParam);
+}
+#endif
+
+// Serialize plugin loads across channels: concurrent VST3 createInstance on
+// separate worker threads (Nexus) deadlocks inside the SDK factory - all
+// stuck forever (observed: 3 concurrent Nexus loads, zero assign returned).
+// One load at a time; SF2/SFZ loads are fast, contention negligible.
+#ifndef _WIN32
+static std::mutex g_loadMutex;
+#endif
+// Pending OPEN_GUI requests whose channel instrument was not loaded yet.
+// The main loop fulfils them as soon as the load job completes (assign ok),
+// so the GUI button works regardless of JS retry timing.
+static std::mutex g_pendingGuiMutex;
+static std::map<uint32_t, std::pair<void*, std::string>> g_pendingGui;
+
+// B9: native Win32 window for the VST editor (replaces the WebView2 surface —
+// the HTML window was drawn ON TOP of the plugin GUI). MUST be created on the
+// ChannelWorker thread so the worker's idle message pump services its messages.
+static void* create_native_vst_window(const char* title) {
+#ifdef _WIN32
+    static const char* kWndClass = "SonicForge_Native_VST3_Class";
+    static bool registered = false;
+    if (!registered) {
+        WNDCLASSA wc = {};
+        wc.lpfnWndProc = VstWindowProc;
+        wc.hInstance = GetModuleHandleA(nullptr);
+        wc.lpszClassName = kWndClass;
+        RegisterClassA(&wc);
+        registered = true;
+    }
+    HWND hwnd = CreateWindowExA(0, kWndClass, title ? title : "VST",
+                                WS_OVERLAPPEDWINDOW | WS_VISIBLE,
+                                CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+    return (void*)hwnd;
+#else
+    (void)title;
+    return nullptr;
+#endif
+}
+
+// Per-channel persistent worker: ONE thread owns the COM STA apartment for that
+// channel's instrument for its whole lifetime. loadPlugin and openGUI MUST run
+// on the same thread — if the loading thread exits, its apartment dies and
+// VST3 plugins that marshal internally (Nexus) hang forever in
+// view->attached(). Verified with gui_probe: `bridge_like` (load thread exits,
+// openGUI on another) hangs; `same_thread` (load+openGUI on one alive thread)
+// returns attached=OK.
+class ChannelWorker {
+public:
+    ChannelWorker() {
+        th_ = std::thread([this] {
+#ifdef _WIN32
+            OleInitialize(nullptr);
+#endif
+            std::unique_lock<std::mutex> lk(mu_);
+            for (;;) {
+                if (stop_ && jobs_.empty()) break;
+                if (!jobs_.empty()) {
+                    auto job = std::move(jobs_.front());
+                    jobs_.pop_front();
+                    lk.unlock();
+                    job();
+                    lk.lock();
+                    continue;
+                }
+                cv_.wait_for(lk, std::chrono::milliseconds(5));
+                // Pump THIS thread's message queue while idle — VST editor
+                // windows are created on this thread, their messages must be
+                // dispatched here or the editor freezes after attach.
+                lk.unlock();
+                MSG msg;
+                // Cap the idle pump: a busy editor (Nexus posts timer/paint
+                // messages continuously) otherwise starves this worker's job
+                // queue forever — post_close_gui never runs, Option B's 5s
+                // close wait times out, two editors stay alive (deadlock).
+                for (int pumped = 0; pumped < 16; ++pumped) {
+                    if (!PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) break;
+                    TranslateMessage(&msg);
+                    DispatchMessageW(&msg);
+                }
+                lk.lock();
+            }
+#ifdef _WIN32
+            OleUninitialize();
+#endif
+        });
+    }
+    ~ChannelWorker() {
+        {
+            std::lock_guard<std::mutex> lk(mu_);
+            stop_ = true;
+        }
+        cv_.notify_all();
+        if (th_.joinable()) th_.join();
+    }
+    void post(std::function<void()> job) {
+        {
+            std::lock_guard<std::mutex> lk(mu_);
+            jobs_.push_back(std::move(job));
+        }
+        cv_.notify_all();
+    }
+
+private:
+    std::thread th_;
+    std::mutex mu_;
+    std::condition_variable cv_;
+    std::deque<std::function<void()>> jobs_;
+    bool stop_ = false;
+};
+
+// --- same-plugin-DLL silence helpers ----------------------------------------
+// Two threads inside one VST3 DLL (Nexus) crash/deadlock: the audio loop's
+// process() on one instance must not race createInstance/createView/terminate
+// on another. Windows plugin paths are case-insensitive — compare lowercased.
+static std::string lower_path_str(std::string p) {
+    std::transform(p.begin(), p.end(), p.begin(),
+                   [](unsigned char c) { return (char)::tolower(c); });
+    return p;
+}
+
+static std::string lower_plugin_path(uint32_t ch) {
+    return g_engine ? lower_path_str(g_engine->pathOf(ch)) : std::string();
+}
+
+// Channels (other than ch) currently assigned the same plugin DLL path.
+static std::vector<uint32_t> same_plugin_channels(uint32_t ch) {
+    std::vector<uint32_t> out;
+    std::string p = lower_plugin_path(ch);
+    if (p.empty()) return out;
+    for (uint32_t y = 0; y < 16; ++y) {
+        if (y == ch) continue;
+        if (!g_engine->get(y)) continue;
+        if (lower_plugin_path(y) == p) out.push_back(y);
+    }
+    return out;
+}
+
+static bool close_in_flight(uint32_t ch) {
+    std::lock_guard<std::mutex> lk(g_attachMutex);
+    return g_closeInFlight[ch];
+}
+
+// Unmute y unless its own close job is still inside createInstance — that job
+// performs the unmute once its fresh instance is loaded (or, if an attach for
+// the same plugin is in flight, the attach job's restore does it).
+static void unmute_if_not_closing(uint32_t y, const char* why) {
+    if (close_in_flight(y)) {
+        std::cerr << "[dbg] " << why << ": ch=" << y
+                  << " close job still in flight - close job unmutes" << std::endl;
+        return;
+    }
+    g_engine->setReloading(y, false);
+    std::cerr << "[dbg] " << why << ": restored ch=" << y << std::endl;
+}
+
+// closeGUI() MUST run on the channel worker thread (its COM STA apartment) —
+// the view was attached there. Calling view->removed() from the main thread
+// (WM_DESTROY handler) is a cross-apartment COM call that corrupts the plugin;
+// Nexus then hangs on the NEXT view->attached(). Erase the registry inside the
+// job so Option B (closing another editor before attach) waits for closeGUI to
+// actually finish.
+static void post_close_gui(uint32_t ch, HWND hwnd) {
+    // Runs on the MAIN thread (VstWindowProc WM_CLOSE/WM_DESTROY). The
+    // editor children are main-owned now (attachView runs on the main pump),
+    // so closeGUI + child destroy + hide all happen here on the owning
+    // thread; only the fresh-instance reload (createInstance ~2s, must live
+    // in the channel COM STA apartment) is posted to the channel worker.
+    {
+        std::lock_guard<std::mutex> lock(g_guiMutex);
+        auto it = g_guiWindows.find(ch);
+        if (it != g_guiWindows.end() && it->second != hwnd) {
+            std::cerr << "[dbg] closeGUI ch=" << ch << " skipped (window replaced)" << std::endl;
+            return;
+        }
+    }
+    std::cerr << "[dbg] closeGUI ch=" << ch << " start" << std::endl;
+    g_engine->setReloading(ch, true);
+    // Close-in-flight: until the fresh instance is loaded, no other job may
+    // unmute this channel (its plugin is being torn down).
+    {
+        std::lock_guard<std::mutex> lk(g_attachMutex);
+        g_closeInFlight[ch] = true;
+    }
+    // Silence same-plugin channels: no second thread may enter this DLL
+    // while closeGUI/createInstance runs (2 threads in one DLL -> Nexus
+    // exits silently, observed in probes).
+    std::vector<uint32_t> sp = same_plugin_channels(ch);
+    for (uint32_t y : sp) {
+        g_engine->setReloading(y, true);
+        std::cerr << "[dbg] closeGUI: silenced same-plugin ch=" << y
+                  << " during reload ch=" << ch << std::endl;
+    }
+    if (auto* i = g_engine->get(ch)) {
+        {
+            // closeGUI nulls the view WITHOUT view->removed() (Nexus removed()
+            // deadlocks). Destroying the editor windows runs the plugin
+            // window proc on this (main) thread; it must not race another
+            // thread createInstance/createView of the same DLL.
+            std::lock_guard<std::mutex> lg(g_loadMutex);
+            i->closeGUI();
+#ifdef _WIN32
+            if (hwnd && IsWindow(hwnd)) {
+                while (HWND c = FindWindowExA(hwnd, nullptr, nullptr, nullptr))
+                    DestroyWindow(c);
+            }
+            ShowWindow(hwnd, SW_HIDE);
+#endif
+        }
+        // Rebuild a fresh instance on the channel worker (its COM STA
+        // apartment is alive); reload() == terminate + loadPlugin
+        // (createInstance). Serialized with other loads by g_loadMutex.
+        ChannelWorker* w = nullptr;
+        if (g_workers) {
+            auto wit = g_workers->find(ch);
+            if (wit != g_workers->end()) w = wit->second.get();
+        }
+        if (w) {
+            w->post([ch, sp]() {
+                bool reloadOk = false;
+                {
+                    std::lock_guard<std::mutex> lg(g_loadMutex);
+                    if (auto* i = g_engine->get(ch)) reloadOk = i->reload();
+                }
+                std::cerr << "[dbg] closeGUI ch=" << ch << " reload="
+                          << (reloadOk ? 1 : 0) << std::endl;
+                // Editor is closed: drop the global editor-open state so the
+                // same-plugin channels render again. (This channel is still
+                // silenced by its reloading flag until the restore below.)
+                {
+                    std::lock_guard<std::mutex> lk(g_editorMutex);
+                    if (g_editorOpen[ch]) {
+                        g_editorOpen[ch] = false;
+                        std::string pth = g_editorOpenPath[ch];
+                        g_editorOpenPath[ch].clear();
+                        if (!pth.empty()) {
+                            auto it = g_editorPathCount.find(pth);
+                            if (it != g_editorPathCount.end() && --it->second <= 0)
+                                g_editorPathCount.erase(it);
+                        }
+                    }
+                }
+                // createInstance is done: unmuting is safe again. But if an
+                // attach for the SAME plugin path is still running (its
+                // createView must not race process() on any same-path
+                // channel), leave the silence in place - the attach job
+                // restore unmutes everything once attachView finished.
+                {
+                    std::lock_guard<std::mutex> lk(g_attachMutex);
+                    g_closeInFlight[ch] = false;
+                }
+                bool pathBusy = false;
+                {
+                    std::lock_guard<std::mutex> lk(g_attachMutex);
+                    std::string p = lower_plugin_path(ch);
+                    pathBusy = !p.empty() &&
+                               std::find(g_attachPaths.begin(), g_attachPaths.end(), p) != g_attachPaths.end();
+                }
+                if (pathBusy) {
+                    std::cerr << "[dbg] closeGUI ch=" << ch
+                              << ": attach in flight for same plugin - leaving silenced (attach restore unmutes)"
+                              << std::endl;
+                } else {
+                    for (uint32_t y : sp) unmute_if_not_closing(y, "closeGUI");
+                    g_engine->setReloading(ch, false);
+                }
+            });
+            return;
+        }
+    }
+    // Instrument already gone / no worker - nothing to rebuild: drop the
+    // editor-open state and unmute.
+    {
+        std::lock_guard<std::mutex> lk(g_editorMutex);
+        if (g_editorOpen[ch]) {
+            g_editorOpen[ch] = false;
+            std::string pth = g_editorOpenPath[ch];
+            g_editorOpenPath[ch].clear();
+            if (!pth.empty()) {
+                auto it = g_editorPathCount.find(pth);
+                if (it != g_editorPathCount.end() && --it->second <= 0)
+                    g_editorPathCount.erase(it);
+            }
+        }
+    }
+    for (uint32_t y : sp) unmute_if_not_closing(y, "closeGUI");
+    g_engine->setReloading(ch, false);
+    {
+        std::lock_guard<std::mutex> lk(g_attachMutex);
+        g_closeInFlight[ch] = false;
+    }
+}
+
+int main(int argc, char* argv[]) {
+    std::cout << "[NativeBridge] Starting DAW Host Bridge Engine..." << std::endl;
+
+    // 1. Shared memory name: argv --shm <name> | env SF_SHM_NAME | default
+    std::string shmName = "SonicForge_DAW_IPC";
+    for (int i = 1; i + 1 < argc; ++i) {
+        if (std::strcmp(argv[i], "--shm") == 0) shmName = argv[i + 1];
+    }
+    if (const char* e = std::getenv("SF_SHM_NAME")) shmName = e;
+
+    // Parent watchdog PID (set by Tauri sidecar spawner)
+    uint32_t parentPid = 0;
+    if (const char* e = std::getenv("SF_PARENT_PID")) parentPid = (uint32_t)std::atoi(e);
+
+    // V8 bug 2: watchdog THREAD rieng - main loop chi check parent_alive giua
+    // cac block; neu VST process() chan loop thi khong bao gio thoat -> orphan.
+    // Thread nay chay doc lap, parent chet -> TerminateProcess ngay. Kem
+    // start-time check chong PID reuse (OpenProcess tra handle cua process
+    // khac chiem lai PID -> tuong parent con song mai).
+    if (parentPid != 0) {
+        std::thread([parentPid]() {
+            auto proc_birth = [](HANDLE h) -> uint64_t {
+                FILETIME c, e, k, u;
+                if (GetProcessTimes(h, &c, &e, &k, &u))
+                    return (uint64_t(c.dwHighDateTime) << 32) | c.dwLowDateTime;
+                return 0;
+            };
+            uint64_t birth = 0;
+            {
+                HANDLE h = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, parentPid);
+                if (h) { birth = proc_birth(h); CloseHandle(h); }
+            }
+            for (;;) {
+                Sleep(2000);
+                HANDLE h = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, parentPid);
+                if (!h) { TerminateProcess(GetCurrentProcess(), 0); return; }
+                uint64_t nowBirth = proc_birth(h);
+                CloseHandle(h);
+                if (birth != 0 && nowBirth != 0 && nowBirth != birth) {
+                    TerminateProcess(GetCurrentProcess(), 0); return;
+                }
+            }
+        }).detach();
+    }
+
+#ifdef _WIN32
+    // Real-time-ish timing: 1ms scheduler resolution
+    timeBeginPeriod(1);
+    HANDLE hMapFile = OpenFileMappingA(FILE_MAP_ALL_ACCESS, FALSE, shmName.c_str());
+    if (!hMapFile) {
+        std::cerr << "[NativeBridge] Failed to open Shared Memory mapping: " << shmName << std::endl;
+        return 1;
+    }
+    auto* shmIPC = (SharedAudioBufferIPC*)MapViewOfFile(hMapFile, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(SharedAudioBufferIPC));
+    if (!shmIPC) { CloseHandle(hMapFile); return 1; }
+#else
+    (void)shmName; // POSIX shm mapping (shm_open) added when porting off Windows
+    auto* shmIPC = (SharedAudioBufferIPC*)std::calloc(1, sizeof(SharedAudioBufferIPC));
+    if (!shmIPC) return 1;
+#endif
+
+    InstrumentEngineManager instruments;
+    // Editor-open predicate: channels whose plugin DLL has an attached editor
+    // stay quiet (channelQuiet in the engine) for the whole editor-open
+    // duration -- derived from the global editor count, so the restore loops
+    // below that unmute after attach/load become harmless no-ops.
+    instruments.setEditorOpenPredicate([](const std::string& lp) {
+        std::lock_guard<std::mutex> lk(g_editorMutex);
+        auto it = g_editorPathCount.find(lp);
+        return it != g_editorPathCount.end() && it->second > 0;
+    });
+#ifdef _WIN32
+    g_engine = &instruments;
+#endif
+    // Per-channel persistent workers: loadPlugin + openGUI run on the SAME
+    // thread whose COM STA apartment stays alive for the channel's lifetime
+    // (see ChannelWorker comment — a dead apartment hangs Nexus attached()).
+    std::map<uint32_t, std::unique_ptr<ChannelWorker>> workers;
+    g_workers = &workers;
+    // B9: native editor windows per channel — keep alive (HWND outlives the job).
+    // Registry la global (g_guiWindows) — WM_DESTROY cleanup can tu VstWindowProc.
+    // B8: sample rate from the DAW (Rust spawns us with SF_SAMPLE_RATE).
+    // Block size is fixed by the SHM layout (AUDIO_BLOCK_SIZE) — SF_BLOCK_SIZE
+    // is accepted but must match, otherwise warned and ignored.
+    double sampleRate = 44100.0;
+    if (const char* e = std::getenv("SF_SAMPLE_RATE")) {
+        double sr = (double)std::atoi(e);
+        if (sr > 0) sampleRate = sr;
+    }
+    if (const char* e = std::getenv("SF_BLOCK_SIZE")) {
+        uint32_t b = (uint32_t)std::atoi(e);
+        if (b != AUDIO_BLOCK_SIZE)
+            std::cerr << "[NativeBridge] SHM block size fixed at " << AUDIO_BLOCK_SIZE
+                      << " (SF_BLOCK_SIZE=" << b << " ignored)" << std::endl;
+    }
+    const uint32_t block = AUDIO_BLOCK_SIZE;
+    uint64_t playheadSamples = 0;
+    // V8 bug 3: khi STOP da xu ly, bo qua NOTE_ON (velocity>0) den sau - JS
+    // note-on timer co the bay toi sau STOP (guardPlay tre do React re-render)
+    // -> retrigger note -> VST loop am. Chi PLAY moi nhan note-on lai.
+    bool transportStopped = false;
+
+    auto dispatch = [&](const SharedAudioBufferIPC::MidiEventIPC& evt) {
+        // CRASH FIX: go through the manager, which holds mu_ for the WHOLE call
+        // (lookup + reloading check + instrument call). Direct get() then
+        // lock-free method calls raced assign() — the worker swapped the map and
+        // destroyed the old instance right after releasing mu_, so a playing
+        // channel loading another VSTi crashed the bridge (use-after-free).
+        // Unassigned and reloading channels are dropped inside the manager.
+        switch (evt.command) {
+            case 0x9:
+                // sampleOffset LUON LUON = 0 khi den day: events duoc dispatch ngay
+                // truoc segment chua no (A11 splitting), nen offset tuong doi la 0.
+                // Truyen offset tuyet doi truoc day lam sfizz/VST3 trigger tre.
+                if (evt.velocity > 0) {
+                    if (transportStopped) return; // V8 bug 3: drop note-on sau STOP
+                    instruments.noteOn(evt.channel, evt.pitch, evt.velocity / 127.0f);
+                } else
+                    instruments.noteOff(evt.channel, evt.pitch);
+                break;
+            case 0x8:
+                instruments.noteOff(evt.channel, evt.pitch);
+                break;
+            case 0xB: // CC: controller number in pitch, value in data2
+                // V9 bug 4: sau STOP, drop sustain-down (CC64>0) — JS co the
+                // gui CC64 xuong sau STOP (note-on/CC timer tre); VSTi giu
+                // note khi pedal down -> am treo loop. CC64=0 (sustain-up)
+                // van cho qua.
+                if (transportStopped && evt.pitch == 64 && evt.data2 > 0) return;
+                instruments.controlChange(evt.channel, evt.pitch, evt.data2);
+                break;
+            case 0xC: // program change: program in data2
+                instruments.programChange(evt.channel, evt.data2);
+                break;
+            case 0xE: // 14-bit pitch bend: data2 = LSB, data3 = MSB
+                instruments.pitchBend(evt.channel, evt.data2 | (uint32_t(evt.data3) << 7));
+                break;
+            default: break;
+        }
+    };
+
+    // Render only [from, to) of the block — used by sample-accurate splitting.
+    auto renderSegment = [&](uint32_t from, uint32_t to) {
+        if (to <= from) return;
+        instruments.renderAll(shmIPC->masterLeft + from, shmIPC->masterRight + from, to - from);
+    };
+
+    double blockDurationMs = (double)block / sampleRate * 1000.0;
+    auto startTime = std::chrono::steady_clock::now();
+    uint64_t blockCount = 0;
+
+    // OPEN_GUI handling - shared by the control queue and the pending-GUI
+    // sweep. Gate on the MAIN thread before creating a window: instrument
+    // load is ASYNC (worker thread); OPEN_GUI too early would attach to an
+    // empty channel and leave a blank window. Not loaded yet => remember the
+    // request; the sweep retries once the load job completes. Window MUST
+    // belong to the MAIN thread (audio loop pump dispatches its messages);
+    // a window on a worker whose pump is idle during jobs hangs
+    // view->attached() (gui_probe: two_workers_close TIMEOUT). The attach
+    // job runs on the channel worker (COM STA apartment stays alive).
+    auto handleOpenGui = [&](uint32_t guiCh, uintptr_t arg1, const std::string& pluginId) {
+        if (!instruments.get(guiCh)) {
+            std::cerr << "[NativeBridge] GUI deferred ch=" << guiCh
+                      << " plugin=" << pluginId << " (no instrument yet) - queued" << std::endl;
+            std::lock_guard<std::mutex> lock(g_pendingGuiMutex);
+            g_pendingGui[guiCh] = { (void*)arg1, pluginId };
+            return;
+        }
+        // Dedupe OPEN_GUI spam (frontend openVstGuiRetry): view dang
+        // attached -> GUI da mo, khong post attach job lan nua. Re-attach
+        // tren view dang attached lam plugin loi (Nexus createView null).
+        if (auto* i0 = instruments.get(guiCh)) {
+            if (i0->hasAttachedView()) {
+                std::cerr << "[dbg] openGUI: view already attached ch=" << guiCh
+                          << " — skip" << std::endl;
+                return;
+            }
+        }
+        if (!workers[guiCh]) workers[guiCh] = std::make_unique<ChannelWorker>();
+        void* hwnd = (void*)arg1;
+#ifdef _WIN32
+        // Window PHAI thuoc MAIN thread (audio loop pump nay dispatch
+        // messages cua no moi vong lap). Tao/cap nhat window ngay tai day.
+        HWND nativeHwnd = nullptr;
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            auto it = g_guiWindows.find(guiCh);
+            if (it != g_guiWindows.end()) nativeHwnd = (HWND)it->second;
+        }
+        if (hwnd == 0) {
+            if (nativeHwnd && IsWindow(nativeHwnd)) {
+                hwnd = (void*)nativeHwnd;
+                SetWindowTextA(nativeHwnd, pluginId.c_str());
+                ShowWindow(nativeHwnd, SW_SHOW);
+                SetForegroundWindow(nativeHwnd);
+                // Reuse: cap nhat USERDATA (channel+1) - inst CU da bi thay
+                // the boi assign() -> WM_DESTROY sau nay lookup inst MOI.
+                SetWindowLongPtrA(nativeHwnd, GWLP_USERDATA, (LONG_PTR)(guiCh + 1));
+            } else {
+                nativeHwnd = (HWND)create_native_vst_window(pluginId.c_str());
+                if (!nativeHwnd) {
+                    std::cerr << "[NativeBridge] GUI create window FAILED plugin=" << pluginId << std::endl;
+                    return;
+                }
+                {
+                    std::lock_guard<std::mutex> lock(g_guiMutex);
+                    g_guiWindows[guiCh] = nativeHwnd;      // keep window alive
+                    g_hwndToCh[nativeHwnd] = guiCh;       // WM_DESTROY cleanup
+                }
+                SetWindowLongPtrA(nativeHwnd, GWLP_USERDATA, (LONG_PTR)(guiCh + 1));
+                hwnd = (void*)nativeHwnd;
+            }
+        }
+#endif
+#ifdef _WIN32
+        // Dedupe: one attach in flight per channel (frontend openVstGuiRetry
+        // spam). Cleared by the worker job early returns and by the
+        // main-thread kMsgAttach handler.
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            if (g_guiAttachPending[guiCh]) {
+                std::cerr << "[dbg] openGUI: attach already pending ch=" << guiCh
+                          << " - skip" << std::endl;
+                return;
+            }
+            g_guiAttachPending[guiCh] = true;
+        }
+#endif
+        workers[guiCh]->post([&instruments, guiCh, hwnd, arg2 = pluginId]() {
+
+
+            if (!instruments.get(guiCh)) {
+                std::cerr << "[NativeBridge] GUI attach FAILED hwnd=" << hwnd
+                          << " plugin=" << arg2 << " ch=" << guiCh << " (no instrument loaded)" << std::endl;
+#ifdef _WIN32
+                {
+                    std::lock_guard<std::mutex> lock(g_guiMutex);
+                    g_guiAttachPending[guiCh] = false;
+                }
+#endif
+                return;
+
+
+            }
+            std::cerr << "[dbg] openGUI thread start hwnd=" << hwnd
+                      << " plugin=" << arg2 << " ch=" << guiCh << std::endl;
+            if (auto* inst0 = instruments.get(guiCh)) {
+                if (inst0->hasAttachedView()) {
+                    std::cerr << "[dbg] openGUI: view already attached ch=" << guiCh
+                              << " — skip" << std::endl;
+#ifdef _WIN32
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_guiAttachPending[guiCh] = false;
+                    }
+#endif
+                    return;
+
+
+                }
+            }
+#ifdef _WIN32
+            // Option B: chi 1 editor VST mo tai 1 thoi diem toan
+            // bridge. Instance thu 2 cua CUNG plugin (Nexus) attach
+            // view o apartment/worker khac -> treo. Dong editor cua
+            // channel khac TRUOC khi attach: WM_CLOSE -> main pump
+            // destroy window -> WM_DESTROY -> closeGUI() + xoa registry.
+            // Chay tren worker job de khong stall writeIndex cua real-time
+            // loop. CRASH FIX: silence moi channel TRUOC khi dong editor
+            // cua no (view->removed() tren worker cung luc process() tren
+            // audio loop = 2 thread trong 1 plugin -> crash USER32).
+            {
+                std::vector<uint32_t> others;
+                bool abortAttach = false;
+                {
+                    std::lock_guard<std::mutex> lock(g_guiMutex);
+                    for (const auto& kv : g_guiWindows)
+                        if (kv.first != guiCh) others.push_back(kv.first);
+                }
+                for (uint32_t y : others) {
+                    // Skip channels whose editor already detached (close job
+                    // finished): do not WM_CLOSE a hidden reused window, do
+                    // not re-silence a channel that is already unmuted.
+                    if (auto* yi0 = instruments.get(y)) {
+                        if (!yi0->hasAttachedView()) {
+                            std::cerr << "[dbg] openGUI: ch=" << y
+                                      << " editor already detached - skip"
+                                      << std::endl;
+                            continue;
+                        }
+                    }
+                    HWND yHwnd = nullptr;
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        auto it = g_guiWindows.find(y);
+                        if (it != g_guiWindows.end()) yHwnd = (HWND)it->second;
+                    }
+                    if (!yHwnd || !IsWindow(yHwnd)) continue;
+                    if (instruments.get(y)) {
+                        instruments.setReloading(y, true);
+                        std::cerr << "[dbg] openGUI: silenced ch=" << y
+                                  << " while closing its editor (before attach ch="
+                                  << guiCh << ")" << std::endl;
+                    }
+                    PostMessage(yHwnd, WM_CLOSE, 0, 0);
+                    std::cerr << "[dbg] openGUI: closing editor ch=" << y
+                              << " before attach ch=" << guiCh << std::endl;
+                    // WM_CLOSE -> VstWindowProc -> post_close_gui -> closeGUI()
+                    // tren worker cua channel y. Doi cho view da detach (window
+                    // duoc giu lai de reuse, khong doi registry erase nhu cu).
+                    bool closed = false;
+                    // The close job = closeGUI + destroy children + fresh
+                    // reload (createInstance, ~2s for Nexus). hasAttachedView
+                    // flips false after closeGUI only - ALSO wait for the
+                    // close job to finish entirely (close_in_flight): the
+                    // attach must not run createView while another thread is
+                    // still inside this plugin DLL (2 threads in one DLL ->
+                    // Nexus exits silently, observed in probes).
+                    for (int i = 0; i < 500; ++i) {  // 5s budget
+                        auto* yi = instruments.get(y);
+                        bool detached = !yi || !yi->hasAttachedView();
+                        if (detached && !close_in_flight(y)) { closed = true; break; }
+                        Sleep(10);
+                    }
+                    if (closed) {
+                        // Editor detached and its close job finished; the
+                        // close job unmutes the channel itself. Do NOT reset
+                        // reloading here - the close job owns the silence state.
+                        std::cerr << "[dbg] openGUI: restored ch=" << y
+                                  << " after editor close" << std::endl;
+                    } else {
+                        std::cerr << "[dbg] openGUI: editor ch=" << y
+                                  << " close job not finished in 5s, aborting attach ch=" << guiCh
+                                  << std::endl;
+                        abortAttach = true;
+                        break;
+                    }
+                }
+                if (abortAttach) {
+                    // A close job is stuck; do NOT createView (would race the
+                    // plugin DLL). Unmute what we silenced (skips channels
+                    // whose close job is still in flight - that job unmutes
+                    // them when it finishes).
+                    for (uint32_t y : others) unmute_if_not_closing(y, "openGUI-abort");
+                    std::cerr << "[dbg] openGUI: attach aborted ch=" << guiCh << std::endl;
+#ifdef _WIN32
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_guiAttachPending[guiCh] = false;
+                    }
+#endif
+                    return;
+
+
+                }
+            }
+#else
+            (void)0;
+#endif
+            if (auto* inst = instruments.get(guiCh)) {
+                // Reopen sau khi dong: reload() (terminate + loadPlugin)
+                // PHAI chay tren worker thread nay - COM STA apartment
+                // cua channel song o day. view->attached() cung chay o
+                // day; window thuoc main thread nen main pump (audio
+                // loop) dispatch messages cua no - khong can pump worker.
+                // Chan UAF bang flag reloading_ (set/clear duoi engine
+                // mutex; renderAll giu mutex khi process).
+                // CRASH FIX (0xc000041d USER32 while playing): keep THIS
+                // channel silenced for the whole time its editor is attached.
+                // The worker pumps the plugin's editor windows -> the plugin's
+                // window proc runs on this worker thread while the audio loop
+                // calls processor->process() on the SAME instance (two threads
+                // inside one DLL) -> Nexus crashes ~1-2s after attach during
+                // playback. Muting the channel while the editor is open is the
+                // deterministic trade-off (track silent while GUI visible);
+                // restored when the editor closes (post_close_gui / LOAD).
+                // STALL/CRASH FIX (Fix C, restored): silence EVERY channel
+                // assigned the SAME plugin DLL path for the reload+attach
+                // duration — the audio loop must not process() another
+                // instance of this DLL while createInstance/createView runs
+                // on this worker (2 threads in one DLL -> Nexus exits
+                // silently, observed in probes). Iterate ALL 16 channels, not
+                // just window-owning ones: session-restore instances without
+                // a window are live and renderable.
+                std::vector<uint32_t> samePathSilenced;
+                std::string gp = lower_plugin_path(guiCh);
+                if (!gp.empty()) {
+                    // Flush held notes BEFORE muting: these channels stay muted
+                    // for the whole editor-open duration and the manager drops
+                    // MIDI for quiet channels -- notes held at mute time would
+                    // otherwise resume stuck after the editor closes. The
+                    // manager's dispatch holds mu_ (serialized vs the audio
+                    // loop); g_loadMutex serializes vs other workers' DLL entry.
+                    std::lock_guard<std::mutex> lg(g_loadMutex);
+                    for (uint32_t y = 0; y < 16; ++y) {
+                        if (y == guiCh) continue;
+                        if (!instruments.get(y)) continue;
+                        if (lower_plugin_path(y) == gp) {
+                            for (uint32_t n = 0; n < 128; ++n)
+                                instruments.noteOff(y, n);
+                            instruments.setReloading(y, true);
+                            samePathSilenced.push_back(y);
+                            std::cerr << "[dbg] openGUI: silenced same-plugin ch=" << y
+                                      << " during attach ch=" << guiCh << std::endl;
+                        }
+                    }
+                }
+                instruments.setReloading(guiCh, true);
+                // Register attach-in-flight: a same-path close job must not
+                // unmute its channel while createView runs here (it stays
+                // silenced; this job's restore unmutes it at the end).
+                {
+                    std::lock_guard<std::mutex> lk(g_attachMutex);
+                    if (!gp.empty()) g_attachPaths.push_back(gp);
+                }
+                // Attach now happens on the MAIN thread (kMsgAttach): the
+                // editor children created inside view->attached() must be
+                // owned by the same thread as the parent window (main pump).
+                // Attaching on the worker made children worker-owned while
+                // the parent was main-owned -> cross-thread parent/child ->
+                // USER32 0xc000041d (verified with gui_probe). Only
+                // reloadForGUI stays here: it may createInstance (~2s on the
+                // hasAttachedOnce reopen path) and must run on this worker
+                // COM STA apartment.
+                bool reloadOk = false;
+                {
+                    // Serialize ALL plugin-DLL entry (createInstance AND
+                    // createView) with other loads: two threads inside one
+                    // DLL (Nexus) crash.
+                    std::lock_guard<std::mutex> lg(g_loadMutex);
+                    reloadOk = inst->reloadForGUI();
+                }
+#ifdef _WIN32
+                if (!reloadOk || !IsWindow((HWND)hwnd)) {
+#else
+                if (!reloadOk) {
+#endif
+                    // No editor running -> safe to process again.
+                    for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "openGUI");
+                    instruments.setReloading(guiCh, false);
+                    {
+                        std::lock_guard<std::mutex> lk(g_attachMutex);
+                        if (!gp.empty()) {
+                            auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
+                            if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+                        }
+                    }
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_guiAttachPending[guiCh] = false;
+                    }
+                    std::cerr << "[NativeBridge] GUI attach FAILED hwnd=" << hwnd
+                              << " plugin=" << arg2 << std::endl;
+#ifdef _WIN32
+                    // Attach khong co view (VD: SF2/SFZ hoac plugin loi).
+                    // Dong ngay cua so vo nghia de khong con window treo.
+                    PostMessageA((HWND)hwnd, WM_CLOSE, 0, 0);
+#endif
+                } else {
+#ifdef _WIN32
+                    // Stash the same-path silenced set for the main-thread
+                    // kMsgAttach handler, then ask it to attach (message, not
+                    // direct call: the window proc runs on the main pump).
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_attachSilenced[guiCh] = samePathSilenced;
+                    }
+                    PostMessageW((HWND)hwnd, kMsgAttach, (WPARAM)guiCh, 0);
+#else
+                    // No native window on non-Windows: direct attach (null
+                    // parent) fails -> restore the silenced channels.
+                    if (!inst->attachView(hwnd)) {
+                        for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "openGUI");
+                        instruments.setReloading(guiCh, false);
+                        std::lock_guard<std::mutex> lk(g_attachMutex);
+                        if (!gp.empty()) {
+                            auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
+                            if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+                        }
+                    }
+#endif
+                }
+            }
+
+        });
+    };
+
+    // 2. REAL-TIME AUDIO PROCESSING ENGINE LOOP
+    while (true) {
+#ifdef _WIN32
+        // Message pump: VST editors (Nexus, JUCE-based...) block inside
+        // view->attached() until the host dispatches messages — openGUI runs
+        // on a worker thread, so THIS loop must pump concurrently (verified
+        // with gui_probe: worker-thread openGUI + concurrent pump → attached
+        // returns kResultOk; without it → hangs forever).
+        MSG msg;
+        int pumpedMain = 0;
+        while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+            TranslateMessage(&msg);
+            DispatchMessageW(&msg);
+            ++pumpedMain;
+        }
+#endif
+        // A. Control events — non-rt safe, drained first
+        for (uint32_t i = 0; i < shmIPC->controlQueueCount; ++i) {
+            const auto& c = shmIPC->controlQueue[i];
+            if (c.type == 2) { // LOAD_INSTRUMENT (A10: assign per MIDI channel)
+                // Robust path length: do not trust arg1 (Rust passes 0 for LOAD).
+                // Chay tren persistent worker thread cua channel: VST3 init
+                // (loadPlugin) co the mat giay — chay dong bo tren audio loop
