@@ -279,6 +279,11 @@ func e2eSplitHostPort(t *testing.T, serverURL string) (string, int) {
 func TestE2EFailoverOverRealBinary(t *testing.T) {
 	forEachEngine(t, func(t *testing.T, tc engineCase) {
 		bin := proxyBinary(t)
+		// The child inherits this environment, so a persisted port it loads on
+		// facade/enable comes from a temp dir, never the developer's config.
+		// It runs after the build, because go derives its module and build
+		// caches from these variables.
+		redirectConfigDir(t)
 
 		var gotBody string
 		busy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 
@@ -12,9 +12,12 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 	"time"
 
+	"nvpair-shared/appdir"
+	"nvpair-shared/engines"
 	"nvpair-shared/jsonrpc"
 )
 
@@ -30,6 +33,7 @@ var (
 	manualNodesBin  string
 	clusterMgrBin   string
 	schedulerBin    string
+	testsConfigBase string
 )
 
 func TestMain(m *testing.M) {
@@ -135,6 +139,19 @@ func TestMain(m *testing.M) {
 		log.Fatalf("build nvpair-job-scheduler: %v", err)
 	}
 
+	// Every child binary inherits this environment, so its persisted state
+	// (ports, workloads, settings) lands under tmpDir instead of the
+	// developer's real config. These are the variables appdir resolves
+	// through on each platform. They are set after the builds, because go
+	// derives its module and build caches from these variables.
+	testsConfigBase = filepath.Join(tmpDir, "config")
+	for _, key := range []string{"XDG_CONFIG_HOME", "HOME", "APPDATA", "LOCALAPPDATA"} {
+		if err := os.Setenv(key, testsConfigBase); err != nil {
+			os.RemoveAll(tmpDir)
+			log.Fatalf("set %s: %v", key, err)
+		}
+	}
+
 	code := m.Run()
 	os.RemoveAll(tmpDir)
 	os.Exit(code)
@@ -209,3 +226,104 @@ func waitForResponse(t *testing.T, ch <-chan jsonrpc.Message, timeout time.Durat
 	}
 	return jsonrpc.Message{}
 }
+
+// codeFacadeBindFailed mirrors the constant of the same name in nvpair-proxy:
+// facade/enable answers with it when the port was taken before it could bind.
+const codeFacadeBindFailed = -32010
+
+// requestOnFreePort sends the request that build makes for a free port and
+// returns the port the proxy accepted. freePort closes its probe before the
+// proxy binds, so another process can take the port first. A request refused
+// for that reason is retried on a new port; any other error fails the test.
+func requestOnFreePort(t *testing.T, w io.Writer, msgs <-chan jsonrpc.Message, timeout time.Duration, build func(port int) map[string]any) int {
+	t.Helper()
+	for attempt := 0; attempt < 8; attempt++ {
+		port := freePort(t)
+		req := build(port)
+		sendLine(t, w, req)
+		resp := waitForResponse(t, msgs, timeout)
+		if resp.Error == nil {
+			return port
+		}
+		if !isBindRace(resp.Error) {
+			t.Fatalf("%s failed: %v", req["method"], resp.Error)
+		}
+	}
+	t.Fatal("every probed port was taken before the proxy could bind it")
+	return 0
+}
+
+// isBindRace reports a request the proxy refused only because the port was
+// taken. facade/enable says so with codeFacadeBindFailed; set-port has no
+// dedicated code, so its bind error is matched by message.
+func isBindRace(e *jsonrpc.RPCError) bool {
+	return e.Code == codeFacadeBindFailed || strings.HasPrefix(e.Message, "failed to bind port")
+}
+
+// TestLMStudioFacadeChildPersistsUnderPrivateBase proves a real proxy child
+// writes its persisted LM Studio port under the TestMain config base, so no
+// cross-process test can clobber the developer's saved port.
+func TestLMStudioFacadeChildPersistsUnderPrivateBase(t *testing.T) {
+	cmd := exec.Command(proxyBin)
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = stdin.Close()
+		_ = cmd.Process.Kill()
+		_ = cmd.Wait()
+	}()
+	msgs := startMsgReader(stdout)
+
+	requestOnFreePort(t, stdin, msgs, 10*time.Second, func(port int) map[string]any {
+		return map[string]any{
+			"jsonrpc": "2.0",
+			"id":      1,
+			"method":  "facade/enable",
+			"params": map[string]any{
+				"engine":              "lmstudio",
+				"port":                port,
+				"ignorePersistedPort": true,
+			},
+		}
+	})
+
+	persistedPort := requestOnFreePort(t, stdin, msgs, 5*time.Second, func(port int) map[string]any {
+		return map[string]any{
+			"jsonrpc": "2.0",
+			"id":      2,
+			"method":  engines.AddressMethod("lmstudio", "set-port"),
+			"params":  map[string]any{"port": port},
+		}
+	})
+
+	path, err := appdir.Path("lmstudio-proxy-port.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	rel, err := filepath.Rel(testsConfigBase, path)
+	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
+		t.Fatalf("lmstudio port path %q is outside test config base %q", path, testsConfigBase)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read persisted lmstudio port: %v", err)
+	}
+	var saved struct {
+		Port int `json:"port"`
+	}
+	if err := json.Unmarshal(data, &saved); err != nil {
+		t.Fatalf("parse persisted lmstudio port: %v", err)
+	}
+	if saved.Port != persistedPort {
+		t.Fatalf("persisted lmstudio port = %d, want %d", saved.Port, persistedPort)
+	}
+}