diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8e0b3df..d58b1399 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 
 ### 修复
 
+- 组织页嵌入本机 openXYOS 不再因为边车「已连接」却空白：`CORS_ORIGIN` 即使漏了 `http://127.0.0.1:3780` / `localhost` / `[::1]`，服务端也会合并监听自源，模块脚本和登录不再 500。FreeOS 启动会先停掉 live 目录里旧的 Node，再用当前 `start-sidecar.ps1` 拉起；嵌套的 `openxyos\dist` 会在启动前提升到 live 根。若 livez 正常但自源请求失败，状态栏和预览区会明确提示，而不是一片白。
 - Windows 安装成功后删除 `$INSTDIR\openxyos-runtime` 目录和 `openxyos-runtime.zip`（以及 `%LOCALAPPDATA%\FreeOS` 下同名暂存）。预配失败时保留这些文件以便排查。最终工作目录 `$INSTDIR\openxyos` 与 `%LOCALAPPDATA%\FreeOS\openxyos` 不受影响。
 - ima 知识库挂接对齐官方 Agent Interface（https://ima.qq.com/agent-interface，落地页现发 ima-skill 1.1.10）：用 Client ID / API Key 连接后，按 `search_knowledge_base` + `get_knowledge_base` 选知识库，按 `get_knowledge_list` / `search_knowledge` 自选文档；文件夹 ID 用接口返回的 `media_id`（不自造 `folder_` 前缀），选择会写入挂接。
 - 模型页注册的本机 Ollama / GGUF 现在会出现在对话区模型选择器里，并走本机 `127.0.0.1:11434` 调用。注册会补齐 Ollama 供应商默认值、打开服务开关、热加载对话列表；Ollama 未启动时给出可操作错误，而不是静默失败。
diff --git a/dashboard/src/api/modules/orgModule.ts b/dashboard/src/api/modules/orgModule.ts
index 795c8e85..f2c2f86d 100644
--- a/dashboard/src/api/modules/orgModule.ts
+++ b/dashboard/src/api/modules/orgModule.ts
@@ -52,6 +52,7 @@ export interface OrgControlPlane {
 export interface OrgOverview {
   enabled: boolean;
   sidecar_reachable: boolean;
+  sidecar_embed_ok?: boolean;
   sidecar_url: string;
   start_available: boolean;
   install_ready: boolean;
diff --git a/dashboard/src/locales/en.json b/dashboard/src/locales/en.json
index c2532a3f..dab0a7e8 100644
--- a/dashboard/src/locales/en.json
+++ b/dashboard/src/locales/en.json
@@ -20,6 +20,7 @@
     "on": "Enabled",
     "off": "Disabled",
     "sidecarUp": "Local openXYOS connected",
+    "sidecarEmbedFailed": "Preview failed to load",
     "sidecarDown": "Opening local openXYOS",
     "sidecarOpening": "Opening local openXYOS",
     "lastSync": "Last sync",
@@ -103,6 +104,7 @@
     "disabled": "Organization module disabled",
     "previewTitle": "openXYOS preview",
     "previewOffline": "Opening local openXYOS (http://127.0.0.1:3780)…",
+    "previewBlank": "Local openXYOS is healthy, but the preview stayed blank: requests from its own origin (http://127.0.0.1:3780) were blocked by CORS, so scripts and styles never loaded. Fully quit and reopen FreeOS so the sidecar restarts with the current allow-list.",
     "previewLoading": "Opening local openXYOS…",
     "fullscreen": "Fullscreen",
     "exitFullscreen": "Exit fullscreen",
diff --git a/dashboard/src/locales/zh.json b/dashboard/src/locales/zh.json
index 6aec4802..71577adc 100644
--- a/dashboard/src/locales/zh.json
+++ b/dashboard/src/locales/zh.json
@@ -20,6 +20,7 @@
     "on": "已启用",
     "off": "已关闭",
     "sidecarUp": "本机 openXYOS 已连接",
+    "sidecarEmbedFailed": "预览页未能加载",
     "sidecarDown": "正在打开本机 openXYOS",
     "sidecarOpening": "正在打开本机 openXYOS",
     "lastSync": "最近同步",
@@ -103,6 +104,7 @@
     "disabled": "组织模块已关闭",
     "previewTitle": "openXYOS 预览",
     "previewOffline": "正在打开本机 openXYOS（http://127.0.0.1:3780）…",
+    "previewBlank": "本机 openXYOS 健康检查已通过，但预览页是空白的：页面自己的地址（http://127.0.0.1:3780）被跨域拦截，脚本和样式没有加载。请完全退出并重新打开 FreeOS，用当前白名单重启本机服务。",
     "previewLoading": "正在打开本机 openXYOS…",
     "fullscreen": "全屏",
     "exitFullscreen": "退出全屏",
diff --git a/dashboard/src/pages/Organization/Organization.module.less b/dashboard/src/pages/Organization/Organization.module.less
index bae9a0b0..658dac7b 100644
--- a/dashboard/src/pages/Organization/Organization.module.less
+++ b/dashboard/src/pages/Organization/Organization.module.less
@@ -105,6 +105,21 @@
   pointer-events: none;
 }
 
+.previewBlank {
+  position: absolute;
+  inset: 0;
+  z-index: 1;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 32px 40px;
+  max-width: none;
+  text-align: center;
+  line-height: 1.6;
+  color: var(--fn-text-primary);
+  background: rgba(255, 255, 255, 0.94);
+}
+
 .drawerBody {
   display: flex;
   flex-direction: column;
diff --git a/dashboard/src/pages/Organization/index.test.tsx b/dashboard/src/pages/Organization/index.test.tsx
index 39b9eec2..5c0900b5 100644
--- a/dashboard/src/pages/Organization/index.test.tsx
+++ b/dashboard/src/pages/Organization/index.test.tsx
@@ -1,11 +1,12 @@
 import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { describe, expect, it, vi } from "vitest";
 import OrganizationPage from "./index";
-import type { OrgOverview } from "../../api/modules/orgModule";
+import { orgModuleApi, type OrgOverview } from "../../api/modules/orgModule";
 
 const overview: OrgOverview = {
   enabled: true,
   sidecar_reachable: true,
+  sidecar_embed_ok: true,
   sidecar_url: "http://127.0.0.1:3780",
   start_available: false,
   install_ready: true,
@@ -92,5 +93,20 @@ describe("OrganizationPage", () => {
     expect(
       screen.getAllByText("organization.downloadSource").length,
     ).toBeGreaterThan(0);
+    expect(screen.queryByTestId("org-preview-blank")).toBeNull();
+  });
+
+  it("surfaces a blank-preview error when livez is up but embed origin fails", async () => {
+    vi.mocked(orgModuleApi.overview).mockResolvedValue({
+      ...overview,
+      sidecar_embed_ok: false,
+    });
+    render(<OrganizationPage />);
+    expect(await screen.findByTestId("org-preview-blank")).toHaveTextContent(
+      "organization.previewBlank",
+    );
+    expect(
+      screen.getByText("organization.sidecarEmbedFailed"),
+    ).toBeInTheDocument();
   });
 });
diff --git a/dashboard/src/pages/Organization/index.tsx b/dashboard/src/pages/Organization/index.tsx
index c5145a9f..665429a6 100644
--- a/dashboard/src/pages/Organization/index.tsx
+++ b/dashboard/src/pages/Organization/index.tsx
@@ -29,6 +29,7 @@ import {
 } from "../../utils/desktopFolder";
 import { message } from "../../utils/antdMessage";
 import { resolveOpenxyosSourceDest } from "./pickSourceDest";
+import { shouldShowPreviewBlank } from "./sidecarRecover";
 import styles from "./Organization.module.less";
 
