Summary

Each browsing context (Work, Personal, etc.) now gets a dedicated WKWebsiteDataStore keyed by a stable UUID, ensuring separate WebContent OS processes per context. This prevents cross-context cookie/storage/cache leakage — even through renderer exploits.

What changed

settings.rs — UUID infrastructure + migration

• DEFAULT_STORE_UUID constant for the shared default context
• generate_store_uuid() using OS CSPRNG via getrandom (collision-resistant)
• parse_store_uuid() / format_store_uuid() for hex encoding
• SessionContext.store_uuid: Option field with serde default
• data_store_uuid() -> parse-only Option<[u8; 16]> (fail-closed on malformed hex)
• Migration in SettingsGlobal::load() repairs missing and malformed UUIDs

tabs.rs — WebView creation wiring

• WebViewTab::new() accepts store_uuid: Option<[u8; 16]>, calls builder.with_data_store_identifier(uuid) via WebViewBuilderExtDarwin
• Fail-closed isolation: store_uuid.is_none() -> incognito (covers private tabs, deleted contexts, macOS <14)
• macos_14_or_later() runtime gate — older macOS degrades to incognito with log warning
• Context creation in Settings UI generates UUID at creation time

workbench.rs — Context resolution + all call sites

• resolve_store_uuid() maps context_id -> UUID bytes (None -> None, "default" -> fixed UUID, named -> from settings)
• Unknown/deleted contexts return None -> fail to incognito (not shared default store)
• isolated_tabs now takes precedence over named contexts (privacy-first)
• All 5 WebView creation paths wired: open_webview, open_webview_background, "Open in Context" menu, "Open Private" menu, restore_session

Security model