From 6186a0645d3f3e92e06b666a6b5774b8af2b488f Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Sat, 19 Sep 2026 23:29:14 +0200
Subject: [PATCH] feat: edit variables, resources and triggers in their own
 session tab (#11206)

* feat: edit variables, resources and triggers in their own session tab

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: take a trigger's flow kind from its config and name the written trigger

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* refactor: one operating-workspace context for editors acting on a session's workspace

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: reload page item tabs only in sessions acting on the tool's workspace

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: resolve open in workspace for every preview tab kind in one place

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: guard every component under a session editor against the navigation workspace

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: show a page item tab whose item is gone instead of mounting its editor

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: follow a saved page item in the tab's own workspace and restore in-frame rows

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* feat: close a page item tab from its editor header

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: judge trigger permissions by the user acting in the session workspace

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: judge every session-editor permission by the user acting in that workspace

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: keep session permissions reactive to the acting role and restore tabs as last seen

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix: default Path's owner controls to the user acting in its workspace

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 .../lib/components/AIProviderPicker.svelte    |   6 +-
 frontend/src/lib/components/AgentTrace.svelte |   8 +-
 .../src/lib/components/ApiConnectForm.svelte  |   6 +-
 .../src/lib/components/AppConnectInner.svelte |   7 +-
 frontend/src/lib/components/ArgInfo.svelte    |   8 +-
 frontend/src/lib/components/ArgInput.svelte   |   6 +-
 .../components/BedrockCredentialsCheck.svelte |  12 +-
 .../src/lib/components/ChannelSelector.svelte |  10 +-
 frontend/src/lib/components/CliHelpBox.svelte |   6 +-
 frontend/src/lib/components/DBManager.svelte  |   8 +-
 .../lib/components/DBManagerContent.svelte    |  12 +-
 frontend/src/lib/components/DBTable.svelte    |  14 +-
 .../src/lib/components/DatatablePicker.svelte |   6 +-
 .../src/lib/components/DefaultScripts.svelte  |   7 +-
 .../lib/components/DefaultScriptsInner.svelte |   7 +-
 .../src/lib/components/DucklakePicker.svelte  |  12 +-
 .../lib/components/EditableSchemaForm.svelte  |   6 +-
 frontend/src/lib/components/Editor.svelte     |  22 +-
 frontend/src/lib/components/EditorBar.svelte  |  11 +-
 .../src/lib/components/EditorHeader.svelte    |  17 +-
 .../components/ErrorOrRecoveryHandler.svelte  |  21 +-
 .../lib/components/ExploreAssetButton.svelte  |  19 +-
 .../src/lib/components/FlowBuilder.svelte     |  26 +-
 .../src/lib/components/FlowGraphViewer.svelte |   6 +-
 .../lib/components/FlowGraphViewerStep.svelte |   7 +-
 .../components/FlowHistoryJobPicker.svelte    |   8 +-
 .../src/lib/components/FlowLogViewer.svelte   |   6 +-
 .../FlowLoopIterationPreview.svelte           |   6 +-
 .../lib/components/FlowPreviewContent.svelte  |   6 +-
 .../lib/components/FlowRestartButton.svelte   |   8 +-
 .../lib/components/FlowStatusViewer.svelte    |   7 +-
 .../components/FlowStatusViewerInner.svelte   |  20 +-
 frontend/src/lib/components/FlowViewer.svelte |   6 +-
 .../src/lib/components/FolderEditor.svelte    |  34 ++-
 .../src/lib/components/FolderPicker.svelte    |  10 +-
 .../components/GitHubAppIntegration.svelte    |  54 ++--
 .../lib/components/GitLabIntegration.svelte   |  14 +-
 .../components/GitRepoPopoverPicker.svelte    |  10 +-
 .../components/GitRepoResourcePicker.svelte   |   6 +-
 .../src/lib/components/GitRepoViewer.svelte   |   6 +-
 .../src/lib/components/GroupEditor.svelte     |  43 +++-
 .../src/lib/components/HistoricInputs.svelte  |   6 +-
 .../src/lib/components/HistoricList.svelte    |  14 +-
 .../components/InputTransformPickers.svelte   |   6 +-
 .../InputTransformSchemaForm.svelte           |   6 +-
 frontend/src/lib/components/JobLoader.svelte  |   6 +-
 .../src/lib/components/JobOtelTraces.svelte   |  43 ++--
 .../src/lib/components/LabelsInput.svelte     |   6 +-
 .../LightweightResourcePicker.svelte          |   8 +-
 frontend/src/lib/components/LogViewer.svelte  |  10 +-
 .../lib/components/ModulePreviewForm.svelte   |   6 +-
 frontend/src/lib/components/ModuleTest.svelte |   6 +-
 .../components/ParqetCsvTableRenderer.svelte  |   9 +-
 .../lib/components/PasswordArgInput.svelte    |   7 +-
 frontend/src/lib/components/Path.svelte       |  56 +++--
 .../components/PathNameAutocomplete.svelte    |  11 +-
 .../lib/components/PermissionHistory.svelte   |  14 +-
 .../src/lib/components/QueuePosition.svelte   |   6 +-
 .../src/lib/components/ResourceEditor.svelte  |  12 +-
 .../components/ResourceEditorDrawer.svelte    |  71 ++++--
 .../src/lib/components/ResourceForm.svelte    |   7 +-
 .../src/lib/components/ResourcePicker.svelte  |   6 +-
 .../lib/components/ResourceTypePicker.svelte  |   8 +-
 .../components/ResourceVersionHistory.svelte  |   6 +-
 .../src/lib/components/S3FilePicker.svelte    |   6 +-
 .../lib/components/S3FilePickerInner.svelte   |   6 +-
 .../src/lib/components/S3FilePreview.svelte   |   6 +-
 .../lib/components/SaveInputsButton.svelte    |   6 +-
 .../lib/components/SavedInputsPicker.svelte   |  16 +-
 frontend/src/lib/components/SchemaForm.svelte |   6 +-
 .../src/lib/components/ScriptBuilder.svelte   |  17 +-
 .../src/lib/components/ScriptEditor.svelte    |  13 +-
 .../src/lib/components/ScriptPicker.svelte    |  18 +-
 .../components/ScriptVersionHistory.svelte    |   8 +-
 frontend/src/lib/components/SqlRepl.svelte    |   6 +-
 .../lib/components/SummaryPathDisplay.svelte  |  24 +-
 .../src/lib/components/TestConnection.svelte  |   6 +-
 .../src/lib/components/VariableEditor.svelte  |  43 +++-
 .../src/lib/components/VariableForm.svelte    |   7 +-
 .../src/lib/components/WorkerTagPicker.svelte |  12 +-
 .../src/lib/components/WorkerTagSelect.svelte |  14 +-
 .../lib/components/WorkflowTimeline.svelte    |  18 +-
 .../WorkspaceItemDrillPicker.svelte           |  11 +-
 .../lib/components/aiEvals/EvalsPane.svelte   |   6 +-
 .../apps/editor/AppEditorHeaderDeploy.svelte  |  36 +--
 .../apps/editor/AppJobsDrawer.svelte          |  12 +-
 .../apps/editor/DeploymentHistory.svelte      |  14 +-
 .../InlineScriptRunnableByPath.svelte         |  12 +-
 .../mainInput/RunnableSelector.svelte         |  13 +-
 .../mainInput/WorkspaceFlowList.svelte        |   6 +-
 .../mainInput/WorkspaceScriptList.svelte      |   6 +-
 .../AssetGraph/AssetGraphDetailsPane.svelte   |   7 +-
 .../assets/AssetGraph/AssetNode.svelte        |  15 +-
 .../assets/AssetGraph/AssetRunsPanel.svelte   |  18 +-
 .../assets/AssetGraph/DataTablePreview.svelte |  14 +-
 .../AssetGraph/DucklakeResultPreview.svelte   |  12 +-
 .../AssetGraph/DucklakeVersionPreview.svelte  |  13 +-
 .../AssetGraph/PipelineScriptView.svelte      |   6 +-
 .../AssetGraph/PipelineTriggerEditors.svelte  |  13 +-
 .../assets/AssetGraph/RunnableNode.svelte     |   6 +-
 .../assets/AssetsDropdownButton.svelte        |  10 +-
 .../components/assets/JobAssetsViewer.svelte  |  16 +-
 .../DraftChangesConfirmationModal.svelte      |   9 +-
 .../common/drawer/DrawerContent.svelte        |  34 ++-
 .../common/fileDownload/FileDownload.svelte   |   6 +-
 .../common/fileUpload/FileUpload.svelte       |  16 +-
 .../components/copilot/StepGenQuick.svelte    |   6 +-
 .../copilot/chat/AIChatMessage.svelte         |   8 +-
 .../copilot/chat/AIChatModelSettings.svelte   |  18 +-
 .../chat/AssistantInstructionsSection.svelte  |  10 +-
 .../chat/AssistantSettingsModal.svelte        |   6 +-
 .../copilot/chat/ChatContextPicker.svelte     |   6 +-
 .../chat/DatatableCreationPolicy.svelte       |   6 +-
 .../copilot/chat/LinkRenderer.svelte          |   8 +-
 .../copilot/chat/ToolMessageActions.svelte    |   5 +-
 .../chat/createdResourceActions.svelte.ts     |  15 +-
 .../components/copilot/chat/global/core.ts    |  12 +-
 .../src/lib/components/copilot/chat/shared.ts |  10 +-
 .../src/lib/components/dbt/DbtEditor.svelte   |   6 +-
 .../details/ErrorHandlerToggleButtonV2.svelte |  10 +-
 .../components/flows/FlowAssetsHandler.svelte |   6 +-
 .../lib/components/flows/FlowEditor.svelte    |  15 +-
 .../components/flows/FlowHistoryInner.svelte  |   6 +-
 .../flows/common/FlowCardHeader.svelte        |   7 +-
 .../flows/content/AgentEditorModal.svelte     |   6 +-
 .../flows/content/AgentResourceBar.svelte     |   8 +-
 .../flows/content/AiAgentStepInputs.svelte    |   6 +-
 .../flows/content/ExpandedSubflowStep.svelte  |   6 +-
 .../flows/content/FlowEditorDrawer.svelte     |   6 +-
 .../content/FlowEnvironmentVariables.svelte   |   6 +-
 .../components/flows/content/FlowInput.svelte |   6 +-
 .../flows/content/FlowInputsFlow.svelte       |   6 +-
 .../flows/content/FlowInputsQuick.svelte      |  24 +-
 .../flows/content/FlowModuleComponent.svelte  |   6 +-
 .../flows/content/FlowModuleScript.svelte     |   6 +-
 .../flows/content/FlowModuleSuspend.svelte    |   9 +-
 .../content/FlowModuleWorkerTagSelect.svelte  |   4 +-
 .../flows/content/FlowPathViewer.svelte       |   8 +-
 .../flows/content/FlowSettings.svelte         |  16 +-
 .../flows/content/McpToolEditor.svelte        |   5 +-
 .../flows/content/ScriptEditorDrawer.svelte   |   6 +-
 .../WorkspaceScriptSettingsDrawer.svelte      |   6 +-
 .../flows/conversations/FlowChat.svelte       |   7 +-
 .../flows/map/FlowModuleSchemaMap.svelte      |   6 +-
 .../flows/map/InsertModuleInner.svelte        |   6 +-
 .../flows/pickers/PickHubScript.svelte        |   7 +-
 .../flows/pickers/PickHubScriptQuick.svelte   |   7 +-
 .../pickers/WorkspaceScriptPicker.svelte      |  10 +-
 .../pickers/WorkspaceScriptPickerQuick.svelte |  11 +-
 .../flows/propPicker/StepHistory.svelte       |   6 +-
 .../lib/components/graph/FlowGraphV2.svelte   |   6 +-
 .../graph/renderers/nodes/AssetNode.svelte    |   7 +-
 .../jobs/MissingWorkerTagAlert.svelte         |   6 +-
 .../components/metrics/MetricsDrawer.svelte   |   6 +-
 .../components/operatingWorkspace.svelte.ts   |  48 ++++
 .../lib/components/operatingWorkspace.test.ts | 119 +++++++++
 .../propertyPicker/ObjectViewer.svelte        |  14 +-
 .../propertyPicker/PropPicker.svelte          |   8 +-
 .../raw_apps/DefaultDatabaseSelector.svelte   |   7 +-
 .../raw_apps/RawAppDataTableDrawer.svelte     |   7 +-
 .../components/raw_apps/RawAppEditor.svelte   |  15 +-
 .../raw_apps/RawAppEditorHeader.svelte        |  26 +-
 .../raw_apps/RawAppInlineScriptEditor.svelte  |   7 +-
 .../RawAppInlineScriptRunnable.svelte         |  15 +-
 .../raw_apps/RawAppInlineScriptsPanel.svelte  |   7 +-
 .../raw_apps/RawAppInputsSpecEditor.svelte    |  15 +-
 .../raw_apps/RawAppSharedUiDrawer.svelte      |   7 +-
 .../raw_apps/RawAppTemplatePicker.svelte      |   8 +-
 .../components/raw_apps/rawAppWorkspace.ts    |  22 --
 .../components/runs/JobDetailHeader.svelte    |  24 +-
 .../runs/NoWorkerWithTagWarning.svelte        |   6 +-
 .../src/lib/components/runs/RunBadges.svelte  |   6 +-
 .../components/schema/JobSchemaPicker.svelte  |   6 +-
 .../schema/RunningJobSchemaPicker.svelte      |  62 +++--
 .../components/scriptEditor/LogPanel.svelte   |  12 +-
 .../sessions/OpenInSessionButton.svelte       |   7 +-
 .../sessions/PageItemEditorView.svelte        | 174 +++++++++++++
 .../components/sessions/PreviewTabHost.svelte |  23 ++
 .../sessions/SessionChangesBar.svelte         |   4 +-
 .../sessions/SessionEditorTarget.svelte       |   2 +
 .../components/sessions/pageDrawerSession.ts  |  35 ++-
 .../lib/components/sessions/pageItemLookup.ts |  62 +++++
 .../lib/components/sessions/previewPaths.ts   |  81 ++++++
 .../components/sessions/previewReload.test.ts |  21 ++
 .../lib/components/sessions/previewReload.ts  |  74 ++++--
 .../components/sessions/previewRouter.test.ts |  21 +-
 .../lib/components/sessions/previewRouter.ts  |  70 +++++-
 .../components/sessions/sessionMode.svelte.ts |  11 +
 .../sessions/sessionPreviewTabs.svelte.ts     | 136 ++++++----
 .../sessions/sessionPreviewTabs.test.ts       | 236 +++++++-----------
 .../sessions/sessionRuntime.svelte.ts         |  20 +-
 .../components/settings/CreateToken.svelte    |  18 +-
 .../settings/EditTokenScopesModal.svelte      |   6 +-
 .../settings/UserAIPromptsSettings.svelte     |   7 +-
 .../triggers/AddTriggersButton.svelte         |  10 +-
 .../components/triggers/CaptureSection.svelte |  10 +-
 .../components/triggers/CaptureTable.svelte   |  11 +-
 .../components/triggers/CaptureWrapper.svelte |  10 +-
 .../triggers/PermissionedAsLine.svelte        |  15 +-
 .../triggers/TestTriggerConnection.svelte     |   7 +-
 .../triggers/TriggerEditorToolbar.svelte      |   6 +-
 .../triggers/TriggerHistoryButton.svelte      |   7 +-
 .../triggers/TriggerSuspendedJobsModal.svelte |   7 +-
 .../components/triggers/TriggerTokens.svelte  |   8 +-
 .../components/triggers/TriggersEditor.svelte |  39 +--
 .../amqp/AmqpEditorConfigSection.svelte       |   7 +-
 .../amqp/AmqpTriggerEditorInner.svelte        |  96 ++++---
 .../AzureTriggerEditorConfigSection.svelte    |  18 +-
 .../azure/AzureTriggerEditorInner.svelte      | 113 ++++++---
 .../triggers/email/DefaultEmailCapture.svelte |   6 +-
 .../email/DefaultEmailConfigSection.svelte    |   9 +-
 .../triggers/email/DefaultEmailPanel.svelte   |  16 +-
 .../triggers/email/EmailCapture.svelte        |   6 +-
 .../EmailTriggerEditorConfigSection.svelte    |  14 +-
 .../email/EmailTriggerEditorInner.svelte      | 102 +++++---
 .../triggers/email/EmailTriggerPanel.svelte   |   8 +-
 .../components/triggers/gcp/GcpCapture.svelte |   6 +-
 .../gcp/GcpTriggerEditorConfigSection.svelte  |  21 +-
 .../triggers/gcp/GcpTriggerEditorInner.svelte | 102 +++++---
 .../triggers/http/OpenAPISpecGenerator.svelte |   9 +-
 .../triggers/http/RouteCapture.svelte         |   6 +-
 .../triggers/http/RouteCorsOption.svelte      |   4 +-
 .../http/RouteEditorConfigSection.svelte      |  24 +-
 .../triggers/http/RouteEditorInner.svelte     | 121 +++++----
 .../triggers/http/RoutesGenerator.svelte      |   9 +-
 .../triggers/http/RoutesPanel.svelte          |   7 +-
 .../kafka/KafkaTriggerEditorInner.svelte      | 102 +++++---
 .../kafka/KafkaTriggersConfigSection.svelte   |   8 +-
 .../mqtt/MqttEditorConfigSection.svelte       |   7 +-
 .../mqtt/MqttTriggerEditorInner.svelte        | 102 +++++---
 .../native/NativeTriggerEditor.svelte         |  41 ++-
 .../triggers/native/NativeTriggerTable.svelte |   9 +-
 .../services/github/GitHubTriggerForm.svelte  |  10 +-
 .../google/GoogleCalendarPicker.svelte        |  16 +-
 .../services/google/GoogleDrivePicker.svelte  |  74 +++---
 .../nextcloud/NextcloudTriggerForm.svelte     |  10 +-
 .../nats/NatsTriggerEditorInner.svelte        | 102 +++++---
 .../nats/NatsTriggersConfigSection.svelte     |   7 +-
 .../postgres/CheckPostgresRequirement.svelte  |  15 +-
 .../PostgresTriggerEditorInner.svelte         |  96 ++++---
 .../postgres/PublicationPicker.svelte         |  27 +-
 .../triggers/postgres/SlotPicker.svelte       |  17 +-
 .../schedules/ScheduleEditorInner.svelte      |  80 +++---
 .../sqs/SqsTriggerEditorConfigSection.svelte  |   7 +-
 .../triggers/sqs/SqsTriggerEditorInner.svelte | 102 +++++---
 .../components/triggers/triggerWorkspace.ts   |  29 ---
 .../triggers/webhook/WebhooksCapture.svelte   |   6 +-
 .../webhook/WebhooksConfigSection.svelte      |   8 +-
 .../websocket/WebsocketCapture.svelte         |  26 +-
 .../WebsocketEditorConfigSection.svelte       |   8 +-
 .../WebsocketTriggerEditorInner.svelte        | 111 +++++---
 .../lib/components/wizards/AppPicker.svelte   |  33 ++-
 .../DataTableMigrationsButton.svelte          |   8 +-
 .../src/routes/(root)/(logged)/+layout.svelte |  14 +-
 .../(root)/(logged)/resources/+page.svelte    |   6 +-
 .../(root)/(logged)/sessions/+page.svelte     |  93 ++++---
 256 files changed, 3455 insertions(+), 1774 deletions(-)
 create mode 100644 frontend/src/lib/components/operatingWorkspace.svelte.ts
 create mode 100644 frontend/src/lib/components/operatingWorkspace.test.ts
 delete mode 100644 frontend/src/lib/components/raw_apps/rawAppWorkspace.ts
 create mode 100644 frontend/src/lib/components/sessions/PageItemEditorView.svelte
 create mode 100644 frontend/src/lib/components/sessions/pageItemLookup.ts
 delete mode 100644 frontend/src/lib/components/triggers/triggerWorkspace.ts

diff --git a/frontend/src/lib/components/AIProviderPicker.svelte b/frontend/src/lib/components/AIProviderPicker.svelte
index 19b1346b84..f69bb6e8f4 100644
--- a/frontend/src/lib/components/AIProviderPicker.svelte
+++ b/frontend/src/lib/components/AIProviderPicker.svelte
@@ -3,11 +3,13 @@
 	import Select from './select/Select.svelte'
 	import { fetchAvailableModels, AI_PROVIDERS } from './copilot/lib'
 	import type { AIProvider, ProviderConfig } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import ResourcePicker from './ResourcePicker.svelte'
 	import Toggle from './Toggle.svelte'
 	import { saveConfig, removeConfig, isSameAsStoredConfig } from './aiProviderStorage'
 	import AIReasoningEffortPicker from './AIReasoningEffortPicker.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value: ProviderConfig | undefined
@@ -26,7 +28,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore ?? '')
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
 
 	let value = $derived.by(() => {
 		if (!_uncheckedValue || typeof _uncheckedValue !== 'object') return undefined
diff --git a/frontend/src/lib/components/AgentTrace.svelte b/frontend/src/lib/components/AgentTrace.svelte
index 8c151e192c..91b87fea67 100644
--- a/frontend/src/lib/components/AgentTrace.svelte
+++ b/frontend/src/lib/components/AgentTrace.svelte
@@ -2,7 +2,6 @@
 	import { ExternalLink, Globe } from 'lucide-svelte'
 	import { JobService, type Job } from '$lib/gen'
 	import { base } from '$lib/base'
-	import { workspaceStore } from '$lib/stores'
 	import { msToReadableTimeShort } from '$lib/utils'
 	import ChatCollapsibleCard from './copilot/chat/ChatCollapsibleCard.svelte'
 	import ToolContentDisplay from './copilot/chat/ToolContentDisplay.svelte'
@@ -10,6 +9,9 @@
 	import GfmMarkdown from './GfmMarkdown.svelte'
 	import type { AgentTraceEntry } from './agentTrace'
 	import { SvelteMap, SvelteSet } from 'svelte/reactivity'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		entries: AgentTraceEntry[]
@@ -40,7 +42,7 @@
 		try {
 			jobs.set(
 				jobId,
-				await JobService.getJob({ id: jobId, workspace: workspaceId ?? $workspaceStore! })
+				await JobService.getJob({ id: jobId, workspace: workspaceId ?? $operatingWorkspace! })
 			)
 		} catch {
 			// A tool job can be gone (retention) or unreadable. The row still has its
@@ -121,7 +123,7 @@
 				{:else if entry.jobId}
 					<a
 						class="text-2xs text-accent inline-flex items-center gap-1 w-fit hover:underline"
-						href="{base}/run/{entry.jobId}?workspace={workspaceId ?? $workspaceStore}"
+						href="{base}/run/{entry.jobId}?workspace={workspaceId ?? $operatingWorkspace}"
 						target="_blank"
 						rel="noreferrer"
 					>
diff --git a/frontend/src/lib/components/ApiConnectForm.svelte b/frontend/src/lib/components/ApiConnectForm.svelte
index dedeee90e2..2255817c5e 100644
--- a/frontend/src/lib/components/ApiConnectForm.svelte
+++ b/frontend/src/lib/components/ApiConnectForm.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { OauthService, type ResourceType } from '$lib/gen'
 	import FilesetEditor from './FilesetEditor.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { emptySchema, emptyString } from '$lib/utils'
 	import SchemaForm from './SchemaForm.svelte'
 	import Toggle from './Toggle.svelte'
@@ -20,6 +19,9 @@
 	import { base } from '$lib/base'
 	import { isDataTableWizardEnabled } from './workspaceSettings/utils.svelte'
 	import { parsePostgresConnectionString } from '$lib/utils/postgresConnectionString'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		resourceType: string
@@ -152,7 +154,7 @@
 		}
 	}
 	$effect(() => {
-		$workspaceStore && untrack(() => loadSchema())
+		$operatingWorkspace && untrack(() => loadSchema())
 	})
 	$effect(() => {
 		notFound && rawCode && untrack(() => parseJson())
diff --git a/frontend/src/lib/components/AppConnectInner.svelte b/frontend/src/lib/components/AppConnectInner.svelte
index cef58fcdb2..c695227964 100644
--- a/frontend/src/lib/components/AppConnectInner.svelte
+++ b/frontend/src/lib/components/AppConnectInner.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { run } from 'svelte/legacy'
 
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import LabelsInput from './LabelsInput.svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import {
@@ -53,6 +53,9 @@
 	import Label from './Label.svelte'
 	import ResourcePathHint from './ResourcePathHint.svelte'
 	import SchemaForm from './SchemaForm.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		step?: number
@@ -84,7 +87,7 @@
 		fillPath = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 
 	let isValid = $state(true)
 
diff --git a/frontend/src/lib/components/ArgInfo.svelte b/frontend/src/lib/components/ArgInfo.svelte
index a1cfdf6276..b071434f9d 100644
--- a/frontend/src/lib/components/ArgInfo.svelte
+++ b/frontend/src/lib/components/ArgInfo.svelte
@@ -1,12 +1,14 @@
 <script lang="ts">
 	import { ResourceService, VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { copyToClipboard, truncate } from '$lib/utils'
 	import { ClipboardCopy, Expand } from 'lucide-svelte'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import Tooltip from './Tooltip.svelte'
 	import { Button, DrawerContent } from './common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value: any
@@ -22,14 +24,14 @@
 
 	async function getResource(path: string) {
 		jsonViewerContent = await ResourceService.getResourceValue({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path
 		})
 	}
 
 	async function getVariable(path: string) {
 		jsonViewerContent = await VariableService.getVariableValue({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path
 		})
 	}
diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index d62f8aed0f..62165bc758 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -41,12 +41,14 @@
 	import { safeSelectItems } from './select/utils.svelte'
 	import S3ArgInput from './common/fileUpload/S3ArgInput.svelte'
 	import { base } from '$lib/base'
-	import { workspaceStore } from '$lib/stores'
 	import { getJsonSchemaFromResource } from './schema/jsonSchemaResource.svelte'
 	import AIProviderPicker from './AIProviderPicker.svelte'
 	import TextInput from './text_input/TextInput.svelte'
 	import FileInput from './common/fileInput/FileInput.svelte'
 	import { randomUUID } from '$lib/utils/uuid'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		label?: string
@@ -823,7 +825,7 @@
 				/>
 			{/await}
 		{:else if inputCat == 'object' && format?.startsWith('jsonschema-')}
-			{#await getJsonSchemaFromResource(format.substring('jsonschema-'.length), workspace ?? $workspaceStore ?? '')}
+			{#await getJsonSchemaFromResource(format.substring('jsonschema-'.length), workspace ?? $operatingWorkspace ?? '')}
 				<Loader2 class="animate-spin" />
 			{:then schema}
 				{#if !schema || !schema.properties}
diff --git a/frontend/src/lib/components/BedrockCredentialsCheck.svelte b/frontend/src/lib/components/BedrockCredentialsCheck.svelte
index 877ca9ff72..fa39309a50 100644
--- a/frontend/src/lib/components/BedrockCredentialsCheck.svelte
+++ b/frontend/src/lib/components/BedrockCredentialsCheck.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { JobService, type FlowValue } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { tryEvery } from '$lib/utils'
 	import { Check, LoaderCircle, Server, X, Cpu } from 'lucide-svelte'
 	import Button from './common/button/Button.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface CredentialsCheckResult {
 		available: boolean
@@ -28,7 +30,7 @@
 		apiResult = null
 
 		try {
-			const response = await fetch(`/api/w/${$workspaceStore}/ai/check_bedrock_credentials`)
+			const response = await fetch(`/api/w/${$operatingWorkspace}/ai/check_bedrock_credentials`)
 			if (!response.ok) {
 				throw new Error(`HTTP error: ${response.status}`)
 			}
@@ -78,7 +80,7 @@
 			}
 
 			const job = await JobService.runFlowPreview({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				requestBody: {
 					value: flowValue as unknown as FlowValue,
 					args: {}
@@ -88,7 +90,7 @@
 			tryEvery({
 				tryCode: async () => {
 					const testResult = await JobService.getCompletedJob({
-						workspace: $workspaceStore!,
+						workspace: $operatingWorkspace!,
 						id: job
 					})
 
@@ -130,7 +132,7 @@
 					workerStatus = 'error'
 					try {
 						await JobService.cancelQueuedJob({
-							workspace: $workspaceStore!,
+							workspace: $operatingWorkspace!,
 							id: job,
 							requestBody: {
 								reason: 'Timeout checking Bedrock credentials'
diff --git a/frontend/src/lib/components/ChannelSelector.svelte b/frontend/src/lib/components/ChannelSelector.svelte
index d7a720d877..1b5faee265 100644
--- a/frontend/src/lib/components/ChannelSelector.svelte
+++ b/frontend/src/lib/components/ChannelSelector.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import Select from './select/Select.svelte'
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { RefreshCcw } from 'lucide-svelte'
 	import { Button } from './common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface ChannelItem {
 		channel_id?: string
@@ -21,8 +23,8 @@
 		showRefreshButton?: boolean
 		onError?: (error: Error) => void
 		onSelectedChannelChange?: (channel: ChannelItem | undefined) => void
-		/** Workspace to list Teams channels from; defaults to the nav
-		 * `$workspaceStore`. A forked session passes its acting workspace. */
+		/** Workspace to list Teams channels from; defaults to the operating workspace (see
+		 * `useOperatingWorkspace`). */
 		workspace?: string
 	}
 
@@ -40,7 +42,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace)
 
 	let isFetching = $state(false)
 	let loadedChannels = $state<ChannelItem[]>([])
diff --git a/frontend/src/lib/components/CliHelpBox.svelte b/frontend/src/lib/components/CliHelpBox.svelte
index 951a7e3d5a..0bee33825c 100644
--- a/frontend/src/lib/components/CliHelpBox.svelte
+++ b/frontend/src/lib/components/CliHelpBox.svelte
@@ -1,7 +1,9 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import ClipboardPanel from './details/ClipboardPanel.svelte'
 	import Section from './Section.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let url = $derived(`${window.location.protocol}//${window.location.hostname}/`)
 </script>
@@ -20,7 +22,7 @@
 				<span class="font-medium">Setup the wmill cli for this workspace & remote:</span>
 				<div class="mt-1">
 					<ClipboardPanel
-						content={`wmill workspace add ${$workspaceStore} ${$workspaceStore} ${url}`}
+						content={`wmill workspace add ${$operatingWorkspace} ${$operatingWorkspace} ${url}`}
 					/>
 				</div>
 			</li>
diff --git a/frontend/src/lib/components/DBManager.svelte b/frontend/src/lib/components/DBManager.svelte
index 7520cc5013..fc1bbb9752 100644
--- a/frontend/src/lib/components/DBManager.svelte
+++ b/frontend/src/lib/components/DBManager.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { superadmin, userStore, type DBSchema } from '$lib/stores'
+	import { superadmin, type DBSchema } from '$lib/stores'
 	import {
 		ChevronDownIcon,
 		EditIcon,
@@ -33,6 +33,10 @@
 	import type { DbFeatures } from './apps/components/display/dbtable/dbFeatures'
 	import Star from './Star.svelte'
 	import type { Asset } from '$lib/gen'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	/** Represents a selected table with its schema */
 	export interface SelectedTable {
@@ -644,7 +648,7 @@
 								Import schema from database
 							</span>
 						</button>
-						{#if !!$userStore?.is_admin || !!$superadmin}
+						{#if !!actingUser?.is_admin || !!$superadmin}
 							<button
 								onclick={() => onImport('schema_and_data')}
 								class="hover:opacity-70 transition-opacity rounded-md border aspect-square w-52 gap-4 p-4 center-center flex-col"
diff --git a/frontend/src/lib/components/DBManagerContent.svelte b/frontend/src/lib/components/DBManagerContent.svelte
index b0ef2859df..3ee98538ba 100644
--- a/frontend/src/lib/components/DBManagerContent.svelte
+++ b/frontend/src/lib/components/DBManagerContent.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { dbSchemas, workspaceStore, type DBSchema } from '$lib/stores'
+	import { dbSchemas, type DBSchema } from '$lib/stores'
 	import { sortArray } from '$lib/utils'
 	import { Loader2, RefreshCcw } from 'lucide-svelte'
 	import Alert from './common/alert/Alert.svelte'
@@ -29,6 +29,9 @@
 	import { createAsyncConfirmationModal } from './common/confirmationModal/asyncConfirmationModal.svelte'
 	import Portal from '$lib/components/Portal.svelte'
 	import { outOfOrderRunMessage } from './workspaceSettings/datatableMigrationUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		input?: DbInput
@@ -44,9 +47,8 @@
 		/** Tables that are already added and should show as disabled */
 		disabledTables?: SelectedTable[]
 		onImport?: (mode: 'schema_and_data' | 'schema_only') => void
-		/** Workspace the datatable/schema lookups run against. Defaults to the
-		 *  navigation `$workspaceStore`; pass the acting workspace when embedded in
-		 *  a session preview whose workspace differs from the top nav. */
+		/** Workspace the datatable/schema lookups run against. Defaults to the operating
+		 *  workspace (see `useOperatingWorkspace`). */
 		workspace?: string
 		/** Worker tag every job of this manager runs on, overriding the database
 		 *  language's native tag. Bound so the hints below can offer to set it. */
@@ -68,7 +70,7 @@
 		workerTag = $bindable()
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let dbSchema: DBSchema | undefined = $derived(input && $dbSchemas[schemaCacheKey(input)])
 
diff --git a/frontend/src/lib/components/DBTable.svelte b/frontend/src/lib/components/DBTable.svelte
index adcf65c2b9..d1f314c615 100644
--- a/frontend/src/lib/components/DBTable.svelte
+++ b/frontend/src/lib/components/DBTable.svelte
@@ -66,7 +66,6 @@
 </script>
 
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { createGrid, type GridApi, type IDatasource } from 'ag-grid-community'
 	import { transformColumnDefs } from './apps/components/display/table/utils'
@@ -82,6 +81,9 @@
 	import 'ag-grid-community/styles/ag-theme-alpine.css'
 	import '$lib/components/apps/components/display/table/theme/windmill-theme.css'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		dbTableOps: IDbTableOps
@@ -101,7 +103,7 @@
 
 	let datasource: IDatasource = {
 		getRows: async function (params) {
-			if (!$workspaceStore) return params.failCallback()
+			if (!$operatingWorkspace) return params.failCallback()
 			let lastRow = rowCount && rowCount <= params.endRow ? rowCount : -1
 
 			const items = await dbTableOps.getRows({
@@ -132,7 +134,7 @@
 						minWidth: 150,
 						editable: true,
 						onCellValueChanged: (e) => {
-							if (!$workspaceStore) return
+							if (!$operatingWorkspace) return
 							const colDef = e.colDef as unknown as { field: string; datatype: string }
 							dbTableOps
 								.onUpdate?.(
@@ -169,7 +171,7 @@
 
 	let prevUpdateKey: any = undefined
 	$effect(() => {
-		if (!$workspaceStore || !api) return
+		if (!$operatingWorkspace || !api) return
 		const key = { quicksearch, colDefs: dbTableOps.colDefs, refreshCount, rowFilter }
 		if (deepEqual(key, prevUpdateKey)) return
 		prevUpdateKey = key
@@ -191,7 +193,7 @@
 			),
 			...(dbTableOps.onDelete && {
 				onDelete: (values) => {
-					if (!$workspaceStore) return
+					if (!$operatingWorkspace) return
 					dbTableOps
 						.onDelete?.({ values })
 						.then(() => {
@@ -249,7 +251,7 @@
 				columnDefs={dbTableOps.colDefs ?? []}
 				dbType={dbTableOps.dbType}
 				onInsert={(values) => {
-					if (!$workspaceStore) return
+					if (!$operatingWorkspace) return
 					dbTableOps.onInsert?.({ values }).then((result) => {
 						refresh?.()
 						sendUserToast('Row inserted')
diff --git a/frontend/src/lib/components/DatatablePicker.svelte b/frontend/src/lib/components/DatatablePicker.svelte
index e1741aaf4c..53617acf36 100644
--- a/frontend/src/lib/components/DatatablePicker.svelte
+++ b/frontend/src/lib/components/DatatablePicker.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 
 	import Select from './select/Select.svelte'
 	import ExploreAssetButton, { assetCanBeExplored } from './ExploreAssetButton.svelte'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value?: string | undefined
@@ -29,7 +31,7 @@
 	}: Props = $props()
 
 	let datatables = usePromise(() =>
-		WorkspaceService.listDataTables({ workspace: $workspaceStore ?? '' }).then((d) =>
+		WorkspaceService.listDataTables({ workspace: $operatingWorkspace ?? '' }).then((d) =>
 			d.map((d) => d.name)
 		)
 	)
diff --git a/frontend/src/lib/components/DefaultScripts.svelte b/frontend/src/lib/components/DefaultScripts.svelte
index dde49ecf2f..b5b83c7067 100644
--- a/frontend/src/lib/components/DefaultScripts.svelte
+++ b/frontend/src/lib/components/DefaultScripts.svelte
@@ -1,10 +1,13 @@
 <script lang="ts">
-	import { userStore } from '$lib/stores'
 	import { SettingsIcon } from 'lucide-svelte'
 	import { Button } from './common'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import DefaultScriptsInner from './DefaultScriptsInner.svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		placement?: 'left' | 'right'
@@ -17,7 +20,7 @@
 	let drawer: Drawer | undefined = $state()
 </script>
 
-{#if $userStore?.is_admin || $userStore?.is_super_admin}
+{#if actingUser?.is_admin || actingUser?.is_super_admin}
 	<Drawer bind:this={drawer} {placement}>
 		<DrawerContent title="Edit Default Scripts" on:close={drawer?.closeDrawer}>
 			<DefaultScriptsInner />
diff --git a/frontend/src/lib/components/DefaultScriptsInner.svelte b/frontend/src/lib/components/DefaultScriptsInner.svelte
index eaa3d989a0..b062fb4c49 100644
--- a/frontend/src/lib/components/DefaultScriptsInner.svelte
+++ b/frontend/src/lib/components/DefaultScriptsInner.svelte
@@ -1,10 +1,13 @@
 <script lang="ts">
 	import { WorkspaceService, type Script, type WorkspaceDefaultScripts } from '$lib/gen'
-	import { defaultScripts, workspaceStore } from '$lib/stores'
+	import { defaultScripts } from '$lib/stores'
 	import { flip } from 'svelte/animate'
 	import Toggle from './Toggle.svelte'
 	import { defaultScriptLanguages } from '$lib/scripts'
 	import Alert from './common/alert/Alert.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		small?: boolean
@@ -29,7 +32,7 @@
 		}
 		defaultScripts.update((s) => ({ ...s, order: norder }))
 		await WorkspaceService.editDefaultScripts({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			requestBody: $defaultScripts
 		})
 	}
diff --git a/frontend/src/lib/components/DucklakePicker.svelte b/frontend/src/lib/components/DucklakePicker.svelte
index e84ddb9060..3a6f2bf739 100644
--- a/frontend/src/lib/components/DucklakePicker.svelte
+++ b/frontend/src/lib/components/DucklakePicker.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 
 	import Select from './select/Select.svelte'
 	import ExploreAssetButton, { assetCanBeExplored } from './ExploreAssetButton.svelte'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value?: string | undefined
@@ -29,9 +31,8 @@
 	}: Props = $props()
 
 	let ducklakes = usePromise(() =>
-		WorkspaceService.listDucklakes({ workspace: $workspaceStore ?? '' })
+		WorkspaceService.listDucklakes({ workspace: $operatingWorkspace ?? '' })
 	)
-
 </script>
 
 <div class={className}>
@@ -46,9 +47,6 @@
 		{onClear}
 	/>
 	{#if showSchemaExplorer && value && assetCanBeExplored({ kind: 'ducklake', path: value })}
-		<ExploreAssetButton
-			class="mt-1 w-fit"
-			asset={{ kind: 'ducklake', path: value }}
-		/>
+		<ExploreAssetButton class="mt-1 w-fit" asset={{ kind: 'ducklake', path: value }} />
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/EditableSchemaForm.svelte b/frontend/src/lib/components/EditableSchemaForm.svelte
index bd3399d9d2..79173424d9 100644
--- a/frontend/src/lib/components/EditableSchemaForm.svelte
+++ b/frontend/src/lib/components/EditableSchemaForm.svelte
@@ -4,7 +4,6 @@
 	const bubble = createBubbler()
 	import type { Schema } from '$lib/common'
 	import { VariableService, type ScriptLang } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
 	import VariableEditor from './VariableEditor.svelte'
@@ -36,6 +35,9 @@
 	import Section from '$lib/components/Section.svelte'
 	import Editor from './Editor.svelte'
 	import AddPropertyV2 from './schema/AddPropertyV2.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// export let openEditTab: () => void = () => {}
 	const dispatch = createEventDispatcher()
@@ -128,7 +130,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	$effect.pre(() => {
 		if (args == undefined) {
diff --git a/frontend/src/lib/components/Editor.svelte b/frontend/src/lib/components/Editor.svelte
index 987aa937eb..6aabc30c2b 100644
--- a/frontend/src/lib/components/Editor.svelte
+++ b/frontend/src/lib/components/Editor.svelte
@@ -42,7 +42,6 @@
 	import { editorConfig, registerWebviewPaste, updateOptions } from '$lib/editorUtils'
 	import { editorFontSize } from '$lib/editorFontSize.svelte'
 	import { createHash as randomHash } from '$lib/editorLangUtils'
-	import { workspaceStore } from '$lib/stores'
 	import DdlMigrationGuard from './DdlMigrationGuard.svelte'
 	import {
 		type Preview,
@@ -120,6 +119,9 @@
 	import { rawAppLintStore, type MonacoLintError } from './raw_apps/lintStore'
 	import { MarkerSeverity } from 'monaco-editor'
 	import { resource, useDebounce, watch } from 'runed'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	// import EditorTheme from './EditorTheme.svelte'
 
 	let divEl: HTMLDivElement | null = $state(null)
@@ -684,7 +686,7 @@
 	// via a short-TTL cache — macros are late-bound, so mild staleness is fine.
 	async function addWorkspaceMacroCompletions() {
 		workspaceMacroCompletor?.dispose()
-		const workspace = $workspaceStore
+		const workspace = $operatingWorkspace
 		if (!workspace) return
 		let macros: Awaited<ReturnType<typeof listWorkspaceMacrosCached>> = []
 		try {
@@ -739,7 +741,7 @@
 			provideCompletionItems: async function (model, position) {
 				// Read the store per request, not at registration — the provider
 				// outlives a workspace switch.
-				const workspace = $workspaceStore
+				const workspace = $operatingWorkspace
 				if (!workspace) return { suggestions: [] }
 				const before = model.getLineContent(position.lineNumber).slice(0, position.column - 1)
 				if (!/^\s*(\/\/|--|#)\s*(column|data_test|on|materialize)\b/.test(before)) {
@@ -780,7 +782,7 @@
 				$dbSchemas[resourcePath] = await getDbSchemas(
 					lang === 'graphql' ? 'graphql' : (scriptLang ?? ''),
 					resourcePath,
-					$workspaceStore,
+					$operatingWorkspace,
 					(e) => console.error(`error getting ${lang} (${scriptLang}) db schema`, e),
 					{ customTag }
 				)
@@ -1778,9 +1780,9 @@
 	let customTsTypesData = resource([() => lang], async () => {
 		if (lang !== 'typescript') return undefined
 		let datatables = (
-			await WorkspaceService.listDataTables({ workspace: $workspaceStore ?? '' })
+			await WorkspaceService.listDataTables({ workspace: $operatingWorkspace ?? '' })
 		).map((d) => d.name)
-		let ducklakes = await WorkspaceService.listDucklakes({ workspace: $workspaceStore ?? '' })
+		let ducklakes = await WorkspaceService.listDucklakes({ workspace: $operatingWorkspace ?? '' })
 		return { datatables, ducklakes }
 	})
 	function setTypescriptCustomTypes() {
@@ -1822,7 +1824,7 @@
 				scriptLang === 'nativets')
 		) {
 			const resourceTypes = await ResourceService.listResourceType({
-				workspace: $workspaceStore ?? ''
+				workspace: $operatingWorkspace ?? ''
 			})
 
 			const namespace = formatResourceTypes(
@@ -2023,7 +2025,7 @@
 			$lspTokenStore = newToken
 			token = newToken
 		}
-		let root = hostname + '/api/scripts_u/tokened_raw/' + $workspaceStore + '/' + token
+		let root = hostname + '/api/scripts_u/tokened_raw/' + $operatingWorkspace + '/' + token
 		return root
 	}
 
@@ -2274,10 +2276,10 @@
 
 <svelte:window onkeydown={onKeyDown} />
 <EditorTheme />
-{#if datatableForMigrations && $workspaceStore}
+{#if datatableForMigrations && $operatingWorkspace}
 	<DdlMigrationGuard
 		bind:this={ddlGuard}
-		workspace={$workspaceStore}
+		workspace={$operatingWorkspace}
 		datatable={datatableForMigrations}
 	/>
 {/if}
diff --git a/frontend/src/lib/components/EditorBar.svelte b/frontend/src/lib/components/EditorBar.svelte
index 91516843ab..81ef6c1c96 100644
--- a/frontend/src/lib/components/EditorBar.svelte
+++ b/frontend/src/lib/components/EditorBar.svelte
@@ -22,7 +22,6 @@
 <script lang="ts">
 	import { ResourceService, VariableService, WorkspaceService, type Script } from '$lib/gen'
 
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import type Editor from './Editor.svelte'
 	import ItemPicker from './ItemPicker.svelte'
@@ -76,6 +75,9 @@
 	import FlowInlineScriptAiButton from './copilot/FlowInlineScriptAIButton.svelte'
 	import GitRepoPopoverPicker from './GitRepoPopoverPicker.svelte'
 	import { insertDelegateToGitRepoInCode } from '$lib/ansibleUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		lang: SupportedLanguage | 'bunnative' | undefined
@@ -121,9 +123,8 @@
 		right?: import('svelte').Snippet
 		openAiChat?: boolean
 		moduleId?: string
-		// Workspace to scope variable/resource/data-table lookups to. Defaults to
-		// the nav `$workspaceStore`; an AI-session live editor passes the session's
-		// acting workspace (a fork) so the helper pickers hit the right workspace.
+		// Workspace to scope variable/resource/data-table lookups to. Defaults to the
+		// operating workspace (see `useOperatingWorkspace`).
 		workspace?: string
 	}
 
@@ -153,7 +154,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let contextualVariablePicker: ItemPicker | undefined = $state()
 	let variablePicker: ItemPicker | undefined = $state()
diff --git a/frontend/src/lib/components/EditorHeader.svelte b/frontend/src/lib/components/EditorHeader.svelte
index fdf18b4b50..25291fa5f0 100644
--- a/frontend/src/lib/components/EditorHeader.svelte
+++ b/frontend/src/lib/components/EditorHeader.svelte
@@ -15,7 +15,15 @@
 	} from '$lib/components/workspacePicker'
 	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
 	import { isOwner } from '$lib/utils'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		summary?: string
@@ -47,9 +55,8 @@
 		 * dropped, leaving only the summary. Used by the condensed session-
 		 * preview top bar to save vertical room. */
 		hidePath?: boolean
-		/** Workspace whose items the breadcrumb picker lists. Session live
-		 * editors pass their acting workspace so the picker isn't scoped to the
-		 * navigation workspace; falls back to $workspaceStore in the picker. */
+		/** Workspace whose items the breadcrumb picker lists; defaults to the operating
+		 * workspace (see `useOperatingWorkspace`). */
 		workspaceId?: string
 	}
 
@@ -116,7 +123,7 @@
 	// Treat an empty path as ownable so the pen popover lets a user pick the
 	// path for a brand-new item. `Path.reset()` then synthesizes a default
 	// under their own user/folder scope.
-	let own = $derived(!path || isOwner(path, $userStore, $workspaceStore))
+	let own = $derived(!path || isOwner(path, actingUser, $operatingWorkspace))
 
 	// Virtual entry for the picker: surfaces the currently-edited item at its
 	// live path (which may differ from `savedPath` mid-rename, so the picker
diff --git a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
index 89e2554c01..33e8073f2f 100644
--- a/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
+++ b/frontend/src/lib/components/ErrorOrRecoveryHandler.svelte
@@ -31,7 +31,7 @@
 
 	import type { Schema, SupportedLanguage } from '$lib/common'
 	import { base } from '$lib/base'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import MsTeamsIcon from '$lib/components/icons/MSTeamsIcon.svelte'
 	import { classNames, emptySchema, emptyString, sendUserToast, tryEvery } from '$lib/utils'
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
@@ -61,6 +61,9 @@
 	import SmtpConfigurationStatus from './common/smtp/SmtpConfigurationStatus.svelte'
 	import { SettingService } from '$lib/gen'
 	import { isSmtpSettingsValid } from './instanceSettings/SmtpSettings.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const slackRecoveryHandler = hubPaths.slackRecoveryHandler
 	const slackHandlerScriptPath = hubPaths.slackErrorHandler
@@ -81,9 +84,8 @@
 		customHandlerKind?: 'flow' | 'script'
 		customTabTooltip?: import('svelte').Snippet
 		noMargin?: boolean
-		/** Workspace for handler lookup / settings / test jobs. Defaults to the
-		 * nav `$workspaceStore`; a trigger editor in a forked session passes its
-		 * acting workspace so the handler is resolved and saved there. */
+		/** Workspace for handler lookup / settings / test jobs. Defaults to the operating
+		 * workspace (see `useOperatingWorkspace`). */
 		workspace?: string
 		/** Offer the instance critical alert channels as a destination. Workspace-level
 		 * error handling only: schedules and triggers have no such setting. */
@@ -106,13 +108,12 @@
 		showInstanceAlerts = false
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
-	// Carry the acting workspace onto the "create from template" route when an
-	// explicit override is set, so a forked session creates the handler script
-	// there. `customScriptTemplate` already has a query string (`?hub=…`).
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace)
+	// Carry the workspace onto the "create from template" route, so the handler script is
+	// created where this handler is saved. `customScriptTemplate` already has a query string.
 	let templateHref = $derived(
-		workspace
-			? `${customScriptTemplate}&workspace=${encodeURIComponent(workspace)}`
+		effectiveWorkspace
+			? `${customScriptTemplate}&workspace=${encodeURIComponent(effectiveWorkspace)}`
 			: customScriptTemplate
 	)
 
diff --git a/frontend/src/lib/components/ExploreAssetButton.svelte b/frontend/src/lib/components/ExploreAssetButton.svelte
index 85ee7f0b98..d48688a871 100644
--- a/frontend/src/lib/components/ExploreAssetButton.svelte
+++ b/frontend/src/lib/components/ExploreAssetButton.svelte
@@ -33,15 +33,18 @@
 	import { Button, ButtonType } from '$lib/components/common'
 	import S3FilePicker from '$lib/components/S3FilePicker.svelte'
 	import { VolumeService } from '$lib/gen'
-	import {
-		globalDbManagerDrawer,
-		globalS3FilePickerExplorer,
-		userStore,
-		workspaceStore
-	} from '$lib/stores'
+	import { globalDbManagerDrawer, globalS3FilePickerExplorer } from '$lib/stores'
 	import { isS3Uri } from '$lib/utils'
 	import { Database, File, HardDriveIcon } from 'lucide-svelte'
 	import DucklakeIcon from './icons/DucklakeIcon.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const {
 		asset,
@@ -69,7 +72,7 @@
 	} = $props()
 
 	let dbManagerDrawer = $derived(globalDbManagerDrawer.val)
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 	const assetUri = $derived(formatAsset(asset))
 	// Contexts with a select/upload flow pass their own picker; everything else
 	// (e.g. the resources list) falls back to the global read-only explorer.
@@ -80,7 +83,7 @@
 </script>
 
 <Button
-	disabled={$userStore?.operator || disabled}
+	disabled={actingUser?.operator || disabled}
 	unifiedSize={'md'}
 	variant={buttonVariant}
 	wrapperClasses={className}
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index cbd6a18207..245f60bcd0 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -18,13 +18,7 @@
 		linkedAgentToolsVersion,
 		migrateLinkedAgentToolsScope
 	} from '$lib/components/flows/linkedAgentToolsStore.svelte'
-	import {
-		enterpriseLicense,
-		userStore,
-		userWorkspaces,
-		workspaceStore,
-		usedTriggerKinds
-	} from '$lib/stores'
+	import { enterpriseLicense, userStore, userWorkspaces, usedTriggerKinds } from '$lib/stores'
 	import {
 		generateRandomString,
 		orderedJsonStringify,
@@ -112,6 +106,14 @@
 	import { UserDraft } from '$lib/userDraft.svelte'
 	import { setOpenInSessionHandoff } from './sessions/openInSessionContext'
 	import { getEditorStoragePath, setEditorStoragePath } from './editorStoragePathContext'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		initialPath = $bindable(''),
@@ -164,9 +166,9 @@
 	// and the AutosaveIndicator all target it. Falls back to the global store, so
 	// the full-page editor is unchanged; the sessions preview overrides it to the
 	// session's (forked) workspace, so an embedded editor acts on the session's
-	// fork rather than the navigation workspace ($workspaceStore, which stays put).
+	// fork rather than the navigation workspace (`workspaceStore`, which stays put).
 	// indicatorPath is the matching draft path.
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
 	const indicatorPath = $derived(autosavePath ?? liveEditorDraftStoragePath)
 
 	let initialPathStore = writable(initialPath)
@@ -628,7 +630,7 @@
 					await deployTriggers(
 						triggersToDeploy,
 						opWorkspace,
-						!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+						!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 						usedTriggerKinds,
 						$pathStore,
 						true
@@ -639,7 +641,7 @@
 					await deployTriggers(
 						triggersToDeploy,
 						opWorkspace,
-						!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+						!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 						usedTriggerKinds,
 						initialPath
 					)
@@ -1512,7 +1514,7 @@
 <AIChangesWarningModal bind:open={aiChangesWarningOpen} onConfirm={aiChangesConfirmCallback} />
 
 {#key renderCount}
-	{#if !$userStore?.operator}
+	{#if !actingUser?.operator}
 		{#if $pathStore}
 			<FlowHistory bind:this={flowHistory} path={$pathStore} {onHistoryRestore} />
 		{/if}
diff --git a/frontend/src/lib/components/FlowGraphViewer.svelte b/frontend/src/lib/components/FlowGraphViewer.svelte
index 945533bcc8..daff7cf8db 100644
--- a/frontend/src/lib/components/FlowGraphViewer.svelte
+++ b/frontend/src/lib/components/FlowGraphViewer.svelte
@@ -10,10 +10,12 @@
 	import FlowGraphViewerStep from './FlowGraphViewerStep.svelte'
 	import FlowGraphV2 from './graph/FlowGraphV2.svelte'
 	import { dfs } from './flows/dfs'
-	import { workspaceStore } from '$lib/stores'
 	import { untrack } from 'svelte'
 	import { publishLinkedAgentTools } from './flows/flowState'
 	import { linkedToolsScope } from './flows/linkedAgentToolsStore.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		flow: {
@@ -45,7 +47,7 @@
 		noGraph = false,
 		triggerNode = false,
 		stepDetail = $bindable(undefined),
-		workspace = $workspaceStore,
+		workspace = $operatingWorkspace,
 		minHeight = 400,
 		noBorder = false,
 		hideDefaultInputs = false,
diff --git a/frontend/src/lib/components/FlowGraphViewerStep.svelte b/frontend/src/lib/components/FlowGraphViewerStep.svelte
index 1e4525274f..1081371b6f 100644
--- a/frontend/src/lib/components/FlowGraphViewerStep.svelte
+++ b/frontend/src/lib/components/FlowGraphViewerStep.svelte
@@ -12,7 +12,7 @@
 	import SchemaViewer from './SchemaViewer.svelte'
 	import { scriptPathToHref } from '$lib/scripts'
 	import { cleanExpr, copyToClipboard } from '$lib/utils'
-	import { hubBaseUrlStore, workspaceStore } from '$lib/stores'
+	import { hubBaseUrlStore } from '$lib/stores'
 
 	import { twMerge } from 'tailwind-merge'
 	import FlowModuleScript from './flows/content/FlowModuleScript.svelte'
@@ -20,6 +20,9 @@
 	import HighlightTheme from './HighlightTheme.svelte'
 	import LanguageIcon from './common/languageIcons/LanguageIcon.svelte'
 	import FlowGraphViewerStepHeader from './FlowGraphViewerStepHeader.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema?: any | undefined
@@ -41,7 +44,7 @@
 		workspace = undefined,
 		onBack = undefined
 	}: Props = $props()
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 	let codeViewer: Drawer | undefined = $state()
 </script>
 
diff --git a/frontend/src/lib/components/FlowHistoryJobPicker.svelte b/frontend/src/lib/components/FlowHistoryJobPicker.svelte
index 26fa41f1af..dfb4927af1 100644
--- a/frontend/src/lib/components/FlowHistoryJobPicker.svelte
+++ b/frontend/src/lib/components/FlowHistoryJobPicker.svelte
@@ -3,9 +3,11 @@
 	import { createEventDispatcher, untrack } from 'svelte'
 	import PopoverV2 from '$lib/components/meltComponents/Popover.svelte'
 	import HistoricInputs from './HistoricInputs.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { JobService } from '$lib/gen'
 	import { Button } from './common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -27,7 +29,7 @@
 	async function loadInitial() {
 		loading = true
 		let jobs = await JobService.listJobs({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			scriptPathExact: path,
 			jobKinds: ['flow', 'flowpreview'].join(','),
 			perPage: 1
@@ -43,7 +45,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore && !newFlow) {
+		if ($operatingWorkspace && !newFlow) {
 			untrack(() => loadInitial())
 		}
 	})
diff --git a/frontend/src/lib/components/FlowLogViewer.svelte b/frontend/src/lib/components/FlowLogViewer.svelte
index 2f466041d7..6a8db18a76 100644
--- a/frontend/src/lib/components/FlowLogViewer.svelte
+++ b/frontend/src/lib/components/FlowLogViewer.svelte
@@ -11,7 +11,6 @@
 		Keyboard
 	} from 'lucide-svelte'
 	import { base } from '$lib/base'
-	import { workspaceStore } from '$lib/stores'
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import LogViewer from './LogViewer.svelte'
 	import FlowLogViewer from './FlowLogViewer.svelte'
@@ -26,6 +25,9 @@
 	import { Tooltip } from './meltComponents'
 	import FlowTimelineBar from './FlowTimelineBar.svelte'
 	import { getActiveReplay } from './recording/replay.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type RootJobData = Partial<Job>
 