 type ActionKey = "assemble" | "pack" | "loop" | "sidecar" | "produce" | null;
@@ -110,6 +111,11 @@ export default function OrganizationPage() {
   }, [applyOverview, overview?.sidecar_reachable]);
 
   const sidecarUp = Boolean(overview?.sidecar_reachable);
+  const embedOk = overview?.sidecar_embed_ok;
+  const previewBlank = shouldShowPreviewBlank({
+    sidecarUp,
+    embedOk,
+  });
   const firstRun = useMemo(() => {
     if (!overview) return false;
     return (
@@ -186,11 +192,19 @@ export default function OrganizationPage() {
 
   useEffect(() => {
     if (autoStartRef.current) return;
-    if (!overview || overview.sidecar_reachable) return;
-    if (!canSilentStart) return;
+    if (!overview) return;
+    const embedBroken =
+      overview.sidecar_reachable && overview.sidecar_embed_ok === false;
+    if (overview.sidecar_reachable && !embedBroken) return;
+    if (!embedBroken && !canSilentStart) return;
     autoStartRef.current = true;
     void startSidecar();
-  }, [canSilentStart, overview, overview?.sidecar_reachable]);
+  }, [
+    canSilentStart,
+    overview,
+    overview?.sidecar_reachable,
+    overview?.sidecar_embed_ok,
+  ]);
 
   const toggleModule = async (key: string, enabled: boolean) => {
     const next = { ...moduleToggles, [key]: enabled };
@@ -404,7 +418,9 @@ export default function OrganizationPage() {
               {overview?.enabled ? t("organization.on") : t("organization.off")}
             </span>
             <span className={styles.chip}>
-              {sidecarUp
+              {previewBlank
+                ? t("organization.sidecarEmbedFailed")
+                : sidecarUp
                 ? t("organization.sidecarUp")
                 : t("organization.sidecarOpening")}
             </span>
@@ -449,6 +465,14 @@ export default function OrganizationPage() {
               {t("organization.previewOffline")}
             </div>
           )}
+          {previewBlank && (
+            <div
+              className={styles.previewBlank}
+              data-testid="org-preview-blank"
+            >
+              {t("organization.previewBlank")}
+            </div>
+          )}
           <iframe
             key={sidecarUp ? "open" : "opening"}
             ref={iframeRef}
diff --git a/dashboard/src/pages/Organization/sidecarRecover.test.ts b/dashboard/src/pages/Organization/sidecarRecover.test.ts
index 1899b7a7..1214bfc1 100644
--- a/dashboard/src/pages/Organization/sidecarRecover.test.ts
+++ b/dashboard/src/pages/Organization/sidecarRecover.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { sidecarRecoverPhase } from "./sidecarRecover";
+import { shouldShowPreviewBlank, sidecarRecoverPhase } from "./sidecarRecover";
 
 describe("sidecarRecoverPhase", () => {
   it("hides overlay when the local console is already up", () => {
@@ -44,3 +44,23 @@ describe("sidecarRecoverPhase", () => {
     ).toBe("opening");
   });
 });
+
+describe("shouldShowPreviewBlank", () => {
+  it("stays quiet when livez is down or embed origin is allowed", () => {
+    expect(shouldShowPreviewBlank({ sidecarUp: false, embedOk: false })).toBe(
+      false,
+    );
+    expect(shouldShowPreviewBlank({ sidecarUp: true, embedOk: true })).toBe(
+      false,
+    );
+    expect(shouldShowPreviewBlank({ sidecarUp: true, embedOk: null })).toBe(
+      false,
+    );
+  });
+
+  it("surfaces a blank-preview error when livez is up but self-origin fails", () => {
+    expect(shouldShowPreviewBlank({ sidecarUp: true, embedOk: false })).toBe(
+      true,
+    );
+  });
+});
diff --git a/dashboard/src/pages/Organization/sidecarRecover.ts b/dashboard/src/pages/Organization/sidecarRecover.ts
index 3cbc6e8c..22fd55bf 100644
--- a/dashboard/src/pages/Organization/sidecarRecover.ts
+++ b/dashboard/src/pages/Organization/sidecarRecover.ts
@@ -11,3 +11,11 @@ export function sidecarRecoverPhase(input: {
   if (input.sidecarUp) return "hidden";
   return "opening";
 }
+
+/** livez can be green while iframe assets 500 on the sidecar's own Origin. */
+export function shouldShowPreviewBlank(input: {
+  sidecarUp: boolean;
+  embedOk: boolean | null | undefined;
+}): boolean {
+  return Boolean(input.sidecarUp) && input.embedOk === false;
+}
diff --git a/desktop/src/build/windows/nsis/start-sidecar.ps1 b/desktop/src/build/windows/nsis/start-sidecar.ps1
index 5d90b439..df953425 100644
--- a/desktop/src/build/windows/nsis/start-sidecar.ps1
+++ b/desktop/src/build/windows/nsis/start-sidecar.ps1
@@ -1,5 +1,7 @@
 # Internal helper: start local openXYOS (FE+BE) at medium integrity.
-# Used by the install-time provisioner and by explorers that open this file.
+# Used by the install-time provisioner and by FreeOS launch / Organization.
+# Always stop a previous live-dir Node first so a day-old process cannot
+# keep a stale CORS_ORIGIN (missing http://127.0.0.1:3780) and blank the iframe.
 # Never start Node while this process is elevated (High IL).
 $ErrorActionPreference = 'Continue'
 $live = Split-Path -Parent $MyInvocation.MyCommand.Path
@@ -14,7 +16,109 @@ function Test-Livez {
     }
 }
 
