diff --git a/TESTING_AND_MODIFICATION_GUIDE.md b/TESTING_AND_MODIFICATION_GUIDE.md
index f3b0a0beb..c4e38711c 100644
--- a/TESTING_AND_MODIFICATION_GUIDE.md
+++ b/TESTING_AND_MODIFICATION_GUIDE.md
@@ -196,7 +196,7 @@ the heading, and the rule gets a `(rationale)` marker.
 | Concern | Code | Spec |
 |---|---|---|
 | Strip look, tabs, menus, rename, indicators | `lib/src/components/WorkspaceStrip.tsx`, `workspace-strip-drag.ts`, stories in `lib/src/stories/` | `docs/specs/layout.md` → Workspaces; `standalone.md` → AppBar; `alert.md` → Workspace union |
-| Shared Workspace kill confirmation and iframe move gate | `lib/src/components/WorkspaceKillConfirm.tsx` ("Confirm kill workspace"), `lib/src/components/WorkspaceStrip.tsx` (`pendingClose` and the iframe `pendingMove` gate), `standalone/src/WorkspaceTeardownModal.tsx` (window close / app quit), `lib/src/lib/workspace-ui-store.ts` | `layout.md` → Workspaces; `standalone.md` → Confirmation UI |
+| Shared Workspace kill confirmation and iframe move gate | `lib/src/components/WorkspaceKillConfirm.tsx` ("Confirm kill workspace"), `lib/src/components/WorkspaceStrip.tsx` (`confirmation`), `standalone/src/WorkspaceTeardownModal.tsx` (window close / app quit), `lib/src/lib/workspace-ui-store.ts` | `layout.md` → Workspaces; `standalone.md` → Confirmation UI |
 | Command-mode keys (`c n p l 1-9 W & !` etc.) | `lib/src/components/wall/keyboard/handle-workspace-shortcuts.ts` | `layout.md` → Workspaces, `shortcuts.md` |
 | Composition, active/hidden Wall, input gating | `lib/src/components/WorkspaceWindow.tsx`, `Wall.tsx` (`WorkspaceActiveContext`) | `layout.md` → Workspaces |
 | Hidden-Workspace terminal minimize | `lib/src/components/TerminalPane.tsx` mount effect (gated on `workspaceActive`), `lib/src/lib/terminal-lifecycle.ts` (`mountElement`/`unmountElement`), `terminal-webgl.ts` | `layout.md` → Workspaces, Renderer; `layout.rationale.md` → Workspaces |
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 12f57087a..1868527c1 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -254,7 +254,7 @@ Source of truth: `createWorkspaceMotion` in `lib/src/components/workspace-motion
 - **Must offer `+` and New workspace only when the source has more than one Surface**, counting Panes and Doors; create a receiving Wall with only the moved Surface. Disable the picker item and `+` drop otherwise, and refuse CLI `--new`.
 - **Must offer Move to workspace in terminal and Tool context** (placement: the Title row above), using the same coordinator as dragging. **Never add a browser context menu. Never add a command-mode move binding.** Browser Surfaces move by dragging or CLI.
 - **Must retain stable Surface identity and Session state while remounting in the destination Wall**: terminals keep their registry instance, browser automation reconnects, and a retained helper follows its source. Never close a departing Session. Pin a moved preview slot by removing its preview mark.
-- **Must confirm plain iframe and serving iframe Tool moves before creating a destination or changing membership**, with a stable random character over the Window content area. Doors remain minimized while waiting. Show “moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page”; the prompted character confirms, anything else cancels. Saved URLs are last-known URLs, not necessarily the page's current location. CLI consent follows `docs/specs/dor-cli.md` → dor move.
+- **Must confirm plain iframe and serving iframe Tool moves before creating a destination or changing membership**, with a stable random character over the Window content area ([one pending confirmation](#workspace-lifecycle)). Doors remain minimized while waiting. Show “moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page”; the prompted character confirms, anything else cancels. Saved URLs are last-known URLs, not necessarily the page's current location. CLI consent follows `docs/specs/dor-cli.md` → dor move.
 - **Must refuse dirty Tools, pending Tool approval, browser startup, closing Surfaces/Workspaces and helper promotion**, rechecking after consent and asynchronous preparation. Dirty/pending refusals cannot be bypassed by iframe consent.
 - **Must follow a GUI move into destination passthrough** (acknowledgement: `docs/specs/alert.md` → Workspace union); CLI focus policy follows `docs/specs/dor-cli.md` → dor move. Remove a source with no Panes or Doors; if Doors remain but no pane does, refill normally.
 - **Must prepare before departure and roll back failed adoption**, restoring layout, Doors, parked state, selection, zoom, metadata and refs. Ref allocation belongs to `docs/specs/dor-cli.md` → Handle Model; coordinated durable publication belongs to `docs/specs/transport.md` → Persisted session types; Activity follows `docs/specs/alert.md` → Workspace union.
@@ -296,17 +296,22 @@ nothing (`iframeSurfaceRefs` on the Wall handle; `standalone/src/workspace-drag.
 - **Must drop the closing Workspace’s rename editor and pending confirmation, and no other’s** (`releases the rename lease when the tab being renamed is middle-clicked closed` in `lib/src/components/WorkspaceStrip.test.tsx`; `preserves another Workspace’s rename and close confirmation when closing a sibling` in `lib/src/components/wall/workspace-lifecycle.test.ts`).
 - **Every Workspace verb runs outside the strip**, which renders the rename editor and confirmation from a store, so tab gestures and `dor` commands take one path.
 