@@ -96,7 +98,7 @@
 
 	function getJobLink(jobId: string | undefined): string {
 		if (!jobId) return ''
-		return `${base}/run/${jobId}?workspace=${workspaceId ?? $workspaceStore}`
+		return `${base}/run/${jobId}?workspace=${workspaceId ?? $operatingWorkspace}`
 	}
 
 	function getStatusColor(status: FlowStatusModule['type'] | undefined): string {
diff --git a/frontend/src/lib/components/FlowLoopIterationPreview.svelte b/frontend/src/lib/components/FlowLoopIterationPreview.svelte
index 0a4f5c60ee..f136cbfe39 100644
--- a/frontend/src/lib/components/FlowLoopIterationPreview.svelte
+++ b/frontend/src/lib/components/FlowLoopIterationPreview.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { type Job, JobService, type FlowModule, type RestartedFrom } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Button } from './common'
 	import { createEventDispatcher, getContext } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
@@ -11,6 +10,9 @@
 	import FlowProgressBar from './flows/FlowProgressBar.svelte'
 	import { CornerDownLeft, Play, RefreshCw, X } from 'lucide-svelte'
 	import type { Schema } from '$lib/common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open: boolean
@@ -165,7 +167,7 @@
 					try {
 						jobId &&
 							(await JobService.cancelQueuedJob({
-								workspace: opWorkspace?.() ?? $workspaceStore ?? '',
+								workspace: opWorkspace?.() ?? $operatingWorkspace ?? '',
 								id: jobId,
 								requestBody: {}
 							}))
diff --git a/frontend/src/lib/components/FlowPreviewContent.svelte b/frontend/src/lib/components/FlowPreviewContent.svelte
index 5d543ae24d..9ccac1d8c6 100644
--- a/frontend/src/lib/components/FlowPreviewContent.svelte
+++ b/frontend/src/lib/components/FlowPreviewContent.svelte
@@ -6,7 +6,6 @@
 		type OpenFlow,
 		type ScriptLang
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Badge, Button } from './common'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
@@ -44,6 +43,9 @@
 	import FlowRestartButton from './FlowRestartButton.svelte'
 	import { useNestedRestartState } from './useNestedRestartState.svelte'
 	import { buildFlowRecording, downloadRecordingJson } from './recording/runRecording'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		previewMode: 'upTo' | 'whole'
@@ -138,7 +140,7 @@
 		opWorkspace
 	} = $state(getContext<FlowEditorContext>('FlowEditorContext'))
 	// Acting workspace when previewing inside an AI session; else the nav workspace.
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	const dispatch = createEventDispatcher()
 
 	let renderCount: number = $state(0)
diff --git a/frontend/src/lib/components/FlowRestartButton.svelte b/frontend/src/lib/components/FlowRestartButton.svelte
index d470c51b54..11f5cfd28a 100644
--- a/frontend/src/lib/components/FlowRestartButton.svelte
+++ b/frontend/src/lib/components/FlowRestartButton.svelte
@@ -3,7 +3,9 @@
 	import Popover from './meltComponents/Popover.svelte'
 	import { Play, RefreshCw } from 'lucide-svelte'
 	import { FlowService, JobService, type FlowVersion } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { emptyString, sendUserToast } from '$lib/utils'
 
 	interface Props {
@@ -166,7 +168,7 @@
 					flow_version: flowVersion
 				}
 		let run = await JobService.restartFlowAtStep({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			id: jobId,
 			requestBody
 		})
@@ -178,7 +180,7 @@
 		loadingVersions = true
 		try {
 			flowVersions = await FlowService.getFlowHistory({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				path: flowPath
 			})
 			if (flowVersions.length > 0) {
diff --git a/frontend/src/lib/components/FlowStatusViewer.svelte b/frontend/src/lib/components/FlowStatusViewer.svelte
index cfca77b748..7a2a28775e 100644
--- a/frontend/src/lib/components/FlowStatusViewer.svelte
+++ b/frontend/src/lib/components/FlowStatusViewer.svelte
@@ -4,8 +4,11 @@
 	import { setContext, untrack } from 'svelte'
 	import type { DurationStatus, FlowStatusViewerContext, GraphModuleState } from './graph'
 	import { isOwner as loadIsOwner, type StateStore } from '$lib/utils'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import type { CompletedJob, FlowModule, FlowNote, FlowValue, Job } from '$lib/gen'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		jobId: string
@@ -98,7 +101,7 @@
 	})
 
 	function loadOwner(path: string) {
-		isOwner = loadIsOwner(path, $userStore!, workspaceId ?? $workspaceStore!)
+		isOwner = loadIsOwner(path, $userStore!, workspaceId ?? $operatingWorkspace!)
 	}
 
 	async function updateJobId() {
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index c082825e83..05ad6c7bb2 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -15,7 +15,6 @@
 		type FlowNote,
 		type FlowValue
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import FlowJobResult from './FlowJobResult.svelte'
 	import WorkflowTimeline from './WorkflowTimeline.svelte'
@@ -69,6 +68,9 @@
 		releaseLinkedToolsScope,
 		retainLinkedToolsScope
 	} from './flows/linkedAgentToolsStore.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		flowState: flowStateStore,
@@ -168,7 +170,7 @@
 		isSubflow = false,
 		reducedPolling = false,
 		wideResults = false,
-		workspace = $workspaceStore,
+		workspace = $operatingWorkspace,
 		prefix = undefined,
 		topModuleStates = undefined,
 		refreshGlobal,
@@ -242,7 +244,7 @@
 						resourceMetadataCache[asset.path] = undefined
 						if (!isReplay) {
 							ResourceService.getResource({
-								workspace: workspace ?? $workspaceStore!,
+								workspace: workspace ?? $operatingWorkspace!,
 								path: asset.path
 							})
 								.then((r) => (resourceMetadataCache[asset.path] = r))
@@ -278,7 +280,7 @@
 	// resolving in the navigation one finds nothing, or an unrelated resource sharing the path. The
 	// store scope stays keyed on `workspace` to match what FlowGraphV2 reads — the job id in the key
 	// already makes the bucket unique.
-	let agentFetchWorkspace = $derived(workspaceId ?? job?.workspace_id ?? $workspaceStore)
+	let agentFetchWorkspace = $derived(workspaceId ?? job?.workspace_id ?? $operatingWorkspace)
 	// Hold this scope for as long as the viewer is mounted, so the store's cap can't drop tools the
 	// run still needs (nothing would refetch them — the set of linked steps hasn't changed).
 	$effect(() => {
@@ -627,7 +629,7 @@
 				) {
 					if (!isReplay) {
 						JobService.getJob({
-							workspace: workspaceId ?? $workspaceStore ?? '',
+							workspace: workspaceId ?? $operatingWorkspace ?? '',
 							id: mod.job ?? '',
 							noLogs: true,
 							noCode: true
@@ -722,7 +724,7 @@
 						})
 						if (!isReplay) {
 							JobService.getStartedAtByIds({
-								workspace: workspaceId ?? $workspaceStore ?? '',
+								workspace: workspaceId ?? $operatingWorkspace ?? '',
 								requestBody: missingStartedAtIds
 							})
 								.then((jobs) => {
@@ -1569,7 +1571,7 @@
 									let storedJob = storedListJobs[j]
 									if (!storedJob && !isReplay) {
 										storedJob = await JobService.getJob({
-											workspace: workspaceId ?? $workspaceStore ?? '',
+											workspace: workspaceId ?? $operatingWorkspace ?? '',
 											id: loopJobId,
 											noLogs: true,
 											noCode: true
@@ -2135,7 +2137,7 @@
 															id={isReplay ? undefined : job.id}
 															workspace={isReplay
 																? undefined
-																: (job.workspace_id ?? $workspaceStore ?? 'no_w')}
+																: (job.workspace_id ?? $operatingWorkspace ?? 'no_w')}
 															args={job.args}
 														/>
 													{:else}
@@ -2202,7 +2204,7 @@
 																			id={isReplay ? undefined : node.job_id}
 																			workspace={isReplay
 																				? undefined
-																				: (job.workspace_id ?? $workspaceStore ?? 'no_w')}
+																				: (job.workspace_id ?? $operatingWorkspace ?? 'no_w')}
 																			args={node.args}
 																		/>
 																	</div>
diff --git a/frontend/src/lib/components/FlowViewer.svelte b/frontend/src/lib/components/FlowViewer.svelte
index 03baebb501..c68d62ad42 100644
--- a/frontend/src/lib/components/FlowViewer.svelte
+++ b/frontend/src/lib/components/FlowViewer.svelte
@@ -7,12 +7,14 @@
 	import { Loader2 } from 'lucide-svelte'
 	import { cleanValueProperties, replaceFalseWithUndefined } from '$lib/utils'
 	import { orderedYamlStringify } from '$lib/utils/orderedYaml'
-	import { workspaceStore } from '$lib/stores'
 	import { watch } from 'runed'
 
 	import HighlightTheme from './HighlightTheme.svelte'
 	import FlowViewerInner from './FlowViewerInner.svelte'
 	import FlowInputViewer from './FlowInputViewer.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface PreviousFlow {
 		summary: string
@@ -86,7 +88,7 @@
 				return
 			}
 			previousFlow = await FlowService.getFlowVersion({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				version
 			})
 			previousFlowCache[version] = previousFlow
diff --git a/frontend/src/lib/components/FolderEditor.svelte b/frontend/src/lib/components/FolderEditor.svelte
index e8f37a625c..7af2066fa6 100644
--- a/frontend/src/lib/components/FolderEditor.svelte
+++ b/frontend/src/lib/components/FolderEditor.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { userStore, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import {
 		type Folder,
 		type FolderDefaultPermissionedAs,
@@ -89,8 +90,12 @@
 		workspace
 	}: Props = $props()
 
-	const targetWorkspace = $derived(workspace ?? $workspaceStore ?? '')
-	const aimedElsewhere = $derived(!!workspace && workspace !== $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const targetWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
+	const aimedElsewhere = $derived(!!targetWorkspace && targetWorkspace !== $workspaceStore)
+	// The group editor and permission history act on the operating workspace and take no
+	// workspace of their own, so they can only follow a drawer aimed at that one.
+	const offOperating = $derived(!!targetWorkspace && targetWorkspace !== $operatingWorkspace)
 
 	// `$userStore` describes the workspace the app is *in*. Aimed at another one it answers
 	// the wrong question — a folder admin there would get read-only controls, and a
@@ -121,9 +126,9 @@
 	})
 
 	async function loadTargetUser(): Promise<void> {
-		if (!aimedElsewhere || !workspace) return
+		if (!aimedElsewhere) return
 		try {
-			targetUser = await UserService.whoami({ workspace })
+			targetUser = await UserService.whoami({ workspace: targetWorkspace })
 		} catch {
 			// Not a member, or the call failed: no membership means read-only controls,
 			// which is the safe reading — the write would be refused anyway.
@@ -551,7 +556,7 @@
 	let loadStarted = false
 	$effect.pre(() => {
 		if (loadStarted) return
-		if ($workspaceStore && $userStore) {
+		if (targetWorkspace && $userStore) {
 			loadStarted = true
 			untrack(() => {
 				load()
@@ -675,10 +680,7 @@
 											class="grow min-w-0"
 										>
 											{#snippet endSnippet({ item, close: closeSelect })}
-												<!-- GroupEditor reads and writes `$workspaceStore` and takes no workspace of its
-												     own, so it cannot follow a drawer aimed at another one: viewing a group
-												     there would edit the same-named group in the active workspace. -->
-												{#if ownerKind == 'group' && !aimedElsewhere}
+												{#if ownerKind == 'group' && !offOperating}
 													<Button
 														title="View group"
 														variant="subtle"
@@ -696,7 +698,7 @@
 												{/if}
 											{/snippet}
 											{#snippet bottomSnippet({ close: closeSelect })}
-												{#if ownerKind == 'group' && !aimedElsewhere}
+												{#if ownerKind == 'group' && !offOperating}
 													<Button
 														variant="subtle"
 														unifiedSize="sm"
@@ -838,11 +840,9 @@
 								</Cell>
 								<Cell last actions>
 									<div class="flex items-center justify-end">
-										<!-- The group editor reads `$workspaceStore`, so it can only be opened for the
-										     workspace the app is in — see the picker's own buttons. It decides on its
-										     own whether the group is editable here; a member with no write on it still
-										     gets to see who is in it. -->
-										{#if ownerKindOf(perm.owner_name) === 'group' && !aimedElsewhere}
+										<!-- The group editor decides on its own whether the group is editable here; a
+										     member with no write on it still gets to see who is in it. -->
+										{#if ownerKindOf(perm.owner_name) === 'group' && !offOperating}
 											<Button
 												title="Manage group"
 												variant="subtle"
@@ -1001,9 +1001,7 @@
 		</CollapseLink>
 	{/if}
 
-	<!-- PermissionHistory fetches against `$workspaceStore`; aimed elsewhere it would show
-	     another folder's history entirely. -->
-	{#if !isNew && !aimedElsewhere && reloadHistory > 0}
+	{#if !isNew && !offOperating && reloadHistory > 0}
 		{#key reloadHistory}
 			<PermissionHistory
 				{name}
diff --git a/frontend/src/lib/components/FolderPicker.svelte b/frontend/src/lib/components/FolderPicker.svelte
index 6f8a4858c3..0b5bc05897 100644
--- a/frontend/src/lib/components/FolderPicker.svelte
+++ b/frontend/src/lib/components/FolderPicker.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { FolderService, UserService, type User } from '$lib/gen'
 	import { workspaceStore, userStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { isDemoWorkspaceRestricted } from '$lib/cloud'
 	import { ChevronDown, Pen, PlusIcon } from 'lucide-svelte'
 	import { Button } from './common'
@@ -39,14 +40,15 @@
 		workspace
 	}: Props = $props()
 
-	const targetWorkspace = $derived(workspace ?? $workspaceStore ?? '')
+	const operatingWorkspace = useOperatingWorkspace()
+	const targetWorkspace = $derived(workspace ?? $operatingWorkspace ?? '')
 
 	// `$userStore` describes the workspace the app is *in*. When this picker is aimed
 	// somewhere else, those memberships answer the wrong question — and since a folder
 	// without write access renders disabled, a stale answer makes the real folders
 	// unpickable. Resolve the membership for the workspace actually being listed.
 	let targetUser: User | undefined = $state(undefined)
-	const aimedElsewhere = $derived(!!workspace && workspace !== $workspaceStore)
+	const aimedElsewhere = $derived(!!targetWorkspace && targetWorkspace !== $workspaceStore)
 	const membership = $derived(aimedElsewhere ? targetUser : ($userStore ?? undefined))
 
 	const restricted = $derived(
@@ -129,9 +131,9 @@
 	}
 
 	async function loadTargetUser(): Promise<void> {
-		if (!workspace || workspace === $workspaceStore) return
+		if (!aimedElsewhere) return
 		try {
-			targetUser = await UserService.whoami({ workspace })
+			targetUser = await UserService.whoami({ workspace: targetWorkspace })
 		} catch {
 			// Not a member, or the call failed: every folder stays read-only, which is
 			// the safe reading — the import would be refused anyway.
diff --git a/frontend/src/lib/components/GitHubAppIntegration.svelte b/frontend/src/lib/components/GitHubAppIntegration.svelte
index 89a80de6b0..6fb5a9fbf3 100644
--- a/frontend/src/lib/components/GitHubAppIntegration.svelte
+++ b/frontend/src/lib/components/GitHubAppIntegration.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { workspaceStore, enterpriseLicense, userStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import Popover from './meltComponents/Popover.svelte'
 	import Button from './common/button/Button.svelte'
 	import { Loader2, Github, RotateCw, Plus, Minus, Download, AlertTriangle } from 'lucide-svelte'
@@ -18,6 +18,14 @@
 		type GitHubAppState
 	} from '$lib/githubApp'
 	import RepositorySelector from './RepositorySelector.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		resourceType: string
@@ -70,14 +78,14 @@
 
 	let showGitHubApp = $derived(
 		resourceType === 'git_repository' &&
-			$workspaceStore &&
-			($userStore?.is_admin || $userStore?.is_super_admin)
+			$operatingWorkspace &&
+			(actingUser?.is_admin || actingUser?.is_super_admin)
 	)
 
 	// Load GitHub installations when conditions are met
 	$effect(() => {
-		if (showGitHubApp && $enterpriseLicense && $workspaceStore) {
-			loadGithubInstallations(githubState, $workspaceStore).catch((error) => {
+		if (showGitHubApp && $enterpriseLicense && $operatingWorkspace) {
+			loadGithubInstallations(githubState, $operatingWorkspace).catch((error) => {
 				console.error('Failed to load GitHub installations:', error)
 			})
 		}
@@ -113,11 +121,11 @@
 	}
 
 	async function handleDeleteInstallation(installationId: number) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await deleteInstallation($workspaceStore, installationId, () =>
-				loadGithubInstallations(githubState, $workspaceStore!)
+			await deleteInstallation($operatingWorkspace, installationId, () =>
+				loadGithubInstallations(githubState, $operatingWorkspace!)
 			)
 		} catch (error) {
 			console.error('Failed to delete installation:', error)
@@ -125,11 +133,11 @@
 	}
 
 	async function handleAddInstallation(installationId: number, workspaceId: string) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await addInstallationToWorkspace($workspaceStore, installationId, workspaceId, () =>
-				loadGithubInstallations(githubState, $workspaceStore!)
+			await addInstallationToWorkspace($operatingWorkspace, installationId, workspaceId, () =>
+				loadGithubInstallations(githubState, $operatingWorkspace!)
 			)
 		} catch (error) {
 			console.error('Failed to add installation:', error)
@@ -137,22 +145,22 @@
 	}
 
 	async function handleExportInstallation(installationId: number) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await exportInstallation($workspaceStore, installationId)
+			await exportInstallation($operatingWorkspace, installationId)
 		} catch (error) {
 			console.error('Failed to export installation:', error)
 		}
 	}
 
 	async function handleImportInstallation() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		try {
-			await importInstallation($workspaceStore, githubState.importJwt, () => {
+			await importInstallation($operatingWorkspace, githubState.importJwt, () => {
 				githubState.importJwt = ''
-				loadGithubInstallations(githubState, $workspaceStore!)
+				loadGithubInstallations(githubState, $operatingWorkspace!)
 			})
 		} catch (error) {
 			console.error('Failed to import installation:', error)
@@ -160,17 +168,17 @@
 	}
 
 	function handleRefreshInstallations() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
-		loadGithubInstallations(githubState, $workspaceStore).catch((error) => {
+		loadGithubInstallations(githubState, $operatingWorkspace).catch((error) => {
 			console.error('Failed to refresh installations:', error)
 		})
 	}
 
 	function handleInstallClickWithPopover() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
-		handleInstallClick(githubState, $workspaceStore, () => {
+		handleInstallClick(githubState, $operatingWorkspace, () => {
 			githubAppPopover?.open()
 		})
 	}
@@ -297,9 +305,9 @@
 										target="_blank"
 										disabled={githubState.isCheckingInstallation}
 										on:click={() => {
-											if ($workspaceStore) {
-												startInstallationCheck(githubState, $workspaceStore, () =>
-													loadGithubInstallations(githubState, $workspaceStore!)
+											if ($operatingWorkspace) {
+												startInstallationCheck(githubState, $operatingWorkspace, () =>
+													loadGithubInstallations(githubState, $operatingWorkspace!)
 												)
 											}
 										}}
diff --git a/frontend/src/lib/components/GitLabIntegration.svelte b/frontend/src/lib/components/GitLabIntegration.svelte
index 66dcaa9ff7..71ef23a633 100644
--- a/frontend/src/lib/components/GitLabIntegration.svelte
+++ b/frontend/src/lib/components/GitLabIntegration.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { workspaceStore, userStore, enterpriseLicense } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { GitSyncService, type GitlabProject } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Popover from './meltComponents/Popover.svelte'
@@ -8,6 +8,14 @@
 	import TextInput from './text_input/TextInput.svelte'
 	import Select from './select/Select.svelte'
 	import { GitBranch, Gitlab, Loader2 } from 'lucide-svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		resourceType: string
@@ -30,7 +38,7 @@
 		onArgsUpdate
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let baseUrl = $state('https://gitlab.com')
 	let token = $state('')
@@ -50,7 +58,7 @@
 	let show = $derived(
 		resourceType === 'git_repository' &&
 			!!ws &&
-			($userStore?.is_admin || $userStore?.is_super_admin)
+			(actingUser?.is_admin || actingUser?.is_super_admin)
 	)
 	// The project listing is served by an enterprise-only route, so on a build
 	// without it the form's first request would 404. The button still shows,
diff --git a/frontend/src/lib/components/GitRepoPopoverPicker.svelte b/frontend/src/lib/components/GitRepoPopoverPicker.svelte
index f8050a90a2..a8eeeb3fe9 100644
--- a/frontend/src/lib/components/GitRepoPopoverPicker.svelte
+++ b/frontend/src/lib/components/GitRepoPopoverPicker.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Popover } from './meltComponents'
 	import { GitBranch, Loader2 } from 'lucide-svelte'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isOpen?: boolean
@@ -20,12 +22,12 @@
 	let gitRepoResources = $state<{ path: string; description?: string }[]>([])
 
 	async function loadGitRepoResources() {
-		if (!$workspaceStore || loading) return
+		if (!$operatingWorkspace || loading) return
 
 		loading = true
 		try {
 			const resources = await ResourceService.listResource({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				resourceType: 'git_repository'
 			})
 
@@ -39,7 +41,7 @@
 	}
 
 	$effect(() => {
-		if (isOpen && $workspaceStore) {
+		if (isOpen && $operatingWorkspace) {
 			untrack(() => loadGitRepoResources())
 		}
 	})
diff --git a/frontend/src/lib/components/GitRepoResourcePicker.svelte b/frontend/src/lib/components/GitRepoResourcePicker.svelte
index 8e49190526..96f7185bf2 100644
--- a/frontend/src/lib/components/GitRepoResourcePicker.svelte
+++ b/frontend/src/lib/components/GitRepoResourcePicker.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import { HelpersService, ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Button, Drawer, DrawerContent } from './common'
 	import { GitBranch, Loader2, FolderOpen } from 'lucide-svelte'
 	import Select from './select/Select.svelte'
 	import { createEventDispatcher } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open: boolean
@@ -27,7 +29,7 @@
 		workspace: workspaceProp = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspaceProp ?? $workspaceStore)
+	let ws = $derived(workspaceProp ?? $operatingWorkspace)
 
 	const dispatch = createEventDispatcher<{
 		selected: {
diff --git a/frontend/src/lib/components/GitRepoViewer.svelte b/frontend/src/lib/components/GitRepoViewer.svelte
index 8383748e5f..53ddea2a96 100644
--- a/frontend/src/lib/components/GitRepoViewer.svelte
+++ b/frontend/src/lib/components/GitRepoViewer.svelte
@@ -3,11 +3,13 @@
 	import { untrack } from 'svelte'
 	import { Alert, Button } from './common'
 	import S3FilePickerInner from './S3FilePickerInner.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { Loader, Loader2, ChevronDown, ChevronRight, ExternalLink } from 'lucide-svelte'
 	import { hubPaths } from '$lib/hub'
 	import { sleep } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const CLONE_MARKER_FILE = '.windmill_clone_complete'
 	const POLL_INTERVAL_MS = 1500
@@ -42,7 +44,7 @@
 		workspace: workspaceProp = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspaceProp ?? $workspaceStore)
+	let ws = $derived(workspaceProp ?? $operatingWorkspace)
 
 	let commitHash = $derived(commitHashInput)
 
diff --git a/frontend/src/lib/components/GroupEditor.svelte b/frontend/src/lib/components/GroupEditor.svelte
index 4fc881be5f..f8d0445840 100644
--- a/frontend/src/lib/components/GroupEditor.svelte
+++ b/frontend/src/lib/components/GroupEditor.svelte
@@ -6,7 +6,7 @@
 		type Group,
 		type InstanceGroup
 	} from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { onMount, tick, untrack } from 'svelte'
 	import { Button } from './common'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
@@ -34,6 +34,14 @@
 		type GroupDraft,
 		type GroupRole
 	} from '$lib/groupDraft'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const ROLE_TOOLTIPS = {
 		member:
@@ -74,10 +82,18 @@
 	}: Props = $props()
 
 	const restricted = $derived(
-		isDemoWorkspaceRestricted($workspaceStore, $userStore?.is_admin, $userStore?.is_super_admin)
+		isDemoWorkspaceRestricted($operatingWorkspace, actingUser?.is_admin, actingUser?.is_super_admin)
 	)
 
-	let can_write = $state(false)
+	let groupPerms = $state<Record<string, boolean> | undefined>(undefined)
+	// A verdict that does not come from a loaded group: a new one is writable, one that failed
+	// to load is not.
+	let writeVerdict = $state<boolean | undefined>(undefined)
+	// Derived for the same reason as the trigger editors: the acting user's role can land after
+	// the group does, and a snapshot taken first would stay read-only.
+	const can_write = $derived(
+		writeVerdict ?? (groupPerms !== undefined && canWrite(name, groupPerms, actingUser))
+	)
 	let group: Group | undefined
 	let instance_group: InstanceGroup | undefined = $state()
 	let usernames: string[] = $state([])
@@ -123,11 +139,11 @@
 	}
 
 	async function loadUsernames(): Promise<void> {
-		usernames = await UserService.listUsernames({ workspace: $workspaceStore! })
+		usernames = await UserService.listUsernames({ workspace: $operatingWorkspace! })
 	}
 
 	async function loadGroupNames(): Promise<void> {
-		groupNames = (await GroupService.listGroupNames({ workspace: $workspaceStore! })) ?? []
+		groupNames = (await GroupService.listGroupNames({ workspace: $operatingWorkspace! })) ?? []
 	}
 
 	async function loadInstanceGroup(): Promise<void> {
@@ -142,7 +158,7 @@
 		loadAside(loadUsernames)
 		if (isNew) {
 			loadAside(loadGroupNames)
-			can_write = true
+			writeVerdict = true
 			setDraft(emptyDraft())
 			loaded = true
 		} else {
@@ -159,8 +175,9 @@
 		const apply = (value: GroupDraft) =>
 			opts?.baselineOnly ? (baseline = structuredClone(value)) : setDraft(value)
 		try {
-			group = await GroupService.getGroup({ workspace: $workspaceStore!, name })
-			can_write = canWrite(name, group.extra_perms ?? {}, $userStore)
+			group = await GroupService.getGroup({ workspace: $operatingWorkspace!, name })
+			groupPerms = group.extra_perms ?? {}
+			writeVerdict = undefined
 			apply({
 				summary: group.summary ?? '',
 				members: Array.from(
@@ -179,7 +196,7 @@
 			sendUserToast(e?.body ?? String(e), true)
 			// Only the opening read decides this. Revoking it on a failed reconcile would
 			// disable Save against a draft that is still dirty, with nothing left to reload.
-			if (!opts?.baselineOnly) can_write = false
+			if (!opts?.baselineOnly) writeVerdict = false
 		} finally {
 			loaded = true
 		}
@@ -245,7 +262,7 @@
 	 * membership goes through the endpoints that name who was added or promoted — which is
 	 * what the permission history reads back. The diff itself is in `groupDraft.ts`. */
 	async function applyMemberChanges(next: GroupDraft['members'], prev: GroupDraft['members']) {
-		const workspace = $workspaceStore ?? ''
+		const workspace = $operatingWorkspace ?? ''
 		for (const call of groupMemberDiff(prev, next, $userStore?.username)) {
 			switch (call.kind) {
 				case 'addUser':
@@ -289,7 +306,7 @@
 		try {
 			if (created) {
 				await GroupService.createGroup({
-					workspace: $workspaceStore ?? '',
+					workspace: $operatingWorkspace ?? '',
 					requestBody: { name, summary: next.summary }
 				})
 				alreadyCreated = true
@@ -299,7 +316,7 @@
 			} else {
 				if (next.summary !== prev.summary) {
 					await GroupService.updateGroup({
-						workspace: $workspaceStore ?? '',
+						workspace: $operatingWorkspace ?? '',
 						name,
 						requestBody: { summary: next.summary }
 					})
@@ -335,7 +352,7 @@
 	let loadStarted = false
 	$effect.pre(() => {
 		if (loadStarted) return
-		if ($workspaceStore && $userStore) {
+		if ($operatingWorkspace && $userStore) {
 			loadStarted = true
 			untrack(() => {
 				load()
diff --git a/frontend/src/lib/components/HistoricInputs.svelte b/frontend/src/lib/components/HistoricInputs.svelte
index 85f2603005..48d1290356 100644
--- a/frontend/src/lib/components/HistoricInputs.svelte
+++ b/frontend/src/lib/components/HistoricInputs.svelte
@@ -7,7 +7,9 @@
 	import { DataTable } from '$lib/components/table'
 	import HistoricList from './HistoricList.svelte'
 	import { Loader2 } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		runnableId?: string | undefined
@@ -32,7 +34,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let historicList: HistoricList | undefined = $state(undefined)
 	const dispatch = createEventDispatcher()
diff --git a/frontend/src/lib/components/HistoricList.svelte b/frontend/src/lib/components/HistoricList.svelte
index bb34daee77..89da866fc2 100644
--- a/frontend/src/lib/components/HistoricList.svelte
+++ b/frontend/src/lib/components/HistoricList.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { InputService, type RunnableType } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { onDestroy, untrack } from 'svelte'
 	import InfiniteList from './InfiniteList.svelte'
 	import JobSchemaPicker from './schema/JobSchemaPicker.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		runnableId: string | undefined
@@ -52,7 +54,7 @@
 		refreshInterval()
 		loadInputsPageFn = async (page: number, perPage: number) => {
 			const inputs = await InputService.getInputHistory({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				runnableId,
 				runnableType,
 				page,
@@ -109,7 +111,7 @@
 		if (!id) return
 		const payloadData = await InputService.getArgsFromHistoryOrSavedInput({
 			jobOrInputId: id,
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			input,
 			allowLarge
 		})
@@ -122,7 +124,11 @@
 	}
 
 	$effect(() => {
-		$workspaceStore && runnableId && runnableType && infiniteList && untrack(() => initLoadInputs())
+		$operatingWorkspace &&
+			runnableId &&
+			runnableType &&
+			infiniteList &&
+			untrack(() => initLoadInputs())
 	})
 </script>
 
diff --git a/frontend/src/lib/components/InputTransformPickers.svelte b/frontend/src/lib/components/InputTransformPickers.svelte
index 199039fb67..d50a63786a 100644
--- a/frontend/src/lib/components/InputTransformPickers.svelte
+++ b/frontend/src/lib/components/InputTransformPickers.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
 	import { VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { watch } from 'runed'
 	import { Plus } from 'lucide-svelte'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
 	import VariableEditor from './VariableEditor.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/** The transforms being edited. A picked variable is written into `pickForField`'s. */
@@ -26,7 +28,7 @@
 		variableEditor = $bindable()
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	watch(
 		() => ws,
diff --git a/frontend/src/lib/components/InputTransformSchemaForm.svelte b/frontend/src/lib/components/InputTransformSchemaForm.svelte
index 31f2eb0054..0a5091323c 100644
--- a/frontend/src/lib/components/InputTransformSchemaForm.svelte
+++ b/frontend/src/lib/components/InputTransformSchemaForm.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import type { Schema } from '$lib/common'
 	import { type InputTransform } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
 	import { untrack } from 'svelte'
 	import StepInputsGen from './copilot/StepInputsGen.svelte'
@@ -12,6 +11,9 @@
 	import type ItemPicker from './ItemPicker.svelte'
 	import type VariableEditor from './VariableEditor.svelte'
 	import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any> }
@@ -54,7 +56,7 @@
 		workspace
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let inputCheck: { [id: string]: boolean } = $state({})
 
diff --git a/frontend/src/lib/components/JobLoader.svelte b/frontend/src/lib/components/JobLoader.svelte
index 71bd2fbb51..324bdea6c7 100644
--- a/frontend/src/lib/components/JobLoader.svelte
+++ b/frontend/src/lib/components/JobLoader.svelte
@@ -14,7 +14,6 @@
 		type WorkflowStatus,
 		type OpenFlow
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getViewToken } from '$lib/viewToken'
 	import { WM_LOGS_SKIPPED } from '$lib/consts'
 	import { getContext, onDestroy, tick, untrack } from 'svelte'
@@ -22,6 +21,9 @@
 	import { sendUserToast } from '$lib/toast'
 	import { DynamicInput, isScriptPreview } from '$lib/utils'
 	import { getActiveReplay, getReplayStartTime } from './recording/replay.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// Will be set to number if job is not a flow
 
@@ -75,7 +77,7 @@
 		children
 	}: Props = $props()
 
-	let workspace = $derived(workspaceOverride ?? $workspaceStore)
+	let workspace = $derived(workspaceOverride ?? $operatingWorkspace)
 
 	let syncIteration: number = 0
 	let errorIteration = 0
diff --git a/frontend/src/lib/components/JobOtelTraces.svelte b/frontend/src/lib/components/JobOtelTraces.svelte
index d57a7158e1..9332abdff1 100644
--- a/frontend/src/lib/components/JobOtelTraces.svelte
+++ b/frontend/src/lib/components/JobOtelTraces.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { Alert, Skeleton } from './common'
 	import { Activity } from 'lucide-svelte'
 	import { JobService } from '$lib/gen'
 	import { msToReadableTime } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// OTEL SpanKind enum values from opentelemetry-proto/opentelemetry/proto/trace/v1/trace.proto
 	const SpanKind = {
@@ -54,14 +56,14 @@
 	})
 
 	async function loadTraces() {
-		if (!$workspaceStore || !jobId) return
+		if (!$operatingWorkspace || !jobId) return
 
 		loading = true
 		error = null
 
 		try {
 			const response = await JobService.getJobOtelTraces({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				id: jobId
 			})
 			traces = response as unknown as OtelSpan[]
@@ -123,12 +125,18 @@
 
 	function getKindLabel(kind: number): string {
 		switch (kind) {
-			case SpanKind.INTERNAL: return 'Internal'
-			case SpanKind.SERVER: return 'Server'
-			case SpanKind.CLIENT: return 'Client'
-			case SpanKind.PRODUCER: return 'Producer'
-			case SpanKind.CONSUMER: return 'Consumer'
-			default: return 'Unknown'
+			case SpanKind.INTERNAL:
+				return 'Internal'
+			case SpanKind.SERVER:
+				return 'Server'
+			case SpanKind.CLIENT:
+				return 'Client'
+			case SpanKind.PRODUCER:
+				return 'Producer'
+			case SpanKind.CONSUMER:
+				return 'Consumer'
+			default:
+				return 'Unknown'
 		}
 	}
 
@@ -182,17 +190,15 @@
 			<Activity size={48} class="mb-4 opacity-50" />
 			<p class="text-lg font-medium">No HTTP requests captured</p>
 			<p class="text-sm mt-2">
-				This job did not make any HTTP/HTTPS requests, or HTTP Request Tracing is not enabled in instance settings.
+				This job did not make any HTTP/HTTPS requests, or HTTP Request Tracing is not enabled in
+				instance settings.
 			</p>
 		</div>
 	{:else}
 		<div class="space-y-4">
 			<div class="flex items-center justify-between">
 				<h3 class="text-lg font-semibold">Traces ({traces.length} spans)</h3>
-				<button
-					class="text-sm text-blue-600 hover:underline"
-					onclick={loadTraces}
-				>
+				<button class="text-sm text-blue-600 hover:underline" onclick={loadTraces}>
 					Refresh
 				</button>
 			</div>
@@ -219,10 +225,7 @@
 						{@const statusCode = span.status?.code ?? 0}
 
 						<div class="hover:bg-surface-hover">
-							<button
-								class="w-full px-4 py-2 text-left"
-								onclick={() => toggleSpan(span.span_id)}
-							>
+							<button class="w-full px-4 py-2 text-left" onclick={() => toggleSpan(span.span_id)}>
 								<div class="grid grid-cols-12 gap-2 items-center">
 									<div class="col-span-4 flex items-center gap-2">
 										<span class="text-xs text-secondary">
@@ -293,7 +296,9 @@
 													{#each Object.entries(parsedAttrs) as [key, value]}
 														<div class="flex gap-2">
 															<span class="text-secondary font-medium shrink-0">{key}:</span>
-															<span class="font-mono break-all">{typeof value === 'object' ? JSON.stringify(value) : value}</span>
+															<span class="font-mono break-all"
+																>{typeof value === 'object' ? JSON.stringify(value) : value}</span
+															>
 														</div>
 													{/each}
 												</div>
diff --git a/frontend/src/lib/components/LabelsInput.svelte b/frontend/src/lib/components/LabelsInput.svelte
index c7eda30d66..cd85b9fd76 100644
--- a/frontend/src/lib/components/LabelsInput.svelte
+++ b/frontend/src/lib/components/LabelsInput.svelte
@@ -2,7 +2,9 @@
 	import Badge from './common/badge/Badge.svelte'
 	import Button from './common/button/Button.svelte'
 	import { Plus, Tag, X } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		labels: string[] | undefined
@@ -53,7 +55,7 @@
 
 	async function loadExistingLabels() {
 		try {
-			const resp = await fetch(`/api/w/${workspace ?? $workspaceStore}/labels/list`)
+			const resp = await fetch(`/api/w/${workspace ?? $operatingWorkspace}/labels/list`)
 			if (resp.ok) existingLabels = await resp.json()
 		} catch {}
 	}
diff --git a/frontend/src/lib/components/LightweightResourcePicker.svelte b/frontend/src/lib/components/LightweightResourcePicker.svelte
index 58557e8c8b..14a7228ef5 100644
--- a/frontend/src/lib/components/LightweightResourcePicker.svelte
+++ b/frontend/src/lib/components/LightweightResourcePicker.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, untrack } from 'svelte'
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { Button, Drawer, DrawerContent } from './common'
@@ -11,6 +10,9 @@
 	import IconedResourceType from './IconedResourceType.svelte'
 	import { addResourceTitle } from './resourceTypeDisplay'
 	import { loadResourceTypeDisplayName } from './displayNameLoaders'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value: string | undefined
@@ -35,7 +37,7 @@
 	let open = $state(false)
 	let refreshCount = $state(0)
 	const appViewerContext = getContext<AppViewerContext>('AppViewerContext')
-	let ws = $derived(workspace ?? appViewerContext?.workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? appViewerContext?.workspace ?? $operatingWorkspace)
 
 	let collection = $state(value ? [{ value, label: value }] : [])
 
@@ -139,7 +141,7 @@
 				title="App connection"
 				class="w-full h-full"
 				src="{base}/embed_connect?resource_type={resourceType}&workspace={appViewerContext?.workspace ??
-					$workspaceStore}&express=false"
+					$operatingWorkspace}&express=false"
 			/> -->
 		</DrawerContent>
 	</Drawer>
diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index dbb8015459..be4ecb5b36 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -18,7 +18,6 @@
 	import { withExternalDomain } from '$lib/externalDomain'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { appendViewToken } from '$lib/viewToken'
-	import { workspaceStore } from '$lib/stores'
 	import { AnsiUp } from 'ansi_up'
 	import NoWorkerWithTagWarning from './runs/NoWorkerWithTagWarning.svelte'
 	import { JobService } from '$lib/gen'
@@ -27,6 +26,9 @@
 	import Tooltip from './Tooltip.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import QueuePosition from './QueuePosition.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		content: string | undefined
@@ -111,7 +113,7 @@
 		const id = jobId
 		fetchedSkippedJobId = id
 		untrack(() => {
-			JobService.getJob({ workspace: $workspaceStore ?? '', id })
+			JobService.getJob({ workspace: $operatingWorkspace ?? '', id })
 				.then((j) => {
 					if (fetchedSkippedJobId === id) {
 						const logs = (j as { logs?: string })['logs'] ?? ''
@@ -219,7 +221,7 @@
 		if (downloadStartUrl) {
 			scroll = false
 			let res = (await JobService.getLogFileFromStore({
-				workspace: $workspaceStore ?? '',
+				workspace: $operatingWorkspace ?? '',
 				path: downloadStartUrl
 			})) as string
 			LOG_LIMIT += Math.min(LOG_INC, res.length)
@@ -250,7 +252,7 @@
 			fetchedSkippedJobId = undefined
 		}
 	})
-	let logsApiPath = $derived(appendViewToken(`/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`))
+	let logsApiPath = $derived(appendViewToken(`/w/${$operatingWorkspace}/jobs_u/get_logs/${jobId}`))
 	let downloadHref = $derived(withExternalDomain(`${base}/api${logsApiPath}`))
 	let downloadName = $derived(`windmill_logs_${jobId}.txt`)
 	let truncatedContent = $derived(
diff --git a/frontend/src/lib/components/ModulePreviewForm.svelte b/frontend/src/lib/components/ModulePreviewForm.svelte
index e71bf11b58..093661c1e8 100644
--- a/frontend/src/lib/components/ModulePreviewForm.svelte
+++ b/frontend/src/lib/components/ModulePreviewForm.svelte
@@ -14,9 +14,11 @@
 	import type SimpleEditor from './SimpleEditor.svelte'
 	import { getResourceTypes } from './resourceTypesStore'
 	import { twMerge } from 'tailwind-merge'
-	import { workspaceStore } from '$lib/stores'
 	import { AGENT_FIELDS, initialVisibleAgentFields } from './flows/agentFormFields'
 	import { openAgentFields } from './flows/content/AiAgentStepInputs.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any>; required?: string[] }
@@ -47,7 +49,7 @@
 	const { stepsInputArgs, flowStateStore, flowStore, previewArgs, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	let inputCheck: { [id: string]: boolean } = $state({})
 	$effect(() => {
diff --git a/frontend/src/lib/components/ModuleTest.svelte b/frontend/src/lib/components/ModuleTest.svelte
index 41199989d2..491c625d09 100644
--- a/frontend/src/lib/components/ModuleTest.svelte
+++ b/frontend/src/lib/components/ModuleTest.svelte
@@ -7,7 +7,6 @@
 		type JavascriptTransform,
 		type Job
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getScriptByPath } from '$lib/scripts'
 	import { getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from './flows/types'
@@ -23,6 +22,9 @@
 	import { AGENT_FLOW_LOCAL_KEYS } from './flows/agentResourceUtils'
 	import { AGENT_HISTORY_KEYS } from './flows/agentFormFields'
 	import { sendUserToast } from '$lib/toast'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		mod: FlowModule
@@ -56,7 +58,7 @@
 	let previewBase = $derived($pathStore ?? '')
 
 	// Acting workspace when the flow editor runs in an AI session; else the nav workspace.
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	let jobLoader: JobLoader | undefined = $state(undefined)
 	let jobProgressReset: () => void = () => {}
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index 70a182ea62..f51d9b4536 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -10,9 +10,12 @@
 	import { AppService, HelpersService } from '$lib/gen'
 	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { Loader2 } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// import 'ag-grid-community/dist/styles/ag-theme-alpine-dark.css'
 
@@ -53,7 +56,7 @@
 	// is set, else the viewer-scoped helpers. Same request/response shape either
 	// way — the only difference is which identity authorizes the S3 read.
 	function loadRowCount(searchCol: string | undefined, searchTerm: string | undefined) {
-		const workspace = workspaceId ?? $workspaceStore!
+		const workspace = workspaceId ?? $operatingWorkspace!
 		return appPath
 			? AppService.appLoadTableCount({
 					workspace,
@@ -82,7 +85,7 @@
 		searchTerm?: string
 		csvSeparator?: string
 	}) {
-		const workspace = workspaceId ?? $workspaceStore!
+		const workspace = workspaceId ?? $operatingWorkspace!
 		const csv = s3resource.endsWith('.csv')
 		if (appPath) {
 			const data = {
diff --git a/frontend/src/lib/components/PasswordArgInput.svelte b/frontend/src/lib/components/PasswordArgInput.svelte
index ee1f67e9c3..9c3683f6ad 100644
--- a/frontend/src/lib/components/PasswordArgInput.svelte
+++ b/frontend/src/lib/components/PasswordArgInput.svelte
@@ -1,11 +1,14 @@
 <script lang="ts">
 	import { VariableService } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { ephemeralSecretPrefix, mintEphemeralSecret } from './secretArgUtils'
 	import { sendUserToast } from '$lib/toast'
 	import { Button } from './common'
 	import Password from './Password.svelte'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		value?: string | undefined
@@ -18,7 +21,7 @@
 
 	let { value = $bindable(undefined), disabled, minRows, workspace }: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let path = $state('')
 	// Workspace the variable at `path` actually lives in; `ws` can move away from it.
diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index ee87cc9511..68604a4a91 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -26,7 +26,7 @@
 		AzureTriggerService,
 		EmailTriggerService
 	} from '$lib/gen'
-	import { superadmin, userStore, workspaceStore, type UserExt } from '$lib/stores'
+	import { superadmin, type UserExt } from '$lib/stores'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import { writable } from 'svelte/store'
 	import { Alert, Button } from './common'
@@ -45,6 +45,15 @@
 	import Select from './select/Select.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import InputError from './InputError.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const operatingHref = useOperatingWorkspaceHref()
 
 	type PathKind =
 		| 'resource'
@@ -81,15 +90,12 @@
 		disableEditing?: boolean
 		size?: 'sm' | 'md'
 		drawerOffset?: number
-		/** Workspace the folder list and path-existence checks run against.
-		 *  Defaults to the navigation `$workspaceStore`; pass the session's acting
-		 *  workspace when the editor operates on a workspace other than the one the
-		 *  top nav points at (see the sessions preview / dev-workspace flows). */
+		/** Workspace the folder list and path-existence checks run against. Defaults to the
+		 *  operating workspace (see `useOperatingWorkspace`). */
 		workspaceOverride?: string
 		/** The user acting in `workspaceOverride`, for the owner suggestion and the folder
-		 *  write flags. Omit it to stand in the navigation `$userStore`, who is a member of
-		 *  the navigation workspace only; pass `null` for "not known (yet)", which that user
-		 *  must not answer for either. */
+		 *  write flags. Omit it to stand in the user acting in the operating workspace; pass
+		 *  `null` for "not known (yet)", which no user must answer for. */
 		actingUser?: UserExt | null
 		/** One path that does not count as taken, for a caller creating something that may
 		 *  already have written there itself — a setup flow correcting its own failed attempt.
@@ -121,11 +127,11 @@
 		warnOnRename = true
 	}: Props = $props()
 
-	let ws = $derived(workspaceOverride ?? $workspaceStore)
-	// Sole place this component falls back to the ambient user, and only for a caller that
-	// passed none; everything below reads `user`, so a caller acting on another workspace is
-	// never mixed with the navigation user's memberships.
-	let user = $derived(actingUser === undefined ? $userStore : (actingUser ?? undefined))
+	let ws = $derived(workspaceOverride ?? $operatingWorkspace)
+	// Sole place this component falls back to an ambient user, and only for a caller that passed
+	// none: the one acting in `ws`, never the navigation user, whose memberships belong to
+	// another workspace. Everything below reads `user`.
+	let user = $derived(actingUser === undefined ? operatingUser.in(ws) : (actingUser ?? undefined))
 
 	$effect.pre(() => {
 		if (path == undefined) {
@@ -612,13 +618,13 @@
 					<Tooltip>
 						<ul>
 							{#each scripts || [] as path}
-								<li><a target="_blank" href="/scripts/edit/{path}">{path}</a></li>
+								<li><a target="_blank" href={operatingHref(`/scripts/edit/${path}`)}>{path}</a></li>
 							{/each}
 							{#each flows || [] as path}
-								<li><a target="_blank" href="/flows/edit/{path}">{path}</a></li>
+								<li><a target="_blank" href={operatingHref(`/flows/edit/${path}`)}>{path}</a></li>
 							{/each}
 							{#each apps || [] as path}
-								<li><a target="_blank" href="/apps/edit/{path}">{path}</a></li>
+								<li><a target="_blank" href={operatingHref(`/apps/edit/${path}`)}>{path}</a></li>
 							{/each}
 						</ul>
 					</Tooltip>
@@ -632,21 +638,33 @@
 						<ul class="list-disc">
 							{#each scripts || [] as scriptPath}
 								<li>
-									<a href={`/scripts/edit/${scriptPath}`} class="text-blue-400" target="_blank">
+									<a
+										href={operatingHref(`/scripts/edit/${scriptPath}`)}
+										class="text-blue-400"
+										target="_blank"
+									>
 										{scriptPath}
 									</a>
 								</li>
 							{/each}
 							{#each flows || [] as flowPath}
 								<li>
-									<a href={`/flows/edit/${flowPath}`} class="text-blue-400" target="_blank">
+									<a
+										href={operatingHref(`/flows/edit/${flowPath}`)}
+										class="text-blue-400"
+										target="_blank"
+									>
 										{flowPath}
 									</a>
 								</li>
 							{/each}
 							{#each apps || [] as appPath}
 								<li>
-									<a href={`/apps/edit/${appPath}`} class="text-blue-400" target="_blank">
+									<a
+										href={operatingHref(`/apps/edit/${appPath}`)}
+										class="text-blue-400"
+										target="_blank"
+									>
 										{appPath}
 									</a>
 								</li>
diff --git a/frontend/src/lib/components/PathNameAutocomplete.svelte b/frontend/src/lib/components/PathNameAutocomplete.svelte
index 10d5c10640..1d8bb4bd46 100644
--- a/frontend/src/lib/components/PathNameAutocomplete.svelte
+++ b/frontend/src/lib/components/PathNameAutocomplete.svelte
@@ -87,7 +87,9 @@
 <script lang="ts">
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { untrack } from 'svelte'
 
 	type Props = {
@@ -101,9 +103,8 @@
 		error?: string | boolean
 		textInputClass?: string
 		onkeyup?: (e: KeyboardEvent) => void
-		/** Workspace whose paths feed the autocomplete. Defaults to the navigation
-		 *  `$workspaceStore`; pass the acting workspace when the editor operates on
-		 *  a workspace other than the one the top nav points at. */
+		/** Workspace whose paths feed the autocomplete. Defaults to the operating workspace
+		 *  (see `useOperatingWorkspace`). */
 		workspace?: string
 	}
 
@@ -121,7 +122,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let inputEl: TextInput | undefined = $state(undefined)
 	export function focus() {
diff --git a/frontend/src/lib/components/PermissionHistory.svelte b/frontend/src/lib/components/PermissionHistory.svelte
index 23f3ec151f..82177b87a9 100644
--- a/frontend/src/lib/components/PermissionHistory.svelte
+++ b/frontend/src/lib/components/PermissionHistory.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { untrack } from 'svelte'
 	import TableCustom from './TableCustom.svelte'
 	import Skeleton from './common/skeleton/Skeleton.svelte'
 	import Label from './Label.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface PermissionChange {
 		id?: number
@@ -31,10 +33,10 @@
 	let perPage = $state(50)
 
 	async function loadHistory() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 		loading = true
 		try {
-			history = await fetchHistory($workspaceStore, name, page, perPage)
+			history = await fetchHistory($operatingWorkspace, name, page, perPage)
 		} catch (e) {
 			console.error('Failed to load permission history:', e)
 			history = []
@@ -56,7 +58,7 @@
 	}
 
 	$effect.pre(() => {
-		if ($workspaceStore && name) {
+		if ($operatingWorkspace && name) {
 			untrack(() => {
 				loadHistory()
 			})
@@ -80,13 +82,13 @@
 	{:else}
 		<TableCustom>
 			{#snippet headerRow()}
-								<tr >
+				<tr>
 					<th>Changed By</th>
 					<th>Change Type</th>
 					<th>Affected</th>
 					<th>Date</th>
 				</tr>
-							{/snippet}
+			{/snippet}
 			{#snippet body()}
 				<tbody>
 					{#each history as change}
diff --git a/frontend/src/lib/components/QueuePosition.svelte b/frontend/src/lib/components/QueuePosition.svelte
index 135feae899..61245613d6 100644
--- a/frontend/src/lib/components/QueuePosition.svelte
+++ b/frontend/src/lib/components/QueuePosition.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
 	import { JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { forLater, getDbClockNow } from '$lib/forLater'
 	import { displayDate } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		jobId,
@@ -15,7 +17,7 @@
 
 	let fetchingQueuePosition = false
 
-	let workspace = $derived(workspaceId ?? $workspaceStore)
+	let workspace = $derived(workspaceId ?? $operatingWorkspace)
 
 	let scheduledFor = $state(undefined) as undefined | number
 
diff --git a/frontend/src/lib/components/ResourceEditor.svelte b/frontend/src/lib/components/ResourceEditor.svelte
index bcb886ee7d..d33b31b332 100644
--- a/frontend/src/lib/components/ResourceEditor.svelte
+++ b/frontend/src/lib/components/ResourceEditor.svelte
@@ -9,7 +9,6 @@
 	} from '$lib/gen'
 	import { canWrite } from '$lib/utils'
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { clearJsonSchemaResourceCache } from './schema/jsonSchemaResource.svelte'
 	import ResourceForm from './ResourceForm.svelte'
@@ -22,6 +21,9 @@
 	import { UserDraftDbSyncer } from '$lib/userDraftDbSyncer.svelte'
 	import { setLocalDraftHint } from '$lib/localDraftHints.svelte'
 	import { onUserInput } from '$lib/userDraftEditGate'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		canSave?: boolean
@@ -74,7 +76,7 @@
 
 	// Sole ambient read in this file: the acting workspace is an input, and only its
 	// default comes from the navigation store.
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 	// Fallback to `effectiveWorkspace` insulates against reactify-style
 	// parents that re-spread props without `selected` — otherwise it
 	// transiently resets and the form below remounts on every keystroke.
@@ -471,6 +473,12 @@
 		current.path = npath
 	}
 
+	/** The path the resource has in `ws`: after a save, the one it was saved under. Each
+	 * workspace-specific version keeps its own, so the selected one says nothing about `ws`. */
+	export function pathIn(ws: string): string | undefined {
+		return initialStates[ws]?.path
+	}
+
 	/** Whether the write landed. It toasts its own failure, so most callers ignore this;
 	 * one that follows the save with bookkeeping of its own has to know not to. */
 	export async function save(): Promise<boolean> {
diff --git a/frontend/src/lib/components/ResourceEditorDrawer.svelte b/frontend/src/lib/components/ResourceEditorDrawer.svelte
index 052c8c9e92..7259fff633 100644
--- a/frontend/src/lib/components/ResourceEditorDrawer.svelte
+++ b/frontend/src/lib/components/ResourceEditorDrawer.svelte
@@ -5,13 +5,13 @@
 
 	import { History, Loader2, Save } from 'lucide-svelte'
 	import WsSpecificVersions from './WsSpecificVersions.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { isOwner } from '$lib/utils'
 	import { useActingUser } from '$lib/actingUser.svelte'
 	import LocalDraftBanner from './LocalDraftBanner.svelte'
 	import OpenInSessionButton from './sessions/OpenInSessionButton.svelte'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		pageDrawerSessionSource,
 		setPageDrawerAnchor
 	} from './sessions/pageDrawerSession'
@@ -20,10 +20,15 @@
 	import IconedResourceType from './IconedResourceType.svelte'
 	import { addResourceTitle } from './resourceTypeDisplay'
 	import { loadResourceTypeDisplayName } from './displayNameLoaders'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		workspace = undefined,
 		disableChatOffset = false,
+		inline = false,
+		onClose = undefined,
 		onRestored = undefined,
 		onSaved = undefined
 	}: {
@@ -31,10 +36,17 @@
 		 * once, at `effectiveWorkspace`, and nowhere else in this file. */
 		workspace?: string
 		disableChatOffset?: boolean
+		/** Render in place, filling the parent, with no drawer or close button — for a host
+		 * that gives the editor a whole pane. Saving and restoring then leave it open: the
+		 * host remounts it on what was written. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		onRestored?: () => void
 		/** Fires after Save has written, for a caller showing state derived from the
-		 * resource — `onRestored` only covers restoring an old version. */
-		onSaved?: () => void
+		 * resource — `onRestored` only covers restoring an old version. `path` is where the
+		 * resource now lives in this drawer's workspace, undefined when the save failed. */
+		onSaved?: (path: string | undefined) => void
 	} = $props()
 
 	let drawer: Drawer | undefined = $state()
@@ -45,7 +57,8 @@
 
 	let resourceEditor:
 		| {
-				save: () => void
+				save: () => Promise<boolean>
+				pathIn: (ws: string) => string | undefined
 				localDraftDeployed: () => unknown
 				localDraftCurrent: () => unknown
 				discardLocalDraft: () => void
@@ -58,7 +71,7 @@
 	let selected: string | undefined = $state(undefined)
 	let viewJsonSchema = $state(false)
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 	// The editor renders whichever workspace-specific variant `selected` points at, so history has
 	// to follow it too — otherwise a restore would write over the variant the user is not looking at.
 	let historyWorkspace = $derived(selected ?? effectiveWorkspace)
@@ -85,6 +98,7 @@
 	 *  dedicated editor elsewhere: the generic form would render its configuration field by field,
 	 *  and materialize a default into every one the value leaves out. */
 	export async function initEdit(p: string, opts?: { json?: boolean }): Promise<void> {
+		if (handOffPageDrawer(RESOURCES_PATH, p)) return
 		// A `close({ keepAnchor })` on an already-closed drawer emits no close event, so the flag
 		// would still be standing when the next drawer session ends and would swallow that one's
 		// anchor clear. Every session starts having to clear its own.
@@ -126,22 +140,35 @@
 	)
 </script>
 
