@@ -12,8 +12,10 @@ import { MINIAPP_LOOPBACK_HEALTH_PATH } from '../../contracts.js';
  *   plugin data.
  * - `foreign` — something else holds the port and does not answer like the guard. Not this Mini App;
  *   the runtime may pick another port.
+ * - `unknown` — the probe could not distinguish a listener from a free port; callers must fail
+ *   closed rather than start on a different port.
  */
-export type MiniAppPortOwnership = 'free' | 'guarded' | 'foreign';
+export type MiniAppPortOwnership = 'free' | 'guarded' | 'foreign' | 'unknown';
 
 export interface MiniAppPortProbeInput {
   readonly port: number;
@@ -32,12 +34,23 @@ export async function probeMiniAppPortOwnership(
   let status: number;
   try {
     status = await requestHealth(input);
-  } catch {
-    return 'free';
+  } catch (error) {
+    if (input.signal.aborted) throw input.signal.reason;
+    if (isConnectionRefused(error)) return 'free';
+    return 'unknown';
   }
   return status === 401 ? 'guarded' : 'foreign';
 }
 
+function isConnectionRefused(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    error.code === 'ECONNREFUSED'
+  );
+}
+
 function requestHealth(input: MiniAppPortProbeInput): Promise<number> {
   if (input.signal.aborted) return Promise.reject(input.signal.reason);
   return new Promise((resolve, reject) => {
 
@@ -20,6 +20,7 @@ import { MiniAppCleanupUnprovenError, markMiniAppRootTerminationProven } from '.
 import { sanitizeMiniAppRuntimeLogEvent } from '../../runtime-log.js';
 import type { MiniAppRunnerInitMessage } from './host-runner.js';
 import { waitForLoopbackReadiness } from './loopback-readiness.js';
+import { probeMiniAppPortOwnership } from './loopback-ownership.js';
 import { acquireMiniAppOwner, type MiniAppOwnerIdentity } from './owner-lease.js';
 import {
   createDirectNodeRootTerminator,
@@ -265,9 +266,14 @@ async function preparedRuntimeWithOwnership(
 ): Promise<MiniAppNodeRuntime> {
   // One credential per process generation: every port attempt reuses it.
   const loopbackToken = input.options.makeLoopbackToken();
+  const derivedPort = deterministicPort(input);
+  const firstCandidatePort = candidatePort(input, 0);
+  if (firstCandidatePort === derivedPort) {
+    await refuseIfPortIsOwnedElsewhere(input, derivedPort);
+  }
   let lastError: unknown;
   for (let index = 0; index < input.options.maxPortAttempts; index += 1) {
-    const port = candidatePort(input, index);
+    const port = index === 0 ? firstCandidatePort : candidatePort(input, index);
     const reservation = input.options.reservePort?.({
       pluginId: input.candidate.pluginId,
       port,
@@ -310,7 +316,11 @@ async function preparedRuntimeWithOwnership(
       attachStartupFailureDetail(error, failure);
       attempt?.startupErrorCapture.attachFailure(failure, error);
       lastError = failure;
-      if (!retryablePortError(failure) || index + 1 >= input.options.maxPortAttempts) throw failure;
+      if (!retryablePortError(failure)) throw failure;
+      // Only this plugin's deterministic port identifies its cross-client owner. A guarded
+      // listener on any fallback candidate can belong to a different Mini App.
+      if (port === derivedPort) await refuseIfPortIsOwnedElsewhere(input, port);
+      if (index + 1 >= input.options.maxPortAttempts) throw failure;
     }
   }
   throw (
@@ -319,6 +329,31 @@ async function preparedRuntimeWithOwnership(
   );
 }
 
+async function refuseIfPortIsOwnedElsewhere(
+  input: Parameters<typeof prepareRuntime>[0],
+  port: number,
+): Promise<void> {
+  throwIfAborted(input.signal);
+  const ownership = await probeMiniAppPortOwnership({
+    port,
+    timeoutMs: input.options.tcpConnectTimeoutMs,
+    signal: input.signal,
+  });
+  throwIfAborted(input.signal);
+  if (ownership === 'unknown') {
+    throw new MiniAppNodeRuntimeError(
+      'RUNNER_START_FAILED',
+      `Unable to verify whether Mini App ${input.candidate.pluginId} is already running in another client`,
+    );
+  }
+  if (ownership === 'guarded') {
+    throw new MiniAppNodeRuntimeError(
+      'OWNED_ELSEWHERE',
+      ownerHeldDetail(undefined, input.candidate.pluginId),
+    );
+  }
+}
+
 async function cleanupFailedAttempt(
   attempt: Attempt | undefined,
   cause: unknown,
@@ -865,12 +900,7 @@ function needsConnectorChannel(candidate: ProcessMiniAppCandidate): boolean {
 }
 