+                // lam writeIndex stall > 3s -> Rust tuong bridge chet va restart
+                // nham (2 bridge cung map SHM -> race control queue / double
+                // load). assign() chi giu mutex khi ghi map nen renderAll khong
+                // bao gio stall. openGUI sau nay chay tren CUNG thread nay
+                // (ChannelWorker) — thread khong bao gio exit nen COM STA
+                // apartment cua plugin con song (xem ChannelWorker comment).
+                size_t plen = 0;
+                while (plen < sizeof(c.arg2) && c.arg2[plen]) ++plen;
+                std::string path(c.arg2, plen);
+                InstrumentType t = (InstrumentType)c.arg0;
+                uint32_t ch = c.channel & 0xF;
+                if (!workers[ch]) workers[ch] = std::make_unique<ChannelWorker>();
+                workers[ch]->post([&instruments, t, ch, path, sampleRate, block]() {
+                    // CRASH FIX: this job enters the plugin DLL (createInstance
+                    // in loadPlugin, old-instance terminate on replace) while
+                    // the audio loop may process() another instance of the SAME
+                    // DLL — 2 threads in one DLL crashes Nexus (observed with
+                    // session-restore instances). Silence this channel (its old
+                    // instance is being torn down / replaced) and every
+                    // same-plugin channel for the whole job. Old path covers
+                    // the old-instance teardown; the new path (computed BEFORE
+                    // assign — see spNew below) covers the freshly created
+                    // instance. CRASH FIX (SF→VSTi while playing): the new
+                    // path must be silenced BEFORE assign() — assign() itself
+                    // runs createInstance (loadPlugin) on this worker, and a
+                    // restored channel on ANOTHER track holding the SAME DLL
+                    // kept process()ing on the audio loop during that window
+                    // (old code silenced spNew only AFTER assign → crash).
+                    instruments.setReloading(ch, true);
+                    std::vector<uint32_t> spOld = same_plugin_channels(ch);
+                    for (uint32_t y : spOld) {
+                        g_engine->setReloading(y, true);
+                        std::cerr << "[dbg] load: silenced same-plugin ch=" << y
+                                  << " during load ch=" << ch << std::endl;
+                    }
+                    // Channels (other than ch) already assigned the NEW path —
+                    // silence BEFORE createInstance enters that DLL.
+                    std::vector<uint32_t> spNew;
+                    if (t == InstrumentType::VST3) {
+                        std::string np = lower_path_str(path);
+                        if (!np.empty()) {
+                            for (uint32_t y = 0; y < 16; ++y) {
+                                if (y == ch) continue;
+                                if (!g_engine->get(y)) continue;
+                                if (std::find(spOld.begin(), spOld.end(), y) != spOld.end()) continue;
+                                if (lower_plugin_path(y) != np) continue;
+                                g_engine->setReloading(y, true);
+                                spNew.push_back(y);
+                                std::cerr << "[dbg] load: silenced same-plugin (new path) ch=" << y
+                                          << " during load ch=" << ch << std::endl;
+                            }
+                        }
+                    }
+#ifdef _WIN32
+                    // DONG cua so editor dang mo cua channel TRUOC khi assign():
+                    // thay the inst (VST3 -> SF2/inst khac) ma editor con song ->
+                    // old inst destructor goi view->removed() tren HWND con hoat
+                    // dong -> plugin block -> treo bridge.
+                    // QUAN TRONG: window duoc tao tren MAIN thread (handleOpenGui
+                    // goi create_native_vst_window o main loop) — DestroyWindow tu
+                    // worker thread la cross-thread (MSDN cam), gay crash USER32
+                    // 0xc000041d. Post WM_CLOSE -> main pump destroy window tren
+                    // DUNG thread so huu no. Registry da erase o tren nen WM_DESTROY
+                    // khong goi closeGUI tren inst cu (inst moi chua co view).
+                    HWND hToHide = nullptr;
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        auto git = g_guiWindows.find(ch);
+                        if (git != g_guiWindows.end()) hToHide = (HWND)git->second;
+                    }
+                    // CRASH FIX: detach view TRUOC khi thay inst. Plugin editor
+                    // children thuoc worker thread nay (attachView chay o day);
+                    // khong destroy parent window (main-owned) khi view con song
+                    // -> DestroyWindow cross-thread -> USER32 0xc000041d. An
+                    // window, giu trong registry de reuse (reopen ShowWindow lai).
+                    if (hToHide && IsWindow(hToHide)) {
+                        // CRASH FIX (0xc000041d USER32 while playing): silence
+                        // the channel while the old editor detaches — view->removed()
+                        // on this worker would race processor->process() on the
+                        // audio loop (same plugin instance).
+                        instruments.setReloading(ch, true);
+                        if (auto* i = instruments.get(ch)) i->closeGUI();
+                        // The editor goes away with this load: drop the global
+                        // editor-open state (path stored at attach -- still the
+                        // old path before assign() below).
+                        {
+                            std::lock_guard<std::mutex> lk(g_editorMutex);
+                            if (g_editorOpen[ch]) {
+                                g_editorOpen[ch] = false;
+                                std::string pth = g_editorOpenPath[ch];
+                                g_editorOpenPath[ch].clear();
+                                if (!pth.empty()) {
+                                    auto it = g_editorPathCount.find(pth);
+                                    if (it != g_editorPathCount.end() && --it->second <= 0)
+                                        g_editorPathCount.erase(it);
+                                }
+                            }
+                        }
+                        // Destroy the old editor's child windows (worker-owned,
+                        // created by attachView here) so they stop pumping;
+                        // the parent window is hidden and kept for reuse.
+                        // See post_close_gui for the same pattern.
+                        // CRASH FIX (0xc000041d): the editor children are
+                        // MAIN-thread-owned now (attachView runs on the main
+                        // pump) - DestroyWindow from this worker is cross-
+                        // thread and crashes USER32. Ask the main thread to
+                        // destroy them (kMsgDestroy) and wait for the ack.
+                        {
+                            std::lock_guard<std::mutex> lock(g_guiMutex);
+                            g_editorDestroyAck[ch] = false;
+                        }
+                        PostMessageW(hToHide, kMsgDestroy, (WPARAM)ch, 0);
+                        bool destroyAcked = false;
+                        for (int i = 0; i < 500; ++i) {
+                            {
+                                std::lock_guard<std::mutex> lock(g_guiMutex);
+                                if (g_editorDestroyAck[ch]) { destroyAcked = true; break; }
+                            }
+                            Sleep(10);
+                        }
+                        if (!destroyAcked)
+                            std::cerr << "[dbg] load: editor destroy not acked ch=" << ch << std::endl;
+
+
+                    }
+#endif
+                    std::cerr << "[dbg] load thread start ch=" << ch
+                              << " type=" << (int)t << " path=" << path << std::endl;
+                    std::lock_guard<std::mutex> lg(g_loadMutex);
+                    bool ok = instruments.assign(ch, t, path, sampleRate, block);
+                    std::cerr << "[dbg] assign returned ch=" << ch << " ok=" << (ok ? 1 : 0) << std::endl;
+                    if (ok) {
+                        std::cout << "[NativeBridge] instrument loaded ch=" << ch
+                                  << " type=" << (int)t << " " << path << std::endl;
+                    } else {
+                        std::cerr << "[NativeBridge] instrument load FAILED ch=" << ch
+                                  << " type=" << (int)t << " " << path << std::endl;
+                    }
+                    // Restore. Failed load keeps the OLD instance — unmute it
+                    // back (silenced at job start); a successful assign leaves
+                    // the fresh instance unmuted by construction.
+                    if (!ok) g_engine->setReloading(ch, false);
+                    for (uint32_t y : spOld) unmute_if_not_closing(y, "load");
+                    for (uint32_t y : spNew) unmute_if_not_closing(y, "load");
+                });
+            } else if (c.type == 1) { // PANIC
+                instruments.allNotesOff();
+                std::cout << "[NativeBridge] PANIC — all notes off" << std::endl;
+            } else if (c.type == 3) { // TRANSPORT (A13)
+                if (c.arg0 == 0) { // STOP → flush every note immediately
+                    transportStopped = true;
+                    // Release sustain pedal TRUOC (CC64=0) — nhieu VSTi giu note
+                    // khi pedal con down -> note-off cua allNotesOff bi bo qua
+                    // -> am treo loop (V8 bug 3).
+                    for (uint32_t ch = 0; ch < 16; ++ch)
+                        instruments.controlChange(ch, 64, 0);  // manager drops unassigned/reloading
+                    instruments.allNotesOff();
+                    std::cout << "[NativeBridge] transport STOP — all notes off" << std::endl;
+                } else if (c.arg0 == 1) { // PLAY
+                    transportStopped = false;
+                    playheadSamples = c.arg1;
+                    std::cout << "[NativeBridge] transport PLAY playhead=" << playheadSamples << std::endl;
+                } else if (c.arg0 == 2) { // SET_POSITION (seek while stopped)
+                    playheadSamples = c.arg1;
+                }
+            } else if (c.type == 4) { // OPEN_GUI (A7): arg1 = parent HWND (0 → bridge tự tạo native window), arg2 = plugin id
+                uint32_t guiCh = c.channel;
+                if (guiCh >= 16) guiCh = 0;
+                handleOpenGui(guiCh, (uintptr_t)c.arg1, std::string(c.arg2));
+            }
+        }
+        shmIPC->controlQueueCount = 0;
+
+        // Pending OPEN_GUI requests: fulfilled as soon as the channel's
+        // instrument becomes available (load job completed on its worker).
+        {
+            std::vector<std::pair<uint32_t, std::pair<void*, std::string>>> readyGui;
+            {
+                std::lock_guard<std::mutex> lock(g_pendingGuiMutex);
+                for (auto it = g_pendingGui.begin(); it != g_pendingGui.end(); ) {
+                    if (instruments.get(it->first)) {
+                        readyGui.push_back({ it->first, it->second });
+                        it = g_pendingGui.erase(it);
+                    } else ++it;
+                }
+            }
+            for (auto& g : readyGui)
+                handleOpenGui(g.first, (uintptr_t)g.second.first, g.second.second);
+        }
+
+
+        // B. Snapshot queued MIDI events (bounded copy, queue reset immediately)
+        uint32_t nEvents = shmIPC->midiQueueCount > 64 ? 64 : shmIPC->midiQueueCount;
+        SharedAudioBufferIPC::MidiEventIPC evts[64];
+        for (uint32_t i = 0; i < nEvents; ++i) evts[i] = shmIPC->midiQueue[i];
+        shmIPC->midiQueueCount = 0;
+
+        // A11 sample-accurate: sort by sampleOffset, dispatch at each boundary,
+        // render the sub-block before the boundary. Events with offset 0 (live
+        // keyboard, current JS) are dispatched first and shape the whole block.
+        std::stable_sort(evts, evts + nEvents,
+                         [](const SharedAudioBufferIPC::MidiEventIPC& a,
+                            const SharedAudioBufferIPC::MidiEventIPC& b) {
+                             return a.sampleOffset < b.sampleOffset;
+                         });
+        uint32_t cursor = 0;
+        uint32_t ei = 0;
+        while (ei < nEvents && evts[ei].sampleOffset <= cursor) { dispatch(evts[ei]); ++ei; }
+        for (; ei < nEvents; ++ei) {
+            uint32_t off = evts[ei].sampleOffset < block ? evts[ei].sampleOffset : block;
+            if (off > cursor) { renderSegment(cursor, off); cursor = off; }
+            dispatch(evts[ei]);
+        }
+        if (cursor < block) renderSegment(cursor, block);
+        shmIPC->bridgeWriteIndex++;
+
+        // D. Parent died / window closed -> exit (no orphan process)
+        if (parentPid != 0 && !parent_alive(parentPid)) {
+            std::cout << "[NativeBridge] parent gone — exiting." << std::endl;
+            break;
+        }
+
+        // E. Synchronize with real-time audio playback
+        blockCount++;
+        auto targetTime = startTime + std::chrono::microseconds(static_cast<int64_t>(blockCount * blockDurationMs * 1000.0));
+        auto now = std::chrono::steady_clock::now();
+        if (now < targetTime) {
+            auto diff = std::chrono::duration_cast<std::chrono::microseconds>(targetTime - now).count();
+            if (diff > 1000) {
+                sleep_ms(diff / 1000);
+            }
+            while (std::chrono::steady_clock::now() < targetTime) {
+                std::this_thread::yield();
+            }
+        }
+    }
+
+#ifdef _WIN32
+    UnmapViewOfFile(shmIPC);
+    CloseHandle(hMapFile);
+    timeEndPeriod(1);
+#else
+    std::free(shmIPC);
+#endif
+    return 0;
+}
diff --git a/native_bridge/debug/NOTES.md b/native_bridge/debug/NOTES.md
new file mode 100644
index 0000000..e24bf80
--- /dev/null
+++ b/native_bridge/debug/NOTES.md
@@ -0,0 +1,50 @@
+# Nexus GUI crash 0xc000041d (USER32) — debug state (WIP)
+
+Thời điểm lưu: 2026-08-14, đang chuyển sang máy Linux để tiếp tục.
+
+## Hiện tượng
+`daw_vst_bridge.exe` crash 0xc000041d khi mở GUI editor VSTi Nexus (`C:\Program Files\Common Files\VST3\Nexus.vst3`) rồi chọn instrument khác. Chạy từ `install/`.
+
+## Kết quả đã có
+- Probe `gui_probe.exe` variant `bridge_exact11` PASS (`RESULT(bridge_exact11): done=1 attached_ok=1`, log: `openGUI: attached=0` = kResultOk), kể cả khi stdout redirect ra file.
+- NHƯNG bridge thật HANG tại `view->attached()` (log dừng tại `isPlatformTypeSupported=0`, không in `attached=`), kể cả SF_ONCE_PROBEWIN=1. Watchdog tick vẫn chạy = đang trong attached().
+
+## Đã loại trừ (session 2026-08-14)
+- **g_engine hypothesis DISPROVEN**: `g_engine` (main.cpp L545) KHÔNG được dùng trong path SF_ONCE (chỉ dùng ở closeGUI/main-loop). Job SF_ONCE chỉ gọi `instruments.setReloading(y,true)` → `Vst3Instrument::setReloading` (chỉ set bool) + `reloadForGUI()` (hasAttachedOnce_=false lần đầu → no-op return true).
+- **Diff ChannelWorker vs PumpWorker**: giống hệt (chỉ khác tên biến + destructor + comment).
+- **Diff exact11 vs SF_ONCE**: giống hệt về ngữ nghĩa — chỉ khác sampleRate/block, setEditorOpenPredicate (cả hai false), SHM driver thật vs tự tạo (đã loại bằng SF_ONCE_SHM).
+- **stdout redirect ra file**: probe vẫn PASS.
+- **Binary up-to-date** (build 22:09 = main.cpp 22:09).
+- CMakeLists: bridge và gui_probe compile CÙNG sources, CÙNG defines (HAVE_VST3SDK=1), cùng libs — không khác.
+
+## Stack main thread (stackscan.py v7/v8)
+- Main thread chờ vô hạn trong ntdll (R9=0x7ffffffffffffffc timeout ~infinite) qua KERNELBASE+22cd8 gọi từ Nexus attached().
+- 3 thread Nexus riêng chờ ntdll+164034; 1 thread (21232) là message pump (win32u+20a4).
+- Export resolve thất bại (offset nội bộ không tên): ntdll+5fc6e→hàm tại 0x5fa90, ntdll+3e732→0x3dc60, KERNELBASE+22cd8→hàm tại 0x22ca0.
+
+## Bước tiếp theo
+1. **waitscan.py** (chạy dở khi lưu): dump RIP mọi thread + NtQueryObject loại/tên handle trong Rcx (wait object) — xem main thread và 3 thread Nexus có CÙNG chờ 1 object (deadlock nội bộ Nexus) hay không. Chạy: `python waitscan.py` (cần bridge đang hang).
+2. Nếu waitscan không rõ: disasm KERNELBASE+22ca0 / ntdll+5fa90 xác định hàm chờ (WaitForSingleObjectEx/WaitForMultipleObjectsEx/AlertableWait), hoặc NtQuerySystemInformation wait-chain.
+3. Khi tìm được trigger: REVERT toàn bộ TEST patch (watchdog, direct attach, no audio, DefWindowProcA, warm-up, pre-window, autogui, exact11, once, once_shm, probewin) — giữ fix chính thức. Đặc biệt:
+   - `wc.lpfnWndProc = DefWindowProcA; // TEST ISOLATION`
+   - bỏ `WS_VISIBLE` ở create_native_vst_window
+   - khôi phục VstWindowProc + WS_VISIBLE khi hết test.
+4. Verify app thật từ `install/` (kill SonicForge/daw_vst trước; check `%APPDATA%\SonicForgeDAW\logs\bridge.log` + spawn.log, không "bridge stalled 3s"). Deploy exe 5 vị trí: install/, src-tauri/binaries/ (2 tên), src-tauri/target/{debug,release}/.
+
+## Cách chạy (Windows)
+- Build: `cd native_bridge && cmake --build build --config Release --target daw_vst_bridge --parallel` (nhớ `taskkill //F //IM daw_vst_bridge.exe` trước, LNK1104 nếu zombie).
+- Probe: `./build/Release/gui_probe.exe "C:\Program Files\Common Files\VST3\Nexus.vst3" <variant> <secs>`; exit 127 dù PASS; watchdog tự kill sau secs+10s.
+- Driver: `python driver_once.py [GATE=VAL...]` (chờ "SF_ONCE attach=" 90s + "GUI attached" 30s; attach=0 = THÀNH CÔNG).
+
+## Scripts trong thư mục này
+- `waitscan.py` — dump RIP + wait object mọi thread (đang dở, bước 1 tiếp theo).
+- `stackscan.py` / `stackwalk.py` / `stack_sample*.py` — stack dump.
+- `driver_once.py` / `driver_verify.py` / `driver_autogui.py` / `driver_narrow.py` — chạy bridge với gate, chờ kết quả.
+- Patch scripts (workspace tmp-7d619832): `patch_once.py`, `patch_once_shm.py`, `patch_exact11_bridge.py`, `patch_gates.py`, `patch_autogui.py`, ... áp bằng python lên `native_bridge/src/main.cpp` (CRLF! ghi `io.open(encoding='utf-8', newline='\r\n')`).
+
+## Learnings kỹ thuật (Windows ctypes)
+- `GetModuleHandleW`/windll trả pointer → PHẢI set `.restype = ctypes.c_void_p` (mặc định c_int → truncate 32-bit → access violation).
+- Mọi API nhận pointer/handle → set argtypes (GetThreadContext, OpenThread, DuplicateHandle...).
+- `ctypes.wintypes` KHÔNG có DWORD64 — dùng ctypes.c_uint64.
+- CONTEXT x64: SegCs..SegSs là WORD; struct đầy đủ 0x4d0 bytes; GetThreadContext ghi full buffer → dùng raw buffer 0x4d0 + struct.unpack_from offset cố định (rip@0xF8, rsp@0x98, rcx@0x80, rdx@0x88, r8@0xB8, r9@0xC0, ContextFlags@0x30).
+- EnumProcessModulesEx: cb = bytes/8 trên x64; module handle có thể NULL → skip.
diff --git a/native_bridge/debug/driver_autogui.py b/native_bridge/debug/driver_autogui.py
new file mode 100644
index 0000000..bec51de
--- /dev/null
+++ b/native_bridge/debug/driver_autogui.py
@@ -0,0 +1,91 @@
+# Driver: LOAD ch=5 only; SF_AUTOGUI makes the bridge auto-attach.
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)), "driver_bridge.log")
+NEXUS = r"C:\Program Files\Common Files\VST3\Nexus.vst3"
+
+kernel32 = ctypes.windll.kernel32
+kernel32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_char_p]
+kernel32.CreateFileMappingA.restype = ctypes.c_void_p
+kernel32.MapViewOfFile.argtypes = [ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_size_t]
+kernel32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+PAGE_READWRITE = 0x04
+FILE_MAP_ALL_ACCESS = 0xF001F
+
+hMap = kernel32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, PAGE_READWRITE, 0, SIZE, SHM_NAME.encode())
+ptr = kernel32.MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0)
+
+def w32(off, fmt, *args):
+    ctypes.memmove(ptr + off, struct.pack(fmt, *args), struct.calcsize(fmt))
+
+def write_control(type_, arg0, arg1, ch, path):
+    for i in range(8):
+        off = 2836 + i * 1040
+        t = ctypes.c_uint32.from_address(ptr + off).value
+        if t == 0:
+            w32(off, 'IIII', type_, arg0, arg1, ch)
+            if path:
+                b = path.encode('utf-8')[:1023] + b'\x00'
+                ctypes.memmove(ptr + off + 16, b, len(b))
+            return i
+    raise RuntimeError("control queue full")
+
+def push_controls(events):
+    for i in range(8):
+        w32(2836 + i * 1040, 'I', 0)
+    n = 0
+    for (type_, arg0, arg1, ch, path) in events:
+        write_control(type_, arg0, arg1, ch, path)
+        n += 1
+    w32(11156, 'I', n)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    last = 0
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                lines = f.readlines()
+        except FileNotFoundError:
+            lines = []
+        for i in range(last, len(lines)):
+            if pattern in lines[i]:
+                return lines[i].strip()
+        last = max(0, len(lines))
+        time.sleep(0.2)
+    return None
+
+proc = subprocess.Popen(
+    [BRIDGE, "--shm", SHM_NAME],
+    env={**os.environ, "SF_SHM_NAME": SHM_NAME, "SF_PARENT_PID": str(os.getpid()),
+         "SF_SAMPLE_RATE": "48000", "SF_BLOCK_SIZE": "256"},
+    stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT,
+)
+time.sleep(1.5)
+print("bridge pid", proc.pid, "poll", proc.poll())
+
+print("[1] load ch=5 Nexus...")
+push_controls([(2, 0, 0, 5, NEXUS)])
+r = wait_log("instrument loaded ch=5", 90)
+print("   ", r)
+
+print("[2] wait auto attach (SF_AUTOGUI)...")
+r = wait_log("GUI attached", 30)
+print("   ", r)
+
+time.sleep(3)
+print("FINAL alive:", proc.poll() is None)
+print("--- last 25 log lines ---")
+try:
+    with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+        lines = f.readlines()
+    for l in lines[-25:]:
+        print(l.rstrip())
+except FileNotFoundError:
+    pass
diff --git a/native_bridge/debug/driver_narrow.py b/native_bridge/debug/driver_narrow.py
new file mode 100644
index 0000000..2b01f3d
--- /dev/null
+++ b/native_bridge/debug/driver_narrow.py
@@ -0,0 +1,107 @@
+# Narrow test: load ONLY ch=5 Nexus -> open GUI ch=5. Is multi-instance the trigger?
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SHM_NAME = "SonicForge_DAW_IPC_NARROW"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)), "narrow_bridge.log")
+NEXUS = r"C:\Program Files\Common Files\VST3\Nexus.vst3"
+
+kernel32 = ctypes.windll.kernel32
+kernel32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_char_p]
+kernel32.CreateFileMappingA.restype = ctypes.c_void_p
+kernel32.MapViewOfFile.argtypes = [ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_size_t]
+kernel32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+PAGE_READWRITE = 0x04
+FILE_MAP_ALL_ACCESS = 0xF001F
+
+hMap = kernel32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, PAGE_READWRITE, 0, SIZE, SHM_NAME.encode())
+if not hMap:
+    print("CreateFileMapping failed", ctypes.get_last_error()); sys.exit(1)
+ptr = kernel32.MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0)
+if not ptr:
+    print("MapViewOfFile failed", ctypes.get_last_error()); sys.exit(1)
+
+def w32(off, fmt, *args):
+    ctypes.memmove(ptr + off, struct.pack(fmt, *args), struct.calcsize(fmt))
+
+def write_control(type_, arg0, arg1, ch, path):
+    for i in range(8):
+        off = 2836 + i * 1040
+        t = ctypes.c_uint32.from_address(ptr + off).value
+        if t == 0:
+            w32(off, 'IIII', type_, arg0, arg1, ch)
+            if path:
+                b = path.encode('utf-8')[:1023] + b'\x00'
+                ctypes.memmove(ptr + off + 16, b, len(b))
+            return i
+    raise RuntimeError("control queue full")
+
+def push_controls(events):
+    for i in range(8):
+        w32(2836 + i * 1040, 'I', 0)
+    w32(11156, 'I', 0)
+    n = 0
+    for (type_, arg0, arg1, ch, path) in events:
+        write_control(type_, arg0, arg1, ch, path)
+        n += 1
+    w32(11156, 'I', n)
+
+def wait_log(pattern, timeout, since=0):
+    end = time.time() + timeout
+    lines = []
+    try:
+        with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+            lines = f.readlines()
+    except FileNotFoundError:
+        pass
+    last = max(0, len(lines) - since)
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                lines = f.readlines()
+        except FileNotFoundError:
+            lines = []
+        for i in range(last, len(lines)):
+            if pattern in lines[i]:
+                return lines[i].strip()
+        last = max(0, len(lines))
+        time.sleep(0.2)
+    return None
+
+proc = subprocess.Popen(
+    [BRIDGE, "--shm", SHM_NAME],
+    env={**os.environ, "SF_SHM_NAME": SHM_NAME, "SF_PARENT_PID": str(os.getpid()),
+         "SF_SAMPLE_RATE": "48000", "SF_BLOCK_SIZE": "256"},
+    stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT,
+)
+time.sleep(1.5)
+print("bridge pid", proc.pid, "poll", proc.poll())
+
+print("[1] load ch=5 Nexus only...")
+push_controls([(2, 0, 0, 5, NEXUS)])
+r = wait_log("instrument loaded ch=5", 60)
+print("   ", r)
+
+print("[2] open GUI ch=5...")
+push_controls([(4, 0, 0, 5, "nexus")])
+r = wait_log("GUI attached", 30)
+print("   ", r)
+
+time.sleep(2)
+print("alive:", proc.poll() is None)
+print("--- last 20 log lines ---")
+with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+    for l in f.readlines()[-20:]:
+        print(l.rstrip())
+
+kernel32.UnmapViewOfFile(ptr)
+kernel32.CloseHandle(hMap)
+try:
+    proc.terminate()
+except Exception:
+    pass
+print("done")
diff --git a/native_bridge/debug/driver_once.py b/native_bridge/debug/driver_once.py
new file mode 100644
index 0000000..f0f04f6
--- /dev/null
+++ b/native_bridge/debug/driver_once.py
@@ -0,0 +1,78 @@
+# Driver: SF_ONCE test — bridge loads ch=5 itself BEFORE main loop.
+# Driver only creates SHM + spawns bridge, waits for "GUI attached" (success)
+# or hang (timeout while alive).
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)), "driver_once.log")
+
+kernel32 = ctypes.windll.kernel32
+kernel32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_char_p]
+kernel32.CreateFileMappingA.restype = ctypes.c_void_p
+kernel32.MapViewOfFile.argtypes = [ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_size_t]
+kernel32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+PAGE_READWRITE = 0x04
+FILE_MAP_ALL_ACCESS = 0xF001F
+
+hMap = kernel32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, PAGE_READWRITE, 0, SIZE, SHM_NAME.encode())
+ptr = kernel32.MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    last = 0
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                lines = f.readlines()
+        except FileNotFoundError:
+            lines = []
+        for i in range(last, len(lines)):
+            if pattern in lines[i]:
+                return lines[i].strip()
+        last = max(0, len(lines))
+        time.sleep(0.2)
+    return None
+
+extra = dict(os.environ)
+for k in list(extra):
+    if k.startswith("SF_"):
+        del extra[k]
+extra.update({
+    "SF_SHM_NAME": SHM_NAME,
+    # SF_PARENT_PID omitted: parent watchdog off (isolate)
+    "SF_SAMPLE_RATE": "48000",
+    "SF_BLOCK_SIZE": "256",
+    "SF_ONCE": "1",
+    "SF_AUTOGUI": "0",  # ensure loop hook stays off
+})
+# Allow extra gates via argv[1]: e.g. "SF_NO_WD SF_NO_QTIMER SF_NO_AUDIO"
+for gate in sys.argv[1:]:
+    k, v = gate.split("=", 1)
+    extra[k] = v
+
+proc = subprocess.Popen(
+    [BRIDGE, "--shm", SHM_NAME],
+    env=extra,
+    stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT,
+)
+print("bridge pid", proc.pid, "poll", proc.poll())
+
+r = wait_log("SF_ONCE attach=", 90)
+print("attach line:", r)
+r2 = wait_log("GUI attached", 30)
+print("gui line:", r2)
+time.sleep(2)
+print("FINAL alive:", proc.poll() is None)
+print("--- last 30 log lines ---")
+try:
+    with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+        lines = f.readlines()
+    for l in lines[-30:]:
+        print(l.rstrip())
+except FileNotFoundError:
+    pass
diff --git a/native_bridge/debug/driver_verify.py b/native_bridge/debug/driver_verify.py
new file mode 100644
index 0000000..8740876
--- /dev/null
+++ b/native_bridge/debug/driver_verify.py
@@ -0,0 +1,174 @@
+# Driver verify: SHM + spawn real bridge, reproduce user flow:
+# load 6x Nexus -> open GUI ch=5 -> play notes -> switch instrument ch=5 (crash point)
+# -> reopen GUI -> verify alive + writeIndex advancing + no crash.
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768  # bigger than struct, safe
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)), "driver_bridge.log")
+NEXUS = r"C:\Program Files\Common Files\VST3\Nexus.vst3"
+AMPLE = r"C:\Program Files\Common Files\VST3\Ample Sound\ACDD.vst3"
+
+kernel32 = ctypes.windll.kernel32
+kernel32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_char_p]
+kernel32.CreateFileMappingA.restype = ctypes.c_void_p
+kernel32.MapViewOfFile.argtypes = [ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.wintypes.DWORD, ctypes.c_size_t]
+kernel32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+PAGE_READWRITE = 0x04
+FILE_MAP_ALL_ACCESS = 0xF001F
+FILE_MAP_WRITE = 0x0002
+FILE_MAP_READ = 0x0004
+
+hMap = kernel32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, PAGE_READWRITE, 0, SIZE, SHM_NAME.encode())
+if not hMap:
+    print("CreateFileMapping failed", ctypes.get_last_error()); sys.exit(1)
+ptr = kernel32.MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0)
+if not ptr:
+    print("MapViewOfFile failed", ctypes.get_last_error()); sys.exit(1)
+
+def w32(off, fmt, *args):
+    ctypes.memmove(ptr + off, struct.pack(fmt, *args), struct.calcsize(fmt))
+
+def write_control(type_, arg0, arg1, ch, path):
+    # find first free slot
+    for i in range(8):
+        off = 2836 + i * 1040
+        t = ctypes.c_uint32.from_address(ptr + off).value
+        if t == 0:
+            w32(off, 'IIII', type_, arg0, arg1, ch)
+            if path:
+                b = path.encode('utf-8')[:1023] + b'\x00'
+                ctypes.memmove(ptr + off + 16, b, len(b))
+            return i
+    raise RuntimeError("control queue full")
+
+def submit_controls():
+    w32(11156, 'I', 0)  # will set below
+    # reset type of all slots first
+    for i in range(8):
+        w32(2836 + i * 1040, 'I', 0)
+
+def push_controls(events):
+    submit_controls()
+    n = 0
+    for (type_, arg0, arg1, ch, path) in events:
+        write_control(type_, arg0, arg1, ch, path)
+        n += 1
+    w32(11156, 'I', n)
+
+def midi(cmd, ch, pitch, vel, data2=0, data3=0):
+    # bridge does not zero midiQueue after drain - always write slot 0, count 1
+    w32(2064, 'BBBBBB', cmd, ch, pitch, vel, data2, data3)
+    w32(2064 + 8, 'I', 0)
+    w32(2832, 'I', 1)
+    return True
+
+def midi_count():
+    return ctypes.c_uint32.from_address(ptr + 2832).value
+
+def write_index():
+    return ctypes.c_uint32.from_address(ptr + 4).value
+
+def wait_log(pattern, timeout, since=0):
+    end = time.time() + timeout
+    lines = []
+    try:
+        with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+            lines = f.readlines()
+    except FileNotFoundError:
+        pass
+    last = max(0, len(lines) - since)
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                lines = f.readlines()
+        except FileNotFoundError:
+            lines = []
+        for i in range(last, len(lines)):
+            if pattern in lines[i]:
+                return lines[i].strip()
+        last = max(0, len(lines))
+        time.sleep(0.2)
+    return None
+
+proc = subprocess.Popen(
+    [BRIDGE, "--shm", SHM_NAME],
+    env={**os.environ, "SF_SHM_NAME": SHM_NAME, "SF_PARENT_PID": str(os.getpid()),
+         "SF_SAMPLE_RATE": "48000", "SF_BLOCK_SIZE": "256"},
+    stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT,
+)
+time.sleep(1.5)
+print("bridge pid", proc.pid, "poll", proc.poll())
+
+# 1. Load 6 channels Nexus
+print("[1] load 6x Nexus...")
+push_controls([(2, 0, 0, ch, NEXUS) for ch in range(6)])
+print("    wait ch=5 loaded...")
+r = wait_log("instrument loaded ch=5", 90)
+print("   ", r)
+
+# 2. Open GUI ch=5
+print("[2] open GUI ch=5...")
+push_controls([(4, 0, 0, 5, "nexus")])
+r = wait_log("GUI attached", 30)
+print("   ", r)
+
+# 3. Play notes on ch=5 and ch=2 while editor open
+print("[3] play notes...")
+for k in range(40):
+    midi(0x9, 5, 60 + (k % 12), 100)
+    midi(0x9, 2, 48 + (k % 7), 90)
+    if k % 2 == 0:
+        midi(0x8, 5, 60 + ((k - 1) % 12), 0)
+    time.sleep(0.05)
+
+# 4. Switch instrument ch=5 while GUI open (OLD CRASH POINT)
+print("[4] switch instrument ch=5 -> Ample ACDD while GUI open...")
+t0 = time.time()
+push_controls([(2, 0, 0, 5, AMPLE)])
+r = wait_log("instrument loaded ch=5", 40)
+print("   ", r, "in", round(time.time() - t0, 1), "s")
+alive = proc.poll() is None
+wi = write_index()
+time.sleep(2)
+wi2 = write_index()
+print("    alive:", alive, "writeIndex", wi, "->", wi2, "advancing:", wi2 > wi)
+
+# 5. Reopen GUI ch=5 (after switch) - attach path again
+print("[5] reopen GUI ch=5...")
+push_controls([(4, 0, 0, 5, "ample")])
+r = wait_log("GUI attached", 40)
+print("   ", r)
+
+# 6. Final liveness check + crash check
+time.sleep(3)
+alive = proc.poll() is None
+wi3 = write_index()
+time.sleep(2)
+wi4 = write_index()
+print("FINAL alive:", alive, "writeIndex", wi3, "->", wi4, "advancing:", wi4 > wi3)
+if not alive:
+    print("!!! BRIDGE CRASHED exit", proc.returncode)
+
+print("--- last 30 log lines ---")
+try:
+    with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+        lines = f.readlines()
+    for l in lines[-30:]:
+        print(l.rstrip())
+except FileNotFoundError:
+    pass
+
+# cleanup
+kernel32.UnmapViewOfFile(ptr)
+kernel32.CloseHandle(hMap)
+try:
+    proc.terminate()
+except Exception:
+    pass
+time.sleep(0.5)
+print("done")
diff --git a/native_bridge/debug/stack_sample.py b/native_bridge/debug/stack_sample.py
new file mode 100644
index 0000000..8417ea8
--- /dev/null
+++ b/native_bridge/debug/stack_sample.py
@@ -0,0 +1,155 @@
+# Stack sampler v2: correct x64 CONTEXT layout + psapi module names.
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)), "stack_sample.log")
+
+k32 = ctypes.windll.kernel32
+k32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_char_p]
+k32.CreateFileMappingA.restype = ctypes.c_void_p
+k32.MapViewOfFile.argtypes = [ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_size_t]
+k32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+hMap = k32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, 0x04, 0, SIZE, SHM_NAME.encode())
+ptr = k32.MapViewOfFile(hMap, 0xF001F, 0, 0, 0)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                if pattern in f.read():
+                    return True
+        except FileNotFoundError:
+            pass
+        time.sleep(0.2)
+    return False
+
+extra = dict(os.environ)
+for k in list(extra):
+    if k.startswith("SF_"):
+        del extra[k]
+extra.update({"SF_SHM_NAME": SHM_NAME, "SF_SAMPLE_RATE": "48000",
+              "SF_BLOCK_SIZE": "256", "SF_ONCE": "1", "SF_AUTOGUI": "0"})
+for gate in sys.argv[1:]:
+    k, v = gate.split("=", 1)
+    extra[k] = v
+
+proc = subprocess.Popen([BRIDGE, "--shm", SHM_NAME], env=extra,
+                        stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+print("bridge pid", proc.pid, "poll", proc.poll())
+
+if not wait_log("isPlatformTypeSupported=0", 120):
+    print("TIMEOUT waiting for hang marker")
+    sys.exit(1)
+time.sleep(3)
+
+pid = proc.pid
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_VM_READ = 0x0010
+hProc = k32.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid)
+if not hProc:
+    print("OpenProcess failed", ctypes.get_last_error())
+    sys.exit(1)
+
+psapi = ctypes.windll.psapi
+psapi.EnumProcessModulesEx.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), w.DWORD, ctypes.POINTER(w.DWORD), w.DWORD]
+psapi.GetModuleBaseNameA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_char_p, w.DWORD]
+psapi.GetModuleInformation.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, w.DWORD]
+
+class MODULEINFO(ctypes.Structure):
+    _fields_ = [("lpBaseOfDll", ctypes.c_void_p), ("SizeOfImage", w.DWORD),
+                ("pad", w.DWORD), ("EntryPoint", ctypes.c_void_p)]
+mods = []
+buf = (ctypes.c_void_p * 1024)()
+needed = w.DWORD(0)
+if psapi.EnumProcessModulesEx(hProc, buf, ctypes.sizeof(buf), ctypes.byref(needed), 3):  # LIST_MODULES_ALL
+    n = needed.value // ctypes.sizeof(ctypes.c_void_p)
+    for i in range(min(n, 1024)):
+        base = buf[i]
+        name = ctypes.create_string_buffer(260)
+        psapi.GetModuleBaseNameA(hProc, base, name, 260)
+        info = MODULEINFO()
+        psapi.GetModuleInformation(hProc, base, ctypes.byref(info), ctypes.sizeof(info))
+        mods.append((base, info.SizeOfImage, name.value.decode('utf-8', 'replace')))  # base, size, name
+mods.sort(key=lambda m: m[0])
+print("modules:", [(hex(b), s, n) for b, s, n in mods])
+
+def modname(addr):
+    if addr == 0:
+        return "null"
+    for b, s, n in mods:
+        if b <= addr < b + s:
+            return "%s+%x" % (n, addr - b)
+    return "??%x" % addr
+
+class THREADENTRY32(ctypes.Structure):
+    _fields_ = [("dwSize", w.DWORD), ("cntUsage", w.DWORD), ("th32ThreadID", w.DWORD),
+                ("th32OwnerProcessID", w.DWORD), ("tpBasePri", ctypes.c_long),
+                ("tpDeltaPri", ctypes.c_long), ("dwFlags", w.DWORD)]
+
+class CONTEXT64(ctypes.Structure):
+    _fields_ = [
+        ("P1Home", ctypes.c_uint64), ("P2Home", ctypes.c_uint64),
+        ("P3Home", ctypes.c_uint64), ("P4Home", ctypes.c_uint64),
+        ("P5Home", ctypes.c_uint64), ("P6Home", ctypes.c_uint64),
+        ("ContextFlags", w.DWORD), ("MxCsr", w.DWORD),
+        ("SegCs", w.WORD), ("SegDs", w.WORD), ("SegEs", w.WORD),
+        ("SegFs", w.WORD), ("SegGs", w.WORD), ("SegSs", w.WORD),
+        ("EFlags", w.DWORD),
+        ("Dr0", ctypes.c_uint64), ("Dr1", ctypes.c_uint64),
+        ("Dr2", ctypes.c_uint64), ("Dr3", ctypes.c_uint64),
+        ("Dr6", ctypes.c_uint64), ("Dr7", ctypes.c_uint64),
+        ("Rax", ctypes.c_uint64), ("Rcx", ctypes.c_uint64),
+        ("Rdx", ctypes.c_uint64), ("Rbx", ctypes.c_uint64),
+        ("Rsp", ctypes.c_uint64), ("Rbp", ctypes.c_uint64),
+        ("Rsi", ctypes.c_uint64), ("Rdi", ctypes.c_uint64),
+        ("R8", ctypes.c_uint64), ("R9", ctypes.c_uint64),
+        ("R10", ctypes.c_uint64), ("R11", ctypes.c_uint64),
+        ("R12", ctypes.c_uint64), ("R13", ctypes.c_uint64),
+        ("R14", ctypes.c_uint64), ("R15", ctypes.c_uint64),
+        ("Rip", ctypes.c_uint64),
+    ]
+
+TH32CS_SNAPTHREAD = 0x4
+THREAD_SUSPEND_RESUME = 0x0002
+THREAD_GET_CONTEXT = 0x0008