-<Drawer
-	bind:this={drawer}
-	size="50rem"
-	{disableChatOffset}
-	on:close={() => {
-		if (keepAnchorOnClose) {
-			keepAnchorOnClose = false
-			return
-		}
-		clearPageDrawerAnchor(RESOURCES_PATH)
-	}}
->
+{#if inline}
+	<!-- ResourceEditor reads its path once, at mount — a drawer mounts it only when opened. -->
+	{#if path !== undefined || resource_type !== undefined}
+		{@render content()}
+	{/if}
+{:else}
+	<Drawer
+		bind:this={drawer}
+		size="50rem"
+		{disableChatOffset}
+		on:close={() => {
+			if (keepAnchorOnClose) {
+				keepAnchorOnClose = false
+				return
+			}
+			clearPageDrawerAnchor(RESOURCES_PATH)
+		}}
+	>
+		{@render content()}
+	</Drawer>
+{/if}
+
+{#snippet content()}
 	<DrawerContent
 		title={mode == 'edit' ? 'Edit ' + path : addResourceTitle(resource_type)}
 		bannerReserved={mode == 'edit'}
-		on:close={drawer?.closeDrawer}
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet titleExtra()}
 			{#if mode == 'new' && resource_type}
@@ -201,10 +228,10 @@
 					// Closed before the write is awaited, the way it always was: `save()` toasts its
 					// own failures and never rejects, so waiting would only add visible lag to every
 					// caller of this drawer. `onSaved` still fires after the write lands.
-					const saved = resourceEditor?.save()
+					const editor = resourceEditor
+					const saved = editor?.save()
 					drawer?.closeDrawer()
-					await saved
-					onSaved?.()
+					onSaved?.((await saved) ? editor?.pathIn(effectiveWorkspace) : undefined)
 				}}
 				disabled={!canSave}
 			>
@@ -212,7 +239,7 @@
 			</Button>
 		{/snippet}
 	</DrawerContent>
-</Drawer>
+{/snippet}
 
 <Drawer bind:this={historyDrawer} size="1200px">
 	<DrawerContent title="Versions History" on:close={historyDrawer?.closeDrawer} noPadding>
diff --git a/frontend/src/lib/components/ResourceForm.svelte b/frontend/src/lib/components/ResourceForm.svelte
index df878280a7..1d4f091236 100644
--- a/frontend/src/lib/components/ResourceForm.svelte
+++ b/frontend/src/lib/components/ResourceForm.svelte
@@ -8,7 +8,7 @@
 	import { Alert, Skeleton } from './common'
 	import Path from './Path.svelte'
 	import LabelsInput from './LabelsInput.svelte'
-	import { workspaceStore, type UserExt } from '$lib/stores'
+	import { type UserExt } from '$lib/stores'
 	import SchemaForm from './SchemaForm.svelte'
 	import SimpleEditor from './SimpleEditor.svelte'
 	import FilesetEditor from './FilesetEditor.svelte'
@@ -22,6 +22,9 @@
 	import SyncResourceTypes from './SyncResourceTypes.svelte'
 	import Label from './Label.svelte'
 	import ResourcePathHint from './ResourcePathHint.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -81,7 +84,7 @@
 		onCredentialStored
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let rawCode: string | undefined = $state(undefined)
 	let textFileContent: string = $state('')
diff --git a/frontend/src/lib/components/ResourcePicker.svelte b/frontend/src/lib/components/ResourcePicker.svelte
index 06023b1bb4..778c1d2614 100644
--- a/frontend/src/lib/components/ResourcePicker.svelte
+++ b/frontend/src/lib/components/ResourcePicker.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { ResourceService, WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { onMount, untrack } from 'svelte'
 	import AppConnect from './AppConnectDrawer.svelte'
 	import ResourceEditorDrawer from './ResourceEditorDrawer.svelte'
@@ -12,6 +11,9 @@
 	import ExploreAssetButton, { assetCanBeExplored } from './ExploreAssetButton.svelte'
 	import DropdownV2 from './DropdownV2.svelte'
 	import { appIconComponent } from './icons'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		initialValue?: string | undefined
@@ -62,7 +64,7 @@
 		onValueChange = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 
 	if (initialValue && value == undefined) {
 		value = initialValue
diff --git a/frontend/src/lib/components/ResourceTypePicker.svelte b/frontend/src/lib/components/ResourceTypePicker.svelte
index 35d6593635..b03723bf0d 100644
--- a/frontend/src/lib/components/ResourceTypePicker.svelte
+++ b/frontend/src/lib/components/ResourceTypePicker.svelte
@@ -2,7 +2,6 @@
 	import { createEventDispatcher } from 'svelte'
 
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import { Button, ClearableInput } from './common'
 	import Label from './Label.svelte'
@@ -14,6 +13,9 @@
 		setResourceTypeDisplayNames,
 		sortResourceTypesByMatch
 	} from './resourceTypeDisplay'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	interface Props {
 		value: string | undefined
 		notPickable?: boolean
@@ -25,7 +27,7 @@
 	let resources: { name: string; description?: string; searchText: string }[] = $state([])
 
 	async function loadResources() {
-		const types = await ResourceService.listResourceType({ workspace: $workspaceStore! })
+		const types = await ResourceService.listResourceType({ workspace: $operatingWorkspace! })
 		setResourceTypeDisplayNames(types)
 		resources = types.map((t) => ({
 			name: t.name,
@@ -42,7 +44,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			untrack(() => {
 				loadResources()
 			})
diff --git a/frontend/src/lib/components/ResourceVersionHistory.svelte b/frontend/src/lib/components/ResourceVersionHistory.svelte
index 9f73e7dda1..383ab93a5e 100644
--- a/frontend/src/lib/components/ResourceVersionHistory.svelte
+++ b/frontend/src/lib/components/ResourceVersionHistory.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { ResourceService, type ResourceVersion } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import Button from './common/button/Button.svelte'
 	import HighlightCode from './HighlightCode.svelte'
@@ -12,6 +11,9 @@
 	import VersionListItem from './VersionListItem.svelte'
 	import { displayDate } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		path,
@@ -27,7 +29,7 @@
 		onRestore?: () => void
 	} = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore!)
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace!)
 
 	let versions = $state<ResourceVersion[] | undefined>(undefined)
 	// Which row is highlighted, updated on click. `loaded` is dropped the moment the selection
diff --git a/frontend/src/lib/components/S3FilePicker.svelte b/frontend/src/lib/components/S3FilePicker.svelte
index 5006e2df0b..ce1af47118 100644
--- a/frontend/src/lib/components/S3FilePicker.svelte
+++ b/frontend/src/lib/components/S3FilePicker.svelte
@@ -7,7 +7,9 @@
 	import Select from './select/Select.svelte'
 	import { FileUp } from 'lucide-svelte'
 	import { SettingService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { resource } from 'runed'
 
 	interface Props {
@@ -54,7 +56,7 @@
 	 * asset lives in a different workspace than this picker was mounted for. */
 	let workspaceOverride: string | undefined = $state(undefined)
 	let effectiveWorkspace = $derived(workspaceOverride ?? workspace)
-	let ws = $derived(effectiveWorkspace ?? $workspaceStore)
+	let ws = $derived(effectiveWorkspace ?? $operatingWorkspace)
 	let uploadModalOpen = $state(false)
 
 	let allFilesByKey: Record<
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index 5737744034..1bf1b4358a 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -10,7 +10,6 @@
 		Trash,
 		MoveRight
 	} from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		CancelablePromise,
 		HelpersService,
@@ -48,6 +47,9 @@
 	import FileUploadModal from './common/fileUpload/FileUploadModal.svelte'
 	import S3FilePreview from './S3FilePreview.svelte'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let deletionModalOpen = $state(false)
 	let fileDeletionInProgress = $state(false)
@@ -137,7 +139,7 @@
 		testConnectionRequest = HelpersService.datasetStorageTestConnection
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let rootPath = $state(initialRootPath)
 	let rootPathNestingLevel = $derived(1 * (rootPath.split('/').length - 1))
diff --git a/frontend/src/lib/components/S3FilePreview.svelte b/frontend/src/lib/components/S3FilePreview.svelte
index 62c95581e7..411592b936 100644
--- a/frontend/src/lib/components/S3FilePreview.svelte
+++ b/frontend/src/lib/components/S3FilePreview.svelte
@@ -8,7 +8,6 @@
 	// need to hand it a `fileKey`. CSV separator/header are local state so
 	// the user can re-preview the same file with different parsing flags.
 	import { FileX2, Loader2 } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		HelpersService,
 		type CancelablePromise,
@@ -20,6 +19,9 @@
 	import { displayDate, displaySize, emptyString } from '$lib/utils'
 	import { twMerge } from 'tailwind-merge'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		fileKey: string | undefined
@@ -115,7 +117,7 @@
 	// existence after an upstream run completes — moving from the
 	// "not yet materialized" empty state to the actual preview without
 	// requiring the user to re-click the asset.
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	$effect(() => {
 		const key = fileKey
diff --git a/frontend/src/lib/components/SaveInputsButton.svelte b/frontend/src/lib/components/SaveInputsButton.svelte
index 91b583e0da..8d32b01163 100644
--- a/frontend/src/lib/components/SaveInputsButton.svelte
+++ b/frontend/src/lib/components/SaveInputsButton.svelte
@@ -1,12 +1,14 @@
 <script lang="ts">
 	import { displayDate } from '$lib/utils.js'
 	import { InputService, type CreateInput, type RunnableType } from '$lib/gen/index.js'
-	import { workspaceStore } from '$lib/stores.js'
 	import { Button } from '$lib/components/common'
 	import { Save } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/utils.js'
 	import { createEventDispatcher } from 'svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
@@ -30,7 +32,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let savingInputs = $state(false)
 
diff --git a/frontend/src/lib/components/SavedInputsPicker.svelte b/frontend/src/lib/components/SavedInputsPicker.svelte
index a6a49e566e..4749c6745f 100644
--- a/frontend/src/lib/components/SavedInputsPicker.svelte
+++ b/frontend/src/lib/components/SavedInputsPicker.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
 	import { InputService, type Input, type RunnableType } from '$lib/gen/index.js'
-	import { userStore, workspaceStore } from '$lib/stores.js'
+	import { userStore } from '$lib/stores.js'
 	import { sendUserToast } from '$lib/utils.js'
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
 	import { Trash2, Save, Pencil } from 'lucide-svelte'
@@ -12,6 +12,14 @@
 	import InfiniteList from './InfiniteList.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import SavedInputsPickerViewer from './SavedInputsPickerViewer.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		previewArgs?: any
@@ -36,7 +44,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	interface EditableInput extends Input {
 		isEditing?: boolean
@@ -254,8 +262,8 @@
 				{#snippet children({ item, hover })}
 					{@const editOptions =
 						item.created_by == $userStore?.username ||
-						$userStore?.is_admin ||
-						$userStore?.is_super_admin}
+						actingUser?.is_admin ||
+						actingUser?.is_super_admin}
 					<Cell>
 						<div class="center-center">
 							<Save size={12} />
diff --git a/frontend/src/lib/components/SchemaForm.svelte b/frontend/src/lib/components/SchemaForm.svelte
index ddc2f182bc..872ed9711e 100644
--- a/frontend/src/lib/components/SchemaForm.svelte
+++ b/frontend/src/lib/components/SchemaForm.svelte
@@ -4,7 +4,6 @@
 	const bubble = createBubbler()
 	import type { Schema } from '$lib/common'
 	import { VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { allTrue, computeShow, type DynamicInput } from '$lib/utils'
 	import { Button } from './common'
 	import ItemPicker from './ItemPicker.svelte'
@@ -26,6 +25,9 @@
 	import type { ComponentCustomCSS } from './apps/types'
 	import ResizeTransitionWrapper from './common/ResizeTransitionWrapper.svelte'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | any
@@ -122,7 +124,7 @@
 		actions: actions_render = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	const dispatch = createEventDispatcher()
 
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index 948425f281..ba184b5389 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -31,6 +31,10 @@
 		workerTags,
 		workspaceStore
 	} from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 	import {
 		emptySchema,
 		emptyString,
@@ -192,7 +196,10 @@
 	// (forked) workspace, so an embedded editor acts on the session's fork rather
 	// than the navigation workspace ($workspaceStore, which stays put). indicatorPath
 	// is the matching draft path (URL path full-page, session target in preview).
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
 	const indicatorPath = $derived(autosavePath ?? userDraftPath)
 
 	// The shared `workerTags` store caches tags for the navigation workspace. A
@@ -226,8 +233,8 @@
 	let preserveOnBehalfOf = $state(false)
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
-	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
-	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
+	let isDeployer = $derived(actingUser?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
+	let canPreserve = $derived(!!actingUser?.is_admin || !!actingUser?.is_super_admin || isDeployer)
 	let originalOnBehalfOfEmail = $derived(savedScript?.on_behalf_of_email)
 	let originalOnBehalfOfPermissionedAs = $derived(savedScript?.on_behalf_of)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
@@ -759,7 +766,7 @@
 				await deployTriggers(
 					triggersToDeploy,
 					opWorkspace,
-					!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+					!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 					usedTriggerKinds,
 					script.path,
 					true
@@ -1284,7 +1291,7 @@
 	on:confirmed={handleDraftTriggersConfirmed}
 />
 
-{#if !$userStore?.operator}
+{#if !actingUser?.operator}
 	<Drawer
 		placement="right"
 		bind:open={metadataOpen}
diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index f8028aeb1f..06c8a77d20 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -11,7 +11,7 @@
 		type ScriptLang,
 		type ScriptModule
 	} from '$lib/gen'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { copyToClipboard, emptySchema, sendUserToast } from '$lib/utils'
 	import Editor from './Editor.svelte'
 	import { inferArgs, inferAssets, inferAnsibleExecutionMode } from '$lib/infer'
@@ -129,6 +129,9 @@
 	import { resource, watch } from 'runed'
 	import { buildScriptRecording, downloadRecordingJson } from './recording/runRecording'
 	import DropdownV2 from './DropdownV2.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Exported
@@ -226,10 +229,8 @@
 		// built by the pipeline page from the resolved graph. Absent outside the
 		// pipeline editor — the check still runs, just without suppression.
 		schemaContractContext?: SchemaContractGraphContext
-		// Workspace to scope this editor's calls to. Defaults to the nav
-		// `$workspaceStore`; an AI-session live editor passes the session's
-		// acting workspace (a fork) so tests, captures and toolbar lookups hit
-		// the right workspace instead of the nav one.
+		// Workspace to scope this editor's calls to (tests, captures, toolbar lookups).
+		// Defaults to the operating workspace (see `useOperatingWorkspace`).
 		workspaceOverride?: string
 	}
 
@@ -278,7 +279,7 @@
 		workspaceOverride = undefined
 	}: Props = $props()
 
-	let opWs = $derived(workspaceOverride ?? $workspaceStore)
+	let opWs = $derived(workspaceOverride ?? $operatingWorkspace)
 
 	// Publish this editor's hand-off for AI entry points below it (the preview
 	// panel's "AI Fix"), withheld under `disableAi` so an embed that turned AI off
diff --git a/frontend/src/lib/components/ScriptPicker.svelte b/frontend/src/lib/components/ScriptPicker.svelte
index ccc3f04be7..5bc317919a 100644
--- a/frontend/src/lib/components/ScriptPicker.svelte
+++ b/frontend/src/lib/components/ScriptPicker.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { ScriptService, FlowService, type Script, AppService } from '$lib/gen'
 
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { createEventDispatcher, untrack } from 'svelte'
 
@@ -18,6 +17,9 @@
 	import FlowIcon from './home/FlowIcon.svelte'
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { truncate } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		initialPath?: string | undefined
@@ -30,9 +32,8 @@
 		allowEdit?: boolean
 		allowView?: boolean
 		clearable?: boolean
-		/** Workspace to list runnables from. Defaults to the navigation
-		 * `$workspaceStore`; pass the session's acting workspace so a forked
-		 * session lists its own scripts/flows/apps rather than the parent's. */
+		/** Workspace to list runnables from. Defaults to the operating workspace (see
+		 * `useOperatingWorkspace`). */
 		workspace?: string
 	}
 
@@ -50,10 +51,11 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let effectiveWorkspace = $derived(workspace ?? $workspaceStore)
-	// Only carry the workspace onto Edit/View routes when an explicit override
-	// was passed, so existing callers' links are unchanged.
-	let wsParam = $derived(workspace ? `?workspace=${encodeURIComponent(workspace)}` : '')
+	let effectiveWorkspace = $derived(workspace ?? $operatingWorkspace)
+	// Edit/View routes open in the workspace listed here, not wherever the tab lands.
+	let wsParam = $derived(
+		effectiveWorkspace ? `?workspace=${encodeURIComponent(effectiveWorkspace)}` : ''
+	)
 
 	let items: { value: string; label: string }[] = $state([])
 	let drawerViewer: Drawer | undefined = $state()
diff --git a/frontend/src/lib/components/ScriptVersionHistory.svelte b/frontend/src/lib/components/ScriptVersionHistory.svelte
index 693ddef47c..f780b32d97 100644
--- a/frontend/src/lib/components/ScriptVersionHistory.svelte
+++ b/frontend/src/lib/components/ScriptVersionHistory.svelte
@@ -2,7 +2,6 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { emptyString } from '$lib/utils'
 	import { ScriptService, type ScriptHistory } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import FlowModuleScript from './flows/content/FlowModuleScript.svelte'
 	import { createEventDispatcher } from 'svelte'
@@ -11,6 +10,9 @@
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import VersionListItem from './VersionListItem.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
@@ -27,7 +29,7 @@
 	async function loadVersions() {
 		loading = true
 		versions = await ScriptService.getScriptHistoryByPath({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path: scriptPath
 		})
 		loading = false
@@ -42,7 +44,7 @@
 			return
 		}
 		await ScriptService.updateScriptHistory({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path: scriptPath,
 			hash: scriptHash,
 			requestBody: {
diff --git a/frontend/src/lib/components/SqlRepl.svelte b/frontend/src/lib/components/SqlRepl.svelte
index c29b6152c0..d6c2d288e6 100644
--- a/frontend/src/lib/components/SqlRepl.svelte
+++ b/frontend/src/lib/components/SqlRepl.svelte
@@ -3,7 +3,6 @@
 	import Button from './common/button/Button.svelte'
 	import { runScriptAndPollResult } from './jobs/utils'
 	import { writingJobOptions } from './jobs/writingJob'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { untrack } from 'svelte'
 	import { getLanguageByResourceType } from './apps/components/display/dbtable/utils'
@@ -14,6 +13,9 @@
 	import { wrapDucklakeQuery } from './ducklake'
 	import { splitSqlStatements, pruneComments } from './sqlDdl'
 	import DdlMigrationGuard from './DdlMigrationGuard.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		input: DbInput
@@ -39,7 +41,7 @@
 		workspace = undefined,
 		tag = undefined
 	}: Props = $props()
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 	let dbType = $derived(getDbType(input))
 
 	// A datatable REPL targets `datatable://<name>`; surface DDL statements as
diff --git a/frontend/src/lib/components/SummaryPathDisplay.svelte b/frontend/src/lib/components/SummaryPathDisplay.svelte
index 790ca5b0f8..22925e98e7 100644
--- a/frontend/src/lib/components/SummaryPathDisplay.svelte
+++ b/frontend/src/lib/components/SummaryPathDisplay.svelte
@@ -4,13 +4,21 @@
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { updateItemPathAndSummary, checkFlowOnBehalfOf } from './moveRenameManager'
 	import Label from './Label.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 	import InheritedLabels from './InheritedLabels.svelte'
 	import Badge from './common/badge/Badge.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		summary?: string
@@ -36,7 +44,11 @@
 	let editPath = $state('')
 	let dirtyPath = $state(false)
 	let popoverOpen = $state(false)
-	let own = $state(false)
+	let ownPath = $state<string | undefined>(undefined)
+	// Derived: ownership answers about the operating workspace, whose user resolves asynchronously.
+	const own = $derived(
+		ownPath === undefined ? false : isOwner(ownPath, actingUser, $operatingWorkspace)
+	)
 	let onBehalfOfEmail = $state<string | undefined>(undefined)
 	let summaryInput: ReturnType<typeof TextInput> | undefined = $state()
 	let labelsDirty = $state(false)
@@ -47,10 +59,10 @@
 			editSummary = summary ?? ''
 			editPath = path ?? ''
 			labelsDirty = false
-			own = isOwner(path ?? '', $userStore, $workspaceStore)
+			ownPath = path ?? ''
 			onBehalfOfEmail = undefined
-			if (kind === 'flow' && $workspaceStore && path) {
-				checkFlowOnBehalfOf($workspaceStore, path).then((email) => {
+			if (kind === 'flow' && $operatingWorkspace && path) {
+				checkFlowOnBehalfOf($operatingWorkspace, path).then((email) => {
 					onBehalfOfEmail = email
 				})
 			}
@@ -63,7 +75,7 @@
 
 		try {
 			await updateItemPathAndSummary({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				kind,
 				initialPath,
 				newPath,
diff --git a/frontend/src/lib/components/TestConnection.svelte b/frontend/src/lib/components/TestConnection.svelte
index 80ec59d206..105d594ce8 100644
--- a/frontend/src/lib/components/TestConnection.svelte
+++ b/frontend/src/lib/components/TestConnection.svelte
@@ -13,7 +13,9 @@
 	import Button from './common/button/Button.svelte'
 	import Tooltip from './meltComponents/Tooltip.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { tryEvery } from '$lib/utils'
 
 	interface Props {
@@ -268,7 +270,7 @@ export async function main(bucket: any, api_token: string) {
 		loading = true
 
 		const resourceScript = scripts[resourceType]
-		const workspace = workspaceOverride ?? $workspaceStore!
+		const workspace = workspaceOverride ?? $operatingWorkspace!
 		const objectStorageArgs: Record<string, any> | undefined =
 			resourceType in objectStorageBody ? objectStorageBody[resourceType](args) : undefined
 
diff --git a/frontend/src/lib/components/VariableEditor.svelte b/frontend/src/lib/components/VariableEditor.svelte
index 7c935be45c..4808b113a3 100644
--- a/frontend/src/lib/components/VariableEditor.svelte
+++ b/frontend/src/lib/components/VariableEditor.svelte
@@ -1,13 +1,13 @@
 <script lang="ts">
 	import { VariableService, WorkspaceService } from '$lib/gen'
 	import { createEventDispatcher, untrack } from 'svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { Button } from './common'
 	import Drawer from './common/drawer/Drawer.svelte'
 	import DrawerContent from './common/drawer/DrawerContent.svelte'
 	import OpenInSessionButton from './sessions/OpenInSessionButton.svelte'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		pageDrawerSessionSource,
 		setPageDrawerAnchor
 	} from './sessions/pageDrawerSession'
@@ -25,6 +25,9 @@
 	import LocalDraftBanner from './LocalDraftBanner.svelte'
 	import { isEncryptedDraftValue } from '$lib/encryptedDraft'
 	import { setLocalDraftHint } from '$lib/localDraftHints.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 
@@ -38,10 +41,25 @@
 	// The "current" workspace this editor defaults New/Edit actions to. Session
 	// editors pass their acting workspace so secrets are created/updated there
 	// rather than in the navigation workspace.
-	let { workspace = undefined }: { workspace?: string } = $props()
+	let {
+		workspace = undefined,
+		inline = false,
+		onClose = undefined,
+		onSaved = undefined
+	}: {
+		workspace?: string
+		/** Render in place, filling the parent, with no drawer or close button — for a host
+		 * that gives the editor a whole pane. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
+		/** Fires once a save lands, with the path the variable now lives at in `workspace` —
+		 * not in the workspace-specific version selected, which can be another's. */
+		onSaved?: (path: string) => void
+	} = $props()
 	// Sole ambient read in this file: the acting workspace is an input, and only its
 	// default comes from the navigation store.
-	let curWs = $derived(workspace ?? $workspaceStore)
+	let curWs = $derived(workspace ?? $operatingWorkspace)
 
 	let editPath: string | undefined = $state(undefined)
 
@@ -233,6 +251,7 @@
 	}
 
 	export function editVariable(edit_path: string): void {
+		if (handOffPageDrawer(VARIABLES_PATH, edit_path)) return
 		reset()
 		editPath = edit_path
 		selected = curWs!
@@ -256,6 +275,7 @@
 
 	async function save(): Promise<void> {
 		const dirty = dirtyWorkspaces
+		const savedPath = (curWs ? states[curWs]?.draft?.path : undefined) ?? editPath ?? ''
 		try {
 			for (const ws of dirty) {
 				const s = states[ws].draft!
@@ -303,6 +323,7 @@
 			}
 			sendUserToast(edit ? `Updated variable in ${dirty.length} workspace(s)` : `Created variable`)
 			dispatch('create')
+			onSaved?.(savedPath)
 			drawer?.closeDrawer()
 		} catch (err) {
 			sendUserToast(`Could not save variable: ${err.body}`, true)
@@ -310,11 +331,21 @@
 	}
 </script>
 
-<Drawer bind:this={drawer} size="50rem" on:close={() => clearPageDrawerAnchor(VARIABLES_PATH)}>
+{#if inline}
+	{@render content()}
+{:else}
+	<Drawer bind:this={drawer} size="50rem" on:close={() => clearPageDrawerAnchor(VARIABLES_PATH)}>
+		{@render content()}
+	</Drawer>
+{/if}
+
+{#snippet content()}
 	<DrawerContent
 		title={edit ? `Update variable at ${initialPath}` : 'Add a variable'}
 		bannerReserved={edit}
-		on:close={drawer?.closeDrawer}
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
 	>
 		{#snippet banner()}
 			<LocalDraftBanner
@@ -382,4 +413,4 @@
 			</Button>
 		{/snippet}
 	</DrawerContent>
-</Drawer>
+{/snippet}
diff --git a/frontend/src/lib/components/VariableForm.svelte b/frontend/src/lib/components/VariableForm.svelte
index 61945eef08..63fdbf7425 100644
--- a/frontend/src/lib/components/VariableForm.svelte
+++ b/frontend/src/lib/components/VariableForm.svelte
@@ -10,10 +10,13 @@
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import { Loader2, RotateCcw } from 'lucide-svelte'
 	import autosize from '$lib/autosize'
-	import { workspaceStore, type UserExt } from '$lib/stores'
+	import { type UserExt } from '$lib/stores'
 	import { isOwner } from '$lib/utils'
 	import { isEncryptedDraftValue } from '$lib/encryptedDraft'
 	import EncryptedDraftField from './EncryptedDraftField.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Variable {
 		value: string
@@ -56,7 +59,7 @@
 		actingUser
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	// Loading the deployed secret overwrites the draft row this form shares with the AI
 	// chat, so every path that would trigger it has to be blocked while that row stages a
diff --git a/frontend/src/lib/components/WorkerTagPicker.svelte b/frontend/src/lib/components/WorkerTagPicker.svelte
index ccc3266ced..dae4967e05 100644
--- a/frontend/src/lib/components/WorkerTagPicker.svelte
+++ b/frontend/src/lib/components/WorkerTagPicker.svelte
@@ -2,6 +2,7 @@
 	import { Button } from '$lib/components/common'
 	import { ExternalLink, RotateCw, Loader2 } from 'lucide-svelte'
 	import { workerTags, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import AssignableTags from './AssignableTags.svelte'
 	import { WorkerService } from '$lib/gen'
 	import WorkerTagSelect from './WorkerTagSelect.svelte'
@@ -11,8 +12,8 @@
 		popupPlacement?: 'bottom-end' | 'top-end'
 		disabled?: boolean
 		placeholder?: string
-		// Workspace to read tags from; defaults to $workspaceStore. A fork-scoped
-		// session passes its effective workspace so the picker matches the deploy target.
+		// Workspace to read tags from; defaults to the operating workspace (see
+		// `useOperatingWorkspace`).
 		workspaceId?: string
 	}
 
@@ -26,8 +27,11 @@
 
 	// See WorkerTagSelect: the shared `workerTags` cache is navigation-scoped, so a
 	// different target workspace reads/writes a local list to avoid clobbering it.
-	let effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
-	let usesLocal = $derived(workspaceId != undefined && workspaceId !== $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let effectiveWorkspace = $derived(workspaceId ?? $operatingWorkspace)
+	let usesLocal = $derived(
+		effectiveWorkspace != undefined && effectiveWorkspace !== $workspaceStore
+	)
 	let localWorkerTags = $state<string[] | undefined>(undefined)
 	let currentTags = $derived(usesLocal ? localWorkerTags : $workerTags)
 
diff --git a/frontend/src/lib/components/WorkerTagSelect.svelte b/frontend/src/lib/components/WorkerTagSelect.svelte
index fe00f07f9d..624aeb1bcd 100644
--- a/frontend/src/lib/components/WorkerTagSelect.svelte
+++ b/frontend/src/lib/components/WorkerTagSelect.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import { workerTags, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { WorkerService } from '$lib/gen'
 
 	import { createEventDispatcher, onDestroy, onMount } from 'svelte'
@@ -31,10 +32,8 @@
 		/** Forwarded to the underlying Select — controls the input height. The
 		 * condensed session top bar passes `sm` to match its smaller buttons. */
 		size?: 'sm' | 'md' | 'lg'
-		// Workspace to read custom tags and worker availability from. Defaults to
-		// $workspaceStore. Session editors act on a workspace that differs from the
-		// navigation one, so they pass their effective workspace to keep the tag
-		// list and availability dots matching the deploy target.
+		// Workspace to read custom tags and worker availability from. Defaults to the
+		// operating workspace (see `useOperatingWorkspace`).
 		workspaceId?: string
 	} = $props()
 
@@ -46,8 +45,11 @@
 	// The shared `workerTags` store caches tags for the navigation workspace. When
 	// this select targets a different workspace, read/write a local list instead so
 	// it neither shows the navigation workspace's tags nor clobbers the shared cache.
-	let effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
-	let usesLocal = $derived(workspaceId != undefined && workspaceId !== $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let effectiveWorkspace = $derived(workspaceId ?? $operatingWorkspace)
+	let usesLocal = $derived(
+		effectiveWorkspace != undefined && effectiveWorkspace !== $workspaceStore
+	)
 	let localWorkerTags = $state<string[] | undefined>(undefined)
 	let currentTags = $derived(usesLocal ? localWorkerTags : $workerTags)
 
diff --git a/frontend/src/lib/components/WorkflowTimeline.svelte b/frontend/src/lib/components/WorkflowTimeline.svelte
index 2ea5ebba50..868f215c20 100644
--- a/frontend/src/lib/components/WorkflowTimeline.svelte
+++ b/frontend/src/lib/components/WorkflowTimeline.svelte
@@ -9,11 +9,19 @@
 	import ObjectViewer from './propertyPicker/ObjectViewer.svelte'
 	import { CheckCircle2, XCircle } from 'lucide-svelte'
 	import { JobService, type Job, type WorkflowStatus } from '$lib/gen'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { Button } from '$lib/components/common'
 	import { Alert } from '$lib/components/common'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import { sendUserToast } from '$lib/toast'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		flow_status: Record<string, WorkflowStatus>
@@ -97,7 +105,7 @@
 	}
 
 	async function fetchChildJob(id: string) {
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		if (!ws) return
 		loadingJobs[id] = true
 		try {
@@ -126,7 +134,7 @@
 	let approvalFormArgs: Record<string, Record<string, any>> = $state({})
 
 	async function handleApprove(key: string, formSchema: any) {
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		if (!ws || !jobId) return
 		approvalLoading[key] = true
 		try {
@@ -147,7 +155,7 @@
 
 	let cancelLoading = $state(false)
 	async function handleCancel() {
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		if (!ws || !jobId) return
 		cancelLoading = true
 		try {
@@ -260,7 +268,7 @@
 								<span class="text-tertiary">{msToSec(v.duration_ms ?? 0)}s</span>
 							{/if}
 						</div>
-						{#if canApprove && selfApprovalDisabled && $userStore?.is_admin}
+						{#if canApprove && selfApprovalDisabled && actingUser?.is_admin}
 							<div class="mt-1 ml-5 text-yellow-600 text-2xs">
 								Self-approval is disabled but allowed because you are an admin/owner
 							</div>
diff --git a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
index e321679a9b..ec285ce4dd 100644
--- a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
+++ b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
@@ -14,7 +14,6 @@ standalone editor autosaves and surfacing those in the breadcrumb picker
 would be surprising.
 -->
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { untrack } from 'svelte'
 	import {
@@ -32,6 +31,9 @@ would be surprising.
 	} from '$lib/components/copilot/chat/global/userDraftAdapter'
 	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
 	import { resource } from 'runed'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Kind = WorkspaceItemKind
 	type ScopeKind = Kind | 'all'
@@ -52,9 +54,8 @@ would be surprising.
 		externalFilter?: string
 		autoFocus?: boolean
 		flush?: boolean
-		// Load items and drafts from this workspace instead of the navigation
-		// workspace. Set by session live editors, whose acting workspace can
-		// differ from $workspaceStore; falls back to $workspaceStore otherwise.
+		// Load items and drafts from this workspace; defaults to the operating workspace
+		// (see `useOperatingWorkspace`).
 		workspaceId?: string
 	}
 
@@ -70,7 +71,7 @@ would be surprising.
 		workspaceId
 	}: Props = $props()
 
-	const effectiveWorkspace = $derived(workspaceId ?? $workspaceStore)
+	const effectiveWorkspace = $derived(workspaceId ?? $operatingWorkspace)
 
 	let inner = $state<DrillPickerHandle | undefined>(undefined)
 
diff --git a/frontend/src/lib/components/aiEvals/EvalsPane.svelte b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
index 568d4302cd..db765607e5 100644
--- a/frontend/src/lib/components/aiEvals/EvalsPane.svelte
+++ b/frontend/src/lib/components/aiEvals/EvalsPane.svelte
@@ -22,7 +22,6 @@
 		type Scorer,
 		type ScorerMean
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { onDestroy, onMount, untrack } from 'svelte'
 	import {
@@ -52,6 +51,9 @@
 		subjectLabel,
 		type EvalsLocation
 	} from './evalUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	/** A dataset is capped at this many cases, so one page holds the whole set. */
 	const CASE_PAGE_SIZE = 1000
@@ -84,7 +86,7 @@
 		active?: boolean
 	} = $props()
 
-	let ws = $derived(opWorkspace ?? $workspaceStore)
+	let ws = $derived(opWorkspace ?? $operatingWorkspace)
 	let datasets = $state<EvalDataset[]>([])
 	let dataset = $state<EvalDataset | undefined>(undefined)
 	let selectedDataset = $state<string | undefined>(undefined)
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
index 108e21e042..4f27eb6b26 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
@@ -2,7 +2,7 @@
 	import { Alert } from '$lib/components/common'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { Loader2 } from 'lucide-svelte'
 
 	import Tooltip from '$lib/components/Tooltip.svelte'
@@ -26,6 +26,14 @@
 	import { canUserBypassRuleKind, protectionRulesState } from '$lib/workspaceProtectionRules.svelte'
 	import { FRONTEND_SDK_SCOPES } from '$lib/components/raw_apps/sdkScopes'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspaceStore = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
 
@@ -78,29 +86,27 @@
 		 *  (`/secret_of/...` 404s with no `app` row) and renders a placeholder
 		 *  instead of the eternally-spinning link. */
 		newApp?: boolean
-		/** Workspace the app is deployed to — the session's acting workspace when
-		 *  embedded in a session preview, else the navigation `$workspaceStore`.
-		 *  The secret-URL / custom-path / folder / on-behalf-of lookups must target
-		 *  it, not `$workspaceStore` (which stays on the nav workspace in a session). */
+		/** Workspace the app is deployed to. The secret-URL / custom-path / folder /
+		 *  on-behalf-of lookups target it; defaults to the operating workspace. */
 		operatingWorkspace?: string
 	} = $props()
 
-	const opWs = $derived(operatingWorkspace ?? $workspaceStore)
+	const opWs = $derived(operatingWorkspace ?? $operatingWorkspaceStore)
 
-	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
+	let isDeployer = $derived(actingUser?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
 	// Admins always pass the backend check. For everyone else, fail closed
 	// while the workspace protection rules are still loading so the toggle
 	// is never briefly enabled for a user the rules will end up restricting.
 	let rulesetsLoaded = $derived(protectionRulesState.rulesets !== undefined)
 	let canSetAnonymous = $derived(
-		!!$userStore?.is_admin ||
-			!!$userStore?.is_super_admin ||
+		!!actingUser?.is_admin ||
+			!!actingUser?.is_super_admin ||
 			(rulesetsLoaded &&
 				canUserBypassRuleKind('RestrictAnonymousAppDeployment', $userStore ?? undefined))
 	)
 	let canSetGuest = $derived(
-		!!$userStore?.is_admin ||
-			!!$userStore?.is_super_admin ||
+		!!actingUser?.is_admin ||
+			!!actingUser?.is_super_admin ||
 			(rulesetsLoaded &&
 				canUserBypassRuleKind('RestrictGuestAppDeployment', $userStore ?? undefined))
 	)
@@ -147,7 +153,7 @@
 			setPublishState()
 		}
 	}
-	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
+	let canPreserve = $derived(!!actingUser?.is_admin || !!actingUser?.is_super_admin || isDeployer)
 	let savedOnBehalfOfEmail = $derived(savedApp?.policy?.on_behalf_of_email)
 	let savedOnBehalfOf = $derived(savedApp?.policy?.on_behalf_of)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
@@ -607,7 +613,7 @@
 		{/if}
 
 		<div class="mt-4">
-			{#if !($userStore?.is_admin || $userStore?.is_super_admin)}
+			{#if !(actingUser?.is_admin || actingUser?.is_super_admin)}
 				<Alert type="warning" title="Admin only" size="xs">
 					Custom path can only be set by workspace admins
 				</Alert>
@@ -628,7 +634,7 @@
 				options={{
 					right: 'Use a custom URL'
 				}}
-				disabled={!$enterpriseLicense || !($userStore?.is_admin || $userStore?.is_super_admin)}
+				disabled={!$enterpriseLicense || !(actingUser?.is_admin || actingUser?.is_super_admin)}
 			/>
 
 			{#if customPath !== undefined}
@@ -636,7 +642,7 @@
 					<div>Custom path</div>
 				</div>
 				<input
-					disabled={!($userStore?.is_admin || $userStore?.is_super_admin)}
+					disabled={!(actingUser?.is_admin || actingUser?.is_super_admin)}
 					type="text"
 					autocomplete="off"
 					bind:value={customPath}
diff --git a/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte b/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte
index 39ecb51715..98d380bcb3 100644
--- a/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte
+++ b/frontend/src/lib/components/apps/editor/AppJobsDrawer.svelte
@@ -7,7 +7,6 @@
 	import JobArgs from '$lib/components/JobArgs.svelte'
 	import LogViewer from '$lib/components/LogViewer.svelte'
 
-	import { workspaceStore } from '$lib/stores'
 	import { BellOff, Loader2, RefreshCw } from 'lucide-svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { classNames, truncateRev, isFlowPreview } from '../../../utils'
@@ -21,6 +20,9 @@
 	import type { Job } from '$lib/gen'
 	import type { JobById } from '../types'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open?: boolean
@@ -163,7 +165,7 @@
 											<Pane size={90} minSize={10} class="text-sm text-secondary">
 												<div class="relative h-full px-2">
 													<DisplayResult
-														workspaceId={$workspaceStore}
+														workspaceId={$operatingWorkspace}
 														jobId={selectedJobId}
 														result={jobResult.result}
 													/>
@@ -192,7 +194,7 @@
 											<div class="p-2">
 												<JobArgs
 													id={job?.id}
-													workspace={job?.workspace_id ?? $workspaceStore ?? 'no_w'}
+													workspace={job?.workspace_id ?? $operatingWorkspace ?? 'no_w'}
 													args={job?.args}
 												/>
 											</div>
@@ -219,7 +221,7 @@
 													{#if job != undefined && 'result' in job && job?.result != undefined}<div
 															class="relative h-full px-2"
 															><DisplayResult
-																workspaceId={$workspaceStore}
+																workspaceId={$operatingWorkspace}
 																jobId={selectedJobId}
 																result={job?.result}
 															/></div
@@ -240,7 +242,7 @@
 														{#if job != undefined && 'result' in job && job?.result != undefined}
 															<div class="relative h-full px-2">
 																<DisplayResult
-																	workspaceId={$workspaceStore}
+																	workspaceId={$operatingWorkspace}
 																	jobId={selectedJobId}
 																	result={jobResult?.transformer}
 																/>
diff --git a/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte b/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte
index 614d1f4fa4..63bc17a8eb 100644
--- a/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte
+++ b/frontend/src/lib/components/apps/editor/DeploymentHistory.svelte
@@ -14,12 +14,14 @@
 	} from '$lib/utils'
 	import { orderedYamlStringify } from '$lib/utils/orderedYaml'
 	import { AppService, type AppWithLastVersion, type AppHistory } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { Pencil, ArrowRight, X, Loader2 } from 'lucide-svelte'
 	import Select from '$lib/components/select/Select.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		appPath: string | undefined
@@ -48,7 +50,7 @@
 			return cached
 		}
 
-		const app = await AppService.getAppByVersion({ workspace: $workspaceStore!, id: version })
+		const app = await AppService.getAppByVersion({ workspace: $operatingWorkspace!, id: version })
 		versionCache[version] = app
 		return app
 	}
@@ -60,7 +62,7 @@
 
 		loading = true
 		versions = await AppService.getAppHistoryByPath({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			path: appPath
 		})
 		loading = false
@@ -90,7 +92,7 @@
 			return
 		}
 		await AppService.updateAppHistory({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			id: appId,
 			version: appVersion,
 			requestBody: {
@@ -107,7 +109,9 @@
 	}
 
 	function toVersionLabel(version: AppHistory): string {
-		return emptyString(version.deployment_msg) ? `Version ${version.version}` : version.deployment_msg!
+		return emptyString(version.deployment_msg)
+			? `Version ${version.version}`
+			: version.deployment_msg!
 	}
 
 	let availableVersions = $derived(
diff --git a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
index 3089809f12..293d83b4ae 100644
--- a/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
+++ b/frontend/src/lib/components/apps/editor/inlineScriptsPanel/InlineScriptRunnableByPath.svelte
@@ -19,7 +19,6 @@
 		CtxAppInput
 	} from '../../inputType'
 	import type { AppViewerContext } from '../../types'
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher } from 'svelte'
 	import { deepEqual } from 'fast-equals'
 	import { computeFields } from './utils'
@@ -35,6 +34,9 @@
 	import FlowEditorDrawer from '$lib/components/flows/content/FlowEditorDrawer.svelte'
 	import { FlowService, ScriptService, type OpenFlow } from '$lib/gen'
 	import { replaceScriptPlaceholderWithItsValues } from '$lib/hub'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		runnable: RunnableByPath
@@ -131,7 +133,7 @@
 				return
 			}
 
-			const loaded = await loadSchema($workspaceStore ?? '', runnable.path, 'flow')
+			const loaded = await loadSchema($operatingWorkspace ?? '', runnable.path, 'flow')
 			const schema = loaded?.schema ?? emptySchema()
 			if (!deepEqual(runnable.schema, schema)) {
 				runnable.schema = schema
@@ -167,7 +169,7 @@
 	async function openScriptEditor(path: string) {
 		try {
 			const script = await ScriptService.getScriptByPath({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				path
 			})
 			scriptEditorDrawer?.openDrawer(script.hash, () => {
@@ -344,7 +346,7 @@
 					startIcon={{ icon: Eye }}
 					endIcon={{ icon: ExternalLink }}
 					target="_blank"
-					href="{base}/flows/get/{runnable.path}?workspace={$workspaceStore}"
+					href="{base}/flows/get/{runnable.path}?workspace={$operatingWorkspace}"
 				>
 					Details
 				</Button>
@@ -425,7 +427,7 @@
 					{#if runnable.runType == 'flow' && isHubFlowPath(runnable.path)}
 						Hub flow not found at {runnable.path}
 					{:else}
-						{runnable.runType} not found at {runnable.path} in workspace {$workspaceStore}
+						{runnable.runType} not found at {runnable.path} in workspace {$operatingWorkspace}
 					{/if}
 				</div>
 			{:else if runnable.runType == 'script' || runnable.runType == 'hubscript'}
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
index 8543fc0683..08b8ac6219 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/RunnableSelector.svelte
@@ -11,15 +11,12 @@
 	import type { Schema } from '$lib/common'
 	import { emptySchema } from '$lib/utils'
 	import { loadSchema } from '$lib/infer'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { buildPathRunnableSelection } from './runnableSelectorUtils'
 
-	type TabType =
-		| 'hubscripts'
-		| 'hubflows'
-		| 'workspacescripts'
-		| 'workspaceflows'
-		| 'inlinescripts'
+	type TabType = 'hubscripts' | 'hubflows' | 'workspacescripts' | 'workspaceflows' | 'inlinescripts'
 
 	interface Props {
 		defaultUserInput?: boolean
@@ -60,7 +57,7 @@
 		path: string,
 		runType: 'script' | 'flow' | 'hubscript'
 	): Promise<{ schema: Schema; summary: string | undefined }> {
-		const schema = await loadSchema($workspaceStore!, path, runType)
+		const schema = await loadSchema($operatingWorkspace!, path, runType)
 		if (!schema.schema.order) {
 			schema.schema.order = Object.keys(schema.schema.properties ?? {})
 		}
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte
index b2cc91fc01..7831e83458 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceFlowList.svelte
@@ -7,9 +7,11 @@
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString } from '$lib/utils'
 	import { Skeleton } from '$lib/components/common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		filter?: string
@@ -26,7 +28,7 @@
 
 	async function loadFlow(): Promise<void> {
 		const loadedFlows = await FlowService.listFlows({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			perPage: 300,
 			withoutDescription: true
 		})
diff --git a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte
index be261ca5e8..13447c4787 100644
--- a/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte
+++ b/frontend/src/lib/components/apps/editor/settingsPanel/mainInput/WorkspaceScriptList.svelte
@@ -7,9 +7,11 @@
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
 	import { type Script, ScriptService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString } from '$lib/utils'
 	import { Skeleton } from '$lib/components/common'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		filter?: string
@@ -26,7 +28,7 @@
 
 	async function loadScripts(): Promise<void> {
 		const loadedScripts = await ScriptService.listScripts({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			perPage: 300,
 			withoutDescription: true
 		})
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
index 4b252b9338..6050c2d1cd 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetGraphDetailsPane.svelte
@@ -48,7 +48,10 @@
 	import AssetRunsPanel from './AssetRunsPanel.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { fade } from 'svelte/transition'
-	import { userStore } from '$lib/stores'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		// Regular selection — loads the script by path for inline editing.
@@ -662,7 +665,7 @@
 	// hand-rolled here because we need *two* confirm buttons, not one.
 	let removeOpen = $state(false)
 	let removing = $state(false)
-	let canHardDelete = $derived(!!($userStore?.is_admin || $userStore?.is_super_admin))
+	let canHardDelete = $derived(!!(actingUser?.is_admin || actingUser?.is_super_admin))
 
 	// React to the parent's remove-signal counter and pop the same modal
 	// the in-pane trash button uses. Skipped for drafts (the parent calls
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
index 815db36b18..e719bfe2bd 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetNode.svelte
@@ -19,12 +19,15 @@
 		XCircle
 	} from 'lucide-svelte'
 	import type { ScriptLang } from '$lib/gen'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { PIPELINE_LANGUAGES } from './pipelineLanguages'
 	import type { PipelineOutputKind } from './pipelineTemplates'
 	import type { DbtAssetProvenance } from './types'
 	import DbtIcon from '$lib/components/icons/DbtIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// Shape used for both the data prop and the run callback. Drafts carry
 	// `content` / `language` so the page-level run handler can dispatch to
@@ -118,7 +121,7 @@
 
 	async function runProducers(e: MouseEvent) {
 		e.stopPropagation()
-		if (!$workspaceStore || running || !data.onRunProducer) return
+		if (!$operatingWorkspace || running || !data.onRunProducer) return
 		if (scriptProducers.length === 0) return
 		running = true
 		const handler = data.onRunProducer
@@ -170,14 +173,14 @@
 		}
 		const cols = Object.entries(d.columns ?? {})
 		if (cols.length) {
-			lines.push(
-				`columns: ${cols.map(([c, desc]) => (desc ? `${c} (${desc})` : c)).join(', ')}`
-			)
+			lines.push(`columns: ${cols.map(([c, desc]) => (desc ? `${c} (${desc})` : c)).join(', ')}`)
 		}
 		if (d.freshness) {
 			const f = d.freshness as Record<string, { count?: number; period?: string }>
 			const window = (k: string) =>
-				f[k]?.count != null ? `${k.replace('_after', '')} after ${f[k].count}${f[k].period?.[0] ?? ''}` : ''
+				f[k]?.count != null
+					? `${k.replace('_after', '')} after ${f[k].count}${f[k].period?.[0] ?? ''}`
+					: ''
 			const windows = ['warn_after', 'error_after'].map(window).filter(Boolean)
 			if (windows.length) lines.push(`freshness: ${windows.join(', ')}`)
 		}
diff --git a/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte b/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
index f43259b561..7cee1deb76 100644
--- a/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/AssetRunsPanel.svelte
@@ -8,7 +8,6 @@
 	// seconds so the user sees status transitions without refreshing —
 	// JobLoader handles streaming for the *selected* job.
 	import { JobService, type Job } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { onDestroy, untrack } from 'svelte'
 	import { displayDate } from '$lib/utils'
 	import { CheckCircle2, Clock, History, Loader2, XCircle, Ban } from 'lucide-svelte'
@@ -21,6 +20,9 @@
 	import { Popover } from '$lib/components/meltComponents'
 	import { twMerge } from 'tailwind-merge'
 	import DispatchEventsButton from '$lib/components/runs/DispatchEventsButton.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Producers of this asset. Each contributes its own listExtendedJobs
@@ -88,7 +90,7 @@
 		// Run only when the *content* of the producer set changes (string
 		// key) or when the parent explicitly bumps `refreshKey` after
 		// dispatching a new run. The producerKey debounce alone isn't
-		// enough: refresh() synchronously reads $workspaceStore and
+		// enough: refresh() synchronously reads $operatingWorkspace and
 		// runnableProducers before the first await, and Svelte 5 records
 		// those as deps of the surrounding $effect — which would then
 		// re-fire whenever the parent re-derives `producers` (i.e. on
@@ -174,11 +176,11 @@
 
 	async function refresh(): Promise<void> {
 		if (refreshInFlight) return refreshInFlight
-		if (!$workspaceStore || runnableProducers.length === 0) {
+		if (!$operatingWorkspace || runnableProducers.length === 0) {
 			jobs = []
 			return
 		}
-		const ws = $workspaceStore
+		const ws = $operatingWorkspace
 		// Capture the producer paths *now* — using runnableProducers
 		// directly inside the await would re-read after the array
 		// identity churned, defeating the in-flight guard.
@@ -286,12 +288,12 @@
 			</span>
 			<a
 				class="text-3xs text-blue-600 hover:underline shrink-0"
-				href={`${base}/run/${selectedJob.id}?workspace=${$workspaceStore}`}
+				href={`${base}/run/${selectedJob.id}?workspace=${$operatingWorkspace}`}
 				target="_blank">Open ↗</a
 			>
-			{#if $workspaceStore}
+			{#if $operatingWorkspace}
 				<DispatchEventsButton
-					workspace={selectedJob.workspace_id ?? $workspaceStore}
+					workspace={selectedJob.workspace_id ?? $operatingWorkspace}
 					jobId={selectedJob.id}
 				/>
 			{/if}
@@ -397,7 +399,7 @@
 			<div class="flex flex-col gap-3 p-3">
 				<JobArgs
 					id={selectedJob.id}
-					workspace={selectedJob.workspace_id ?? $workspaceStore ?? ''}
+					workspace={selectedJob.workspace_id ?? $operatingWorkspace ?? ''}
 					args={selectedJob.args}
 				/>
 				<div class="flex flex-col gap-1">
diff --git a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
index 1b86fa6853..5f5dc98b60 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DataTablePreview.svelte
@@ -9,7 +9,6 @@
 	// just be noise.
 	import DBTable from '$lib/components/DBTable.svelte'
 	import { resource } from 'runed'
-	import { workspaceStore } from '$lib/stores'
 	import { loadAllTablesMetaData } from '$lib/components/apps/components/display/dbtable/metadata'
 	import { dbTableOpsWithPreviewScripts } from '$lib/components/dbOps'
 	import { WorkspaceService } from '$lib/gen'
@@ -19,6 +18,9 @@
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { base } from '$lib/base'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Asset path as parsed from `datatable://<datatable>/<table>` —
@@ -71,7 +73,7 @@
 	// query, and the user needs to configure it before pipeline scripts
 	// can write to it.
 	let datatables = resource(
-		() => $workspaceStore,
+		() => $operatingWorkspace,
 		async (ws) => {
 			if (!ws) return [] as string[]
 			try {
@@ -117,9 +119,9 @@
 		() => [input, refreshKey],
 		async ([_input]) => {
 			colDefsError = undefined
-			if (!_input || !$workspaceStore) return undefined
+			if (!_input || !$operatingWorkspace) return undefined
 			try {
-				return await loadAllTablesMetaData($workspaceStore, _input)
+				return await loadAllTablesMetaData($operatingWorkspace, _input)
 			} catch (e) {
 				colDefsError = (e as Error)?.message || String(e)
 				return undefined
@@ -138,12 +140,12 @@
 	})
 
 	let dbTableOps = $derived(
-		input && tableColDefs && parsed.table && $workspaceStore
+		input && tableColDefs && parsed.table && $operatingWorkspace
 			? dbTableOpsWithPreviewScripts({
 					input,
 					tableKey: parsed.table,
 					colDefs: tableColDefs,
-					workspace: $workspaceStore
+					workspace: $operatingWorkspace
 				})
 			: undefined
 	)
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
index f21ca486af..d2d3c03b8a 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeResultPreview.svelte
@@ -9,7 +9,6 @@
 	// ("This partition") or show the full table ("Whole table") via a toggle.
 	import DBTable from '$lib/components/DBTable.svelte'
 	import { resource } from 'runed'
-	import { workspaceStore } from '$lib/stores'
 	import { loadAllTablesMetaData } from '$lib/components/apps/components/display/dbtable/metadata'
 	import { dbTableOpsWithPreviewScripts } from '$lib/components/dbOps'
 	import type { DbInput } from '$lib/components/dbTypes'
@@ -18,6 +17,9 @@
 	import { twMerge } from 'tailwind-merge'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Full asset URI, e.g. `ducklake://main/orders_daily`.
@@ -61,9 +63,9 @@
 		() => [input, refreshKey] as const,
 		async ([_input]) => {
 			colDefsError = undefined
-			if (!_input || !$workspaceStore) return undefined
+			if (!_input || !$operatingWorkspace) return undefined
 			try {
-				return await loadAllTablesMetaData($workspaceStore, _input)
+				return await loadAllTablesMetaData($operatingWorkspace, _input)
 			} catch (e) {
 				colDefsError = (e as Error)?.message || String(e)
 				return undefined
@@ -89,12 +91,12 @@
 	})
 
 	let dbTableOps = $derived.by(() => {
-		if (!(input && tableColDefs && tableKey && $workspaceStore)) return undefined
+		if (!(input && tableColDefs && tableKey && $operatingWorkspace)) return undefined
 		const ops = dbTableOpsWithPreviewScripts({
 			input,
 			tableKey,
 			colDefs: tableColDefs,
-			workspace: $workspaceStore,
+			workspace: $operatingWorkspace,
 			whereClause
 		})
 		// Read-only preview: drop the mutation handlers so DBTable hides its
diff --git a/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte b/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte
index 5afb51fe66..35eff3beae 100644
--- a/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/DucklakeVersionPreview.svelte
@@ -7,7 +7,6 @@
 	// hand is shown above the grid so the affordance is self-documenting.
 	import DBTable from '$lib/components/DBTable.svelte'
 	import { resource } from 'runed'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		fetchDucklakeColumnsAtVersion,
 		dbTableOpsWithPreviewScripts
@@ -17,6 +16,9 @@
 	import { AlertTriangle, Loader2, ClipboardCopy } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		// Full asset URI, e.g. `ducklake://main/orders_daily`.
@@ -56,9 +58,10 @@
 	let columns = resource(
 		() => [ducklake, tableKey, version] as const,
 		async ([_ducklake, _tableKey, _version]) => {
-			if (!_ducklake || !_tableKey || _version == undefined || !$workspaceStore) return undefined
+			if (!_ducklake || !_tableKey || _version == undefined || !$operatingWorkspace)
+				return undefined
 			const colDefs = await fetchDucklakeColumnsAtVersion({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				ducklake: _ducklake,
 				tableKey: _tableKey,
 				version: _version
@@ -73,13 +76,13 @@
 	let tableColDefs = $derived(ready ? columns.current!.colDefs : undefined)
 
 	let dbTableOps = $derived.by(() => {
-		if (!(input && tableColDefs && tableKey && $workspaceStore && version != undefined))
+		if (!(input && tableColDefs && tableKey && $operatingWorkspace && version != undefined))
 			return undefined
 		const ops = dbTableOpsWithPreviewScripts({
 			input,
 			tableKey,
 			colDefs: tableColDefs,
-			workspace: $workspaceStore,
+			workspace: $operatingWorkspace,
 			version
 		})
 		// Historical reads are immutable: drop every mutation handler so DBTable
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
index 79a1cf6d47..2450595b6d 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineScriptView.svelte
@@ -6,7 +6,9 @@
 	import PipelineRunForm from './PipelineRunForm.svelte'
 	import AssetRunsPanel from './AssetRunsPanel.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { parsePipelineAnnotations } from './parsePipelineAnnotations'
 
 	interface Props {
@@ -201,7 +203,7 @@
 								bind:args
 								bind:isValid
 								{partitionSpec}
-								workspace={$workspaceStore ?? ''}
+								workspace={$operatingWorkspace ?? ''}
 								{materializeTarget}
 								{upstreamAssets}
 							/>
diff --git a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
index e364b29883..4f97039a1c 100644
--- a/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/PipelineTriggerEditors.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import ConfirmationModal from '$lib/components/common/confirmationModal/ConfirmationModal.svelte'
 	import type { NativeTriggerKind } from './types'
@@ -24,7 +23,10 @@
 	import EmailTriggerEditor from '$lib/components/triggers/email/EmailTriggerEditor.svelte'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
 	import WebhookEditor from '$lib/components/triggers/webhook/WebhookEditor.svelte'
-	import { setTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	// Owns the native-trigger drawer wiring for the pipeline canvas: the nine
 	// editor instances, the create/edit dispatch by kind, and the delete
@@ -40,9 +42,8 @@
 	type Props = { onUpdate: () => void; mountTriggerEditors: boolean; workspace?: string }
 	let { onUpdate, mountTriggerEditors, workspace: triggerWorkspace }: Props = $props()
 
