feat: ESC at root opens Windows switcher via izui policy

app/lib/izui-state.js

···
   return 'nothing';
 }
 
+/**
+ * ESC unhandled policy: second-phase policy consulted ONLY after the renderer
+ * returns { handled: false } AND escPolicy() returns 'nothing'.
+ *
+ * Determines what to do when ESC has nowhere left to navigate.
+ * Pure function — no side effects.
+ *
+ * @param {string} sessionState - Current IZUI state ('idle'|'transient'|'active'|'overlay')
+ * @param {string} role - Window role ('quick-view'|'palette'|'utility'|'overlay'|'child-content'|'workspace'|'content')
+ * @returns {'open-switcher'|'nothing'}
+ */
+function escUnhandledPolicy(sessionState, role) {
+  // Only workspace windows in active or idle sessions open the switcher.
+  // Transient sessions should NOT trigger switcher — user expects ESC to
+  // return to previous app, not open more UI.
+  if (role === 'workspace' && (sessionState === 'active' || sessionState === 'idle')) return 'open-switcher';
+  return 'nothing';
+}
+
 // ============================================================================
 // Singleton & Exports
 // ============================================================================
···
   IzuiStateCoordinator,
   getIzuiCoordinator,
   escPolicy,
+  escUnhandledPolicy,
 };

app/lib/session.js

···
  * These are internal bookkeeping or context-dependent values that should be
  * re-derived from the URL and current environment during restore:
  * - x/y/width/height: stale positions from original creation (bounds are authoritative)
- * - role: saved role can trigger hasNonContentRole in window-open, preventing
- *   canvas mode for web pages that had role 'workspace'
- * - escapeMode: affects role detection (escapeMode:'navigate' -> role:'workspace')
- *   which also disables canvas mode for web pages
  * - address: internal bookkeeping param, overwritten by window-open anyway
  * - transient/parentWindowId: session state, not applicable to restored windows
+ * Note: role and escapeMode are preserved — they're semantic properties that
+ * describe how the window should behave (e.g., ESC handling for extension windows).
  * @type {Set<string>}
  */
 export const RESTORE_STRIP_KEYS = new Set([
   'x', 'y', 'width', 'height',
-  'role', 'escapeMode', 'address',
+  'address',
   'transient', 'parentWindowId',
 ]);
 

backend/electron/ipc.ts

···
     // (webview, navbar, resize handle) are positioned via JS on an invisible surface.
     // Non-canvas web pages (modals, quick-views, overlays) load their URL directly.
     const isModalOrQuickView = options.modal === true || options.overlay === true;
-    const hasNonContentRole = options.role && !['content', 'child-content'].includes(options.role as string);
-    const useCanvas = isWebPage && !isModalOrQuickView && !hasNonContentRole;
+    const useCanvas = isWebPage && !isModalOrQuickView;
 
     // Use profile-specific session for isolation
     const profileSession = getProfileSession();

backend/electron/izui-state.test.ts

···
 // Import will be done after build
 let izuiState: typeof import('./izui-state.js');
 
-// Import escPolicy from the shared module (pure function, no Electron deps)
+// Import escPolicy and escUnhandledPolicy from the shared module (pure functions, no Electron deps)
 // At runtime (from dist/backend/electron/) the path is ../../../app/lib/izui-state.js
 let escPolicy: (sessionState: string, role: string) => 'close' | 'close-and-restore' | 'nothing';
+let escUnhandledPolicy: (sessionState: string, role: string) => 'open-switcher' | 'nothing';
 
 describe('IZUI State Coordinator Tests', () => {
   let mockWindows: MockWindow[];
···
     // @ts-expect-error — shared JS module in app/lib, no .d.ts in tsconfig rootDir
     const shared = await import('../../../app/lib/izui-state.js');
     escPolicy = shared.escPolicy;
+    escUnhandledPolicy = shared.escUnhandledPolicy;
   });
 
   beforeEach(() => {
···
       assert.strictEqual(escPolicy(coordinator.getState(), 'content'), 'close');
       assert.strictEqual(escPolicy(coordinator.getState(), 'workspace'), 'nothing',
         'workspace windows must never close on ESC, even in transient sessions');
+    });
+  });
+
+  describe('escUnhandledPolicy', () => {
+    it('should open switcher for workspace in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'workspace'), 'open-switcher');
+    });
+
+    it('should open switcher for workspace in idle session', () => {
+      assert.strictEqual(escUnhandledPolicy('idle', 'workspace'), 'open-switcher');
+    });
+
+    it('should NOT open switcher for workspace in transient session', () => {
+      assert.strictEqual(escUnhandledPolicy('transient', 'workspace'), 'nothing',
+        'transient sessions should not trigger switcher — user expects ESC to return to previous app');
+    });
+
+    it('should NOT open switcher for workspace in overlay session', () => {
+      assert.strictEqual(escUnhandledPolicy('overlay', 'workspace'), 'nothing');
+    });
+
+    it('should NOT open switcher for content in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'content'), 'nothing');
+    });
+
+    it('should NOT open switcher for child-content in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'child-content'), 'nothing');
+    });
+
+    it('should NOT open switcher for overlay role in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'overlay'), 'nothing');
+    });
+
+    it('should NOT open switcher for palette in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'palette'), 'nothing');
+    });
+
+    it('should NOT open switcher for utility in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'utility'), 'nothing');
+    });
+
+    it('should NOT open switcher for quick-view in active session', () => {
+      assert.strictEqual(escUnhandledPolicy('active', 'quick-view'), 'nothing');
     });
   });
 });

backend/electron/session.test.ts

···
      */
     function stripRestoreParams(params: Record<string, unknown>): Record<string, unknown> {
       const cleanParams: Record<string, unknown> = {};
-      const stripKeys = new Set(['x', 'y', 'width', 'height', 'role', 'escapeMode', 'address', 'transient', 'parentWindowId']);
+      const stripKeys = new Set(['x', 'y', 'width', 'height', 'address', 'transient', 'parentWindowId']);
       for (const [key, value] of Object.entries(params)) {
         if (!stripKeys.has(key)) {
           cleanParams[key] = value;
···
       assert.strictEqual(clean.transparent, true, 'transparent should be preserved');
     });
 