+THREAD_QUERY_INFORMATION = 0x0040
+CONTEXT_CTRL_INT_SEG = 0x100001 | 0x2 | 0x20  # CONTROL | INTEGER | SEGMENTS
+
+snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)
+te = THREADENTRY32(); te.dwSize = ctypes.sizeof(THREADENTRY32)
+threads = []
+ok = k32.Thread32First(snap, ctypes.byref(te))
+while ok:
+    if te.th32OwnerProcessID == pid:
+        threads.append(te.th32ThreadID)
+    ok = k32.Thread32Next(snap, ctypes.byref(te))
+
+print("threads(%d): %s" % (len(threads), threads))
+for tid in threads:
+    hT = k32.OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, False, tid)
+    if not hT:
+        print("tid %d: OpenThread fail" % tid)
+        continue
+    susp = k32.SuspendThread(hT)
+    ctx = CONTEXT64(); ctx.ContextFlags = CONTEXT_CTRL_INT_SEG
+    r = k32.GetThreadContext(hT, ctypes.byref(ctx))
+    k32.ResumeThread(hT)
+    k32.CloseHandle(hT)
+    if not r:
+        print("tid %d: GetThreadContext fail %d" % (tid, ctypes.get_last_error()))
+        continue
+    print("tid %d rip=%s rsp=%s" % (tid, modname(ctx.Rip), modname(ctx.Rsp)))
+
+print("--- log tail ---")
+try:
+    with open(LOG, 'rb') as f:
+        f.seek(max(0, os.path.getsize(LOG) - 2500))
+        print(f.read().decode('utf-8', 'replace'))
+except FileNotFoundError:
+    pass
diff --git a/native_bridge/debug/stack_sample2.py b/native_bridge/debug/stack_sample2.py
new file mode 100644
index 0000000..daed893
--- /dev/null
+++ b/native_bridge/debug/stack_sample2.py
@@ -0,0 +1,217 @@
+# Stack sampler v4: thread start addrs (identify main) + poor-man stack walk.
+# Usage: python stack_sample2.py --bridge | --probe [secs]
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+MODE = sys.argv[1] if len(sys.argv) > 1 else "--bridge"
+SECS = int(sys.argv[2]) if len(sys.argv) > 2 else 15
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+PROBE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\gui_probe.exe"
+NEXUS = r"C:\Program Files\Common Files\VST3\Nexus.vst3"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                   "stack_sample.log" if MODE == "--bridge" else "stack_probe.log")
+
+k32 = ctypes.windll.kernel32
+k32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_char_p]
+k32.CreateFileMappingA.restype = ctypes.c_void_p
+k32.MapViewOfFile.argtypes = [ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_size_t]
+k32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+hMap = k32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, 0x04, 0, SIZE, SHM_NAME.encode())
+ptr = k32.MapViewOfFile(hMap, 0xF001F, 0, 0, 0)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                if pattern in f.read():
+                    return True
+        except FileNotFoundError:
+            pass
+        time.sleep(0.2)
+    return False
+
+if MODE == "--bridge":
+    extra = dict(os.environ)
+    for k in list(extra):
+        if k.startswith("SF_"):
+            del extra[k]
+    extra.update({"SF_SHM_NAME": SHM_NAME, "SF_SAMPLE_RATE": "48000",
+                  "SF_BLOCK_SIZE": "256", "SF_ONCE": "1", "SF_AUTOGUI": "0"})
+    proc = subprocess.Popen([BRIDGE, "--shm", SHM_NAME], env=extra,
+                            stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+    marker = "isPlatformTypeSupported=0"
+    wait_after = 3
+else:
+    proc = subprocess.Popen([PROBE, NEXUS, "bridge_exact11", str(SECS)],
+                            stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+    marker = "openGUI: attached=0"
+    wait_after = 2
+
+print("pid", proc.pid, "poll", proc.poll(), "mode", MODE)
+if not wait_log(marker, 120):
+    print("TIMEOUT waiting for", marker)
+    sys.exit(1)
+time.sleep(wait_after)
+pid = proc.pid
+
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_VM_READ = 0x0010
+hProc = k32.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid)
+if not hProc:
+    print("OpenProcess failed", ctypes.get_last_error())
+    sys.exit(1)
+
+psapi = ctypes.windll.psapi
+class MODULEINFO(ctypes.Structure):
+    _fields_ = [("lpBaseOfDll", ctypes.c_void_p), ("SizeOfImage", w.DWORD),
+                ("pad", w.DWORD), ("EntryPoint", ctypes.c_void_p)]
+psapi.EnumProcessModulesEx.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), w.DWORD, ctypes.POINTER(w.DWORD), w.DWORD]
+psapi.GetModuleBaseNameA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_char_p, w.DWORD]
+psapi.GetModuleInformation.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(MODULEINFO), w.DWORD]
+mods = []
+buf = (ctypes.c_void_p * 1024)()
+needed = w.DWORD(0)
+if psapi.EnumProcessModulesEx(hProc, buf, ctypes.sizeof(buf), ctypes.byref(needed), 3):
+    n = needed.value // ctypes.sizeof(ctypes.c_void_p)
+    for i in range(min(n, 1024)):
+        base = buf[i]
+        name = ctypes.create_string_buffer(260)
+        psapi.GetModuleBaseNameA(hProc, base, name, 260)
+        info = MODULEINFO()
+        psapi.GetModuleInformation(hProc, base, ctypes.byref(info), ctypes.sizeof(info))
+        mods.append((base, info.SizeOfImage, name.value.decode('utf-8', 'replace')))
+mods.sort(key=lambda m: m[0])
+
+def modname(addr):
+    if addr == 0:
+        return "null"
+    for b, s, n in mods:
+        if b <= addr < b + s:
+            return "%s+%x" % (n, addr - b)
+    return "??%x" % addr
+
+class THREADENTRY32(ctypes.Structure):
+    _fields_ = [("dwSize", w.DWORD), ("cntUsage", w.DWORD), ("th32ThreadID", w.DWORD),
+                ("th32OwnerProcessID", w.DWORD), ("tpBasePri", ctypes.c_long),
+                ("tpDeltaPri", ctypes.c_long), ("dwFlags", w.DWORD)]
+
+class CONTEXT64(ctypes.Structure):
+    _fields_ = [
+        ("P1Home", ctypes.c_uint64), ("P2Home", ctypes.c_uint64),
+        ("P3Home", ctypes.c_uint64), ("P4Home", ctypes.c_uint64),
+        ("P5Home", ctypes.c_uint64), ("P6Home", ctypes.c_uint64),
+        ("ContextFlags", w.DWORD), ("MxCsr", w.DWORD),
+        ("SegCs", w.WORD), ("SegDs", w.WORD), ("SegEs", w.WORD),
+        ("SegFs", w.WORD), ("SegGs", w.WORD), ("SegSs", w.WORD),
+        ("EFlags", w.DWORD),
+        ("Dr0", ctypes.c_uint64), ("Dr1", ctypes.c_uint64),
+        ("Dr2", ctypes.c_uint64), ("Dr3", ctypes.c_uint64),
+        ("Dr6", ctypes.c_uint64), ("Dr7", ctypes.c_uint64),
+        ("Rax", ctypes.c_uint64), ("Rcx", ctypes.c_uint64),
+        ("Rdx", ctypes.c_uint64), ("Rbx", ctypes.c_uint64),
+        ("Rsp", ctypes.c_uint64), ("Rbp", ctypes.c_uint64),
+        ("Rsi", ctypes.c_uint64), ("Rdi", ctypes.c_uint64),
+        ("R8", ctypes.c_uint64), ("R9", ctypes.c_uint64),
+        ("R10", ctypes.c_uint64), ("R11", ctypes.c_uint64),
+        ("R12", ctypes.c_uint64), ("R13", ctypes.c_uint64),
+        ("R14", ctypes.c_uint64), ("R15", ctypes.c_uint64),
+        ("Rip", ctypes.c_uint64),
+    ]
+
+TH32CS_SNAPTHREAD = 0x4
+THREAD_SUSPEND_RESUME = 0x0002
+THREAD_GET_CONTEXT = 0x0008
+THREAD_QUERY_INFORMATION = 0x0040
+CONTEXT_CTRL_INT_SEG = 0x100001 | 0x2 | 0x20
+
+ntdll = ctypes.WinDLL("ntdll", use_last_error=True)
+class THREAD_BASIC_INFORMATION(ctypes.Structure):
+    _fields_ = [("ExitStatus", ctypes.c_long), ("TebBaseAddress", ctypes.c_void_p),
+                ("UniqueProcess", ctypes.c_void_p), ("UniqueThread", ctypes.c_void_p),
+                ("AffinityMask", ctypes.c_void_p), ("Priority", ctypes.c_long),
+                ("BasePriority", ctypes.c_long)]
+
+def thread_start_addr(hT):
+    tbi = THREAD_BASIC_INFORMATION()
+    buf = (ctypes.c_uint64 * 4)()
+    try:
+        r = ntdll.NtQueryInformationThread(hT, 9, ctypes.byref(buf), 32, None)  # ThreadQuerySetWin32StartAddress
+        if r == 0:
+            return buf[0]
+    except Exception:
+        pass
+    return 0
+
+snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)
+te = THREADENTRY32(); te.dwSize = ctypes.sizeof(THREADENTRY32)
+threads = []
+ok = k32.Thread32First(snap, ctypes.byref(te))
+while ok:
+    if te.th32OwnerProcessID == pid:
+        threads.append(te.th32ThreadID)
+    ok = k32.Thread32Next(snap, ctypes.byref(te))
+
+exe_name = mods[0][2] if mods else "exe"
+main_tid = None
+print("threads(%d): %s" % (len(threads), threads))
+for tid in threads:
+    hT = k32.OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, False, tid)
+    if not hT:
+        continue
+    start = thread_start_addr(hT)
+    susp = k32.SuspendThread(hT)
+    ctx = CONTEXT64(); ctx.ContextFlags = CONTEXT_CTRL_INT_SEG
+    r = k32.GetThreadContext(hT, ctypes.byref(ctx))
+    k32.ResumeThread(hT)
+    k32.CloseHandle(hT)
+    if not r:
+        continue
+    if mods and mods[0][0] <= start < mods[0][0] + mods[0][1] and main_tid is None:
+        main_tid = tid
+    print("tid %d rip=%s rsp=%s start=%s%s" % (
+        tid, modname(ctx.Rip), modname(ctx.Rsp), modname(start),
+        "  <== MAIN?" if (mods and mods[0][0] <= start < mods[0][0] + mods[0][1]) else ""))
+
+# poor-man stack walk for MAIN thread
+if main_tid:
+    print("--- stack walk MAIN tid=%d ---" % main_tid)
+    hT = k32.OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, False, main_tid)
+    k32.SuspendThread(hT)
+    ctx = CONTEXT64(); ctx.ContextFlags = CONTEXT_CTRL_INT_SEG
+    k32.GetThreadContext(hT, ctypes.byref(ctx))
+    k32.ResumeThread(hT)
+    k32.CloseHandle(hT)
+    rsp = ctx.Rsp
+    PAGE = 0x1000
+    seen = []
+    # scan a few pages of stack memory
+    base = rsp & ~0xF
+    data = b""
+    try:
+        buf2 = ctypes.create_string_buffer(PAGE * 64)
+        read = ctypes.c_size_t(0)
+        if k32.ReadProcessMemory(hProc, ctypes.c_void_p(base), buf2, PAGE * 64, ctypes.byref(read)):
+            data = buf2.raw[:read.value]
+    except Exception:
+        data = b""
+    for off in range(0, len(data) - 8, 8):
+        val = struct.unpack_from('<Q', data, off)[0]
+        if val >= 0x7ff000000000:
+            mn = modname(val)
+            if mn not in seen and (mn.startswith("Nexus") or mn.startswith("daw") or mn.startswith("USER32") or mn.startswith("ntdll") or mn.startswith("win32u") or mn.startswith("KERNELBASE") or mn.startswith("ole32") or mn.startswith("combase")):
+                seen.append(mn)
+    print("main stack (module+offset, dedup):")
+    for s in seen:
+        print("   ", s)
+print("--- log tail ---")
+try:
+    with open(LOG, 'rb') as f:
+        f.seek(max(0, os.path.getsize(LOG) - 1500))
+        print(f.read().decode('utf-8', 'replace'))
+except FileNotFoundError:
+    pass
diff --git a/native_bridge/debug/stackscan.py b/native_bridge/debug/stackscan.py
new file mode 100644
index 0000000..6b39945
--- /dev/null
+++ b/native_bridge/debug/stackscan.py
@@ -0,0 +1,249 @@
+# Stack scan v7: read thread stack in small chunks, skip unreadable pages
+# (v6 failed reading upward from rsp when the thread's stack was shallow and
+# the 0x4000 chunk crossed the committed top). Also dumps full registers for
+# the window-owner thread so the wait handle/params can be read.
+# Usage: python stackscan.py --bridge | --probe [secs]
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+MODE = sys.argv[1] if len(sys.argv) > 1 else "--bridge"
+SECS = int(sys.argv[2]) if len(sys.argv) > 2 else 15
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+PROBE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\gui_probe.exe"
+NEXUS = r"C:\Program Files\Common Files\VST3\Nexus.vst3"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                   "stack_sample.log" if MODE == "--bridge" else "stack_probe.log")
+
+k32 = ctypes.windll.kernel32
+k32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_char_p]
+k32.CreateFileMappingA.restype = ctypes.c_void_p
+k32.MapViewOfFile.argtypes = [ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_size_t]
+k32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+hMap = k32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, 0x04, 0, SIZE, SHM_NAME.encode())
+ptr = k32.MapViewOfFile(hMap, 0xF001F, 0, 0, 0)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                if pattern in f.read():
+                    return True
+        except FileNotFoundError:
+            pass
+        time.sleep(0.2)
+    return False
+
+if MODE == "--bridge":
+    extra = dict(os.environ)
+    for k in list(extra):
+        if k.startswith("SF_"):
+            del extra[k]
+    extra.update({"SF_SHM_NAME": SHM_NAME, "SF_SAMPLE_RATE": "48000",
+                  "SF_BLOCK_SIZE": "256", "SF_ONCE": "1", "SF_AUTOGUI": "0"})
+    proc = subprocess.Popen([BRIDGE, "--shm", SHM_NAME], env=extra,
+                            stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+    marker = "isPlatformTypeSupported=0"
+    wait_after = 3
+    wnd_class = "SonicForge_Native_VST3_Class"
+else:
+    proc = subprocess.Popen([PROBE, NEXUS, "bridge_exact11", str(SECS)],
+                            stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+    marker = "openGUI: attached=0"
+    wait_after = 2
+    wnd_class = "SonicForge_Native_VST3_Class"
+
+print("pid", proc.pid, "mode", MODE)
+if not wait_log(marker, 120):
+    print("TIMEOUT waiting for", marker)
+    sys.exit(1)
+time.sleep(wait_after)
+pid = proc.pid
+
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_VM_READ = 0x0010
+k32.OpenProcess.argtypes = [w.DWORD, w.BOOL, w.DWORD]
+k32.OpenProcess.restype = ctypes.c_void_p
+hProc = k32.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid)
+if not hProc:
+    print("OpenProcess failed", ctypes.get_last_error())
+    sys.exit(1)
+
+psapi = ctypes.windll.psapi
+class MODULEINFO(ctypes.Structure):
+    _fields_ = [("lpBaseOfDll", ctypes.c_void_p), ("SizeOfImage", w.DWORD),
+                ("pad", w.DWORD), ("EntryPoint", ctypes.c_void_p)]
+psapi.EnumProcessModulesEx.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), w.DWORD, ctypes.POINTER(w.DWORD), w.DWORD]
+psapi.GetModuleBaseNameA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_char_p, w.DWORD]
+psapi.GetModuleInformation.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(MODULEINFO), w.DWORD]
+mods = []
+buf = (ctypes.c_void_p * 1024)()
+needed = w.DWORD(0)
+if psapi.EnumProcessModulesEx(hProc, buf, ctypes.sizeof(buf), ctypes.byref(needed), 3):
+    n = needed.value // ctypes.sizeof(ctypes.c_void_p)
+    for i in range(min(n, 1024)):
+        base = buf[i]
+        name = ctypes.create_string_buffer(260)
+        psapi.GetModuleBaseNameA(hProc, base, name, 260)
+        info = MODULEINFO()
+        psapi.GetModuleInformation(hProc, base, ctypes.byref(info), ctypes.sizeof(info))
+        mods.append((base, info.SizeOfImage, name.value.decode('utf-8', 'replace')))
+mods.sort(key=lambda m: m[0])
+
+def modname(addr):
+    if addr == 0:
+        return "null"
+    for b, s, n in mods:
+        if b <= addr < b + s:
+            return "%s+%x" % (n, addr - b)
+    return None
+
+# --- find the target window + its owning thread (main) ---
+user32 = ctypes.windll.user32
+user32.EnumWindows.argtypes = [ctypes.c_void_p, ctypes.c_void_p]
+user32.GetWindowThreadProcessId.argtypes = [ctypes.c_void_p, ctypes.POINTER(w.DWORD)]
+user32.GetClassNameA.argtypes = [ctypes.c_void_p, ctypes.c_char_p, ctypes.c_int]
+WNDENUMPROC = ctypes.WINFUNCTYPE(w.BOOL, ctypes.c_void_p, ctypes.c_void_p)
+found = {"hwnd": None, "tid": None}
+
+@WNDENUMPROC
+def enumcb(hwnd, lparam):
+    wpid = w.DWORD(0)
+    tid = user32.GetWindowThreadProcessId(hwnd, ctypes.byref(wpid))
+    if wpid.value != pid:
+        return True
+    cls = ctypes.create_string_buffer(256)
+    user32.GetClassNameA(hwnd, cls, 256)
+    if cls.value.decode('utf-8', 'replace') == wnd_class:
+        found["hwnd"] = hwnd
+        found["tid"] = tid
+        return False
+    return True
+
+user32.EnumWindows(enumcb, None)
+print("target window hwnd=%s tid=%s" % (found["hwnd"], found["tid"]))
+
+class THREADENTRY32(ctypes.Structure):
+    _fields_ = [("dwSize", w.DWORD), ("cntUsage", w.DWORD), ("th32ThreadID", w.DWORD),
+                ("th32OwnerProcessID", w.DWORD), ("tpBasePri", ctypes.c_long),
+                ("tpDeltaPri", ctypes.c_long), ("dwFlags", w.DWORD)]
+
+TH32CS_SNAPTHREAD = 0x4
+THREAD_SUSPEND_RESUME = 0x0002
+THREAD_GET_CONTEXT = 0x0008
+THREAD_QUERY_INFORMATION = 0x0040
+CONTEXT_CTRL_INT_SEG = 0x100001 | 0x2 | 0x20
+
+class CONTEXT64(ctypes.Structure):
+    _fields_ = [
+        ("P1Home", ctypes.c_uint64), ("P2Home", ctypes.c_uint64),
+        ("P3Home", ctypes.c_uint64), ("P4Home", ctypes.c_uint64),
+        ("P5Home", ctypes.c_uint64), ("P6Home", ctypes.c_uint64),
+        ("ContextFlags", w.DWORD), ("MxCsr", w.DWORD),
+        ("SegCs", w.WORD), ("SegDs", w.WORD), ("SegEs", w.WORD),
+        ("SegFs", w.WORD), ("SegGs", w.WORD), ("SegSs", w.WORD),
+        ("EFlags", w.DWORD),
+        ("Dr0", ctypes.c_uint64), ("Dr1", ctypes.c_uint64),
+        ("Dr2", ctypes.c_uint64), ("Dr3", ctypes.c_uint64),
+        ("Dr6", ctypes.c_uint64), ("Dr7", ctypes.c_uint64),
+        ("Rax", ctypes.c_uint64), ("Rcx", ctypes.c_uint64),
+        ("Rdx", ctypes.c_uint64), ("Rbx", ctypes.c_uint64),
+        ("Rsp", ctypes.c_uint64), ("Rbp", ctypes.c_uint64),
+        ("Rsi", ctypes.c_uint64), ("Rdi", ctypes.c_uint64),
+        ("R8", ctypes.c_uint64), ("R9", ctypes.c_uint64),
+        ("R10", ctypes.c_uint64), ("R11", ctypes.c_uint64),
+        ("R12", ctypes.c_uint64), ("R13", ctypes.c_uint64),
+        ("R14", ctypes.c_uint64), ("R15", ctypes.c_uint64),
+        ("Rip", ctypes.c_uint64),
+    ]
+
+k32.CreateToolhelp32Snapshot.argtypes = [w.DWORD, w.DWORD]
+k32.CreateToolhelp32Snapshot.restype = ctypes.c_void_p
+snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)
+te = THREADENTRY32(); te.dwSize = ctypes.sizeof(THREADENTRY32)
+threads = []
+ok = k32.Thread32First(snap, ctypes.byref(te))
+while ok:
+    if te.th32OwnerProcessID == pid:
+        threads.append(te.th32ThreadID)
+    ok = k32.Thread32Next(snap, ctypes.byref(te))
+
+INTEREST = ("Nexus", "daw_", "USER32", "ntdll", "win32u", "KERNELBASE", "ole32",
+            "combase", "uxtheme", "d2d1", "d3d11", "MSCTF", "IMM32", "SHELL32")
+
+def read_mem(addr, size):
+    """ReadProcessMemory with proper argtypes; returns bytes or None."""
+    chunk = ctypes.create_string_buffer(size)
+    read = ctypes.c_size_t(0)
+    k32.ReadProcessMemory.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
+    if not k32.ReadProcessMemory(hProc, ctypes.c_void_p(addr), chunk, size, ctypes.byref(read)):
+        return None
+    return chunk.raw[:read.value]
+
+def scan_stack(tid, depth=0x20000):
+    k32.OpenThread.argtypes = [w.DWORD, w.BOOL, w.DWORD]
+    k32.OpenThread.restype = ctypes.c_void_p
+    hT = k32.OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, False, tid)
+    if not hT:
+        return None, [], None
+    k32.SuspendThread(hT)
+    ctx = CONTEXT64(); ctx.ContextFlags = CONTEXT_CTRL_INT_SEG
+    r = k32.GetThreadContext(hT, ctypes.byref(ctx))
+    k32.ResumeThread(hT)
+    k32.CloseHandle(hT)
+    if not r:
+        return None, [], None
+    rsp = ctx.Rsp
+    chunks = []
+    fails = []
+    # read downward a bit first (trap frame may sit below rsp), then upward
+    for base in (rsp - 0x1000, rsp, rsp + 0x1000, rsp + 0x2000):
+        if base > rsp + depth:
+            break
+        d = read_mem(base, 0x1000)
+        if d is None:
+            fails.append(hex(base))
+        else:
+            chunks.append((base, d))
+    data = b"".join(d for _, d in chunks)
+    seen = []
+    for addr, d in chunks:
+        for i in range(0, len(d) - 8, 8):
+            val = struct.unpack_from('<Q', d, i)[0]
+            mn = modname(val)
+            if mn:
+                base_mod = mn.split("+")[0]
+                if any(base_mod.startswith(ig) for ig in INTEREST):
+                    seen.append((addr + i, mn))
+    seen.sort()
+    return ctx, seen, fails, rsp
+
+regnames = ["Rax", "Rcx", "Rdx", "Rbx", "Rsp", "Rbp", "Rsi", "Rdi",
+            "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15", "Rip"]
+
+for tid in threads:
+    ctx, stack, fails, rsp = scan_stack(tid)
+    tag = " <== WINDOW OWNER (main)" if tid == found["tid"] else ""
+    if not ctx:
+        print("=== tid %d (no context) ===" % tid)
+        continue
+    rip = ctx.Rip
+    print("=== tid %d rip=%s%s ===" % (tid, modname(rip) if modname(rip) else hex(rip), tag))
+    if tag:
+        print("     regs:", " ".join("%s=%s" % (n, hex(getattr(ctx, n))) for n in regnames))
+    print("     stack read fails:", fails if fails else "none")
+    shown = [s for s in stack if s[0] >= rsp] or stack
+    for a, mn in shown[-60:]:
+        print("   ", "%s @%x" % (mn, a))
+
+print("--- log tail ---")
+try:
+    with open(LOG, 'rb') as f:
+        f.seek(max(0, os.path.getsize(LOG) - 1000))
+        print(f.read().decode('utf-8', 'replace'))
+except FileNotFoundError:
+    pass
diff --git a/native_bridge/debug/stackwalk.py b/native_bridge/debug/stackwalk.py
new file mode 100644
index 0000000..f02bbdc
--- /dev/null
+++ b/native_bridge/debug/stackwalk.py
@@ -0,0 +1,218 @@
+# Stack walker v5: dbghelp StackWalk64 on every thread of a live process.
+# Usage: python stackwalk.py --bridge | --probe [secs]
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+MODE = sys.argv[1] if len(sys.argv) > 1 else "--bridge"
+SECS = int(sys.argv[2]) if len(sys.argv) > 2 else 15
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+PROBE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\gui_probe.exe"
+NEXUS = r"C:\Program Files\Common Files\VST3\Nexus.vst3"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                   "stack_sample.log" if MODE == "--bridge" else "stack_probe.log")
+
+k32 = ctypes.windll.kernel32
+k32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_char_p]
+k32.CreateFileMappingA.restype = ctypes.c_void_p
+k32.MapViewOfFile.argtypes = [ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_size_t]
+k32.MapViewOfFile.restype = ctypes.c_void_p
+INVALID_HANDLE_VALUE = ctypes.c_void_p(-1).value
+hMap = k32.CreateFileMappingA(INVALID_HANDLE_VALUE, None, 0x04, 0, SIZE, SHM_NAME.encode())
+ptr = k32.MapViewOfFile(hMap, 0xF001F, 0, 0, 0)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                if pattern in f.read():
+                    return True
+        except FileNotFoundError:
+            pass
+        time.sleep(0.2)
+    return False
+
+if MODE == "--bridge":
+    extra = dict(os.environ)
+    for k in list(extra):
+        if k.startswith("SF_"):
+            del extra[k]
+    extra.update({"SF_SHM_NAME": SHM_NAME, "SF_SAMPLE_RATE": "48000",
+                  "SF_BLOCK_SIZE": "256", "SF_ONCE": "1", "SF_AUTOGUI": "0"})
+    proc = subprocess.Popen([BRIDGE, "--shm", SHM_NAME], env=extra,
+                            stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+    marker = "isPlatformTypeSupported=0"
+    wait_after = 3
+else:
+    proc = subprocess.Popen([PROBE, NEXUS, "bridge_exact11", str(SECS)],
+                            stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+    marker = "openGUI: attached=0"
+    wait_after = 2
+
+print("pid", proc.pid, "mode", MODE)
+if not wait_log(marker, 120):
+    print("TIMEOUT waiting for", marker)
+    sys.exit(1)
+time.sleep(wait_after)
+pid = proc.pid
+
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_VM_READ = 0x0010
+hProc = k32.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, False, pid)
+if not hProc:
+    print("OpenProcess failed", ctypes.get_last_error())
+    sys.exit(1)
+
+# module map
+psapi = ctypes.windll.psapi
+class MODULEINFO(ctypes.Structure):
+    _fields_ = [("lpBaseOfDll", ctypes.c_void_p), ("SizeOfImage", w.DWORD),
+                ("pad", w.DWORD), ("EntryPoint", ctypes.c_void_p)]
+psapi.EnumProcessModulesEx.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), w.DWORD, ctypes.POINTER(w.DWORD), w.DWORD]
+psapi.GetModuleBaseNameA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_char_p, w.DWORD]
+psapi.GetModuleInformation.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(MODULEINFO), w.DWORD]
+mods = []
+buf = (ctypes.c_void_p * 1024)()
+needed = w.DWORD(0)
+if psapi.EnumProcessModulesEx(hProc, buf, ctypes.sizeof(buf), ctypes.byref(needed), 3):
+    n = needed.value // ctypes.sizeof(ctypes.c_void_p)
+    for i in range(min(n, 1024)):
+        base = buf[i]
+        name = ctypes.create_string_buffer(260)
+        psapi.GetModuleBaseNameA(hProc, base, name, 260)
+        info = MODULEINFO()
+        psapi.GetModuleInformation(hProc, base, ctypes.byref(info), ctypes.sizeof(info))
+        mods.append((base, info.SizeOfImage, name.value.decode('utf-8', 'replace')))
+mods.sort(key=lambda m: m[0])
+
+def modname(addr):
+    if addr == 0:
+        return "null"
+    for b, s, n in mods:
+        if b <= addr < b + s:
+            return "%s+%x" % (n, addr - b)
+    return "??%x" % addr
+
+# dbghelp stack walk
+dbg = ctypes.WinDLL("dbghelp")
+dbg.SymInitializeW.argtypes = [ctypes.c_void_p, ctypes.c_wchar_p, w.BOOL]
+dbg.SymInitializeW.restype = w.BOOL
+dbg.SymSetOptions.argtypes = [w.DWORD]
+dbg.SymSetOptions.restype = w.DWORD
+dbg.StackWalk64.argtypes = [w.DWORD, ctypes.c_void_p, ctypes.c_void_p,
+                            ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p,
+                            ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, w.DWORD]
+dbg.StackWalk64.restype = w.BOOL
+
+class STACKFRAME64(ctypes.Structure):
+    class ADDR(ctypes.Structure):
+        _fields_ = [("Offset", ctypes.c_uint64), ("Segment", w.DWORD),
+                    ("Mode", w.DWORD)]
+    _fields_ = [("AddrPC", ADDR), ("AddrReturn", ADDR), ("AddrFrame", ADDR),
+                ("AddrStack", ADDR), ("AddrBStore", ADDR), ("FuncTableEntry", ctypes.c_void_p),
+                ("Params", ctypes.c_uint64 * 4), ("Far", w.BOOL),
+                ("Virtual", w.BOOL), ("Reserved", ctypes.c_uint64 * 3),
+                ("KdHelp", ctypes.c_uint64 * 2)]
+
+class CONTEXT64(ctypes.Structure):
+    _fields_ = [
+        ("P1Home", ctypes.c_uint64), ("P2Home", ctypes.c_uint64),
+        ("P3Home", ctypes.c_uint64), ("P4Home", ctypes.c_uint64),
+        ("P5Home", ctypes.c_uint64), ("P6Home", ctypes.c_uint64),
+        ("ContextFlags", w.DWORD), ("MxCsr", w.DWORD),
+        ("SegCs", w.WORD), ("SegDs", w.WORD), ("SegEs", w.WORD),
+        ("SegFs", w.WORD), ("SegGs", w.WORD), ("SegSs", w.WORD),
+        ("EFlags", w.DWORD),
+        ("Dr0", ctypes.c_uint64), ("Dr1", ctypes.c_uint64),
+        ("Dr2", ctypes.c_uint64), ("Dr3", ctypes.c_uint64),
+        ("Dr6", ctypes.c_uint64), ("Dr7", ctypes.c_uint64),
+        ("Rax", ctypes.c_uint64), ("Rcx", ctypes.c_uint64),
+        ("Rdx", ctypes.c_uint64), ("Rbx", ctypes.c_uint64),
+        ("Rsp", ctypes.c_uint64), ("Rbp", ctypes.c_uint64),
+        ("Rsi", ctypes.c_uint64), ("Rdi", ctypes.c_uint64),
+        ("R8", ctypes.c_uint64), ("R9", ctypes.c_uint64),
+        ("R10", ctypes.c_uint64), ("R11", ctypes.c_uint64),
+        ("R12", ctypes.c_uint64), ("R13", ctypes.c_uint64),
+        ("R14", ctypes.c_uint64), ("R15", ctypes.c_uint64),
+        ("Rip", ctypes.c_uint64),
+    ]
+
+ReadProcessMemory_cb = ctypes.CFUNCTYPE(w.BOOL, ctypes.c_void_p, ctypes.c_uint64,
+                                        ctypes.c_void_p, w.DWORD, ctypes.POINTER(w.DWORD))
+
+@ReadProcessMemory_cb
+def read_mem(hProc, addr, buf, size, nread):
+    return k32.ReadProcessMemory(hProc, ctypes.c_void_p(addr), buf, size, nread)
+
+class THREADENTRY32(ctypes.Structure):
+    _fields_ = [("dwSize", w.DWORD), ("cntUsage", w.DWORD), ("th32ThreadID", w.DWORD),
+                ("th32OwnerProcessID", w.DWORD), ("tpBasePri", ctypes.c_long),
+                ("tpDeltaPri", ctypes.c_long), ("dwFlags", w.DWORD)]
+
+TH32CS_SNAPTHREAD = 0x4
+THREAD_SUSPEND_RESUME = 0x0002
+THREAD_GET_CONTEXT = 0x0008
+THREAD_QUERY_INFORMATION = 0x0040
+CONTEXT_CTRL_INT_SEG = 0x100001 | 0x2 | 0x20
+IMAGE_FILE_MACHINE_AMD64 = 0x8664
+
+dbg.SymInitializeW(hProc, None, True)
+dbg.SymSetOptions(0x2)  # SYMOPT_DEFERRED_LOADS
+
+snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)
+te = THREADENTRY32(); te.dwSize = ctypes.sizeof(THREADENTRY32)
+threads = []
+ok = k32.Thread32First(snap, ctypes.byref(te))
+while ok:
+    if te.th32OwnerProcessID == pid:
+        threads.append(te.th32ThreadID)
+    ok = k32.Thread32Next(snap, ctypes.byref(te))
+
+print("threads(%d): %s" % (len(threads), threads))
+for tid in threads:
+    hT = k32.OpenThread(THREAD_SUSPEND_RESUME | THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION, False, tid)
+    if not hT:
+        continue
+    k32.SuspendThread(hT)
+    ctx = CONTEXT64(); ctx.ContextFlags = CONTEXT_CTRL_INT_SEG
+    r = k32.GetThreadContext(hT, ctypes.byref(ctx))
+    if not r:
+        k32.ResumeThread(hT); k32.CloseHandle(hT)
+        print("tid %d GetThreadContext fail" % tid)
+        continue
+    sf = STACKFRAME64()
+    sf.AddrPC.Offset = ctx.Rip
+    sf.AddrPC.Mode = 0
+    sf.AddrReturn.Offset = ctx.Rsp  # will be set by walker
+    sf.AddrFrame.Offset = ctx.Rbp
+    sf.AddrStack.Offset = ctx.Rsp
+    frames = []
+    for i in range(48):
+        if not dbg.StackWalk64(IMAGE_FILE_MACHINE_AMD64, hProc, hT, ctypes.byref(sf),
+                               ctypes.byref(ctx), read_mem,
+                               dbg.SymFunctionTableAccess64, dbg.SymGetModuleBase64,
+                               None, 0):
+            break
+        if sf.AddrPC.Offset == 0:
+            break
+        frames.append(modname(sf.AddrPC.Offset))
+        if sf.AddrPC.Offset == sf.AddrReturn.Offset:
+            break
+        if i > 0 and frames[-1] == frames[-2]:
+            break
+    k32.ResumeThread(hT)
+    k32.CloseHandle(hT)
+    print("=== tid %d (rip %s) ===" % (tid, modname(ctx.Rip)))
+    for f in frames:
+        print("   ", f)
+
+print("--- log tail ---")
+try:
+    with open(LOG, 'rb') as f:
+        f.seek(max(0, os.path.getsize(LOG) - 1200))
+        print(f.read().decode('utf-8', 'replace'))
+except FileNotFoundError:
+    pass
diff --git a/native_bridge/debug/waitscan.py b/native_bridge/debug/waitscan.py
new file mode 100644
index 0000000..053794b
--- /dev/null
+++ b/native_bridge/debug/waitscan.py
@@ -0,0 +1,198 @@
+# waitscan: dump all threads' registers + wait-handle object types of a hung
+# bridge. Goal: find what Nexus attached() and its worker threads wait on.
+import ctypes, ctypes.wintypes as w, struct, subprocess, sys, os, time
+
+sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+
+SHM_NAME = "SonicForge_DAW_IPC_VERIFY"
+SIZE = 32768
+BRIDGE = r"C:\Users\locpham\SonicForgeStudio\native_bridge\build\Release\daw_vst_bridge.exe"
+LOG = os.path.join(os.path.dirname(os.path.abspath(__file__)), "waitscan.log")
+
+k32 = ctypes.windll.kernel32
+k32.CreateFileMappingA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_char_p]
+k32.CreateFileMappingA.restype = ctypes.c_void_p
+k32.MapViewOfFile.argtypes = [ctypes.c_void_p, w.DWORD, w.DWORD, w.DWORD, ctypes.c_size_t]
+k32.MapViewOfFile.restype = ctypes.c_void_p
+hMap = k32.CreateFileMappingA(ctypes.c_void_p(-1).value, None, 0x04, 0, SIZE, SHM_NAME.encode())
+k32.MapViewOfFile(hMap, 0xF001F, 0, 0, 0)
+
+def wait_log(pattern, timeout):
+    end = time.time() + timeout
+    while time.time() < end:
+        try:
+            with open(LOG, 'r', encoding='utf-8', errors='replace') as f:
+                if pattern in f.read():
+                    return True
+        except FileNotFoundError:
+            pass
+        time.sleep(0.2)
+    return False
+
+extra = dict(os.environ)
+for k in list(extra):
+    if k.startswith("SF_"):
+        del extra[k]
+extra.update({"SF_SHM_NAME": SHM_NAME, "SF_SAMPLE_RATE": "48000",
+              "SF_BLOCK_SIZE": "256", "SF_ONCE": "1", "SF_AUTOGUI": "0",
+              "SF_ONCE_PROBEWIN": "1"})
+proc = subprocess.Popen([BRIDGE, "--shm", SHM_NAME], env=extra,
+                        stdout=open(LOG, 'wb'), stderr=subprocess.STDOUT)
+pid = proc.pid
+print("pid", pid)
+if not wait_log("isPlatformTypeSupported=0", 120):
+    print("TIMEOUT"); sys.exit(1)
+time.sleep(3)
+
+PROCESS_QUERY_INFORMATION = 0x0400
+PROCESS_VM_READ = 0x0010
+PROCESS_DUP_HANDLE = 0x0040
+TH32CS_SNAPTHREAD = 0x4
+THREAD_GET_CONTEXT = 0x0008
+THREAD_QUERY_INFORMATION = 0x0040
+THREAD_SUSPEND_RESUME = 0x0002
+
+k32.OpenProcess.argtypes = [w.DWORD, w.BOOL, w.DWORD]
+k32.OpenProcess.restype = ctypes.c_void_p
+hProc = k32.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_DUP_HANDLE, False, pid)
+if not hProc:
+    print("OpenProcess failed", ctypes.get_last_error()); sys.exit(1)
+
+# module list for name resolution
+psapi = ctypes.windll.psapi
+class MODULEINFO(ctypes.Structure):
+    _fields_ = [("lpBaseOfDll", ctypes.c_void_p), ("SizeOfImage", w.DWORD),
+                ("pad", w.DWORD), ("EntryPoint", ctypes.c_void_p)]
+psapi.EnumProcessModulesEx.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), w.DWORD, ctypes.POINTER(w.DWORD), w.DWORD]
+psapi.GetModuleInformation.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(MODULEINFO), w.DWORD]
+psapi.GetModuleBaseNameA.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_char_p, w.DWORD]
+nmods = w.DWORD(0)
+psapi.EnumProcessModulesEx(hProc, None, 0, ctypes.byref(nmods), 3)
+arr = (ctypes.c_void_p * (nmods.value // 8))()
+psapi.EnumProcessModulesEx(hProc, arr, nmods.value, ctypes.byref(nmods), 3)
+mods = []
+for m in arr:
+    if not m:
+        continue
+    mi = MODULEINFO()
+    psapi.GetModuleInformation(hProc, m, ctypes.byref(mi), ctypes.sizeof(MODULEINFO))
+    name = ctypes.create_string_buffer(260)
+    psapi.GetModuleBaseNameA(hProc, m, name, 260)
+    mods.append((mi.lpBaseOfDll, mi.SizeOfImage, name.value.decode('latin1')))
+def resolve(addr):
+    for base, size, name in mods:
+        if base <= addr < base + size:
+            return f"{name}+0x{addr-base:x}"
+    return f"0x{addr:x}"
+
+class THREADENTRY32(ctypes.Structure):
+    _fields_ = [("dwSize", w.DWORD), ("cntUsage", w.DWORD), ("th32ThreadID", w.DWORD),
+                ("th32OwnerProcessID", w.DWORD), ("tpBasePri", w.LONG),
+                ("tpDeltaPri", w.LONG), ("dwFlags", w.DWORD)]
+te = THREADENTRY32()
+te.dwSize = ctypes.sizeof(THREADENTRY32)
+snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0)
+ok = k32.Thread32First(snap, ctypes.byref(te))
+threads = []
+while ok:
+    if te.th32OwnerProcessID == pid:
+        threads.append(te.th32ThreadID)
+    ok = k32.Thread32Next(snap, ctypes.byref(te))
+k32.CloseHandle(snap)
+print(f"threads: {threads}")
+
+class CONTEXT(ctypes.Structure):
+    # full x64 CONTEXT is 0x4d0 bytes; we only parse the GPR area (0x00-0xf8).
+    _fields_ = [("raw", ctypes.c_ubyte * 0x4d0)]
+
+CONTEXT_AMD64 = 0x00100000
+CONTEXT_CONTROL = CONTEXT_AMD64 | 0x1
+CONTEXT_INTEGER = CONTEXT_AMD64 | 0x2
+CONTEXT_FULL = CONTEXT_CONTROL | CONTEXT_INTEGER
+def ctx_regs(ctx):
+    b = bytes(ctx.raw)
+    u = lambda o: struct.unpack_from('<Q', b, o)[0]
+    return dict(rip=u(0xF8), rsp=u(0x98), rcx=u(0x80), rdx=u(0x88), r8=u(0xB8), r9=u(0xC0),
+                rbx=u(0x90), rax=u(0x78))
+k32.GetThreadContext.argtypes = [ctypes.c_void_p, ctypes.POINTER(CONTEXT)]
+k32.GetThreadContext.restype = w.BOOL
+k32.SuspendThread.argtypes = [ctypes.c_void_p]
+k32.SuspendThread.restype = w.DWORD
+k32.ResumeThread.argtypes = [ctypes.c_void_p]
+k32.ResumeThread.restype = w.DWORD
+k32.OpenThread.argtypes = [w.DWORD, w.BOOL, w.DWORD]
+k32.OpenThread.restype = ctypes.c_void_p
+k32.CloseHandle.argtypes = [ctypes.c_void_p]
+k32.CloseHandle.restype = w.BOOL
+k32.DuplicateHandle.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(ctypes.c_void_p), w.DWORD, w.BOOL, w.DWORD]
+k32.DuplicateHandle.restype = w.BOOL
+k32.GetCurrentProcess.restype = ctypes.c_void_p
+
+ntdll = ctypes.windll.ntdll
+class UNICODE_STRING(ctypes.Structure):
+    _fields_ = [("Length", w.USHORT), ("MaximumLength", w.USHORT), ("Buffer", ctypes.c_void_p)]
+class OBJECT_NAME_INFORMATION(ctypes.Structure):
+    _fields_ = [("Name", UNICODE_STRING)]
+class OBJECT_TYPE_INFORMATION(ctypes.Structure):
+    _fields_ = [("Name", UNICODE_STRING), ("TotalNumberOfObjects", w.ULONG), ("TotalNumberOfHandles", w.ULONG),
+                ("TotalPagedPoolUsage", w.ULONG), ("TotalNonPagedPoolUsage", w.ULONG),
+                ("TotalNamePoolUsage", w.ULONG), ("TotalHandleTableUsage", w.ULONG),
+                ("HighWaterNumberOfObjects", w.ULONG), ("HighWaterNumberOfHandles", w.ULONG),
+                ("HighWaterPagedPoolUsage", w.ULONG), ("HighWaterNonPagedPoolUsage", w.ULONG),
+                ("HighWaterNamePoolUsage", w.ULONG), ("HighWaterHandleTableUsage", w.ULONG),
+                ("InvalidAttributes", w.ULONG), ("GenericMapping", w.BYTE * 16), ("ValidAccess", w.ULONG),
+                ("SecurityRequired", w.BYTE), ("MaintainHandleCount", w.BYTE),
+                ("MaintainTypeList", w.BYTE), ("Reserved", w.BYTE * 9)]
+
+def obj_info(h):
+    # duplicate to get a handle valid in OUR process for querying
+    dup = ctypes.c_void_p()
+    if not k32.DuplicateHandle(hProc, ctypes.c_void_p(h), k32.GetCurrentProcess(),
+                               ctypes.byref(dup), 0, False, 0x2):  # DUPLICATE_SAME_ACCESS
+        return "dup-fail"
+    # type
+    buf = ctypes.create_string_buffer(512)
+    sz = w.ULONG(0)
+    r = ntdll.NtQueryObject(dup, 2, buf, 512, ctypes.byref(sz))  # ObjectTypeInformation=2
+    typ = "?"
+    if r == 0:
+        ti = OBJECT_TYPE_INFORMATION.from_buffer(buf)
+        if ti.Name.Buffer:
+            typ = ctypes.wstring_at(ti.Name.Buffer)
+    # name
+    buf2 = ctypes.create_string_buffer(1024)
+    sz2 = w.ULONG(0)
+    name = ""
+    r = ntdll.NtQueryObject(dup, 1, buf2, 1024, ctypes.byref(sz2))  # ObjectNameInformation=1
+    if r == 0:
+        oi = OBJECT_NAME_INFORMATION.from_buffer(buf2)
+        if oi.Name.Buffer:
+            try:
+                name = ctypes.wstring_at(oi.Name.Buffer)
+            except Exception:
+                name = "(name-err)"
+    k32.CloseHandle(dup)
+    return f"{typ}|{name}"
+
+for tid in threads:
+    ht = k32.OpenThread(THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | THREAD_SUSPEND_RESUME, False, tid)
+    if not ht:
+        print(f"tid {tid}: open fail {ctypes.get_last_error()}"); continue
+    k32.SuspendThread(ht)
+    ctx = CONTEXT()
+    struct.pack_into('<I', ctx.raw, 0x30, CONTEXT_FULL)
+    if k32.GetThreadContext(ht, ctypes.byref(ctx)):
+        r = ctx_regs(ctx)
+        rip = r['rip']; rcx = r['rcx']
+        line = f"tid {tid}: rip={resolve(rip)} rcx=0x{rcx:x} rdx=0x{r['rdx']:x} r8=0x{r['r8']:x} r9=0x{r['r9']:x} rsp=0x{r['rsp']:x}"
+        if rip and rcx:
+            try:
+                info = obj_info(rcx)
+                line += f" | wait_obj: {info}"
+            except Exception as e:
+                line += f" | obj_err {e}"
+        print(line)
+    else:
+        print(f"tid {tid}: GetThreadContext fail {ctypes.get_last_error()}")
+    k32.ResumeThread(ht)
+    k32.CloseHandle(ht)
diff --git a/native_bridge/include/NativeInstrumentEngine.h b/native_bridge/include/NativeInstrumentEngine.h
index f5b716e..8dfa266 100644
--- a/native_bridge/include/NativeInstrumentEngine.h
+++ b/native_bridge/include/NativeInstrumentEngine.h
@@ -8,6 +8,7 @@
 
