The current "Create a new outer and brain-transplant the old outer into a CCW" approach doesn't work in this case. What needs to happen instead is presumably that we create a new outer (so that we have the invariant that the outer's global is the current inner's global) and then brain-transplant the old outer into the new outer.

Isn't that what already happens right now? I think this situation also comes up with system windows and while debugging some issues there I noticed we do what you described in comment 0 (brain-transplant two outers, no CCWs).

Isn't that what already happens right now?

Yes, it is, based on reading the code. OK, good.

The remaining question is whether everyone can handle a Window whose WindowProxy is different-Realm from the Window (but same-compartment). I just audited all callsites of js::ToWindowProxyIfWindow and they all look OK. Going the other direction (js::ToWindowIfWindowProxy) doesn't change global. So I think we're good here...