-	// Register the trigger-workspace resolver for the whole editor subtree (the
-	// nine editors + the delete handler below). See triggerWorkspace.ts.
-	setTriggerWorkspace(() => triggerWorkspace ?? $workspaceStore)
+	// The nine editors below act on this workspace (see operatingWorkspace.svelte.ts).
+	setOperatingWorkspace(() => triggerWorkspace)
 
 	let kafkaEditor: KafkaTriggerEditor | undefined = $state()
 	let mqttEditor: MqttTriggerEditor | undefined = $state()
@@ -127,7 +128,7 @@
 	}
 
 	async function confirmDeleteAttachedTrigger() {
-		const workspace = triggerWorkspace ?? $workspaceStore
+		const workspace = triggerWorkspace ?? $operatingWorkspace
 		if (!triggerDeleteTarget || !workspace) return
 		const { kind, path: triggerPath } = triggerDeleteTarget
 		triggerDeleteLoading = true
diff --git a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
index c260bc2e5b..c4cb5ca998 100644
--- a/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
+++ b/frontend/src/lib/components/assets/AssetGraph/RunnableNode.svelte
@@ -28,7 +28,9 @@
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import type { Item } from '$lib/utils'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { sendUserToast, msToReadableTimeShort } from '$lib/utils'
 
 	interface Props {
@@ -129,7 +131,7 @@
 
 	async function runSelf(e: MouseEvent, cascade?: boolean) {
 		e.stopPropagation()
-		if (!$workspaceStore || running || !data.onRunSelf) return
+		if (!$operatingWorkspace || running || !data.onRunSelf) return
 		running = true
 		try {
 			await data.onRunSelf(cascade != undefined ? { cascade } : undefined)
diff --git a/frontend/src/lib/components/assets/AssetsDropdownButton.svelte b/frontend/src/lib/components/assets/AssetsDropdownButton.svelte
index 3ed8690079..d701ec9d4f 100644
--- a/frontend/src/lib/components/assets/AssetsDropdownButton.svelte
+++ b/frontend/src/lib/components/assets/AssetsDropdownButton.svelte
@@ -14,7 +14,6 @@
 	} from './lib'
 	import { untrack } from 'svelte'
 	import { ResourceService, WorkspaceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import Tooltip from '../meltComponents/Tooltip.svelte'
 	import Tooltip2 from '../Tooltip.svelte'
 	import ResourceEditorDrawer from '../ResourceEditorDrawer.svelte'
@@ -23,6 +22,9 @@
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import { resource } from 'runed'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		assets,
@@ -61,12 +63,12 @@
 	})
 
 	let datatables = resource([], () =>
-		WorkspaceService.listDataTables({ workspace: $workspaceStore ?? '' }).then((d) =>
+		WorkspaceService.listDataTables({ workspace: $operatingWorkspace ?? '' }).then((d) =>
 			d.map((d) => d.name)
 		)
 	)
 	let ducklakes = resource([], () =>
-		WorkspaceService.listDucklakes({ workspace: $workspaceStore ?? '' })
+		WorkspaceService.listDucklakes({ workspace: $operatingWorkspace ?? '' })
 	)
 
 	$effect(() => {
@@ -88,7 +90,7 @@
 					let truncatedPath = asset.path.split('?table=')[0]
 					if (truncatedPath in resourceDataCache) continue
 					resourceDataCache[truncatedPath] = undefined // avoid fetching multiple times because of async
-					ResourceService.getResource({ path: truncatedPath, workspace: $workspaceStore! })
+					ResourceService.getResource({ path: truncatedPath, workspace: $operatingWorkspace! })
 						.then((r) => (resourceDataCache[truncatedPath] = r.resource_type))
 						.catch((err) => console.error("Couldn't fetch resource", truncatedPath, err))
 				}
diff --git a/frontend/src/lib/components/assets/JobAssetsViewer.svelte b/frontend/src/lib/components/assets/JobAssetsViewer.svelte
index 45bc4cd70f..8b99cadbd1 100644
--- a/frontend/src/lib/components/assets/JobAssetsViewer.svelte
+++ b/frontend/src/lib/components/assets/JobAssetsViewer.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { JobService, ResourceService, ScriptService, type Job } from '$lib/gen'
 	import { inferAssets } from '$lib/infer'
-	import { workspaceStore } from '$lib/stores'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
 	import { pruneNullishArray, uniqueBy } from '$lib/utils'
 	import { Skeleton } from '../common'
@@ -15,6 +14,9 @@
 		parseInputArgsAssets,
 		type AssetWithAccessType
 	} from './lib'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		job: Job
@@ -56,9 +58,9 @@
 	async function fetchRuntimeAssets(
 		job: Job
 	): Promise<{ assets: AssetWithAccessType[]; truncated: boolean }> {
-		if (!$workspaceStore) return { assets: [], truncated: false }
+		if (!$operatingWorkspace) return { assets: [], truncated: false }
 		return await JobService.listRunAssets({
-			workspace: $workspaceStore,
+			workspace: $operatingWorkspace,
 			id: job.id
 		}).catch((err) => {
 			console.error("Couldn't fetch runtime assets of job", job.id, err)
@@ -83,9 +85,9 @@
 
 		if (job.job_kind === 'script') {
 			let code = job.raw_code
-			if (!code && job.script_hash && $workspaceStore) {
+			if (!code && job.script_hash && $operatingWorkspace) {
 				const script = await ScriptService.getScriptByHash({
-					workspace: $workspaceStore,
+					workspace: $operatingWorkspace,
 					hash: job.script_hash
 				})
 				code = script.content
@@ -100,7 +102,7 @@
 	let assets = usePromise(() => extractAssets(job), { loadInit: false })
 	$effect(() => {
 		job.id
-		$workspaceStore
+		$operatingWorkspace
 		assets.refresh()
 	})
 
@@ -111,7 +113,7 @@
 				let truncatedPath = asset.path.split('?table=')[0]
 				if (truncatedPath in resourceDataCache) continue
 				resourceDataCache[truncatedPath] = undefined // avoid fetching multiple times because of async
-				ResourceService.getResource({ path: truncatedPath, workspace: $workspaceStore! })
+				ResourceService.getResource({ path: truncatedPath, workspace: $operatingWorkspace! })
 					.then((r) => (resourceDataCache[truncatedPath] = r.resource_type))
 					.catch((err) => console.error("Couldn't fetch resource", truncatedPath, err))
 			}
diff --git a/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte
index dadf814a80..5a51b4cfba 100644
--- a/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/DraftChangesConfirmationModal.svelte
@@ -9,9 +9,12 @@
 	import { Bot, Star } from 'lucide-svelte'
 	import ToggleButtonGroup from '../toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../toggleButton-v2/ToggleButton.svelte'
-	import { userStore } from '$lib/stores'
 	import Badge from '../badge/Badge.svelte'
 	import type { LinkedAgentDraft } from '$lib/components/flows/linkedAgentDrafts'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		open?: boolean
@@ -80,8 +83,8 @@
 		// Creating http trigger is forbidden for non-admin users
 		const adminOnly =
 			trigger.type === 'http' &&
-			!$userStore?.is_admin &&
-			!$userStore?.is_super_admin &&
+			!actingUser?.is_admin &&
+			!actingUser?.is_super_admin &&
 			trigger.isDraft
 
 		const invalidConfig = !trigger.draftConfig?.canSave
diff --git a/frontend/src/lib/components/common/drawer/DrawerContent.svelte b/frontend/src/lib/components/common/drawer/DrawerContent.svelte
index ed2ed68519..9664f3a27e 100644
--- a/frontend/src/lib/components/common/drawer/DrawerContent.svelte
+++ b/frontend/src/lib/components/common/drawer/DrawerContent.svelte
@@ -30,6 +30,8 @@
 		 * the content hug it with tight top padding; new entities keep normal padding.
 		 */
 		bannerReserved?: boolean
+		/** For content rendered in place of a drawer, which has nothing to close. */
+		hideClose?: boolean
 		children?: import('svelte').Snippet
 	}
 
@@ -50,6 +52,7 @@
 		titleExtra,
 		banner,
 		bannerReserved = false,
+		hideClose = false,
 		children
 	}: Props = $props()
 
@@ -69,19 +72,26 @@
 	)}
 	{id}
 >
-	<div class="flex justify-between w-full items-center pl-2 pr-4 py-2 gap-2">
+	<div
+		class={classNames(
+			'flex justify-between w-full items-center pr-4 py-2 gap-2',
+			hideClose ? 'pl-4' : 'pl-2'
+		)}
+	>
 		<div class="flex items-center gap-2 w-full truncate">
-			<div
-				use:triggerableByAI={{
-					id: `close-${aiId}`,
-					description: `Close ${aiDescription}`,
-					callback: () => {
-						dispatch('close')
-					}
-				}}
-			>
-				<CloseButton on:close Icon={CloseIcon} id="{id}-close-btn" />
-			</div>
+			{#if !hideClose}
+				<div
+					use:triggerableByAI={{
+						id: `close-${aiId}`,
+						description: `Close ${aiDescription}`,
+						callback: () => {
+							dispatch('close')
+						}
+					}}
+				>
+					<CloseButton on:close Icon={CloseIcon} id="{id}-close-btn" />
+				</div>
+			{/if}
 			<span class="font-semibold text-emphasis truncate text-lg max-w-sm"
 				>{title ?? ''}
 				{#if tooltip != '' || documentationLink}
diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index 8d6529764b..c1a29fae70 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		s3object: any
@@ -12,7 +14,7 @@
 
 	let { s3object, workspaceId = undefined, appPath = undefined }: Props = $props()
 
-	let workspace = $derived(workspaceId ?? $workspaceStore)
+	let workspace = $derived(workspaceId ?? $operatingWorkspace)
 	let filename = $derived(s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file')
 
 	let apiPath = $derived(
diff --git a/frontend/src/lib/components/common/fileUpload/FileUpload.svelte b/frontend/src/lib/components/common/fileUpload/FileUpload.svelte
index dfe5c158cc..0a25745ac9 100644
--- a/frontend/src/lib/components/common/fileUpload/FileUpload.svelte
+++ b/frontend/src/lib/components/common/fileUpload/FileUpload.svelte
@@ -4,7 +4,6 @@
 
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
 	import { AppService, HelpersService } from '$lib/gen'
 	import { OpenAPI } from '$lib/gen/core/OpenAPI'
 	import { writable, type Writable } from 'svelte/store'
@@ -12,6 +11,9 @@
 	import { twMerge } from 'tailwind-merge'
 	import { createEventDispatcher, onDestroy } from 'svelte'
 	import { emptyString } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		acceptedFileTypes?: string[] | undefined
@@ -237,7 +239,7 @@
 
 		try {
 			// const response = await HelpersService.multipartFileUpload({
-			// 	workspace: $workspaceStore!,
+			// 	workspace: $operatingWorkspace!,
 			// 	fileKey: path,
 			// 	fileExtension: fileExtension,
 			// 	s3ResourcePath: customS3ResourcePath?.split(':')[1],
@@ -280,7 +282,7 @@
 			}
 
 			// let response = await fetch(
-			// 	`/api/w/${$workspaceStore}/job_helpers/multipart_upload_s3_file?${params.toString()}`,
+			// 	`/api/w/${$operatingWorkspace}/job_helpers/multipart_upload_s3_file?${params.toString()}`,
 			// 	{
 			// 		method: 'POST',
 			// 		headers: {
@@ -327,10 +329,10 @@
 					'POST',
 					appPath
 						? `/api/w/${
-								workspace ?? $workspaceStore
+								workspace ?? $operatingWorkspace
 							}/apps_u/upload_s3_file/${appPath}?${params.toString()}`
 						: `/api/w/${
-								workspace ?? $workspaceStore
+								workspace ?? $operatingWorkspace
 							}/job_helpers/upload_s3_file?${params.toString()}`,
 					true
 				)
@@ -376,12 +378,12 @@
 		try {
 			if (deleteToken) {
 				await AppService.deleteS3FileFromApp({
-					workspace: workspace ?? $workspaceStore!,
+					workspace: workspace ?? $operatingWorkspace!,
 					deleteToken: deleteToken
 				})
 			} else {
 				await HelpersService.deleteS3File({
-					workspace: workspace ?? $workspaceStore!,
+					workspace: workspace ?? $operatingWorkspace!,
 					fileKey: fileKey
 				})
 			}
diff --git a/frontend/src/lib/components/copilot/StepGenQuick.svelte b/frontend/src/lib/components/copilot/StepGenQuick.svelte
index 0be2fecb4c..3890cacd58 100644
--- a/frontend/src/lib/components/copilot/StepGenQuick.svelte
+++ b/frontend/src/lib/components/copilot/StepGenQuick.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { copilotInfo } from '$lib/aiStore'
 	import { ScriptService, type Script } from '$lib/gen'
 
@@ -8,6 +7,9 @@
 	import { emptyString } from '$lib/utils'
 	import { createEventDispatcher, onMount, untrack } from 'svelte'
 	import TextInput from '../text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let scripts: Script[] | undefined = $state(undefined)
 	interface Props {
@@ -34,7 +36,7 @@
 
 	async function loadScripts(): Promise<void> {
 		const loadedScripts = await ScriptService.listScripts({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			perPage: 300,
 			kinds: trigger ? 'trigger' : 'script'
 		})
diff --git a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
index 7fccb7addd..e7cfa270ee 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatMessage.svelte
@@ -13,7 +13,9 @@
 	import { messageDraft, segments } from './chatDraft'
 	import { lineCountLabel } from './pasteTokens'
 	import ExpandableImage from '$lib/components/common/image/ExpandableImage.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const chatHost = getChatViewHost()
 
@@ -23,8 +25,8 @@
 	// to a different copy.
 	const messageWorkspace = $derived.by(() => {
 		// Registers the dependency that `operatingWorkspace`'s own untracked
-		// `get(workspaceStore)` cannot.
-		void $workspaceStore
+		// `get(operatingWorkspace)` cannot.
+		void $operatingWorkspace
 		return chatHost.operatingWorkspace
 	})
 
diff --git a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
index 914ad51bc9..c9c786ccbc 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatModelSettings.svelte
@@ -10,9 +10,7 @@
 	import {
 		COPILOT_SESSION_MODEL_SETTING_NAME,
 		COPILOT_SESSION_PROVIDER_SETTING_NAME,
-		COPILOT_SESSION_REASONING_SETTING_NAME,
-		userStore,
-		workspaceStore
+		COPILOT_SESSION_REASONING_SETTING_NAME
 	} from '$lib/stores'
 	import { storeLocalSetting, type Item } from '$lib/utils'
 	import {
@@ -33,6 +31,14 @@
 		REASONING_OFF,
 		type ReasoningProviderModel
 	} from '../reasoningRegistry'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		/** Whether this dropdown carries the custom-prompt entries. Off where the surface
@@ -97,7 +103,7 @@
 	// operations must key off this snapshot, not the reactive `mode`.
 	let activeMode = $state(aiChatManager.mode)
 
-	let isAdmin = $derived(Boolean($userStore?.is_admin || $userStore?.is_super_admin))
+	let isAdmin = $derived(Boolean(actingUser?.is_admin || actingUser?.is_super_admin))
 	// True when the workspace has no AI providers of its own (it uses instance defaults).
 	// In that case the backend never makes workspace custom_prompts effective, so a saved
 	// workspace prompt would be dead config — mirror the settings page and surface it read-only.
@@ -130,7 +136,7 @@
 		if (!isAdmin) {
 			initialPrompt = $copilotInfo.customPrompts?.[activeMode] ?? ''
 		} else {
-			const workspace = $workspaceStore
+			const workspace = $operatingWorkspace
 			try {
 				const settings = workspace ? await WorkspaceService.getSettings({ workspace }) : undefined
 				const providers = settings?.ai_config?.providers ?? {}
@@ -165,7 +171,7 @@
 			return
 		}
 
-		const workspace = $workspaceStore
+		const workspace = $operatingWorkspace
 		if (!workspace) return
 		try {
 			// Saving prompts requires a full ai_config round-trip; fetch the current
diff --git a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
index 47f25b6c09..5d825bd5c8 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantInstructionsSection.svelte
@@ -24,6 +24,10 @@ writes whichever of the two changed, including the tab that is not on screen.
 	import { Building2, ExternalLink, User } from 'lucide-svelte'
 	import { untrack } from 'svelte'
 	import { getAiChatManager } from './aiChatManagerContext'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		ws,
@@ -55,7 +59,7 @@ writes whichever of the two changed, including the tab that is not on screen.
 			? `Applies to everyone in ${ws}.`
 			: 'Stored in this browser and sent in every workspace, so they follow you rather than the workspace.'
 	)
-	// `$userStore.is_admin` is the role in the nav workspace, not necessarily in `ws`, so
+	// `actingUser?.is_admin` is the role in the nav workspace, not necessarily in `ws`, so
 	// the resolved role is keyed to the workspace it was read for, and an unresolved one
 	// reads as no admin: offering the field and taking it away on resolve would discard
 	// whatever was typed in between. Superadmin holds everywhere.
@@ -69,8 +73,8 @@ writes whichever of the two changed, including the tab that is not on screen.
 	let roleUnknown = $derived(roleRead !== undefined && !roleRead.user && !navIsTarget)
 	let isAdmin = $derived(
 		Boolean(
-			$userStore?.is_super_admin ||
-				(roleForTarget ? roleForTarget.is_admin : navIsTarget && $userStore?.is_admin)
+			actingUser?.is_super_admin ||
+				(roleForTarget ? roleForTarget.is_admin : navIsTarget && actingUser?.is_admin)
 		)
 	)
 
diff --git a/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte b/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
index 7694be3827..c9def4f9e6 100644
--- a/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
+++ b/frontend/src/lib/components/copilot/chat/AssistantSettingsModal.svelte
@@ -19,7 +19,6 @@ callers that already know which section they mean, such as the "+" menu's Manage
 	import Modal2 from '$lib/components/common/modal/Modal2.svelte'
 	import SidebarNavigation from '$lib/components/common/sidebar/SidebarNavigation.svelte'
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 	import { getAiChatManager } from './aiChatManagerContext'
 	import { summarizeTools } from './agentContext'
@@ -28,6 +27,9 @@ callers that already know which section they mean, such as the "+" menu's Manage
 	import AssistantInstructionsSection from './AssistantInstructionsSection.svelte'
 	import AssistantMcpSection from './AssistantMcpSection.svelte'
 	import AssistantFilesSection from './AssistantFilesSection.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const aiChatManager = getAiChatManager()
 
@@ -88,7 +90,7 @@ callers that already know which section they mean, such as the "+" menu's Manage
 	// unconditionally rather than behind `??`: short-circuiting it would leave this
 	// derived with no dependency at all, frozen on the workspace it first saw.
 	let ws = $derived.by(() => {
-		const active = $workspaceStore
+		const active = $operatingWorkspace
 		return aiChatManager.operatingWorkspace ?? active ?? ''
 	})
 
diff --git a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
index d2cf1dfee6..68a65d75fc 100644
--- a/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
+++ b/frontend/src/lib/components/copilot/chat/ChatContextPicker.svelte
@@ -19,7 +19,6 @@ On a workspace-leaf pick, emits a reference-only `WorkspaceScriptElement` /
 Content is materialized at message-prep time by `AIChatManager` — see PR #9216.
 -->
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { Database, Diff, FileText, Folder, Layers } from 'lucide-svelte'
 	import BarsStaggered from '$lib/components/icons/BarsStaggered.svelte'
 	import FlowModuleIcon from '$lib/components/flows/FlowModuleIcon.svelte'
@@ -45,6 +44,9 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 		type WorkspaceFlowElement,
 		type WorkspaceScriptElement
 	} from './context'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		availableContext: ContextElement[]
@@ -105,7 +107,7 @@ Content is materialized at message-prep time by `AIChatManager` — see PR #9216
 		aiChatManager.mode === AIMode.GLOBAL ? ['flow', 'script', 'app'] : ['flow', 'script']
 	)
 	const loader = useWorkspaceItemsLoader(
-		() => $workspaceStore,
+		() => $operatingWorkspace,
 		() => WORKSPACE_KINDS
 	)
 
diff --git a/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte b/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte
index 65abb0e1c5..3aec0fa2b6 100644
--- a/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte
+++ b/frontend/src/lib/components/copilot/chat/DatatableCreationPolicy.svelte
@@ -5,11 +5,13 @@
 
 	const aiChatManager = getAiChatManager()
 	import DefaultDatabaseSelector from '$lib/components/raw_apps/DefaultDatabaseSelector.svelte'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	import { createDatatablesResource } from '$lib/components/raw_apps/datatableUtils.svelte'
 
 	// Load available datatables from workspace using shared utility
-	const datatables = createDatatablesResource(() => $workspaceStore)
+	const datatables = createDatatablesResource(() => $operatingWorkspace)
 
 	const hasNoDatatables = $derived((datatables.current?.length ?? 0) === 0)
 
diff --git a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
index 364e7fceaf..adc3fe6184 100644
--- a/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
+++ b/frontend/src/lib/components/copilot/chat/LinkRenderer.svelte
@@ -34,8 +34,8 @@
 		title
 	}: Props = $props()
 
-	// The drawers ride with the docked chat, so a surface can render this pill with nothing
-	// able to open one.
+	// The drawers ride with the docked chat and the session tabs with the sessions page, so a
+	// surface can render this pill with nothing able to open one.
 	const available = $derived.by(() => {
 		const action = workspaceItemAction(wmKind, wmPath, wmTargetKind, wmRawApp === 'true')
 		return action && hasToolDisplayActionHandler(action.type) ? action : undefined
@@ -113,8 +113,8 @@
 					variant="subtle"
 					iconOnly
 					startIcon={{ icon: PanelRight }}
-					title="Open in drawer"
-					aria-label="Open {wmPath} in drawer"
+					title="Open in editor"
+					aria-label="Open {wmPath} in editor"
 					wrapperClasses="ml-0.5 inline-flex self-center shrink-0 opacity-0 group-hover:opacity-100 transition-opacity"
 					btnClasses="!w-auto !rounded !p-0.5 !text-tertiary"
 					onClick={openDrawer}
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index db2a0e22c4..84ee04d06f 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -125,8 +125,9 @@
 					<div class="truncate text-xs font-semibold text-primary">{card.title}</div>
 					<div class="truncate text-2xs text-secondary">{card.subtitle}</div>
 				</div>
-				<!-- open_created_resource is serviced solely by the docked chat's drawers, so
-				     elsewhere the card stands alone as a record of what the tool created. -->
+				<!-- open_created_resource is serviced only by the docked chat's drawers and the
+				     sessions page's tabs, so elsewhere the card stands alone as a record of what the
+				     tool created. -->
 				{#if hasToolDisplayActionHandler(action.type)}
 					<Button
 						unifiedSize="sm"
diff --git a/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts b/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
index bd0f3b3d0e..c76e892cdf 100644
--- a/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/createdResourceActions.svelte.ts
@@ -5,6 +5,10 @@ type MaybePromise<T> = T | Promise<T>
 type ToolDisplayActionHandler = (action: ToolDisplayAction) => MaybePromise<void>
 
 const toolDisplayActionHandlers = $state<Record<string, ToolDisplayActionHandler | undefined>>({})
+// Every registration per type, latest last: a page that takes over a type from the layout
+// (the sessions page opens items in its panel rather than in drawers) hands it back on
+// unmount instead of leaving the type unhandled.
+const registrations: Record<string, ToolDisplayActionHandler[]> = {}
 
 function formatUnknownError(error: unknown): string {
 	if (error instanceof Error) {
@@ -17,11 +21,16 @@ export function registerToolDisplayActionHandler(
 	type: ToolDisplayAction['type'],
 	handler: ToolDisplayActionHandler
 ): () => void {
+	const stack = (registrations[type] ??= [])
+	stack.push(handler)
 	toolDisplayActionHandlers[type] = handler
 	return () => {
-		if (toolDisplayActionHandlers[type] === handler) {
-			delete toolDisplayActionHandlers[type]
-		}
+		const at = stack.lastIndexOf(handler)
+		if (at < 0) return
+		stack.splice(at, 1)
+		const current = stack[stack.length - 1]
+		if (current) toolDisplayActionHandlers[type] = current
+		else delete toolDisplayActionHandlers[type]
 	}
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
index 6efcb58f98..7dfad3816f 100644
--- a/frontend/src/lib/components/copilot/chat/global/core.ts
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -308,8 +308,8 @@ export type GlobalActivePreviewContext = {
 	 * location: a tab can host a legacy app whose hash is app state, and a filter value
 	 * can be free text the user typed. Build it with `previewLocationContext`. */
 	location: string
-	/** The row whose drawer is open on that page. The list pages drop the anchor when
-	 * their drawer closes, so its absence means no row is open. */
+	/** The item open in its editor: a list page row whose drawer is open, or the item a
+	 * session tab edits. Its absence means no item is open. */
 	open?: string
 }
 
@@ -1332,7 +1332,7 @@ const buildGlobalSystemPrompt = (
 	// right now: the system prompt is the cached prefix, so a line appearing and
 	// disappearing between turns costs more cache than the tool call it saves.
 	const activePreviewRule = previewTools
-		? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the row the page is anchored at, whose drawer the user opened) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
+		? '\n- If the user message includes an ACTIVE PREVIEW section, that is the page the side panel is showing — resolve "this page", "here" and "it" against it, and against `open` (the item the user has open in its editor) when there is one. It already tells you what get_preview_status would, so do not call that tool to learn what is on screen; call it only to check the panel\'s *other* tabs.'
 		: ''
 	const pipelineBullet = `- A "data pipeline" is NOT a flow: it is a DAG of independent scripts in one folder, wired by storage assets (DuckLake/data tables/S3) and triggers via top-of-file \`pipeline\` / \`on <ref>\` annotation comments written in each script's comment syntax (\`--\` for SQL, \`#\` for Python/Bash, \`//\` for TS — a \`//\` line in a SQL node is a syntax error). When the user asks for a data pipeline (or to ingest/transform/materialize data across steps), call get_instructions with subject "pipeline" and build annotated script drafts — do not build a flow.${pipelineAlphaNote}`
 	// Hosting and edition come from the hostname and a store the app populates at init, so
@@ -1379,7 +1379,7 @@ ${pipelineBullet}
 - Use list_runs to find recent runs (optionally filtered by path, creator, label, or status), then get_run with a returned id to see what that run was called with, what it returned and what it logged — without starting a new test run.
 - get_run also covers what a flow run did per step — statuses and results across the whole execution tree, subflow steps and loop iterations included — and works while the flow is still running. Pass step to read one step's result in full (capped at 12k chars).
 - Use open_page to show a workspace page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, or Workspace settings on a specific tab (e.g. "open the failed runs of f/foo/bar", "open the schedule for X", "open the git sync settings"). Carry over every filter the user described — Runs takes the page's whole filter set (time window, path, user, folder, label, tag, worker, trigger kind, args/result, ...), so don't drop a criterion just because it wasn't in the request's main clause. Only the pages listed for this user in the tool are available; don't offer pages that aren't listed. Don't use it as a substitute for list_runs when you just need the data yourself.
-- Whenever you ask the user to perform a manual step in the UI — fill in a resource's credentials, set a secret variable's value, adjust a schedule or setting — call open_page in the same message, targeted at that item (pass open with its path to land in its edit drawer, or the page's filters otherwise). Never just describe where to click.
+- Whenever you ask the user to perform a manual step in the UI — fill in a resource's credentials, set a secret variable's value, adjust a schedule or setting — call open_page in the same message, targeted at that item (pass open with its path to land in its editor, or the page's filters otherwise). Never just describe where to click.
 - When the user is happy with the changes and wants to review or deploy them, use open_page with page "compare" — it opens the Compare & Deploy review page.${
 		previewTools
 			? ' By default it preselects the items this chat modified; pass items ("<kind>:<path>" entries) to control the selection'
@@ -2790,7 +2790,7 @@ const openPageFullSchema = z.object({
 		.string()
 		.optional()
 		.describe(
-			'Schedules/Triggers/Variables/Resources: exact item path to open in the edit drawer, e.g. f/foo/my_schedule. Use it whenever the user should act on one specific item (e.g. fill in credentials) so they land directly in its editor.'
+			'Schedules/Triggers/Variables/Resources: exact item path to open in its editor, e.g. f/foo/my_schedule — in a session, a preview tab of its own instead of the list page. Use it whenever the user should act on one specific item (e.g. fill in credentials) so they land directly in its editor.'
 		),
 	summary: z
 		.string()
@@ -2919,7 +2919,7 @@ function buildOpenPageDefSchema(
 }
 
 const OPEN_PAGE_DESCRIPTION =
-	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy review page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and ALWAYS when asking the user to perform a manual step themselves (fill in a resource\'s credentials, set a variable\'s value — pass open with the item path so its edit drawer opens directly). Use page "compare" when the user wants to review and deploy pending changes (the items field controls which changes are preselected). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
+	'Open a Windmill page with filters applied — Runs, Schedules, Variables, Resources, Assets, Audit logs, Folders, Groups, Triggers (by kind), Workspace settings (on a specific tab), or the Compare & Deploy review page. Inside an AI session it opens as a tab in the side-panel preview next to the chat; elsewhere it offers a clickable link. Use after surfacing something the user likely wants to inspect (e.g. "show me the failed runs of X", "open the schedule for Y", "open the git sync settings", "open the kafka triggers"), and ALWAYS when asking the user to perform a manual step themselves (fill in a resource\'s credentials, set a variable\'s value — pass open with the item path so its editor opens directly). Use page "compare" when the user wants to review and deploy pending changes (the items field controls which changes are preselected). This is the only way to show one of these pages in the session preview — open_preview only handles editable items (scripts, flows, raw apps, pipelines). Only pages listed for this user are available; do not offer others.'
 
 // Non-arg inputs the URL builder needs: the chat's operating workspace (the compare
 // page cannot fall back to its own store default inside a session preview) and the
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index dd84e479de..bd347224f9 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -784,11 +784,11 @@ export function pendingUserActionDetail(
 // the sessions page) react to mutating tools — refreshing previews — without
 // the tool layer knowing about the UI. Single slot; the consumer filters by name
 // and reads the tool args (e.g. the mutated item's `path`) to scope its refresh.
-let toolCompletionListener: ((toolName: string, args: any) => void) | undefined
+// `workspace` is the one the tool acted on: a path names an item only within it.
+export type ToolCompletionListener = (toolName: string, args: any, workspace: string) => void
+let toolCompletionListener: ToolCompletionListener | undefined
 
-export function setToolCompletionListener(
-	fn: ((toolName: string, args: any) => void) | undefined
-): void {
+export function setToolCompletionListener(fn: ToolCompletionListener | undefined): void {
 	toolCompletionListener = fn
 }
 
@@ -816,7 +816,7 @@ async function callTool<T>({
 		)
 	}
 	const result = await tool.fn({ args, workspace, helpers, toolCallbacks, toolId })
-	toolCompletionListener?.(functionName, args)
+	toolCompletionListener?.(functionName, args, workspace)
 	return result
 }
 
diff --git a/frontend/src/lib/components/dbt/DbtEditor.svelte b/frontend/src/lib/components/dbt/DbtEditor.svelte
index 4b30f8fa28..51a029c05a 100644
--- a/frontend/src/lib/components/dbt/DbtEditor.svelte
+++ b/frontend/src/lib/components/dbt/DbtEditor.svelte
@@ -11,7 +11,6 @@
 	import { createEventDispatcher, onDestroy, onMount } from 'svelte'
 	import type { Schema, SupportedLanguage } from '$lib/common'
 	import type { Preview, ScriptModule } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptySchema } from '$lib/utils'
 	import { inferArgs } from '$lib/infer'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
@@ -54,6 +53,9 @@
 	import { ChevronDown, CornerDownLeft, Play, Plus } from 'lucide-svelte'
 	import type { ScriptEditorWhitelabelCustomUi } from '../custom_ui'
 	import { processSecretArgs } from '../secretArgUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		schema = $bindable(),
@@ -86,7 +88,7 @@
 	} = $props()
 
 	const dispatch = createEventDispatcher()
-	let opWs = $derived(workspaceOverride ?? $workspaceStore)
+	let opWs = $derived(workspaceOverride ?? $operatingWorkspace)
 
 	/** The open file, or `null` for the descriptor at the project root. */
 	let openFile = $state<string | null>(null)
diff --git a/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte b/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte
index 51cb389616..2aec483e32 100644
--- a/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte
+++ b/frontend/src/lib/components/details/ErrorHandlerToggleButtonV2.svelte
@@ -3,7 +3,9 @@
 
 	import { FlowService, ScriptService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		kind: 'script' | 'flow'
@@ -25,11 +27,11 @@
 
 	async function toggleErrorHandler(): Promise<void> {
 		toggleState = !toggleState
-		if ($workspaceStore !== undefined) {
+		if ($operatingWorkspace !== undefined) {
 			try {
 				if (kind === 'flow') {
 					await FlowService.toggleWorkspaceErrorHandlerForFlow({
-						workspace: $workspaceStore,
+						workspace: $operatingWorkspace,
 						path: scriptOrFlowPath,
 						requestBody: {
 							muted: !errorHandlerMuted
@@ -37,7 +39,7 @@
 					})
 				} else {
 					await ScriptService.toggleWorkspaceErrorHandlerForScript({
-						workspace: $workspaceStore,
+						workspace: $operatingWorkspace,
 						path: scriptOrFlowPath,
 						requestBody: {
 							muted: !errorHandlerMuted
diff --git a/frontend/src/lib/components/flows/FlowAssetsHandler.svelte b/frontend/src/lib/components/flows/FlowAssetsHandler.svelte
index 947eca1a67..86fff85437 100644
--- a/frontend/src/lib/components/flows/FlowAssetsHandler.svelte
+++ b/frontend/src/lib/components/flows/FlowAssetsHandler.svelte
@@ -43,11 +43,13 @@
 		type RawScript
 	} from '$lib/gen'
 	import { deepEqual } from 'fast-equals'
-	import { workspaceStore } from '$lib/stores'
 	import S3FilePicker from '../S3FilePicker.svelte'
 	import ResourceEditorDrawer from '../ResourceEditorDrawer.svelte'
 	import { watch } from 'runed'
 	import { sendUserToast } from '$lib/toast'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		modules,
@@ -63,7 +65,7 @@
 
 	const flowGraphAssetsCtx = getContext<FlowGraphAssetContext | undefined>('FlowGraphAssetContext')
 	const { selectionManager, opWorkspace } = getContext<FlowEditorContext>('FlowEditorContext') || {}
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	// Expose the acting workspace to the asset explore controls (ExploreAssetButton
 	// reads it from this context; the DB manager / S3 picker act on it).
 	$effect(() => {
diff --git a/frontend/src/lib/components/flows/FlowEditor.svelte b/frontend/src/lib/components/flows/FlowEditor.svelte
index bf25a1dcda..a9c3a40e8a 100644
--- a/frontend/src/lib/components/flows/FlowEditor.svelte
+++ b/frontend/src/lib/components/flows/FlowEditor.svelte
@@ -40,14 +40,21 @@
 	import FlowPanelPlacementPicker from './common/FlowPanelPlacementPicker.svelte'
 	import { prefersSessionHandoff } from '../copilot/chat/global/gate'
 	import { openSourceInSession } from '$lib/components/sessions/sessionSwitch.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 	const { flowStore, selectionManager, pathStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 	// Flow paths repeat across workspaces, and a session keeps every tab it has visited alive, so two
 	// editors can hold the same path at once. Both halves are needed to tell them apart.
-	let editorWorkspace = $derived(opWorkspace?.() ?? $workspaceStore)
+	let editorWorkspace = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	function targetWorkspace(t: AgentEditorTarget): string | undefined {
-		return t.workspace ?? $workspaceStore
+		return t.workspace ?? $operatingWorkspace
 	}
 
 	const sessionScopedManager = getContext<AIChatManager>('aiChatManager')
@@ -404,7 +411,7 @@
 							if (
 								!sessionScopedManager &&
 								sessionOpen &&
-								prefersSessionHandoff($userStore?.operator)
+								prefersSessionHandoff(actingUser?.operator)
 							) {
 								void openSourceInSession(sessionOpen, {
 									previewParams: { selected: detail.moduleId },
diff --git a/frontend/src/lib/components/flows/FlowHistoryInner.svelte b/frontend/src/lib/components/flows/FlowHistoryInner.svelte
index 1f906c1e45..87c2306339 100644
--- a/frontend/src/lib/components/flows/FlowHistoryInner.svelte
+++ b/frontend/src/lib/components/flows/FlowHistoryInner.svelte
@@ -5,12 +5,14 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { classNames, displayDate, emptyString, sendUserToast } from '$lib/utils'
 	import { type Flow, FlowService, type FlowVersion } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { Skeleton } from '$lib/components/common'
 	import Button from '../common/button/Button.svelte'
 	import { ArrowRight, Loader2, Pencil, X } from 'lucide-svelte'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from './types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -21,7 +23,7 @@
 	let { path, allowFork = false, onHistoryRestore }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let loading: boolean = $state(false)
 
diff --git a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
index 063367cc85..5776c88025 100644
--- a/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
+++ b/frontend/src/lib/components/flows/common/FlowCardHeader.svelte
@@ -19,7 +19,7 @@
 	import FlowPanelChrome from './FlowPanelChrome.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
 	import DropdownV2 from '$lib/components/DropdownV2.svelte'
-	import { hubBaseUrlStore, workspaceStore } from '$lib/stores'
+	import { hubBaseUrlStore } from '$lib/stores'
 	import { DEFAULT_HUB_BASE_URL, PRIVATE_HUB_MIN_VERSION } from '$lib/hub'
 	import { getLatestHashForScript } from '$lib/scripts'
 	import { sendUserToast, type Item } from '$lib/utils'
@@ -27,6 +27,9 @@
 	import { getToolNameError } from '$lib/components/flows/agentToolUtils'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
 	import autosize from '$lib/autosize'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		flowModuleValue?: FlowModuleValue | undefined
@@ -65,7 +68,7 @@
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
 	const { scriptEditorDrawer, workspaceScriptSettingsDrawer } = flowEditorContext
 
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 	const scriptPath = $derived(flowModuleValue?.type === 'script' ? flowModuleValue.path : undefined)
 	const pinnedHash = $derived(flowModuleValue?.type === 'script' ? flowModuleValue.hash : undefined)
 	const isHub = $derived(scriptPath?.startsWith('hub/') ?? false)
diff --git a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
index 11e59769fc..a6e113f39b 100644
--- a/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
+++ b/frontend/src/lib/components/flows/content/AgentEditorModal.svelte
@@ -12,7 +12,6 @@
 	import EvalsPane from '$lib/components/aiEvals/EvalsPane.svelte'
 	import type { EvalsLocation } from '$lib/components/aiEvals/evalUtils'
 	import { ResourceService, type AgentDraft } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		agentEditorTarget,
 		agentWriteCount,
@@ -27,6 +26,9 @@
 	import { publishLinkedAgentTools } from '../flowState'
 	import { linkedModulesForAgent, linkedToolsScope } from '../linkedAgentToolsStore.svelte'
 	import AgentEditorHost from './AgentEditorHost.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		enableAi?: boolean
@@ -61,7 +63,7 @@
 		if (p) untrack(() => (lastShownAgent = p))
 	})
 
-	let ws = $derived(target?.workspace ?? $workspaceStore)
+	let ws = $derived(target?.workspace ?? $operatingWorkspace)
 	let host = $state<ReturnType<typeof AgentEditorHost> | undefined>(undefined)
 	let versionDrawer: Drawer | undefined = $state(undefined)
 	let saving = $state(false)
diff --git a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
index 9bfcb222b2..83be7c876e 100644
--- a/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
+++ b/frontend/src/lib/components/flows/content/AgentResourceBar.svelte
@@ -7,7 +7,6 @@
 	import Label from '$lib/components/Label.svelte'
 	import ResourcePathHint from '$lib/components/ResourcePathHint.svelte'
 	import { ResourceService, type InputTransform, type Resource } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { Bot, ChevronDown, ChevronUp, Save, Unlink, Pencil } from 'lucide-svelte'
 	import {
@@ -46,6 +45,9 @@
 	import type { AgentTool as AgentToolStrict } from '../agentToolUtils'
 	import { resource } from 'runed'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		agent = $bindable(),
@@ -65,7 +67,7 @@
 		toolInputs: Record<string, Record<string, InputTransform>>
 		moduleId: string
 		// The workspace the flow editor operates on (differs from the nav workspace in session/fork
-		// editors). All resource reads/writes must target it, not $workspaceStore.
+		// editors). All resource reads/writes must target it, not the navigation workspace.
 		opWorkspace?: string
 		// Scope for the linked-agent tools store (the flow path); must match what the graph reads.
 		flowPath?: string
@@ -80,7 +82,7 @@
 		linkedMemory?: { memory: unknown } | undefined
 	} = $props()
 
-	let ws = $derived(opWorkspace ?? $workspaceStore)
+	let ws = $derived(opWorkspace ?? $operatingWorkspace)
 
 	// How many times the linked agent has been written, from anywhere: this card's own save, or a
 	// deploy from the agent editor mounted alongside it. Both reads below key on it, so neither
diff --git a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
index 37fcfe8d1c..33a15922f5 100644
--- a/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
+++ b/frontend/src/lib/components/flows/content/AiAgentStepInputs.svelte
@@ -30,7 +30,6 @@
 	import type { Schema } from '$lib/common'
 	import { deepEqual } from 'fast-equals'
 	import { type InputTransform } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { allTrue, type DynamicInput as DynamicInputTypes } from '$lib/utils'
 	import { getContext, untrack, type Snippet } from 'svelte'
 	import { SvelteSet } from 'svelte/reactivity'
@@ -69,6 +68,9 @@
 	import AgentToolRoster from './AgentToolRoster.svelte'
 	import AgentMemoryNotes from './AgentMemoryNotes.svelte'
 	import { memoryOptionLabel, memoryPropertyFor } from '../flowInfers'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		schema: Schema | { properties?: Record<string, any> }
@@ -148,7 +150,7 @@
 		linkedMemory = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let inputCheck: { [id: string]: boolean } = $state({})
 
diff --git a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
index 4aede5e3d1..979717dae1 100644
--- a/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
+++ b/frontend/src/lib/components/flows/content/ExpandedSubflowStep.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { getContext, untrack } from 'svelte'
 	import { FlowService, type FlowModule } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
@@ -16,6 +15,9 @@
 	import { parseExpandedSubflowId } from '$lib/components/restartFromStepPath'
 	import { base } from '$app/paths'
 	import FlowPanelChrome from '../common/FlowPanelChrome.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/** Graph node id of the selected step, of the form `subflow:<step>[:<step>...]:<leaf>`. */
@@ -28,7 +30,7 @@
 
 	const { flowStore, flowEditorDrawer, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	let leafId = $derived(parseExpandedSubflowId(selectedId)?.leaf ?? selectedId)
 
diff --git a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
index 3103f310b4..6b4d73c6a0 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorDrawer.svelte
@@ -3,7 +3,6 @@
 	import FlowBuilder from '$lib/components/FlowBuilder.svelte'
 	import DiffDrawer from '$lib/components/DiffDrawer.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { ExternalLink, Loader2 } from 'lucide-svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { emptySchema, type StateStore } from '$lib/utils'
@@ -13,13 +12,16 @@
 	import type { FlowState } from '$lib/components/flows/flowState'
 	import type { FlowEditorContext } from '../types'
 	import { base } from '$app/paths'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let flowEditorDrawer: Drawer | undefined = $state()
 
 	const dispatch = createEventDispatcher()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	export async function openDrawer(path: string, cb: () => void, stepId?: string): Promise<void> {
 		flowPath = path
diff --git a/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte b/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
index cc2f5ea808..1094d60227 100644
--- a/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEnvironmentVariables.svelte
@@ -14,7 +14,9 @@
 	import ItemPicker from '$lib/components/ItemPicker.svelte'
 	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
 	import { VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		noEditor: boolean
@@ -34,7 +36,7 @@
 	let { noEditor }: Props = $props()
 
 	const { flowStore, opWorkspace } = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	if (!flowStore.val.value.flow_env) {
 		flowStore.val.value.flow_env = {}
diff --git a/frontend/src/lib/components/flows/content/FlowInput.svelte b/frontend/src/lib/components/flows/content/FlowInput.svelte
index 02e25bafa5..ca5c6d8073 100644
--- a/frontend/src/lib/components/flows/content/FlowInput.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInput.svelte
@@ -8,7 +8,6 @@
 	import JsonInputs from '$lib/components/JsonInputs.svelte'
 	import { convert } from '@redocly/json-to-json-schema'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
 	import EditableSchemaForm from '$lib/components/EditableSchemaForm.svelte'
 	import AddPropertyV2 from '$lib/components/schema/AddPropertyV2.svelte'
 	import FlowInputViewer from '$lib/components/FlowInputViewer.svelte'
@@ -57,6 +56,9 @@
 	import type { AIAgentConfig } from '../agentResourceUtils'
 	import FlowChat from '../conversations/FlowChat.svelte'
 	import { SPECIAL_MODULE_IDS } from '$lib/components/copilot/chat/shared'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		noEditor: boolean
@@ -84,7 +86,7 @@
 		opWorkspace
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 	// Acting workspace when the flow editor runs in an AI session; else the nav workspace.
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	// Get diffManager from the graph
 	const diffManager = $derived(flowModuleSchemaMap?.getDiffManager())
diff --git a/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte b/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte
index 4938b470af..2d4b124694 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsFlow.svelte
@@ -3,13 +3,15 @@
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import SearchItems from '$lib/components/SearchItems.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString } from '$lib/utils'
 
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { flip } from 'svelte/animate'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	interface Props {
 		children?: import('svelte').Snippet
 	}
@@ -17,7 +19,7 @@
 	let { children }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	// export let failureModule: boolean
 	const dispatch = createEventDispatcher()
diff --git a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
index eb875973dc..ae28a377c4 100644
--- a/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInputsQuick.svelte
@@ -7,13 +7,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import FlowScriptPickerQuick from '../pickers/FlowScriptPickerQuick.svelte'
 	import { defaultScriptLanguages, processInlineLangs } from '$lib/scripts'
-	import {
-		defaultScripts,
-		enterpriseLicense,
-		hubBaseUrlStore,
-		userStore,
-		workspaceStore
-	} from '$lib/stores'
+	import { defaultScripts, enterpriseLicense, hubBaseUrlStore } from '$lib/stores'
 	import type { SupportedLanguage } from '$lib/common'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from '$lib/components/custom_ui'
@@ -34,6 +28,14 @@
 		canHaveApproval,
 		canHaveFailure
 	} from '$lib/script_helpers'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const dispatch = createEventDispatcher()
 
@@ -65,8 +67,8 @@
 		refreshCount = 0
 	}: Props = $props()
 
-	if ($workspaceStore && cachedOwners?.[$workspaceStore]) {
-		owners = cachedOwners[$workspaceStore]
+	if ($operatingWorkspace && cachedOwners?.[$operatingWorkspace]) {
+		owners = cachedOwners[$operatingWorkspace]
 	}
 	type HubCompletion = {
 		path: string
@@ -400,7 +402,7 @@
 				<div class="text-2xs font-normal text-secondary ml-2"
 					>New {selectedKind != 'script' ? selectedKind + ' ' : ''}script</div
 				>
-				{#if $userStore?.is_admin || $userStore?.is_super_admin}
+				{#if actingUser?.is_admin || actingUser?.is_super_admin}
 					{#if !openScriptSettings}
 						<Button
 							onClick={() => (openScriptSettings = true)}
@@ -494,7 +496,7 @@
 					bind:owners={
 						() => owners,
 						(v) => {
-							$workspaceStore && (cachedOwners[$workspaceStore] = v)
+							$operatingWorkspace && (cachedOwners[$operatingWorkspace] = v)
 							owners = v
 						}
 					}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index 6c2093caa6..0c87d6fb9e 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -39,7 +39,6 @@
 	import type { ButtonProp } from '$lib/components/diffEditorTypes'
 	import { loadSchemaFromModule } from '../flowInfers'
 	import { type Job } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { checkIfParentLoop } from '../utils.svelte'
 	import { useWorkspaceScriptSettings } from '../useWorkspaceScriptSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
@@ -72,6 +71,9 @@
 	} from '$lib/components/debug'
 	import { Bug, Terminal } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const {
 		selectionManager,
@@ -103,7 +105,7 @@
 		return empty
 	}
 
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	interface Props {
 		flowModule: FlowModule
diff --git a/frontend/src/lib/components/flows/content/FlowModuleScript.svelte b/frontend/src/lib/components/flows/content/FlowModuleScript.svelte
index 021437d20a..ccb168cf75 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleScript.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleScript.svelte
@@ -18,10 +18,12 @@
 	import TimeAgo from '$lib/components/TimeAgo.svelte'
 	import { ScriptService, type ScriptLang } from '$lib/gen'
 	import { getScriptByPath, scriptLangToEditorLang } from '$lib/scripts'
-	import { workspaceStore } from '$lib/stores'
 	import { Loader2 } from 'lucide-svelte'
 	import { getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -46,7 +48,7 @@
 	}: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let code: string | undefined = $state()
 	let previousCode: string | undefined = $state()
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
index 1230de1b05..b4bb2538ae 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
@@ -8,7 +8,7 @@
 	import { Alert, Button, Tab, Tabs } from '$lib/components/common'
 	import { GroupService, type FlowModule } from '$lib/gen'
 	import { emptySchema, emptyString } from '$lib/utils'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores.js'
+	import { enterpriseLicense } from '$lib/stores.js'
 	import { SecondsInput } from '../../common'
 	import PropPickerWrapper from '../propPicker/PropPickerWrapper.svelte'
 	import type { FlowEditorContext } from '../types'
@@ -21,12 +21,15 @@
 	import { Pen, Plus } from 'lucide-svelte'
 	import { slideDynamic } from '$lib/transitions'
 	import { logFeatureUsage } from '$lib/utils/featureUsage'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type ApprovalSkin = NonNullable<NonNullable<FlowModule['suspend']>['skin']>
 
 	const { selectionManager, flowStateStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	const result = flowStateStore.val[selectionManager.getSelectedId()]?.previewResult ?? {}
 	let editor: SimpleEditor | undefined = $state(undefined)
 
@@ -56,7 +59,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore && allUserGroups.length === 0) {
+		if ($operatingWorkspace && allUserGroups.length === 0) {
 			untrack(() => {
 				loadGroups()
 			})
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte b/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
index 620f0136dd..b319da9549 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
@@ -2,6 +2,7 @@
 	import { createEventDispatcher, getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { workerTags, workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { WorkerService } from '$lib/gen'
 	import WorkerTagSelect from '$lib/components/WorkerTagSelect.svelte'
 
@@ -25,7 +26,8 @@
 	// A fork-scoped session deploys to opWorkspace, not $workspaceStore. Keep a local
 	// tag list in that case so the gate reflects the fork without clobbering the
 	// shared, navigation-scoped `workerTags` cache.
-	let effectiveWorkspace = $derived(opWorkspace?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let effectiveWorkspace = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	let usesLocal = $derived(
 		effectiveWorkspace != undefined && effectiveWorkspace !== $workspaceStore
 	)
diff --git a/frontend/src/lib/components/flows/content/FlowPathViewer.svelte b/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
index 8ef7b12dee..bf96d181af 100644
--- a/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
+++ b/frontend/src/lib/components/flows/content/FlowPathViewer.svelte
@@ -6,24 +6,26 @@
 	import type { TriggerContext } from '$lib/components/triggers'
 	import { Triggers } from '$lib/components/triggers/triggers.svelte'
 	import { FlowService, type Flow, type TriggersCount } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, setContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { writable } from 'svelte/store'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
 		noSide?: boolean
 		fillAvailableHeight?: boolean
 		/** Explicit workspace override; takes precedence over the flow-editor
-		 * `opWorkspace` context and the nav `$workspaceStore`. */
+		 * `opWorkspace` context and the operating workspace. */
 		workspace?: string
 	}
 
 	let { path, noSide = false, fillAvailableHeight = false, workspace = undefined }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(workspace ?? flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(workspace ?? flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let flow: Flow | undefined = $state(undefined)
 
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index 8e78a04269..de3733d238 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -8,7 +8,7 @@
 	import { Alert, Button, SecondsInput } from '$lib/components/common'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import { isCloudHosted } from '$lib/cloud'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
@@ -31,6 +31,14 @@
 		type OnBehalfOfChoice
 	} from '$lib/components/OnBehalfOfSelector.svelte'
 	import { modulesWithRetryOrSleep, SAME_WORKER_INCOMPATIBLE_MSG } from '../utils.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		noEditor: boolean
@@ -52,8 +60,8 @@
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const WM_DEPLOYERS_GROUP = 'wm_deployers'
-	let isDeployer = $derived($userStore?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
-	let canPreserve = $derived(!!$userStore?.is_admin || !!$userStore?.is_super_admin || isDeployer)
+	let isDeployer = $derived(actingUser?.groups?.includes(WM_DEPLOYERS_GROUP) ?? false)
+	let canPreserve = $derived(!!actingUser?.is_admin || !!actingUser?.is_super_admin || isDeployer)
 	let onBehalfOfChoice: OnBehalfOfChoice = $state(undefined)
 	let customOnBehalfOfEmail: string = $state('')
 	let myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
@@ -475,7 +483,7 @@
 					/>
 					{#if flowStore.val.on_behalf_of_email && canPreserve}
 						&rarr; <OnBehalfOfSelector
-							targetWorkspace={opWorkspace?.() ?? $workspaceStore ?? ''}
+							targetWorkspace={opWorkspace?.() ?? $operatingWorkspace ?? ''}
 							targetValue={$savedOnBehalfOfEmail}
 							selected={onBehalfOfChoice}
 							onSelect={(choice, details) => {
diff --git a/frontend/src/lib/components/flows/content/McpToolEditor.svelte b/frontend/src/lib/components/flows/content/McpToolEditor.svelte
index ac5e0f3463..f69aa25d1d 100644
--- a/frontend/src/lib/components/flows/content/McpToolEditor.svelte
+++ b/frontend/src/lib/components/flows/content/McpToolEditor.svelte
@@ -30,6 +30,9 @@
 	import { getContext, untrack } from 'svelte'
 	import McpConnect from '$lib/components/mcp/McpConnect.svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		tool: McpTool
@@ -39,7 +42,7 @@
 	let { tool = $bindable(), noEditor = false }: Props = $props()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let refreshCount = $state(0)
 	let resourcePicker: ResourcePicker | undefined = $state()
diff --git a/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte b/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
index 362b7bca37..ee9d646419 100644
--- a/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/ScriptEditorDrawer.svelte
@@ -5,7 +5,6 @@
 	import ScriptEditor from '$lib/components/ScriptEditor.svelte'
 	import { ScriptService, type Preview, type Script } from '$lib/gen'
 	import { inferArgs } from '$lib/infer'
-	import { workspaceStore } from '$lib/stores'
 	import { Loader2, Save, DiffIcon, Settings } from 'lucide-svelte'
 	import ScriptAdvancedSettings from '$lib/components/ScriptAdvancedSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
@@ -21,13 +20,16 @@
 	import { fade } from 'svelte/transition'
 	import WorkerTagSelect from '$lib/components/WorkerTagSelect.svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let scriptEditorDrawer: Drawer | undefined = $state()
 
 	const dispatch = createEventDispatcher()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	export async function openDrawer(hash: string, cb: () => void): Promise<void> {
 		script = undefined
diff --git a/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
index 3a88e6214a..f9ed5f671d 100644
--- a/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
+++ b/frontend/src/lib/components/flows/content/WorkspaceScriptSettingsDrawer.svelte
@@ -4,14 +4,16 @@
 	import ScriptAdvancedSettings from '$lib/components/ScriptAdvancedSettings.svelte'
 	import ScriptSettingsBadges from '$lib/components/ScriptSettingsBadges.svelte'
 	import { ScriptService, type Script } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { emptyString, sendUserToast } from '$lib/utils'
 	import { Loader2, Save } from 'lucide-svelte'
 	import { getContext } from 'svelte'
 	import type { FlowEditorContext } from '../types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	// cache_ignore_s3_path lives on NewScript but not the returned Script type;
diff --git a/frontend/src/lib/components/flows/conversations/FlowChat.svelte b/frontend/src/lib/components/flows/conversations/FlowChat.svelte
index 6639f78391..52116991c6 100644
--- a/frontend/src/lib/components/flows/conversations/FlowChat.svelte
+++ b/frontend/src/lib/components/flows/conversations/FlowChat.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { createChat, type Chat, type ChatState } from 'windmill-chat'
 	import FlowConversationsSidebar from './FlowConversationsSidebar.svelte'
@@ -8,6 +8,9 @@
 	import type { FlowEditorContext } from '../types'
 	import type { FlowModule } from '$lib/gen'
 	import { FRAME_CLASS, type ChatFrame } from './flowChatProps'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/**
@@ -64,7 +67,7 @@
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
 	// The editor may act on a workspace other than the nav store's (AI-session live editor).
-	const workspace = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	const workspace = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let chat = $state<Chat | undefined>(undefined)
 	let chatState = $state<ChatState | undefined>(undefined)
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 22b74230b4..044e52c6ba 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -20,7 +20,6 @@
 	import { overlayPortalTarget } from '$lib/components/common/overlayHost.svelte'
 
 	import { locateModules, groupByParent } from '../multiSelectUtils'
-	import { workspaceStore } from '$lib/stores'
 	import FlowGraphV2 from '$lib/components/graph/FlowGraphV2.svelte'
 	import { replaceId } from '../flowStore.svelte'
 	import { setScheduledPollSchedule, type TriggerContext } from '$lib/components/triggers'
@@ -50,6 +49,9 @@
 		dfsStructure,
 		moduleToStructureNode
 	} from '$lib/components/graph/flowStructure'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		sidebarSize?: number | undefined
@@ -114,7 +116,7 @@
 	const { customUi, selectionManager, history, flowStateStore, flowStore, pathStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 
 	const moveManager = new MoveManager()
 	const { triggersCount, triggersState } = getContext<TriggerContext>('TriggerContext')
diff --git a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
index 7c75d97fab..3c50e213f1 100644
--- a/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
+++ b/frontend/src/lib/components/flows/map/InsertModuleInner.svelte
@@ -12,10 +12,12 @@
 	import RefreshButton from '$lib/components/common/button/RefreshButton.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { ResourceService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import type { FlowEditorContext } from '../types'
 	import { logReusableAgentUsage } from '../agentTelemetry'
 	import { BotIcon, Loader2, Plus } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 	interface Props {
@@ -56,7 +58,7 @@
 