 #include <map>
 #include <mutex>
+#include <functional>
 #include <memory>
 #include <string>
 #include <vector>
@@ -72,6 +73,19 @@ public:
 
     INativeInstrument* get(uint32_t channel);
 
+    // Real-time MIDI dispatch (audio loop thread). Each call holds mu_ for the
+    // WHOLE call — lookup + reloading check + instrument call under one lock —
+    // so a worker thread's assign()/unload() can never swap the map and destroy
+    // the old instance while dispatch is inside a method on it (use-after-free
+    // when loading a new VSTi while others play). Events for unassigned or
+    // reloading channels are dropped (a mid-reload instance must not be touched
+    // while its worker rebuilds state_ in place).
+    void noteOn(uint32_t channel, uint32_t pitch, float velocity);
+    void noteOff(uint32_t channel, uint32_t pitch);
+    void controlChange(uint32_t channel, uint32_t cc, uint32_t value);
+    void programChange(uint32_t channel, uint32_t program);
+    void pitchBend(uint32_t channel, uint32_t bend14);
+
     // Remove and destroy the instrument on `channel` (its destructor may call
     // VST terminate — MUST run on the channel worker thread, caller's duty).
     // Used by Option B: two live instances of the same plugin DLL (Nexus)
@@ -87,6 +101,16 @@ public:
     // teardown never races the audio thread.
     void setReloading(uint32_t channel, bool on);
 
