diff --git a/games.monsterrobot.flowrinse.plist b/games.monsterrobot.flowrinse.plist
index f212596..58945eb 100644
--- a/games.monsterrobot.flowrinse.plist
+++ b/games.monsterrobot.flowrinse.plist
@@ -21,6 +21,13 @@
     <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
   </dict>
 
+  <!-- launch.sh backgrounds the queue server, then exits. Without this key launchd
+       SIGKILLs the whole process group on exit, taking the server with it — the
+       "self-heal" then restarts a server that dies a second later, forever. The
+       server you had running was a MANUAL ./launch.sh; the agent never kept one up. -->
+  <key>AbandonProcessGroup</key>
+  <true/>
+
   <!-- self-healing: idempotent launch.sh every 10 min (nc check + tab reuse
        make repeat runs no-ops), so a dead server or closed tab comes back -->
   <key>RunAtLoad</key>
diff --git a/install.sh b/install.sh
old mode 100644
new mode 100755
diff --git a/launch.sh b/launch.sh
index 330df26..24c24c2 100755
--- a/launch.sh
+++ b/launch.sh
@@ -32,10 +32,13 @@ fi
 
 # 2. open or focus ONE Flow tab (reuses an existing one so it can't double-run).
 # Only `activate` (steal system focus) when opening fresh — on the 10-min launchd
-# tick an existing tab is re-selected inside Brave without yanking you out of
+# tick an existing tab is re-selected inside the browser without yanking you out of
 # whatever you're doing. Selecting the tab also keeps Memory Saver from discarding it.
+#
+# Must name the browser the EXTENSION is loaded into. ultra = Brave, m3ultra = Chrome.
+BROWSER="${FLOW_BROWSER:-Brave Browser}"
 osascript <<OSA
-tell application "Brave Browser"
+tell application "$BROWSER"
   set found to false
   repeat with w in windows
     set i to 0
@@ -54,4 +57,4 @@ tell application "Brave Browser"
   end if
 end tell
 OSA
-echo "Brave focused on Flow. With Auto-start ticked, the rinse begins on load."
+echo "$BROWSER focused on Flow. With Auto-start ticked, the rinse begins on load."
diff --git a/local_server_example.py b/local_server_example.py
index 29a7fee..b1877be 100755
--- a/local_server_example.py
+++ b/local_server_example.py
@@ -173,10 +173,17 @@ def selftest():
     print("selftest ok")
 
 def run(port=8017):
-    print(f"--- Flow queue on http://localhost:{port} ---")
+    # ponytail: loopback ONLY. /save base64-writes to an attacker-supplied absolute `dest`
+    # with no auth — bound to 0.0.0.0 that is arbitrary file write as this user (drop a
+    # ~/Library/LaunchAgents plist → code execution) for anyone on the same wifi.
+    # The extension only ever calls localhost. FLOW_BIND=<tailscale-ip> if a remote box
+    # must enqueue — a tailnet IP is routed over utun, so the LAN still can't reach it.
+    # Never set it back to "" / 0.0.0.0.
+    host = os.environ.get("FLOW_BIND", "127.0.0.1")
+    print(f"--- Flow queue on http://{host}:{port} ---")
     print(f"queue:   {QUEUE_FILE if os.path.exists(QUEUE_FILE) else '(demo — no queue.jsonl)'}")
     print(f"pending: {sum(1 for t in load_queue() if t['id'] not in done_ids())}")
-    HTTPServer(("", port), Handler).serve_forever()
+    HTTPServer((host, port), Handler).serve_forever()
 
 if __name__ == "__main__":
     import sys