@@ -6,6 +6,15 @@ Release notes live here rather than beside the version number: the number is one
 
 ## 1.1
 
+- **`InstanceGate` is exclusive on Linux and macOS too.** It never was: .NET's named-pipe server
+  there is a Unix-domain socket that unlinks whatever socket is at its path and binds its own,
+  enforcing the single instance only within one process. So a second launch claimed the gate
+  instead of being refused, a hand-off reached the newest window rather than the first, and the
+  older gate's dispose then unlinked the newer one's socket. Off Windows the claim is now an
+  advisory lock (`flock`) on a `<channel>.claim` file in the temporary folder, held for the gate's
+  life and released by the kernel when the process dies, so a crashed holder leaves no stale claim.
+  Pinned by two tests that hold the gate from a second process, which fail on Linux without the
+  lock. No API change.
 - **`InstanceGate.TryHandOff` answers "nobody is there" at once instead of at the timeout.**
   `NamedPipeClientStream.Connect` does not distinguish an absent holder from a busy one: it polls
   for the name to appear and gives up only when the timeout expires. Waiting is right for a busy
 
@@ -58,9 +58,11 @@ and `c:\data\` do not open two windows onto the same folder.
 
 ## Three things it gets right that are easy to get wrong
 
-**The pipe is the lock.** A named pipe with a single server instance can only be created once, so
-claiming it *is* the primacy test — there is no separate mutex, one lifetime to get right, and no
-abandoned-mutex case.
+**On Windows the pipe is the lock.** A named pipe with a single server instance can only be created
+once, so claiming it *is* the primacy test — there is no separate mutex, one lifetime to get right,
+and no abandoned-mutex case. On Linux and macOS .NET's pipe is a Unix-domain socket whose server
+replaces whatever socket is at its path, so there the claim is an advisory lock (`flock`) on a file
+beside it, which the kernel releases when its process dies, a crash included.
 
 **The accept loop is not on the thread pool.** The pipe is deliberately not `Asynchronous`, and the
 accept runs on a dedicated thread. An awaited accept resumes on a pool worker, and an app of this
 
@@ -0,0 +1,82 @@
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace SharpAstro.AppShell.Tests;
+
+/// <summary>
+/// A second PROCESS holding a gate. A claim's exclusivity is a property of the OS between processes,
+/// and inside one process .NET refuses a second server of one name by itself (its Unix server keeps a
+/// per-process table), so a test of two gates in one process passes whether or not two processes
+/// would be kept apart.
+///
+/// <para>The holder is this test assembly run again, <c>dotnet SharpAstro.AppShell.Tests.dll</c>, with
+/// <see cref="ChannelVariable"/> naming the channel: the module initializer below claims it before the
+/// test runner starts, prints <c>claimed</c> or <c>taken</c>, holds the claim until its standard input
+/// closes, and exits without running a test.</para>
+/// </summary>
+internal sealed class GateHolderProcess : IDisposable
+{
+    private const string ChannelVariable = "APPSHELL_TESTS_HOLD_GATE";
+
+    private readonly Process _process;
+
+    private GateHolderProcess(Process process) => _process = process;
+
+    /// <summary>What the holder answered: <c>claimed</c> or <c>taken</c>.</summary>
+    public string Answer { get; private init; } = "";
+
+    public static async Task<GateHolderProcess> StartAsync(string channel, CancellationToken cancellationToken)
+    {
+        var info = new ProcessStartInfo(DotnetHost(), $"\"{typeof(GateHolderProcess).Assembly.Location}\"")
+        {
+            RedirectStandardInput = true,
+            RedirectStandardOutput = true,
+            UseShellExecute = false,
+        };
+        info.Environment[ChannelVariable] = channel;
+        var process = Process.Start(info) ?? throw new InvalidOperationException("The holder process did not start.");
+        var answer = await process.StandardOutput.ReadLineAsync(cancellationToken) ?? "";
+        return new GateHolderProcess(process) { Answer = answer };
+    }
+
+    /// <summary>Ends the holder as a crash does: nothing it would do on its way out runs.</summary>
+    public async Task KillAsync(CancellationToken cancellationToken)
+    {
+        _process.Kill(entireProcessTree: true);
+        await _process.WaitForExitAsync(cancellationToken);
+    }
+
+    public void Dispose()
+    {
+        if (!_process.HasExited)
+        {
+            _process.StandardInput.Close();
+            if (!_process.WaitForExit(10_000))
+            {
+                _process.Kill(entireProcessTree: true);
+            }
+        }
+        _process.Dispose();
+    }
+
+    // The SDK's own host when a test runs under it, else the one on PATH
+    private static string DotnetHost()
+        => Environment.GetEnvironmentVariable("DOTNET_HOST_PATH") is { Length: > 0 } host ? host : "dotnet";
+
+    [ModuleInitializer]
+    internal static void HoldWhenAsked()
+    {
+        if (Environment.GetEnvironmentVariable(ChannelVariable) is not { Length: > 0 } channel)
+        {
+            return;
+        }
+
+        using (var gate = InstanceGate.TryClaim(channel))
+        {
+            Console.Out.WriteLine(gate is null ? "taken" : "claimed");
+            Console.Out.Flush();
+            Console.In.ReadToEnd();
+        }
+        Environment.Exit(0);
+    }
+}
@@ -56,6 +56,39 @@ public void The_first_claim_wins_and_the_second_is_refused()
         InstanceGate.TryClaim(channel).ShouldBeNull();
     }
 