 	// Optional: this picker also renders outside the flow editor's context (the triggers wrapper).
 	const flowEditorContext = getContext<FlowEditorContext | undefined>('FlowEditorContext')
-	let ws = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let ws = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	// Flagged for the whole menu, whichever pane is showing: the flow builder walks node
 	// selection on ArrowUp/ArrowDown while it is unset, which tears the popover down.
diff --git a/frontend/src/lib/components/flows/pickers/PickHubScript.svelte b/frontend/src/lib/components/flows/pickers/PickHubScript.svelte
index 05205d8335..2e63266a58 100644
--- a/frontend/src/lib/components/flows/pickers/PickHubScript.svelte
+++ b/frontend/src/lib/components/flows/pickers/PickHubScript.svelte
@@ -9,13 +9,16 @@
 	import { ScriptService, type HubScriptKind } from '$lib/gen'
 	import { Loader2 } from 'lucide-svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
-	import { disableHubStore, workspaceStore } from '$lib/stores'
+	import { disableHubStore } from '$lib/stores'
 	import { logHubScriptPick } from '$lib/utils/featureUsage'
 	import {
 		alphabetical,
 		byPopularity,
 		localCountsByIntegration
 	} from '$lib/components/pickerPopularity'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		kind?: HubScriptKind & string
@@ -66,7 +69,7 @@
 			// Independent reads, so they share one round trip before first paint.
 			const [integrations, local] = await Promise.all([
 				listHubIntegrationsShared(filterKind),
-				$workspaceStore ? localCountsByIntegration($workspaceStore) : {}
+				$operatingWorkspace ? localCountsByIntegration($operatingWorkspace) : {}
 			])
 			const hubPicks = Object.fromEntries(integrations.map((x) => [x.name, x.picks ?? 0]))
 			popularity = byPopularity(hubPicks, local)
diff --git a/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte b/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
index 2499c285c4..6648c622c0 100644
--- a/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/PickHubScriptQuick.svelte
@@ -42,7 +42,7 @@
 	import { Circle, ExternalLink } from 'lucide-svelte'
 	import Popover from '$lib/components/Popover.svelte'
 	import { usePromise } from '$lib/svelte5Utils.svelte'
-	import { disableHubStore, hubBaseUrlStore, userStore, workspaceStore } from '$lib/stores'
+	import { disableHubStore, hubBaseUrlStore, userStore } from '$lib/stores'
 	import { get } from 'svelte/store'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { Alert } from '$lib/components/common'
@@ -53,6 +53,9 @@
 		byPopularity,
 		localCountsByIntegration
 	} from '$lib/components/pickerPopularity'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let customUi: undefined | FlowBuilderWhitelabelCustomUi = getContext('customUi')
 
@@ -113,7 +116,7 @@
 			// Independent reads, so they share one round trip before first paint.
 			const [integrations, local] = await Promise.all([
 				listHubIntegrationsShared(filterKind, refreshCount),
-				$workspaceStore ? localCountsByIntegration($workspaceStore) : {}
+				$operatingWorkspace ? localCountsByIntegration($operatingWorkspace) : {}
 			])
 			const hubPicks = Object.fromEntries(integrations.map((x) => [x.name, x.picks ?? 0]))
 			popularity = byPopularity(hubPicks, local)
diff --git a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
index 575744cb04..5bfb13bec4 100644
--- a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
+++ b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPicker.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { ScriptService } from '$lib/gen'
@@ -11,6 +10,9 @@
 	import Toggle from '$lib/components/Toggle.svelte'
 	import NoItemFound from '$lib/components/home/NoItemFound.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Item = {
 		path: string
@@ -24,7 +26,7 @@
 	let filteredItems = $state(undefined) as (Item & { marked?: string })[] | undefined
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 	interface Props {
 		kind?: 'script' | 'trigger' | 'approval' | 'failure' | 'preprocessor'
 		isTemplate?: boolean | undefined
@@ -55,10 +57,10 @@
 	const dispatch = createEventDispatcher()
 	let lockHash = $state(false)
 	$effect(() => {
-		$workspaceStore && kind && untrack(() => loadItems())
+		$operatingWorkspace && kind && untrack(() => loadItems())
 	})
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			ownerFilter = undefined
 		}
 	})
diff --git a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
index 9e3a20b4a7..aaf198fd01 100644
--- a/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
+++ b/frontend/src/lib/components/flows/pickers/WorkspaceScriptPickerQuick.svelte
@@ -1,4 +1,5 @@
 <script module lang="ts">
+	import { workspaceStore } from '$lib/stores'
 	let initialWorkspace = get(workspaceStore)
 	let loadItemsCached = createCache(
 		({
@@ -36,7 +37,6 @@
 </script>
 
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher, getContext, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { FlowService, ScriptService } from '$lib/gen'
@@ -50,6 +50,9 @@
 	import { get } from 'svelte/store'
 	import { userStore } from '$lib/stores'
 	import Button from '$lib/components/common/button/Button.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Item = {
 		path: string
@@ -59,7 +62,7 @@
 	}
 
 	const flowEditorContext = getContext<FlowEditorContext>('FlowEditorContext')
-	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(flowEditorContext?.opWorkspace?.() ?? $operatingWorkspace)
 
 	let items = usePromise(
 		async () => await loadItemsCached({ workspace: opWs!, kind, isTemplate, refreshCount }),
@@ -123,10 +126,10 @@
 	}
 	$effect(() => {
 		refreshCount
-		$workspaceStore && kind && untrack(() => items.refresh())
+		$operatingWorkspace && kind && untrack(() => items.refresh())
 	})
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			ownerFilter = undefined
 		}
 	})
diff --git a/frontend/src/lib/components/flows/propPicker/StepHistory.svelte b/frontend/src/lib/components/flows/propPicker/StepHistory.svelte
index 67190154b8..8fc9a3493e 100644
--- a/frontend/src/lib/components/flows/propPicker/StepHistory.svelte
+++ b/frontend/src/lib/components/flows/propPicker/StepHistory.svelte
@@ -10,12 +10,14 @@
 <script lang="ts">
 	import InfiniteList from '$lib/components/InfiniteList.svelte'
 	import { JobService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, createEventDispatcher, untrack } from 'svelte'
 	import type { FlowEditorContext } from '../types'
 	import { Pin } from 'lucide-svelte'
 	import { Cell } from '$lib/components/table'
 	import JobPickerLight from './JobPickerLight.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		selected?: string | undefined
@@ -41,7 +43,7 @@
 
 	const { pathStore, flowStateStore, opWorkspace } =
 		getContext<FlowEditorContext>('FlowEditorContext') ?? {}
-	let opWs = $derived(opWorkspace?.() ?? $workspaceStore)
+	let opWs = $derived(opWorkspace?.() ?? $operatingWorkspace)
 	const dispatch = createEventDispatcher()
 
 	let infiniteList: InfiniteList | undefined = $state(undefined)
diff --git a/frontend/src/lib/components/graph/FlowGraphV2.svelte b/frontend/src/lib/components/graph/FlowGraphV2.svelte
index 4c004a4f56..3c870832ee 100644
--- a/frontend/src/lib/components/graph/FlowGraphV2.svelte
+++ b/frontend/src/lib/components/graph/FlowGraphV2.svelte
@@ -55,7 +55,6 @@
 	import FlowYamlEditor from '../flows/header/FlowYamlEditor.svelte'
 	import BranchOneEndNode from './renderers/nodes/branchOneEndNode.svelte'
 	import type { TriggerContext } from '../triggers'
-	import { workspaceStore } from '$lib/stores'
 	import SubflowBound from './renderers/nodes/SubflowBound.svelte'
 	import DiffDrawer from '../DiffDrawer.svelte'
 	import ViewportResizer from './ViewportResizer.svelte'
@@ -112,6 +111,9 @@
 		locateModules,
 		areContiguousSiblings
 	} from '../flows/multiSelectUtils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let useDataflow: Writable<boolean | undefined> = writable<boolean | undefined>(false)
 	let showAssets: Writable<boolean | undefined> = writable<boolean | undefined>(true)
@@ -266,7 +268,7 @@
 		fullSize = false,
 		disableAi = false,
 		triggerNode = false,
-		workspace = $workspaceStore ?? 'NO_WORKSPACE',
+		workspace = $operatingWorkspace ?? 'NO_WORKSPACE',
 		editMode = false,
 		allowSimplifiedPoll = true,
 		expandedSubflows = $bindable({}),
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
index 12cf247c9a..cf2a7339c6 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
@@ -207,10 +207,13 @@
 	import type { Edge, Node } from '@xyflow/svelte'
 
 	import { getNodeColorClasses, NODE } from '../../util'
-	import { userStore } from '$lib/stores'
 	import { deepEqual } from 'fast-equals'
 	import { slide } from 'svelte/transition'
 	import AssetColumnBadges from '$lib/components/assets/AssetColumnBadges.svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		data: AssetN['data']
@@ -279,7 +282,7 @@
 							Could not find resource
 						{/snippet}
 					</Tooltip>
-				{:else if isSelected && assetCanBeExplored(data.asset, cachedResourceMetadata) && !$userStore?.operator}
+				{:else if isSelected && assetCanBeExplored(data.asset, cachedResourceMetadata) && !actingUser?.operator}
 					<div transition:slide={{ axis: 'x', duration: 100 }}>
 						<ExploreAssetButton
 							btnClasses="rounded-none"
diff --git a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
index 6d996e76e4..c6b86b1cc7 100644
--- a/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
+++ b/frontend/src/lib/components/jobs/MissingWorkerTagAlert.svelte
@@ -2,9 +2,11 @@
 	import { base } from '$app/paths'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { WorkerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { resource } from 'runed'
 	import { hasWorkerForTag } from './missingWorker'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		/** Worker tag the feature's jobs run on. */
@@ -17,7 +19,7 @@
 
 	let { tag, subject, workspace = undefined, class: className = '' }: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	// With per-workspace default tags, jobs run on a workspace-suffixed variant of
 	// `tag`, so probing the bare tag would warn about a tag nothing uses. The
diff --git a/frontend/src/lib/components/metrics/MetricsDrawer.svelte b/frontend/src/lib/components/metrics/MetricsDrawer.svelte
index cdc640fba8..223b490041 100644
--- a/frontend/src/lib/components/metrics/MetricsDrawer.svelte
+++ b/frontend/src/lib/components/metrics/MetricsDrawer.svelte
@@ -2,7 +2,6 @@
 	import { Drawer, DrawerContent, Button, ClearableInput } from '$lib/components/common'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { DataMetricService, type DataMetric } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { SvelteSet } from 'svelte/reactivity'
 	import {
 		attachAliasFor,
@@ -16,6 +15,9 @@
 	import { Copy, Play } from 'lucide-svelte'
 	import SqlRepl from '$lib/components/SqlRepl.svelte'
 	import SimpleAgTable from '$lib/components/SimpleAgTable.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let {
 		getCode,
@@ -27,7 +29,7 @@
 		workspace?: string
 	} = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let entries = $state<DataMetric[]>([])
diff --git a/frontend/src/lib/components/operatingWorkspace.svelte.ts b/frontend/src/lib/components/operatingWorkspace.svelte.ts
new file mode 100644
index 0000000000..93a7f2c0de
--- /dev/null
+++ b/frontend/src/lib/components/operatingWorkspace.svelte.ts
@@ -0,0 +1,48 @@
+import { getContext, setContext } from 'svelte'
+import { fromStore, toStore, type Readable } from 'svelte/store'
+import { workspaceStore } from '$lib/stores'
+import { withWorkspaceParam } from './sessions/sessionMode.svelte'
+import { useActingUser } from '$lib/actingUser.svelte'
+
+// The workspace a subtree acts on. An AI session edits its (possibly forked) workspace while
+// `workspaceStore` stays on the navigation workspace, and a component that reads the navigation
+// store directly writes to the parent from inside a fork's editor. So the hosts that embed an
+// editor for another workspace set it once, and every component under them reads
+// `useOperatingWorkspace()` instead of `$workspaceStore` — nothing has to thread it through props.
+// Outside such a host it is the navigation store itself.
+
+const KEY = Symbol('operatingWorkspace')
+const navigation = fromStore(workspaceStore)
+
+/** Declare the workspace this subtree acts on. A getter, read wherever the workspace is used;
+ * resolving to nothing defers to the enclosing host. Reads context: call during component
+ * initialisation. */
+export function setOperatingWorkspace(resolve: () => string | undefined): void {
+	const outer = getContext<(() => string | undefined) | undefined>(KEY)
+	setContext(KEY, outer ? () => resolve() ?? outer() : resolve)
+}
+
+/** The workspace this component acts on, as a store. Reads context: call during component
+ * initialisation. Falls back to the navigation workspace where no host set one, or where the
+ * host's resolves to nothing. */
+export function useOperatingWorkspace(): Readable<string | undefined> {
+	const resolve = getContext<(() => string | undefined) | undefined>(KEY)
+	return resolve ? toStore(() => resolve() ?? navigation.current) : workspaceStore
+}
+
+/** The user acting in this subtree's operating workspace: `$userStore` describes the navigation
+ * workspace, so a permission check reading it inside a fork's editor answers about the parent —
+ * enabling or disabling controls by the wrong roles. Unresolved reads as unknown, which
+ * `canWrite`/`isOwner` refuse; ask `resolved` before rendering that as a denial. Reads context
+ * and registers an effect: call during component initialisation. */
+export function useOperatingUser(): ReturnType<typeof useActingUser> {
+	const operating = fromStore(useOperatingWorkspace())
+	return useActingUser(() => operating.current)
+}
+
+/** Stamps this component's operating workspace onto an in-app link, which otherwise opens in
+ * the navigation workspace. Reads context: call during component initialisation. */
+export function useOperatingWorkspaceHref(): (href: string) => string {
+	const operating = fromStore(useOperatingWorkspace())
+	return (href) => withWorkspaceParam(href, operating.current)
+}
diff --git a/frontend/src/lib/components/operatingWorkspace.test.ts b/frontend/src/lib/components/operatingWorkspace.test.ts
new file mode 100644
index 0000000000..1c14aa7262
--- /dev/null
+++ b/frontend/src/lib/components/operatingWorkspace.test.ts
@@ -0,0 +1,119 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+
+const components = dirname(fileURLToPath(import.meta.url))
+const lib = dirname(components)
+
+// The editors an AI session mounts for its own, possibly forked, workspace. Everything they
+// render acts on that workspace, so a component reading the navigation store directly writes
+// to the parent from inside a fork's editor — and nothing at runtime would say so.
+const SESSION_EDITORS = [
+	'sessions/ScriptEditorView.svelte',
+	'sessions/FlowEditorView.svelte',
+	'sessions/RawAppEditorView.svelte',
+	'sessions/PipelineEditorView.svelte',
+	'sessions/PageItemEditorView.svelte'
+]
+
+// Components that read the navigation store on purpose, with why. Keep each reason true.
+const NAVIGATION_READERS: Record<string, string> = {
+	'ScriptBuilder.svelte': 'keeps its own tag list when it acts off the navigation workspace',
+	'WorkerTagSelect.svelte': 'the shared worker tag cache is navigation-scoped',
+	'WorkerTagPicker.svelte': 'the shared worker tag cache is navigation-scoped',
+	'flows/content/FlowModuleWorkerTagSelect.svelte':
+		'the shared worker tag cache is navigation-scoped',
+	'FolderPicker.svelte': '`$userStore` describes the navigation workspace',
+	'FolderEditor.svelte': '`$userStore` describes the navigation workspace'
+}
+
+// Followed through plain modules too: a barrel like `$lib/components/common` is how most
+// components are reached.
+function resolveImport(from: string, spec: string): string | undefined {
+	const target = spec.startsWith('$lib/')
+		? join(lib, spec.slice('$lib/'.length))
+		: spec.startsWith('.')
+			? resolve(dirname(from), spec)
+			: undefined
+	if (!target || target.includes('/gen/')) return undefined
+	const candidates = [target, `${target}.ts`, `${target}.svelte.ts`, join(target, 'index.ts')]
+	return candidates.find((c) => /\.(svelte|ts|js)$/.test(c) && existsSync(c))
+}
+
+function reachableComponents(): string[] {
+	const seen = new Set<string>()
+	const queue = SESSION_EDITORS.map((f) => join(components, f))
+	while (queue.length) {
+		const file = queue.pop()!
+		if (seen.has(file)) continue
+		seen.add(file)
+		const source = readFileSync(file, 'utf-8')
+		for (const m of source.matchAll(/(?:from\s+|import\(\s*)['"]([^'"]+)['"]/g)) {
+			const next = resolveImport(file, m[1])
+			if (next) queue.push(next)
+		}
+	}
+	return [...seen].filter((f) => f.endsWith('.svelte')).map((f) => relative(components, f))
+}
+
+// Module scripts have no component context to read the operating workspace from, so what
+// they fetch takes its workspace explicitly; only instance code and markup are checked.
+function instanceCode(file: string): string {
+	return readFileSync(join(components, file), 'utf-8')
+		.replace(/<script\b[^>]*\bmodule\b[^>]*>[\s\S]*?<\/script>/g, '')
+		.replace(/<!--[\s\S]*?-->|\/\*[\s\S]*?\*\/|(^|[^:])\/\/.*$/gm, '$1')
+}
+
+function readsNavigationStore(file: string): boolean {
+	return /\$workspaceStore\b|\bget\(workspaceStore\)/.test(instanceCode(file))
+}
+
+// Roles are per workspace, so a permission judged from `$userStore` inside a fork's editor
+// answers about the parent: it disables edits the user may make, or offers ones the backend
+// then refuses. Identity (username, email) is the same person in either, and stays.
+// Following one alias, the shape that slipped past this before: `let user = $derived(… $userStore
+// …)` with the permission checks reading `user`. Aliasing the navigation user for identity —
+// their username, or which workspace they are on — is fine and stays.
+function judgesByAliasedNavigationUser(code: string): boolean {
+	const aliases = [...code.matchAll(/(?:let|const)\s+(\w+)\s*=\s*\$derived[^\n]*\$userStore/g)].map(
+		(m) => m[1]
+	)
+	return aliases.some((name) =>
+		new RegExp(
+			`${name}(?:\\?|!)?\\.(?:is_admin|is_super_admin|operator|folders|groups)\\b|canWrite\\((?:[^()]|\\([^()]*\\))*?\\b${name}\\b|isOwner\\((?:[^()]|\\([^()]*\\))*?\\b${name}\\b`
+		).test(code)
+	)
+}
+
+const PERMISSION_READ =
+	/canWrite\((?:[^()]|\([^()]*\))*?\$userStore|isOwner\((?:[^()]|\([^()]*\))*?\$userStore|\$userStore(?:\?|!)?\.(?:is_admin|is_super_admin|operator|folders|groups)\b/
+
+// Components that judge by the navigation user on purpose, with why.
+const NAVIGATION_JUDGES: Record<string, string> = {
+	'FolderPicker.svelte':
+		'resolves the target workspace’s member itself, and asks `$userStore` only for the navigation one',
+	'FolderEditor.svelte':
+		'resolves the target workspace’s member itself, and asks `$userStore` only for the navigation one'
+}
+
+describe('components under a session editor', () => {
+	it('read the operating workspace, not the navigation store', () => {
+		const reachable = reachableComponents()
+		// A walk that finds nothing would pass vacuously.
+		expect(reachable).toContain('triggers/http/RouteEditorInner.svelte')
+		const offenders = reachable.filter((f) => !(f in NAVIGATION_READERS) && readsNavigationStore(f))
+		expect(offenders).toEqual([])
+	})
+
+	it('judge permissions by the user acting in that workspace', () => {
+		const reachable = reachableComponents()
+		expect(reachable).toContain('triggers/PermissionedAsLine.svelte')
+		const offenders = reachable.filter((f) => {
+			if (f in NAVIGATION_JUDGES) return false
+			const code = instanceCode(f)
+			return PERMISSION_READ.test(code) || judgesByAliasedNavigationUser(code)
+		})
+		expect(offenders).toEqual([])
+	})
+})
diff --git a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
index 9746991d6b..d9684430c5 100644
--- a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
+++ b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
@@ -26,13 +26,15 @@
 		Braces
 	} from 'lucide-svelte'
 	import S3FilePicker from '../S3FilePicker.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import AnimatedButton from '$lib/components/common/button/AnimatedButton.svelte'
 	import Popover from '../Popover.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import ContextMenu, {
 		type ContextMenuItem
 	} from '$lib/components/common/contextmenu/ContextMenu.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		json: any
@@ -408,16 +410,14 @@
 					<div class="flex">
 						<span class="text-primary">{closeBracket}</span>
 						{#if getTypeAsString(jsonFiltered) === 's3object'}
-							{@const s3DownloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
+							{@const s3DownloadApiPath = `/w/${$operatingWorkspace}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
 							{@const s3DownloadName = jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
 							{#if shouldDownloadViaClient()}
 								<button
 									class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
 									onclick={() => downloadViaClient(s3DownloadApiPath, s3DownloadName)}
 								>
-									<span class="flex items-center gap-1"
-										><Download size={12} />download</span
-									>
+									<span class="flex items-center gap-1"><Download size={12} />download</span>
 								</button>
 							{:else}
 								<a
@@ -425,9 +425,7 @@
 									href={`/api${s3DownloadApiPath}`}
 									download={s3DownloadName}
 								>
-									<span class="flex items-center gap-1"
-										><Download size={12} />download</span
-									>
+									<span class="flex items-center gap-1"><Download size={12} />download</span>
 								</a>
 							{/if}
 							<button
diff --git a/frontend/src/lib/components/propertyPicker/PropPicker.svelte b/frontend/src/lib/components/propertyPicker/PropPicker.svelte
index ae02462942..b80a13de1d 100644
--- a/frontend/src/lib/components/propertyPicker/PropPicker.svelte
+++ b/frontend/src/lib/components/propertyPicker/PropPicker.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
 	import { ResourceService, VariableService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { getContext, onDestroy, untrack } from 'svelte'
 	import { Badge, Button } from '../common'
 	import type { PropPickerWrapperContext } from '../flows/propPicker/PropPickerWrapper.svelte'
@@ -12,6 +11,9 @@
 	import { filterNestedObject } from '../flows/previousResults'
 	import type { PropPickerContext } from '../prop_picker'
 	import Scrollable from '../Scrollable.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		pickableProperties: PickableProperties
@@ -101,7 +103,7 @@
 		variables = Object.fromEntries(
 			(
 				await VariableService.listVariable({
-					workspace: $workspaceStore ?? ''
+					workspace: $operatingWorkspace ?? ''
 				})
 			).map((variable) => [variable.path, variable.is_secret ? '***' : (variable.value ?? '')])
 		)
@@ -111,7 +113,7 @@
 		resources = Object.fromEntries(
 			(
 				await ResourceService.listResource({
-					workspace: $workspaceStore ?? ''
+					workspace: $operatingWorkspace ?? ''
 				})
 			).map((resource) => [resource.path, resource.description ?? ''])
 		)
diff --git a/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte b/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte
index 66e3ab0355..57f01dddc1 100644
--- a/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte
+++ b/frontend/src/lib/components/raw_apps/DefaultDatabaseSelector.svelte
@@ -2,7 +2,6 @@
 	import { Settings } from 'lucide-svelte'
 	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Select from '$lib/components/select/Select.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import {
 		createDatatablesResource,
 		createSchemasResource,
@@ -10,10 +9,10 @@
 		toSchemaItems
 	} from './datatableUtils.svelte'
 	import { Button } from '../common'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	interface Props {
 		/** Currently selected datatable */
diff --git a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
index 5f0488638d..6befd85579 100644
--- a/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppDataTableDrawer.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { WorkspaceService } from '$lib/gen'
 	import Drawer from '../common/drawer/Drawer.svelte'
 	import DrawerContent from '../common/drawer/DrawerContent.svelte'
@@ -12,12 +11,12 @@
 	import DBManagerContent from '../DBManagerContent.svelte'
 	import type { DbInput } from '../dbTypes'
 	import type { SelectedTable } from '../DBManager.svelte'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
 	import { useDbManagerTag } from '../dbManagerTag.svelte'
 	import DbWorkerTagButton from '../DbWorkerTagButton.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	interface Props {
 		onAdd?: (ref: DataTableRef) => void
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 196a4c011e..1154bb308b 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -14,8 +14,7 @@
 
 	// import { addWmillClient } from './utils'
 	import RawAppBackgroundRunner from './RawAppBackgroundRunner.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { setRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
 	import {
 		WMILL_TS_PATH,
@@ -74,6 +73,9 @@
 	} from './dataTableRefUtils'
 	import { randomUUID } from '$lib/utils/uuid'
 	import { editorFontSize } from '$lib/editorFontSize.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		files?: Record<string, string>
@@ -229,11 +231,10 @@
 
 	// Workspace this editor operates on: the session's acting workspace when
 	// embedded in a session preview (autosaveWorkspace), else the navigation
-	// workspace. Deploy/save/background-runner must target it, not $workspaceStore.
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
-	// Expose it to the sidebar sub-components (inline scripts, datatable/shared-UI
-	// drawers, DB selector) so their lookups target the app's workspace too.
-	setRawAppOperatingWorkspace(() => opWorkspace)
+	// workspace. Deploy/save/background-runner must target it, not the navigation one.
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
+	// Everything under the editor acts on it too (see operatingWorkspace.svelte.ts).
+	setOperatingWorkspace(() => opWorkspace)
 
 	// The path autosaves land on, which is what the session preview loads the app by.
 	const draftStoragePath = $derived(autosavePath ?? liveEditorDraftStoragePath)
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index 7e7f71947d..7faa17978c 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -13,7 +13,7 @@
 		type OpenInSessionSource
 	} from '$lib/components/sessions/OpenInSessionButton.svelte'
 	import { discardDraftAfterDeploy } from '$lib/userDraftToast'
-	import { enterpriseLicense, userStore, userWorkspaces, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore, userWorkspaces } from '$lib/stores'
 	import {
 		Bug,
 		DiffIcon,
@@ -66,7 +66,7 @@
 	// In a session pane the editor does NOT own the localStorage draft — the
 	// session runtime does, keyed by the session's (fork) workspace. So the
 	// `if (!inSessionPane) UserDraft.remove(...)` guards below skip the editor's
-	// own removal (it would target the wrong, main-`$workspaceStore` key). The
+	// own removal (it would target the wrong, navigation-workspace key). The
 	// session-side equivalent is RawAppEditorView's `onDeploy` →
 	// `runtime.syncPreviewWithDeployed`, which discards the fork draft + reloads
 	// the preview to the deployed version.
@@ -75,6 +75,14 @@
 	import type { RawAppData } from './dataTableRefUtils'
 	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	// async function hash(message) {
 	// 	try {
@@ -150,7 +158,7 @@
 		/** Indicator-only overrides for the sessions preview: the AutosaveIndicator
 		 *  watches the session's (workspace, path) so it renders + animates on the
 		 *  key SessionEditorTarget saves under. Undefined on the full-page editor →
-		 *  falls back to `$workspaceStore`/`liveEditorDraftStoragePath`. */
+		 *  falls back to the operating workspace/`liveEditorDraftStoragePath`. */
 		autosaveWorkspace?: string
 		autosavePath?: string
 		// Fired after a successful deploy; lets the session preview reload. `version` is
@@ -236,7 +244,7 @@
 
 	// The AutosaveIndicator watches these; in the sessions preview they're the
 	// session's (workspace, path), else the full-page editor's own values.
-	const opWorkspace = $derived(autosaveWorkspace ?? $workspaceStore)
+	const opWorkspace = $derived(autosaveWorkspace ?? $operatingWorkspace)
 	const indicatorPath = $derived(autosavePath ?? liveEditorDraftStoragePath)
 
 	$effect(() => {
@@ -361,9 +369,9 @@
 			// `path` orphaned the real draft row. Bracketed + flushed:
 			// RawAppEditor stays mounted through the post-deploy navigation
 			// and its mirror would otherwise displace the queued delete.
-			if (!inSessionPane && $workspaceStore) {
+			if (!inSessionPane && $operatingWorkspace) {
 				discardDraftAfterDeploy({
-					workspace: $workspaceStore,
+					workspace: $operatingWorkspace,
 					itemKind: 'raw_app',
 					path: appPath
 				})
@@ -565,7 +573,7 @@
 					// custom_path requires admin so to accept update without it, we need to send as undefined when non-admin (when undefined, it will be ignored)
 					// it also means that customPath needs to be set to '' instead of undefined to unset it (when admin)
 					custom_path:
-						$userStore?.is_admin || $userStore?.is_super_admin ? (customPath ?? '') : undefined,
+						actingUser?.is_admin || actingUser?.is_super_admin ? (customPath ?? '') : undefined,
 					labels
 				},
 				js,
@@ -593,9 +601,9 @@
 		closeSaveDrawer()
 		sendUserToast('App deployed successfully')
 		// Bracketed + flushed (see createApp).
-		if (!inSessionPane && $workspaceStore) {
+		if (!inSessionPane && $operatingWorkspace) {
 			discardDraftAfterDeploy({
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				itemKind: 'raw_app',
 				path: appPath
 			})
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte
index 42c048878b..d7ae7b2245 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptEditor.svelte
@@ -23,8 +23,6 @@
 	import { resource } from 'runed'
 	import { usePreparedAssetSqlQueries } from '$lib/infer.svelte'
 	import AssetsDropdownButton from '../assets/AssetsDropdownButton.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
 	import { SvelteSet } from 'svelte/reactivity'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { editor as meditor } from 'monaco-editor'
@@ -42,6 +40,7 @@
 		getDebugErrorMessage
 	} from '$lib/components/debug'
 	import TextInput from '../text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		inlineScript: (InlineScript & { language: ScriptLang }) | undefined
@@ -78,8 +77,8 @@
 		delete_after_secs = $bindable()
 	}: Props = $props()
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	let diffEditor = $state() as DiffEditor | undefined
 	let validCode = $state(true)
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
index ca48eb74dc..200e76d85b 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
@@ -26,13 +26,18 @@
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import RunButton from '$lib/components/RunButton.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import { isHubFlowPath } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let opWs = $derived($operatingWorkspace)
 
 	type RunnableWithInlineScript = RunnableWithFields & {
 		inlineScript?: InlineScript & { language: ScriptLang }
@@ -133,7 +138,7 @@
 			case 'email':
 				return $userStore?.email ?? ''
 			case 'groups':
-				return $userStore?.groups ?? []
+				return actingUser?.groups ?? []
 			case 'workspace':
 				return opWs ?? ''
 			case 'author':
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte
index 6d0854ee54..891fcfa7c8 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptsPanel.svelte
@@ -1,11 +1,10 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import RawAppInlineScripRunnable, { type Runnable } from './RawAppInlineScriptRunnable.svelte'
 	import { createScriptFromInlineScript } from '../apps/editor/inlineScriptsPanel/utils'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	interface Props {
 		runnables: Record<string, Runnable>
diff --git a/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
index 7b3639f41d..67ead38501 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInputsSpecEditor.svelte
@@ -13,11 +13,16 @@
 	import { fieldTypeToTsType } from '../apps/utils'
 	import type { InputType } from '../apps/inputType'
 	import Select from '$lib/components/select/Select.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { userStore } from '$lib/stores'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let opWs = $derived($operatingWorkspace)
 
 	// Build ctx properties with current user's actual values
 	let ctxProperties = $derived([
@@ -30,7 +35,7 @@
 		{
 			value: 'groups',
 			label: 'Groups',
-			subtitle: `string[] — ${JSON.stringify($userStore?.groups ?? [])}`
+			subtitle: `string[] — ${JSON.stringify(actingUser?.groups ?? [])}`
 		},
 		{
 			value: 'workspace',
diff --git a/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte b/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte
index b84a60ca0f..1ec0b01b7a 100644
--- a/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppSharedUiDrawer.svelte
@@ -1,15 +1,14 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { WorkspaceService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Drawer from '../common/drawer/Drawer.svelte'
 	import DrawerContent from '../common/drawer/DrawerContent.svelte'
 	import Editor from '$lib/components/Editor.svelte'
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	let open = $state(false)
 	let files: Record<string, string> = $state({})
diff --git a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
index 7ead1f6fb0..91bd0a54fa 100644
--- a/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppTemplatePicker.svelte
@@ -1,10 +1,9 @@
 <script lang="ts">
 	import { Sparkles, Plus, List, Ban, ExternalLinkIcon, Loader2 } from 'lucide-svelte'
 	import type { Policy } from '$lib/gen'
-	import { superadmin, userStore, workspaceStore } from '$lib/stores'
+	import { superadmin, userStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { sendUserToast } from '$lib/toast'
-	import { getRawAppOperatingWorkspace } from './rawAppWorkspace'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -29,6 +28,7 @@
 	import RawAppDataTableList from './RawAppDataTableList.svelte'
 	import RawAppDataTableDrawer from './RawAppDataTableDrawer.svelte'
 	import FileEditorIcon from './FileEditorIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	export type RawAppTemplatePickerResult = {
 		files: Record<string, string>
@@ -64,8 +64,8 @@
 	let preWhitelistedTables = $state<DataTableRef[]>([])
 	let dataTableDrawer: RawAppDataTableDrawer | undefined = $state()
 
-	const getOpWs = getRawAppOperatingWorkspace()
-	let opWs = $derived(getOpWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	let opWs = $derived($operatingWorkspace)
 
 	const datatables = createDatatablesResource(() => opWs)
 	const schemas = createSchemasResource(
diff --git a/frontend/src/lib/components/raw_apps/rawAppWorkspace.ts b/frontend/src/lib/components/raw_apps/rawAppWorkspace.ts
deleted file mode 100644
index 71702fd826..0000000000
--- a/frontend/src/lib/components/raw_apps/rawAppWorkspace.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { getContext, setContext } from 'svelte'
-
-// The workspace a raw-app editor operates on. In a session preview this is the
-// session's acting workspace, which differs from the navigation `$workspaceStore`
-// (a session deliberately leaves the nav store on the workspace the top nav
-// points at). RawAppEditor provides it once; the sidebar sub-components (inline
-// scripts, datatable/shared-UI drawers, DB selector, …) read it so their lookups
-// target the workspace the app actually lives in rather than the nav workspace.
-//
-// A getter (not a value) so the live `$derived` opWorkspace is read reactively at
-// each call site. Consumers fall back to `$workspaceStore` when unset — e.g. the
-// full-page app editor, where the nav workspace IS the operating workspace.
-
-const KEY = 'RawAppOperatingWorkspace'
-
-export function setRawAppOperatingWorkspace(get: () => string | undefined): void {
-	setContext(KEY, get)
-}
-
-export function getRawAppOperatingWorkspace(): (() => string | undefined) | undefined {
-	return getContext(KEY)
-}
diff --git a/frontend/src/lib/components/runs/JobDetailHeader.svelte b/frontend/src/lib/components/runs/JobDetailHeader.svelte
index 5015d5ed37..fb7a8890fc 100644
--- a/frontend/src/lib/components/runs/JobDetailHeader.svelte
+++ b/frontend/src/lib/components/runs/JobDetailHeader.svelte
@@ -13,7 +13,7 @@
 	import { sendUserToast } from '$lib/toast'
 	import ScheduleEditor from '$lib/components/triggers/schedules/ScheduleEditor.svelte'
 	import TimeAgo from '$lib/components/TimeAgo.svelte'
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import Tooltip from '$lib/components/meltComponents/Tooltip.svelte'
 	import { ExternalLink, ListFilter, ChevronDown, Share2, Link, Copy } from 'lucide-svelte'
 	import JobStatus from '$lib/components/JobStatus.svelte'
@@ -31,6 +31,14 @@
 	import { flowPathToHref } from '$lib/scripts'
 	import { slide } from 'svelte/transition'
 	import { twMerge } from 'tailwind-merge'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		job: Job
@@ -79,7 +87,7 @@
 		}
 		togglingResolution = true
 		try {
-			const workspace = job.workspace_id ?? $workspaceStore ?? ''
+			const workspace = job.workspace_id ?? $operatingWorkspace ?? ''
 			const affected = resolve
 				? await JobService.resolveCompletedJobs({
 						workspace,
@@ -296,7 +304,7 @@
 				Triggered by
 			{/if}
 			<a
-				href={`${base}/run/${job.parent_job}?workspace=${$workspaceStore}`}
+				href={`${base}/run/${job.parent_job}?workspace=${$operatingWorkspace}`}
 				target="_blank"
 				rel="noopener noreferrer"
 				class="flex items-center gap-1"
@@ -418,7 +426,7 @@
 					{#each expandedFields as config}
 						{@const displayValue = getDisplayValue(config, job)}
 						{@const fullValue = getFullValue(config, job)}
-						{@const href = config.getHref?.(job, $workspaceStore || '')}
+						{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 						<div class="flex items-baseline gap-1 text-xs">
 							<span class="text-secondary flex-shrink-0">{config.label}</span>
@@ -496,7 +504,7 @@
 						<div class="flex items-baseline flex-wrap gap-x-2 gap-y-1">
 							<JobStatus {job} />
 
-							{#if isJobResolvable(job) && !$userStore?.operator}
+							{#if isJobResolvable(job) && !actingUser?.operator}
 								<!-- No startIcon on these: the row is baseline-aligned, and a Button is
 								     itself a flex container whose baseline comes from its icon rather
 								     than its label, which sits the text ~3px above the badges. Text
@@ -585,7 +593,7 @@
 						{#each fields as config}
 							{@const displayValue = getDisplayValue(config, job)}
 							{@const fullValue = getFullValue(config, job)}
-							{@const href = config.getHref?.(job, $workspaceStore || '')}
+							{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 							<div class="flex items-baseline gap-3 text-xs">
 								<span class="text-secondary min-w-[110px] flex-shrink-0">
@@ -638,7 +646,7 @@
 							{#each fields as config (config.field)}
 								{@const displayValue = getDisplayValue(config, job)}
 								{@const fullValue = getFullValue(config, job)}
-								{@const href = config.getHref?.(job, $workspaceStore || '')}
+								{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 								<!-- Field -->
 								<div class="flex items-baseline gap-1 text-xs min-w-0">
@@ -686,7 +694,7 @@
 							{#each expandedFields as config}
 								{@const displayValue = getDisplayValue(config, job)}
 								{@const fullValue = getFullValue(config, job)}
-								{@const href = config.getHref?.(job, $workspaceStore || '')}
+								{@const href = config.getHref?.(job, $operatingWorkspace || '')}
 
 								<div class="flex items-baseline gap-3 text-xs">
 									<span class="text-secondary min-w-[110px] flex-shrink-0">
diff --git a/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte b/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte
index 91eee5f1a1..5ff51c9c04 100644
--- a/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte
+++ b/frontend/src/lib/components/runs/NoWorkerWithTagWarning.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
 	import { WorkerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { AlertTriangle } from 'lucide-svelte'
 	import Popover from '../Popover.svelte'
 	import { onDestroy, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 	interface Props {
 		tag: string | undefined
 		tagLabel?: string
@@ -31,7 +33,7 @@
 			if (!customTag) return
 			const existsWorkerWithTag = await WorkerService.existsWorkersWithTags({
 				tags: customTag,
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 			noWorkerWithTag = !existsWorkerWithTag[customTag]
 			if (noWorkerWithTag) {
diff --git a/frontend/src/lib/components/runs/RunBadges.svelte b/frontend/src/lib/components/runs/RunBadges.svelte
index c54de9f18d..668521b429 100644
--- a/frontend/src/lib/components/runs/RunBadges.svelte
+++ b/frontend/src/lib/components/runs/RunBadges.svelte
@@ -4,11 +4,13 @@
 	import { getJobKindDisplayLabel, truncateHash } from '$lib/utils'
 	import { base } from '$lib/base'
 	import { truncateRev } from '$lib/utils'
-	import { workspaceStore } from '$lib/stores'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
 	import { ListFilter, Tag } from 'lucide-svelte'
 	import type { Job } from '$lib/gen'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		job: Job
@@ -33,7 +35,7 @@
 
 {#if job.script_hash && showScriptHash && job.job_kind !== 'aiagent'}
 	{#if job.job_kind == 'script'}
-		<a href="{base}/scripts/get/{job.script_hash}?workspace={$workspaceStore}"
+		<a href="{base}/scripts/get/{job.script_hash}?workspace={$operatingWorkspace}"
 			><Badge color="gray" title={`Script hash: ${job.script_hash}`} {large}
 				>{truncateHash(job.script_hash)}
 			</Badge></a
diff --git a/frontend/src/lib/components/schema/JobSchemaPicker.svelte b/frontend/src/lib/components/schema/JobSchemaPicker.svelte
index 47e6220c79..fe132d546c 100644
--- a/frontend/src/lib/components/schema/JobSchemaPicker.svelte
+++ b/frontend/src/lib/components/schema/JobSchemaPicker.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
 	import SchemaPickerRow from './SchemaPickerRow.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { ExternalLink } from 'lucide-svelte'
 	import { base } from '$lib/base'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		job: any
@@ -60,7 +62,7 @@
 			<div class="center-center">
 				<a
 					target="_blank"
-					href="{base}/run/{job.id}?workspace={$workspaceStore}"
+					href="{base}/run/{job.id}?workspace={$operatingWorkspace}"
 					class="text-right float-right text-secondary px-2"
 					title="See run detail in a new tab"
 				>
diff --git a/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte b/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
index 4e2a503d84..2714cc92c3 100644
--- a/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
+++ b/frontend/src/lib/components/schema/RunningJobSchemaPicker.svelte
@@ -2,19 +2,21 @@
 	import SchemaPickerRow from './SchemaPickerRow.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import { JobService } from '$lib/gen/index.js'
-	import { workspaceStore } from '$lib/stores'
 	import { createEventDispatcher, untrack } from 'svelte'
 	import { ExternalLink } from 'lucide-svelte'
 	import { base } from '$lib/base'
 	import { Cell, Row } from '$lib/components/table'
 	import { twMerge } from 'tailwind-merge'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	const dispatch = createEventDispatcher()
 	interface Props {
-		job: any;
-		selected?: boolean;
-		payloadData?: any | undefined;
-		hovering?: boolean;
+		job: any
+		selected?: boolean
+		payloadData?: any | undefined
+		hovering?: boolean
 	}
 
 	let {
@@ -22,7 +24,7 @@
 		selected = false,
 		payloadData = $bindable(undefined),
 		hovering = $bindable(false)
-	}: Props = $props();
+	}: Props = $props()
 
 	let loadingArgs = $state(true)
 	loadArgsFromRunningJob(untrack(() => job).id)
@@ -30,7 +32,7 @@
 	async function loadArgsFromRunningJob(id: string | undefined) {
 		if (!id) return
 		payloadData = await JobService.getJobArgs({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			id
 		})
 		loadingArgs = false
@@ -58,32 +60,28 @@
 	>
 		<SchemaPickerRow {payloadData} date={job.started_at} {hovering}>
 			{#snippet start()}
-					
-					<div class="center-center">
-						<div
-							class={twMerge(
-								'rounded-full w-2 h-2 animate-pulse',
-								job.suspend ? 'bg-violet-400' : 'bg-orange-400'
-							)}
-							title="Running"
-						></div>
-					</div>
-				
-					{/snippet}
+				<div class="center-center">
+					<div
+						class={twMerge(
+							'rounded-full w-2 h-2 animate-pulse',
+							job.suspend ? 'bg-violet-400' : 'bg-orange-400'
+						)}
+						title="Running"
+					></div>
+				</div>
+			{/snippet}
 			{#snippet extra()}
-					
-					<div class="center-center {hovering ? '' : '!hidden'}">
-						<a
-							target="_blank"
-							href="{base}/run/{job.id}?workspace={$workspaceStore}"
-							class="text-right float-right text-secondary"
-							title="See run detail in a new tab"
-						>
-							<ExternalLink size={16} />
-						</a>
-					</div>
-				
-					{/snippet}
+				<div class="center-center {hovering ? '' : '!hidden'}">
+					<a
+						target="_blank"
+						href="{base}/run/{job.id}?workspace={$operatingWorkspace}"
+						class="text-right float-right text-secondary"
+						title="See run detail in a new tab"
+					>
+						<ExternalLink size={16} />
+					</a>
+				</div>
+			{/snippet}
 		</SchemaPickerRow>
 	</Row>
 {/if}
diff --git a/frontend/src/lib/components/scriptEditor/LogPanel.svelte b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
index 010369a663..fe2bc6c73c 100644
--- a/frontend/src/lib/components/scriptEditor/LogPanel.svelte
+++ b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
@@ -9,7 +9,6 @@
 		type Preview,
 		type WorkflowStatus
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { base } from '$lib/base'
 	import { displayDate } from '$lib/utils'
 	import Tabs from '../common/tabs/Tabs.svelte'
@@ -33,6 +32,9 @@
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import type { PreviewPanelUi } from '../custom_ui'
 	import { getStringError } from '../copilot/chat/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		lang: Preview['language'] | undefined
@@ -268,7 +270,7 @@
 										<Cell first>
 											<a
 												class="pr-3"
-												href="{base}/run/{id}?workspace={workspace ?? $workspaceStore}"
+												href="{base}/run/{id}?workspace={workspace ?? $operatingWorkspace}"
 												target="_blank">{id.substring(30)}</a
 											>
 										</Cell>
@@ -286,7 +288,7 @@
 												onclick={preventDefault(() => {
 													openDrawer({ mode: 'json', content: undefined, title: 'Result' })
 													JobService.getCompletedJobResult({
-														workspace: workspace ?? $workspaceStore ?? 'NO_W',
+														workspace: workspace ?? $operatingWorkspace ?? 'NO_W',
 														id
 													}).then((res) => {
 														drawerContent && (drawerContent.content = res)
@@ -302,7 +304,7 @@
 												onclick={preventDefault(async () => {
 													const code = (
 														await JobService.getCompletedJob({
-															workspace: workspace ?? $workspaceStore ?? 'NO_W',
+															workspace: workspace ?? $operatingWorkspace ?? 'NO_W',
 															id
 														})
 													).raw_code
@@ -323,7 +325,7 @@
 													const logs = await (
 														await fetch(
 															OpenAPI.BASE +
-																`/w/${workspace ?? $workspaceStore}/jobs_u/get_logs/${id}`
+																`/w/${workspace ?? $operatingWorkspace}/jobs_u/get_logs/${id}`
 														)
 													).text()
 													console.log(logs)
diff --git a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
index 03ce21589e..4e453c09a3 100644
--- a/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
+++ b/frontend/src/lib/components/sessions/OpenInSessionButton.svelte
@@ -41,9 +41,12 @@
 	import { AIBtnClasses } from '$lib/components/copilot/chat/AIButtonStyle'
 	import { prefersSessionHandoff } from '$lib/components/copilot/chat/global/gate'
 	import { copilotInfo } from '$lib/aiStore'
-	import { userStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { openSourceInSession } from './sessionSwitch.svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		source,
@@ -83,7 +86,7 @@
 	const show = $derived(
 		!inSessionPanel &&
 			!!(source?.target || source?.page) &&
-			prefersSessionHandoff($userStore?.operator)
+			prefersSessionHandoff(actingUser?.operator)
 	)
 
 	// Not $state: only read inside open() as a re-entrancy latch, never rendered.
diff --git a/frontend/src/lib/components/sessions/PageItemEditorView.svelte b/frontend/src/lib/components/sessions/PageItemEditorView.svelte
new file mode 100644
index 0000000000..73efd892d4
--- /dev/null
+++ b/frontend/src/lib/components/sessions/PageItemEditorView.svelte
@@ -0,0 +1,174 @@
+<script lang="ts">
+	import { setContext, untrack } from 'svelte'
+	import { Loader2 } from 'lucide-svelte'
+	import { enterpriseLicense } from '$lib/stores'
+	import { resource } from 'runed'
+	import { Button } from '$lib/components/common'
+	import { lookupPageItem } from './pageItemLookup'
+	import VariableEditor from '$lib/components/VariableEditor.svelte'
+	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
+	import { setOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+	import {
+		pageItemKindLabel,
+		pageItemUrl,
+		TRIGGER_PAGES,
+		type PageItemRef,
+		type TriggerKind
+	} from './previewPaths'
+	import type { SessionRuntime } from './sessionRuntime.svelte'
+
+	let {
+		runtime,
+		item,
+		workspaceId,
+		reloadNonce = 0
+	}: {
+		runtime: SessionRuntime
+		item: PageItemRef
+		workspaceId: string
+		/** Bumped to reload the item from the server, discarding the mounted editor. */
+		reloadNonce?: number
+	} = $props()
+
+	// Mounted in the preview panel, outside the chat's own subtree: chat-aware components
+	// below would otherwise resolve the app-wide manager rather than this session's.
+	// Captured at init, as SessionEditorTarget does: descendants rely on its presence.
+	setContext(
+		'aiChatManager',
+		untrack(() => runtime.manager)
+	)
+	setOperatingWorkspace(() => workspaceId)
+
+	type TriggerEditorHandle = { openEdit: (path: string, isFlow: boolean) => Promise<void> }
+	type EditorModule = { default: any }
+
+	const TRIGGER_EDITORS: Record<TriggerKind | 'schedule', () => Promise<EditorModule>> = {
+		schedule: () => import('$lib/components/triggers/schedules/ScheduleEditorInner.svelte'),
+		http: () => import('$lib/components/triggers/http/RouteEditorInner.svelte'),
+		websocket: () =>
+			import('$lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte'),
+		postgres: () => import('$lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte'),
+		kafka: () => import('$lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte'),
+		nats: () => import('$lib/components/triggers/nats/NatsTriggerEditorInner.svelte'),
+		mqtt: () => import('$lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte'),
+		amqp: () => import('$lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte'),
+		sqs: () => import('$lib/components/triggers/sqs/SqsTriggerEditorInner.svelte'),
+		gcp: () => import('$lib/components/triggers/gcp/GcpTriggerEditorInner.svelte'),
+		azure: () => import('$lib/components/triggers/azure/AzureTriggerEditorInner.svelte'),
+		email: () => import('$lib/components/triggers/email/EmailTriggerEditorInner.svelte')
+	}
+
+	const triggerKey = $derived(
+		item.kind === 'schedule' ? 'schedule' : item.kind === 'trigger' ? item.triggerKind : undefined
+	)
+	const eeLocked = $derived(
+		item.kind === 'trigger' && !!TRIGGER_PAGES[item.triggerKind].ee && !$enterpriseLicense
+	)
+
+	let variableEditor: VariableEditor | undefined = $state()
+	let resourceEditor: ResourceEditorDrawer | undefined = $state()
+	let triggerEditor: TriggerEditorHandle | undefined = $state()
+
+	// Each editor loads through the same call its list page makes, once its instance is bound.
+	// Keyed below on everything that names what it shows, so each binding is a fresh instance.
+	$effect(() => {
+		const path = item.path
+		const v = variableEditor
+		const r = resourceEditor
+		const t = triggerEditor
+		untrack(() => {
+			v?.editVariable(path)
+			// An agent opens on JSON: the generic form would render its configuration field by
+			// field and write a default into each one the value leaves out, drafting just by opening.
+			void r?.initEdit(path, { json: lookup.current?.resourceType === 'ai_agent' })
+			void t?.openEdit(path, false)
+		})
+	})
+
+	// A save can move the item; the tab follows it, which remounts the editor on what was
+	// written. Saving in place remounts it too: the editors keep the pre-save baseline, and
+	// their drawers only ever relied on being closed after a save.
+	let savedNonce = $state(0)
+
+	// Whether the item still exists, deployed or as a draft, read again whenever the editor
+	// remounts: a delete or a discarded draft reloads the tab too, and the editors have no state
+	// of their own for an item that is gone. A lookup that fails otherwise is left to the editor,
+	// which reports its own load errors.
+	const lookup = resource(
+		() => ({ ref: item, workspace: workspaceId, reload: `${reloadNonce}:${savedNonce}` }),
+		({ ref, workspace }) =>
+			lookupPageItem(ref, workspace).then(
+				(found) => ({ exists: !!found, resourceType: found?.resource_type as string | undefined }),
+				() => ({ exists: true, resourceType: undefined })
+			)
+	)
+
+	function closeTab() {
+		const tab = runtime.previewTabs.tabs.find((t) => t.url === pageItemUrl(item))
+		if (tab) runtime.previewTabs.close(tab.id)
+	}
+	function onSaved(path: string | undefined) {
+		if (path && path !== item.path) {
+			runtime.previewTabs.retargetPageItem(item, { ...item, path })
+		} else {
+			savedNonce++
+		}
+	}
+</script>
+
+{#snippet loading()}
+	<div class="flex-1 flex items-center justify-center text-tertiary">
+		<Loader2 class="animate-spin" />
+	</div>
+{/snippet}
+
+<div class="flex h-full min-h-0 flex-col">
+	{#if eeLocked}
+		<div class="p-4 text-sm text-secondary">This trigger requires an enterprise license.</div>
+	{:else if lookup.loading || !lookup.current}
+		{@render loading()}
+	{:else if !lookup.current.exists}
+		<div class="flex flex-col items-start gap-3 p-4 text-sm text-secondary">
+			<p>
+				{pageItemKindLabel(item)} <span class="font-mono">{item.path}</span> no longer exists in this
+				workspace.
+			</p>
+			<Button variant="default" unifiedSize="sm" onClick={closeTab}>Close tab</Button>
+		</div>
+	{:else}
+		{#key `${item.kind}:${triggerKey}:${item.path}:${workspaceId}:${reloadNonce}:${savedNonce}`}
+			{#if item.kind === 'variable'}
+				<VariableEditor
+					bind:this={variableEditor}
+					inline
+					workspace={workspaceId}
+					{onSaved}
+					onClose={closeTab}
+				/>
+			{:else if item.kind === 'resource'}
+				<ResourceEditorDrawer
+					bind:this={resourceEditor}
+					inline
+					workspace={workspaceId}
+					onClose={closeTab}
+					onSaved={(path) => {
+						if (path !== undefined) onSaved(path)
+					}}
+					onRestored={() => savedNonce++}
+				/>
+			{:else if triggerKey}
+				{#await TRIGGER_EDITORS[triggerKey]()}
+					{@render loading()}
+				{:then Module}
+					<Module.default
+						bind:this={triggerEditor}
+						useDrawer
+						inline
+						onClose={closeTab}
+						onUpdate={(path?: string) => onSaved(path)}
+					/>
+				{/await}
+			{/if}
+		{/key}
+	{/if}
+</div>
diff --git a/frontend/src/lib/components/sessions/PreviewTabHost.svelte b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
index 3dee7dd1b3..b88907bf02 100644
--- a/frontend/src/lib/components/sessions/PreviewTabHost.svelte
+++ b/frontend/src/lib/components/sessions/PreviewTabHost.svelte
@@ -103,12 +103,19 @@
 		applyPageIframeTheme(darkMode)
 	})
 
+	// A page item's editor reads its draft only when it loads, so a reload remounts it.
+	let pageItemReloadNonce = $state(0)
+
 	export function reload() {
 		// A live editor shares the runtime store the chat mutates, so generic chat
 		// edits are already reflected — no reload needed. Deploys refresh it via
 		// each editor view's onDeploy → runtime.syncPreviewWithDeployed. So only the
 		// iframe fallback (a separate page) has to be told to refresh.
 		if (slot.kind === 'editor') return
+		if (slot.kind === 'pageitem') {
+			pageItemReloadNonce++
+			return
+		}
 		try {
 			const win = frame?.contentWindow
 			if (!win) return
@@ -311,6 +318,22 @@
 			{/await}
 		{/if}
 	</div>
+{:else if slot.kind === 'pageitem' && mounted && runtime}
+	<div
+		bind:this={overlayHostEl}
+		class="absolute inset-0 flex flex-col min-h-0 bg-surface {visibility}"
+		aria-hidden={!active}
+	>
+		<!-- Waits for the host element, as the run form does: the editors' own drawers and
+		     modals portal when they mount, and resolve their host only then. -->
+		{#if overlayHostEl}
+			{#await import('./PageItemEditorView.svelte')}
+				{@render editorLoading()}
+			{:then Module}
+				<Module.default {runtime} item={slot.ref} {workspaceId} reloadNonce={pageItemReloadNonce} />
+			{/await}
+		{/if}
+	</div>
 {:else if slot.kind === 'artifact' && mounted}
 	<div
 		bind:this={overlayHostEl}
diff --git a/frontend/src/lib/components/sessions/SessionChangesBar.svelte b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
index 61333a65bc..777ca8c935 100644
--- a/frontend/src/lib/components/sessions/SessionChangesBar.svelte
+++ b/frontend/src/lib/components/sessions/SessionChangesBar.svelte
@@ -197,8 +197,8 @@
 		return previewTargetForDeployKind(item.deployKind, item.path)
 	}
 
-	// The row's primary action is the preview; kinds the panel can't host
-	// (triggers, schedules, resources, variables) fall back to their diff.
+	// The row's primary action is the preview; kinds the panel can't host fall back
+	// to their diff.
 	function openRow(item: DeployItem) {
 		if (previewTargetFor(item)) openInPreview(item)
 		else openDrawer(item.key)
diff --git a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
index 65e1a13abf..0ff2329abf 100644
--- a/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
+++ b/frontend/src/lib/components/sessions/SessionEditorTarget.svelte
@@ -9,6 +9,7 @@
 	import { itemDisplayName } from './previewRouter'
 	import SessionItemNotFound from './SessionItemNotFound.svelte'
 	import { setEditorStoragePath } from '../editorStoragePathContext'
+	import { setOperatingWorkspace } from '../operatingWorkspace.svelte'
 
 	let {
 		runtime,
@@ -51,6 +52,7 @@
 	// component instance keeps the first runtime's manager — so descendants may
 	// rely on its presence, not its identity.
 	setContext('aiChatManager', runtime.manager)
+	setOperatingWorkspace(() => workspaceId)
 
 	// This tab's storage path, for the editor below: several tabs are mounted at
 	// once and only this one knows which item each is open on.
diff --git a/frontend/src/lib/components/sessions/pageDrawerSession.ts b/frontend/src/lib/components/sessions/pageDrawerSession.ts
index ca7379be20..16d8d9204a 100644
--- a/frontend/src/lib/components/sessions/pageDrawerSession.ts
+++ b/frontend/src/lib/components/sessions/pageDrawerSession.ts
@@ -11,6 +11,7 @@ import type { UserDraftItemKind } from '$lib/gen'
 // flow editors, where pulling the filter schemas that module reads views from would make
 // every trigger's save utils eager.
 import {
+	drawerHashFor,
 	pageHref,
 	stripBase,
 	TRIGGER_PAGES,
@@ -20,6 +21,7 @@ import {
 	type TriggerKind
 } from './previewPaths'
 import type { OpenInSessionSource } from './OpenInSessionButton.svelte'
+import { isSessionPreviewFrame } from './sessionMode.svelte'
 