+    // True while a channel is being rebuilt (instance teardown/reload on its
+    // worker thread): real-time code drops MIDI for it. Channel-level flag —
+    // survives the instance swap (the per-instance flag dies with the object).
+    bool isReloading(uint32_t channel) const;
+    // Editor-open predicate: while any VST editor is attached, channels whose
+    // plugin DLL path has an open editor count as quiet (same-plugin channels
+    // too -- the worker pumps the editor's window proc inside the DLL while the
+    // audio loop process()es other instances of the same DLL).
+    void setEditorOpenPredicate(std::function<bool(const std::string& lowerPath)> fn);
+
     // Flush every sounding note on every assigned channel.
     void allNotesOff();
 
@@ -103,6 +127,13 @@ private:
     std::map<uint32_t, std::string> paths_;  // last assigned path per channel
     // Per-instrument scratch so engines that overwrite (not mix) stay additive.
     std::vector<float> scratchL_, scratchR_;
+    // Channel-level reload flag (see isReloading) — indexed by MIDI channel.
+    bool reloadingCh_[16] = {};
+    // True when the channel's plugin DLL has an attached editor (or its reload
+    // is in progress): real-time code drops MIDI and skips rendering. Lowercased
+    // compare inside -- Windows plugin paths are case-insensitive.
+    bool channelQuiet(uint32_t ch) const;
+    std::function<bool(const std::string&)> editorOpenFn_;
 };
 
 #endif // NATIVE_INSTRUMENT_ENGINE_H
diff --git a/native_bridge/src/NativeInstrumentEngine.cpp b/native_bridge/src/NativeInstrumentEngine.cpp
index b2b6a11..d876c72 100644
--- a/native_bridge/src/NativeInstrumentEngine.cpp
+++ b/native_bridge/src/NativeInstrumentEngine.cpp
@@ -9,6 +9,8 @@
 #define FS_SYNTH (static_cast<fluid_synth_t*>(synth))
 #define FS_SETTINGS (static_cast<fluid_settings_t*>(settings))
 
+#include <algorithm>
+#include <cctype>
 #include <cstring>
 #include <iostream>
 
@@ -187,6 +189,10 @@ bool InstrumentEngineManager::assign(uint32_t channel, InstrumentType type,
         if (it != channels_.end()) oldInst = std::move(it->second);
         channels_[channel] = std::move(inst);
         paths_[channel] = path;
+        // Fresh instance is by construction not reloading — clear the channel
+        // flag so real-time MIDI dispatch (which drops reloading channels)
+        // flows to it again.
+        reloadingCh_[channel] = false;
     }
     oldInst.reset();
     return true;
@@ -203,6 +209,7 @@ void InstrumentEngineManager::unload(uint32_t channel) {
         if (it != channels_.end()) oldInst = std::move(it->second);
         channels_.erase(channel);
         paths_.erase(channel);
+        reloadingCh_[channel] = false;
     }
     oldInst.reset();
 }
@@ -221,13 +228,86 @@ INativeInstrument* InstrumentEngineManager::get(uint32_t channel) {
 
 void InstrumentEngineManager::setReloading(uint32_t channel, bool on) {
     std::lock_guard<std::mutex> lock(mu_);
+    if (channel < 16) reloadingCh_[channel] = on;
     auto it = channels_.find(channel);
     if (it != channels_.end()) it->second->setReloading(on);
 }
 
+bool InstrumentEngineManager::isReloading(uint32_t channel) const {
+    std::lock_guard<std::mutex> lock(mu_);
+    return channel < 16 && reloadingCh_[channel];
+}
+
+void InstrumentEngineManager::setEditorOpenPredicate(std::function<bool(const std::string&)> fn) {
+    std::lock_guard<std::mutex> lock(mu_);
+    editorOpenFn_ = std::move(fn);
+}
+
+// Quiet = reloading OR an editor attached for the channel's plugin DLL path.
+// Called with mu_ held by the real-time dispatch (the predicate locks
+// g_editorMutex -- lock order mu_ -> g_editorMutex; g_editorMutex is never
+// held while taking mu_).
+bool InstrumentEngineManager::channelQuiet(uint32_t ch) const {
+    if (ch >= 16 || reloadingCh_[ch]) return true;
+    if (!editorOpenFn_) return false;
+    auto it = paths_.find(ch);
+    if (it == paths_.end() || it->second.empty()) return false;
+    std::string lp = it->second;
+    std::transform(lp.begin(), lp.end(), lp.begin(),
+                   [](unsigned char c) { return (char)::tolower(c); });
+    return editorOpenFn_(lp);
+}
+
+// Real-time MIDI dispatch: hold mu_ for the WHOLE call so assign()/unload()
+// (map swap + old-instance destruction outside the lock) and reload()/reloadForGUI()
+// (state_ deleted in place on the worker) can never destroy/free the instance
+// while dispatch is inside a method on it — use-after-free when loading a new
+// VSTi while other channels keep playing. Reloading channels are skipped: their
+// instance is mid-teardown and must not be touched.
+void InstrumentEngineManager::noteOn(uint32_t channel, uint32_t pitch, float velocity) {
+    std::lock_guard<std::mutex> lock(mu_);
+    if (channelQuiet(channel)) return;
+    auto it = channels_.find(channel);
+    if (it == channels_.end()) return;
+    it->second->noteOn(channel, pitch, velocity, 0);
+}
+
+void InstrumentEngineManager::noteOff(uint32_t channel, uint32_t pitch) {
+    std::lock_guard<std::mutex> lock(mu_);
+    if (channelQuiet(channel)) return;
+    auto it = channels_.find(channel);
+    if (it == channels_.end()) return;
+    it->second->noteOff(channel, pitch, 0);
+}
+
+void InstrumentEngineManager::controlChange(uint32_t channel, uint32_t cc, uint32_t value) {
+    std::lock_guard<std::mutex> lock(mu_);
+    if (channelQuiet(channel)) return;
+    auto it = channels_.find(channel);
+    if (it == channels_.end()) return;
+    it->second->controlChange(channel, cc, value);
+}
+
+void InstrumentEngineManager::programChange(uint32_t channel, uint32_t program) {
+    std::lock_guard<std::mutex> lock(mu_);
+    if (channelQuiet(channel)) return;
+    auto it = channels_.find(channel);
+    if (it == channels_.end()) return;
+    it->second->programChange(channel, program);
+}
+
+void InstrumentEngineManager::pitchBend(uint32_t channel, uint32_t bend14) {
+    std::lock_guard<std::mutex> lock(mu_);
+    if (channelQuiet(channel)) return;
+    auto it = channels_.find(channel);
+    if (it == channels_.end()) return;
+    it->second->pitchBend(channel, bend14);
+}
+
 void InstrumentEngineManager::allNotesOff() {
     std::lock_guard<std::mutex> lock(mu_);
     for (auto& [ch, inst] : channels_) {
+        if (channelQuiet(ch)) continue;  // mid-rebuild / editor open: do not touch the instance
         for (uint32_t n = 0; n < 128; ++n) inst->noteOff(ch, n, 0);
     }
 }
@@ -242,6 +322,7 @@ void InstrumentEngineManager::renderAll(float* outputL, float* outputR, uint32_t
         scratchR_.resize(numSamples);
     }
     for (auto& [ch, inst] : channels_) {
+        if (channelQuiet(ch)) continue;  // editor open on this plugin DLL: do not process
         std::memset(scratchL_.data(), 0, numSamples * sizeof(float));
         std::memset(scratchR_.data(), 0, numSamples * sizeof(float));
         inst->processAudioBlock(scratchL_.data(), scratchR_.data(), numSamples);
diff --git a/native_bridge/src/gui_probe.cpp b/native_bridge/src/gui_probe.cpp
index 30ca659..77bef0b 100644
--- a/native_bridge/src/gui_probe.cpp
+++ b/native_bridge/src/gui_probe.cpp
@@ -3,6 +3,7 @@
 // tests openGUI under different thread/pump/parent-window setups so we can
 // find why view->attached() hangs inside the bridge.
 #include "Vst3Instrument.h"
+#include "NativeInstrumentEngine.h"
 
 #ifdef _WIN32
 #include <windows.h>
@@ -77,10 +78,56 @@ public:
     bool stop = false;
 };
 