-**Must use `WorkspaceKillConfirm` for Workspace close, the iframe move gate,
+**Must use `WorkspaceKillConfirm` for Workspace close, the iframe move gates,
 and host termination confirmations**, titled “Confirm kill workspace” except the
-move gate: **a bare matching letter confirms, another bare key cancels, and a
+move gates: **a bare matching letter confirms, another bare key cancels, and a
 modifier or chord never answers**, so `Cmd+Q` still quits. **Must ignore
-its confirmation key while that Workspace transfers.** A successful transfer
-dismisses only the departing Workspace's pending close, move, and rename UI;
-a failed transfer retains them. No pending kill follows a Workspace to its
+the close confirmation's key while that Workspace transfers.**
+**Must hold at most one pending Workspace confirmation** (close, cross-Window
+move gate, Surface move iframe consent), **answered no when a newer one is
+raised or any close, cross-Window move, or Surface move starts**, by gesture or
+`dor`, even one that refuses. **Must abandon superseded preparation while awaiting a Wall, window probe or editor decision**, so an older verb cannot later act or replace the newer question. A move refusal waits behind it and rename
+(`lib/src/components/WorkspaceWindow.test.tsx`, `lib/src/lib/workspace-ui-store.test.ts`).
+A successful transfer dismisses only the departing Workspace's pending
+confirmation and rename UI; a failed transfer retains them. No pending kill follows a Workspace to its
 destination. Pinned by `does not accept a pending kill during transfer and releases its keyboard lease on departure`
 in `lib/src/components/WorkspaceStrip.test.tsx` and `keeps the pending kill until commit, then dismisses only the departing Workspace`
 in `lib/src/components/wall/workspace-transfer.test.ts`.
-Source of truth: `dismissWorkspaceUi` in `lib/src/lib/workspace-ui-store.ts`;
+Source of truth: `requestConfirmation` / `cancelPendingConfirmation` / `dismissWorkspaceUi` in `lib/src/lib/workspace-ui-store.ts`;
 `prepareWorkspaceTransfer` in `lib/src/components/wall/workspace-transfer.ts`.
 
 The union projection and its indicators are owned by `docs/specs/alert.md` → Workspace union; the strip that renders them by `docs/specs/standalone.md` → AppBar. Persisted containers are owned by `docs/specs/transport.md`: standalone stores one `PersistedWindow` per window, so a relaunch restores every Workspace ([Session persistence](#session-persistence)).
@@ -355,7 +360,7 @@ That order is load-bearing twice: a rename input suppresses the pane shortcuts b
 
 **Every open dialog holds its own reference-counted lease on that gate**, and command-mode dispatch resumes only once the last lease is released — so a dialog closing over another cannot lift the survivor's suppression (`createDialogKeyboardCoordinator` in `lib/src/components/wall/wall-context.tsx`).
 