 // The draft each page's drawer edits. The preview loads the page in its own
 // document and reads the draft back from the server, so opening a session has to
@@ -63,11 +65,6 @@ async function flushOrRefuse(query: Parameters<typeof UserDraftDbSyncer.flush>[0
 	}
 }
 
-// How each page addresses a row in its hash. Resources route theirs through an extra
-// segment; every other page names the path directly.
-const drawerHashFor = (pagePath: string, itemPath: string) =>
-	pagePath === RESOURCES_PATH ? `/resource/${itemPath}` : itemPath
-
 /**
  * Deep-link the row whose drawer just opened, so the location says what is on screen — a
  * drawer opened from a row's Edit button is as open as one reached by link, and the chat
@@ -87,6 +84,34 @@ export function setPageDrawerAnchor(pagePath: string, itemPath: string | undefin
 	history.replaceState(history.state, '', `${pathname}${search}${anchor}`)
 }
 
+/**
+ * Inside a session preview frame, hand a list page row up to the session, which edits it in
+ * a tab of its own. True when handed off: the caller must then not open its drawer. False
+ * off that page, and outside a preview frame, where the drawer is how the row is edited.
+ */
+export function handOffPageDrawer(pagePath: string, itemPath: string | undefined): boolean {
+	if (!itemPath || !isSessionPreviewFrame()) return false
+	if (stripBase(window.location.pathname) !== pagePath) return false
+	try {
+		window.parent.postMessage(
+			{ type: 'wm.session.openPageItem', pagePath, path: itemPath },
+			window.location.origin
+		)
+	} catch {
+		return false
+	}
+	// A frame left on a row's hash claims a row nobody has open here, and reopens its tab on
+	// every reload. Not through the router: these pages open their drawer from the hash. Once
+	// more after the event: a row link's `href="#<path>"` lands after its click handler.
+	const dropAnchor = () => {
+		const { pathname, search, hash } = window.location
+		if (hash) history.replaceState(history.state, '', `${pathname}${search}`)
+	}
+	dropAnchor()
+	setTimeout(dropAnchor, 0)
+	return true
+}
+
 /**
  * Drop the row a list page deep-links, once its drawer closes. The hash is how the row was
  * requested; leaving it behind makes the location claim a drawer that is no longer open —
diff --git a/frontend/src/lib/components/sessions/pageItemLookup.ts b/frontend/src/lib/components/sessions/pageItemLookup.ts
new file mode 100644
index 0000000000..bee3fc41c1
--- /dev/null
+++ b/frontend/src/lib/components/sessions/pageItemLookup.ts
@@ -0,0 +1,62 @@
+import {
+	AmqpTriggerService,
+	ApiError,
+	AzureTriggerService,
+	EmailTriggerService,
+	GcpTriggerService,
+	HttpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	ResourceService,
+	ScheduleService,
+	SqsTriggerService,
+	VariableService,
+	WebsocketTriggerService
+} from '$lib/gen'
+import type { PageItemRef, TriggerKind } from './previewPaths'
+
+type Get = (args: { workspace: string; path: string; getDraft: boolean }) => Promise<unknown>
+
+const TRIGGER_GETS: Record<TriggerKind, Get> = {
+	http: (a) => HttpTriggerService.getHttpTrigger(a),
+	websocket: (a) => WebsocketTriggerService.getWebsocketTrigger(a),
+	postgres: (a) => PostgresTriggerService.getPostgresTrigger(a),
+	kafka: (a) => KafkaTriggerService.getKafkaTrigger(a),
+	nats: (a) => NatsTriggerService.getNatsTrigger(a),
+	mqtt: (a) => MqttTriggerService.getMqttTrigger(a),
+	amqp: (a) => AmqpTriggerService.getAmqpTrigger(a),
+	sqs: (a) => SqsTriggerService.getSqsTrigger(a),
+	gcp: (a) => GcpTriggerService.getGcpTrigger(a),
+	azure: (a) => AzureTriggerService.getAzureTrigger(a),
+	email: (a) => EmailTriggerService.getEmailTrigger(a)
+}
+
+function getFor(ref: PageItemRef): Get {
+	switch (ref.kind) {
+		case 'variable':
+			return (a) => VariableService.getVariable(a)
+		case 'resource':
+			return (a) => ResourceService.getResource(a)
+		case 'schedule':
+			return (a) => ScheduleService.getSchedule(a)
+		case 'trigger':
+			return TRIGGER_GETS[ref.triggerKind]
+	}
+}
+
+/** A page item as its editor would load it — deployed, or only a draft — or undefined when it
+ * is neither: deleted, or a draft that was discarded. Any other failure is thrown, for the
+ * caller to leave to the editor rather than report as a missing item. */
+export async function lookupPageItem(
+	ref: PageItemRef,
+	workspace: string
+): Promise<Record<string, any> | undefined> {
+	try {
+		return (await getFor(ref)({ workspace, path: ref.path, getDraft: true })) as Record<string, any>
+	} catch (e) {
+		if (e instanceof ApiError && e.status === 404) return undefined
+		throw e
+	}
+}
diff --git a/frontend/src/lib/components/sessions/previewPaths.ts b/frontend/src/lib/components/sessions/previewPaths.ts
index 8d10dc1a32..13d5abca33 100644
--- a/frontend/src/lib/components/sessions/previewPaths.ts
+++ b/frontend/src/lib/components/sessions/previewPaths.ts
@@ -48,6 +48,87 @@ export const TRIGGER_PAGES: Record<TriggerKind, { path: string; label: string; e
 	email: { path: '/email_triggers', label: 'Email triggers' }
 }
 
+/** A workspace item edited from its list page rather than at an editor route: a variable,
+ * resource, schedule or trigger. A session hosts each in a tab of its own. */
+export type PageItemRef =
+	| { kind: 'variable' | 'resource' | 'schedule'; path: string }
+	| { kind: 'trigger'; triggerKind: TriggerKind; path: string }
+
+/** How a list page addresses a row in its hash. Resources route theirs through an extra
+ * segment; every other page names the path directly. */
+export const drawerHashFor = (pagePath: string, itemPath: string) =>
+	pagePath === RESOURCES_PATH ? `/resource/${itemPath}` : itemPath
+
+/** The full page a page item is edited on: its list page, with the row's drawer open. */
+export function pageItemPageHref(ref: PageItemRef): string {
+	const listPath = pageItemListPath(ref)
+	return `${pageHref(listPath)}#${drawerHashFor(listPath, ref.path)}`
+}
+
+/** The list page a page item is edited from. */
+export function pageItemListPath(ref: PageItemRef): string {
+	switch (ref.kind) {
+		case 'variable':
+			return VARIABLES_PATH
+		case 'resource':
+			return RESOURCES_PATH
+		case 'schedule':
+			return SCHEDULES_PATH
+		case 'trigger':
+			return TRIGGER_PAGES[ref.triggerKind].path
+	}
+}
+
+/** The page item a list page's row names, or undefined for a page that lists none. */
+export function pageItemForListPath(pagePath: string, path: string): PageItemRef | undefined {
+	const clean = stripBase(pagePath)
+	if (clean === VARIABLES_PATH) return { kind: 'variable', path }
+	if (clean === RESOURCES_PATH) return { kind: 'resource', path }
+	if (clean === SCHEDULES_PATH) return { kind: 'schedule', path }
+	const trigger = Object.entries(TRIGGER_PAGES).find(([, p]) => p.path === clean)
+	return trigger ? { kind: 'trigger', triggerKind: trigger[0] as TriggerKind, path } : undefined
+}
+
+const PAGE_ITEM_ROUTE = /^pageitem:(variable|resource|schedule|trigger\.([a-z]+))\/([^?#]+)$/
+
+// A scheme rather than a path, like artifacts: the tab mounts the item's editor in process,
+// so there is no page a frame could load. The path is encoded whole, so its slashes cannot
+// be read as part of the scheme.
+export function pageItemUrl(ref: PageItemRef): string {
+	const kind = ref.kind === 'trigger' ? `trigger.${ref.triggerKind}` : ref.kind
+	return `pageitem:${kind}/${encodeURIComponent(ref.path)}`
+}
+
+export function parsePageItemRoute(url: string): PageItemRef | null {
+	const m = url.match(PAGE_ITEM_ROUTE)
+	if (!m) return null
+	let path: string
+	try {
+		path = decodeURIComponent(m[3])
+	} catch {
+		return null
+	}
+	if (m[2] !== undefined) {
+		if (!(m[2] in TRIGGER_PAGES)) return null
+		return { kind: 'trigger', triggerKind: m[2] as TriggerKind, path }
+	}
+	return { kind: m[1] as 'variable' | 'resource' | 'schedule', path }
+}
+
+/** Singular human name of a page item's kind, e.g. "Kafka trigger". */
+export function pageItemKindLabel(ref: PageItemRef): string {
+	switch (ref.kind) {
+		case 'variable':
+			return 'Variable'
+		case 'resource':
+			return 'Resource'
+		case 'schedule':
+			return 'Schedule'
+		case 'trigger':
+			return TRIGGER_PAGES[ref.triggerKind].label.replace(/s$/, '')
+	}
+}
+
 /** Label a trigger list page from its (base-stripped) pathname, or undefined. */
 export function triggerLabelForPath(path: string): string | undefined {
 	const clean = stripBase(path)
diff --git a/frontend/src/lib/components/sessions/previewReload.test.ts b/frontend/src/lib/components/sessions/previewReload.test.ts
index de11805b9a..ce9491d334 100644
--- a/frontend/src/lib/components/sessions/previewReload.test.ts
+++ b/frontend/src/lib/components/sessions/previewReload.test.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import { toolReloadEffect, tabsToReload } from './previewReload'
 import type { SessionPreviewTab } from './sessionState.svelte'
+import { pageItemUrl } from './previewPaths'
 
 describe('toolReloadEffect', () => {
 	it('maps a non-item mutation to its own list page only', () => {
@@ -52,6 +53,26 @@ describe('toolReloadEffect', () => {
 	})
 })
 
+describe('page item tabs', () => {
+	const tab = (url: string): SessionPreviewTab => ({ id: url, url, loc: url })
+	const kafkaA = tab('pageitem:trigger.kafka/u%2Fme%2Fa')
+	const kafkaB = tab('pageitem:trigger.kafka/u%2Fme%2Fb')
+	const list = tab('/kafka_triggers')
+
+	it('reloads only the trigger a write names, and its list page', () => {
+		const { pages, items } = toolReloadEffect('write_trigger', {
+			kind: 'kafka',
+			config: { path: 'u/me/a' }
+		})
+		const named = new Set(items.map((i) => pageItemUrl(i)))
+		expect(tabsToReload([kafkaA, kafkaB, list], new Set(pages), named)).toEqual([kafkaA, list])
+	})
+
+	it('reloads every tab of the kind when the tool names no item', () => {
+		expect(tabsToReload([kafkaA, kafkaB], new Set(['/kafka_triggers']))).toEqual([kafkaA, kafkaB])
+	})
+})
+
 describe('tabsToReload', () => {
 	const scheduleTab: SessionPreviewTab = { id: 's', url: '/schedules', loc: '/schedules' }
 	const resourceTab: SessionPreviewTab = { id: 'r', url: '/resources', loc: '/resources' }
diff --git a/frontend/src/lib/components/sessions/previewReload.ts b/frontend/src/lib/components/sessions/previewReload.ts
index 6e9d750a1f..bdfbeaa3ff 100644
--- a/frontend/src/lib/components/sessions/previewReload.ts
+++ b/frontend/src/lib/components/sessions/previewReload.ts
@@ -1,6 +1,14 @@
 import type { SessionPreviewTab } from './sessionState.svelte'
 import { whereIs } from './sessionPreviewTabs.svelte'
-import { stripBase, TRIGGER_PAGES, type TriggerKind } from './previewPaths'
+import {
+	pageItemListPath,
+	pageItemUrl,
+	parsePageItemRoute,
+	stripBase,
+	TRIGGER_PAGES,
+	type PageItemRef,
+	type TriggerKind
+} from './previewPaths'
 
 // Which list pages a completed chat tool can change, as base-stripped paths
 // (e.g. `/schedules`). This allowlist is the single source of truth for "does
@@ -13,23 +21,27 @@ import { stripBase, TRIGGER_PAGES, type TriggerKind } from './previewPaths'
 // deliberately absent: every editable item is a live in-process editor that
 // self-syncs from the store the chat mutates, so its tab needs no reload — and
 // no list page we preview lists open drafts. They fall through to NO_RELOAD.
-// This "live editors self-sync, only list pages reload" invariant is the reason
-// the callers below and in the sessions page reload nothing for item tabs.
-export type ToolReloadEffect = { pages: string[] }
-const NO_RELOAD: ToolReloadEffect = { pages: [] }
+//
+// Page items (variables, resources, schedules, triggers) are the exception among
+// in-process tabs: their editors read a draft only when they open, so a write to
+// one reloads its tab too. `items` names it when the tool's args do; without a
+// path, every tab of that kind reloads.
+export type ToolReloadEffect = { pages: string[]; items: PageItemRef[] }
+const NO_RELOAD: ToolReloadEffect = { pages: [], items: [] }
 
 export function toolReloadEffect(name: string, args: any): ToolReloadEffect {
 	switch (name) {
 		case 'write_schedule':
-			return { pages: ['/schedules'] }
+			return withItem(['/schedules'], itemRef('schedule', args))
 		case 'write_trigger':
-			return { pages: triggerPages(args?.kind) }
+			// Its path sits in the trigger's own config, not beside `kind`.
+			return withItem(triggerPages(args?.kind), itemRef('trigger', args?.config, args?.kind))
 		case 'write_resource':
-			return { pages: ['/resources'] }
+			return withItem(['/resources'], itemRef('resource', args))
 		case 'write_variable':
-			return { pages: ['/variables'] }
+			return withItem(['/variables'], itemRef('variable', args))
 		case 'create_folder':
-			return { pages: ['/folders'] }
+			return { pages: ['/folders'], items: [] }
 		// Generic item tools carry a workspace-item `type`; refresh its list page
 		// when it lives on one (schedule/resource/variable/trigger). script/flow/app
 		// have their own live editor tab and no previewed list page → nothing.
@@ -37,12 +49,31 @@ export function toolReloadEffect(name: string, args: any): ToolReloadEffect {
 		case 'discard_local_draft':
 		case 'deploy_workspace_item':
 		case 'rebase_draft':
-			return { pages: pagesForItemType(args?.type, args) }
+			return withItem(
+				pagesForItemType(args?.type, args),
+				itemRef(args?.type, args, args?.trigger_kind)
+			)
 		default:
 			return NO_RELOAD
 	}
 }
 
+function withItem(pages: string[], item: PageItemRef | undefined): ToolReloadEffect {
+	return { pages, items: item && pages.length ? [item] : [] }
+}
+
+function itemRef(type: unknown, args: any, triggerKind?: unknown): PageItemRef | undefined {
+	const path = args?.path
+	if (typeof path !== 'string' || !path) return undefined
+	if (type === 'variable' || type === 'resource' || type === 'schedule') {
+		return { kind: type, path }
+	}
+	if (type === 'trigger' && (triggerKind as string) in TRIGGER_PAGES) {
+		return { kind: 'trigger', triggerKind: triggerKind as TriggerKind, path }
+	}
+	return undefined
+}
+
 function pagesForItemType(type: unknown, args: any): string[] {
 	switch (type) {
 		case 'schedule':
@@ -63,14 +94,23 @@ function triggerPages(kind: unknown): string[] {
 	return page ? [page.path] : []
 }
 
-// The open tabs a page-reload should refresh: those whose observed page path is
-// in `pages`. Item-editor and pipeline tab routes are never list pages, so they
-// never match (see the self-sync invariant above). Pure over a tab snapshot so
-// the sessions page can reload by id and this stays unit-testable.
+// The open tabs a reload should refresh: list-page tabs whose observed page path is
+// in `pages`, and page item tabs on those pages — only the named ones when a tool
+// named its item. Item-editor and pipeline tab routes are never list pages, so they
+// never match (see the self-sync invariant above). Pure over a tab snapshot so the
+// sessions page can reload by id and this stays unit-testable.
 export function tabsToReload(
 	tabs: SessionPreviewTab[],
-	pages: ReadonlySet<string>
+	pages: ReadonlySet<string>,
+	items: ReadonlySet<string> = new Set()
 ): SessionPreviewTab[] {
 	if (pages.size === 0) return []
-	return tabs.filter((t) => pages.has(stripBase(whereIs(t))))
+	return tabs.filter((t) => {
+		const pageItem = parsePageItemRoute(t.url)
+		if (!pageItem) return pages.has(stripBase(whereIs(t)))
+		const listPath = pageItemListPath(pageItem)
+		if (!pages.has(listPath)) return false
+		const named = [...items].some((u) => pageItemListPath(parsePageItemRoute(u)!) === listPath)
+		return !named || items.has(pageItemUrl(pageItem))
+	})
 }
diff --git a/frontend/src/lib/components/sessions/previewRouter.test.ts b/frontend/src/lib/components/sessions/previewRouter.test.ts
index 7d56f9e717..3bc76882e5 100644
--- a/frontend/src/lib/components/sessions/previewRouter.test.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.test.ts
@@ -14,8 +14,27 @@ import {
 	previewLocationContext,
 	previewLocationLabel,
 	resolvePreviewTab,
-	runFormUrl
+	runFormUrl,
+	workspacePageHref
 } from './previewRouter'
+import { pageItemUrl } from './previewPaths'
+
+describe('workspacePageHref', () => {
+	it('sends a page item tab to its list page with the row open, never to its scheme', () => {
+		expect(workspacePageHref(pageItemUrl({ kind: 'resource', path: 'u/me/db' }))).toBe(
+			'/resources#/resource/u/me/db'
+		)
+		expect(
+			workspacePageHref(pageItemUrl({ kind: 'trigger', triggerKind: 'kafka', path: 'f/a/b' }))
+		).toBe('/kafka_triggers#f/a/b')
+	})
+
+	it('has no page for a tab that belongs to the chat', () => {
+		expect(workspacePageHref(artifactUrl('a1', 'Plan'))).toBeUndefined()
+		expect(workspacePageHref(runFormUrl('call_1', 'Run'))).toBeUndefined()
+		expect(workspacePageHref('/runs?path=u/me/x')).toBe('/runs?path=u/me/x')
+	})
+})
 
 describe('drawerAnchorFor', () => {
 	it('reads the anchored row on the pages that deep-link one', () => {
diff --git a/frontend/src/lib/components/sessions/previewRouter.ts b/frontend/src/lib/components/sessions/previewRouter.ts
index 9f312ea389..13e7626e70 100644
--- a/frontend/src/lib/components/sessions/previewRouter.ts
+++ b/frontend/src/lib/components/sessions/previewRouter.ts
@@ -3,8 +3,13 @@ import {
 	AUDIT_LOGS_PATH,
 	FOLDERS_PATH,
 	GROUPS_PATH,
+	pageItemForListPath,
+	pageItemListPath,
+	pageItemPageHref,
+	pageItemUrl,
 	pageKey,
 	pageHref,
+	parsePageItemRoute,
 	parsePreviewItemRoute,
 	RESOURCES_PATH,
 	RUNS_PATH,
@@ -14,17 +19,22 @@ import {
 	WORKSPACE_SETTINGS_PATH,
 	triggerLabelForPath,
 	TRIGGER_PAGES,
+	type PageItemRef,
 	type PreviewItemRoute,
 	type TriggerKind
 } from './previewPaths'
 // Re-exported so the preview code that already reads locations through this module keeps
 // one import, while a caller needing only a path can reach for the leaf instead.
 export {
+	pageItemListPath,
+	pageItemUrl,
 	pageKey,
 	pageHref,
+	parsePageItemRoute,
 	parsePreviewItemRoute,
 	stripBase,
 	TRIGGER_PAGES,
+	type PageItemRef,
 	type PreviewItemRoute,
 	type TriggerKind
 }
@@ -68,6 +78,7 @@ export type PreviewTarget =
 	| { type: 'item'; item: WorkspaceItem }
 	| { type: 'artifact'; id: string; name: string; version?: ArtifactVersionTarget }
 	| { type: 'runform'; toolCallId: string; label: string }
+	| { type: 'pageitem'; ref: PageItemRef }
 
 export type PreviewPage = { label: string; path: string; icon: DrillIcon }
 
@@ -117,6 +128,26 @@ export function drawerAnchorFor(location: string): string | undefined {
 	return location.slice(hashAt + 1).replace(/^\/resource\//, '') || undefined
 }
 
+/** The item a list-page location deep-links, as a tab of its own: a session edits these
+ * in process, so the list page's drawer is never where one belongs. */
+export function pageItemForLocation(location: string): PageItemRef | undefined {
+	const anchor = drawerAnchorFor(location)
+	if (!anchor) return undefined
+	let path: string
+	try {
+		path = decodeURIComponent(anchor)
+	} catch {
+		return undefined
+	}
+	return pageItemForListPath(location, path)
+}
+
+/** A location with a deep-linked row replaced by that row's own tab; any other unchanged. */
+export function pageItemLocation(location: string): string {
+	const ref = pageItemForLocation(location)
+	return ref ? pageItemUrl(ref) : location
+}
+
 // Query params the preview host injects into an iframe URL (`nomenubar` hides the nav,
 // `workspace` scopes the page). Never part of what a location means.
 const INJECTED_PARAMS = ['nomenubar', 'workspace'] as const
@@ -126,7 +157,7 @@ const INJECTED_PARAMS = ['nomenubar', 'workspace'] as const
 export function canonicalizeObservedLoc(loc: string): string {
 	// An artifact or a run form is a scheme, not a path — `new URL` would happily parse it
 	// and hand back a pathname with the scheme gone.
-	if (parseArtifactRoute(loc) || parseRunFormRoute(loc)) return loc
+	if (parseArtifactRoute(loc) || parseRunFormRoute(loc) || parsePageItemRoute(loc)) return loc
 	try {
 		const u = new URL(loc, 'http://_')
 		for (const p of INJECTED_PARAMS) u.searchParams.delete(p)
@@ -201,6 +232,8 @@ export function describeLocation(loc: string): PreviewLocation {
 	// Identity is the call, never the label: that carries the script's summary, so folding it
 	// in would open a second tab for the same form whenever the summary differed.
 	if (runForm) return { identity: `runform:${runForm.toolCallId}`, view: '', anchor: '' }
+	const pageItem = parsePageItemRoute(loc)
+	if (pageItem) return { identity: pageItemUrl(pageItem), view: '', anchor: '' }
 	const canonical = canonicalizeObservedLoc(loc)
 	const path = stripBase(canonical)
 	const bare = canonical.split('#')[0]
@@ -322,6 +355,15 @@ export function previewLocationContext(loc: string): {
 	location: string
 	open?: string
 } {
+	// Told as its list page with the item open, the shape the model already reads for a row
+	// whose drawer is open — which is all a page item tab is to it.
+	const pageItem = parsePageItemRoute(loc)
+	if (pageItem) {
+		return {
+			...previewLocationContext(pageItemListPath(pageItem)),
+			open: promptSafe(pageItem.path)
+		}
+	}
 	const { identity, anchor } = describeLocation(loc)
 	const bare = canonicalizeObservedLoc(loc).split('#')[0]
 	const query = bare.includes('?') ? bare.slice(bare.indexOf('?') + 1) : ''
@@ -370,6 +412,8 @@ export function previewLocationLabel(url: string): string {
 	if (artifact) return artifact.name || 'Artifact'
 	const runForm = parseRunFormRoute(url)
 	if (runForm) return runForm.label || 'Run form'
+	const pageItem = parsePageItemRoute(url)
+	if (pageItem) return pageItem.path.split('/').pop() || pageItem.path
 	const page = matchReusablePage(url)
 	if (page) return page.label
 	const trigger = triggerLabelForPath(url)
@@ -492,6 +536,7 @@ export type PreviewSlot =
 	| { kind: 'editor'; editorKind: SessionTargetKind | 'pipeline'; path: string }
 	| { kind: 'artifact'; id: string; version?: number }
 	| { kind: 'runform'; toolCallId: string }
+	| { kind: 'pageitem'; ref: PageItemRef }
 	| { kind: 'iframe' }
 
 export function resolvePreviewTab(url: string): PreviewSlot {
@@ -499,6 +544,8 @@ export function resolvePreviewTab(url: string): PreviewSlot {
 	if (artifact) return { kind: 'artifact', id: artifact.id, version: artifact.version }
 	const runForm = parseRunFormRoute(url)
 	if (runForm) return { kind: 'runform', toolCallId: runForm.toolCallId }
+	const pageItem = parsePageItemRoute(url)
+	if (pageItem) return { kind: 'pageitem', ref: pageItem }
 	const pipelineFolder = parsePipelineRoute(url)
 	if (pipelineFolder) {
 		return { kind: 'editor', editorKind: 'pipeline', path: pipelineFolder }
@@ -516,3 +563,24 @@ export function resolvePreviewTab(url: string): PreviewSlot {
 	if (!editorKind) return { kind: 'iframe' }
 	return { kind: 'editor', editorKind, path: route.itemPath }
 }
+
+/** The full workspace page showing what a tab shows ("Open in workspace"), or undefined when
+ * there is none. Every tab kind answers here, so a new one cannot fall through to its url being
+ * navigated as a path — an artifact or page item url is a scheme, not a route. */
+export function workspacePageHref(location: string): string | undefined {
+	const slot = resolvePreviewTab(location)
+	switch (slot.kind) {
+		case 'artifact':
+		case 'runform':
+			return undefined
+		case 'pageitem':
+			return pageItemPageHref(slot.ref)
+		case 'editor':
+		case 'iframe':
+			return location
+		default: {
+			const unhandled: never = slot
+			return unhandled
+		}
+	}
+}
diff --git a/frontend/src/lib/components/sessions/sessionMode.svelte.ts b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
index a4972a9afb..a2c20e08a8 100644
--- a/frontend/src/lib/components/sessions/sessionMode.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionMode.svelte.ts
@@ -47,6 +47,17 @@ export function withMenuHidden(url: string, workspaceId?: string): string {
 	}
 }
 
+// True when this window is a sessions-preview iframe: embedded, with the `nomenubar` flag
+// the preview always sets and the logged layout stickies into sessionStorage.
+export function isSessionPreviewFrame(): boolean {
+	if (typeof window === 'undefined' || window.self === window.top) return false
+	try {
+		return sessionStorage.getItem('nomenubar_embedded') === 'true'
+	} catch {
+		return false
+	}
+}
+
 // Append `?workspace=` to a canonical route so a full-page navigation (e.g.
 // "Open in workspace") lands on the session's effective workspace instead of
 // the navigation workspace. Unlike withMenuHidden, the menu is kept visible —
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
index a9db01e0fa..a90eb83cc4 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.svelte.ts
@@ -8,7 +8,10 @@ import {
 	describeLocation,
 	matchPreviewPage,
 	showsView,
+	pageItemLocation,
+	pageItemUrl,
 	parseArtifactRoute,
+	parsePageItemRoute,
 	parsePipelineRoute,
 	previewLocationContext,
 	promptSafe,
@@ -24,6 +27,12 @@ import {
 import type { SessionPreviewTab, SessionTarget } from './sessionState.svelte'
 import type { Kind } from '$lib/utils_deployable'
 import { pipelineFolderFromBundlePath } from '$lib/pipelinePaths'
+import {
+	pageItemKindLabel,
+	TRIGGER_PAGES,
+	type PageItemRef,
+	type TriggerKind
+} from './previewPaths'
 
 // The single live owner of a session's preview tabs. Runs behind a small
 // interface both the sessions page (renderer) and the `open_preview` tool cross,
@@ -78,7 +87,10 @@ function keptVersion(
 // scheme. `onto` is the tab about to be written, passed wherever one is being re-pointed so
 // that every such path keeps its pin.
 function targetUrl(target: PreviewTarget, onto?: SessionPreviewTab): string {
-	if (target.type === 'page') return target.href
+	// A list page asked for with a row anchored is that row's own tab: its drawer would only
+	// open the editor a page item tab already hosts, inside a frame of its own.
+	if (target.type === 'page') return pageItemLocation(target.href)
+	if (target.type === 'pageitem') return pageItemUrl(target.ref)
 	if (target.type === 'artifact') {
 		return artifactUrl(target.id, target.name, keptVersion(target, onto))
 	}
@@ -152,10 +164,9 @@ export function previewTargetForSessionTarget(
 
 // Adapt a deployable item's layout kind (the session review dock speaks `Kind`,
 // not SessionTarget) to a preview destination: the three live editors, data
-// pipelines, plus legacy drag-and-drop apps, which the panel hosts as an iframe
-// over their edit route. Every other kind maps to undefined — not for lack of any
-// route (a variable or trigger has a list page the panel can host) but because
-// there is no item editor to preview, so their row falls back to the diff. The
+// pipelines, page items (variables, resources, schedules, triggers), plus legacy
+// drag-and-drop apps, which the panel hosts as an iframe over their edit route.
+// Every other kind maps to undefined, and its row falls back to the diff. The
 // undefined is also the caller's test for "can this row be previewed?".
 export function previewTargetForDeployKind(kind: Kind, path: string): PreviewTarget | undefined {
 	if (kind === 'app') {
@@ -164,6 +175,16 @@ export function previewTargetForDeployKind(kind: Kind, path: string): PreviewTar
 	if (kind === 'script' || kind === 'flow' || kind === 'raw_app') {
 		return previewTargetForSessionTarget(kind, path)
 	}
+	if (kind === 'variable' || kind === 'resource' || kind === 'schedule') {
+		return { type: 'pageitem', ref: { kind, path } }
+	}
+	const triggerKind = kind.endsWith('_trigger') ? kind.slice(0, -'_trigger'.length) : undefined
+	if (triggerKind && triggerKind in TRIGGER_PAGES) {
+		return {
+			type: 'pageitem',
+			ref: { kind: 'trigger', triggerKind: triggerKind as TriggerKind, path }
+		}
+	}
 	// A pipeline's editor is its folder's graph view, not its bundle path.
 	if (kind === 'data_pipeline') {
 		const folder = pipelineFolderFromBundlePath(path)
@@ -189,7 +210,14 @@ export function hydratePreviewTabs(session: {
 		seen.add(t.id)
 		// Rebuilt field-by-field so stray properties on old saved records (e.g. the
 		// retired `pinned` flag) don't survive hydration and get persisted back.
-		tabs.push({ id: t.id, url: t.url, loc: t.loc || t.url })
+		// A list page saved with a row's drawer open comes back as that row's own tab. Read from
+		// where the frame was, not from what was last commanded: the user may have moved to
+		// another row since, or closed the drawer, and the observation is what they saw.
+		const loc = t.loc || t.url
+		const item = pageItemLocation(t.loc ? loc : t.url)
+		tabs.push(
+			parsePageItemRoute(item) ? { id: t.id, url: item, loc: item } : { id: t.id, url: t.url, loc }
+		)
 	}
 	if (tabs.length > 0) {
 		const wantActive = session.activePreviewTabId
@@ -290,22 +318,14 @@ export class SessionPreviewTabs {
 		// Drift is a change of what the frame *shows*, not of its URL string: a page
 		// writing its own filter defaults back is not the user navigating away.
 		const drifted = !showsView(tab.loc, url)
-		// Both cases the browser will not act on, decided here because this is where the
-		// old and new commands are both in hand: re-commanding the URL a drifted frame
-		// already carries moves nothing, and moving to another fragment resolves within the
-		// same document — so a list page never re-runs the `#<path>` read that opens a row.
-		// Dropping the fragment is not one of them: the same-document path applies only to a
-		// target that has one, so the browser loads the page — closing the drawer by itself —
-		// and forcing a second load races that one back onto the row.
-		const fragmentOnly =
-			!commandUnchanged && url.includes('#') && tab.url.split('#')[0] === url.split('#')[0]
+		// Decided here because this is where the old and new commands are both in hand:
+		// re-commanding the URL a drifted frame already carries moves nothing.
 		retargetTab(tab, url)
-		if ((commandUnchanged && drifted) || fragmentOnly) this.pulseReload(tab.id)
+		if (commandUnchanged && drifted) this.pulseReload(tab.id)
 	}
 
-	// Force the host to reload the iframe. A navigation onto the tab's exact current URL
-	// changes nothing, so URL-driven behavior — a `#<path>` opening a drawer the user has
-	// since closed — would never re-fire.
+	// Force the host to reload the tab. A navigation onto the tab's exact current URL
+	// changes nothing, so URL-driven behavior would never re-fire.
 	pulseReload(id: string): void {
 		this.#reloadPulse = { id, nonce: this.#reloadPulse.nonce + 1 }
 	}
@@ -435,21 +455,21 @@ export class SessionPreviewTabs {
 		// shows this. The tab on this exact view wins over any other on the page —
 		// `new_tab` puts two views side by side, and retargeting whichever sits first
 		// would overwrite the other and leave both on the same row.
-		const shown = opts?.forceNewTab
-			? undefined
-			: (this.#tabs.find((t) => showsView(t.loc, url)) ??
-				this.#tabs.find((t) => describeLocation(t.loc).identity === describeLocation(url).identity))
+		// A page item stays one tab whatever the opener asks: two would hold two drafts of it.
+		const shown =
+			opts?.forceNewTab && !parsePageItemRoute(url)
+				? undefined
+				: (this.#tabs.find((t) => showsView(t.loc, url)) ??
+					this.#tabs.find(
+						(t) => describeLocation(t.loc).identity === describeLocation(url).identity
+					))
 		if (shown) {
 			const same = showsView(shown.loc, url)
 			if (same) {
 				// The frame is already here, but record what was asked for: `url` is what the
 				// tab persists and remounts from, so leaving it on where the frame started
-				// sends a refresh back to the row the user has since moved off.
+				// sends a refresh back to the view the user has since moved off.
 				recordCommand(shown, url)
-				// Nothing to navigate to, so nothing would re-run: the list pages read their
-				// `#<path>` once per document, and the drawer it opens may since have been
-				// closed. Only a forced load can bring it back.
-				if (describeLocation(url).anchor) this.pulseReload(shown.id)
 			} else {
 				this.#retarget(shown, url)
 			}
@@ -512,7 +532,17 @@ export class SessionPreviewTabs {
 				return
 			}
 		}
-		this.#retarget(t, targetUrl(target, t))
+		// One tab per page item, as for editors: two would hold two drafts of one item.
+		const url = targetUrl(target, t)
+		if (parsePageItemRoute(url)) {
+			const existing = this.#tabs.find((x) => x.url === url)
+			if (existing && existing.id !== t.id) {
+				this.#activeId = existing.id
+				this.#flush()
+				return
+			}
+		}
+		this.#retarget(t, url)
 		this.#flush()
 	}
 
@@ -574,6 +604,17 @@ export class SessionPreviewTabs {
 		this.#flush()
 	}
 
+	/** Follow a page item its editor saved under a new path, in place. */
+	retargetPageItem(from: PageItemRef, to: PageItemRef): void {
+		const fromUrl = pageItemUrl(from)
+		const toUrl = pageItemUrl(to)
+		if (fromUrl === toUrl) return
+		const tab = this.#tabs.find((t) => t.url === fromUrl)
+		if (!tab) return
+		retargetTab(tab, toUrl)
+		this.#flush()
+	}
+
 	closeArtifact(artifactId: string): void {
 		const tab = this.#tabs.find((t) => parseArtifactRoute(t.url)?.id === artifactId)
 		if (tab) this.close(tab.id)
@@ -606,23 +647,14 @@ export class SessionPreviewTabs {
 	}
 
 	// Feed back the location an iframe reported on load (only the page can read
-	// contentWindow.location). Updates the observed `loc`; `url` follows only when a
-	// drawer closed (below), and the host navigates on a command it isn't already at,
-	// so that write does not move the frame.
+	// contentWindow.location). Updates the observed `loc` only: the host navigates on a
+	// command it isn't already at, and an in-frame move is the user browsing.
 	observeLocation(id: string, loc: string): void {
 		const t = this.#tabs.find((x) => x.id === id)
 		if (!t) return
 		const canonical = canonicalizeObservedLoc(loc)
 		if (t.loc === canonical) return
 		t.loc = canonical
-		// Closing a drawer drops the row from the frame's URL. The command has to follow, or
-		// the tab reopens it on the next mount — the iframe loads `url`, not `loc`. Only the
-		// anchor: any other in-frame move is the user browsing, which must not re-command.
-		const commanded = describeLocation(t.url)
-		const observed = describeLocation(canonical)
-		if (commanded.anchor && !observed.anchor && commanded.identity === observed.identity) {
-			t.url = t.url.split('#')[0]
-		}
 		this.#flush()
 	}
 
@@ -730,6 +762,7 @@ export function describePreview(
 	const lines = tabs.map((t) => {
 		const where = whereIs(t)
 		const artifact = parseArtifactRoute(where)
+		const pageItem = parsePageItemRoute(where)
 		const page = matchPreviewPage(where)
 		const pipelineFolder = parsePipelineRoute(where)
 		const route = parsePreviewItemRoute(where)
@@ -737,16 +770,19 @@ export function describePreview(
 			? // A pinned tab is not showing what the assistant last wrote, and nothing else in this
 				// summary would tell it so.
 				`artifact "${artifact.name || 'Artifact'}"${artifact.version ? ` (pinned to v${artifact.version})` : ''}`
-			: page
-				? `page "${page.label}"${previewLocationDetail(where)}`
-				: pipelineFolder
-					? `pipeline "${pipelineFolder}"`
-					: route
-						? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
-						: // Trigger list pages land here (they're outside PREVIEW_PAGES), and
-							// their `#<path>` is the trigger the drawer has open.
-							`${stripBase(where)}${previewLocationDetail(where)}`
-		const live = resolvePreviewTab(t.url).kind === 'editor' ? ', live editor' : ''
+			: pageItem
+				? `${pageItemKindLabel(pageItem).toLowerCase()} "${pageItem.path}"`
+				: page
+					? `page "${page.label}"${previewLocationDetail(where)}`
+					: pipelineFolder
+						? `pipeline "${pipelineFolder}"`
+						: route
+							? `${route.raw_app ? 'raw_app' : route.kind} "${route.itemPath}"`
+							: // Trigger list pages land here (they're outside PREVIEW_PAGES), and
+								// their `#<path>` is the trigger the drawer has open.
+								`${stripBase(where)}${previewLocationDetail(where)}`
+		const slotKind = resolvePreviewTab(t.url).kind
+		const live = slotKind === 'editor' || slotKind === 'pageitem' ? ', live editor' : ''
 		const active = t.id === activeId ? ', active' : ''
 		// One list entry per tab: an artifact's name, a pipeline folder and an item path
 		// all arrive decoded from a URL, so any of them could otherwise write a line here.
diff --git a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
index b71de62c23..8b1ba27ea0 100644
--- a/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
+++ b/frontend/src/lib/components/sessions/sessionPreviewTabs.test.ts
@@ -177,10 +177,88 @@ describe('previewTargetForDeployKind', () => {
 			pipelineTarget
 		)
 	})
+	it('routes variables, resources, schedules and triggers to their own tab', () => {
+		expect(previewTargetForDeployKind('schedule', 'u/me/s')).toEqual({
+			type: 'pageitem',
+			ref: { kind: 'schedule', path: 'u/me/s' }
+		})
+		expect(previewTargetForDeployKind('http_trigger', 'u/me/t')).toEqual({
+			type: 'pageitem',
+			ref: { kind: 'trigger', triggerKind: 'http', path: 'u/me/t' }
+		})
+		expect(previewTargetForDeployKind('variable', 'u/me/v')).toEqual({
+			type: 'pageitem',
+			ref: { kind: 'variable', path: 'u/me/v' }
+		})
+	})
+
 	it('has no destination for kinds the preview panel cannot host', () => {
-		expect(previewTargetForDeployKind('schedule', 'u/me/s')).toBeUndefined()
-		expect(previewTargetForDeployKind('http_trigger', 'u/me/t')).toBeUndefined()
-		expect(previewTargetForDeployKind('variable', 'u/me/v')).toBeUndefined()
+		expect(previewTargetForDeployKind('folder', 'f/x')).toBeUndefined()
+		expect(previewTargetForDeployKind('resource_type', 'x')).toBeUndefined()
+	})
+})
+
+describe('page item tabs', () => {
+	const variable: PreviewTarget = {
+		type: 'pageitem',
+		ref: { kind: 'variable', path: 'u/me/token' }
+	}
+
+	it('opens a list page anchored at a row as that row’s own tab, beside the list', () => {
+		const o = owner()
+		o.open({ type: 'page', href: '/routes', label: 'HTTP routes' })
+		o.open({ type: 'page', href: '/routes#u/me/a', label: 'HTTP routes' })
+		expect(o.tabs.map((t) => t.url)).toEqual(['/routes', 'pageitem:trigger.http/u%2Fme%2Fa'])
+
+		// Resources address their row through an extra segment.
+		o.open({ type: 'page', href: '/resources?owner=u#/resource/u/me/db', label: 'Resources' })
+		expect(o.tabs.at(-1)!.url).toBe('pageitem:resource/u%2Fme%2Fdb')
+	})
+
+	it('keeps one tab per item, whatever the opener asks', () => {
+		const o = owner()
+		o.open(variable)
+		o.open({ type: 'page', href: '/runs', label: 'Runs' })
+		expect(o.open({ type: 'page', href: '/variables#u/me/token', label: 'V' }).status).toBe(
+			'focused'
+		)
+		expect(o.open(variable, { forceNewTab: true }).status).toBe('focused')
+		o.navigate(variable)
+		expect(o.tabs).toHaveLength(2)
+		expect(o.activeId).toBe(o.tabs[0].id)
+	})
+
+	it('follows an item saved under a new path in place', () => {
+		const o = owner()
+		o.open(variable)
+		const id = o.tabs[0].id
+		o.retargetPageItem(
+			{ kind: 'variable', path: 'u/me/token' },
+			{ kind: 'variable', path: 'f/x/token' }
+		)
+		expect(o.tabs).toEqual([
+			{ id, url: 'pageitem:variable/f%2Fx%2Ftoken', loc: 'pageitem:variable/f%2Fx%2Ftoken' }
+		])
+	})
+
+	it('restores a tab saved on a row’s drawer as the row it was last on', () => {
+		const snap = hydratePreviewTabs({
+			previewTabs: [
+				{ id: 'a', url: '/schedules#u/me/daily', loc: '/schedules?path=u#u/me/daily' },
+				// A drawer opened inside the frame: the command is still the bare list.
+				{ id: 'b', url: '/variables', loc: '/variables#u/me/token' },
+				// The user moved on to another row inside the frame…
+				{ id: 'c', url: '/variables#u/me/token', loc: '/variables#u/me/other' },
+				// …or closed the drawer, leaving no row to restore.
+				{ id: 'd', url: '/variables#u/me/token', loc: '/variables' }
+			]
+		})
+		expect(snap.tabs).toEqual([
+			{ id: 'a', url: 'pageitem:schedule/u%2Fme%2Fdaily', loc: 'pageitem:schedule/u%2Fme%2Fdaily' },
+			{ id: 'b', url: 'pageitem:variable/u%2Fme%2Ftoken', loc: 'pageitem:variable/u%2Fme%2Ftoken' },
+			{ id: 'c', url: 'pageitem:variable/u%2Fme%2Fother', loc: 'pageitem:variable/u%2Fme%2Fother' },
+			{ id: 'd', url: '/variables#u/me/token', loc: '/variables' }
+		])
 	})
 })
 
@@ -232,93 +310,34 @@ describe('SessionPreviewTabs.open', () => {
 		expect(o.activeId).toBe(firstId)
 	})
 
-	// A trigger list page is not a `matchReusablePage`, so the runtime's
-	// navigate-in-place path doesn't cover it: re-pointing the tab has to happen
-	// here or the panel keeps showing the previously opened row.
-	it('re-points a page tab whose hash target changed instead of only focusing it', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const firstId = o.activeId
-
-		// 'retargeted', not 'opened': the tab count is unchanged, and the caller
-		// reports that to the model.
-		const res = o.open(routes('/routes#u/me/b'))
-		expect(res.status).toBe('retargeted')
-		expect(o.tabs).toHaveLength(1)
-		expect(o.activeId).toBe(firstId)
-		expect(o.tabs[0].url).toBe('/routes#u/me/b')
-
-		// Back to the bare list: still the same tab, no longer anchored at a row.
-		expect(o.open(routes('/routes')).status).toBe('retargeted')
-		expect(o.tabs).toHaveLength(1)
-		expect(o.tabs[0].url).toBe('/routes')
-
-		// ...and asking for the view it already shows is a plain focus.
-		expect(o.open(routes('/routes')).status).toBe('focused')
-	})
-
 	// The list pages rewrite their own filter defaults into the URL after mount,
 	// and `loc` follows that rewrite. Matching on anything but the path made a tab
 	// stop recognizing itself, so every later open spawned a duplicate.
 	it('still recognizes a tab after the page rewrote its own filter params', () => {
 		const o = owner()
 		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		o.observeLocation(id, '/routes?filter_path_of=trigger#u/me/a')
+		o.open(routes('/routes'))
+		o.observeLocation(o.tabs[0].id, '/routes?filter_path_of=trigger')
 
-		const res = o.open(routes('/routes#u/me/b'))
-		expect(res.status).toBe('retargeted')
+		expect(o.open(routes('/routes')).status).toBe('focused')
 		expect(o.tabs).toHaveLength(1)
-		expect(o.tabs[0].url).toBe('/routes#u/me/b')
 	})
 
 	// `new_tab` deliberately keeps two views of one page side by side. Reopening one of
 	// them must focus the tab already showing it, not retarget whichever tab happens to
-	// sit first in the strip — that would overwrite the other view and leave two tabs
-	// on the same row.
+	// sit first in the strip — that would overwrite the other view.
 	it('focuses the tab already showing the exact location before retargeting by path', () => {
 		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
+		const runs = (href: string) => ({ type: 'page' as const, href, label: 'Runs' })
+		o.open(runs('/runs?path=u/me/a'))
 		const first = o.tabs[0].id
-		o.open(routes('/routes#u/me/b'), { forceNewTab: true })
+		o.open(runs('/runs?path=u/me/b'), { forceNewTab: true })
 		const second = o.tabs[1].id
 
-		expect(o.open(routes('/routes#u/me/b')).status).toBe('focused')
+		expect(o.open(runs('/runs?path=u/me/b')).status).toBe('focused')
 		expect(o.activeId).toBe(second)
 		expect(o.tabs).toHaveLength(2)
-		expect(o.tabs.find((t) => t.id === first)?.url).toBe('/routes#u/me/a')
-	})
-
-	// The list pages read their `#<path>` once per document, so a drawer the user closed
-	// inside the frame only comes back on a forced load — and re-commanding the location
-	// the tab already shows produces no navigation the host could act on.
-	it('forces a load when the requested row is the one the tab already shows', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		o.observeLocation(id, '/routes?filter_path_of=trigger#u/me/a')
-		const before = o.reloadPulse.nonce
-
-		expect(o.open(routes('/routes#u/me/a')).status).toBe('focused')
-		expect(o.reloadPulse).toEqual({ id, nonce: before + 1 })
-	})
-
-	// Dropping the fragment is a load in itself, so the forced one lands on top of a
-	// navigation still in flight — and reloads the row the command asked to leave.
-	it('does not force a load when the requested location drops the row', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		const before = o.reloadPulse.nonce
-
-		o.navigate(routes('/routes'))
-		expect(o.tabs.find((t) => t.id === id)?.url).toBe('/routes')
-		expect(o.reloadPulse.nonce).toBe(before)
+		expect(o.tabs.find((t) => t.id === first)?.url).toBe('/runs?path=u/me/a')
 	})
 
 	// Runs restores the user's "hide schedules" preference into the URL whenever a load
@@ -365,29 +384,11 @@ describe('SessionPreviewTabs.open', () => {
 		expect(o.tabs[0].url).toBe('/apps/edit/u/me/dash')
 	})
 
-	// Re-commanding the URL a tab is already pointed at changes nothing the host can
-	// see, so the frame would stay wherever the user navigated it inside the page.
-	it('forces a reload when the request matches the command but the frame drifted', () => {
-		const o = owner()
-		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const id = o.tabs[0].id
-		// The user clicked another trigger inside the iframe.
-		o.observeLocation(id, '/routes#u/me/b')
-		const before = o.reloadPulse.nonce
-
-		const res = o.open(routes('/routes#u/me/a'))
-		expect(res.status).toBe('retargeted')
-		expect(o.tabs).toHaveLength(1)
-		expect(o.tabs[0].loc).toBe('/routes#u/me/a')
-		expect(o.reloadPulse.nonce).toBe(before + 1)
-	})
-
 	it('forceNewTab opts a page out of the location dedupe', () => {
 		const o = owner()
 		const routes = (href: string) => ({ type: 'page' as const, href, label: 'HTTP routes' })
-		o.open(routes('/routes#u/me/a'))
-		const res = o.open(routes('/routes#u/me/b'), { forceNewTab: true })
+		o.open(routes('/routes'))
+		const res = o.open(routes('/routes'), { forceNewTab: true })
 		expect(res.status).toBe('opened')
 		expect(o.tabs).toHaveLength(2)
 	})
@@ -512,59 +513,6 @@ describe('SessionPreviewTabs.open', () => {
 	})
 })
 
-describe('SessionPreviewTabs.open — commanded url', () => {
-	it('records the requested row even when the frame is already showing it', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		// The user moves to another row inside the frame.
-		o.observeLocation(o.tabs[0].id, '/routes#u/me/b')
-		o.open({ type: 'page', href: '/routes#u/me/b', label: 'R' })
-		// `url` is what a refresh and a remount reload from, so it has to follow.
-		expect(o.tabs[0].url).toBe('/routes#u/me/b')
-		expect(o.tabs).toHaveLength(1)
-	})
-})
-
-describe('SessionPreviewTabs.observeLocation', () => {
-	it('drops the row from the command when the frame closes its drawer', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		// The page clears its own hash when the drawer closes.
-		o.observeLocation(o.tabs[0].id, '/routes?filter_path_of=trigger')
-		// The iframe mounts from `url`, so a remount would otherwise reopen the drawer.
-		expect(o.tabs[0].url).toBe('/routes')
-	})
-
-	it('leaves the command alone when the user just browses inside the frame', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		o.observeLocation(o.tabs[0].id, '/routes#u/me/b')
-		expect(o.tabs[0].url).toBe('/routes#u/me/a')
-	})
-})
-
-describe('SessionPreviewTabs.open — forced loads', () => {
-	it('pulses when only the fragment changes, since the browser would not load', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		const before = o.reloadPulse.nonce
-		o.open({ type: 'page', href: '/routes#u/me/b', label: 'R' })
-		// Same document: the browser resolves the new fragment without a load, so the
-		// list page never re-runs the `#<path>` read that opens the row.
-		expect(o.reloadPulse.nonce).toBeGreaterThan(before)
-		expect(o.tabs).toHaveLength(1)
-	})
-
-	it('does not pulse when the document itself changes', () => {
-		const o = owner()
-		o.open({ type: 'page', href: '/routes#u/me/a', label: 'R' })
-		const before = o.reloadPulse.nonce
-		o.open({ type: 'page', href: '/schedules#u/me/a', label: 'S' })
-		// Different page: src changes, the browser loads it, nothing to force.
-		expect(o.reloadPulse.nonce).toBe(before)
-	})
-})
-
 describe('SessionPreviewTabs.navigate', () => {
 	it('retargets the active tab to an editor item', () => {
 		const o = owner()
diff --git a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
index bd899c8208..640b484478 100644
--- a/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
+++ b/frontend/src/lib/components/sessions/sessionRuntime.svelte.ts
@@ -56,7 +56,10 @@ import {
 	selectPreviewTabsToClose,
 	whereIs
 } from './sessionPreviewTabs.svelte'
+import { pageItemKindLabel } from './previewPaths'
 import {
+	pageItemForLocation,
+	pageItemLocation,
 	parsePreviewItemRoute,
 	previewLocationContext,
 	previewLocationLabel,
@@ -387,7 +390,8 @@ function createRuntime(session: Session): SessionRuntime {
 	// What the side panel is showing, stamped on each user message so the chat
 	// knows the page (and the row whose drawer is open) without spending a
 	// get_preview_status round-trip. Live editors are skipped: they register
-	// themselves as the ACTIVE EDITOR through UserDraft's live-draft registry.
+	// themselves as the ACTIVE EDITOR through UserDraft's live-draft registry. A page
+	// item tab is not one of them, and reads as its list page with the item open.
 	manager.activePreviewResolver = () => {
 		const owner = getRuntime(session.id)?.previewTabs
 		// What is on screen, not merely which tab is selected: the rule tells the model
@@ -395,7 +399,8 @@ function createRuntime(session: Session): SessionRuntime {
 		// point those at a page the user cannot see.
 		const tab = owner?.displayedTab
 		if (!tab) return undefined
-		if (resolvePreviewTab(tab.url).kind !== 'iframe') return undefined
+		const slotKind = resolvePreviewTab(tab.url).kind
+		if (slotKind !== 'iframe' && slotKind !== 'pageitem') return undefined
 		return previewLocationContext(whereIs(tab))
 	}
 	// Pre-flight: materialise the (still-transient) session, then commit
@@ -1101,7 +1106,9 @@ async function applyRemoteTurnEnd(sessionId: string, chatId: string): Promise<vo
 // and/or held by a live owner — would otherwise keep showing the old target.
 // Must write through the live owner when one exists; a bare record write would
 // be clobbered by the owner's next flush.
-export function resetSessionPreviewTabs(sessionId: string, url: string): void {
+export function resetSessionPreviewTabs(sessionId: string, seedUrl: string): void {
+	// A list page seeded on a row's drawer opens that row's own tab, as open() would.
+	const url = pageItemLocation(seedUrl)
 	const tabs = [{ id: 'session', url, loc: url }]
 	const rt = runtimes.get(sessionId)
 	if (rt) {
@@ -1179,12 +1186,17 @@ setOpenPreviewHandler(async ({ sessionId: callerSessionId, kind, path }) => {
 // open_page dispatches here to show a workspace page (Runs/Schedules) as a page
 // tab in the calling session's preview panel. Returns undefined when there is no
 // session so open_page can fall back to browser navigation.
-setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label, newTab }) => {
+setOpenPagePreviewHandler(({ sessionId: callerSessionId, href, label: pageLabel, newTab }) => {
 	const sessionId = callerSessionId ?? sessionState.currentSessionId
 	if (!sessionId) return undefined
 	const session = sessionState.sessions.find((s) => s.id === sessionId)
 	if (!session) return undefined
 	const owner = getOrCreateRuntime(session).previewTabs
+	// A page opened on one item is that item's tab, and the report has to name what opened.
+	const pageItem = pageItemForLocation(href)
+	const label = pageItem
+		? `the ${pageItemKindLabel(pageItem).toLowerCase()} ${promptSafe(pageItem.path)}`
+		: pageLabel
 	// open() owns the whole decision — which tab already shows this page, whether the
 	// requested view differs from what it shows, and whether a forced load is needed to
 	// re-fire a drawer. Deciding any of that again here means two predicates for one
diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index 146f844b3f..8ee5391443 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -1,11 +1,6 @@
 <script lang="ts">
 	import { onMount, untrack } from 'svelte'
-	import {
-		userWorkspaces,
-		usersWorkspaceStore,
-		workspaceStore,
-		type UserWorkspace
-	} from '$lib/stores'
+	import { userWorkspaces, usersWorkspaceStore, type UserWorkspace } from '$lib/stores'
 	import { Alert, Button, Skeleton } from '../common'
 	import { triggerableByAI } from '$lib/actions/triggerableByAI.svelte'
 	import Toggle from '../Toggle.svelte'
@@ -19,6 +14,9 @@
 
 	import TextInput from '../text_input/TextInput.svelte'
 	import Select from '../select/Select.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		showMcpMode?: boolean
@@ -138,7 +136,7 @@
 		mcpCreationMode = true
 		void loadMcpUrlPolicy()
 		resetExpirationOnModeChange()
-		newTokenWorkspace = defaultNewTokenWorkspace ?? $workspaceStore
+		newTokenWorkspace = defaultNewTokenWorkspace ?? $operatingWorkspace
 		newToken = undefined
 		newMcpToken = undefined
 		readOnly = false
@@ -198,13 +196,13 @@
 		}
 	}
 
-	const workspaces = $derived(ensureCurrentWorkspaceIncluded($userWorkspaces, $workspaceStore))
+	const workspaces = $derived(ensureCurrentWorkspaceIncluded($userWorkspaces, $operatingWorkspace))
 	const isAllWorkspaces = $derived(newTokenWorkspace === ALL_WORKSPACES)
 	const tokenWorkspaceId = $derived(
 		isAllWorkspaces
 			? undefined
 			: mcpCreationMode
-				? newTokenWorkspace || $workspaceStore
+				? newTokenWorkspace || $operatingWorkspace
 				: newTokenWorkspace
 	)
 
@@ -242,7 +240,7 @@
 	// For an all-workspaces token there is no single workspace, so fall back to
 	// the current one just for populating the endpoint list.
 	const scopeWorkspaceId = $derived(
-		isAllWorkspaces ? $workspaceStore || '' : newTokenWorkspace || $workspaceStore || ''
+		isAllWorkspaces ? $operatingWorkspace || '' : newTokenWorkspace || $operatingWorkspace || ''
 	)
 	// Undefined wherever the workspace is: `/api/mcp/w/undefined/mcp` reads like a real URL
 	// and is copyable, so the OAuth panel withholds it rather than showing a broken one. The
diff --git a/frontend/src/lib/components/settings/EditTokenScopesModal.svelte b/frontend/src/lib/components/settings/EditTokenScopesModal.svelte
index ffea14f4c0..44a44a7937 100644
--- a/frontend/src/lib/components/settings/EditTokenScopesModal.svelte
+++ b/frontend/src/lib/components/settings/EditTokenScopesModal.svelte
@@ -2,11 +2,13 @@
 	import { untrack } from 'svelte'
 	import { UserService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
-	import { workspaceStore } from '$lib/stores'
 	import Button from '../common/button/Button.svelte'
 	import Modal from '../common/modal/Modal.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
 	import ScopesPicker from './ScopesPicker.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		open: boolean
@@ -35,7 +37,7 @@
 	const isMcp = $derived(
 		(initialScopes ?? []).length > 0 && (initialScopes ?? []).every((s) => s.startsWith('mcp:'))
 	)
-	const mcpWorkspaceId = $derived(tokenWorkspaceId ?? $workspaceStore ?? '')
+	const mcpWorkspaceId = $derived(tokenWorkspaceId ?? $operatingWorkspace ?? '')
 
 	let labelValue = $state('')
 	let pickedScopes = $state<string[] | null>(null)
diff --git a/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte b/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte
index 407d3a3bfe..096689bd09 100644
--- a/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte
+++ b/frontend/src/lib/components/settings/UserAIPromptsSettings.svelte
@@ -6,7 +6,10 @@
 	import Label from '../Label.svelte'
 	import AIPromptsModal from './AIPromptsModal.svelte'
 	import { ExternalLink, Settings } from 'lucide-svelte'
-	import { userStore } from '$lib/stores'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	const USER_CUSTOM_PROMPTS_KEY = 'userCustomAIPrompts'
 