+// ChannelWorker replica: persistent thread + COM STA + idle message pump
+// (16 messages per 5ms wait, exactly like native_bridge/src/main.cpp).
+class PumpWorker {
+public:
+    void start() {
+        th = std::thread([this] {
+#ifdef _WIN32
+            OleInitialize(nullptr);
+#endif
+            std::unique_lock<std::mutex> lk(mu);
+            for (;;) {
+                if (stop && jobs.empty()) break;
+                if (!jobs.empty()) {
+                    auto j = std::move(jobs.front());
+                    jobs.pop_front();
+                    lk.unlock();
+                    j();
+                    lk.lock();
+                    continue;
+                }
+                cv.wait_for(lk, std::chrono::milliseconds(5));
+                lk.unlock();
+                MSG msg;
+                for (int i = 0; i < 16; ++i) {
+                    if (!PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) break;
+                    TranslateMessage(&msg);
+                    DispatchMessageW(&msg);
+                }
+                lk.lock();
+            }
+#ifdef _WIN32
+            OleUninitialize();
+#endif
+        });
+    }
+    void post(std::function<void()> j) {
+        { std::lock_guard<std::mutex> lk(mu); jobs.push_back(std::move(j)); }
+        cv.notify_all();
+    }
+    std::thread th;
+    std::mutex mu;
+    std::condition_variable cv;
+    std::deque<std::function<void()>> jobs;
+    bool stop = false;
+};
+
 int main(int argc, char* argv[]) {
     if (argc < 2) {
         printf("usage: gui_probe <plugin.vst3> [variant] [secs] [hwnd]\n"
-               "variants: main_own | worker_own_nopump | worker_own_pump | worker_foreign_nopump | worker_foreign_pump | bridge_like | same_thread | two_instances | two_instances_close | close_reopen | bridge_two | shared_worker | two_workers_close\n");
+               "variants: main_own | worker_own_nopump | worker_own_pump | worker_foreign_nopump | worker_foreign_pump | bridge_like | same_thread | two_instances | two_instances_close | close_reopen | bridge_two | shared_worker | two_workers_close | bridge_current | bridge_fixed\n");
         return 2;
     }
     std::string path = argv[1];
@@ -489,6 +536,1245 @@ int main(int argc, char* argv[]) {
         }
         printf("RESULT: done=%d attached_ok=%d\n", 1, 1);
         return 0;
+    } else if (variant == "bridge_current") {
+        // EXACT current bridge architecture: plugin loaded on the channel's
+        // persistent worker (COM STA + idle pump), editor parent window created
+        // on the MAIN thread, view->attached() on the worker -> the editor's
+        // child windows (worker-owned) are parented to a MAIN-thread window.
+        // Main pump + worker pump both dispatch concurrently. This is the
+        // configuration the shipping bridge crashes with (USER32 c000041d ~1s
+        // after attach, observed twice in bridge.log 2026-08-14).
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> done{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_current] load on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_current] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            if (!r) { done = true; return; }
+            printf("[bridge_current] openGUI hwnd=%p (parent on MAIN thread)\n", targetHwnd);
+            fflush(stdout);
+            r = inst.openGUI(targetHwnd);
+            printf("[bridge_current] attach=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            ok = r;
+            done = true;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_current): done=%d attached_ok=%d (survived %ds)\n",
+               done.load() ? 1 : 0, ok.load() ? 1 : 0, secs);
+        return (done.load() && ok.load()) ? 0 : 3;
+    } else if (variant == "bridge_fixed") {
+        // PROPOSED FIX: the editor parent window is created ON the channel
+        // worker (same thread as attach + editor children), so parent and
+        // children share one thread; the worker's idle pump dispatches both;
+        // main pump runs concurrently like the audio loop. No cross-thread
+        // parent-child relationship anywhere.
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> done{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_fixed] load + create window + attach on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_fixed] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            if (!r) { done = true; return; }
+            HWND h = CreateWindowEx(0, "GuiProbeClass", "ProbeFixed", WS_OVERLAPPEDWINDOW,
+                                    0, 0, 800, 600, nullptr, nullptr, GetModuleHandle(nullptr), nullptr);
+            printf("[bridge_fixed] hwnd=%p (parent on WORKER thread)\n", (void*)h);
+            fflush(stdout);
+            r = inst.openGUI(h);
+            printf("[bridge_fixed] attach=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            ok = r;
+            done = true;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_fixed): done=%d attached_ok=%d (survived %ds)\n",
+               done.load() ? 1 : 0, ok.load() ? 1 : 0, secs);
+        return (done.load() && ok.load()) ? 0 : 3;
+    } else if (variant == "bridge_fixed2") {
+        // FIX v2: parent window created ON the worker with WS_VISIBLE and
+        // painted (ShowWindow + UpdateWindow) BEFORE view->attached(), so the
+        // plugin's attached() has nothing to wait for (its hang in bridge_fixed
+        // was a missing WM_PAINT/show on the parent). Parent + editor children
+        // share the worker thread; the worker idle pump dispatches both.
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> done{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_fixed2] load + create(WS_VISIBLE) + paint + attach on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_fixed2] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            if (!r) { done = true; return; }
+            HWND h = CreateWindowEx(0, "GuiProbeClass", "ProbeFixed2",
+                                    WS_OVERLAPPEDWINDOW | WS_VISIBLE,
+                                    0, 0, 800, 600, nullptr, nullptr, GetModuleHandle(nullptr), nullptr);
+            ShowWindow(h, SW_SHOW);
+            UpdateWindow(h);
+            printf("[bridge_fixed2] hwnd=%p shown+painted\n", (void*)h);
+            fflush(stdout);
+            r = inst.openGUI(h);
+            printf("[bridge_fixed2] attach=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            ok = r;
+            done = true;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_fixed2): done=%d attached_ok=%d (survived %ds)\n",
+               done.load() ? 1 : 0, ok.load() ? 1 : 0, secs);
+        return (done.load() && ok.load()) ? 0 : 3;
+        } else if (variant == "bridge_final") {
+        // PROPOSED FIX: plugin loaded on the persistent worker (COM STA apartment
+        // stays alive), editor parent window created on MAIN, view->attached()
+        // runs on the MAIN thread -> editor child windows are MAIN-owned (no
+        // cross-thread parent-child). Main pump dispatches editor messages;
+        // worker idle pump keeps running. Tests whether attach-on-main works
+        // when loadPlugin happened on ANOTHER alive thread.
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_final] load on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_final] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (!loaded.load()) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_final): load timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_final] openGUI hwnd=%p (parent on MAIN, attach on MAIN)\n", targetHwnd);
+        fflush(stdout);
+        ok = inst.openGUI(targetHwnd);
+        printf("[bridge_final] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_final): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact") {
+        // EXACT bridge sequence minus worker-job side effects: plugin loaded on
+        // the persistent worker, THEN the parent window is created (like
+        // handleOpenGui does AFTER the instrument exists), then attachView on
+        // the MAIN thread directly. Isolates "window created after load" (the
+        // bridge) vs bridge_final's "window created before load" (works).
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_exact] load on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_exact] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (!loaded.load()) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_exact): load timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        // Window created AFTER load, like handleOpenGui (hidden, no warm-up).
+        HWND h = CreateWindowEx(0, "GuiProbeClass", "ProbeExact", WS_OVERLAPPEDWINDOW,
+                                0, 0, 800, 600, nullptr, nullptr, GetModuleHandle(nullptr), nullptr);
+        printf("[bridge_exact] hwnd=%p (created AFTER load, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        ok = inst.attachView(h);
+        printf("[bridge_exact] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact2") {
+        // bridge_exact + the bridge's AUDIO LOOP: after load, main keeps
+        // calling processAudioBlock (like renderAll every 5ms) BEFORE attach.
+        // Isolates "instance was audio-processed before attach" — the probe
+        // never processes; the bridge does.
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_exact2] load on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_exact2] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        float L[256] = {0}, R[256] = {0};
+        int blocks = 0;
+        while (!loaded.load() || blocks < 300) {  // process ~1.5s even after load
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_exact2): timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            if (loaded.load()) {
+                inst.processAudioBlock(L, R, 256);
+                ++blocks;
+            }
+            Sleep(5);
+        }
+        printf("[bridge_exact2] processed %d blocks, hwnd after load\n", blocks);
+        fflush(stdout);
+        HWND h = CreateWindowEx(0, "GuiProbeClass", "ProbeExact2", WS_OVERLAPPEDWINDOW,
+                                0, 0, 800, 600, nullptr, nullptr, GetModuleHandle(nullptr), nullptr);
+        printf("[bridge_exact2] hwnd=%p (attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        ok = inst.attachView(h);
+        printf("[bridge_exact2] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact2): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact3") {
+        // bridge_exact + the bridge's remaining worker-job side effects and
+        // the attach-drain warm-up: worker job sets the reloading flag and
+        // sleeps (mimics close-others/silence/reloadForGUI), then MAIN pumps
+        // 500ms before attachView. Isolates flag + warm-up - the only state
+        // bridge_exact lacks.
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_exact3] load on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_exact3] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            inst.setReloading(true);
+            Sleep(100);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (!loaded.load()) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_exact3): load timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        HWND h = CreateWindowEx(0, "GuiProbeClass", "ProbeExact3", WS_OVERLAPPEDWINDOW,
+                                0, 0, 800, 600, nullptr, nullptr, GetModuleHandle(nullptr), nullptr);
+        printf("[bridge_exact3] hwnd=%p (reloading=true, warm-up 500ms, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        ok = inst.attachView(h);
+        printf("[bridge_exact3] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact3): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact4") {
+        // bridge_exact3 + the REAL bridge's native window creation: ANSI
+        // class "SonicForge_Native_VST3_Class" registered via RegisterClassA +
+        // DefWindowProcA, created via CreateWindowExA, SetWindowLongPtrA
+        // GWLP_USERDATA=ch+1 (ch=5), title "nexus". Isolates the window
+        // (probe GuiProbeClass vs bridge class) as the attached() hang trigger.
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_exact4] load on worker\n");
+            fflush(stdout);
+            bool r = inst.loadPlugin(path, 44100.0);
+            printf("[bridge_exact4] load=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            inst.setReloading(true);
+            Sleep(100);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (!loaded.load()) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_exact4): load timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact4] hwnd=%p (bridge-native window, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        ok = inst.attachView(h);
+        printf("[bridge_exact4] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact4): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact5") {
+        // bridge_exact4 + the ENGINE path: load via
+        // InstrumentEngineManager::assign on the worker (setChannel+init+map
+        // swap), engine-level reloading flag set (reloadingCh_), then
+        // attachView through engine->get(5) on MAIN. Replicates the real
+        // bridge single-channel LOAD + OPEN_GUI flow end to end, minus the
+        // main-loop's other drains (MIDI/render/writeIndex).
+        InstrumentEngineManager eng;
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_exact5] assign on worker\n");
+            fflush(stdout);
+            bool r = eng.assign(5, InstrumentType::VST3, path, 48000.0, 256);
+            printf("[bridge_exact5] assign=%d\n", r ? 1 : 0);
+            fflush(stdout);
+            eng.setReloading(5, true);
+            Sleep(100);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (!loaded.load()) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_exact5): load timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact5] hwnd=%p (engine path, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        printf("[bridge_exact5] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact5] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact5): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact6") {
+        // exact5 + SIX Nexus instances (ch 0-5) like the real bridge load,
+        // no render/MIDI, no ChannelWorker pump threads. Attach ch5 on MAIN.
+        // Is multi-instance-in-process the trigger?
+        InstrumentEngineManager eng;
+        PumpWorker w;
+        w.start();
+        std::atomic<int> loadedCount{0}, okCount{0};
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            w.post([&, ch]() {
+                bool r = eng.assign(ch, InstrumentType::VST3, path, 48000.0, 256);
+                printf("[bridge_exact6] assign ch=%u =%d\n", ch, r ? 1 : 0);
+                fflush(stdout);
+                if (r) ++okCount;
+                ++loadedCount;
+            });
+        }
+        auto t0 = std::chrono::steady_clock::now();
+        while (loadedCount.load() < 6) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 120) {
+                printf("RESULT(bridge_exact6): load timeout (%d/6)\n", loadedCount.load());
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact6] all loaded ok=%d/6\n", okCount.load());
+        fflush(stdout);
+        // Silence same-path channels like the bridge openGUI job does.
+        for (uint32_t y = 0; y < 6; ++y) if (y != 5) eng.setReloading(y, true);
+        eng.setReloading(5, true);
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact6] hwnd=%p (6 instances, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        std::atomic<bool> ok{false};
+        printf("[bridge_exact6] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact6] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact6): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact7") {
+        // FULL replication of the real bridge pre-attach state:
+        // - 6 channels, EACH loaded on its OWN PumpWorker (per-channel COM STA,
+        //   idle pump) — real bridge has 6 ChannelWorkers
+        // - loads serialized via a mutex (real bridge g_loadMutex)
+        // - main renderAll 300 blocks on all 6 channels (engine path)
+        // - silence same-path 0-4 + setReloading(5) like openGUI job
+        // - 500ms warm-up + attachView ch5 on MAIN
+        InstrumentEngineManager eng;
+        std::mutex loadMu;
+        std::vector<std::unique_ptr<PumpWorker>> ws;
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            auto w = std::make_unique<PumpWorker>();
+            w->start();
+            ws.push_back(std::move(w));
+        }
+        std::atomic<int> loadedCount{0}, okCount{0};
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            ws[ch]->post([&, ch]() {
+                std::lock_guard<std::mutex> lg(loadMu);
+                bool r = eng.assign(ch, InstrumentType::VST3, path, 48000.0, 256);
+                printf("[bridge_exact7] assign ch=%u =%d\n", ch, r ? 1 : 0);
+                fflush(stdout);
+                if (r) ++okCount;
+                ++loadedCount;
+            });
+        }
+        auto t0 = std::chrono::steady_clock::now();
+        while (loadedCount.load() < 6) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 120) {
+                printf("RESULT(bridge_exact7): load timeout (%d/6)\n", loadedCount.load());
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact7] all loaded ok=%d/6\n", okCount.load());
+        fflush(stdout);
+        // Main renderAll like the bridge audio loop (~1.5s)
+        float L[256] = {0}, R[256] = {0};
+        auto r0 = std::chrono::steady_clock::now();
+        int blocks = 0;
+        while (blocks < 300) {
+            eng.renderAll(L, R, 256);
+            ++blocks;
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact7] rendered %d blocks\n", blocks);
+        fflush(stdout);
+        // Silence same-path channels like the bridge openGUI job does.
+        for (uint32_t y = 0; y < 6; ++y) if (y != 5) eng.setReloading(y, true);
+        eng.setReloading(5, true);
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact7] hwnd=%p (6 threads + render, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        std::atomic<bool> ok{false};
+        printf("[bridge_exact7] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact7] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact7): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact8") {
+        // EXACT narrow-bridge replication: LOAD job sets reloading BEFORE
+        // assign and NEVER resets it (current bridge bug); then a SECOND
+        // worker job (openGUI) sets reloading again + attachPaths push
+        // equivalent; then main creates window + warm-up + attachView.
+        // Same as exact5 but with reloading set before assign and a separate
+        // openGUI job.
+        InstrumentEngineManager eng;
+        PumpWorker w;
+        w.start();
+        std::atomic<bool> loaded{false}, job2done{false}, ok{false};
+        w.post([&]() {
+            printf("[bridge_exact8] load job: setReloading BEFORE assign\n");
+            fflush(stdout);
+            eng.setReloading(5, true);
+            bool r = eng.assign(5, InstrumentType::VST3, path, 48000.0, 256);
+            printf("[bridge_exact8] assign=%d (reloading NOT reset - bridge bug)\n", r ? 1 : 0);
+            fflush(stdout);
+            loaded = r;
+        });
+        auto t0 = std::chrono::steady_clock::now();
+        while (!loaded.load()) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 30) {
+                printf("RESULT(bridge_exact8): load timeout\n");
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        w.post([&]() {
+            // openGUI job on the channel worker: silence same-path (none) +
+            // reloading on guiCh + reloadForGUI no-op equivalent.
+            eng.setReloading(5, true);
+            Sleep(50);
+            printf("[bridge_exact8] openGUI job done\n");
+            fflush(stdout);
+            job2done = true;
+        });
+        while (!job2done.load()) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact8] hwnd=%p (exact narrow flow, attach on MAIN)\n", (void*)h);
+        fflush(stdout);
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        printf("[bridge_exact8] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact8] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact8): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact9") {
+        // exact7 (6 instances, 6 workers, render, silence, warm-up, attach MAIN)
+        // PLUS the real bridge ordering: window created BEFORE the openGUI
+        // job, and the openGUI job runs on worker5 (the SAME worker that
+        // loaded ch5), like handleOpenGui -> workers[ch]->post.
+        InstrumentEngineManager eng;
+        std::mutex loadMu;
+        std::vector<std::unique_ptr<PumpWorker>> ws;
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            auto w = std::make_unique<PumpWorker>();
+            w->start();
+            ws.push_back(std::move(w));
+        }
+        std::atomic<int> loadedCount{0}, okCount{0};
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            ws[ch]->post([&, ch]() {
+                std::lock_guard<std::mutex> lg(loadMu);
+                bool r = eng.assign(ch, InstrumentType::VST3, path, 48000.0, 256);
+                printf("[bridge_exact9] assign ch=%u =%d\n", ch, r ? 1 : 0);
+                fflush(stdout);
+                if (r) ++okCount;
+                ++loadedCount;
+            });
+        }
+        auto t0 = std::chrono::steady_clock::now();
+        while (loadedCount.load() < 6) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 120) {
+                printf("RESULT(bridge_exact9): load timeout (%d/6)\n", loadedCount.load());
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact9] all loaded ok=%d/6\n", okCount.load());
+        fflush(stdout);
+        float L[256] = {0}, R[256] = {0};
+        auto r0 = std::chrono::steady_clock::now();
+        int blocks = 0;
+        while (blocks < 300) {
+            eng.renderAll(L, R, 256);
+            ++blocks;
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact9] rendered %d blocks\n", blocks);
+        fflush(stdout);
+        // Window created FIRST (bridge: handleOpenGui creates window before
+        // posting the worker job).
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact9] hwnd=%p (window BEFORE openGUI job)\n", (void*)h);
+        fflush(stdout);
+        // openGUI job on worker5 (the thread that loaded ch5): silence + reload.
+        std::atomic<bool> jobDone{false};
+        ws[5]->post([&]() {
+            for (uint32_t y = 0; y < 6; ++y) if (y != 5) eng.setReloading(y, true);
+            eng.setReloading(5, true);
+            auto* i5 = eng.get(5);
+            if (i5) i5->reloadForGUI();
+            printf("[bridge_exact9] openGUI job done\n");
+            fflush(stdout);
+            jobDone = true;
+        });
+        while (!jobDone.load()) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        // 500ms warm-up like the bridge drain
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        std::atomic<bool> ok{false};
+        printf("[bridge_exact9] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact9] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact9): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact10") {
+        // exact9 PLUS: map a shared-memory file view BEFORE attach, like the
+        // real bridge does (tests whether MapViewOfFile / address-space state
+        // breaks Nexus attached()).
+        HANDLE hMap = CreateFileMappingA(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE,
+                                         0, 32768, "SonicForge_DAW_IPC_PROBE10");
+        void* shm = hMap ? MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0) : nullptr;
+        printf("[bridge_exact10] shm=%p err=%lu\n", shm,
+               hMap ? 0 : GetLastError());
+        fflush(stdout);
+        if (shm) {
+            // touch a few fields like the bridge loop does
+            volatile uint32_t* wi = (volatile uint32_t*)((char*)shm + 4);
+            for (int i = 0; i < 500; ++i) *wi = (uint32_t)i;
+        }
+        InstrumentEngineManager eng;
+        std::mutex loadMu;
+        std::vector<std::unique_ptr<PumpWorker>> ws;
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            auto w = std::make_unique<PumpWorker>();
+            w->start();
+            ws.push_back(std::move(w));
+        }
+        std::atomic<int> loadedCount{0}, okCount{0};
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            ws[ch]->post([&, ch]() {
+                std::lock_guard<std::mutex> lg(loadMu);
+                bool r = eng.assign(ch, InstrumentType::VST3, path, 48000.0, 256);
+                printf("[bridge_exact10] assign ch=%u =%d\n", ch, r ? 1 : 0);
+                fflush(stdout);
+                if (r) ++okCount;
+                ++loadedCount;
+            });
+        }
+        auto t0 = std::chrono::steady_clock::now();
+        while (loadedCount.load() < 6) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 120) {
+                printf("RESULT(bridge_exact10): load timeout (%d/6)\n", loadedCount.load());
+                fflush(stdout);
+                return 3;
+            }
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact10] all loaded ok=%d/6\n", okCount.load());
+        fflush(stdout);
+        float L[256] = {0}, R[256] = {0};
+        int blocks = 0;
+        while (blocks < 300) {
+            eng.renderAll(L, R, 256);
+            ++blocks;
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact10] rendered %d blocks\n", blocks);
+        fflush(stdout);
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact10] hwnd=%p (SHM mapped)\n", (void*)h);
+        fflush(stdout);
+        std::atomic<bool> jobDone{false};
+        ws[5]->post([&]() {
+            for (uint32_t y = 0; y < 6; ++y) if (y != 5) eng.setReloading(y, true);
+            eng.setReloading(5, true);
+            auto* i5 = eng.get(5);
+            if (i5) i5->reloadForGUI();
+            jobDone = true;
+        });
+        while (!jobDone.load()) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        std::atomic<bool> ok{false};
+        printf("[bridge_exact10] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact10] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact10): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
+    } else if (variant == "bridge_exact11") {
+        // exact10 PLUS full bridge main-loop simulation:
+        // watchdog thread, SHM struct reads (controlQueue/midiQueue as the
+        // bridge drains them), setEditorOpenPredicate, parent_alive check.
+        // Tests whether ANY of those (running concurrently with the attach)
+        // breaks Nexus attached().
+        HANDLE hMap = CreateFileMappingA(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE,
+                                         0, 32768, "SonicForge_DAW_IPC_PROBE11");
+        void* shm = hMap ? MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 0) : nullptr;
+        printf("[bridge_exact11] shm=%p err=%lu\n", shm,
+               hMap ? 0 : GetLastError());
+        fflush(stdout);
+        // watchdog thread, like the bridge
+        std::atomic<long long> loopTick{0};
+        std::thread watchdog([&]() {
+            for (;;) {
+                Sleep(2000);
+                printf("[wd11] tick=%lld\n", loopTick.load());
+                fflush(stdout);
+            }
+        });
+        watchdog.detach();
+        InstrumentEngineManager eng;
+        eng.setEditorOpenPredicate([](const std::string&) { return false; });
+        std::mutex loadMu;
+        std::vector<std::unique_ptr<PumpWorker>> ws;
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            auto w = std::make_unique<PumpWorker>();
+            w->start();
+            ws.push_back(std::move(w));
+        }
+        std::atomic<int> loadedCount{0}, okCount{0};
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            ws[ch]->post([&, ch]() {
+                std::lock_guard<std::mutex> lg(loadMu);
+                bool r = eng.assign(ch, InstrumentType::VST3, path, 48000.0, 256);
+                printf("[bridge_exact11] assign ch=%u =%d\n", ch, r ? 1 : 0);
+                fflush(stdout);
+                if (r) ++okCount;
+                ++loadedCount;
+            });
+        }
+        auto t0 = std::chrono::steady_clock::now();
+        auto drainLikeBridge = [&]() {
+            // read controlQueueCount + controlQueue + midiQueue like the
+            // bridge loop does (offsets from driver_verify.py: control count
+            // at 11156, slots at 2836 + i*1040, midi count at 2832, midi slot
+            // at 2064, writeIndex at 4)
+            if (!shm) return;
+            volatile uint32_t* cc = (volatile uint32_t*)((char*)shm + 11156);
+            volatile uint32_t* mc = (volatile uint32_t*)((char*)shm + 2832);
+            volatile uint32_t* wi = (volatile uint32_t*)((char*)shm + 4);
+            uint32_t ccn = *cc;
+            for (uint32_t i = 0; i < (ccn > 8 ? 8 : ccn); ++i) {
+                volatile uint32_t* sl = (volatile uint32_t*)((char*)shm + 2836 + i * 1040);
+                (void)*sl; (void)*(sl+1); (void)*(sl+2); (void)*(sl+3);
+            }
+            *cc = 0;
+            uint32_t mcn = *mc;
+            for (uint32_t i = 0; i < (mcn > 64 ? 64 : mcn); ++i) {
+                volatile uint32_t* sl = (volatile uint32_t*)((char*)shm + 2064 + i * 24);
+                (void)*sl;
+            }
+            *mc = 0;
+            ++*wi;
+        };
+        while (loadedCount.load() < 6) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t0).count() > 120) {
+                printf("RESULT(bridge_exact11): load timeout (%d/6)\n", loadedCount.load());
+                fflush(stdout);
+                return 3;
+            }
+            ++loopTick;
+            drainLikeBridge();
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact11] all loaded ok=%d/6\n", okCount.load());
+        fflush(stdout);
+        float L[256] = {0}, R[256] = {0};
+        int blocks = 0;
+        while (blocks < 300) {
+            ++loopTick;
+            drainLikeBridge();
+            eng.renderAll(L, R, 256);
+            ++blocks;
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("[bridge_exact11] rendered %d blocks\n", blocks);
+        fflush(stdout);
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND h = CreateWindowExA(0, kWndClass, "nexus",
+                                 WS_OVERLAPPEDWINDOW,
+                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(h, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        printf("[bridge_exact11] hwnd=%p (SHM mapped, watchdog running)\n", (void*)h);
+        fflush(stdout);
+        std::atomic<bool> jobDone{false};
+        ws[5]->post([&]() {
+            for (uint32_t y = 0; y < 6; ++y) if (y != 5) eng.setReloading(y, true);
+            eng.setReloading(5, true);
+            auto* i5 = eng.get(5);
+            if (i5) i5->reloadForGUI();
+            jobDone = true;
+        });
+        while (!jobDone.load()) {
+            ++loopTick;
+            drainLikeBridge();
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        auto w0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - w0).count() < 500) {
+            ++loopTick;
+            drainLikeBridge();
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(10);
+        }
+        auto* inst5 = eng.get(5);
+        std::atomic<bool> ok{false};
+        printf("[bridge_exact11] inst=%p hasView=%d\n", (void*)inst5,
+               (inst5 && inst5->hasAttachedView()) ? 1 : 0);
+        fflush(stdout);
+        if (inst5) ok = inst5->attachView(h);
+        printf("[bridge_exact11] attach=%d\n", ok.load() ? 1 : 0);
+        fflush(stdout);
+        t0 = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::seconds>(
+                   std::chrono::steady_clock::now() - t0).count() < secs) {
+            ++loopTick;
+            drainLikeBridge();
+            MSG msg;
+            while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&msg);
+                DispatchMessageW(&msg);
+            }
+            Sleep(2);
+        }
+        printf("RESULT(bridge_exact11): done=1 attached_ok=%d (survived %ds)\n",
+               ok.load() ? 1 : 0, secs);
+        fflush(stdout);
+        return ok.load() ? 0 : 3;
     } else {
         printf("unknown variant %s\n", variant.c_str());
         return 2;
diff --git a/native_bridge/src/main.cpp b/native_bridge/src/main.cpp
index a82ac3d..77de2dc 100644
--- a/native_bridge/src/main.cpp
+++ b/native_bridge/src/main.cpp
@@ -58,6 +58,9 @@ static void sleep_ms(uint32_t ms) {
 // bi huy → WM_DESTROY tren con tro dangling → crash/hang bridge).
 class ChannelWorker;  // fwd — WM_DESTROY posts closeGUI() to the channel worker
 static void post_close_gui(uint32_t ch, HWND hwnd);  // defined after ChannelWorker
+static std::string lower_plugin_path(uint32_t ch);      // defined after ChannelWorker
+static void unmute_if_not_closing(uint32_t y, const char* why);  // defined after ChannelWorker
+
 static InstrumentEngineManager* g_engine = nullptr;
 static std::mutex g_guiMutex;
 static std::map<uint32_t, void*> g_guiWindows;  // channel -> HWND (keep window alive)
@@ -73,6 +76,46 @@ static std::map<uint32_t, std::unique_ptr<ChannelWorker>>* g_workers = nullptr;
 static std::mutex g_attachMutex;
 static std::vector<std::string> g_attachPaths;
 static bool g_closeInFlight[16] = { false };
+// Editor-open predicate state: while a channel's VST editor is attached, EVERY
+// channel assigned the same plugin DLL path stays quiet (the worker pumps the
+// editor's window proc inside the DLL while the audio loop process()es other
+// instances of the same DLL - 2 threads in one DLL crashes Nexus on GUI clicks).
+// Count keyed by lowercased plugin path. The predicate runs on the audio thread
+// under the engine's mu_ - lock order mu_ -> g_editorMutex (never inverted).
+static std::mutex g_editorMutex;
+static std::map<std::string, int> g_editorPathCount;
+static std::string g_editorOpenPath[16];
+static bool g_editorOpen[16] = { false };
+
+// GUI attach state (CRASH FIX 0xc000041d): attachView MUST run on the MAIN
+// thread so the editor children created inside view->attached() are owned by
+// the same thread as the parent window (main pump). g_guiAttachPending = one
+// attach in flight per channel (dedupe OPEN_GUI); g_attachSilenced = the
+// same-path channels silenced by the worker job, restored by the kMsgAttach
+// handler after attach; g_editorDestroyAck = kMsgDestroy handshake for the
+// LOAD job (children are main-owned -> DestroyWindow must run on main).
+static bool g_guiAttachPending[16] = { false };
+static std::map<uint32_t, std::vector<uint32_t>> g_attachSilenced;
+static bool g_editorDestroyAck[16] = { false };
+// Main-thread request queues (NOT window messages): attachView / destroy
+// children must run on the MAIN thread but OUTSIDE the window proc — a
+// plugin's attached() spins its own message wait that a reentrant
+// DispatchMessageW cannot satisfy (verified: in-handler kMsgAttach hung at
+// isPlatformTypeSupported, writeIndex stalled; gui_probe bridge_final with
+// attach-on-main-outside-wndproc succeeded). Worker jobs set these; the main
+// loop drains them before the message pump each iteration.
+static uintptr_t g_attachRequest[16] = { 0 };
+static HWND g_destroyRequest[16] = { nullptr };
+static const UINT kMsgAttach = WM_APP + 1;
+static const UINT kMsgDestroy = WM_APP + 2;
+static std::mutex g_loadMutex;  // moved up: VstWindowProc handlers need it
+
+// TEST WATCHDOG: loop tick + drain phase + worker state dump
+static std::atomic<uint64_t> g_loopTick{0};
+static std::atomic<int> g_drainPhase{0}; // 0=none 1=warmup 2=attaching 3=attached
+static std::atomic<int> g_attachThreadDone{0};
+static std::atomic<uint32_t> g_lastWriteIndex{0};
+
 