-if (Test-Livez) { exit 0 }
+function Test-OpenXYOSLayout {
+    param([string]$Root)
+    $node = Join-Path $Root 'node\node.exe'
+    if (-not (Test-Path -LiteralPath $node)) { return $false }
+    $nested = Join-Path $Root 'openxyos\dist\index.html'
+    $flat = Join-Path $Root 'dist\index.html'
+    return (Test-Path -LiteralPath $nested) -or (Test-Path -LiteralPath $flat)
+}
+
+function Copy-OpenXYOSTree {
+    param([string]$Src, [string]$Dest)
+    New-Item -ItemType Directory -Force -Path $Dest | Out-Null
+    $xcopy = Join-Path $env:SystemRoot 'System32\xcopy.exe'
+    if (Test-Path -LiteralPath $xcopy) {
+        & $xcopy /E /I /Y "$Src\*" "$Dest\" | Out-Null
+        return
+    }
+    Copy-Item -Path (Join-Path $Src '*') -Destination $Dest -Recurse -Force
+}
+
+function Find-OpenXYOSBundleRoot {
+    param([string]$Root)
+    if (Test-OpenXYOSLayout $Root) { return $Root }
+    $candidates = New-Object System.Collections.Generic.List[string]
+    foreach ($name in @('openxyos', 'org-sidecar')) {
+        $candidates.Add((Join-Path $Root $name))
+    }
+    if (Test-Path -LiteralPath $Root) {
+        Get-ChildItem -LiteralPath $Root -Directory -ErrorAction SilentlyContinue | ForEach-Object {
+            $candidates.Add($_.FullName)
+            $candidates.Add((Join-Path $_.FullName 'org-sidecar'))
+            $candidates.Add((Join-Path $_.FullName 'openxyos'))
+        }
+    }
+    foreach ($cand in $candidates) {
+        if (Test-OpenXYOSLayout $cand) { return $cand }
+    }
+    return $null
+}
+
+function Repair-OpenXYOSLayout {
+    param([string]$Root)
+    $nestedFe = Join-Path $Root 'openxyos\dist\index.html'
+    $flatFe = Join-Path $Root 'dist\index.html'
+    $nestedBe = Join-Path $Root 'openxyos\backend-dist\server.js'
+    $flatBe = Join-Path $Root 'backend-dist\server.js'
+    if ((Test-Path -LiteralPath $nestedFe) -and -not (Test-Path -LiteralPath $flatFe)) {
+        Copy-OpenXYOSTree (Join-Path $Root 'openxyos') $Root
+    } elseif ((Test-Path -LiteralPath $nestedBe) -and -not (Test-Path -LiteralPath $flatBe)) {
+        Copy-OpenXYOSTree (Join-Path $Root 'openxyos') $Root
+    }
+    if (Test-OpenXYOSLayout $Root) { return $true }
+    $found = Find-OpenXYOSBundleRoot $Root
+    if (-not $found) { return $false }
+    $fullFound = [IO.Path]::GetFullPath($found)
+    $fullRoot = [IO.Path]::GetFullPath($Root)
+    if ($fullFound -eq $fullRoot) { return $true }
+    Copy-OpenXYOSTree $found $Root
+    return (Test-OpenXYOSLayout $Root)
+}
+
+function Stop-OpenXYOSNode {
+    param([string]$Root)
+    $pidFile = Join-Path $Root 'start.pid'
+    if (Test-Path -LiteralPath $pidFile) {
+        $raw = (Get-Content -LiteralPath $pidFile -Raw -ErrorAction SilentlyContinue)
+        $nid = 0
+        if ($null -ne $raw -and [int]::TryParse($raw.Trim(), [ref]$nid) -and $nid -gt 0) {
+            Stop-Process -Id $nid -Force -ErrorAction SilentlyContinue
+        }
+        Remove-Item -LiteralPath $pidFile -Force -ErrorAction SilentlyContinue
+    }
+    $nodeExe = Join-Path $Root 'node\node.exe'
+    $want = ''
+    if (Test-Path -LiteralPath $nodeExe) {
+        try { $want = [IO.Path]::GetFullPath($nodeExe) } catch { $want = $nodeExe }
+    }
+    $fullRoot = ''
+    try { $fullRoot = [IO.Path]::GetFullPath($Root) } catch { $fullRoot = $Root }
+    Get-CimInstance Win32_Process -Filter "Name = 'node.exe'" -ErrorAction SilentlyContinue |
+        Where-Object {
+            if ($want -and $_.ExecutablePath) {
+                try {
+                    return ([IO.Path]::GetFullPath($_.ExecutablePath) -eq $want)
+                } catch {
+                }
+            }
+            if ($fullRoot -and $_.CommandLine) {
+                return ($_.CommandLine -like "*$fullRoot*")
+            }
+            return $false
+        } |
+        ForEach-Object {
+            Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue
+        }
+}
+
+$null = Repair-OpenXYOSLayout $live
+Stop-OpenXYOSNode $live
+for ($i = 0; $i -lt 8; $i++) {
+    if (-not (Test-Livez)) { break }
+    Start-Sleep -Milliseconds 250
+}
 
 function Test-IsElevated {
     $id = [Security.Principal.WindowsIdentity]::GetCurrent()
diff --git a/desktop/src/process_sidecar.go b/desktop/src/process_sidecar.go
index 13ec37fe..62cce84b 100644
--- a/desktop/src/process_sidecar.go
+++ b/desktop/src/process_sidecar.go
@@ -37,8 +37,28 @@ func sidecarNodeAt(bundle string) string {
 	return filepath.Join(base, "bin", "node")
 }
 
+func sidecarAppReady(app string) bool {
+	if strings.TrimSpace(app) == "" {
+		return false
+	}
+	if _, err := os.Stat(filepath.Join(app, "backend", "server.ts")); err != nil {
+		return false
+	}
+	if _, err := os.Stat(filepath.Join(app, "dist", "index.html")); err != nil {
+		return false
+	}
+	return true
+}
+
 func sidecarAppAt(bundle string) string {
-	return filepath.Join(bundle, "openxyos")
+	nested := filepath.Join(bundle, "openxyos")
+	if sidecarAppReady(nested) {
+		return nested
+	}
+	if sidecarAppReady(bundle) {
+		return bundle
+	}
+	return nested
 }
 
 func sidecarNodeArgs(app string) []string {
@@ -56,15 +76,11 @@ func sidecarBundleReady(bundle string) bool {
 	if _, err := os.Stat(sidecarNodeAt(bundle)); err != nil {
 		return false
 	}
-	app := sidecarAppAt(bundle)
-	if _, err := os.Stat(filepath.Join(app, "backend", "server.ts")); err != nil {
-		return false
-	}
-	if _, err := os.Stat(filepath.Join(app, "dist", "index.html")); err != nil {
-		log.Printf("organization sidecar frontend missing under %s", app)
-		return false
+	if sidecarAppReady(sidecarAppAt(bundle)) {
+		return true
 	}
-	return true
+	log.Printf("organization sidecar frontend missing under %s", bundle)
+	return false
 }
 
 func sidecarReady(root string) bool {
@@ -261,8 +277,8 @@ func sidecarLaunchEnv(home string, dashboardPort int) (map[string]string, error)
 		return nil, err
 	}
 	origin := fmt.Sprintf(
-		"http://127.0.0.1:%d,http://localhost:%d,http://127.0.0.1:18900,http://localhost:18900",
-		dashboardPort, dashboardPort,
+		"http://127.0.0.1:%d,http://localhost:%d,http://127.0.0.1:18900,http://localhost:18900,http://127.0.0.1:8088,http://localhost:8088,http://127.0.0.1:%d,http://localhost:%d,http://[::1]:%d",
+		dashboardPort, dashboardPort, defaultSidecarPort, defaultSidecarPort, defaultSidecarPort,
 	)
 	return map[string]string{
 		"NODE_ENV":                  "production",
@@ -282,15 +298,138 @@ func sidecarLaunchEnv(home string, dashboardPort int) (map[string]string, error)
 	}, nil
 }
 
