diff --git a/src/main/mesh.js b/src/main/mesh.js
index 1192a7f7..29f2c032 100644
--- a/src/main/mesh.js
+++ b/src/main/mesh.js
@@ -150,14 +150,30 @@ function init() {
     // trigger space event binding
     call.space_init({ space: space, platform });
 
-    // CMMS embedding (not upstream): window.MESH_TOOL_CONFIG is set by the
-    // host page (public/mesh-edit.php) when this is launched job-scoped to
-    // repair one specific attachment, rather than the normal freestanding
-    // app. When present, load that file instead of restoring whatever
-    // workspace happened to be in this browser's local IndexedDB - the
-    // whole point of a job-scoped launch is "this exact file", not
-    // whatever was last open here.
-    if (self.MESH_TOOL_CONFIG && self.MESH_TOOL_CONFIG.loadUrl) {
+    // CMMS embedding (not upstream): the host page (public/mesh-edit.php)
+    // iframes this at /mesh/?cmms_load=...&cmms_save=...&cmms_owner=...
+    // &cmms_csrf=...&cmms_name=... when launched job-scoped to repair one
+    // specific attachment, rather than the normal freestanding app.
+    // Query params, not a window.MESH_TOOL_CONFIG global set by the parent
+    // frame: this app's own served index.html isn't something the CMMS
+    // renders, so there's no point to inject a <script> into before this
+    // module runs, and by the time an iframe's `load` event fires (the
+    // only parent->child signal available for a same-origin but
+    // externally-served page) this init() has already run. Query params
+    // are readable synchronously, before the "hide url params" cleanup
+    // below strips them - self.MESH_TOOL_CONFIG is still set from them
+    // here so util.download() (src/mesh/build.js) has one stable place to
+    // read from regardless of how config arrived.
+    const cmmsParams = new URLSearchParams(location.search);
+    const cmmsLoadUrl = cmmsParams.get('cmms_load');
+    if (cmmsLoadUrl) {
+        self.MESH_TOOL_CONFIG = {
+            loadUrl: cmmsLoadUrl,
+            saveUrl: cmmsParams.get('cmms_save'),
+            ownerToken: cmmsParams.get('cmms_owner'),
+            csrfToken: cmmsParams.get('cmms_csrf'),
+            originalName: cmmsParams.get('cmms_name'),
+        };
         motoClient.on('ready', () => cmms_load_from_url(self.MESH_TOOL_CONFIG));
     } else {
         // reload stored space when worker is ready