 static LRESULT CALLBACK VstWindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
     if (uMsg == WM_CLOSE) {
@@ -111,6 +154,11 @@ static LRESULT CALLBACK VstWindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARA
         }
         if (ch != UINT32_MAX) post_close_gui(ch, hwnd);
     }
+    // kMsgAttach / kMsgDestroy moved to the main-loop request queues:
+    // window-proc dispatch is reentrant and a plugin's attached() waits for
+    // messages the pump cannot deliver while inside DispatchMessageW (see
+    // the g_attachRequest comment). The main loop drains both queues before
+    // pumping (attach) / after closeGUI (destroy handshake).
     return DefWindowProcA(hwnd, uMsg, wParam, lParam);
 }
 #endif
@@ -119,7 +167,9 @@ static LRESULT CALLBACK VstWindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARA
 // separate worker threads (Nexus) deadlocks inside the SDK factory - all
 // stuck forever (observed: 3 concurrent Nexus loads, zero assign returned).
 // One load at a time; SF2/SFZ loads are fast, contention negligible.
+#ifndef _WIN32
 static std::mutex g_loadMutex;
+#endif
 // Pending OPEN_GUI requests whose channel instrument was not loaded yet.
 // The main loop fulfils them as soon as the load job completes (assign ok),
 // so the GUI button works regardless of JS retry timing.
@@ -135,14 +185,14 @@ static void* create_native_vst_window(const char* title) {
     static bool registered = false;
     if (!registered) {
         WNDCLASSA wc = {};
-        wc.lpfnWndProc = VstWindowProc;
+        wc.lpfnWndProc = DefWindowProcA;  // TEST ISOLATION: VstWindowProc vs DefWindowProc
         wc.hInstance = GetModuleHandleA(nullptr);
         wc.lpszClassName = kWndClass;
         RegisterClassA(&wc);
         registered = true;
     }
     HWND hwnd = CreateWindowExA(0, kWndClass, title ? title : "VST",
-                                WS_OVERLAPPEDWINDOW | WS_VISIBLE,
+                                WS_OVERLAPPEDWINDOW,
                                 CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
                                 nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
     return (void*)hwnd;
@@ -275,83 +325,89 @@ static void unmute_if_not_closing(uint32_t y, const char* why) {
 // job so Option B (closing another editor before attach) waits for closeGUI to
 // actually finish.
 static void post_close_gui(uint32_t ch, HWND hwnd) {
-    ChannelWorker* w = nullptr;
-    if (g_workers) {
-        auto wit = g_workers->find(ch);
-        if (wit != g_workers->end()) w = wit->second.get();
+    // Runs on the MAIN thread (VstWindowProc WM_CLOSE/WM_DESTROY). The
+    // editor children are main-owned now (attachView runs on the main pump),
+    // so closeGUI + child destroy + hide all happen here on the owning
+    // thread; only the fresh-instance reload (createInstance ~2s, must live
+    // in the channel COM STA apartment) is posted to the channel worker.
+    {
+        std::lock_guard<std::mutex> lock(g_guiMutex);
+        auto it = g_guiWindows.find(ch);
+        if (it != g_guiWindows.end() && it->second != hwnd) {
+            std::cerr << "[dbg] closeGUI ch=" << ch << " skipped (window replaced)" << std::endl;
+            return;
+        }
     }
-    if (w) {
-        // closeGUI() (view->removed()) PHAI chay tren channel worker - COM STA
-        // apartment cua plugin song o do. Window KHONG bi destroy: VstWindowProc
-        // giu lai (an) de reuse nen plugin editor children (worker-owned) khong
-        // bao gio bi huy cross-thread. Registry (g_guiWindows/g_hwndToCh) chi
-        // xoa trong WM_DESTROY khi window thuc su bi huy.
-        w->post([ch, hwnd]() {
-            // Guard window-replaced race: neu OPEN_GUI moi da dung window khac
-            // (hoac da xoa), khong detach view cua window moi.
-            {
-                std::lock_guard<std::mutex> lock(g_guiMutex);
-                auto it = g_guiWindows.find(ch);
-                if (it == g_guiWindows.end() || it->second != hwnd) {
-                    std::cerr << "[dbg] closeGUI ch=" << ch << " skipped (window replaced)" << std::endl;
-                    return;
-                }
+    std::cerr << "[dbg] closeGUI ch=" << ch << " start" << std::endl;
+    g_engine->setReloading(ch, true);
+    // Close-in-flight: until the fresh instance is loaded, no other job may
+    // unmute this channel (its plugin is being torn down).
+    {
+        std::lock_guard<std::mutex> lk(g_attachMutex);
+        g_closeInFlight[ch] = true;
+    }
+    // Silence same-plugin channels: no second thread may enter this DLL
+    // while closeGUI/createInstance runs (2 threads in one DLL -> Nexus
+    // exits silently, observed in probes).
+    std::vector<uint32_t> sp = same_plugin_channels(ch);
+    for (uint32_t y : sp) {
+        g_engine->setReloading(y, true);
+        std::cerr << "[dbg] closeGUI: silenced same-plugin ch=" << y
+                  << " during reload ch=" << ch << std::endl;
+    }
+    if (auto* i = g_engine->get(ch)) {
+        {
+            // closeGUI nulls the view WITHOUT view->removed() (Nexus removed()
+            // deadlocks). Destroying the editor windows runs the plugin
+            // window proc on this (main) thread; it must not race another
+            // thread createInstance/createView of the same DLL.
+            std::lock_guard<std::mutex> lg(g_loadMutex);
+            i->closeGUI();
+#ifdef _WIN32
+            if (hwnd && IsWindow(hwnd)) {
+                while (HWND c = FindWindowExA(hwnd, nullptr, nullptr, nullptr))
+                    DestroyWindow(c);
             }
-            std::cerr << "[dbg] closeGUI ch=" << ch << " start" << std::endl;
-            // Silence first: the audio loop must not process() the instance
-            // while we tear its editor down on this thread.
-            g_engine->setReloading(ch, true);
-            // Close-in-flight: until the fresh instance is loaded, no other
-            // job may unmute this channel (its plugin is being torn down).
-            {
-                std::lock_guard<std::mutex> lk(g_attachMutex);
-                g_closeInFlight[ch] = true;
-            }
-            if (auto* i = g_engine->get(ch)) {
-                // closeGUI() nulls the view WITHOUT view->removed() (Nexus
-                // removed() deadlocks this worker - modal wait for a message
-                // only its own pump can dispatch, but it is inside removed()).
-                i->closeGUI();
-                // CRASH FIX: the editor was dropped WITHOUT view->removed() —
-                // the instance's editor state is dangling, so the audio loop
-                // must NOT process() it. Rebuild a fresh instance NOW on this
-                // worker (its COM STA apartment is alive); reload() ==
-                // terminate + loadPlugin (createInstance). Same-plugin
-                // channels are silenced so no second thread enters this DLL
-                // during createInstance (2 threads in one DLL -> Nexus exits
-                // silently, observed in probes). Serialized with other loads
-                // by g_loadMutex.
-                std::vector<uint32_t> sp = same_plugin_channels(ch);
-                for (uint32_t y : sp) {
-                    g_engine->setReloading(y, true);
-                    std::cerr << "[dbg] closeGUI: silenced same-plugin ch=" << y
-                              << " during reload ch=" << ch << std::endl;
-                }
+            ShowWindow(hwnd, SW_HIDE);
+#endif
+        }
+        // Rebuild a fresh instance on the channel worker (its COM STA
+        // apartment is alive); reload() == terminate + loadPlugin
+        // (createInstance). Serialized with other loads by g_loadMutex.
+        ChannelWorker* w = nullptr;
+        if (g_workers) {
+            auto wit = g_workers->find(ch);
+            if (wit != g_workers->end()) w = wit->second.get();
+        }
+        if (w) {
+            w->post([ch, sp]() {
                 bool reloadOk = false;
                 {
-                    // destroy children + reload in ONE lock: destroying the
-                    // editor windows runs the plugin's window proc (DLL
-                    // entry) on this worker; it must not race another
-                    // thread's createInstance/createView of the same DLL.
-                    // Same-thread destroy is valid (attachView created them
-                    // on this worker); without destroy the editor keeps
-                    // pumping (0x47b flood) while the audio loop processes
-                    // the instance (2 threads in one DLL) -> Nexus USER32 crash.
                     std::lock_guard<std::mutex> lg(g_loadMutex);
-#ifdef _WIN32
-                    if (hwnd && IsWindow(hwnd)) {
-                        while (HWND c = FindWindowExA(hwnd, nullptr, nullptr, nullptr))
-                            DestroyWindow(c);
-                    }
-#endif
-                    reloadOk = i->reload();
+                    if (auto* i = g_engine->get(ch)) reloadOk = i->reload();
                 }
                 std::cerr << "[dbg] closeGUI ch=" << ch << " reload="
                           << (reloadOk ? 1 : 0) << std::endl;
+                // Editor is closed: drop the global editor-open state so the
+                // same-plugin channels render again. (This channel is still
+                // silenced by its reloading flag until the restore below.)
+                {
+                    std::lock_guard<std::mutex> lk(g_editorMutex);
+                    if (g_editorOpen[ch]) {
+                        g_editorOpen[ch] = false;
+                        std::string pth = g_editorOpenPath[ch];
+                        g_editorOpenPath[ch].clear();
+                        if (!pth.empty()) {
+                            auto it = g_editorPathCount.find(pth);
+                            if (it != g_editorPathCount.end() && --it->second <= 0)
+                                g_editorPathCount.erase(it);
+                        }
+                    }
+                }
                 // createInstance is done: unmuting is safe again. But if an
                 // attach for the SAME plugin path is still running (its
                 // createView must not race process() on any same-path
-                // channel), leave the silence in place — the attach job's
+                // channel), leave the silence in place - the attach job
                 // restore unmutes everything once attachView finished.
                 {
                     std::lock_guard<std::mutex> lk(g_attachMutex);
@@ -372,13 +428,30 @@ static void post_close_gui(uint32_t ch, HWND hwnd) {
                     for (uint32_t y : sp) unmute_if_not_closing(y, "closeGUI");
                     g_engine->setReloading(ch, false);
                 }
-            } else {
-                // Instrument already gone (unloaded) — nothing to rebuild.
-                g_engine->setReloading(ch, false);
-                std::lock_guard<std::mutex> lk(g_attachMutex);
-                g_closeInFlight[ch] = false;
+            });
+            return;
+        }
+    }
+    // Instrument already gone / no worker - nothing to rebuild: drop the
+    // editor-open state and unmute.
+    {
+        std::lock_guard<std::mutex> lk(g_editorMutex);
+        if (g_editorOpen[ch]) {
+            g_editorOpen[ch] = false;
+            std::string pth = g_editorOpenPath[ch];
+            g_editorOpenPath[ch].clear();
+            if (!pth.empty()) {
+                auto it = g_editorPathCount.find(pth);
+                if (it != g_editorPathCount.end() && --it->second <= 0)
+                    g_editorPathCount.erase(it);
             }
-        });
+        }
+    }
+    for (uint32_t y : sp) unmute_if_not_closing(y, "closeGUI");
+    g_engine->setReloading(ch, false);
+    {
+        std::lock_guard<std::mutex> lk(g_attachMutex);
+        g_closeInFlight[ch] = false;
     }
 }
 
@@ -429,11 +502,26 @@ int main(int argc, char* argv[]) {
 
 #ifdef _WIN32
     // Real-time-ish timing: 1ms scheduler resolution
-    timeBeginPeriod(1);
-    HANDLE hMapFile = OpenFileMappingA(FILE_MAP_ALL_ACCESS, FALSE, shmName.c_str());
-    if (!hMapFile) {
-        std::cerr << "[NativeBridge] Failed to open Shared Memory mapping: " << shmName << std::endl;
-        return 1;
+    if (!std::getenv("SF_NO_QTIMER")) timeBeginPeriod(1);
+    // CRASH FIX (0xc000041d): the MAIN thread creates/attaches VST editors
+    // (attachView runs on the main pump) - it must be COM-initialized as STA
+    // like the probe, or view->attached() blocks forever (log stops at
+    // isPlatformTypeSupported, never prints attached=). Probe confirmed:
+    // CoInitializeEx on the attaching thread is REQUIRED for Nexus.
+    CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED);
+    HANDLE hMapFile = nullptr;
+    if (std::getenv("SF_ONCE_SHM")) {
+        hMapFile = CreateFileMappingA(INVALID_HANDLE_VALUE, nullptr, PAGE_READWRITE,
+                                      0, sizeof(SharedAudioBufferIPC), nullptr);
+        std::cerr << "[test] SF_ONCE_SHM: self-created mapping h=" << (void*)hMapFile
+                  << " err=" << (hMapFile ? 0 : GetLastError()) << std::endl;
+        if (!hMapFile) return 1;
+    } else {
+        hMapFile = OpenFileMappingA(FILE_MAP_ALL_ACCESS, FALSE, shmName.c_str());
+        if (!hMapFile) {
+            std::cerr << "[NativeBridge] Failed to open Shared Memory mapping: " << shmName << std::endl;
+            return 1;
+        }
     }
     auto* shmIPC = (SharedAudioBufferIPC*)MapViewOfFile(hMapFile, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(SharedAudioBufferIPC));
     if (!shmIPC) { CloseHandle(hMapFile); return 1; }
@@ -444,6 +532,15 @@ int main(int argc, char* argv[]) {
 #endif
 
     InstrumentEngineManager instruments;
+    // Editor-open predicate: channels whose plugin DLL has an attached editor
+    // stay quiet (channelQuiet in the engine) for the whole editor-open
+    // duration -- derived from the global editor count, so the restore loops
+    // below that unmute after attach/load become harmless no-ops.
+    instruments.setEditorOpenPredicate([](const std::string& lp) {
+        std::lock_guard<std::mutex> lk(g_editorMutex);
+        auto it = g_editorPathCount.find(lp);
+        return it != g_editorPathCount.end() && it->second > 0;
+    });
 #ifdef _WIN32
     g_engine = &instruments;
 #endif
@@ -476,8 +573,12 @@ int main(int argc, char* argv[]) {
     bool transportStopped = false;
 
     auto dispatch = [&](const SharedAudioBufferIPC::MidiEventIPC& evt) {
-        auto* inst = instruments.get(evt.channel);
-        if (!inst) return; // channel chưa gán instrument → silent (A10)
+        // CRASH FIX: go through the manager, which holds mu_ for the WHOLE call
+        // (lookup + reloading check + instrument call). Direct get() then
+        // lock-free method calls raced assign() — the worker swapped the map and
+        // destroyed the old instance right after releasing mu_, so a playing
+        // channel loading another VSTi crashed the bridge (use-after-free).
+        // Unassigned and reloading channels are dropped inside the manager.
         switch (evt.command) {
             case 0x9:
                 // sampleOffset LUON LUON = 0 khi den day: events duoc dispatch ngay
@@ -485,12 +586,12 @@ int main(int argc, char* argv[]) {
                 // Truyen offset tuyet doi truoc day lam sfizz/VST3 trigger tre.
                 if (evt.velocity > 0) {
                     if (transportStopped) return; // V8 bug 3: drop note-on sau STOP
-                    inst->noteOn(evt.channel, evt.pitch, evt.velocity / 127.0f, 0);
+                    instruments.noteOn(evt.channel, evt.pitch, evt.velocity / 127.0f);
                 } else
-                    inst->noteOff(evt.channel, evt.pitch, 0);
+                    instruments.noteOff(evt.channel, evt.pitch);
                 break;
             case 0x8:
-                inst->noteOff(evt.channel, evt.pitch, 0);
+                instruments.noteOff(evt.channel, evt.pitch);
                 break;
             case 0xB: // CC: controller number in pitch, value in data2
                 // V9 bug 4: sau STOP, drop sustain-down (CC64>0) — JS co the
@@ -498,13 +599,13 @@ int main(int argc, char* argv[]) {
                 // note khi pedal down -> am treo loop. CC64=0 (sustain-up)
                 // van cho qua.
                 if (transportStopped && evt.pitch == 64 && evt.data2 > 0) return;
-                inst->controlChange(evt.channel, evt.pitch, evt.data2);
+                instruments.controlChange(evt.channel, evt.pitch, evt.data2);
                 break;
             case 0xC: // program change: program in data2
-                inst->programChange(evt.channel, evt.data2);
+                instruments.programChange(evt.channel, evt.data2);
                 break;
             case 0xE: // 14-bit pitch bend: data2 = LSB, data3 = MSB
-                inst->pitchBend(evt.channel, evt.data2 | (uint32_t(evt.data3) << 7));
+                instruments.pitchBend(evt.channel, evt.data2 | (uint32_t(evt.data3) << 7));
                 break;
             default: break;
         }
@@ -520,6 +621,159 @@ int main(int argc, char* argv[]) {
     auto startTime = std::chrono::steady_clock::now();
     uint64_t blockCount = 0;
 