+    [Fact(Timeout = 60_000)]
+    public async Task A_claim_another_process_holds_refuses_this_one()
+    {
+        // The test above holds both claims in one process, where .NET refuses the second server by
+        // itself. Between processes on Linux and macOS, .NET's pipe server unlinked the holder's
+        // socket and bound its own, so EVERY launch claimed the gate and a hand-off reached the
+        // newest window rather than the first.
+        var ct = TestContext.Current.CancellationToken;
+        var channel = InstanceGate.ChannelFor(Scope, UniqueIdentity("cross-process"));
+
+        using var holder = await GateHolderProcess.StartAsync(channel, ct);
+        holder.Answer.ShouldBe("claimed");
+
+        InstanceGate.TryClaim(channel).ShouldBeNull();
+        InstanceGate.TryHandOff(channel, "to the holder", TimeSpan.FromSeconds(5)).ShouldBeTrue();
+    }
+
+    [Fact(Timeout = 60_000)]
+    public async Task A_holder_that_died_leaves_the_claim_free()
+    {
+        // A crash runs no dispose, so whatever marks the claim must die with the process, or a
+        // crashed window would refuse every later launch the gate.
+        var ct = TestContext.Current.CancellationToken;
+        var channel = InstanceGate.ChannelFor(Scope, UniqueIdentity("crashed"));
+
+        using var holder = await GateHolderProcess.StartAsync(channel, ct);
+        holder.Answer.ShouldBe("claimed");
+        await holder.KillAsync(ct);
+
+        using var next = InstanceGate.TryClaim(channel);
+        next.ShouldNotBeNull();
+    }
+
     [Fact]
     public void Releasing_a_claim_lets_the_next_process_take_it()
     {
 
@@ -31,11 +31,22 @@ namespace SharpAstro.AppShell;
 /// open folder", where opening a file in a new folder gets a new window but opening one in a folder
 /// already on screen activates that window. Neither policy is baked in here.</para>
 ///
-/// <para><b>The pipe is the lock.</b> A named pipe with a single server instance can only be
+/// <para><b>On Windows the pipe is the lock.</b> A named pipe with a single server instance can only be
 /// created once, so <see cref="TryClaim"/> succeeding IS the claim, and the same object then
 /// carries the hand-off traffic. One primitive means one lifetime to get right and no
 /// abandoned-mutex case to reason about.</para>
 ///
+/// <para><b>On Linux and macOS it cannot be, so a lock file is.</b> .NET's pipe there is a Unix-domain
+/// socket, and its server unlinks whatever socket is at the path and binds its own, enforcing the
+/// single instance only within one process (<c>NamedPipeServerStream.Unix.cs</c>, <c>SharedServer</c>).
+/// So a second process took the name instead of being refused: every launch claimed the gate, a
+/// hand-off reached the NEWEST window, and the older gate's dispose then unlinked the newer one's
+/// socket. The claim is an exclusive advisory lock (<c>flock</c>, which .NET takes for
+/// <see cref="FileShare.None"/>) on a file beside the socket, held for the gate's life; the kernel
+/// releases it when its process dies, however it dies, so a crash leaves no stale claim behind, which
+/// <see cref="PipeOptions.FirstPipeInstance"/> alone would (its bind fails on a dead holder's socket
+/// file for good).</para>
+///
 /// <para><b>The accept loop gets its own thread, and the pipe is deliberately NOT
 /// <see cref="PipeOptions.Asynchronous"/>.</b> An awaited accept resumes on a thread-pool worker,
 /// and a desktop app of this kind saturates its own pool with decode and tessellation work -- so
@@ -65,6 +76,9 @@ public sealed class InstanceGate : IDisposable
 