-func startOrgSidecar(root string, dashboardPort int) (*exec.Cmd, error) {
-	if sidecarLive() {
-		log.Printf("organization sidecar already live at %s", sidecarURL())
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+func promoteNestedOpenXYOSApp(root string) {
+	nested := filepath.Join(root, "openxyos")
+	need := (fileExists(filepath.Join(nested, "dist", "index.html")) &&
+		!fileExists(filepath.Join(root, "dist", "index.html"))) ||
+		(fileExists(filepath.Join(nested, "backend-dist", "server.js")) &&
+			!fileExists(filepath.Join(root, "backend-dist", "server.js")))
+	if !need {
+		return
+	}
+	if err := copyTree(nested, root); err != nil {
+		log.Printf("heal openXYOS nested layout: %v", err)
+	}
+}
+
+func healOpenXYOSLayout(root string) bool {
+	if strings.TrimSpace(root) == "" {
+		return false
+	}
+	promoteNestedOpenXYOSApp(root)
+	if sidecarBundleReady(root) {
+		return true
+	}
+	candidates := []string{
+		filepath.Join(root, "openxyos"),
+		filepath.Join(root, "org-sidecar"),
+		filepath.Join(root, "openxyos", "openxyos"),
+		filepath.Join(root, "openxyos", "org-sidecar"),
+	}
+	if entries, err := os.ReadDir(root); err == nil {
+		for _, entry := range entries {
+			if !entry.IsDir() {
+				continue
+			}
+			child := filepath.Join(root, entry.Name())
+			candidates = append(candidates, child)
+			candidates = append(candidates, filepath.Join(child, "openxyos"))
+			candidates = append(candidates, filepath.Join(child, "org-sidecar"))
+		}
+	}
+	seen := map[string]bool{}
+	for _, candidate := range candidates {
+		clean := filepath.Clean(candidate)
+		if seen[clean] || clean == filepath.Clean(root) {
+			continue
+		}
+		seen[clean] = true
+		if !sidecarBundleReady(clean) {
+			continue
+		}
+		if err := copyTree(clean, root); err != nil {
+			log.Printf("heal openXYOS from %s: %v", clean, err)
+			continue
+		}
+		promoteNestedOpenXYOSApp(root)
+		return sidecarBundleReady(root)
+	}
+	promoteNestedOpenXYOSApp(root)
+	return sidecarBundleReady(root)
+}
+
+func stopStaleOpenXYOS(bundle string) {
+	if strings.TrimSpace(bundle) == "" {
+		return
+	}
+	pidFile := filepath.Join(bundle, "start.pid")
+	if data, err := os.ReadFile(pidFile); err == nil {
+		if pid, err := strconv.Atoi(strings.TrimSpace(string(data))); err == nil && pid > 0 {
+			killPid(pid)
+		}
+		_ = os.Remove(pidFile)
+	}
+	if runtime.GOOS == "windows" {
+		node := sidecarNodeAt(bundle)
+		killWindowsImageAt(node)
+	}
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) && sidecarLive() {
+		time.Sleep(200 * time.Millisecond)
+	}
+}
+
+func startViaWindowsHelper(bundle string) (*exec.Cmd, error) {
+	helper := filepath.Join(bundle, "start-sidecar.ps1")
+	if !fileExists(helper) {
 		return nil, nil
 	}
+	systemRoot := strings.TrimSpace(os.Getenv("SystemRoot"))
+	if systemRoot == "" {
+		systemRoot = `C:\Windows`
+	}
+	ps := filepath.Join(systemRoot, `System32`, `WindowsPowerShell`, `v1.0`, `powershell.exe`)
+	cmd := exec.Command(ps, "-NoProfile", "-WindowStyle", "Hidden", "-ExecutionPolicy", "Bypass", "-File", helper)
+	cmd.Dir = bundle
+	configureProcGroup(cmd)
+	if f, err := attachProcessLogFile("org-sidecar"); err == nil {
+		cmd.Stdout = f
+		cmd.Stderr = f
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	return cmd, nil
+}
+
+func startOrgSidecar(root string, dashboardPort int) (*exec.Cmd, error) {
 	bundle := resolveSidecarDir(root)
+	if bundle == "" {
+		work := openxyosUserWorkDir()
+		if healOpenXYOSLayout(work) {
+			bundle = work
+		}
+	}
 	if bundle == "" {
 		return nil, nil
 	}
+	if !healOpenXYOSLayout(bundle) && !sidecarBundleReady(bundle) {
+		return nil, nil
+	}
+	stopStaleOpenXYOS(bundle)
+	if runtime.GOOS == "windows" {
+		if cmd, err := startViaWindowsHelper(bundle); err != nil {
+			return nil, err
+		} else if cmd != nil {
+			log.Printf("organization sidecar restart via start-sidecar.ps1 at %s", bundle)
+			return cmd, nil
+		}
+	}
 	home := productHome()
 	env, err := sidecarLaunchEnv(home, dashboardPort)
 	if err != nil {
diff --git a/desktop/src/process_sidecar_test.go b/desktop/src/process_sidecar_test.go
index 42a2e4b6..122c7697 100644
--- a/desktop/src/process_sidecar_test.go
+++ b/desktop/src/process_sidecar_test.go
@@ -49,6 +49,15 @@ func TestSidecarLaunchEnvPointsAtHomeDatabase(t *testing.T) {
 	if !strings.Contains(env["CORS_ORIGIN"], "http://127.0.0.1:8088") {
 		t.Fatalf("CORS_ORIGIN=%q", env["CORS_ORIGIN"])
 	}
+	if !strings.Contains(env["CORS_ORIGIN"], "http://127.0.0.1:3780") {
+		t.Fatalf("CORS_ORIGIN missing sidecar self origin: %q", env["CORS_ORIGIN"])
+	}
+	if !strings.Contains(env["CORS_ORIGIN"], "http://localhost:3780") {
+		t.Fatalf("CORS_ORIGIN missing localhost self origin: %q", env["CORS_ORIGIN"])
+	}
+	if !strings.Contains(env["CORS_ORIGIN"], "http://[::1]:3780") {
+		t.Fatalf("CORS_ORIGIN missing ipv6 self origin: %q", env["CORS_ORIGIN"])
+	}
 }
 
 func TestSidecarReadyRequiresFrontendBuild(t *testing.T) {
@@ -295,7 +304,7 @@ func TestSidecarLiveReadsHealthURL(t *testing.T) {
 	}
 }
 
-func TestStartOrgSidecarSkipsWhenLive(t *testing.T) {
+func TestStartOrgSidecarSkipsWhenNoBundle(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	}))
@@ -307,7 +316,41 @@ func TestStartOrgSidecarSkipsWhenLive(t *testing.T) {
 		t.Fatal(err)
 	}
 	if cmd != nil {
-		t.Fatal("already-live sidecar must not spawn a second node")
+		t.Fatal("missing sidecar bundle must not spawn node even if livez is up")
+	}
+}
+
+func TestHealOpenXYOSLayoutPromotesNestedApp(t *testing.T) {
+	root := t.TempDir()
+	inner := filepath.Join(root, "openxyos")
+	writeSidecarBundle(t, inner)
+	if sidecarBundleReady(root) {
+		t.Fatal("outer tree should be incomplete before heal")
+	}
+	if !healOpenXYOSLayout(root) {
+		t.Fatal("heal should copy nested bundle to the live root")
+	}
+	if !sidecarBundleReady(root) {
+		t.Fatal("healed root should be a complete sidecar")
+	}
+	if !fileExists(filepath.Join(root, "dist", "index.html")) &&
+		!fileExists(filepath.Join(root, "openxyos", "dist", "index.html")) {
+		t.Fatal("heal should expose dist/index.html at nested or flat layout")
+	}
+}
+
+func TestHealOpenXYOSLayoutCopiesNestedFrontendToRoot(t *testing.T) {
+	root := t.TempDir()
+	writeSidecarBundle(t, root)
+	flat := filepath.Join(root, "dist", "index.html")
+	if fileExists(flat) {
+		t.Fatal("bundled layout should keep FE under openxyos/ until promoted")
+	}
+	if !healOpenXYOSLayout(root) {
+		t.Fatal("complete nested bundle should stay ready")
+	}
+	if !fileExists(flat) {
+		t.Fatal("missing top-level dist/index.html should be copied from openxyos/")
 	}
 }
 