+    // TEST ISOLATION (SF_PREWINDOW): create the native window BEFORE the
+    // main loop (probe bridge_final creates its parent before load/attach;
+    // bridge creates it inside handleOpenGui from the control drain -> hangs
+    // view->attached()). Pre-created window is used for channel 0.
+    HWND g_preHwnd = nullptr;
+    if (std::getenv("SF_PREWINDOW")) {
+        g_preHwnd = (HWND)create_native_vst_window("pre");
+        std::cerr << "[test] pre-window created hwnd=" << g_preHwnd << std::endl;
+    }
+    // TEST ISOLATION (SF_ONCE): replicate probe bridge_exact11 ENTIRELY BEFORE
+    // the while(true) loop — 6 channels each loaded on its own ChannelWorker,
+    // setReloading+reloadForGUI job on worker 5, SHM drain, ANSI window,
+    // warm-up pump, attachView on MAIN. If PASSES, the hang comes from loop /
+    // global-state; if HANGS, the trigger is static/startup state.
+#ifdef _WIN32
+    if (std::getenv("SF_ONCE")) {
+        // TEST ISOLATION (SF_ONCE_PROBEWIN): replicate probe startup window
+        // "GuiProbeClass" + watchdog thread (the last two probe-vs-bridge
+        // differences) before the exact11 sequence.
+        if (std::getenv("SF_ONCE_PROBEWIN")) {
+            WNDCLASSEX wc = {};
+            wc.cbSize = sizeof(wc);
+            wc.lpfnWndProc = DefWindowProc;
+            wc.hInstance = GetModuleHandle(nullptr);
+            wc.lpszClassName = "GuiProbeClass";
+            RegisterClassEx(&wc);
+            HWND probeHwnd = CreateWindowEx(0, "GuiProbeClass", "GuiProbe",
+                                            WS_OVERLAPPEDWINDOW, 0, 0, 800, 600,
+                                            nullptr, nullptr, wc.hInstance, nullptr);
+            std::cerr << "[test] SF_ONCE GuiProbeClass window=" << (void*)probeHwnd << std::endl;
+            std::thread([&]() { for (;;) { Sleep(2000);
+                std::cerr << "[test] SF_ONCE wd tick" << std::endl; } }).detach();
+        }
+        const char* oncePath = std::getenv("SF_ONCE_PATH");
+        std::string op = oncePath ? oncePath : "C:\\Program Files\\Common Files\\VST3\\Nexus.vst3";
+        std::cerr << "[test] SF_ONCE start path=" << op << std::endl;
+        std::vector<std::unique_ptr<ChannelWorker>> ows;
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            auto w = std::make_unique<ChannelWorker>();
+            ows.push_back(std::move(w));
+        }
+        std::atomic<int> loadedCount{0}, okCount{0};
+        for (uint32_t ch = 0; ch < 6; ++ch) {
+            ows[ch]->post([&, ch]() {
+                std::lock_guard<std::mutex> lg(g_loadMutex);
+                bool r = instruments.assign(ch, InstrumentType::VST3, op, sampleRate, block);
+                std::cerr << "[test] SF_ONCE assign ch=" << ch << " =" << (r ? 1 : 0) << std::endl;
+                if (r) ++okCount;
+                ++loadedCount;
+            });
+        }
+        auto t1 = std::chrono::steady_clock::now();
+        auto drainOnce = [&]() {
+            if (!shmIPC) return;
+            volatile uint32_t* cc = (volatile uint32_t*)((char*)shmIPC + 11156);
+            volatile uint32_t* mc = (volatile uint32_t*)((char*)shmIPC + 2832);
+            volatile uint32_t* wi = (volatile uint32_t*)((char*)shmIPC + 4);
+            uint32_t ccn = *cc;
+            for (uint32_t i = 0; i < (ccn > 8 ? 8 : ccn); ++i) {
+                volatile uint32_t* sl = (volatile uint32_t*)((char*)shmIPC + 2836 + i * 1040);
+                (void)*sl; (void)*(sl+1); (void)*(sl+2); (void)*(sl+3);
+            }
+            *cc = 0;
+            uint32_t mcn = *mc;
+            for (uint32_t i = 0; i < (mcn > 64 ? 64 : mcn); ++i) {
+                volatile uint32_t* sl = (volatile uint32_t*)((char*)shmIPC + 2064 + i * 24);
+                (void)*sl;
+            }
+            *mc = 0;
+            ++*wi;
+        };
+        while (loadedCount.load() < 6) {
+            if (std::chrono::duration_cast<std::chrono::seconds>(
+                    std::chrono::steady_clock::now() - t1).count() > 120) {
+                std::cerr << "[test] SF_ONCE load timeout (" << loadedCount.load() << "/6)" << std::endl;
+                return 3;
+            }
+            drainOnce();
+            MSG m;
+            while (PeekMessageW(&m, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&m);
+                DispatchMessageW(&m);
+            }
+            Sleep(2);
+        }
+        std::cout << "[NativeBridge] instrument loaded ch=5 type=2 " << op << std::endl;
+        float Lr[256] = {0}, Rr[256] = {0};
+        for (int b = 0; b < 300; ++b) {
+            drainOnce();
+            instruments.renderAll(Lr, Rr, 256);
+            MSG m;
+            while (PeekMessageW(&m, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&m);
+                DispatchMessageW(&m);
+            }
+            Sleep(2);
+        }
+        std::cerr << "[test] SF_ONCE rendered 300 blocks" << std::endl;
+        static const char* kWndClass = "SonicForge_Native_VST3_Class";
+        static bool registered = false;
+        if (!registered) {
+            WNDCLASSA wc = {};
+            wc.lpfnWndProc = DefWindowProcA;
+            wc.hInstance = GetModuleHandleA(nullptr);
+            wc.lpszClassName = kWndClass;
+            RegisterClassA(&wc);
+            registered = true;
+        }
+        HWND hOnce = CreateWindowExA(0, kWndClass, "nexus",
+                                     WS_OVERLAPPEDWINDOW,
+                                     CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+                                     nullptr, nullptr, GetModuleHandleA(nullptr), nullptr);
+        SetWindowLongPtrA(hOnce, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+        std::cerr << "[test] SF_ONCE hwnd=" << (void*)hOnce << std::endl;
+        std::atomic<bool> onceJob{false};
+        ows[5]->post([&]() {
+            for (uint32_t y = 0; y < 6; ++y) if (y != 5) instruments.setReloading(y, true);
+            instruments.setReloading(5, true);
+            auto* i5 = instruments.get(5);
+            if (i5) i5->reloadForGUI();
+            onceJob.store(true);
+        });
+        while (!onceJob.load()) {
+            drainOnce();
+            MSG m;
+            while (PeekMessageW(&m, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&m);
+                DispatchMessageW(&m);
+            }
+            Sleep(2);
+        }
+        auto wOnce = std::chrono::steady_clock::now();
+        while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                   std::chrono::steady_clock::now() - wOnce).count() < 500) {
+            drainOnce();
+            MSG m;
+            while (PeekMessageW(&m, nullptr, 0, 0, PM_REMOVE)) {
+                TranslateMessage(&m);
+                DispatchMessageW(&m);
+            }
+            Sleep(10);
+        }
+        auto* iOnce = instruments.get(5);
+        bool okOnce = iOnce ? iOnce->attachView(hOnce) : false;
+        std::cerr << "[test] SF_ONCE attach=" << (okOnce ? 1 : 0) << std::endl;
+        if (okOnce) {
+            ShowWindow(hOnce, SW_SHOW);
+            std::cout << "[NativeBridge] GUI attached hwnd=" << hOnce
+                      << " plugin=nexus ch=5" << std::endl;
+        }
+    }
+#endif
+
     // OPEN_GUI handling - shared by the control queue and the pending-GUI
     // sweep. Gate on the MAIN thread before creating a window: instrument
     // load is ASYNC (worker thread); OPEN_GUI too early would attach to an
@@ -558,12 +812,25 @@ int main(int argc, char* argv[]) {
             auto it = g_guiWindows.find(guiCh);
             if (it != g_guiWindows.end()) nativeHwnd = (HWND)it->second;
         }
-        if (hwnd == 0) {
+        if (hwnd == 0 && g_preHwnd && IsWindow(g_preHwnd)) {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            if (g_guiWindows.find(guiCh) != g_guiWindows.end()) {
+                nativeHwnd = (HWND)g_guiWindows[guiCh];
+            } else {
+                nativeHwnd = g_preHwnd;
+                g_guiWindows[guiCh] = nativeHwnd;
+                g_hwndToCh[nativeHwnd] = guiCh;
+            }
+            SetWindowLongPtrA(nativeHwnd, GWLP_USERDATA, (LONG_PTR)(guiCh + 1));
+            hwnd = (void*)nativeHwnd;
+            SetWindowTextA(nativeHwnd, pluginId.c_str());
+        } else if (hwnd == 0) {
             if (nativeHwnd && IsWindow(nativeHwnd)) {
                 hwnd = (void*)nativeHwnd;
                 SetWindowTextA(nativeHwnd, pluginId.c_str());
-                ShowWindow(nativeHwnd, SW_SHOW);
-                SetForegroundWindow(nativeHwnd);
+                // Window stays hidden until attach succeeds (visible parent
+                // deadlocks Nexus attached() - see create_native_vst_window).
+                // ShowWindow happens in the main-loop attach success path.
                 // Reuse: cap nhat USERDATA (channel+1) - inst CU da bi thay
                 // the boi assign() -> WM_DESTROY sau nay lookup inst MOI.
                 SetWindowLongPtrA(nativeHwnd, GWLP_USERDATA, (LONG_PTR)(guiCh + 1));
@@ -583,19 +850,98 @@ int main(int argc, char* argv[]) {
             }
         }
 #endif
+#ifdef _WIN32
+        // Dedupe: one attach in flight per channel (frontend openVstGuiRetry
+        // spam). Cleared by the worker job early returns and by the
+        // main-thread kMsgAttach handler.
+        {
+            std::lock_guard<std::mutex> lock(g_guiMutex);
+            if (g_guiAttachPending[guiCh]) {
+                std::cerr << "[dbg] openGUI: attach already pending ch=" << guiCh
+                          << " - skip" << std::endl;
+                return;
+            }
+            g_guiAttachPending[guiCh] = true;
+        }
+#endif
+        // TEST DIRECT ATTACH: bypass worker job + drain, attach on MAIN
+        // right here in handleOpenGui (env SF_DIRECT_ATTACH=1).
+        if (std::getenv("SF_DIRECT_ATTACH")) {
+            std::cerr << "[test] DIRECT attach path ch=" << guiCh << std::endl;
+            auto* instD = instruments.get(guiCh);
+            std::vector<uint32_t> samePathSilenced;
+            std::string gpd = lower_plugin_path(guiCh);
+            if (!gpd.empty()) {
+                for (uint32_t y = 0; y < 16; ++y) {
+                    if (y == guiCh) continue;
+                    if (!instruments.get(y)) continue;
+                    if (lower_plugin_path(y) == gpd) {
+                        instruments.setReloading(y, true);
+                        samePathSilenced.push_back(y);
+                    }
+                }
+            }
+            instruments.setReloading(guiCh, true);
+            bool reloadOk = false;
+            if (instD) reloadOk = instD->reloadForGUI();
+            bool okD = false;
+            if (reloadOk && IsWindow((HWND)hwnd)) okD = instD->attachView(hwnd);
+            std::cerr << "[test] DIRECT attach ok=" << (okD ? 1 : 0) << " ch=" << guiCh << std::endl;
+            if (okD) {
+                {
+                    std::lock_guard<std::mutex> lk(g_editorMutex);
+                    if (!gpd.empty()) {
+                        g_editorOpen[guiCh] = true;
+                        g_editorOpenPath[guiCh] = gpd;
+                        ++g_editorPathCount[gpd];
+                    }
+                }
+                ShowWindow((HWND)hwnd, SW_SHOW);
+                SetForegroundWindow((HWND)hwnd);
+                std::cout << "[NativeBridge] GUI attached hwnd=" << hwnd
+                          << " plugin=" << gpd << " ch=" << guiCh << std::endl;
+            } else {
+                g_engine->setReloading(guiCh, false);
+                PostMessageA((HWND)hwnd, WM_CLOSE, 0, 0);
+            }
+            for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "direct");
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                g_guiAttachPending[guiCh] = false;
+            }
+            return;
+        }
         workers[guiCh]->post([&instruments, guiCh, hwnd, arg2 = pluginId]() {
+
+
             if (!instruments.get(guiCh)) {
                 std::cerr << "[NativeBridge] GUI attach FAILED hwnd=" << hwnd
                           << " plugin=" << arg2 << " ch=" << guiCh << " (no instrument loaded)" << std::endl;
+#ifdef _WIN32
+                {
+                    std::lock_guard<std::mutex> lock(g_guiMutex);
+                    g_guiAttachPending[guiCh] = false;
+                }
+#endif
                 return;
+
+
             }
             std::cerr << "[dbg] openGUI thread start hwnd=" << hwnd
                       << " plugin=" << arg2 << " ch=" << guiCh << std::endl;
             if (auto* inst0 = instruments.get(guiCh)) {
                 if (inst0->hasAttachedView()) {
                     std::cerr << "[dbg] openGUI: view already attached ch=" << guiCh
-                              << " — skip" << std::endl;
+                              << " — skip" << std::endl;
+#ifdef _WIN32
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_guiAttachPending[guiCh] = false;
+                    }
+#endif
                     return;
+
+
                 }
             }
 #ifdef _WIN32
@@ -682,7 +1028,15 @@ int main(int argc, char* argv[]) {
                     // them when it finishes).
                     for (uint32_t y : others) unmute_if_not_closing(y, "openGUI-abort");
                     std::cerr << "[dbg] openGUI: attach aborted ch=" << guiCh << std::endl;
+#ifdef _WIN32
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_guiAttachPending[guiCh] = false;
+                    }
+#endif
                     return;
+
+
                 }
             }
 #else
@@ -716,10 +1070,19 @@ int main(int argc, char* argv[]) {
                 std::vector<uint32_t> samePathSilenced;
                 std::string gp = lower_plugin_path(guiCh);
                 if (!gp.empty()) {
+                    // Flush held notes BEFORE muting: these channels stay muted
+                    // for the whole editor-open duration and the manager drops
+                    // MIDI for quiet channels -- notes held at mute time would
+                    // otherwise resume stuck after the editor closes. The
+                    // manager's dispatch holds mu_ (serialized vs the audio
+                    // loop); g_loadMutex serializes vs other workers' DLL entry.
+                    std::lock_guard<std::mutex> lg(g_loadMutex);
                     for (uint32_t y = 0; y < 16; ++y) {
                         if (y == guiCh) continue;
                         if (!instruments.get(y)) continue;
                         if (lower_plugin_path(y) == gp) {
+                            for (uint32_t n = 0; n < 128; ++n)
+                                instruments.noteOff(y, n);
                             instruments.setReloading(y, true);
                             samePathSilenced.push_back(y);
                             std::cerr << "[dbg] openGUI: silenced same-plugin ch=" << y
@@ -735,53 +1098,291 @@ int main(int argc, char* argv[]) {
                     std::lock_guard<std::mutex> lk(g_attachMutex);
                     if (!gp.empty()) g_attachPaths.push_back(gp);
                 }
-                bool ok = false;
+                // Attach now happens on the MAIN thread (kMsgAttach): the
+                // editor children created inside view->attached() must be
+                // owned by the same thread as the parent window (main pump).
+                // Attaching on the worker made children worker-owned while
+                // the parent was main-owned -> cross-thread parent/child ->
+                // USER32 0xc000041d (verified with gui_probe). Only
+                // reloadForGUI stays here: it may createInstance (~2s on the
+                // hasAttachedOnce reopen path) and must run on this worker
+                // COM STA apartment.
+                bool reloadOk = false;
                 {
                     // Serialize ALL plugin-DLL entry (createInstance AND
                     // createView) with other loads: two threads inside one
-                    // DLL (Nexus) crash. createView outside the lock raced a
-                    // same-path close job's reload (createInstance) -> Nexus
-                    // exited silently (observed in probes).
+                    // DLL (Nexus) crash.
+                    if (std::getenv("SF_NO_LOADMUTEX")) {
+                        reloadOk = inst->reloadForGUI();
+                    } else {
                     std::lock_guard<std::mutex> lg(g_loadMutex);
-                    ok = inst->reloadForGUI();
-                    if (ok) ok = inst->attachView(hwnd);
-                }
-                // Attach done (ok or failed) — close jobs may unmute again.
-                {
-                    std::lock_guard<std::mutex> lk(g_attachMutex);
-                    if (!gp.empty()) {
-                        auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
-                        if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+                    reloadOk = inst->reloadForGUI();
                     }
                 }
-                // Restore same-path silence. Channels whose own close job is
-                // still inside createInstance stay muted — that job owns
-                // their unmute and performs it once reload finished.
-                for (uint32_t y : samePathSilenced)
-                    unmute_if_not_closing(y, "openGUI");
-                if (ok)
-                    std::cout << "[NativeBridge] GUI attached hwnd=" << hwnd
-                              << " plugin=" << arg2 << " ch=" << guiCh
-                              << " (channel muted while editor open)" << std::endl;
-                else {
-                    // Attach failed -> no editor running -> safe to process again.
+#ifdef _WIN32
+                if (!reloadOk || !IsWindow((HWND)hwnd)) {
+#else
+                if (!reloadOk) {
+#endif
+                    // No editor running -> safe to process again.
+                    for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "openGUI");
                     instruments.setReloading(guiCh, false);
+                    {
+                        std::lock_guard<std::mutex> lk(g_attachMutex);
+                        if (!gp.empty()) {
+                            auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
+                            if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+                        }
+                    }
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_guiAttachPending[guiCh] = false;
+                    }
                     std::cerr << "[NativeBridge] GUI attach FAILED hwnd=" << hwnd
                               << " plugin=" << arg2 << std::endl;
 #ifdef _WIN32
-                    // Attach that — khong co view (VD: channel la SF2/SFZ hoac plugin
-                    // loi). Dong ngay cua so vo nghia de khong con window treo trong
-                    // registry; WM_CLOSE -> main pump destroy tren main thread (owner).
-                    // PostMessage an toan cross-thread (khong nhu DestroyWindow).
+                    // Attach khong co view (VD: SF2/SFZ hoac plugin loi).
+                    // Dong ngay cua so vo nghia de khong con window treo.
                     PostMessageA((HWND)hwnd, WM_CLOSE, 0, 0);
+#endif
+                } else {
+#ifdef _WIN32
+                    // Stash the same-path silenced set for the main-thread
+                    // kMsgAttach handler, then ask it to attach (message, not
+                    // direct call: the window proc runs on the main pump).
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_attachSilenced[guiCh] = samePathSilenced;
+                    }
+                    {
+                        std::lock_guard<std::mutex> lock(g_guiMutex);
+                        g_attachRequest[guiCh] = (uintptr_t)hwnd;
+                    }
+#else
+                    // No native window on non-Windows: direct attach (null
+                    // parent) fails -> restore the silenced channels.
+                    if (!inst->attachView(hwnd)) {
+                        for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "openGUI");
+                        instruments.setReloading(guiCh, false);
+                        std::lock_guard<std::mutex> lk(g_attachMutex);
+                        if (!gp.empty()) {
+                            auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
+                            if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+                        }
+                    }
 #endif
                 }
             }
+
         });
     };
 
     // 2. REAL-TIME AUDIO PROCESSING ENGINE LOOP
+    if (!std::getenv("SF_NO_WD")) {
+    std::thread watchdog([&]() {
+        for (;;) {
+            Sleep(2000);
+            std::string rb, hv;
+            for (uint32_t c = 0; c < 6; ++c) {
+                bool r = g_engine ? g_engine->isReloading(c) : false;
+                bool v = g_engine && g_engine->get(c) ? g_engine->get(c)->hasAttachedView() : false;
+                rb += (r ? "1" : "0");
+                hv += (v ? "1" : "0");
+            }
+            std::cerr << "[wd] tick=" << g_loopTick.load()
+                      << " wi=" << g_lastWriteIndex.load()
+                      << " phase=" << g_drainPhase.load()
+                      << " attachThreadDone=" << g_attachThreadDone.load()
+                      << " reloading=" << rb << " view=" << hv << std::endl;
+        }
+    });
+    watchdog.detach();
+    }
+    // SF_AUTOGUI: auto-attach ch=5 after load (no OPEN_GUI via control drain).
+    // Isolates "called from control drain loop" vs "direct call like probe".
+    static bool autoguiOnce = false;
     while (true) {
+        if (std::getenv("SF_AUTOGUI") && !autoguiOnce) {
+            auto* ai = g_engine ? g_engine->get(5) : nullptr;
+            if (ai) {
+                autoguiOnce = true;
+                std::cerr << "[test] SF_AUTOGUI trigger ch=5" << std::endl;
+#ifdef _WIN32
+                if (std::getenv("SF_EXACT11")) {
+                    // Probe bridge_exact11 (PASS in gui_probe) replicated
+                    // inside the REAL bridge process: create ANSI native
+                    // window, warm-up pump 500ms, attachView on MAIN.
+                    HWND h11 = (HWND)create_native_vst_window("nexus");
+                    SetWindowLongPtrA(h11, GWLP_USERDATA, (LONG_PTR)(5 + 1));
+                    std::cerr << "[test] EXACT11 hwnd=" << (void*)h11 << std::endl;
+                    auto w011 = std::chrono::steady_clock::now();
+                    while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                               std::chrono::steady_clock::now() - w011).count() < 500) {
+                        MSG wm;
+                        while (PeekMessageW(&wm, nullptr, 0, 0, PM_REMOVE)) {
+                            TranslateMessage(&wm);
+                            DispatchMessageW(&wm);
+                        }
+                        Sleep(10);
+                    }
+                    auto* i5 = g_engine ? g_engine->get(5) : nullptr;
+                    bool ok11 = i5 ? i5->attachView(h11) : false;
+                    std::cerr << "[test] EXACT11 attach=" << (ok11 ? 1 : 0) << std::endl;
+                    if (ok11) {
+                        ShowWindow(h11, SW_SHOW);
+                        std::cout << "[NativeBridge] GUI attached hwnd=" << h11
+                                  << " plugin=nexus ch=5" << std::endl;
+                    }
+                } else
+#endif
+                handleOpenGui(5, 0, "nexus");
+            }
+        }
+        ++g_loopTick;
+        g_lastWriteIndex = shmIPC->bridgeWriteIndex;
+        // Editor destroy requests (LOAD handshake): the editor children are
+        // MAIN-owned (attachView runs on this thread) - DestroyWindow must
+        // run here, not on the worker (cross-thread -> USER32 0xc000041d).
+        // Runs BEFORE the pump: closeGUI may post messages to the editor
+        // windows, and the pump dispatches them after.
+        if (!std::getenv("SF_NO_SWEEP")) {
+        for (uint32_t ch = 0; ch < 16; ++ch) {
+            HWND dh;
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                dh = g_destroyRequest[ch];
+            }
+            if (!dh) continue;
+            if (IsWindow(dh)) {
+                if (auto* i = g_engine ? g_engine->get(ch) : nullptr) {
+                    std::lock_guard<std::mutex> lg(g_loadMutex);
+                    i->closeGUI();
+                    while (HWND c = FindWindowExA(dh, nullptr, nullptr, nullptr))
+                        DestroyWindow(c);
+                    ShowWindow(dh, SW_HIDE);
+                }
+            }
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                g_destroyRequest[ch] = nullptr;
+                g_editorDestroyAck[ch] = true;
+            }
+        }
+        }
+        // TEST ISOLATION: pump pending messages BEFORE attach (probe pumps
+        // during load wait before attach; bridge did not -> Nexus attached()
+        // hangs).
+        { MSG msg; while (PeekMessageW(&msg, nullptr, 0, 0, PM_REMOVE)) { TranslateMessage(&msg); DispatchMessageW(&msg); } }
+        // Editor attach requests (openGUI job): attachView MUST run on the
+        // MAIN thread so the editor children created inside view->attached()
+        // are owned by the same thread as the parent window - and OUTSIDE
+        // the window proc (see g_attachRequest comment). Drain before the
+        // pump: attached() may need its own messages delivered afterwards.
+        for (uint32_t ch = 0; ch < 16; ++ch) {
+            uintptr_t ah;
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                ah = g_attachRequest[ch];
+                g_attachRequest[ch] = 0;
+            }
+            if (!ah) continue;
+            HWND hwnd = (HWND)ah;
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                auto it = g_guiWindows.find(ch);
+                if (it != g_guiWindows.end() && it->second != hwnd) {
+                    // Window replaced by a newer OPEN_GUI - stale attach, drop.
+                    std::cerr << "[dbg] attach req ch=" << ch << " skipped (window replaced)" << std::endl;
+                    g_guiAttachPending[ch] = false;
+                    continue;
+                }
+            }
+            auto* inst = g_engine ? g_engine->get(ch) : nullptr;
+            if (!inst || inst->hasAttachedView()) {
+                std::cerr << "[dbg] attach req ch=" << ch << " skipped (no instrument / view attached)" << std::endl;
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                g_guiAttachPending[ch] = false;
+                continue;
+            }
+            std::vector<uint32_t> samePathSilenced;
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                auto it = g_attachSilenced.find(ch);
+                if (it != g_attachSilenced.end()) {
+                    samePathSilenced = it->second;
+                    g_attachSilenced.erase(it);
+                }
+            }
+            std::string gp = lower_plugin_path(ch);
+            bool ok = false;
+            {
+                // CRASH FIX: serialize attachView with worker loads. Main
+                // thread entering view->attached() while another worker is
+                // inside Nexus createInstance (same DLL factory) deadlocks -
+                // the SDK factory is not reentrant across threads.
+                std::lock_guard<std::mutex> lg(g_loadMutex);
+                g_drainPhase = 1;
+                // TEST ISOLATION: warm-up window before attach (probe bridge_final
+                // pumped 2-4s between CreateWindow and attachView; bridge attaches
+                // within ms -> Nexus attached() hangs). Pump + sleep ~500ms.
+                {
+                    auto w0 = std::chrono::steady_clock::now();
+                    while (std::chrono::duration_cast<std::chrono::milliseconds>(
+                               std::chrono::steady_clock::now() - w0).count() < 500) {
+                        MSG wmsg;
+                        while (PeekMessageW(&wmsg, nullptr, 0, 0, PM_REMOVE)) {
+                            TranslateMessage(&wmsg);
+                            DispatchMessageW(&wmsg);
+                        }
+                        Sleep(10);
+                    }
+                }
+                g_drainPhase = 2;
+                std::cerr << "[wd] attachView begin ch=" << ch
+                          << " tid=" << std::this_thread::get_id() << std::endl;
+                ok = inst->attachView(hwnd);
+                g_attachThreadDone = 1;
+                std::cerr << "[wd] attachView end ch=" << ch << " ok=" << (ok ? 1 : 0)
+                          << " tid=" << std::this_thread::get_id() << std::endl;
+                g_drainPhase = 3;
+            }
+            {
+                std::lock_guard<std::mutex> lock(g_guiMutex);
+                g_guiAttachPending[ch] = false;
+            }
+            if (!gp.empty()) {
+                std::lock_guard<std::mutex> lk(g_attachMutex);
+                auto it = std::find(g_attachPaths.begin(), g_attachPaths.end(), gp);
+                if (it != g_attachPaths.end()) g_attachPaths.erase(it);
+            }
+            if (ok) {
+                // Editor is attached on this channel: register it globally so
+                // EVERY channel assigned the same plugin DLL path stays quiet
+                // for the whole editor-open duration (g_editorPathCount).
+                {
+                    std::lock_guard<std::mutex> lk(g_editorMutex);
+                    if (!gp.empty()) {
+                        g_editorOpen[ch] = true;
+                        g_editorOpenPath[ch] = gp;
+                        ++g_editorPathCount[gp];
+                    }
+                }
+                ShowWindow(hwnd, SW_SHOW);
+                SetForegroundWindow(hwnd);
+                std::cout << "[NativeBridge] GUI attached hwnd=" << hwnd
+                          << " plugin=" << gp << " ch=" << ch
+                          << " (channel muted while editor open)" << std::endl;
+            } else {
+                // Attach failed -> no editor running -> safe to process again.
+                g_engine->setReloading(ch, false);
+                std::cerr << "[NativeBridge] GUI attach FAILED hwnd=" << hwnd
+                          << " plugin=" << gp << std::endl;
+                PostMessageA(hwnd, WM_CLOSE, 0, 0);
+            }
+            // Restore same-path silence. Channels whose own close job is still
+            // inside createInstance stay muted - that job owns their unmute.
+            for (uint32_t y : samePathSilenced) unmute_if_not_closing(y, "openGUI");
+        }
 #ifdef _WIN32
         // Message pump: VST editors (Nexus, JUCE-based...) block inside
         // view->attached() until the host dispatches messages — openGUI runs
@@ -885,13 +1486,51 @@ int main(int argc, char* argv[]) {
                         // audio loop (same plugin instance).
                         instruments.setReloading(ch, true);
                         if (auto* i = instruments.get(ch)) i->closeGUI();
+                        // The editor goes away with this load: drop the global
+                        // editor-open state (path stored at attach -- still the
+                        // old path before assign() below).
+                        {
+                            std::lock_guard<std::mutex> lk(g_editorMutex);
+                            if (g_editorOpen[ch]) {
+                                g_editorOpen[ch] = false;
+                                std::string pth = g_editorOpenPath[ch];
+                                g_editorOpenPath[ch].clear();
+                                if (!pth.empty()) {
+                                    auto it = g_editorPathCount.find(pth);
+                                    if (it != g_editorPathCount.end() && --it->second <= 0)
+                                        g_editorPathCount.erase(it);
+                                }
+                            }
+                        }
                         // Destroy the old editor's child windows (worker-owned,
                         // created by attachView here) so they stop pumping;
                         // the parent window is hidden and kept for reuse.
                         // See post_close_gui for the same pattern.
-                        while (HWND c = FindWindowExA(hToHide, nullptr, nullptr, nullptr))
-                            DestroyWindow(c);
-                        ShowWindow(hToHide, SW_HIDE);
+                        // CRASH FIX (0xc000041d): the editor children are
+                        // MAIN-thread-owned now (attachView runs on the main
+                        // pump) - DestroyWindow from this worker is cross-
+                        // thread and crashes USER32. Ask the main thread to
+                        // destroy them (kMsgDestroy) and wait for the ack.
+                        {
+                            std::lock_guard<std::mutex> lock(g_guiMutex);
+                            g_editorDestroyAck[ch] = false;
+                        }
+                        {
+                            std::lock_guard<std::mutex> lock(g_guiMutex);
+                            g_destroyRequest[ch] = hToHide;
+                        }
+                        bool destroyAcked = false;
+                        for (int i = 0; i < 500; ++i) {
+                            {
+                                std::lock_guard<std::mutex> lock(g_guiMutex);
+                                if (g_editorDestroyAck[ch]) { destroyAcked = true; break; }
+                            }
+                            Sleep(10);
+                        }
+                        if (!destroyAcked)
+                            std::cerr << "[dbg] load: editor destroy not acked ch=" << ch << std::endl;
+
+
                     }
 #endif
                     std::cerr << "[dbg] load thread start ch=" << ch
@@ -922,9 +1561,8 @@ int main(int argc, char* argv[]) {
                     // Release sustain pedal TRUOC (CC64=0) — nhieu VSTi giu note
                     // khi pedal con down -> note-off cua allNotesOff bi bo qua
                     // -> am treo loop (V8 bug 3).
-                    for (uint32_t ch = 0; ch < 16; ++ch) {
-                        if (auto* inst = instruments.get(ch)) inst->controlChange(ch, 64, 0);
-                    }
+                    for (uint32_t ch = 0; ch < 16; ++ch)
+                        instruments.controlChange(ch, 64, 0);  // manager drops unassigned/reloading
                     instruments.allNotesOff();
                     std::cout << "[NativeBridge] transport STOP — all notes off" << std::endl;
                 } else if (c.arg0 == 1) { // PLAY
@@ -944,6 +1582,7 @@ int main(int argc, char* argv[]) {
 
         // Pending OPEN_GUI requests: fulfilled as soon as the channel's
         // instrument becomes available (load job completed on its worker).
+        if (!std::getenv("SF_NO_SWEEP")) {
         {
             std::vector<std::pair<uint32_t, std::pair<void*, std::string>>> readyGui;
             {
@@ -958,8 +1597,10 @@ int main(int argc, char* argv[]) {
             for (auto& g : readyGui)
                 handleOpenGui(g.first, (uintptr_t)g.second.first, g.second.second);
         }
+        }
 
 
+        if (!std::getenv("SF_NO_AUDIO")) {
         // B. Snapshot queued MIDI events (bounded copy, queue reset immediately)
         uint32_t nEvents = shmIPC->midiQueueCount > 64 ? 64 : shmIPC->midiQueueCount;
         SharedAudioBufferIPC::MidiEventIPC evts[64];
@@ -984,13 +1625,15 @@ int main(int argc, char* argv[]) {
         }
         if (cursor < block) renderSegment(cursor, block);
         shmIPC->bridgeWriteIndex++;
+        }
 
         // D. Parent died / window closed -> exit (no orphan process)
-        if (parentPid != 0 && !parent_alive(parentPid)) {
+        if (!std::getenv("SF_NO_PARENT") && parentPid != 0 && !parent_alive(parentPid)) {
             std::cout << "[NativeBridge] parent gone — exiting." << std::endl;
             break;
         }
 
+        if (!std::getenv("SF_NO_AUDIO")) {
         // E. Synchronize with real-time audio playback
         blockCount++;
         auto targetTime = startTime + std::chrono::microseconds(static_cast<int64_t>(blockCount * blockDurationMs * 1000.0));
@@ -1004,6 +1647,7 @@ int main(int argc, char* argv[]) {
                 std::this_thread::yield();
             }
         }
+        }
     }
 
 #ifdef _WIN32