-    it('strips role to prevent hasNonContentRole disabling canvas mode', () => {
-      // BUG: Web page saved with role:'workspace' gets useCanvas=false on restore
-      // because hasNonContentRole = true for 'workspace'.
+    it('preserves role and escapeMode across session restore', () => {
+      // role and escapeMode are semantic properties that affect window behavior
+      // (e.g., ESC handling for extension windows like Groups).
       const params = {
         role: 'workspace',
         escapeMode: 'navigate',
         key: 'https://example.com',
       };
       const clean = stripRestoreParams(params);
-      assert.strictEqual(clean.role, undefined, 'role should be stripped');
-      assert.strictEqual(clean.escapeMode, undefined, 'escapeMode should be stripped');
+      assert.strictEqual(clean.role, 'workspace', 'role should be preserved');
+      assert.strictEqual(clean.escapeMode, 'navigate', 'escapeMode should be preserved');
       assert.strictEqual(clean.key, 'https://example.com', 'key should be preserved');
     });
 
···
         trackingSourceId: 'open',
         focusable: true,
         debug: false,
+        role: 'content',
         // These should be stripped:
-        x: 100, y: 200, role: 'content', address: 'url', transient: false,
+        x: 100, y: 200, address: 'url', transient: false,
       };
       const clean = stripRestoreParams(params);
       assert.strictEqual(clean.key, 'my-window');
···
       assert.strictEqual(clean.trackingSourceId, 'open');
       assert.strictEqual(clean.focusable, true);
       assert.strictEqual(clean.debug, false);
+      assert.strictEqual(clean.role, 'content', 'role should be preserved');
       // Verify stripped keys are gone
       assert.strictEqual(clean.x, undefined);
       assert.strictEqual(clean.y, undefined);
-      assert.strictEqual(clean.role, undefined);
       assert.strictEqual(clean.address, undefined);
       assert.strictEqual(clean.transient, undefined);
     });

backend/electron/session.ts

···
       // These are internal bookkeeping or context-dependent values that should be
       // re-derived from the URL and current environment during restore:
       // - x/y/width/height: stale positions from original creation (bounds are authoritative)
-      // - role: saved role can trigger hasNonContentRole in window-open, preventing
-      //   canvas mode for web pages that had role 'workspace' (Bug: useCanvas=false)
-      // - escapeMode: affects role detection (escapeMode:'navigate' -> role:'workspace')
-      //   which also disables canvas mode for web pages
       // - address: internal bookkeeping param, overwritten by window-open anyway
       // - transient/parentWindowId: session state, not applicable to restored windows
+      // Note: role and escapeMode are preserved — they're semantic properties that
+      // describe how the window should behave (e.g., ESC handling for extension windows).
       const cleanParams: Record<string, unknown> = {};
-      const stripKeys = new Set(['x', 'y', 'width', 'height', 'role', 'escapeMode', 'address', 'transient', 'parentWindowId']);
+      const stripKeys = new Set(['x', 'y', 'width', 'height', 'address', 'transient', 'parentWindowId']);
       for (const [key, value] of Object.entries(descriptor.params)) {
         if (!stripKeys.has(key)) {
           cleanParams[key] = value;

backend/electron/windows.ts

···
   getIzuiCoordinator,
 } from './izui-state.js';
 
+import { publish, scopes } from './pubsub.js';
+
 /**
  * Get the appropriate background color based on system theme
  * This helps prevent the "white flash" when opening windows in dark mode
···
 }
 
 /**
+ * ESC unhandled policy: second-phase policy consulted ONLY after the renderer
+ * returns { handled: false } AND escPolicy() returns 'nothing'.
+ *
+ * Determines what to do when ESC has nowhere left to navigate.
+ * Pure function — no side effects.
+ */
+export function escUnhandledPolicy(sessionState: string, role: string): 'open-switcher' | 'nothing' {
+  // Only workspace windows in active or idle sessions open the switcher.
+  // Transient sessions should NOT trigger switcher — user expects ESC to
+  // return to previous app, not open more UI.
+  if (role === 'workspace' && (sessionState === 'active' || sessionState === 'idle')) return 'open-switcher';
+  return 'nothing';
+}
+
+/**
  * Core ESC handling logic for a BrowserWindow.
  * Called when ESC keyDown is detected on the window's own webContents
  * or on a webview guest webContents within the window.
···
 
   if (action === 'close' || action === 'close-and-restore') {
     closeOrHideWindow(bw.id);
+  } else {
+    // escPolicy returned 'nothing' — renderer is at root and window won't close.
+    // Consult second-phase policy for unhandled ESC.
+    const unhandledAction = escUnhandledPolicy(sessionState, role);
+    DEBUG && console.log(`[esc] escUnhandledPolicy(${sessionState}, ${role}) -> ${unhandledAction}`);
+    if (unhandledAction === 'open-switcher') {
+      publish('peek://system/', scopes.GLOBAL, 'cmd:execute:windows', {});
+    }
   }
-  // 'nothing' -> return silently (active workspace/content at root)
 }
 
 /**