diff --git a/desktop/src/process_unix.go b/desktop/src/process_unix.go
index cd03ff98..24067613 100644
--- a/desktop/src/process_unix.go
+++ b/desktop/src/process_unix.go
@@ -14,6 +14,19 @@ func configureProcGroup(cmd *exec.Cmd) {
 }
 
 func killProcessTree(cmd *exec.Cmd) {
-	_ = syscall.Kill(-cmd.Process.Pid, syscall.SIGTERM)
+	if cmd == nil || cmd.Process == nil {
+		return
+	}
+	killPid(cmd.Process.Pid)
 	_ = cmd.Wait()
 }
+
+func killPid(pid int) {
+	if pid <= 0 {
+		return
+	}
+	_ = syscall.Kill(-pid, syscall.SIGTERM)
+	_ = syscall.Kill(pid, syscall.SIGTERM)
+}
+
+func killWindowsImageAt(string) {}
diff --git a/desktop/src/process_windows.go b/desktop/src/process_windows.go
index 6a7ae8d2..756c2be4 100644
--- a/desktop/src/process_windows.go
+++ b/desktop/src/process_windows.go
@@ -4,8 +4,11 @@ package main
 
 import (
 	"io"
+	"os"
 	"os/exec"
+	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 
 	"golang.org/x/sys/windows"
@@ -25,7 +28,44 @@ func configureProcGroup(cmd *exec.Cmd) {
 }
 
 func killProcessTree(cmd *exec.Cmd) {
-	kill := exec.Command("taskkill", "/F", "/T", "/PID", strconv.Itoa(cmd.Process.Pid))
+	if cmd == nil || cmd.Process == nil {
+		return
+	}
+	killPid(cmd.Process.Pid)
+}
+
+func killPid(pid int) {
+	if pid <= 0 {
+		return
+	}
+	kill := exec.Command("taskkill", "/F", "/T", "/PID", strconv.Itoa(pid))
 	hideConsole(kill)
 	_ = kill.Run()
 }
+
+func killWindowsImageAt(exe string) {
+	exe = strings.TrimSpace(exe)
+	if exe == "" {
+		return
+	}
+	ps := filepath.Join(os.Getenv("SystemRoot"), `System32`, `WindowsPowerShell`, `v1.0`, `powershell.exe`)
+	if os.Getenv("SystemRoot") == "" {
+		ps = `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`
+	}
+	script := `
+param($Path)
+$want = ''
+try { $want = [IO.Path]::GetFullPath($Path) } catch { $want = $Path }
+Get-CimInstance Win32_Process -Filter "Name = 'node.exe'" -ErrorAction SilentlyContinue | ForEach-Object {
+    if (-not $_.ExecutablePath) { return }
+    try {
+        if ([IO.Path]::GetFullPath($_.ExecutablePath) -eq $want) {
+            Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue
+        }
+    } catch {}
+}
+`
+	cmd := exec.Command(ps, "-NoProfile", "-Command", script, "-Path", exe)
+	hideConsole(cmd)
+	_ = cmd.Run()
+}
diff --git a/modules/openxyos/backend/routes/health.ts b/modules/openxyos/backend/routes/health.ts
index 09b544e3..16aab7bc 100644
--- a/modules/openxyos/backend/routes/health.ts
+++ b/modules/openxyos/backend/routes/health.ts
@@ -1,8 +1,24 @@
 import { Router } from "express";
 import { dbGet } from "../db";
+import {
+  corsAllowsSelf,
+  mergeCorsOrigins,
+  parseOriginList,
+} from "../utils/cors-origins";
 
 export const healthRoutes = Router();
 
+function listenPort(): string {
+  return String(process.env.PORT ?? "3780").trim() || "3780";
+}
+
+function selfOriginAllowed(): boolean {
+  const port = listenPort();
+  const configured = parseOriginList(process.env.CORS_ORIGIN);
+  const allowed = mergeCorsOrigins(configured, port);
+  return corsAllowsSelf(allowed, port);
+}
+
 function checkDatabase() {
   const employees = dbGet("SELECT COUNT(*) as c FROM employees") as any;
   const tasks = dbGet("SELECT COUNT(*) as c FROM tasks") as any;
@@ -11,7 +27,11 @@ function checkDatabase() {
 }
 
 healthRoutes.get("/livez", (_req, res) => {
-  res.status(200).json({ status: "live", uptime: Math.floor(process.uptime()) });
+  res.status(200).json({
+    status: "live",
+    uptime: Math.floor(process.uptime()),
+    self_origin_allowed: selfOriginAllowed(),
+  });
 });
 
 healthRoutes.get("/readyz", (_req, res) => {
diff --git a/modules/openxyos/backend/utils/cors-origins.ts b/modules/openxyos/backend/utils/cors-origins.ts
index ab96d0ee..29f5ea59 100644
--- a/modules/openxyos/backend/utils/cors-origins.ts
+++ b/modules/openxyos/backend/utils/cors-origins.ts
@@ -59,3 +59,14 @@ export function isAllowedCorsOrigin(
   }
   return false;
 }
+
+/** True when every listen-origin (127.0.0.1 / localhost / [::1]) is allowed. */
+export function corsAllowsSelf(
+  allowed: readonly string[],
+  port: string | number,
+  reqHost?: string,
+): boolean {
+  return sidecarSelfOrigins(port).every((origin) =>
+    isAllowedCorsOrigin(origin, allowed, reqHost),
+  );
+}
diff --git a/modules/openxyos/frontend/src/main.tsx b/modules/openxyos/frontend/src/main.tsx
index 85c22000..c20cdf79 100644
--- a/modules/openxyos/frontend/src/main.tsx
+++ b/modules/openxyos/frontend/src/main.tsx
@@ -8,6 +8,11 @@ import "./index.css";
 
 if (typeof window !== "undefined" && window.self !== window.top) {
   document.documentElement.classList.add("ox-embedded");
+  try {
+    window.parent.postMessage({ type: "openxyos:ready" }, "*");
+  } catch {
+    /* embed host may ignore */
+  }
 }
 
 const queryClient = new QueryClient({
diff --git a/modules/openxyos/scripts/test-cors-origins.ts b/modules/openxyos/scripts/test-cors-origins.ts
index c3dc31c3..0efb05b8 100644
--- a/modules/openxyos/scripts/test-cors-origins.ts
+++ b/modules/openxyos/scripts/test-cors-origins.ts
@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import {
+  corsAllowsSelf,
   isAllowedCorsOrigin,
   mergeCorsOrigins,
   parseOriginList,
@@ -11,14 +12,32 @@ assert.deepEqual(sidecarSelfOrigins(3780), [
   "http://localhost:3780",
   "http://[::1]:3780",
 ]);
+assert.deepEqual(sidecarSelfOrigins(" 18900 "), [
+  "http://127.0.0.1:18900",
+  "http://localhost:18900",
+  "http://[::1]:18900",
+]);
 
