diff --git a/LifeOS/install/skills/Interceptor/Tools/LaunchTestProfile.sh b/LifeOS/install/skills/Interceptor/Tools/LaunchTestProfile.sh
index 18f39a791b..f7ad247069 100755
--- a/LifeOS/install/skills/Interceptor/Tools/LaunchTestProfile.sh
+++ b/LifeOS/install/skills/Interceptor/Tools/LaunchTestProfile.sh
@@ -56,10 +56,22 @@ fi
 
 case "$(uname -s)" in
     Darwin)
-        # No -n flag here — we want to reuse the existing Chrome process so the new
-        # window shares the user-data-dir lock with Default. Chrome handles
-        # --profile-directory by opening a window for that profile in the existing
-        # instance.
+        # Direct binary, not `open -a … --args`: when the browser is ALREADY
+        # RUNNING, `open` silently drops the --args (macOS behavior), so the
+        # profile window never opens and the isolation gate times out waiting
+        # for the context. Invoking the binary directly forwards the args to
+        # the running instance via Chrome's process singleton — the profile
+        # window opens whether or not the browser was already up.
+        CHROME_BIN="${INTERCEPTOR_TEST_BROWSER_BIN:-/Applications/${BROWSER}.app/Contents/MacOS/${BROWSER}}"
+        if [ -x "$CHROME_BIN" ]; then
+            "$CHROME_BIN" \
+                --profile-directory="$CHROME_PROFILE" \
+                --new-window \
+                "$START_URL" >/dev/null 2>&1 &
+            exit 0
+        fi
+        # Fallback (binary not at the expected path): reliable only when the
+        # browser is not already running.
         exec open -a "$BROWSER" --args \
             --profile-directory="$CHROME_PROFILE" \
             --new-window \
diff --git a/LifeOS/install/skills/Interceptor/preferences.env.example b/LifeOS/install/skills/Interceptor/preferences.env.example
new file mode 100644
index 0000000000..81de8ca742
--- /dev/null
+++ b/LifeOS/install/skills/Interceptor/preferences.env.example
@@ -0,0 +1,31 @@
+# Interceptor per-machine preferences — the contract read by
+# Tools/PreflightIsolation.sh, Tools/EnsureTestProfile.sh, and
+# Tools/LaunchTestProfile.sh.
+#
+# Copy to:
+#   ~/.claude/LIFEOS/USER/CUSTOMIZATIONS/SKILLS/Interceptor/preferences.env
+# and fill in the two required values.
+
+# REQUIRED — the pinned test context the agent is allowed to drive.
+# Set this friendly name ONCE in the extension popup's Context ID field
+# (click the Interceptor toolbar icon → Context ID → Save). Friendly names
+# survive extension reloads; raw UUIDs rot on every reload.
+INTERCEPTOR_TEST_CONTEXT_ID="interceptor-test"
+
+# REQUIRED for auto-launch — the dedicated test profile's on-disk directory
+# name (e.g. "Profile 2"). Map directory → profile name via Chrome's
+# "Local State" file (profile.info_cache), or chrome://version → Profile Path.
+# There is deliberately no default: guessing a profile could open the
+# operator's working window.
+INTERCEPTOR_TEST_CHROME_PROFILE=""
+
+# Optional — browser app name (default "Google Chrome").
+#INTERCEPTOR_TEST_BROWSER="Google Chrome"
+
+# Optional — direct path to the browser binary, used so launches work while
+# the browser is already running (macOS `open -a … --args` drops the args).
+#INTERCEPTOR_TEST_BROWSER_BIN="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+
+# Optional — comma-separated context IDs of the operator's WORKING profiles;
+# the preflight gate hard-denies driving any of these.
+#INTERCEPTOR_WORKING_PROFILE_IDS=""