@@ -49,7 +52,7 @@
 		<div class="flex flex-col gap-4">
 			<p class="text-xs text-secondary">
 				Customize AI behavior with system prompts. These are stored locally in your browser and
-				apply in addition to {#if $userStore?.is_admin || $userStore?.is_super_admin}<a
+				apply in addition to {#if actingUser?.is_admin || actingUser?.is_super_admin}<a
 						href="/workspace_settings?tab=ai"
 						>workspace-level prompts <ExternalLink size={12} class="inline-block" /></a
 					>{:else}workspace-level prompts{/if}.
diff --git a/frontend/src/lib/components/triggers/AddTriggersButton.svelte b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
index 4027bf9081..17387d13e0 100644
--- a/frontend/src/lib/components/triggers/AddTriggersButton.svelte
+++ b/frontend/src/lib/components/triggers/AddTriggersButton.svelte
@@ -8,7 +8,9 @@
 	import { isCloudHosted } from '$lib/cloud'
 	import { CloudOff } from 'lucide-svelte'
 	import { isServiceAvailable } from './native/utils'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		setDropdownWidthToButtonWidth?: boolean
@@ -41,15 +43,15 @@
 	let githubAvailable = $state(false)
 
 	async function setNextcloudState() {
-		nextcloudAvailable = await isServiceAvailable('nextcloud', $workspaceStore!)
+		nextcloudAvailable = await isServiceAvailable('nextcloud', $operatingWorkspace!)
 	}
 
 	async function setGoogleState() {
-		googleAvailable = await isServiceAvailable('google', $workspaceStore!)
+		googleAvailable = await isServiceAvailable('google', $operatingWorkspace!)
 	}
 
 	async function setGithubState() {
-		githubAvailable = await isServiceAvailable('github', $workspaceStore!)
+		githubAvailable = await isServiceAvailable('github', $operatingWorkspace!)
 	}
 
 	setNextcloudState()
diff --git a/frontend/src/lib/components/triggers/CaptureSection.svelte b/frontend/src/lib/components/triggers/CaptureSection.svelte
index eebfe3c1a7..5b1980e1b4 100644
--- a/frontend/src/lib/components/triggers/CaptureSection.svelte
+++ b/frontend/src/lib/components/triggers/CaptureSection.svelte
@@ -26,7 +26,6 @@
 	import { Pane, Splitpanes } from 'svelte-splitpanes'
 	import { Popover } from '$lib/components/meltComponents'
 	import { CaptureService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { isObject, sendUserToast } from '$lib/utils'
 	import { triggerIconMap } from './utils'
 	import { formatDateShort } from '$lib/utils'
@@ -37,6 +36,9 @@
 	import { twMerge } from 'tailwind-merge'
 	import { FlaskConical } from 'lucide-svelte'
 	import Alert from '../common/alert/Alert.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		disabled?: boolean | undefined
@@ -139,7 +141,7 @@
 			if (!captureInfo.path) return
 
 			const captures = await CaptureService.listCaptures({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				runnableKind: captureInfo.isFlow ? 'flow' : 'script',
 				path: captureInfo.path,
 				triggerKind: captureType,
@@ -167,7 +169,7 @@
 
 			try {
 				const captures = await CaptureService.listCaptures({
-					workspace: $workspaceStore!,
+					workspace: $operatingWorkspace!,
 					runnableKind: captureInfo.isFlow ? 'flow' : 'script',
 					path: captureInfo.path,
 					triggerKind: captureType,
@@ -213,7 +215,7 @@
 		try {
 			isLoadingBigPayload = true
 			const fullCapture = await CaptureService.getCapture({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				id: capture.id
 			})
 
diff --git a/frontend/src/lib/components/triggers/CaptureTable.svelte b/frontend/src/lib/components/triggers/CaptureTable.svelte
index 2d20ac02e1..ea0cf5e256 100644
--- a/frontend/src/lib/components/triggers/CaptureTable.svelte
+++ b/frontend/src/lib/components/triggers/CaptureTable.svelte
@@ -10,7 +10,6 @@
 	import { createEventDispatcher, onDestroy, untrack } from 'svelte'
 	import { type TriggerKind } from '../triggers'
 	import { CaptureService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { type CaptureTriggerKind } from '$lib/gen'
 	import CaptureButton from '$lib/components/triggers/CaptureButton.svelte'
 	import InfiniteList from '../InfiniteList.svelte'
@@ -19,6 +18,9 @@
 	import type { Capture } from '$lib/gen'
 	import { AwsIcon, MqttIcon, AmqpIcon } from '../icons'
 	import GoogleCloudIcon from '../icons/GoogleCloudIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		path: string
@@ -33,9 +35,8 @@
 		limitPayloadSize?: boolean
 		noBorder?: boolean
 		captureActiveIndicator?: boolean | undefined
-		// Workspace to scope capture list/get/delete calls to. Defaults to the nav
-		// `$workspaceStore`; an AI-session live editor passes the session's acting
-		// workspace (a fork) so captures hit the right workspace.
+		// Workspace to scope capture list/get/delete calls to. Defaults to the operating
+		// workspace (see `useOperatingWorkspace`).
 		workspace?: string
 	}
 
@@ -55,7 +56,7 @@
 		workspace = undefined
 	}: Props = $props()
 
-	let ws = $derived(workspace ?? $workspaceStore)
+	let ws = $derived(workspace ?? $operatingWorkspace)
 
 	let selected: number | undefined = $state(undefined)
 	let testKind: 'preprocessor' | 'main' = $state('main')
diff --git a/frontend/src/lib/components/triggers/CaptureWrapper.svelte b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
index bfffbfc56b..9b616454fd 100644
--- a/frontend/src/lib/components/triggers/CaptureWrapper.svelte
+++ b/frontend/src/lib/components/triggers/CaptureWrapper.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import { CaptureService, type CaptureConfig, type CaptureTriggerKind } from '$lib/gen'
 	import { onDestroy, untrack } from 'svelte'
 	import { sendUserToast, sleep } from '$lib/utils'
@@ -18,6 +17,9 @@
 	import GcpCapture from './gcp/GcpCapture.svelte'
 	import AzureCapture from './azure/AzureCapture.svelte'
 	import EmailCapture from './email/EmailCapture.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isFlow: boolean
@@ -63,7 +65,7 @@
 					is_flow: isFlow,
 					trigger_config: args && Object.keys(args).length > 0 ? args : undefined
 				},
-				workspace: $workspaceStore!
+				workspace: $operatingWorkspace!
 			})
 			return true
 		} catch (error) {
@@ -94,7 +96,7 @@
 
 	async function getCaptureConfigs() {
 		const captureConfigsList = await CaptureService.getCaptureConfigs({
-			workspace: $workspaceStore!,
+			workspace: $operatingWorkspace!,
 			runnableKind: isFlow ? 'flow' : 'script',
 			path
 		})
@@ -123,7 +125,7 @@
 		while (captureActive) {
 			if (i % 3 === 0) {
 				await CaptureService.pingCaptureConfig({
-					workspace: $workspaceStore!,
+					workspace: $operatingWorkspace!,
 					triggerKind: captureType,
 					runnableKind: isFlow ? 'flow' : 'script',
 					path
diff --git a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
index 73d1220166..86c5ad74b8 100644
--- a/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
+++ b/frontend/src/lib/components/triggers/PermissionedAsLine.svelte
@@ -4,9 +4,12 @@
 		type OnBehalfOfDetails
 	} from '$lib/components/OnBehalfOfSelector.svelte'
 	import { useFolderDefaultPermissionedAs } from '$lib/components/useFolderDefaultPermissionedAs.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { userStore } from '$lib/stores'
 	import { AlertTriangle } from 'lucide-svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		/** Current permissioned_as value from the trigger (e.g., 'u/admin') */
@@ -22,11 +25,13 @@
 	}
 
 	let { permissionedAs, onPermissionedAsChange, path = undefined }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	const canPreserve = $derived(
-		$userStore?.is_admin || ($userStore?.groups ?? []).includes('wm_deployers')
+		actingUser?.is_admin || (actingUser?.groups ?? []).includes('wm_deployers')
 	)
 
 	const myPermissionedAs = $derived($userStore?.username ? `u/${$userStore.username}` : undefined)
diff --git a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
index 77a81ba432..f6d838be25 100644
--- a/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
+++ b/frontend/src/lib/components/triggers/TestTriggerConnection.svelte
@@ -10,10 +10,9 @@
 		WebsocketTriggerService,
 		GcpTriggerService
 	} from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import Button from '../common/button/Button.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		kind: 'websocket' | 'nats' | 'kafka' | 'postgres' | 'sqs' | 'mqtt' | 'amqp' | 'gcp'
@@ -23,8 +22,8 @@
 	}
 
 	let { kind, args, noButton = false, testLoading = $bindable(false) }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const kindToName: { [key: string]: string } = {
 		websocket: 'WebSocket',
diff --git a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
index 72f0d83fa0..ab8b850fa2 100644
--- a/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
+++ b/frontend/src/lib/components/triggers/TriggerEditorToolbar.svelte
@@ -13,7 +13,7 @@
 	import { stripBase, TRIGGER_PAGES, SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
 	import { pageDrawerSessionSource } from '../sessions/pageDrawerSession'
 	import { page } from '$app/state'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import TriggerHistoryButton from './TriggerHistoryButton.svelte'
 
 	interface Props {
@@ -62,6 +62,8 @@
 		triggerPath,
 		triggerKind
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const canSave = $derived((permissions === 'write' && edit) || permissions === 'create')
 
@@ -79,7 +81,7 @@
 			? pageDrawerSessionSource(
 					triggerPagePath,
 					trigger?.isDraft ? undefined : triggerPath || trigger?.path,
-					$workspaceStore ?? undefined
+					wsId ?? undefined
 				)
 			: undefined
 	)
diff --git a/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte b/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte
index f8bf4c7bb4..9f5d698f24 100644
--- a/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte
+++ b/frontend/src/lib/components/triggers/TriggerHistoryButton.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
 	import { History } from 'lucide-svelte'
 	import { TriggerService, type TriggerHistoryEntry } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import { displayDate } from '$lib/utils'
 	import Button from '../common/button/Button.svelte'
 	import Drawer from '../common/drawer/Drawer.svelte'
@@ -9,8 +8,8 @@
 	import Badge from '../common/badge/Badge.svelte'
 	import Skeleton from '../common/skeleton/Skeleton.svelte'
 	import TriggerHistoryChanges from './TriggerHistoryChanges.svelte'
-	import { getTriggerWorkspace } from './triggerWorkspace'
 	import type { TriggerType } from './utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		/** Trigger kind as the backend records it: `schedule`, `http`, `kafka`, … */
@@ -22,8 +21,8 @@
 
 	// An AI session can edit a trigger in a workspace that is not the nav one;
 	// the whole trigger subtree reads its workspace through this seam.
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let entries: TriggerHistoryEntry[] | undefined = $state(undefined)
diff --git a/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte b/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
index 98bff3c722..cc00e398ec 100644
--- a/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
+++ b/frontend/src/lib/components/triggers/TriggerSuspendedJobsModal.svelte
@@ -19,8 +19,6 @@
 		TriggerMode
 	} from '$lib/gen/types.gen'
 	import Button from '../common/button/Button.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { JobService, TriggerService } from '$lib/gen'
 	import { sendUserToast } from '$lib/toast'
 	import Cell from '$lib/components/table/Cell.svelte'
@@ -39,6 +37,7 @@
 		errorHandlerArgs,
 		slackErrorHandlerHubPathEnding
 	} from '../ErrorOrRecoveryHandler.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	type Props = {
 		triggerPath: string
@@ -49,8 +48,8 @@
 	}
 
 	let { triggerKind, triggerPath, onToggleMode, hasChanged, runnableConfig }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let shouldShowModal = $state(false)
 	let queuedJobs = $state<QueuedJob[]>([])
diff --git a/frontend/src/lib/components/triggers/TriggerTokens.svelte b/frontend/src/lib/components/triggers/TriggerTokens.svelte
index 044b89022a..e480480131 100644
--- a/frontend/src/lib/components/triggers/TriggerTokens.svelte
+++ b/frontend/src/lib/components/triggers/TriggerTokens.svelte
@@ -2,13 +2,13 @@
 	import { run } from 'svelte/legacy'
 
 	import { FlowService, ScriptService, UserService, type TruncatedToken } from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { userStore } from '$lib/stores'
 	import { getContext } from 'svelte'
 	import { Skeleton } from '../common'
 	import Label from '../Label.svelte'
 	import type { TriggerContext } from '../triggers'
 	import { capitalize } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		isFlow: boolean
@@ -17,8 +17,8 @@
 	}
 
 	let { isFlow, path, labelPrefix }: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const { triggersCount } = getContext<TriggerContext>('TriggerContext')
 
diff --git a/frontend/src/lib/components/triggers/TriggersEditor.svelte b/frontend/src/lib/components/triggers/TriggersEditor.svelte
index 4b7733ac33..ae32345907 100644
--- a/frontend/src/lib/components/triggers/TriggersEditor.svelte
+++ b/frontend/src/lib/components/triggers/TriggersEditor.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import FlowCard from '../flows/common/FlowCard.svelte'
 	import { getContext, onDestroy, createEventDispatcher } from 'svelte'
 	import type { TriggerContext } from '$lib/components/triggers'
@@ -38,6 +38,9 @@
 	import { sendUserToast } from '$lib/toast'
 	import Alert from '../common/alert/Alert.svelte'
 	import type { FlowEditorContext } from '../flows/types'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		noEditor: boolean
@@ -137,13 +140,13 @@
 		try {
 			if (nativeServiceName) {
 				await NativeTriggerService.deleteNativeTrigger({
-					workspace: $workspaceStore ?? '',
+					workspace: $operatingWorkspace ?? '',
 					serviceName: nativeServiceName,
 					externalId: triggerPath ?? ''
 				})
 			} else if (deleteHandler) {
 				await deleteHandler()({
-					workspace: $workspaceStore ?? '',
+					workspace: $operatingWorkspace ?? '',
 					path: triggerPath ?? ''
 				})
 			} else {
@@ -187,7 +190,7 @@
 		if (triggerType === 'schedule') {
 			await triggersState.fetchSchedules(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				undefined,
@@ -196,7 +199,7 @@
 		} else if (triggerType === 'websocket') {
 			await triggersState.fetchWebsocketTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -204,7 +207,7 @@
 		} else if (triggerType === 'postgres') {
 			await triggersState.fetchPostgresTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -212,7 +215,7 @@
 		} else if (triggerType === 'kafka') {
 			await triggersState.fetchKafkaTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -220,7 +223,7 @@
 		} else if (triggerType === 'nats') {
 			await triggersState.fetchNatsTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -228,7 +231,7 @@
 		} else if (triggerType === 'gcp') {
 			await triggersState.fetchGcpTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -236,7 +239,7 @@
 		} else if (triggerType === 'azure') {
 			await triggersState.fetchAzureTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -244,7 +247,7 @@
 		} else if (triggerType === 'sqs') {
 			await triggersState.fetchSqsTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -252,7 +255,7 @@
 		} else if (triggerType === 'mqtt') {
 			await triggersState.fetchMqttTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -260,7 +263,7 @@
 		} else if (triggerType === 'amqp') {
 			await triggersState.fetchAmqpTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -268,7 +271,7 @@
 		} else if (triggerType === 'http') {
 			await triggersState.fetchHttpTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -276,7 +279,7 @@
 		} else if (triggerType === 'email') {
 			await triggersState.fetchEmailTriggers(
 				triggersCount,
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -285,7 +288,7 @@
 			await triggersState.fetchNativeTriggers(
 				triggersCount,
 				'nextcloud',
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -294,7 +297,7 @@
 			await triggersState.fetchNativeTriggers(
 				triggersCount,
 				'google',
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
@@ -303,7 +306,7 @@
 			await triggersState.fetchNativeTriggers(
 				triggersCount,
 				'github',
-				$workspaceStore,
+				$operatingWorkspace,
 				currentPath,
 				isFlow,
 				$userStore
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
index 72b6f6360a..8e73e32d78 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpEditorConfigSection.svelte
@@ -13,8 +13,7 @@
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import TestingBadge from '../testingBadge.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		can_write?: boolean
@@ -36,8 +35,8 @@
 		showTestingBadge = false
 	}: Props = $props()
 
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	// Toggling the exchange binding on/off. Off means the queue is consumed
 	// directly with no exchange binding.
diff --git a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
index 9fb44491bb..7e3c2c5ac1 100644
--- a/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/amqp/AmqpTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { untrack } from 'svelte'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -10,8 +11,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -42,9 +42,17 @@
 	import { deepEqual } from 'fast-equals'
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -63,6 +71,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -78,8 +88,10 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let amqp_resource_path: string = $state('')
 	let drawer: Drawer | undefined = $state(undefined)
@@ -94,7 +106,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let queue_name: string = $state('')
@@ -158,6 +176,9 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.amqp.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -229,6 +250,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		try {
 			amqp_resource_path = cfg?.amqp_resource_path
 			queue_name = cfg?.queue_name ?? ''
@@ -240,7 +263,8 @@
 			is_flow = cfg?.is_flow
 			path = cfg?.path
 			mode = cfg?.mode ?? 'enabled'
-			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			permsPath = cfg?.path
+			permsForWrite = cfg?.extra_perms
 			error_handler_path = cfg?.error_handler_path
 			error_handler_args = cfg?.error_handler_args ?? {}
 			retry = cfg?.retry
@@ -397,36 +421,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit AMQP trigger ${initialPath}`
+				: `AMQP trigger ${initialPath}`
+			: 'New AMQP trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.amqp.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit AMQP trigger ${initialPath}`
-					: `AMQP trigger ${initialPath}`
-				: 'New AMQP trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'AMQP trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -523,7 +555,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					/>
 				</Section>
 			{/if}
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
index 992fab62b6..f6442d71ef 100644
--- a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorConfigSection.svelte
@@ -10,7 +10,7 @@
 	import type { AzureMode, AzureArmResource } from '$lib/gen'
 	import { AzureTriggerService } from '$lib/gen'
 	import { emptyStringTrimmed } from '$lib/utils'
-	import { workspaceStore } from '$lib/stores'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 	import { RefreshCw } from 'lucide-svelte'
 
 	interface Props {
@@ -38,6 +38,8 @@
 		event_type_filters = $bindable(),
 		path = ''
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	type Edition = 'basic' | 'namespace'
 	type Delivery = 'push' | 'pull'
@@ -64,8 +66,8 @@
 	})
 
 	$effect(() => {
-		if (emptyStringTrimmed(subscription_name) && !emptyStringTrimmed(path) && $workspaceStore) {
-			const generated = `windmill-${$workspaceStore}-${path.replaceAll(/[^A-Za-z0-9-]/g, '-')}`
+		if (emptyStringTrimmed(subscription_name) && !emptyStringTrimmed(path) && wsId) {
+			const generated = `windmill-${wsId}-${path.replaceAll(/[^A-Za-z0-9-]/g, '-')}`
 			subscription_name = generated.slice(0, 50)
 		}
 	})
@@ -90,7 +92,7 @@
 	let scopeError = $state<string | undefined>(undefined)
 
 	async function loadScopeResources() {
-		if (!$workspaceStore || emptyStringTrimmed(azure_resource_path)) {
+		if (!wsId || emptyStringTrimmed(azure_resource_path)) {
 			scopeResources = []
 			return
 		}
@@ -99,11 +101,11 @@
 		try {
 			const result = is_namespace
 				? await AzureTriggerService.listAzureNamespaces({
-						workspace: $workspaceStore,
+						workspace: wsId,
 						path: azure_resource_path
 					})
 				: await AzureTriggerService.listAzureBasicTopics({
-						workspace: $workspaceStore,
+						workspace: wsId,
 						path: azure_resource_path
 					})
 			scopeResources = result
@@ -143,7 +145,7 @@
 	async function loadTopics() {
 		if (
 			!is_namespace ||
-			!$workspaceStore ||
+			!wsId ||
 			emptyStringTrimmed(azure_resource_path) ||
 			emptyStringTrimmed(scope_resource_id)
 		) {
@@ -154,7 +156,7 @@
 		topicsError = undefined
 		try {
 			const result = await AzureTriggerService.listAzureNamespaceTopics({
-				workspace: $workspaceStore,
+				workspace: wsId,
 				path: azure_resource_path,
 				requestBody: { scope_resource_id }
 			})
diff --git a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
index e7063a92bb..697bc00ad4 100644
--- a/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/azure/AzureTriggerEditorInner.svelte
@@ -2,13 +2,14 @@
 	import { Alert, Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -39,6 +40,11 @@
 	import Tab from '$lib/components/common/tabs/Tab.svelte'
 	import TriggerRetriesAndErrorHandler from '../TriggerRetriesAndErrorHandler.svelte'
 	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let initialPath = $state('')
@@ -51,7 +57,15 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 
 	let azure_resource_path: string = $state('')
@@ -79,6 +93,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -95,6 +111,10 @@
 		cloudDisabled = false
 	}: {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -110,6 +130,9 @@
 		onReset?: () => void
 		cloudDisabled?: boolean
 	} = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let hasChanged = $derived(!deepEqual(getAzureConfig(), originalConfig ?? {}))
 	const azureConfig = $derived.by(getAzureConfig)
@@ -117,7 +140,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_azure',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => azureConfig,
 		applyCfg: loadTriggerConfig,
@@ -133,6 +156,9 @@
 		isFlow: boolean,
 		defaultValues?: Record<string, any>
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.azure.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -205,7 +231,7 @@
 		}
 		try {
 			const s = await AzureTriggerService.getAzureTrigger({
-				workspace: $workspaceStore!,
+				workspace: wsId!,
 				path: initialPath,
 				getDraft: true
 			})
@@ -224,6 +250,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		azure_resource_path = cfg?.azure_resource_path
@@ -234,7 +262,8 @@
 		event_type_filters = cfg?.event_type_filters
 		path = cfg?.path
 		mode = cfg?.mode ?? 'enabled'
-		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		permsPath = cfg?.path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -249,13 +278,7 @@
 		const previousPath = initialPath
 		const cfg = azureConfig
 		if (!cfg) return
-		const isSaved = await saveAzureTriggerFromCfg(
-			initialPath,
-			cfg,
-			edit,
-			$workspaceStore!,
-			usedTriggerKinds
-		)
+		const isSaved = await saveAzureTriggerFromCfg(initialPath, cfg, edit, wsId!, usedTriggerKinds)
 		if (isSaved) {
 			draftSync.discard(previousPath, getAzureConfig())
 			onUpdate?.(cfg.path)
@@ -309,7 +332,7 @@
 				(force) =>
 					AzureTriggerService.setAzureTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'Azure trigger'
@@ -353,36 +376,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit Azure trigger ${initialPath}`
+				: `Azure trigger ${initialPath}`
+			: 'New Azure trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.azure.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit Azure trigger ${initialPath}`
-					: `Azure trigger ${initialPath}`
-				: 'New Azure trigger'}
-			on:close={drawer?.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section
@@ -487,7 +518,7 @@
 							bind:itemKind
 							bind:scriptPath={script_path}
 							allowRefresh={can_write}
-							allowEdit={!$userStore?.operator}
+							allowEdit={!actingUser?.operator}
 							clearable
 						/>
 						{#if emptyString(script_path)}
@@ -496,7 +527,9 @@
 								variant="default"
 								unifiedSize="md"
 								disabled={!can_write}
-								href={itemKind === 'flow' ? '/flows/add?hub=81' : '/scripts/add?hub=hub%2F28214'}
+								href={operatingHref(
+									itemKind === 'flow' ? '/flows/add?hub=81' : '/scripts/add?hub=hub%2F28214'
+								)}
 								target="_blank">Create from template</Button
 							>
 						{/if}
diff --git a/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte b/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte
index 068df9d707..f3a480bf58 100644
--- a/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte
+++ b/frontend/src/lib/components/triggers/email/DefaultEmailCapture.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import Label from '$lib/components/Label.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { base32 } from 'rfc4648'
 	import ClipboardPanel from '../../details/ClipboardPanel.svelte'
 	import CaptureSection, { type CaptureInfo } from '../CaptureSection.svelte'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isFlow?: boolean
@@ -26,7 +28,7 @@
 
 	function getCaptureEmail() {
 		const cleanedPath = path.replaceAll('/', '.')
-		const plainPrefix = `capture+${$workspaceStore}+${(isFlow ? 'flow.' : '') + cleanedPath}`
+		const plainPrefix = `capture+${$operatingWorkspace}+${(isFlow ? 'flow.' : '') + cleanedPath}`
 		const encodedPrefix = base32
 			.stringify(new TextEncoder().encode(plainPrefix), {
 				pad: false
diff --git a/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte b/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte
index 0aebee6680..9e3c501ccd 100644
--- a/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/email/DefaultEmailConfigSection.svelte
@@ -3,7 +3,6 @@
 	import Label from '$lib/components/Label.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { AlertTriangle } from 'lucide-svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { SCRIPT_VIEW_SHOW_CREATE_TOKEN_BUTTON } from '$lib/consts'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
@@ -13,12 +12,16 @@
 	import { emptyString } from '$lib/utils'
 	import UserSettings from '$lib/components/UserSettings.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let requestType: 'runnableVersion' | 'path' = $state('path')
 
 	function emailAddress() {
-		const pathOrHash = requestType === 'runnableVersion' ? runnableVersion : path.replaceAll('/', '.')
-		const plainPrefix = `${$workspaceStore}+${
+		const pathOrHash =
+			requestType === 'runnableVersion' ? runnableVersion : path.replaceAll('/', '.')
+		const plainPrefix = `${$operatingWorkspace}+${
 			(requestType === 'runnableVersion' ? 'hash.' : isFlow ? 'flow.' : '') + pathOrHash
 		}+${token}`
 		const encodedPrefix = base32
diff --git a/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte b/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte
index e8c201ff63..2424301f3f 100644
--- a/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte
+++ b/frontend/src/lib/components/triggers/email/DefaultEmailPanel.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense, userStore } from '$lib/stores'
 	import UserSettings from '../../UserSettings.svelte'
 	import { generateRandomString } from '$lib/utils'
 	import HighlightTheme from '../../HighlightTheme.svelte'
@@ -10,6 +10,9 @@
 	import Section from '../../Section.svelte'
 	import DefaultEmailConfigSection from './DefaultEmailConfigSection.svelte'
 	import { getEmailDomain } from './utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	let userSettings: UserSettings | undefined = $state(undefined)
 	interface Props {
@@ -55,7 +58,7 @@
 		token = e.detail
 		triggerTokens?.listTokens()
 	}}
-	newTokenWorkspace={$workspaceStore}
+	newTokenWorkspace={$operatingWorkspace}
 	newTokenLabel={`email-${$userStore?.username ?? 'superadmin'}-${generateRandomString(4)}`}
 	{scopes}
 />
@@ -70,7 +73,14 @@
 		<Skeleton layout={[[18]]} />
 	{:else}
 		{#if emailDomain}
-			<DefaultEmailConfigSection {runnableVersion} {token} {path} {isFlow} {userSettings} {emailDomain} />
+			<DefaultEmailConfigSection
+				{runnableVersion}
+				{token}
+				{path}
+				{isFlow}
+				{userSettings}
+				{emailDomain}
+			/>
 		{:else}
 			<div>
 				<Alert title="Email triggers are disabled" size="xs" type="warning">
diff --git a/frontend/src/lib/components/triggers/email/EmailCapture.svelte b/frontend/src/lib/components/triggers/email/EmailCapture.svelte
index f77c15b5bd..8815439c13 100644
--- a/frontend/src/lib/components/triggers/email/EmailCapture.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailCapture.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import Label from '$lib/components/Label.svelte'
 	// import { page } from '$app/state'
 	import type { CaptureInfo } from '../CaptureSection.svelte'
 	import CaptureSection from '../CaptureSection.svelte'
 	import { fade } from 'svelte/transition'
 	import ClipboardPanel from '$lib/components/details/ClipboardPanel.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		local_part: string | undefined
@@ -27,7 +29,7 @@
 		captureLoading = false
 	}: Props = $props()
 
-	let captureEmail = $derived(`capture+${$workspaceStore}-${local_part}@${emailDomain}`)
+	let captureEmail = $derived(`capture+${$operatingWorkspace}-${local_part}@${emailDomain}`)
 </script>
 
 {#if captureInfo}
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
index 3a60d3be71..4a44e01b30 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorConfigSection.svelte
@@ -2,8 +2,6 @@
 	import { Alert } from '$lib/components/common'
 	import Required from '$lib/components/Required.svelte'
 	import Section from '$lib/components/Section.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	// import { page } from '$app/state'
 	import { getEmailAddress, getEmailDomain } from './utils'
 	import { isCloudHosted } from '$lib/cloud'
@@ -12,6 +10,10 @@
 	import { untrack } from 'svelte'
 	import { EmailTriggerService } from '$lib/gen'
 	import ClipboardPanel from '$lib/components/details/ClipboardPanel.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 	interface Props {
 		initialTriggerPath?: string | undefined
 		dirtyLocalPart?: boolean
@@ -35,8 +37,10 @@
 		isDraftOnly = true,
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let validateTimeout: number | undefined = undefined
 
@@ -95,7 +99,7 @@
 		local_part === undefined && (local_part = '')
 	})
 
-	let userIsAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	let userIsAdmin = $derived(actingUser?.is_admin || actingUser?.is_super_admin)
 	let userCanEditConfig = $derived(userIsAdmin || isDraftOnly) // User can edit config if they are admin or if the trigger is a draft which will not be saved
 </script>
 
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
index d2133cf865..30f848004f 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -17,8 +18,7 @@
 		type Retry,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -38,9 +38,16 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		hideTarget = false,
 		description = undefined,
 		isEditor = false,
@@ -55,8 +62,11 @@
 		trigger = undefined,
 		customSaveBehavior = undefined
 	} = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	// Form data state
 	let initialPath = $state('')
@@ -75,7 +85,13 @@
 	let workspaced_local_part = $state(false)
 	let drawerLoading = $state(true)
 	let showLoader = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let extraPerms = $state<Record<string, boolean> | undefined>(undefined)
 	let error_handler_path: string | undefined = $state()
 	let error_handler_args: Record<string, any> = $state({})
@@ -95,7 +111,7 @@
 	let originalConfig = $state<NewEmailTrigger | undefined>(undefined)
 
 	let hasChanged = $derived(!deepEqual(getEmailTriggerConfig(), originalConfig ?? {}))
-	const isAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	const isAdmin = $derived(actingUser?.is_admin || actingUser?.is_super_admin)
 	const emailConfig = $derived.by(getEmailTriggerConfig)
 
 	const draftSync = useTriggerDraftSync({
@@ -127,6 +143,9 @@
 		defaultConfig?: Partial<NewEmailTrigger>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.email.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -206,6 +225,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Partial<EmailTrigger>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path ?? ''
 		initialScriptPath = cfg?.script_path ?? ''
 		is_flow = cfg?.is_flow ?? false
@@ -213,7 +234,8 @@
 		local_part = cfg?.local_part ?? ''
 		workspaced_local_part = cfg?.workspaced_local_part ?? false
 		extraPerms = cfg?.extra_perms ?? undefined
-		can_write = canWrite(path, cfg?.extra_perms ?? {}, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms ?? {}
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -265,7 +287,7 @@
 				saveCfg,
 				edit,
 				wsId!,
-				!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+				!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 				usedTriggerKinds
 			)
 			if (isSaved) {
@@ -405,7 +427,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptClass="text-xs mt-3 mb-1 text-primary"
 					>
 						{#snippet createButton()}
@@ -414,7 +436,9 @@
 									btnClasses="ml-4"
 									variant="accent"
 									size="xs"
-									href={itemKind === 'flow' ? '/flows/add?hub=72' : '/scripts/add?hub=hub%2F19813'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=72' : '/scripts/add?hub=hub%2F19813'
+									)}
 									target="_blank">Create from template</Button
 								>
 							{/if}
@@ -486,36 +510,44 @@
 	{/if}
 {/snippet}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit email trigger ${initialPath}`
+				: `Email trigger ${initialPath}`
+			: 'New email trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render saveButton()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="700px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.email.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit email trigger ${initialPath}`
-					: `Email trigger ${initialPath}`
-				: 'New email trigger'}
-			on:close={() => drawer?.closeDrawer()}
-		>
-			{#snippet actions()}
-				{@render saveButton()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Email trigger' : ''} headerClass="grow min-w-0 h-[30px]">
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte
index 12ec403aeb..7eac6a8971 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerPanel.svelte
@@ -1,11 +1,15 @@
 <script lang="ts">
 	import EmailTriggerEditorInner from './EmailTriggerEditorInner.svelte'
 	import Description from '$lib/components/Description.svelte'
-	import { enterpriseLicense, userStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { Alert } from '$lib/components/common'
 	import { onMount, type Snippet } from 'svelte'
 	import { getEmailDomain } from './utils'
 	import type { Trigger } from '../utils'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let emailTriggerEditor = $state<EmailTriggerEditorInner | null>(null)
 
@@ -73,7 +77,7 @@
 				trigger can be configured with a specific local part.
 			</Description>
 
-			{#if !$userStore?.is_admin && !$userStore?.is_super_admin && selectedTrigger.isDraft}
+			{#if !actingUser?.is_admin && !actingUser?.is_super_admin && selectedTrigger.isDraft}
 				<Alert title="Only workspace admins can create email triggers" type="info" size="xs" />
 			{/if}
 
diff --git a/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte b/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
index 7538026782..a77d12ebef 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpCapture.svelte
@@ -1,10 +1,12 @@
 <script lang="ts">
 	import type { CaptureInfo } from '../CaptureSection.svelte'
 	import CaptureSection from '../CaptureSection.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
 	import { base } from '$lib/base'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		captureInfo?: CaptureInfo | undefined
@@ -30,7 +32,7 @@
 		if (!captureInfo) {
 			return
 		}
-		return `${window.location.origin}${base}/api/w/${$workspaceStore}/capture_u/gcp/${
+		return `${window.location.origin}${base}/api/w/${$operatingWorkspace}/capture_u/gcp/${
 			captureInfo.isFlow ? 'flow' : 'script'
 		}/${captureInfo.path}`
 	}
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
index 591de38b3b..ade1de1f70 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorConfigSection.svelte
@@ -15,8 +15,6 @@
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import { base } from '$lib/base'
 	import Toggle from '$lib/components/Toggle.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 
 	import { Button, Url } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -25,11 +23,17 @@
 	import TestingBadge from '../testingBadge.svelte'
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	// Declared before `DEFAULT_PUSH_CONFIG` / the `base_endpoint` prop default,
 	// which call `getBaseUrl()` (a `wsId` reader) during component init.
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let topic_items: string[] = $state([])
 	let subscription_items: string[] = $state([])
@@ -152,14 +156,14 @@
 	// Keyed on the loaded mode, not the live one: reading the live mode would make the toggle a
 	// one-way door, disabling itself the moment a non-admin switched an inherited ADC trigger away.
 	const canUseDefaultCredentials = $derived(
-		$userStore?.is_admin === true || loaded_uses_default_credentials
+		actingUser?.is_admin === true || loaded_uses_default_credentials
 	)
 	const hasCredentials = $derived(usesDefaultCredentials || !emptyStringTrimmed(gcp_resource_path))
 	/** Saving re-provisions the subscription with the instance's credentials, so the backend runs
 	 * the admin check on every write, not only when the mode is switched. A non-admin who inherits
 	 * such a trigger can open it, so say why saving is unavailable instead of letting them hit a
 	 * bare 403. */
-	const blockedByAdminGate = $derived(usesDefaultCredentials && $userStore?.is_admin !== true)
+	const blockedByAdminGate = $derived(usesDefaultCredentials && actingUser?.is_admin !== true)
 
 	// One-shot on mount, so read the props rather than the derived: referencing `$derived` state
 	// here captures its initial value anyway, and Svelte warns about it.
@@ -274,7 +278,10 @@
 							     travel as `?project_id=`, dirty the config, and reach the column as a
 							     value `empty_as_none` does not trim away. -->
 							<TextInput
-								bind:value={() => project_id ?? '', (v) => (project_id = emptyStringTrimmed(v) ? undefined : v)}
+								bind:value={
+									() => project_id ?? '',
+									(v) => (project_id = emptyStringTrimmed(v) ? undefined : v)
+								}
 								inputProps={{
 									placeholder: 'my-gcp-project',
 									disabled: !can_write,
diff --git a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
index 3c63d79e12..92902aa44b 100644
--- a/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/gcp/GcpTriggerEditorInner.svelte
@@ -2,14 +2,14 @@
 	import { Alert, Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -43,6 +43,11 @@
 	import TriggerAdvancedBadges from '../TriggerAdvancedBadges.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let initialPath = $state('')
@@ -56,7 +61,15 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let topic_id: string = $state('')
 	let gcp_resource_path: string | undefined = $state('')
@@ -90,6 +103,8 @@
 	let loadedUsesDefaultCredentials = $state(false)
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -106,6 +121,10 @@
 		cloudDisabled = false
 	}: {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -121,8 +140,9 @@
 		onReset?: () => void
 		cloudDisabled?: boolean
 	} = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let hasChanged = $derived(!deepEqual(getGcpConfig(), originalConfig ?? {}))
 	const gcpConfig = $derived.by(getGcpConfig)
@@ -147,6 +167,9 @@
 		defaultValues?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.gcp.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		try {
 			drawer?.openDrawer()
@@ -254,6 +277,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		gcp_resource_path = cfg?.gcp_resource_path ?? undefined
@@ -267,7 +292,8 @@
 		path = cfg?.path
 		mode = cfg?.mode ?? 'enabled'
 		topic_id = cfg?.topic_id ?? ''
-		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		permsPath = cfg?.path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -405,36 +431,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit GCP Pub/Sub trigger ${initialPath}`
+				: `GCP Pub/Sub trigger ${initialPath}`
+			: 'New GCP Pub/Sub trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.gcp.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit GCP Pub/Sub trigger ${initialPath}`
-					: `GCP Pub/Sub trigger ${initialPath}`
-				: 'New GCP Pub/Sub trigger'}
-			on:close={drawer?.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'GCP Pub/Sub trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -532,7 +566,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptText="Pick a script or flow to be triggered "
 					>
 						{#snippet createButton()}
@@ -542,7 +576,9 @@
 									variant="default"
 									unifiedSize="md"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=68' : '/scripts/add?hub=hub%2F19796'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=68' : '/scripts/add?hub=hub%2F19796'
+									)}
 									target="_blank">Create from template</Button
 								>
 							{/if}
diff --git a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
index fd66b449d0..b0cc491393 100644
--- a/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/OpenAPISpecGenerator.svelte
@@ -11,7 +11,7 @@
 		type OpenapiV3Info,
 		type WebhookFilters
 	} from '$lib/gen'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import SimpleEditor from '$lib/components/SimpleEditor.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
@@ -35,6 +35,9 @@
 	import CreateToken from '$lib/components/settings/CreateToken.svelte'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type HttpRouteAndWebhook = WebhookFilters | OpenapiHttpRouteFilters
 
@@ -148,7 +151,7 @@
 			const info = buildInfo()
 			isGeneratingOpenapiSpec = true
 			openapiDocument = await OpenapiService.generateOpenapiSpec({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				requestBody: {
 					openapi_spec_format,
 					info,
@@ -222,7 +225,7 @@
 				{/snippet}
 				<CopyableCodeBlock
 					code={`token=${emptyString(token) ? '' : token}; \\
-curl -X POST "${window.location.origin}${base}/api/w/${$workspaceStore!}/openapi/generate" \\
+curl -X POST "${window.location.origin}${base}/api/w/${$operatingWorkspace!}/openapi/generate" \\
 -H "Authorization: Bearer $token" \\
 -H "Content-Type: application/json" \\
 -d '${JSON.stringify(obj)}'`}
diff --git a/frontend/src/lib/components/triggers/http/RouteCapture.svelte b/frontend/src/lib/components/triggers/http/RouteCapture.svelte
index b1024573c9..5cbe3570dc 100644
--- a/frontend/src/lib/components/triggers/http/RouteCapture.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteCapture.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-	import { workspaceStore } from '$lib/stores'
 	import Label from '$lib/components/Label.svelte'
 	import CopyableCodeBlock from '$lib/components/details/CopyableCodeBlock.svelte'
 	import { bash } from 'svelte-highlight/languages'
@@ -10,6 +9,7 @@
 	import { isObject } from '$lib/utils'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		route_path: string | undefined
@@ -32,9 +32,11 @@
 		isFlow = false,
 		captureLoading = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let captureURL = $derived(
-		`${location.origin}${base}/api/w/${$workspaceStore}/capture_u/http/${
+		`${location.origin}${base}/api/w/${wsId}/capture_u/http/${
 			captureInfo?.isFlow ? 'flow' : 'script'
 		}/${captureInfo?.path.replaceAll('/', '.')}/${route_path ?? ''}`
 	)
diff --git a/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte b/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte
index 50b09a108d..eb371fbc73 100644
--- a/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteCorsOption.svelte
@@ -47,7 +47,9 @@
 	// Advisory: the value saves either way, so this only points out an entry
 	// that could never match rather than deciding what a browser may send.
 	let warning = $derived(
-		restricted ? origins.map(allowedOriginWarning).find((message) => message !== undefined) : undefined
+		restricted
+			? origins.map(allowedOriginWarning).find((message) => message !== undefined)
+			: undefined
 	)
 
 	// While the toggle is on, whatever is typed is what gets saved. A rejected
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte b/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte
index 2365e1353c..b019b2f15b 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorConfigSection.svelte
@@ -4,7 +4,6 @@
 	import Section from '$lib/components/Section.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
 	import { HttpTriggerService, SettingService } from '$lib/gen'
 	// import { page } from '$app/state'
 	import { getHttpRoute } from './utils'
@@ -13,6 +12,10 @@
 	import TestingBadge from '../testingBadge.svelte'
 	import { untrack } from 'svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		initialTriggerPath?: string | undefined
@@ -41,6 +44,10 @@
 		isDraftOnly = true,
 		showTestingBadge = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const wsId = $derived($operatingWorkspace)
 
 	let validateTimeout: number | undefined = undefined
 
@@ -74,7 +81,7 @@
 		workspaced_route: boolean
 	) {
 		return await HttpTriggerService.existsRoute({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			requestBody: {
 				route_path,
 				http_method: method,
@@ -95,7 +102,7 @@
 		isValid = routeError === ''
 	})
 
-	let fullRoute = $derived(getHttpRoute('r', route_path, workspaced_route, $workspaceStore ?? ''))
+	let fullRoute = $derived(getHttpRoute('r', route_path, workspaced_route, wsId ?? ''))
 
 	$effect.pre(() => {
 		!http_method && (http_method = 'post')
@@ -104,7 +111,11 @@
 		route_path === undefined && (route_path = '')
 	})
 
-	let userIsAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
+	// Unknown until the acting user resolves: forcing the prefix on an admin meanwhile would
+	// silently save a workspace-prefixed route they never chose.
+	let userIsAdmin = $derived(
+		operatingUser.resolved(wsId) ? actingUser?.is_admin || actingUser?.is_super_admin : undefined
+	)
 
 	let globalHttpWorkspacedRoute = $state(false)
 
@@ -127,7 +138,10 @@
 		// Existing non-workspaced triggers created by admins can still be edited by non-admins
 		// (with restricted fields), so we don't override their workspaced_route value.
 		const isNewTrigger = !initialTriggerPath
-		if ((globalHttpWorkspacedRoute || (!userIsAdmin && isNewTrigger)) && !workspaced_route) {
+		if (
+			(globalHttpWorkspacedRoute || (userIsAdmin === false && isNewTrigger)) &&
+			!workspaced_route
+		) {
 			workspaced_route = true
 			dirtyRoutePath = true
 		}
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
index eb046f380e..2b28ae0d8d 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -21,7 +22,7 @@
 		type Retry,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import {
 		canWrite,
 		capitalize,
@@ -76,9 +77,16 @@
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
 	import UserSettings from '$lib/components/UserSettings.svelte'
 	import Tooltip from '$lib/components/Tooltip.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		hideTarget = false,
 		description = undefined,
 		isEditor = false,
@@ -93,6 +101,11 @@
 		trigger = undefined,
 		customSaveBehavior = undefined
 	} = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	// Form data state
 	let initialPath = $state('')
@@ -146,7 +159,13 @@
 	let authentication_resource_path = $state('')
 	let variable_path = $state('')
 	let signature_options_type = $state<'custom_script' | 'custom_signature'>('custom_signature')
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let extraPerms = $state<Record<string, boolean> | undefined>(undefined)
 	let summary: string | undefined = $state()
 	let routeDescription: string | undefined = $state()
@@ -179,7 +198,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_http',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => routeConfig,
 		applyCfg: (c) => loadTriggerConfig(c as Partial<HttpTrigger>),
@@ -215,7 +234,7 @@
 	}
 
 	async function loadVariables() {
-		return await VariableService.listVariable({ workspace: $workspaceStore ?? '' })
+		return await VariableService.listVariable({ workspace: wsId ?? '' })
 	}
 
 	const authentication_options: AuthenticationOption[] = [
@@ -255,6 +274,9 @@
 		isFlow: boolean,
 		defaultConfig?: Partial<NewHttpTrigger>
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.http.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		drawerLoading = true
 		let loader = setTimeout(() => {
 			showLoader = true
@@ -346,6 +368,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Partial<HttpTrigger>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path ?? ''
 		initialScriptPath = cfg?.script_path ?? ''
 		is_flow = cfg?.is_flow ?? false
@@ -374,7 +398,8 @@
 			is_static_website = cfg?.is_static_website ?? false
 		}
 		extraPerms = cfg?.extra_perms ?? undefined
-		can_write = canWrite(path, cfg?.extra_perms ?? {}, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms ?? {}
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -393,7 +418,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await HttpTriggerService.getHttpTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -419,8 +444,8 @@
 				initialPath,
 				saveCfg,
 				edit,
-				$workspaceStore!,
-				!!$userStore?.is_admin || !!$userStore?.is_super_admin,
+				wsId!,
+				!!actingUser?.is_admin || !!actingUser?.is_super_admin,
 				usedTriggerKinds
 			)
 			if (isSaved) {
@@ -482,7 +507,7 @@
 			// and parent live at distinct URLs — no fork-conflict warning.
 			await HttpTriggerService.setHttpTriggerMode({
 				path: initialPath,
-				workspace: $workspaceStore ?? '',
+				workspace: wsId ?? '',
 				requestBody: { mode: newMode }
 			})
 			sendUserToast(`${capitalize(newMode)} HTTP trigger ${initialPath}`)
@@ -535,8 +560,8 @@
 {#if authentication_method === 'windmill'}
 	<UserSettings
 		bind:this={userSettings}
-		newTokenWorkspace={$workspaceStore}
-		newTokenLabel={`http-${$userStore?.username ?? 'superadmin'}-${generateRandomString(4)}`}
+		newTokenWorkspace={wsId}
+		newTokenLabel={`http-${actingUser?.username ?? 'superadmin'}-${generateRandomString(4)}`}
 		{scopes}
 	/>
 {/if}
@@ -747,7 +772,7 @@
 										bind:itemKind
 										bind:scriptPath={script_path}
 										allowRefresh={can_write}
-										allowEdit={!$userStore?.operator}
+										allowEdit={!actingUser?.operator}
 										clearable
 									/>
 
@@ -755,9 +780,9 @@
 										<Button
 											variant="default"
 											size="lg"
-											href={itemKind === 'flow'
-												? '/flows/add?hub=62'
-												: '/scripts/add?hub=hub%2F19669'}
+											href={operatingHref(
+												itemKind === 'flow' ? '/flows/add?hub=62' : '/scripts/add?hub=hub%2F19669'
+											)}
 											target="_blank">Create from template</Button
 										>
 									{/if}
@@ -967,13 +992,11 @@
 														disabled={emptyString(variable_path) || !can_write}
 														variant="default"
 														size="xs"
-														href={itemKind === 'flow'
-															? `/flows/add?${SECRET_KEY_PATH}=${encodeURIComponent(variable_path)}&hub=${
-																	HubFlow.SIGNATURE_TEMPLATE
-																}`
-															: `/scripts/add?${SECRET_KEY_PATH}=${encodeURIComponent(
-																	variable_path
-																)}&hub=hub%2F${HUB_SCRIPT_ID}`}
+														href={operatingHref(
+															itemKind === 'flow'
+																? `/flows/add?${SECRET_KEY_PATH}=${encodeURIComponent(variable_path)}&hub=${HubFlow.SIGNATURE_TEMPLATE}`
+																: `/scripts/add?${SECRET_KEY_PATH}=${encodeURIComponent(variable_path)}&hub=hub%2F${HUB_SCRIPT_ID}`
+														)}
 														target="_blank">Create from template</Button
 													>
 												</div>
@@ -1057,36 +1080,40 @@
 	{/if}
 {/snippet}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit ? (can_write ? `Edit route ${initialPath}` : `Route ${initialPath}`) : 'New route'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render saveButton()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="700px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.http.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit route ${initialPath}`
-					: `Route ${initialPath}`
-				: 'New route'}
-			on:close={() => drawer?.closeDrawer()}
-		>
-			{#snippet actions()}
-				{@render saveButton()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'HTTP Route' : ''} headerClass="grow min-w-0 h-[30px]">
diff --git a/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte b/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
index 5c01c84918..91b2ee7e9e 100644
--- a/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
+++ b/frontend/src/lib/components/triggers/http/RoutesGenerator.svelte
@@ -16,13 +16,16 @@
 	import RouteEditor from './RouteEditor.svelte'
 	import { generateHttpTriggerFromOpenApi, type Source } from './utils'
 	import { isCloudHosted } from '$lib/cloud'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds, userStore } from '$lib/stores'
 	import FileInput from '../../common/fileInput/FileInput.svelte'
 	import { emptyStringTrimmed, sendUserToast } from '$lib/utils'
 	import FolderPicker from '../../FolderPicker.svelte'
 	import Required from '$lib/components/Required.svelte'
 	import { Drawer, DrawerContent } from '$lib/components/common'
 	import { get } from 'svelte/store'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type Props = {
 		closeFn: () => Promise<void>
@@ -108,7 +111,7 @@
 		try {
 			isCreating = true
 			const message = await HttpTriggerService.createHttpTriggers({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				requestBody: httpTriggers
 			})
 			sendUserToast(message)
@@ -314,7 +317,7 @@
 									<div class="text-primary">
 										{httpTrigger.http_method.toUpperCase()}
 										{isCloudHosted() || httpTrigger.workspaced_route || globalHttpWorkspacedRoute
-											? $workspaceStore! + '/' + httpTrigger.route_path
+											? $operatingWorkspace! + '/' + httpTrigger.route_path
 											: httpTrigger.route_path}
 									</div>
 									<div class="text-secondary text-xs truncate text-left font-light">
diff --git a/frontend/src/lib/components/triggers/http/RoutesPanel.svelte b/frontend/src/lib/components/triggers/http/RoutesPanel.svelte
index 4e827cd6c1..edda2aee47 100644
--- a/frontend/src/lib/components/triggers/http/RoutesPanel.svelte
+++ b/frontend/src/lib/components/triggers/http/RoutesPanel.svelte
@@ -1,9 +1,12 @@
 <script lang="ts">
 	import RouteEditorInner from './RouteEditorInner.svelte'
 	import Description from '$lib/components/Description.svelte'
-	import { userStore } from '$lib/stores'
 	import { Alert } from '$lib/components/common'
 	import { onMount } from 'svelte'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let routeEditor = $state<RouteEditorInner | null>(null)
 	let {
@@ -48,7 +51,7 @@
 				specific HTTP method and path.</Description
 			>
 
-			{#if !$userStore?.is_admin && !$userStore?.is_super_admin && selectedTrigger.isDraft}
+			{#if !actingUser?.is_admin && !actingUser?.is_super_admin && selectedTrigger.isDraft}
 				<Alert title="Non-admin users are limited to workspaced routes" type="info" size="xs" />
 			{/if}
 		</div>
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
index cd33bfb450..3fb5668f44 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Alert, Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -11,8 +12,7 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { KafkaTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -37,9 +37,18 @@
 	import type { FilterNode } from '../filters'
 	import Select from '$lib/components/select/Select.svelte'
 	import Toggle from '$lib/components/Toggle.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -58,6 +67,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -73,8 +84,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let is_flow: boolean = $state(false)
@@ -88,7 +102,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let initialConfig: Record<string, any> | undefined = undefined
@@ -158,6 +178,9 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.kafka.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -236,6 +259,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Record<string, any>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -249,7 +274,8 @@
 		autoCommit = cfg?.auto_commit ?? true
 		mode = cfg?.mode ?? 'enabled'
 		extra_perms = cfg?.extra_perms
-		can_write = canWrite(path, cfg?.extra_perms, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -417,36 +443,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit Kafka trigger ${initialPath}`
+				: `Kafka trigger ${initialPath}`
+			: 'New Kafka trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons('sm')}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.kafka.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit Kafka trigger ${initialPath}`
-					: `Kafka trigger ${initialPath}`
-				: 'New Kafka trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons('sm')}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Kafka trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -543,7 +577,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					>
 						{#snippet createButton()}
 							{#if emptyString(script_path)}
@@ -552,7 +586,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=65' : '/scripts/add?hub=hub%2F19659'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=65' : '/scripts/add?hub=hub%2F19659'
+									)}
 									target="_blank">Create from template</Button
 								>
 							{/if}
diff --git a/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
index 4cf4225fd9..c6e5c56c74 100644
--- a/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/kafka/KafkaTriggersConfigSection.svelte
@@ -3,11 +3,10 @@
 	import Section from '$lib/components/Section.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
 	import SchemaForm from '../../SchemaForm.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '../testingBadge.svelte'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		path: string
@@ -26,8 +25,8 @@
 		can_write = true,
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const kafkaConfigSchema = {
 		$schema: 'http://json-schema.org/draft-07/schema#',
@@ -103,7 +102,6 @@
 					/>
 				</Subsection>
 			</div>
-
 		</div>
 	</Section>
 </div>
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
index 0381417c03..4f31a9c891 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttEditorConfigSection.svelte
@@ -16,8 +16,7 @@
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import TestingBadge from '../testingBadge.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		can_write?: boolean
@@ -39,8 +38,8 @@
 		showTestingBadge = false
 	}: Props = $props()
 