-const merged = mergeCorsOrigins(
-  ["http://127.0.0.1:8088", "http://localhost:8088"],
-  3780,
-);
+const staleDashboardOnly = ["http://127.0.0.1:8088", "http://localhost:8088"];
+const merged = mergeCorsOrigins(staleDashboardOnly, 3780);
 assert.ok(merged.includes("http://127.0.0.1:8088"));
 assert.ok(merged.includes("http://127.0.0.1:3780"));
 assert.ok(merged.includes("http://localhost:3780"));
+assert.ok(merged.includes("http://[::1]:3780"));
+assert.equal(corsAllowsSelf(merged, 3780), true);
+assert.equal(corsAllowsSelf(staleDashboardOnly, 3780), false);
+assert.equal(
+  isAllowedCorsOrigin(
+    "http://127.0.0.1:3780",
+    staleDashboardOnly,
+    "127.0.0.1:3780",
+  ),
+  true,
+);
+assert.equal(
+  corsAllowsSelf(staleDashboardOnly, 3780, "127.0.0.1:3780"),
+  false,
+);
 
 assert.deepEqual(parseOriginList("http://a.com, http://b.com"), [
   "http://a.com",
@@ -27,8 +46,10 @@ assert.deepEqual(parseOriginList("http://a.com, http://b.com"), [
 
 assert.equal(isAllowedCorsOrigin(undefined, merged), true);
 assert.equal(isAllowedCorsOrigin("http://127.0.0.1:3780", merged), true);
+assert.equal(isAllowedCorsOrigin("http://localhost:3780", merged), true);
+assert.equal(isAllowedCorsOrigin("http://[::1]:3780", merged), true);
 assert.equal(
-  isAllowedCorsOrigin("http://127.0.0.1:3780", ["http://127.0.0.1:8088"], "127.0.0.1:3780"),
+  isAllowedCorsOrigin("http://127.0.0.1:3780", staleDashboardOnly, "127.0.0.1:3780"),
   true,
 );
 assert.equal(isAllowedCorsOrigin("https://evil.example", merged, "127.0.0.1:3780"), false);
diff --git a/src/octop/modules/org_os/overview.py b/src/octop/modules/org_os/overview.py
index 30873a96..c98ba600 100644
--- a/src/octop/modules/org_os/overview.py
+++ b/src/octop/modules/org_os/overview.py
@@ -45,6 +45,7 @@ def _read_loop_proof(home: Path) -> dict[str, Any] | None:
 class DualLoopOverview:
     enabled: bool
     sidecar_reachable: bool
+    sidecar_embed_ok: bool
     sidecar_url: str
     start_available: bool
     install_ready: bool
@@ -60,6 +61,7 @@ def to_dict(self) -> dict[str, Any]:
         return {
             "enabled": self.enabled,
             "sidecar_reachable": self.sidecar_reachable,
+            "sidecar_embed_ok": self.sidecar_embed_ok,
             "sidecar_url": self.sidecar_url,
             "start_available": self.start_available,
             "install_ready": self.install_ready,
@@ -123,6 +125,12 @@ def build_overview(
         "FreeOS does the work. openXYOS owns organization and governance.",
         "Data plane: colleagues / experts / skills / MCP / tasks. Control plane: department employees / blueprints / modules / governance.",
     ]
+    embed_ok = False
+    if status.sidecar.reachable:
+        try:
+            embed_ok = service.probe_sidecar_embed()
+        except Exception:
+            embed_ok = True
     if not status.sidecar.reachable:
         if install_ready:
             notes.append(
@@ -130,9 +138,12 @@ def build_overview(
             )
         else:
             notes.append("openXYOS sidecar is offline — start it to sync blueprints and approvals.")
+    elif not embed_ok:
+        notes.append("openXYOS livez is up but the embed origin is blocked (blank preview).")
     return DualLoopOverview(
         enabled=status.enabled,
         sidecar_reachable=status.sidecar.reachable,
+        sidecar_embed_ok=embed_ok,
         sidecar_url=status.sidecar.url,
         start_available=start_available,
         install_ready=install_ready,
diff --git a/src/octop/modules/org_os/service.py b/src/octop/modules/org_os/service.py
index 89f761db..ef4dd719 100644
--- a/src/octop/modules/org_os/service.py
+++ b/src/octop/modules/org_os/service.py
@@ -211,6 +211,25 @@ def probe_sidecar(self, timeout: float = 2.0) -> SidecarHealth:
             payload=payload,
         )
 
+    def probe_sidecar_embed(self, timeout: float = 2.0) -> bool:
+        """True when a document request with the sidecar's own Origin is not 5xx.
+
+        WebView module loads send ``Origin: http://127.0.0.1:<port>``. A stale
+        CORS whitelist answers those with HTTP 500 while livez (no Origin)
+        still looks healthy — the Organization iframe stays white.
+        """
+        url = self.sidecar_url()
+        origin = url.rstrip("/")
+        try:
+            with httpx.Client(timeout=timeout, follow_redirects=True) as client:
+                response = client.get(
+                    f"{origin}/",
+                    headers={"Origin": origin, "Accept": "text/html"},
+                )
+        except httpx.HTTPError:
+            return False
+        return response.status_code < 500
+
     def status(self) -> OrgModuleStatus:
         sidecar = self.probe_sidecar()
         enabled = self.is_enabled()
diff --git a/src/octop/modules/org_os/sidecar_launch.py b/src/octop/modules/org_os/sidecar_launch.py
index 4cf08586..2d3f1368 100644
--- a/src/octop/modules/org_os/sidecar_launch.py
+++ b/src/octop/modules/org_os/sidecar_launch.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import logging
 import os
 import subprocess
@@ -142,20 +143,89 @@ def sidecar_bundle_dir() -> Path | None:
     return bundled if bundled.is_dir() else None
 
 
+def _app_looks_complete(app: Path) -> bool:
+    return (app / "backend" / "server.ts").is_file() and (app / "dist" / "index.html").is_file()
+
+
 def _bundle_looks_complete(path: Path) -> bool:
     if not path.is_dir():
         return False
     node = path / "node" / "node.exe"
     posix = path / "node" / "bin" / "node"
-    app = path / "openxyos"
-    return (
-        (node.is_file() or posix.is_file())
-        and (app / "backend" / "server.ts").is_file()
-        and (app / "dist" / "index.html").is_file()
+    if not (node.is_file() or posix.is_file()):
+        return False
+    return _app_looks_complete(path / "openxyos") or _app_looks_complete(path)
+
+
+def _copy_tree(src: Path, dest: Path) -> None:
+    dest.mkdir(parents=True, exist_ok=True)
+    for child in src.iterdir():
+        target = dest / child.name
+        if child.is_dir():
+            _copy_tree(child, target)
+        else:
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(child.read_bytes())
+
+
+def heal_openxyos_layout(root: Path) -> bool:
+    """Promote a nested ``openxyos\\`` tree so start helpers find FE+BE."""
+    if not root.is_dir():
+        return False
+    nested = root / "openxyos"
+    need_flat = (
+        (nested / "dist" / "index.html").is_file() and not (root / "dist" / "index.html").is_file()
+    ) or (
+        (nested / "backend-dist" / "server.js").is_file()
+        and not (root / "backend-dist" / "server.js").is_file()
     )
+    if need_flat:
+        _copy_tree(nested, root)
+    if _bundle_looks_complete(root):
+        return True
+    candidates: list[Path] = [
+        nested,
+        root / "org-sidecar",
+        nested / "openxyos",
+        nested / "org-sidecar",
+    ]
+    try:
+        children = [child for child in root.iterdir() if child.is_dir()]
+    except OSError:
+        children = []
+    for child in children:
+        candidates.extend((child, child / "openxyos", child / "org-sidecar"))
+    seen: set[Path] = set()
+    for candidate in candidates:
+        try:
+            clean = candidate.resolve()
+        except OSError:
+            continue
+        if clean in seen or clean == root.resolve():
+            continue
+        seen.add(clean)
+        if not _bundle_looks_complete(clean):
+            continue
+        _copy_tree(clean, root)
+        need_flat = (nested / "dist" / "index.html").is_file() and not (
+            root / "dist" / "index.html"
+        ).is_file()
+        if need_flat:
+            _copy_tree(nested, root)
+        return _bundle_looks_complete(root)
+    return _bundle_looks_complete(root)
+
+
+def _sidecar_app_dir(bundled: Path) -> Path:
+    nested = bundled / "openxyos"
+    if _app_looks_complete(nested):
+        return nested
+    return bundled
 