     // Not readonly: a wedged instance is replaced, see AcceptLoop. Written only by the accept thread.
     private volatile NamedPipeServerStream _server;
+
+    // The claim off Windows, held until after the server is disposed (see the class remarks); null on Windows.
+    private readonly FileStream? _claim;
     private readonly ConcurrentQueue<HandoffRequest> _incoming = new();
     private readonly ILogger? _log;
     private Thread? _thread;
@@ -74,9 +88,10 @@ public sealed class InstanceGate : IDisposable
     // connection (see Dispose), and this is what tells it that connection was ours.
     private volatile bool _stopping;
 
-    private InstanceGate(NamedPipeServerStream server, string channel, ILogger? log)
+    private InstanceGate(NamedPipeServerStream server, FileStream? claim, string channel, ILogger? log)
     {
         _server = server;
+        _claim = claim;
         Channel = channel;
         _log = log;
     }
@@ -140,11 +155,19 @@ public static string NormalizePathIdentity(string path)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(channel);
 
+        FileStream? claim = null;
         NamedPipeServerStream server;
         try
         {
-            // maxNumberOfServerInstances 1 is what makes creation exclusive, and therefore what
-            // makes this the primacy test rather than merely a transport.
+            if (!OperatingSystem.IsWindows())
+            {
+                // The claim itself (see the class remarks); an IOException is another process holding it
+                claim = new FileStream(ClaimPath(channel), FileMode.OpenOrCreate, FileAccess.ReadWrite, FileShare.None);
+            }
+
+            // maxNumberOfServerInstances 1 is what makes creation exclusive on Windows, and therefore
+            // what makes this the primacy test there rather than merely a transport. Elsewhere the
+            // claim above is, and this server only replaces whatever socket a dead holder left.
             server = new NamedPipeServerStream(
                 channel,
                 PipeDirection.InOut,
@@ -155,17 +178,19 @@ public static string NormalizePathIdentity(string path)
         catch (IOException)
         {
             // The name is taken: somebody else is the instance for this identity.
+            claim?.Dispose();
             return null;
         }
         catch (Exception ex)
         {
             // Anything else (an unsupported platform, a permissions problem) means we cannot gate.
             // Running without one is correct: the app opens its own window.
+            claim?.Dispose();
             log?.LogDebug(ex, "Could not claim instance channel {Channel}; continuing ungated", channel);
             return null;
         }
 
-        var gate = new InstanceGate(server, channel, log);
+        var gate = new InstanceGate(server, claim, channel, log);
         gate._thread = new Thread(gate.AcceptLoop)
         {
             IsBackground = true,
@@ -175,6 +200,10 @@ public static string NormalizePathIdentity(string path)
         return gate;
     }
 
+    // Beside .NET's own socket for the channel, in the per-user temporary folder on macOS; on Linux the
+    // channel's hash of the user's name keeps two users' claims apart in a shared /tmp
+    private static string ClaimPath(string channel) => Path.Combine(Path.GetTempPath(), $"{channel}.claim");
+
     /// <summary>
     /// Hand <paramref name="payload"/> to the instance holding <paramref name="channel"/>, and
     /// grant it the right to raise its window. Returns false if nobody answered in time, in which
@@ -400,7 +429,8 @@ private void AcceptLoop()
 
     /// <summary>
     /// Rebuilds the server instance after it has stopped accepting. Returns false when the name
-    /// cannot be retaken, which means somebody else now holds it and this gate is finished.
+    /// cannot be retaken, which means somebody else now holds it and this gate is finished. Off
+    /// Windows the claim is held throughout, so nobody can take the name in between.
     /// </summary>
     private bool TryReplaceWedgedServer()
     {
@@ -478,6 +508,10 @@ public void Dispose()
 
         _thread?.Join(TimeSpan.FromSeconds(2));
         _server.Dispose();
+
+        // Only now: disposing the server unlinks the socket path, which must not happen to a socket a
+        // newer holder has already bound there
+        _claim?.Dispose();
     }
 
     private static string Sanitize(string value)