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const isValidSubscribeTopics = (subscribe_topics: MqttSubscribeTopic[]): boolean => {
 		if (
diff --git a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
index f25e841fc1..f3a42f0d49 100644
--- a/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/mqtt/MqttTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { untrack } from 'svelte'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -10,8 +11,7 @@
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -46,9 +46,18 @@
 	import { deepEqual } from 'fast-equals'
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -67,6 +76,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -82,8 +93,11 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let mqtt_resource_path: string = $state('')
 	let drawer: Drawer | undefined = $state(undefined)
@@ -98,7 +112,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let subscribe_topics: MqttSubscribeTopic[] = $state([])
@@ -153,6 +173,9 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.mqtt.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -232,6 +255,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		try {
 			mqtt_resource_path = cfg?.mqtt_resource_path
 			subscribe_topics = cfg?.subscribe_topics
@@ -244,7 +269,8 @@
 			v3_config = cfg?.v3_config ?? DEFAULT_V3_CONFIG
 			v5_config = cfg?.v5_config ?? DEFAULT_V5_CONFIG
 			client_id = cfg?.client_id ?? ''
-			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			permsPath = cfg?.path
+			permsForWrite = cfg?.extra_perms
 			error_handler_path = cfg?.error_handler_path
 			error_handler_args = cfg?.error_handler_args ?? {}
 			retry = cfg?.retry
@@ -391,36 +417,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit MQTT trigger ${initialPath}`
+				: `MQTT trigger ${initialPath}`
+			: 'New MQTT trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.mqtt.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit MQTT trigger ${initialPath}`
-					: `MQTT trigger ${initialPath}`
-				: 'New MQTT trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'MQTT trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -517,7 +551,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					>
 						{#snippet createButton()}
 							{#if emptyString(script_path)}
@@ -526,7 +560,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=61' : '/scripts/add?hub=hub%2F19655'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=61' : '/scripts/add?hub=hub%2F19655'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
index b7bf3fa567..677bfe857c 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerEditor.svelte
@@ -8,7 +8,7 @@
 		getTemplatePath,
 		saveNativeTriggerFromCfg
 	} from './utils'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, emptyString, sendUserToast } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
@@ -27,6 +27,14 @@
 	import { deepEqual } from 'fast-equals'
 	import type { Snippet } from 'svelte'
 	import Alert from '$lib/components/common/alert/Alert.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
 		service: NativeServiceName
@@ -102,7 +110,15 @@
 	let isFlow = $state(false)
 	let summary = $state('')
 	let externalId = $state<string | null>(null)
-	let can_write = $state(true)
+	let permsScriptPath = $state<string | undefined>(undefined)
+	// A verdict that does not come from a loaded trigger: a new one is writable, and a trigger
+	// that failed to load is not.
+	let writeVerdict = $state<boolean | undefined>(undefined)
+	// Derived, not snapshotted at load: the acting user's role arrives on its own schedule, and
+	// a trigger that loaded first would otherwise stay read-only until reopened.
+	const can_write = $derived(
+		writeVerdict ?? (permsScriptPath === undefined || canWrite(permsScriptPath, {}, actingUser))
+	)
 	let originalConfig = $state<Record<string, any> | undefined>(undefined)
 	let initialConfig = $state<Record<string, any> | undefined>(undefined)
 	let loadError = $state<string | undefined>(undefined)
@@ -131,7 +147,8 @@
 		externalId = null
 		loadingConfig = false
 		loadingForm = false
-		can_write = true
+		writeVerdict = true
+		permsScriptPath = undefined
 		originalConfig = undefined
 		initialConfig = undefined
 		summary = ''
@@ -159,7 +176,8 @@
 		externalId = null
 		loadingConfig = false
 		loadingForm = false
-		can_write = true
+		writeVerdict = true
+		permsScriptPath = undefined
 		originalConfig = undefined
 		initialConfig = undefined
 		summary = nativeTrigger.summary ?? ''
@@ -204,7 +222,7 @@
 
 		try {
 			const fullTrigger = await NativeTriggerService.getNativeTrigger({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId: externalIdOrPath
 			})
@@ -212,7 +230,8 @@
 			serviceConfig = (fullTrigger.service_config as Record<string, any>) || {}
 			scriptPath = fullTrigger.script_path
 			initialScriptPath = fullTrigger.script_path
-			can_write = canWrite(fullTrigger.script_path, {}, $userStore)
+			permsScriptPath = fullTrigger.script_path
+			writeVerdict = undefined
 			summary = fullTrigger.summary ?? ''
 			externalData = fullTrigger.external_data
 			externalError = fullTrigger.external_error ?? undefined
@@ -230,7 +249,7 @@
 			// The service form is not rendered in the error state, so nothing else will ever
 			// clear its loading flag or narrow the permission left over from the last trigger.
 			loadingForm = false
-			can_write = false
+			writeVerdict = false
 			retryEdit = () => openEdit(externalIdOrPath, nis_flow, defaultValues)
 		} finally {
 			clearTimeout(loadingTimeout)
@@ -308,7 +327,7 @@
 		enabled = next
 		try {
 			await NativeTriggerService.setNativeTriggerEnabled({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId,
 				requestBody: { enabled: next }
@@ -335,7 +354,7 @@
 			// before anything can pause it again.
 			isRecreate ? { ...saveCfg, enabled } : saveCfg,
 			!isNew,
-			$workspaceStore!,
+			$operatingWorkspace!,
 			usedTriggerKinds
 		)
 		if (newExternalId) {
@@ -345,7 +364,7 @@
 				if (isRecreate && oldExternalIdToDelete) {
 					try {
 						await NativeTriggerService.deleteNativeTrigger({
-							workspace: $workspaceStore!,
+							workspace: $operatingWorkspace!,
 							serviceName: service,
 							externalId: oldExternalIdToDelete
 						})
@@ -515,7 +534,7 @@
 							bind:itemKind
 							kinds={['script']}
 							allowFlow={true}
-							allowEdit={!$userStore?.operator}
+							allowEdit={!actingUser?.operator}
 							clearable
 						/>
 						{#if emptyString(scriptPath)}
diff --git a/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte b/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
index 6f28875b17..098cc18ce3 100644
--- a/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
+++ b/frontend/src/lib/components/triggers/native/NativeTriggerTable.svelte
@@ -4,7 +4,7 @@
 	import type { ExtendedNativeTrigger } from './utils'
 	import { getServiceConfig } from './utils'
 	import { canWrite, sendUserToast } from '$lib/utils'
-	import { userStore, workspaceStore } from '$lib/stores'
+	import { userStore } from '$lib/stores'
 	import TriggerModeToggle from '$lib/components/triggers/TriggerModeToggle.svelte'
 	import Skeleton from '$lib/components/common/skeleton/Skeleton.svelte'
 	import Button from '$lib/components/common/button/Button.svelte'
@@ -16,6 +16,9 @@
 	import Alert from '$lib/components/common/alert/Alert.svelte'
 	import GoogleDriveIcon from '$lib/components/icons/GoogleDriveIcon.svelte'
 	import GoogleCalendarIcon from '$lib/components/icons/GoogleCalendarIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	type TriggerW = ExtendedNativeTrigger & { marked?: any }
 
@@ -51,7 +54,7 @@
 		const enabled = mode === 'enabled'
 		try {
 			await NativeTriggerService.setNativeTriggerEnabled({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId: trigger.external_id,
 				requestBody: { enabled }
@@ -76,7 +79,7 @@
 		isDeleting = true
 		try {
 			await NativeTriggerService.deleteNativeTrigger({
-				workspace: $workspaceStore!,
+				workspace: $operatingWorkspace!,
 				serviceName: service,
 				externalId: triggerToDelete.external_id
 			})
diff --git a/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte b/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte
index 5e31dfc33c..27add7f797 100644
--- a/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte
+++ b/frontend/src/lib/components/triggers/native/services/github/GitHubTriggerForm.svelte
@@ -4,9 +4,11 @@
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { GithubRepoEntry } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { Loader2 } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		serviceConfig: Record<string, any>
@@ -57,14 +59,14 @@
 	let selectedEvents = $state<string[]>(externalData?.events ?? serviceConfig.events ?? ['push'])
 
 	async function loadRepos() {
-		if (!$workspaceStore) {
+		if (!$operatingWorkspace) {
 			repos = []
 			return
 		}
 		loading = true
 		try {
 			repos = await NativeTriggerService.listGithubRepos({
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 		} catch (err: any) {
 			console.error('Failed to load GitHub repositories:', err)
@@ -76,7 +78,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			loadRepos()
 		}
 	})
diff --git a/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte b/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte
index 98c23f8755..f4c6d9894b 100644
--- a/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte
+++ b/frontend/src/lib/components/triggers/native/services/google/GoogleCalendarPicker.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { GoogleCalendarEntry } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { Badge } from '$lib/components/common'
 	import { Loader2, X, RefreshCw } from 'lucide-svelte'
 	import GoogleCalendarIcon from '$lib/components/icons/GoogleCalendarIcon.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		calendarId: string
@@ -13,22 +15,18 @@
 		disabled?: boolean
 	}
 
-	let {
-		calendarId = $bindable(),
-		calendarName = $bindable(),
-		disabled = false
-	}: Props = $props()
+	let { calendarId = $bindable(), calendarName = $bindable(), disabled = false }: Props = $props()
 
 	let calendars = $state<GoogleCalendarEntry[]>([])
 	let loading = $state(false)
 
 	async function loadCalendars() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		loading = true
 		try {
 			calendars = await NativeTriggerService.listGoogleCalendars({
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 			if (calendarId && !calendarName) {
 				const found = calendars.find((c) => c.id === calendarId)
@@ -55,7 +53,7 @@
 	}
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			loadCalendars()
 		}
 	})
diff --git a/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte b/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte
index 359dfc3536..597eb7d514 100644
--- a/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte
+++ b/frontend/src/lib/components/triggers/native/services/google/GoogleDrivePicker.svelte
@@ -1,23 +1,16 @@
 <script lang="ts">
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { GoogleDriveFile, SharedDriveEntry } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { Button } from '$lib/components/common'
-	import {
-		Loader2,
-		Folder,
-		File,
-		ChevronRight,
-		Search,
-		X,
-		RefreshCw,
-		Check
-	} from 'lucide-svelte'
+	import { Loader2, Folder, File, ChevronRight, Search, X, RefreshCw, Check } from 'lucide-svelte'
 	import GoogleDriveIcon from '$lib/components/icons/GoogleDriveIcon.svelte'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { Debounced, watch } from 'runed'
 	import { untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		resourceId: string
@@ -25,11 +18,7 @@
 		disabled?: boolean
 	}
 
-	let {
-		resourceId = $bindable(),
-		resourceName = $bindable(),
-		disabled = false
-	}: Props = $props()
+	let { resourceId = $bindable(), resourceName = $bindable(), disabled = false }: Props = $props()
 
 	type BreadcrumbItem = { id: string; name: string }
 	type DriveTab = 'my_drive' | 'shared_with_me' | 'shared_drives'
@@ -49,7 +38,7 @@
 	let loadVersion = 0
 
 	async function loadFiles(pageToken?: string) {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		const version = ++loadVersion
 
@@ -63,7 +52,7 @@
 
 		try {
 			const params: Parameters<typeof NativeTriggerService.listGoogleDriveFiles>[0] = {
-				workspace: $workspaceStore,
+				workspace: $operatingWorkspace,
 				pageToken
 			}
 
@@ -101,7 +90,7 @@
 	}
 
 	async function loadSharedDrives() {
-		if (!$workspaceStore) return
+		if (!$operatingWorkspace) return
 
 		loadingFiles = true
 		files = []
@@ -109,7 +98,7 @@
 
 		try {
 			sharedDrives = await NativeTriggerService.listGoogleSharedDrives({
-				workspace: $workspaceStore
+				workspace: $operatingWorkspace
 			})
 		} catch (err: any) {
 			sendUserToast(`Failed to load shared drives: ${err.body || err.message}`, true)
@@ -161,7 +150,7 @@
 
 	// Initial load when workspace is available
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			untrack(() => loadFiles())
 		}
 	})
@@ -169,28 +158,37 @@
 	// React to debounced search changes (skip initial)
 	watch(
 		() => debouncedSearch.current,
-		() => { loadFiles() },
+		() => {
+			loadFiles()
+		},
 		{ lazy: true }
 	)
 </script>
 
 <div class="flex flex-col gap-2 border rounded-md p-2 bg-surface">
 	{#if resourceId}
-		<div class="flex items-center gap-2 px-2 py-1 rounded bg-surface-selected text-secondary text-xs border">
+		<div
+			class="flex items-center gap-2 px-2 py-1 rounded bg-surface-selected text-secondary text-xs border"
+		>
 			<GoogleDriveIcon width="14px" height="14px" />
 			<span>
 				Selected: <strong>{resourceName || resourceId}</strong>
 			</span>
 			<button
 				class="ml-auto text-tertiary hover:text-secondary"
-				onclick={() => { resourceId = ''; resourceName = '' }}
+				onclick={() => {
+					resourceId = ''
+					resourceName = ''
+				}}
 				{disabled}
 			>
 				<X size={14} />
 			</button>
 		</div>
 	{:else}
-		<div class="flex items-center gap-2 px-2 py-1 rounded text-tertiary text-xs border border-dashed">
+		<div
+			class="flex items-center gap-2 px-2 py-1 rounded text-tertiary text-xs border border-dashed"
+		>
 			<GoogleDriveIcon width="14px" height="14px" />
 			<span>No file selected</span>
 		</div>
@@ -198,21 +196,27 @@
 
 	<div class="flex items-center gap-1 text-2xs">
 		<button
-			class="px-2 py-0.5 rounded {activeTab === 'my_drive' ? 'bg-surface-selected font-semibold' : 'hover:bg-surface-hover'}"
+			class="px-2 py-0.5 rounded {activeTab === 'my_drive'
+				? 'bg-surface-selected font-semibold'
+				: 'hover:bg-surface-hover'}"
 			onclick={() => switchTab('my_drive')}
 			{disabled}
 		>
 			My Drive
 		</button>
 		<button
-			class="px-2 py-0.5 rounded {activeTab === 'shared_with_me' ? 'bg-surface-selected font-semibold' : 'hover:bg-surface-hover'}"
+			class="px-2 py-0.5 rounded {activeTab === 'shared_with_me'
+				? 'bg-surface-selected font-semibold'
+				: 'hover:bg-surface-hover'}"
 			onclick={() => switchTab('shared_with_me')}
 			{disabled}
 		>
 			Shared with me
 		</button>
 		<button
-			class="px-2 py-0.5 rounded {activeTab === 'shared_drives' ? 'bg-surface-selected font-semibold' : 'hover:bg-surface-hover'}"
+			class="px-2 py-0.5 rounded {activeTab === 'shared_drives'
+				? 'bg-surface-selected font-semibold'
+				: 'hover:bg-surface-hover'}"
 			onclick={() => switchTab('shared_drives')}
 			{disabled}
 		>
@@ -222,7 +226,10 @@
 		<button
 			class="p-1 text-tertiary hover:text-secondary"
 			title="Refresh"
-			onclick={() => activeTab === 'shared_drives' && currentParentId === 'root' ? loadSharedDrives() : loadFiles()}
+			onclick={() =>
+				activeTab === 'shared_drives' && currentParentId === 'root'
+					? loadSharedDrives()
+					: loadFiles()}
 			{disabled}
 		>
 			<RefreshCw size={12} />
@@ -237,7 +244,10 @@
 				size="xs"
 				class="!pl-7"
 			/>
-			<Search size={14} class="absolute left-2 top-1/2 -translate-y-1/2 text-tertiary pointer-events-none" />
+			<Search
+				size={14}
+				class="absolute left-2 top-1/2 -translate-y-1/2 text-tertiary pointer-events-none"
+			/>
 			{#if searchQuery}
 				<button
 					class="absolute right-2 top-1/2 -translate-y-1/2 text-tertiary hover:text-secondary"
@@ -277,9 +287,7 @@
 			</div>
 		{:else if activeTab === 'shared_drives' && currentParentId === 'root'}
 			{#if sharedDrives.length === 0}
-				<div class="text-center py-4 text-xs text-tertiary">
-					No shared drives found
-				</div>
+				<div class="text-center py-4 text-xs text-tertiary"> No shared drives found </div>
 			{:else}
 				{#each sharedDrives as drive (drive.id)}
 					<div
diff --git a/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte b/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
index c282797b9b..780ccde9e8 100644
--- a/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
+++ b/frontend/src/lib/components/triggers/native/services/nextcloud/NextcloudTriggerForm.svelte
@@ -1,13 +1,15 @@
 <script lang="ts">
 	import { NativeTriggerService } from '$lib/gen/services.gen'
 	import type { NextCloudEventType } from '$lib/gen/types.gen'
-	import { workspaceStore } from '$lib/stores'
 	import { sendUserToast } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import Section from '$lib/components/Section.svelte'
 	import { Loader2 } from 'lucide-svelte'
 	import { getNextcloudSchema } from '../../utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		serviceConfig: Record<string, any>
@@ -38,7 +40,7 @@
 	let eventsError = $state<string | undefined>(undefined)
 
 	async function loadAvailableEvents() {
-		if (!$workspaceStore) {
+		if (!$operatingWorkspace) {
 			availableEvents = []
 			return
 		}
@@ -47,7 +49,7 @@
 		eventsError = undefined
 		try {
 			const events = await NativeTriggerService.listNextCloudEvents({
-				workspace: $workspaceStore!
+				workspace: $operatingWorkspace!
 			})
 			availableEvents = events
 			serviceSchema = getNextcloudSchema(events)
@@ -84,7 +86,7 @@
 	let externalDataApplied = $state(false)
 
 	$effect(() => {
-		if ($workspaceStore) {
+		if ($operatingWorkspace) {
 			loadAvailableEvents()
 		}
 	})
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
index 1ee7b9c594..16997be11a 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Alert, Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -10,8 +11,7 @@
 	import Path from '$lib/components/Path.svelte'
 	import TriggerRunnablePicker from '$lib/components/triggers/TriggerRunnablePicker.svelte'
 	import { NatsTriggerService, type ErrorHandler, type Retry, type TriggerMode } from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -32,9 +32,18 @@
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -54,6 +63,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -69,8 +80,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -83,7 +97,13 @@
 	let path: string = $state('')
 	let pathError = $state('')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let defaultValues: Record<string, any> | undefined = $state(undefined)
@@ -141,6 +161,9 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.nats.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -225,6 +248,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -238,7 +263,8 @@
 			consumer_name: useJetstream ? cfg?.consumer_name || '' : undefined
 		}
 		mode = cfg?.mode ?? 'enabled'
-		can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+		permsPath = cfg?.path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -388,36 +414,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit NATS trigger ${initialPath}`
+				: `NATS trigger ${initialPath}`
+			: 'New NATS trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.nats.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit NATS trigger ${initialPath}`
-					: `NATS trigger ${initialPath}`
-				: 'New NATS trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'NATS trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -512,7 +546,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 					>
 						{#snippet createButton()}
 							{#if emptyString(script_path)}
@@ -520,7 +554,9 @@
 									btnClasses="ml-4"
 									variant="accent"
 									size="xs"
-									href={itemKind === 'flow' ? '/flows/add?hub=66' : '/scripts/add?hub=hub%2F19663'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=66' : '/scripts/add?hub=hub%2F19663'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
index 2c459770d0..4d81cf4ff6 100644
--- a/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/nats/NatsTriggersConfigSection.svelte
@@ -1,13 +1,12 @@
 <script lang="ts">
 	import Section from '$lib/components/Section.svelte'
 	import Subsection from '$lib/components/Subsection.svelte'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import ResourcePicker from '$lib/components/ResourcePicker.svelte'
 	import SchemaForm from '$lib/components/SchemaForm.svelte'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '../testingBadge.svelte'
 	import { createEventDispatcher, untrack } from 'svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		defaultValues?: Record<string, any> | undefined
@@ -35,8 +34,8 @@
 		can_write = true,
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let otherArgsValid = $state(false)
 	let globalError = $derived(
diff --git a/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte b/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
index 194d932c7a..5da889320d 100644
--- a/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
+++ b/frontend/src/lib/components/triggers/postgres/CheckPostgresRequirement.svelte
@@ -2,10 +2,9 @@
 	import { Button } from '$lib/components/common'
 	import Tooltip from '$lib/components/Tooltip.svelte'
 	import { PostgresTriggerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	let loadingConfiguration = $state(false)
 
@@ -49,14 +48,14 @@
 	}
 
 	interface Props {
-		can_write: boolean;
-		postgres_resource_path: string;
-		checkConnection?: any | undefined;
+		can_write: boolean
+		postgres_resource_path: string
+		checkConnection?: any | undefined
 	}
 
-	let { can_write, postgres_resource_path, checkConnection = undefined }: Props = $props();
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	let { can_write, postgres_resource_path, checkConnection = undefined }: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 </script>
 
 {#if postgres_resource_path}
diff --git a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
index ecfbd0a081..23ce3fc43c 100644
--- a/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PostgresTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Alert, Button, TabContent } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -18,8 +19,7 @@
 		type Retry,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, emptyString, emptyStringTrimmed, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -54,9 +54,18 @@
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
 	import { capitalize } from '$lib/utils'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		isEditor?: boolean
@@ -75,6 +84,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		isEditor = false,
@@ -90,8 +101,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -104,7 +118,13 @@
 	let path: string = $state('')
 	let pathError = $state('')
 	let dirtyPath: boolean = $state(false)
-	let can_write: boolean = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading: boolean = $state(true)
 	let showLoading: boolean = $state(false)
 	let postgres_resource_path: string = $state('')
@@ -242,6 +262,9 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.postgres.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -361,6 +384,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -368,7 +393,8 @@
 		postgres_resource_path = cfg?.postgres_resource_path
 		publication_name = cfg?.publication_name
 		replication_slot_name = cfg?.replication_slot_name
-		can_write = canWrite(path, cfg?.extra_perms, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms
 		transaction_to_track = [...cfg?.publication?.transaction_to_track]
 		relations = cfg?.publication?.table_to_track ?? []
 		error_handler_path = cfg?.error_handler_path
@@ -491,7 +517,7 @@
 					postgres_resource_path
 				}
 			})
-			window.open(`${base}/scripts/add?id=${templateId}`)
+			window.open(operatingHref(`${base}/scripts/add?id=${templateId}`))
 			loading = false
 		} catch (error) {
 			loading = false
@@ -572,34 +598,42 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit Postgres trigger ${initialPath}`
+				: `Postgres trigger ${initialPath}`
+			: 'New Postgres trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}{@render actionsSnippet()}{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render content()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.postgres.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit Postgres trigger ${initialPath}`
-					: `Postgres trigger ${initialPath}`
-				: 'New Postgres trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}{@render actionsSnippet()}{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render content()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Postgres trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -696,7 +730,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptText="Pick a script or flow to be triggered "
 						promptClass="text-xs text-primary"
 					>
diff --git a/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte b/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
index a7a06b04d4..fdf24b5757 100644
--- a/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
+++ b/frontend/src/lib/components/triggers/postgres/PublicationPicker.svelte
@@ -1,25 +1,24 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import { Button } from '$lib/components/common'
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
 	import type { Relations } from '$lib/gen'
 	import { PostgresTriggerService } from '$lib/gen/services.gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 	import { RefreshCw } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
-		items?: string[];
-		can_write?: boolean;
-		publication_name?: string;
-		postgres_resource_path?: string;
-		relations?: Relations[] | undefined;
-		transaction_to_track?: string[];
-		disabled?: boolean;
+		items?: string[]
+		can_write?: boolean
+		publication_name?: string
+		postgres_resource_path?: string
+		relations?: Relations[] | undefined
+		transaction_to_track?: string[]
+		disabled?: boolean
 	}
 
 	let {
@@ -30,9 +29,9 @@
 		relations = $bindable(undefined),
 		transaction_to_track = $bindable([]),
 		disabled = false
-	}: Props = $props();
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let loadingPublication: boolean = $state(false)
 	let deletingPublication: boolean = $state(false)
@@ -113,7 +112,7 @@
 	listDatabasePublication()
 	run(() => {
 		publication_name && getAllRelations()
-	});
+	})
 </script>
 
 <div class="flex gap-1">
diff --git a/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte b/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
index ef3ac720ef..4ea985f0e7 100644
--- a/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
+++ b/frontend/src/lib/components/triggers/postgres/SlotPicker.svelte
@@ -3,17 +3,16 @@
 	import Select from '$lib/components/select/Select.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
 	import { PostgresTriggerService } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { sendUserToast } from '$lib/toast'
 	import { emptyString } from '$lib/utils'
 	import { RefreshCw } from 'lucide-svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
-		edit: boolean;
-		replication_slot_name?: string;
-		postgres_resource_path?: string;
-		disabled?: boolean;
+		edit: boolean
+		replication_slot_name?: string
+		postgres_resource_path?: string
+		disabled?: boolean
 	}
 
 	let {
@@ -21,9 +20,9 @@
 		replication_slot_name = $bindable(''),
 		postgres_resource_path = '',
 		disabled = false
-	}: Props = $props();
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let deletingSlot: boolean = $state(false)
 	let loadingSlot: boolean = $state(false)
diff --git a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
index 9745654676..a6a6b5e7a8 100644
--- a/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/schedules/ScheduleEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Alert, Badge, Button, ButtonType, Tab, Tabs } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { SCHEDULES_PATH } from '$lib/components/sessions/previewPaths'
@@ -29,7 +30,7 @@
 		type Schedule,
 		type ErrorHandler
 	} from '$lib/gen'
-	import { enterpriseLicense, workspaceStore } from '$lib/stores'
+	import { enterpriseLicense } from '$lib/stores'
 	import { canWrite, emptyString, formatCron, sendUserToast, cronV1toV2 } from '$lib/utils'
 	import { base } from '$lib/base'
 	import Section from '$lib/components/Section.svelte'
@@ -49,11 +50,13 @@
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
 	import { twMerge } from 'tailwind-merge'
 	import PermissionedAsLine from '../PermissionedAsLine.svelte'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import { useActingUser } from '$lib/actingUser.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		hideTarget = false,
 		docDescription = undefined,
 		allowDraft = false,
@@ -136,8 +139,8 @@
 	let selectedPermissionedAs = $state<string | undefined>(undefined)
 	let preservePermissionedAs = $state(false)
 
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 	// `undefined` while the lookup is in flight or after it failed; the checks below then
 	// refuse rather than fall back to rights that belong to another workspace.
 	const acting = useActingUser(() => wsId)
@@ -157,9 +160,9 @@
 				emptyString(errorHandlerExtraArgs['channel'])) ||
 			!can_write
 	)
-	// Carry the acting workspace onto "create from template" routes when a
-	// session override is set, so the script is created in the session workspace.
-	const wsParam = $derived(triggerWs?.() ? `&workspace=${encodeURIComponent(wsId!)}` : '')
+	// Carry the acting workspace onto "create from template" routes, so the script is created
+	// in the workspace this schedule lives in.
+	const wsParam = $derived(wsId ? `&workspace=${encodeURIComponent(wsId)}` : '')
 	const scheduleCfg = $derived.by(getScheduleCfg)
 
 	const draftSync = useTriggerDraftSync({
@@ -178,6 +181,7 @@
 		defaultCfg?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(SCHEDULES_PATH, ePath)) return
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -1420,34 +1424,42 @@
 	</div>
 {/snippet}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit schedule ${initialPath}`
+				: `View schedule ${initialPath}`
+			: 'New schedule'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			<div class="flex flex-row gap-4 items-center">
+				{@render saveButton()}
+			</div>
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render content()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer size="900px" bind:this={drawer} on:close={() => clearPageDrawerAnchor(SCHEDULES_PATH)}>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit schedule ${initialPath}`
-					: `View schedule ${initialPath}`
-				: 'New schedule'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				<div class="flex flex-row gap-4 items-center">
-					{@render saveButton()}
-				</div>
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render content()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'Schedule' : ''} headerClass="grow min-w-0 h-[30px]">
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
index 6aa7b025cc..7a648ab63b 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorConfigSection.svelte
@@ -13,11 +13,10 @@
 	import VariableEditor from '$lib/components/VariableEditor.svelte'
 	import { Button } from '$lib/components/common'
 	import { VariableService, type AwsAuthResourceType } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
 	import TestingBadge from '../testingBadge.svelte'
 	import MultiSelect from '$lib/components/select/MultiSelect.svelte'
 	import { safeSelectItems } from '$lib/components/select/utils.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		can_write?: boolean
@@ -40,8 +39,8 @@
 		message_attributes = $bindable([]),
 		showTestingBadge = false
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	async function loadVariables() {
 		return await VariableService.listVariable({ workspace: wsId ?? '' })
diff --git a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
index 75b5f60cb9..0b3f846c97 100644
--- a/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/sqs/SqsTriggerEditorInner.svelte
@@ -2,14 +2,14 @@
 	import { Alert, Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import Path from '$lib/components/Path.svelte'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, capitalize, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import { Loader2 } from 'lucide-svelte'
@@ -38,9 +38,18 @@
 	import { deepEqual } from 'fast-equals'
 	import { useTriggerDraftSync } from '../useTriggerDraftSync.svelte'
 	import LocalDraftBanner from '$lib/components/LocalDraftBanner.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -59,6 +68,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -74,8 +85,11 @@
 		onDelete = undefined,
 		onReset = undefined
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state(undefined)
 	let is_flow: boolean = $state(false)
@@ -89,7 +103,13 @@
 	let pathError = $state('')
 	let mode = $state<TriggerMode>('enabled')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let aws_resource_path: string = $state('')
@@ -136,6 +156,9 @@
 		defaultConfig?: Record<string, any>,
 		fixedScriptPath_?: string
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.sqs.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -214,6 +237,8 @@
 	}
 
 	async function loadTriggerConfig(cfg?: Record<string, any>): Promise<void> {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		try {
 			script_path = cfg?.script_path
 			initialScriptPath = cfg?.script_path
@@ -224,7 +249,8 @@
 			path = cfg?.path
 			mode = cfg?.mode ?? 'enabled'
 			aws_auth_resource_type = cfg?.aws_auth_resource_type
-			can_write = canWrite(cfg?.path, cfg?.extra_perms, $userStore)
+			permsPath = cfg?.path
+			permsForWrite = cfg?.extra_perms
 			error_handler_path = cfg?.error_handler_path
 			error_handler_args = cfg?.error_handler_args ?? {}
 			retry = cfg?.retry
@@ -370,36 +396,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit SQS trigger ${initialPath}`
+				: `SQS trigger ${initialPath}`
+			: 'New SQS trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsSnippet()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.sqs.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit SQS trigger ${initialPath}`
-					: `SQS trigger ${initialPath}`
-				: 'New SQS trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsSnippet()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'SQS trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -496,7 +530,7 @@
 						bind:scriptPath={script_path}
 						{initialScriptPath}
 						canWrite={can_write}
-						isOperator={!!$userStore?.operator}
+						isOperator={!!actingUser?.operator}
 						promptText="Pick a script or flow to be triggered "
 					>
 						{#snippet createButton()}
@@ -506,7 +540,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=59' : '/scripts/add?hub=hub%2F19657'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=59' : '/scripts/add?hub=hub%2F19657'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/triggers/triggerWorkspace.ts b/frontend/src/lib/components/triggers/triggerWorkspace.ts
deleted file mode 100644
index 290db9da37..0000000000
--- a/frontend/src/lib/components/triggers/triggerWorkspace.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { getContext, setContext } from 'svelte'
-
-const TRIGGER_WORKSPACE_KEY = 'triggerWorkspace'
-
-/**
- * Context seam letting the native-trigger editors operate on a workspace other
- * than the globally-active `$workspaceStore`. An AI session can run against a
- * (possibly forked) workspace that differs from the nav workspace WITHOUT
- * switching `$workspaceStore` (see `SessionPicker`), so a host that embeds the
- * trigger editors in that context registers a resolver here.
- *
- * Every workspace-scoped backend call / navigation inside the trigger subtree
- * reads its workspace via {@link getTriggerWorkspace} and falls back to
- * `$workspaceStore` when no resolver is set — the default everywhere outside
- * such a host, so behavior there is unchanged. Mirrors the AI chat manager's
- * `operatingWorkspace` resolver.
- */
-export function setTriggerWorkspace(resolver: () => string | undefined): void {
-	setContext(TRIGGER_WORKSPACE_KEY, resolver)
-}
-
-/**
- * The trigger-workspace resolver set by an embedding host, or `undefined` when
- * none is set (fall back to `$workspaceStore`). Read once during component init;
- * use in a `$derived`: `const ws = $derived(triggerWs?.() ?? $workspaceStore)`.
- */
-export function getTriggerWorkspace(): (() => string | undefined) | undefined {
-	return getContext<(() => string | undefined) | undefined>(TRIGGER_WORKSPACE_KEY)
-}
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte
index b6392bf41b..18a95d01c6 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksCapture.svelte
@@ -4,9 +4,11 @@
 	import { isObject } from '$lib/utils'
 	import CopyableCodeBlock from '../../details/CopyableCodeBlock.svelte'
 	import CaptureSection, { type CaptureInfo } from '../CaptureSection.svelte'
-	import { workspaceStore } from '$lib/stores'
 	import { Url } from '$lib/components/common'
 	import { fade } from 'svelte/transition'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
 
 	interface Props {
 		isFlow?: boolean
@@ -33,7 +35,7 @@
 	)
 
 	let captureUrl = $derived(
-		`${location.origin}/api/w/${$workspaceStore}/capture_u/webhook/${
+		`${location.origin}/api/w/${$operatingWorkspace}/capture_u/webhook/${
 			isFlow ? 'flow' : 'script'
 		}/${path}`
 	)
diff --git a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
index 36bb8e36d5..9033aab3cf 100644
--- a/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/webhook/WebhooksConfigSection.svelte
@@ -18,11 +18,11 @@
 	// import { page } from '$app/state'
 	import { base } from '$lib/base'
 	import TriggerTokens from '../TriggerTokens.svelte'
-	import { workspaceStore, userStore } from '$lib/stores'
-	import { getTriggerWorkspace } from '$lib/components/triggers/triggerWorkspace'
+	import { userStore } from '$lib/stores'
 	import UserSettings from '../../UserSettings.svelte'
 	import { generateRandomString } from '$lib/utils'
 	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		isFlow?: boolean
@@ -43,8 +43,8 @@
 		triggerTokens = $bindable(undefined),
 		scopes = []
 	}: Props = $props()
-	const triggerWs = getTriggerWorkspace()
-	const wsId = $derived(triggerWs?.() ?? $workspaceStore)
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	const WEBHOOK_BASE_URL = $derived(`${location.origin}${base}/api/w/${wsId}/jobs`)
 
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte
index 7fb8307c33..49421d6de5 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketCapture.svelte
@@ -35,23 +35,21 @@
 		{captureLoading}
 	>
 		{#snippet description()}
-			
-				{#if captureInfo.active}
-					{#if captureInfo.connectionInfo?.connected}
-						<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
-							Listenning to websocket events...
-						</p>
-					{:else}
-						<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
-							Connecting to websocket...
-						</p>
-					{/if}
+			{#if captureInfo.active}
+				{#if captureInfo.connectionInfo?.connected}
+					<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+						Listenning to websocket events...
+					</p>
 				{:else}
 					<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
-						Start capturing to listen to websocket events.
+						Connecting to websocket...
 					</p>
 				{/if}
-			
-			{/snippet}
+			{:else}
+				<p in:fade={{ duration: 100, delay: 50 }} out:fade={{ duration: 50 }}>
+					Start capturing to listen to websocket events.
+				</p>
+			{/if}
+		{/snippet}
 	</CaptureSection>
 {/if}
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte
index 2549ed4c85..50ef769ce2 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketEditorConfigSection.svelte
@@ -8,9 +8,9 @@
 	import { sendUserToast } from '$lib/utils'
 	import type { Schema } from '$lib/common'
 	import { FlowService, ScriptService, type Flow, type Script } from '$lib/gen'
-	import { workspaceStore } from '$lib/stores'
 	import TestTriggerConnection from '../TestTriggerConnection.svelte'
 	import TestingBadge from '$lib/components/triggers/testingBadge.svelte'
+	import { useOperatingWorkspace } from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		url: string | undefined
@@ -31,6 +31,8 @@
 		isValid = $bindable(false),
 		showTestingBadge = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const wsId = $derived($operatingWorkspace)
 
 	let areRunnableArgsValid: boolean = $state(true)
 
@@ -42,11 +44,11 @@
 				try {
 					let scriptOrFlow: Script | Flow = url.startsWith('$flow:')
 						? await FlowService.getFlowByPath({
-								workspace: $workspaceStore!,
+								workspace: wsId!,
 								path: url.split(':')[1]
 							})
 						: await ScriptService.getScriptByPath({
-								workspace: $workspaceStore!,
+								workspace: wsId!,
 								path: url.split(':')[1]
 							})
 					urlRunnableSchema = scriptOrFlow.schema as Schema
diff --git a/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
index e255b7b552..86285c06b3 100644
--- a/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/websocket/WebsocketTriggerEditorInner.svelte
@@ -2,6 +2,7 @@
 	import { Alert, Button } from '$lib/components/common'
 	import {
 		clearPageDrawerAnchor,
+		handOffPageDrawer,
 		setPageDrawerAnchor
 	} from '$lib/components/sessions/pageDrawerSession'
 	import { TRIGGER_PAGES } from '$lib/components/sessions/previewPaths'
@@ -24,7 +25,7 @@
 		type ErrorHandler,
 		type TriggerMode
 	} from '$lib/gen'
-	import { usedTriggerKinds, userStore, workspaceStore } from '$lib/stores'
+	import { usedTriggerKinds } from '$lib/stores'
 	import { canWrite, emptySchema, emptyString, sendUserToast } from '$lib/utils'
 	import { withForkConflictRetry } from '$lib/utils/forkConflict'
 	import Section from '$lib/components/Section.svelte'
@@ -53,9 +54,18 @@
 	import TriggerSuspendedJobsAlert from '../TriggerSuspendedJobsAlert.svelte'
 	import TriggerSuspendedJobsModal from '../TriggerSuspendedJobsModal.svelte'
 	import { capitalize } from '$lib/utils'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace,
+		useOperatingWorkspaceHref
+	} from '$lib/components/operatingWorkspace.svelte'
 
 	interface Props {
 		useDrawer?: boolean
+		/** With `useDrawer`, render the drawer's content in place, filling the parent, with no drawer or close button. */
+		inline?: boolean
+		/** With `inline`, closes whatever hosts the editor; the header has a close button only when set. */
+		onClose?: () => void
 		description?: Snippet | undefined
 		hideTarget?: boolean
 		hideTooltips?: boolean
@@ -75,6 +85,8 @@
 
 	let {
 		useDrawer = true,
+		inline = false,
+		onClose = undefined,
 		description = undefined,
 		hideTarget = false,
 		hideTooltips = false,
@@ -90,6 +102,11 @@
 		onReset = undefined,
 		cloudDisabled = false
 	}: Props = $props()
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
+	const operatingHref = useOperatingWorkspaceHref()
+	const wsId = $derived($operatingWorkspace)
 
 	let drawer: Drawer | undefined = $state()
 	let is_flow: boolean = $state(false)
@@ -114,7 +131,13 @@
 	let heartbeat_message = $state('')
 	let heartbeat_state_field = $state('')
 	let dirtyPath = $state(false)
-	let can_write = $state(true)
+	let permsPath = $state<string | undefined>(undefined)
+	let permsForWrite = $state<Record<string, boolean> | undefined>(undefined)
+	// The acting user in the operating workspace arrives asynchronously, and an unknown user
+	// refuses — so the editor stays read-only until the lookup lands, which is the safe answer.
+	const can_write = $derived(
+		permsPath === undefined ? true : canWrite(permsPath, permsForWrite ?? {}, actingUser)
+	)
 	let drawerLoading = $state(true)
 	let showLoading = $state(false)
 	let initialConfig: Record<string, any> | undefined = undefined
@@ -139,7 +162,7 @@
 	const draftSync = useTriggerDraftSync({
 		itemKind: 'trigger_websocket',
 		path: () => initialPath,
-		workspace: () => $workspaceStore,
+		workspace: () => wsId,
 		drawerLoading: () => drawerLoading,
 		getCfg: () => websocketCfg,
 		applyCfg: loadTriggerConfig,
@@ -179,6 +202,9 @@
 		isFlow: boolean,
 		defaultConfig?: Record<string, any>
 	) {
+		if (handOffPageDrawer(TRIGGER_PAGES.websocket.path, ePath)) return
+		// A `whoami` that failed earlier would otherwise pin this workspace to "unknown user".
+		operatingUser.forgetFailures()
 		let loadingTimeout = setTimeout(() => {
 			showLoading = true
 		}, 100) // Do not show loading spinner for the first 100ms
@@ -256,6 +282,8 @@
 	}
 
 	function loadTriggerConfig(cfg?: Record<string, any>): void {
+		// The loaded trigger says what it runs; an opener's `isFlow` is only its guess.
+		if (cfg?.is_flow !== undefined) itemKind = cfg.is_flow ? 'flow' : 'script'
 		script_path = cfg?.script_path
 		initialScriptPath = cfg?.script_path
 		is_flow = cfg?.is_flow
@@ -272,7 +300,8 @@
 		heartbeat_interval_secs = hb?.interval_secs ?? 41
 		heartbeat_message = hb?.message ?? ''
 		heartbeat_state_field = hb?.state_field ?? ''
-		can_write = canWrite(path, cfg?.extra_perms, $userStore)
+		permsPath = path
+		permsForWrite = cfg?.extra_perms
 		error_handler_path = cfg?.error_handler_path
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
@@ -320,7 +349,7 @@
 			return { overlay: undefined, noDeployed: false }
 		}
 		const s = await WebsocketTriggerService.getWebsocketTrigger({
-			workspace: $workspaceStore!,
+			workspace: wsId!,
 			path: initialPath,
 			getDraft: true
 		})
@@ -348,8 +377,8 @@
 			try {
 				let schema: Schema | undefined = emptySchema()
 				let scriptOrFlow: Script | Flow = is_flow
-					? await FlowService.getFlowByPath({ workspace: $workspaceStore!, path })
-					: await ScriptService.getScriptByPath({ workspace: $workspaceStore!, path })
+					? await FlowService.getFlowByPath({ workspace: wsId!, path })
+					: await ScriptService.getScriptByPath({ workspace: wsId!, path })
 				schema = scriptOrFlow.schema as Schema
 				if (schema && schema.properties) {
 					initialMessageRunnableSchemas[(is_flow ? 'flow/' : '') + path] = schema
@@ -380,7 +409,7 @@
 			initialPath,
 			saveCfg,
 			edit,
-			$workspaceStore!,
+			wsId!,
 			usedTriggerKinds
 		)
 		if (isSaved) {
@@ -412,7 +441,7 @@
 				(force) =>
 					WebsocketTriggerService.setWebsocketTriggerMode({
 						path: initialPath,
-						workspace: $workspaceStore ?? '',
+						workspace: wsId ?? '',
 						requestBody: { mode: newMode, force }
 					}),
 				'websocket trigger'
@@ -458,36 +487,44 @@
 	/>
 {/if}
 
-{#if useDrawer}
+{#snippet drawerBody()}
+	<DrawerContent
+		hideClose={inline && !onClose}
+		fullScreen={!inline}
+		bannerReserved={draftSync.hasBaseline}
+		title={edit
+			? can_write
+				? `Edit WebSocket trigger ${initialPath}`
+				: `WebSocket trigger ${initialPath}`
+			: 'New WebSocket trigger'}
+		on:close={() => (inline ? onClose?.() : drawer?.closeDrawer())}
+	>
+		{#snippet actions()}
+			{@render actionsButtons()}
+		{/snippet}
+		{#snippet banner()}
+			<LocalDraftBanner
+				show={draftSync.hasDraft}
+				getDeployed={() => draftSync.deployed}
+				reserveSpace={draftSync.hasBaseline}
+				getCurrent={() => draftSync.current}
+				onDiscard={() => draftSync.resetToDeployed(initialPath)}
+				disabled={!can_write}
+			/>
+		{/snippet}
+		{@render config()}
+	</DrawerContent>
+{/snippet}
+
+{#if useDrawer && inline}
+	{@render drawerBody()}
+{:else if useDrawer}
 	<Drawer
 		size="800px"
 		bind:this={drawer}
 		on:close={() => clearPageDrawerAnchor(TRIGGER_PAGES.websocket.path)}
 	>
-		<DrawerContent
-			bannerReserved={draftSync.hasBaseline}
-			title={edit
-				? can_write
-					? `Edit WebSocket trigger ${initialPath}`
-					: `WebSocket trigger ${initialPath}`
-				: 'New WebSocket trigger'}
-			on:close={drawer.closeDrawer}
-		>
-			{#snippet actions()}
-				{@render actionsButtons()}
-			{/snippet}
-			{#snippet banner()}
-				<LocalDraftBanner
-					show={draftSync.hasDraft}
-					getDeployed={() => draftSync.deployed}
-					reserveSpace={draftSync.hasBaseline}
-					getCurrent={() => draftSync.current}
-					onDiscard={() => draftSync.resetToDeployed(initialPath)}
-					disabled={!can_write}
-				/>
-			{/snippet}
-			{@render config()}
-		</DrawerContent>
+		{@render drawerBody()}
 	</Drawer>
 {:else}
 	<Section label={!customLabel ? 'WebSocket trigger' : ''} headerClass="grow min-w-0 h-[30px]">
@@ -589,7 +626,7 @@
 								bind:itemKind
 								bind:scriptPath={script_path}
 								allowRefresh={can_write}
-								allowEdit={!$userStore?.operator}
+								allowEdit={!actingUser?.operator}
 								clearable
 							/>
 							{#if emptyString(script_path)}
@@ -598,7 +635,9 @@
 									variant="accent"
 									size="xs"
 									disabled={!can_write}
-									href={itemKind === 'flow' ? '/flows/add?hub=64' : '/scripts/add?hub=hub%2F19660'}
+									href={operatingHref(
+										itemKind === 'flow' ? '/flows/add?hub=64' : '/scripts/add?hub=hub%2F19660'
+									)}
 									target="_blank"
 								>
 									Create from template
diff --git a/frontend/src/lib/components/wizards/AppPicker.svelte b/frontend/src/lib/components/wizards/AppPicker.svelte
index e6ee5b3f25..17f384c71d 100644
--- a/frontend/src/lib/components/wizards/AppPicker.svelte
+++ b/frontend/src/lib/components/wizards/AppPicker.svelte
@@ -1,18 +1,25 @@
 <script lang="ts">
 	import { getContext, onMount } from 'svelte'
 	import DarkModeObserver from '../DarkModeObserver.svelte'
-	import { userStore, workspaceStore } from '$lib/stores'
 	import { AppService, type ListableApp } from '$lib/gen'
 	import { canWrite } from '$lib/utils'
 	import type { AppViewerContext } from '../apps/types'
 	import Alert from '../common/alert/Alert.svelte'
 	import Select from '../select/Select.svelte'
+	import {
+		useOperatingUser,
+		useOperatingWorkspace
+	} from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingWorkspace = useOperatingWorkspace()
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	interface Props {
-		value?: string;
+		value?: string
 	}
 
-	let { value = $bindable('') }: Props = $props();
+	let { value = $bindable('') }: Props = $props()
 	let darkMode = $state(false)
 
 	const { appPath } = getContext<AppViewerContext>('AppViewerContext')
@@ -20,17 +27,17 @@
 	let apps: ListableApp[] = $state([])
 
 	async function loadApps(): Promise<void> {
-		apps = (await AppService.listApps({ workspace: $workspaceStore!, includeDraftOnly: true })).map(
-			(app: ListableApp) => {
-				return {
-					canWrite:
-						canWrite(app.path!, app.extra_perms!, $userStore) &&
-						app.workspace_id == $workspaceStore &&
-						!$userStore?.operator,
-					...app
-				}
+		apps = (
+			await AppService.listApps({ workspace: $operatingWorkspace!, includeDraftOnly: true })
+		).map((app: ListableApp) => {
+			return {
+				canWrite:
+					canWrite(app.path!, app.extra_perms!, actingUser) &&
+					app.workspace_id == $operatingWorkspace &&
+					!actingUser?.operator,
+				...app
 			}
-		)
+		})
 	}
 
 	onMount(() => {
diff --git a/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte b/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
index fc9bddcf4e..08fa94e189 100644
--- a/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DataTableMigrationsButton.svelte
@@ -26,7 +26,11 @@
 	import Portal from '$lib/components/Portal.svelte'
 	import DropdownV2 from '../DropdownV2.svelte'
 	import MissingWorkerTagAlert from '../jobs/MissingWorkerTagAlert.svelte'
-	import { superadmin, userStore } from '$lib/stores'
+	import { superadmin } from '$lib/stores'
+	import { useOperatingUser } from '$lib/components/operatingWorkspace.svelte'
+
+	const operatingUser = useOperatingUser()
+	const actingUser = $derived(operatingUser.current)
 
 	let {
 		workspace,
@@ -56,7 +60,7 @@
 	let generatingInitial = $state(false)
 
 	// Only workspace admins and super admins can opt a data table in or out.
-	const canManage = $derived(!!$userStore?.is_admin || !!$superadmin)
+	const canManage = $derived(!!actingUser?.is_admin || !!$superadmin)
 
 	let newMigrationModal = $state<NewDataTableMigrationModal | undefined>(undefined)
 	let newMigrationOpen = $state(false)
diff --git a/frontend/src/routes/(root)/(logged)/+layout.svelte b/frontend/src/routes/(root)/(logged)/+layout.svelte
index 19cf5bb5a2..9489384405 100644
--- a/frontend/src/routes/(root)/(logged)/+layout.svelte
+++ b/frontend/src/routes/(root)/(logged)/+layout.svelte
@@ -13,6 +13,7 @@
 	} from '$lib/gen'
 	import { capitalize, classNames, getModifierKey, sendUserToast } from '$lib/utils'
 	import { useLocalStorageValue } from '$lib/svelte5Utils.svelte'
+	import { isSessionPreviewFrame } from '$lib/components/sessions/sessionMode.svelte'
 	import WorkspaceMenu from '$lib/components/sidebar/WorkspaceMenu.svelte'
 	import SidebarContent from '$lib/components/sidebar/SidebarContent.svelte'
 	import SettingsMenu from '$lib/components/sidebar/SettingsMenu.svelte'
@@ -355,17 +356,6 @@
 		}
 	}
 
-	// True when this window is a sessions-preview iframe (embedded + nomenubar,
-	// which the preview always sets and stickies — see the menu-hide block above).
-	function isSessionPreviewEmbed(): boolean {
-		if (!embedded) return false
-		try {
-			return sessionStorage.getItem('nomenubar_embedded') === 'true'
-		} catch {
-			return false
-		}
-	}
-
 	// A job-detail navigation (/run/<id>) inside a preview tab should open the job in
 	// a NEW tab rather than navigate the current tab away from its page (e.g. clicking
 	// a job in the Runs tab keeps Runs put and opens the run beside it). Returns the
@@ -412,7 +402,7 @@
 		// instead of booting a second, disconnected editor in this frame. Cancel so
 		// the heavy editor never mounts here at all. Runs before the apps_raw reload
 		// below so a raw-app editor promotes rather than full-reloading the iframe.
-		if (isSessionPreviewEmbed()) {
+		if (isSessionPreviewFrame()) {
 			const target = previewEditorTarget(navigation.to?.url)
 			if (target) {
 				navigation.cancel()
diff --git a/frontend/src/routes/(root)/(logged)/resources/+page.svelte b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
index be735f4901..bf62818170 100644
--- a/frontend/src/routes/(root)/(logged)/resources/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/resources/+page.svelte
@@ -84,7 +84,10 @@
 		openAgentEditor
 	} from '$lib/components/flows/agentEditorStore.svelte'
 	import { copilotInfo } from '$lib/aiStore'
-	import { setPageDrawerAnchor } from '$lib/components/sessions/pageDrawerSession'
+	import {
+		handOffPageDrawer,
+		setPageDrawerAnchor
+	} from '$lib/components/sessions/pageDrawerSession'
 	import { RESOURCES_PATH } from '$lib/components/sessions/previewPaths'
 	import GfmMarkdown from '$lib/components/GfmMarkdown.svelte'
 	import ExploreAssetButton, {
@@ -141,6 +144,7 @@
 	 *  render its configuration as raw JSON. Both write the same resource draft, so the choice is
 	 *  presentational and either can open a path the other left a draft at. */
 	function openResourceEditor(path: string, resourceType: string | undefined) {
+		if (handOffPageDrawer(RESOURCES_PATH, path)) return
 		if (resourceType === 'ai_agent') {
 			// The generic editor anchors itself from `initEdit`; this one has to, or the URL, a
 			// refresh, and the AI session's idea of where you are all miss the open agent. Claim the
diff --git a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
index 8c38795059..a3712f3f24 100644
--- a/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/sessions/+page.svelte
@@ -59,14 +59,18 @@
 		artifactKey,
 		itemDisplayName,
 		matchPreviewPage,
+		pageItemUrl,
 		pageKey,
 		parseArtifactRoute,
-		parseRunFormRoute,
+		parsePageItemRoute,
+		type PageItemRef,
 		parsePreviewItemRoute,
 		previewLocationLabel,
+		workspacePageHref,
 		type PreviewTarget
 	} from '$lib/components/sessions/previewRouter'
 	import { toolReloadEffect, tabsToReload } from '$lib/components/sessions/previewReload'
+	import { pageItemForListPath } from '$lib/components/sessions/previewPaths'
 	import {
 		leafKeyFor,
 		loadKind,
@@ -103,7 +107,8 @@
 				() => import('$lib/components/sessions/ScriptEditorView.svelte'),
 				() => import('$lib/components/sessions/FlowEditorView.svelte'),
 				() => import('$lib/components/sessions/RawAppEditorView.svelte'),
-				() => import('$lib/components/sessions/PipelineEditorView.svelte')
+				() => import('$lib/components/sessions/PipelineEditorView.svelte'),
+				() => import('$lib/components/sessions/PageItemEditorView.svelte')
 			]
 			for (const load of loaders) {
 				if (disposed) return
@@ -492,13 +497,9 @@
 	// Page path shown after the workspace breadcrumb — the active tab's observed
 	// location, so the breadcrumb tracks where the user browses inside the tab.
 	const displayPath = $derived(owner?.activeTab?.loc ?? owner?.activeTab?.url ?? `${base}/`)
-	// Artifacts have no workspace page, so "Open in workspace" can't resolve for them.
 	const activeArtifact = $derived(owner?.activeTab ? parseArtifactRoute(owner.activeTab.url) : null)
-	// Nor does a run form: it belongs to a chat, and its url is a scheme rather than a path,
-	// so the link would resolve to the tool call id as a route.
-	const activeTabHasNoWorkspacePage = $derived(
-		activeArtifact != null ||
-			(owner?.activeTab ? parseRunFormRoute(owner.activeTab.url) != null : false)
+	const activeWorkspaceHref = $derived(
+		owner?.activeTab ? workspacePageHref(owner.activeTab.loc || owner.activeTab.url) : `${base}/`
 	)
 	// The active session's artifacts, surfaced as an "Artifacts" branch in the
 	// preview pickers.
@@ -552,47 +553,49 @@
 
 	// Reload mounted preview tabs affected by a mutating chat tool. Item and pipeline
 	// tabs are live editors that self-sync from the store the chat mutates, so nothing
-	// reloads them. Only list-page tabs (schedules, resources, …) are iframes, and each
-	// reloads only when a tool actually changed *its* page (toolReloadEffect) — so a
+	// reloads them. List-page tabs (schedules, resources, …) and page item tabs reload
+	// only when a tool actually changed *their* page or item (toolReloadEffect) — so a
 	// schedule write leaves the Resources tab alone, and a purely local tool (saving
 	// user instructions) reloads nothing.
 	const tabHosts: Record<string, PreviewTabHost | undefined> = {}
 
 	let reloadHandle: ReturnType<typeof setTimeout> | undefined
-	// Base-stripped list-page paths (e.g. `/schedules`) a chat round touched since
-	// the last flush — see toolReloadEffect for how tools map to pages.
-	let pendingPages = new Set<string>()
+	// Per workspace a chat round touched since the last flush: base-stripped list-page paths
+	// (e.g. `/schedules`, see toolReloadEffect) and the page items its tools named, as tab
+	// urls. By workspace because a path names an item only within one: a write in one fork
+	// must not remount the same path's editor in a session on another.
+	let pending = new Map<string, { pages: Set<string>; items: Set<string> }>()
 
-	// Reload the mounted list-page tabs a chat round changed, across all warm
-	// sessions (a hidden preview would otherwise show pre-mutation content on
-	// return). tabsToReload picks only the tabs whose page is in `pages`.
-	function reloadTabs(pages: Set<string>) {
+	// Reload the mounted tabs a chat round changed in each warm session acting on that
+	// workspace (a hidden preview would otherwise show pre-mutation content on return).
+	function flushReload() {
+		const touched = pending
+		pending = new Map()
 		for (const s of warmSessions) {
+			const scope = touched.get(getEffectiveWorkspaceId(s) ?? $workspaceStore ?? '')
 			const owner = getRuntime(s.id)?.previewTabs
-			if (!owner) continue
-			for (const tab of tabsToReload(owner.tabs, pages)) {
+			if (!scope || !owner) continue
+			for (const tab of tabsToReload(owner.tabs, scope.pages, scope.items)) {
 				const key = tabKey(s.id, tab.id)
 				if (mountedTabKeys.has(key)) tabHosts[key]?.reload()
 			}
 		}
 	}
-	function flushReload() {
-		const pages = pendingPages
-		pendingPages = new Set()
-		reloadTabs(pages)
-	}
 	$effect(() => {
 		// Debounced so a burst of writes (the AI editing several files) reloads once.
-		setToolCompletionListener((name, args) => {
-			const { pages } = toolReloadEffect(name, args)
+		setToolCompletionListener((name, args, workspace) => {
+			const { pages, items } = toolReloadEffect(name, args)
 			if (pages.length === 0) return
-			for (const p of pages) pendingPages.add(p)
+			let scope = pending.get(workspace)
+			if (!scope) pending.set(workspace, (scope = { pages: new Set(), items: new Set() }))
+			for (const p of pages) scope.pages.add(p)
+			for (const item of items) scope.items.add(pageItemUrl(item))
 			clearTimeout(reloadHandle)
 			reloadHandle = setTimeout(flushReload, 500)
 		})
 		return () => {
 			clearTimeout(reloadHandle)
-			pendingPages = new Set()
+			pending = new Map()
 			setToolCompletionListener(undefined)
 		}
 	})
@@ -610,6 +613,22 @@
 			o.open(target)
 		})
 	})
+	// Variables, resources, schedules and triggers the chat links to open as tabs of their
+	// own here, rather than in the drawers the layout opens them in elsewhere.
+	$effect(() => {
+		return registerToolDisplayActionHandler('open_created_resource', (action) => {
+			if (action.type !== 'open_created_resource') return
+			const ref: PageItemRef | undefined =
+				action.resource === 'trigger'
+					? action.triggerKind && {
+							kind: 'trigger',
+							triggerKind: action.triggerKind,
+							path: action.path
+						}
+					: { kind: action.resource, path: action.path }
+			if (ref) owner?.open({ type: 'pageitem', ref })
+		})
+	})
 
 	// Editor-style breadcrumb over the previewed page. We only render clickable
 	// segments when the preview is sitting on a script/flow/app route — for any
@@ -745,7 +764,8 @@
 		const path =
 			tab.friendlyPath ??
 			listedItemFor(tab, workspace)?.draftPath ??
-			parsePreviewItemRoute(tab.loc)?.itemPath
+			parsePreviewItemRoute(tab.loc)?.itemPath ??
+			parsePageItemRoute(tab.loc)?.path
 		return path && path !== label ? `${label}\n${path}` : label
 	}
 
@@ -785,6 +805,14 @@
 				owner?.navigate({ type: 'item', item })
 				return
 			}
+			// A row opened on a list page inside a preview tab: its editor opens as a tab of its
+			// own, leaving the list where it is.
+			if (d.type === 'wm.session.openPageItem') {
+				if (typeof d.pagePath !== 'string' || typeof d.path !== 'string') return
+				const ref = pageItemForListPath(d.pagePath, d.path)
+				if (ref) owner?.open({ type: 'pageitem', ref })
+				return
+			}
 			// A job clicked inside a preview tab: open the run detail in a NEW tab so the
 			// originating page (e.g. Runs) stays put. open() focuses an existing tab for
 			// the same run rather than duplicating it.
@@ -937,12 +965,9 @@
 								<!-- Open-in-full-page + full-screen toggle, floating over the top-right
 								     corner to mirror the collapse control. -->
 								<div class="absolute top-1 right-1 z-30 flex items-center gap-0.5">
-									{#if !activeTabHasNoWorkspacePage}
+									{#if activeWorkspaceHref}
 										<a
-											href={withWorkspaceParam(
-												owner?.activeTab?.loc || owner?.activeTab?.url || `${base}/`,
-												previewWorkspace
-											)}
+											href={withWorkspaceParam(activeWorkspaceHref, previewWorkspace)}
 											title="Open in workspace"
 											aria-label="Open in workspace"
 											class="inline-flex items-center justify-center w-6 h-6 rounded text-tertiary hover:text-primary hover:bg-surface-hover"