 
 def find_sidecar_runtime() -> SidecarRuntime | None:
+    for candidate in sidecar_candidate_roots():
+        heal_openxyos_layout(candidate)
     bundled = sidecar_bundle_dir()
     if bundled is None:
         return None
@@ -166,7 +236,7 @@ def find_sidecar_runtime() -> SidecarRuntime | None:
     node = next((path for path in node_candidates if path.is_file()), None)
     if node is None:
         return None
-    app = bundled / "openxyos"
+    app = _sidecar_app_dir(bundled)
     runtime = SidecarRuntime(node=node, app=app, root=bundled)
     if not runtime.server.is_file():
         return None
@@ -177,7 +247,7 @@ def find_sidecar_launcher() -> Path | None:
     bundled = sidecar_bundle_dir()
     if bundled is not None:
         names = (
-            ("start-sidecar.bat", "start-sidecar.sh")
+            ("start-sidecar.ps1", "start-sidecar.cmd", "start-sidecar.bat", "start-sidecar.sh")
             if sys.platform == "win32"
             else ("start-sidecar.sh", "start-sidecar.bat")
         )
@@ -188,6 +258,8 @@ def find_sidecar_launcher() -> Path | None:
                     continue
                 if name.endswith(".sh") and sys.platform == "win32":
                     continue
+                if name.endswith(".ps1") and sys.platform != "win32":
+                    continue
                 return path
     here = Path(__file__).resolve()
     for parent in here.parents:
@@ -316,7 +388,22 @@ def sidecar_log_path(home: Path | None = None) -> Path:
 
 
 def launch_sidecar_argv(runtime: SidecarRuntime | None, launcher: Path | None) -> list[str]:
-    """Argv used to spawn the sidecar. Prefer bundled Node over .bat/.sh."""
+    """Argv used to spawn the sidecar.
+
+    Windows prefers the shipped ``start-sidecar.ps1`` so CORS/env always match
+    the current helper (and so a stale Node is replaced first).
+    """
+    if launcher is not None and sys.platform == "win32" and launcher.suffix.lower() == ".ps1":
+        return [
+            "powershell",
+            "-NoProfile",
+            "-WindowStyle",
+            "Hidden",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-File",
+            str(launcher),
+        ]
     if runtime is not None:
         return sidecar_node_argv(runtime)
     if launcher is None:
@@ -328,6 +415,40 @@ def launch_sidecar_argv(runtime: SidecarRuntime | None, launcher: Path | None) -
     return [str(launcher)]
 
 
+def stop_stale_openxyos(root: Path) -> None:
+    """Stop a previous FreeOS-openxyos Node that still owns the live dir."""
+    pid_file = root / "start.pid"
+    if pid_file.is_file():
+        raw = pid_file.read_text(encoding="utf-8", errors="replace").strip()
+        if raw.isdigit():
+            pid = int(raw)
+            if pid > 0:
+                with contextlib.suppress(OSError):
+                    os.kill(pid, 15)
+                if sys.platform == "win32":
+                    subprocess.run(
+                        ["taskkill", "/F", "/T", "/PID", str(pid)],
+                        check=False,
+                        capture_output=True,
+                    )
+        with contextlib.suppress(OSError):
+            pid_file.unlink()
+    node = root / "node" / "node.exe"
+    if sys.platform == "win32" and node.is_file():
+        script = (
+            "$want = [IO.Path]::GetFullPath('" + str(node).replace("'", "''") + "'); "
+            "Get-CimInstance Win32_Process -Filter \"Name = 'node.exe'\" -ErrorAction SilentlyContinue | "
+            "ForEach-Object { if ($_.ExecutablePath) { "
+            "try { if ([IO.Path]::GetFullPath($_.ExecutablePath) -eq $want) { "
+            "Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue } } catch {} } }"
+        )
+        subprocess.run(
+            ["powershell", "-NoProfile", "-Command", script],
+            check=False,
+            capture_output=True,
+        )
+
+
 def _popen_kwargs(cwd: Path, env: dict[str, str], log_file: Any) -> dict[str, Any]:
     kwargs: dict[str, Any] = {
         "cwd": str(cwd),
@@ -349,10 +470,18 @@ def _spawn(service: OrgModuleService) -> tuple[list[str], str]:
     argv = launch_sidecar_argv(runtime, launcher)
     if not argv:
         return [], "no bundled sidecar runtime or launcher"
-    if runtime is not None:
+    if launcher is not None and launcher.suffix.lower() == ".ps1":
+        cwd = launcher.parent
+        heal_openxyos_layout(cwd)
+        stop_stale_openxyos(cwd)
+    elif runtime is not None:
         cwd = runtime.app
+        heal_openxyos_layout(runtime.root)
+        stop_stale_openxyos(runtime.root)
     elif launcher is not None:
         cwd = launcher.parent
+        heal_openxyos_layout(cwd)
+        stop_stale_openxyos(cwd)
     else:
         return [], "no bundled sidecar runtime or launcher"
     home = service.home
@@ -378,13 +507,23 @@ def _wait_reachable(service: OrgModuleService, wait: float) -> Any:
     return last
 
 
+def _embed_ok(service: OrgModuleService) -> bool:
+    probe = getattr(service, "probe_sidecar_embed", None)
+    if not callable(probe):
+        return True
+    try:
+        return bool(probe())
+    except Exception:
+        return True
+
+
 def start_sidecar(service: OrgModuleService, *, wait: float = 20.0) -> SidecarStartResult:
     health = service.probe_sidecar()
     command = sidecar_start_command()
     runtime = find_sidecar_runtime()
     launcher = find_sidecar_launcher()
     launcher_label = str(runtime.node if runtime is not None else launcher or "")
-    if health.reachable:
+    if health.reachable and _embed_ok(service):
         return SidecarStartResult(
             started=False,
             already=True,
@@ -451,7 +590,7 @@ def ensure_sidecar(service: OrgModuleService, *, wait: float | None = None) -> S
         wait = 20.0 if sidecar_install_ready() else 8.0
     health = service.probe_sidecar()
     command = sidecar_start_command()
-    if health.reachable:
+    if health.reachable and _embed_ok(service):
         return SidecarStartResult(
             started=False,
             already=True,
diff --git a/tests/unit/desktop/test_openxyos_provisioner.py b/tests/unit/desktop/test_openxyos_provisioner.py
index 00d3b7ff..b55655e5 100644
--- a/tests/unit/desktop/test_openxyos_provisioner.py
+++ b/tests/unit/desktop/test_openxyos_provisioner.py
@@ -79,6 +79,17 @@ def test_start_sidecar_does_not_assign_automatic_home() -> None:
     assert not re.search(r"(?i)\$pid\s*=", text)
 