 function candidatePort(input: Parameters<typeof prepareRuntime>[0], index: number): number {
-  const preferred = input.preferredPort;
-  const digest = createHash('sha256').update(input.candidate.pluginId).digest();
-  const base =
-    preferred !== undefined && preferred >= PORT_MIN && preferred <= PORT_MAX
-      ? preferred
-      : PORT_MIN + (digest.readUInt32BE(0) % PORT_COUNT);
+  const base = deterministicPort(input);
   let available = 0;
   for (let offset = 0; offset < PORT_COUNT; offset += 1) {
     const port = PORT_MIN + ((base - PORT_MIN + offset) % PORT_COUNT);
@@ -881,6 +911,13 @@ function candidatePort(input: Parameters<typeof prepareRuntime>[0], index: numbe
   throw new MiniAppNodeRuntimeError('NO_CANDIDATE_PORT', 'No Host-approved port is available');
 }
 
+function deterministicPort(input: Parameters<typeof prepareRuntime>[0]): number {
+  const preferred = input.preferredPort;
+  if (preferred !== undefined && preferred >= PORT_MIN && preferred <= PORT_MAX) return preferred;
+  const digest = createHash('sha256').update(input.candidate.pluginId).digest();
+  return PORT_MIN + (digest.readUInt32BE(0) % PORT_COUNT);
+}
+
 function runnerEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
   const result: NodeJS.ProcessEnv = { ELECTRON_RUN_AS_NODE: '1' };
   for (const key of [
 
@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import http from 'node:http';
-import { createServer as createNetServer, connect as connectNet } from 'node:net';
+import { createServer as createNetServer, connect as connectNet, type Socket } from 'node:net';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
@@ -354,4 +354,29 @@ describe('Mini App port ownership', () => {
       child.kill('SIGKILL');
     }
   });
+
+  it('reports a stalled listener as unknown rather than free', async () => {
+    const stalledPort = await freePort();
+    const sockets = new Set<Socket>();
+    const stalledServer = createNetServer((socket) => {
+      sockets.add(socket);
+      socket.once('close', () => sockets.delete(socket));
+    });
+    await new Promise<void>((resolve, reject) => {
+      stalledServer.once('error', reject);
+      stalledServer.listen(stalledPort, '127.0.0.1', resolve);
+    });
+    try {
+      await expect(
+        probeMiniAppPortOwnership({
+          port: stalledPort,
+          timeoutMs: 10,
+          signal: new AbortController().signal,
+        }),
+      ).resolves.toBe('unknown');
+    } finally {
+      for (const socket of sockets) socket.destroy();
+      await new Promise<void>((resolve) => stalledServer.close(() => resolve()));
+    }
+  });
 });
@@ -1,4 +1,5 @@
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createServer, type Server } from 'node:http';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { EventEmitter } from 'node:events';
@@ -35,6 +36,7 @@ class ScriptedChild extends EventEmitter {
     private readonly onExit: () => void,
     /** A child that accepts the init message and never reports readiness. */
     private readonly silent = false,
+    private readonly beforeStart?: (init: MiniAppRunnerInitMessage) => Promise<void>,
   ) {
     super();
   }
@@ -45,6 +47,7 @@ class ScriptedChild extends EventEmitter {
       this.received.push(init);
       if (this.silent) return true;
       try {
+        await this.beforeStart?.(init);
         this.runner = await startMiniAppModule(init, {
           loadModule: async () => ({
             start: async (context: { readonly listen: { host: string; port: number } }) => {
@@ -67,7 +70,11 @@ class ScriptedChild extends EventEmitter {
         });
       } catch (error) {
         callback?.(error as Error);
-        this.emit('message', { type: 'miniapp:error', code: 'RUNNER_START_FAILED', errorText: String(error) });
+        const code =
+          typeof error === 'object' && error !== null && 'code' in error && error.code === 'EADDRINUSE'
+            ? 'EADDRINUSE'
+            : 'RUNNER_START_FAILED';
+        this.emit('message', { type: 'miniapp:error', code, errorText: String(error) });
         return false;
       }
       callback?.(null);
@@ -230,6 +237,105 @@ describe('Mini App process generations', () => {
 });
 