-**Must defer Workspace close and move confirmations while an inline Workspace rename editor is open**, leaving its keys to the input; the pending gate appears after rename ends. Pinned by `defers the %s gate while another Workspace is being renamed` in `lib/src/components/WorkspaceStrip.test.tsx`.
+**Must defer the pending Workspace confirmation while an inline Workspace rename editor is open**, leaving its keys to the input; it appears after rename ends. Pinned by `defers the %s gate while another Workspace is being renamed` in `lib/src/components/WorkspaceStrip.test.tsx`.
 
 **Chrome outside every Wall takes the chrome keyboard lease instead**: the Workspace strip's rename editor and close confirmation live in the app bar, where `stopPropagation` cannot reach a capture-phase window listener. **The Workspace branch is inert on a Wall with no Workspace id**, which is what leaves those keys unbound on a bare Wall. Source of truth: `acquireChromeKeyboardLease` in `lib/src/components/wall/chrome-keyboard-lease.ts`; `handleWorkspaceShortcuts` in `lib/src/components/wall/keyboard/handle-workspace-shortcuts.ts`.
 
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index e270184ca..892b964a1 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -243,7 +243,7 @@ Source of truth: `ManagedVoicePort` in `lib/src/lib/platform/managed-voice-types
 
 **Each mounted Workspace publishes its `PersistedSession` to a Window collector**, which orders them by the Workspace store and writes the whole Window through one debounced writer the host installs at boot. **A Workspace with neither a published nor a boot-seeded session is dropped rather than written empty**, so a snapshot taken mid-boot cannot replace a restored Workspace with a blank one. **A Workspace's save compares against its own previous record** — seeded from disk until its Wall publishes — never the Window's active one, or a dead PTY's retained cwd and alert would come from the wrong Workspace. **Reordering, renaming, or switching the active Workspace writes too**: each changes the blob with no Session changing. A `PersistedWorkspace` is a `WorkspaceId`, a `name`, `nameIsAuto`, and that Workspace's `PersistedSession`. **Always write `nameIsAuto`**; lacking it, only a `Workspace <n>` name is auto. The top-level snapshot is a `PersistedWindow` (its own `version: 1`) wrapping v3 sessions: the ordered `PersistedWorkspace` list plus the active `WorkspaceId`. **VS Code does not use it** — each webview persists one bare `PersistedSession`, its single Workspace, through its own per-surface state API (`docs/specs/vscode.md`).
 
-**Must publish both Workspace records together across a Surface move**, fencing saves collected before ownership changed and retaining a departed Session's previous cwd/alert in the destination. Window writes are held until both records publish or the move rolls back. Source of truth: `beginWorkspaceSessionBatch` / `invalidateWorkspaceSaves` / `moveRetainedSurfaceRecord` in `lib/src/lib/window-session-aggregator.ts`; `doSave` in `lib/src/components/wall/use-session-persistence.ts`.
+**Must publish both Workspace records in one synchronous step with the Surface move's ownership change**, unprobed and behind one Window write (`pagehide` included), fencing saves collected before or during the ownership change and retaining a departed Session's previous cwd/alert in the destination. Source of truth: `publishWorkspaceSessions` / `invalidateWorkspaceSaves` / `moveRetainedSurfaceRecord` in `lib/src/lib/window-session-aggregator.ts`; `serializeNow` / `doSave` in `lib/src/components/wall/use-session-persistence.ts`; `assemblePersistedSession` in `lib/src/lib/session-save.ts`.
 
 **The Window wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` owns the JSON and the storage slot over a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence); the shared save/restore code still operates on a bare `PersistedSession`, which the boot hands it per Workspace. **A Window-persisting adapter answers through `getWindowState` / `saveWindowState`, and answers nothing on the bare-Session `getState` / `saveState` pair** — its blob is a Window and every shared reader of `getState` wants a Session. **A blob written before standalone persisted Windows is wrapped as the window's one Workspace**; that is the only migration.
 