 
+def test_start_sidecar_stops_stale_node_and_heals_layout() -> None:
+    text = START_PS1.read_text(encoding="utf-8")
+    assert "Repair-OpenXYOSLayout" in text
+    assert "Stop-OpenXYOSNode" in text
+    assert "start.pid" in text
+    assert "openxyos\\dist\\index.html" in text
+    assert "backend-dist\\server.js" in text
+    assert "if (Test-Livez) { exit 0 }" not in text
+    assert "day-old" in text or "stale" in text.lower()
+
+
 def test_start_sidecar_cors_origin_is_parseorigins_safe() -> None:
     """openXYOS parseOrigins requires explicit http(s) origins, no '*'."""
     text = START_PS1.read_text(encoding="utf-8")
diff --git a/tests/unit/test_org_module.py b/tests/unit/test_org_module.py
index 4f9b5a0b..b14e070e 100644
--- a/tests/unit/test_org_module.py
+++ b/tests/unit/test_org_module.py
@@ -139,6 +139,58 @@ def get(self, url: str) -> _Resp:
     assert health.payload["status"] == "live"
 
 
+def test_probe_sidecar_embed_rejects_self_origin_500(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    class _Resp:
+        def __init__(self, status_code: int) -> None:
+            self.status_code = status_code
+
+    class _Client:
+        def __init__(self, *args: object, **kwargs: object) -> None:
+            pass
+
+        def __enter__(self) -> _Client:
+            return self
+
+        def __exit__(self, *args: object) -> None:
+            return None
+
+        def get(self, url: str, headers: dict[str, str] | None = None) -> _Resp:
+            assert url == "http://127.0.0.1:3780/"
+            assert headers is not None
+            assert headers["Origin"] == "http://127.0.0.1:3780"
+            return _Resp(500)
+
+    monkeypatch.setattr(httpx, "Client", _Client)
+    service = OrgModuleService(config_path=tmp_path / "config.json", home=tmp_path)
+    assert service.probe_sidecar_embed() is False
+
+
+def test_probe_sidecar_embed_allows_self_origin(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    class _Resp:
+        status_code = 200
+
+    class _Client:
+        def __init__(self, *args: object, **kwargs: object) -> None:
+            pass
+
+        def __enter__(self) -> _Client:
+            return self
+
+        def __exit__(self, *args: object) -> None:
+            return None
+
+        def get(self, url: str, headers: dict[str, str] | None = None) -> _Resp:
+            return _Resp()
+
+    monkeypatch.setattr(httpx, "Client", _Client)
+    service = OrgModuleService(config_path=tmp_path / "config.json", home=tmp_path)
+    assert service.probe_sidecar_embed() is True
+
+
 def test_sidecar_target_rejects_traversal() -> None:
     with pytest.raises(ValueError, match="traversal"):
         sidecar_target("http://127.0.0.1:3780", "../secret")
@@ -185,6 +237,7 @@ def test_overview_reports_real_empty_counts(tmp_path: Path) -> None:
     assert payload["freeos"]["mcp"] == 1
     assert payload["freeos"]["tasks"] == 3
     assert payload["sidecar_reachable"] is False
+    assert payload["sidecar_embed_ok"] is False
     assert payload["install_ready"] is False
     assert payload["last_loop"] is None
     assert any("FreeOS does the work" in note for note in payload["notes"])
diff --git a/tests/unit/test_sidecar_launch.py b/tests/unit/test_sidecar_launch.py
index 9be5112f..a2f2df62 100644
--- a/tests/unit/test_sidecar_launch.py
+++ b/tests/unit/test_sidecar_launch.py
@@ -86,6 +86,7 @@ def test_start_sidecar_already_reachable(tmp_path: Path, monkeypatch: pytest.Mon
         "probe_sidecar",
         lambda timeout=2.0: SidecarHealth(reachable=True, url="http://127.0.0.1:3780"),
     )
+    monkeypatch.setattr(service, "probe_sidecar_embed", lambda timeout=2.0: True)
     monkeypatch.setattr(sidecar_launch, "find_sidecar_runtime", lambda: None)
     monkeypatch.setattr(sidecar_launch, "find_sidecar_launcher", lambda: None)
     result = sidecar_launch.start_sidecar(service, wait=0.1)
@@ -94,6 +95,26 @@ def test_start_sidecar_already_reachable(tmp_path: Path, monkeypatch: pytest.Mon
     assert result.started is False
 
 
+def test_start_sidecar_restarts_when_embed_blocked(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from octop.modules.org_os import sidecar_launch
+    from octop.modules.org_os.service import SidecarHealth
+
+    service = OrgModuleService(config_path=tmp_path / "config.json", home=tmp_path)
+    monkeypatch.setattr(
+        service,
+        "probe_sidecar",
+        lambda timeout=2.0: SidecarHealth(reachable=True, url="http://127.0.0.1:3780"),
+    )
+    monkeypatch.setattr(service, "probe_sidecar_embed", lambda timeout=2.0: False)
+    monkeypatch.setattr(sidecar_launch, "find_sidecar_runtime", lambda: None)
+    monkeypatch.setattr(sidecar_launch, "find_sidecar_launcher", lambda: None)
+    result = sidecar_launch.start_sidecar(service, wait=0.1)
+    assert result.already is False
+    assert result.detail == "no bundled sidecar runtime"
+
+
 def test_ensure_sidecar_skips_source_tree_script(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
@@ -194,3 +215,39 @@ def test_sidecar_launch_env_merges_existing_cors(
     env = sidecar_launch_env(tmp_path, dashboard_port=8099)
     assert "http://127.0.0.1:9000" in env["CORS_ORIGIN"]
     assert "http://127.0.0.1:3780" in env["CORS_ORIGIN"]
+
+
+def test_launch_argv_windows_prefers_ps1(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr("octop.modules.org_os.sidecar_launch.sys.platform", "win32")
+    runtime = _write_runtime(tmp_path)
+    launcher = tmp_path / "org-sidecar" / "start-sidecar.ps1"
+    launcher.write_text("# start", encoding="utf-8")
+    argv = launch_sidecar_argv(runtime, launcher)
+    assert argv[0] == "powershell"
+    assert str(launcher) in argv
+
+
+def test_heal_openxyos_layout_promotes_nested(tmp_path: Path) -> None:
+    from octop.modules.org_os.sidecar_launch import heal_openxyos_layout
+
+    inner = tmp_path / "openxyos"
+    _write_runtime(inner)
+    assert heal_openxyos_layout(tmp_path) is True
+    assert (tmp_path / "node" / "node.exe").is_file() or (
+        tmp_path / "node" / "bin" / "node"
+    ).is_file()
+    assert (tmp_path / "openxyos" / "dist" / "index.html").is_file() or (
+        tmp_path / "dist" / "index.html"
+    ).is_file()
+
+
+def test_heal_openxyos_layout_copies_nested_frontend(tmp_path: Path) -> None:
+    from octop.modules.org_os.sidecar_launch import heal_openxyos_layout
+
+    bundled = tmp_path / "live"
+    _write_runtime(bundled)
+    live = bundled / "org-sidecar"
+    assert (live / "openxyos" / "dist" / "index.html").is_file()
+    assert not (live / "dist" / "index.html").is_file()
+    assert heal_openxyos_layout(live) is True
+    assert (live / "dist" / "index.html").is_file()