 describe('Mini App ownership before spawn', () => {
+  it('re-probes after a bind race and does not retry on another port', async () => {
+    const dataDir = await mkdtemp(join(tmpdir(), 'miniapp external race '));
+    let guardedServer: Server | undefined;
+    const child = new ScriptedChild(() => undefined, false, async (init) => {
+      guardedServer = createServer((_request, response) => {
+        response.writeHead(401).end();
+      });
+      await new Promise<void>((resolve, reject) => {
+        guardedServer?.once('error', reject);
+        guardedServer?.listen(init.listen.port, '127.0.0.1', resolve);
+      });
+    });
+    const adapter = createMiniAppNodeRuntimeAdapter({
+      resolvePluginDataDir: () => dataDir,
+      verifyCandidate: async () => true,
+      materializePackage: async ({ targetRoot }) => {
+        const target = join(targetRoot, 'miniapp', 'node', 'server.js');
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, 'export const start = async () => undefined;\n');
+      },
+      isPortReserved: () => false,
+      maxPortAttempts: 1,
+      spawn: () => child as unknown as ChildProcess,
+      createTerminator: () => ({ stop: async () => ({ proven: true }) }) as never,
+    });
+
+    try {
+      await expect(
+        adapter.prepare({
+          candidate: candidate(),
+          processGeneration: 'generation-bind-race',
+          preferredPort: 56_000,
+          signal: new AbortController().signal,
+          onLog: () => undefined,
+        }),
+      ).rejects.toMatchObject({ code: 'OWNED_ELSEWHERE' });
+      expect(child.received).toHaveLength(1);
+    } finally {
+      guardedServer?.closeAllConnections();
+      if (guardedServer) {
+        await new Promise<void>((resolve) => guardedServer?.close(() => resolve()));
+      }
+      await rm(dataDir, { recursive: true, force: true });
+    }
+  });
+
+  it('refuses a guarded derived port owned by another client before retrying on a new port', async () => {
+    const dataDir = await mkdtemp(join(tmpdir(), 'miniapp external owner '));
+    let guardedServer: Server | undefined;
+    let guardedPort: number | undefined;
+    for (let port = 55_000; port < 56_000 && guardedServer === undefined; port += 1) {
+      const server = createServer((_request, response) => {
+        response.writeHead(401).end();
+      });
+      try {
+        await new Promise<void>((resolve, reject) => {
+          server.once('error', reject);
+          server.listen(port, '127.0.0.1', resolve);
+        });
+        guardedServer = server;
+        guardedPort = port;
+      } catch {
+        server.closeAllConnections();
+      }
+    }
+    if (!guardedServer || guardedPort === undefined) throw new Error('Could not reserve a test port');
+
+    const child = new ScriptedChild(() => undefined);
+    const adapter = createMiniAppNodeRuntimeAdapter({
+      resolvePluginDataDir: () => dataDir,
+      verifyCandidate: async () => true,
+      materializePackage: async ({ targetRoot }) => {
+        const target = join(targetRoot, 'miniapp', 'node', 'server.js');
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, 'export const start = async () => undefined;\n');
+      },
+      isPortReserved: () => false,
+      spawn: () => child as unknown as ChildProcess,
+      createTerminator: () => ({ stop: async () => ({ proven: true }) }) as never,
+    });
+
+    try {
+      const preparation = adapter.prepare({
+        candidate: candidate(),
+        processGeneration: 'generation-external-owner',
+        preferredPort: guardedPort,
+        signal: new AbortController().signal,
+        onLog: () => undefined,
+      });
+
+      await expect(preparation).rejects.toMatchObject({ code: 'OWNED_ELSEWHERE' });
+      expect(child.received).toHaveLength(0);
+    } finally {
+      guardedServer.closeAllConnections();
+      await new Promise<void>((resolve) => guardedServer.close(() => resolve()));
+      await rm(dataDir, { recursive: true, force: true });
+    }
+  });
+
   it('refuses a Mini App another client owns, without spawning a process', async () => {
     const dataDir = await mkdtemp(join(tmpdir(), 'miniapp owned '));
     const build = (child: ScriptedChild) =>