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 469525ab5..9be8420bd 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1768,7 +1768,8 @@ export function Wall({
   // re-render never replaces a registered entry.
   // Capture before a synchronous commit. Rollback restores the complete Wall,
   // including a Door's held rect and the ref allocator, without killing Sessions.
-  const captureMoveRollback = (incomingId?: string) => {
+  // It runs only before `finishSurfaceMove`, so no refill has mounted a shell.
+  const captureMoveRollback = () => {
     const snapshot = lath.store.getSnapshot();
     const savedDoors = doorsRef.current;
     const refs = new Map(dorSurfaceRefsRef.current);
@@ -1780,10 +1781,6 @@ export function Wall({
     const context = terminalContextRef.current;
     return () => {
       movingSurfaceRef.current = true;
-      // A temporary auto-refill may already have mounted its default shell.
-      for (const member of memberSurfaceIds()) {
-        if (member !== incomingId && !snapshot.leafMeta.has(member)) disposeSession(member);
-      }
       doorsRef.current = savedDoors; setDoors(savedDoors);
       dorSurfaceRefsRef.current = refs; nextDorSurfaceRefIndexRef.current = next;
       lath.store.restoreSnapshot(snapshot);
@@ -1833,7 +1830,7 @@ export function Wall({
     },
     adoptSurfaceMove: (id, meta) => {
       if (ownsSurface(id) || closingWorkspaceRef.current) throw new Error('The destination cannot accept this Surface');
-      const rollback = captureMoveRollback(id);
+      const rollback = captureMoveRollback();
       movingSurfaceRef.current = true;
       const ref = livePaneId();
       if (!lath.store.addLeaf(id, meta, ref ? { refId: ref, edge: lath.store.autoEdgeFor(ref) } : null).ok) throw new Error('Could not place the Surface');
@@ -1850,7 +1847,7 @@ export function Wall({
       else enterTerminalMode(id);
     },
     showMoveNotice: (id, text) => showShellSpawnNotice(id, text, 8000),
-    serializePersistence: persistence.serialize,
+    serializeNow: persistence.serializeNow,
 
     surfaceIds: memberSurfaceIds,
     ownsSurface,
diff --git a/lib/src/components/WorkspaceStrip.test.tsx b/lib/src/components/WorkspaceStrip.test.tsx
index 3b5076d61..49ec0b348 100644
--- a/lib/src/components/WorkspaceStrip.test.tsx
+++ b/lib/src/components/WorkspaceStrip.test.tsx
@@ -8,7 +8,7 @@ import { WorkspaceStrip } from './WorkspaceStrip';
 import { chromeKeyboardHeld, resetChromeKeyboardLeases } from './wall/chrome-keyboard-lease';
 import { registerWallHandle, resetWallHandles, stubWallHandle, type WallHandle } from './wall/wall-handles';
 import { ensureResizeObserver } from './wall/wall-test-utils';
-import { requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
+import { requestWorkspaceClose, requestWorkspaceRename, workspaceCloseConfirmation } from './wall/workspace-lifecycle';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../lib/workspace-surfaces';
 import { clearTerminalActivity, setTerminalActivity } from '../lib/terminal-registry';
 import { createAlertEpisode } from '../lib/alert-episode';
@@ -18,8 +18,7 @@ import {
   getWorkspaceUiSnapshot,
   dismissWorkspaceUi,
   resetWorkspaceUi,
-  setPendingWorkspaceClose,
-  setPendingWorkspaceMove,
+  requestConfirmation,
   setWorkspaceMoveError,
 } from '../lib/workspace-ui-store';
 import {
@@ -525,8 +524,7 @@ describe('WorkspaceStrip', () => {
     await render();
     await act(async () => { requestWorkspaceRename(first); });
     await act(async () => {
-      if (kind === 'close') setPendingWorkspaceClose({ id: 'ws-2', char: 'q' });
-      else setPendingWorkspaceMove({ id: 'ws-2', char: 'q', iframeCount: 1, proceed });
+      requestConfirmation(kind === 'close' ? workspaceCloseConfirmation('ws-2', 'q') : { id: 'ws-2', char: 'q', answer: ok => { if (ok) void proceed(); } });
     });
     const input = container.querySelector<HTMLInputElement>(`[data-workspace-rename-for="${first}"]`)!;
     expect(document.body.querySelector('#kill-confirm-title')).toBeNull();
@@ -540,7 +538,7 @@ describe('WorkspaceStrip', () => {
     expect(proceed).toHaveBeenCalledOnce();
   });
 
-  it('keeps the move gate behind a close confirmation, and ignores modifiers and chords', async () => {
+  it('answers the pending confirmation no when a newer one is raised, and ignores modifiers and chords', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     await act(async () => { createWorkspace({ id: 'ws-2' }); });
     stubHandle(first);
@@ -548,7 +546,8 @@ describe('WorkspaceStrip', () => {
     stubHandle('ws-2', { closeAll: closed });
     await render();
     const proceed = vi.fn();
-    await act(async () => { setPendingWorkspaceMove({ id: first, char: 'k', iframeCount: 1, proceed }); });
+    const move = vi.fn((ok: boolean) => { if (ok) proceed(); });
+    await act(async () => { requestConfirmation({ id: first, char: 'k', title: 'Move and lose page state?', answer: move }); });
     expect(document.body.querySelector('#kill-confirm-title')).not.toBeNull();
 
     // A bare modifier or a chord is never an answer, even on the gate's letter.
@@ -559,27 +558,22 @@ describe('WorkspaceStrip', () => {
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', ctrlKey: true, bubbles: true }));
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', metaKey: true, bubbles: true }));
     });
-    expect(proceed).not.toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingMove).not.toBeNull();
+    expect(move).not.toHaveBeenCalled();
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBeNull();
 
-    // A close raised over it shows its own letter; the same letter typed at it
-    // closes and must not also move, however the two were minted.
-    await act(async () => { setPendingWorkspaceClose({ id: 'ws-2', char: 'k' }); });
+    // A close raised over it answers the move no; the same letter typed at the
+    // close closes and must not also move, however the two were minted.
+    await act(async () => { requestConfirmation(workspaceCloseConfirmation('ws-2', 'k')); });
+    expect(move).toHaveBeenCalledExactlyOnceWith(false);
+    expect(document.body.querySelector('#kill-confirm-title')?.textContent).toBe('Confirm kill workspace');
     await act(async () => {
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', bubbles: true }));
     });
     await act(async () => { await Promise.resolve(); });
     expect(closed).toHaveBeenCalledTimes(1);
     expect(proceed).not.toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingMove).not.toBeNull();
-
-    // With the close resolved the gate is armed again, and its letter moves.
-    await act(async () => {
-      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', bubbles: true }));
-    });
-    expect(proceed).toHaveBeenCalledTimes(1);
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+    expect(document.body.querySelector('#kill-confirm-title')).toBeNull();
   });
 
   it('releases the rename lease when the tab being renamed is middle-clicked closed', async () => {
@@ -637,13 +631,13 @@ describe('WorkspaceStrip', () => {
     const closeAll = vi.fn(async () => null);
     stubHandle('ws-2', { hasTouchedSurfaces: () => true, closeAll });
     await render();
-    await act(async () => { setPendingWorkspaceClose({ id: 'ws-2', char: 'q' }); });
+    await act(async () => { requestConfirmation(workspaceCloseConfirmation('ws-2', 'q')); });
     expect(document.body.querySelector('#kill-confirm-title')?.textContent).toBe('Confirm kill workspace');
     expect(chromeKeyboardHeld()).toBe(true);
     setWorkspaceTransferPending('ws-2', true);
     await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'q', bubbles: true })); });
     expect(closeAll).not.toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-2');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-2');
     // A failed transfer leaves this prompt usable; successful commit dismisses it.
     setWorkspaceTransferPending('ws-2', false);
     await act(async () => { dismissWorkspaceUi('ws-2'); });
diff --git a/lib/src/components/WorkspaceStrip.tsx b/lib/src/components/WorkspaceStrip.tsx
index 738004eae..74fdfc87b 100644
--- a/lib/src/components/WorkspaceStrip.tsx
+++ b/lib/src/components/WorkspaceStrip.tsx
@@ -20,16 +20,14 @@ import { createWorkspaceStripDrag, type StripDragHost } from './workspace-strip-
 import { acquireChromeKeyboardLease } from './wall/chrome-keyboard-lease';
 import { getWallHandle } from './wall/wall-handles';
 import { useDialogKeyboardOwner } from './wall/wall-context';
-import { closeWorkspaceWithSurfaces, enterWorkspace, requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
+import { enterWorkspace, requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
 import { getActivitySnapshot, subscribeToActivity } from '../lib/terminal-registry';
 import { getWorkspaceSurfacesSnapshot, subscribeToWorkspaceSurfaces } from '../lib/workspace-surfaces';
 import { computeWorkspaceUnion, type WorkspaceUnion } from '../lib/workspace-union';
 import { spotlightTodo } from '../lib/todo-spotlight';
-import { isWorkspaceTransferPending } from '../lib/window-session-aggregator';
 import {
   getWorkspaceUiSnapshot,
-  setPendingWorkspaceClose,
-  setPendingWorkspaceMove,
+  settleConfirmation,
   setWorkspaceMoveError,
   setRenamingWorkspace,
   subscribeToWorkspaceUi,
@@ -72,7 +70,7 @@ export function WorkspaceStrip({
   const { workspaces, activeId } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
   const membership = useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
   const activity = useSyncExternalStore(subscribeToActivity, getActivitySnapshot);
-  const { renamingId, pendingClose, pendingMove, pendingSurfaceMove, moveError } = useSyncExternalStore(subscribeToWorkspaceUi, getWorkspaceUiSnapshot);
+  const { renamingId, confirmation, moveError } = useSyncExternalStore(subscribeToWorkspaceUi, getWorkspaceUiSnapshot);
   const [draggingId, setDraggingId] = useState<WorkspaceId | null>(null);
 
   const stripRef = useRef<HTMLDivElement>(null);
@@ -80,7 +78,7 @@ export function WorkspaceStrip({
 
   // The editor and the confirmation both sit outside every Wall, so a
   // capture-phase command-mode shortcut would still fire behind them.
-  useDialogKeyboardOwner(renamingId !== null || pendingClose !== null || pendingMove !== null || pendingSurfaceMove !== null || moveError !== null, acquireChromeKeyboardLease);
+  useDialogKeyboardOwner(renamingId !== null || confirmation !== null || moveError !== null, acquireChromeKeyboardLease);
 
   const activate = useCallback((id: WorkspaceId) => {
     getWallHandle(id)?.enterCommandMode();
@@ -160,8 +158,8 @@ export function WorkspaceStrip({
   // confirmation lands in the same place whichever Workspace it is about. No
   // Window (Storybook) leaves it viewport-centered.
   const confirmTarget = useMemo(
-    () => (pendingClose || pendingMove || pendingSurfaceMove || moveError ? document.querySelector<HTMLElement>('[data-workspace-content]') : null),
-    [pendingClose, pendingMove, pendingSurfaceMove, moveError],
+    () => (confirmation || moveError ? document.querySelector<HTMLElement>('[data-workspace-content]') : null),
+    [confirmation, moveError],
   );
 
   // One union per tab, computed in the loop it is rendered in: every tab shows
@@ -232,11 +230,10 @@ export function WorkspaceStrip({
       >
         <PlusIcon size={12} weight="bold" aria-hidden="true" />
       </button>
-      {/* Rename owns its input until it ends; both typed gates wait behind it.
-          The move gate is the same typed letter (the page state it destroys is
-          as gone as a killed pane's process) and waits behind a close, so only
-          one gate ever listens for the letter on screen. */}
-      {moveError && !pendingSurfaceMove && !pendingClose && !pendingMove && !renamingId && (
+      {/* Rename owns its input until it ends, and the confirmation waits behind
+          it; a refusal waits behind both (`docs/specs/layout.md` → "Workspace
+          lifecycle"). */}
+      {moveError && !confirmation && !renamingId && (
         <ModalFrame titleId="workspace-move-error" targetElement={confirmTarget}
           onEscape={() => setWorkspaceMoveError(null)} className={clsx("w-80 max-w-full overflow-auto text-sm", OVERLAY_MAX_HEIGHT.modal)}>
           <h2 id="workspace-move-error" className="mb-2 font-semibold">Move could not complete</h2>
@@ -244,40 +241,16 @@ export function WorkspaceStrip({
           <button type="button" className={modalActionButton()} onClick={() => setWorkspaceMoveError(null)}>Close</button>
         </ModalFrame>
       )}
-      {pendingClose && !pendingSurfaceMove && !renamingId && (
+      {confirmation && !renamingId && (
         <WorkspaceKillConfirm
-          char={pendingClose.char}
-          detail={workspaces.find(workspace => workspace.id === pendingClose.id)?.name}
-          canConfirm={() => !isWorkspaceTransferPending(pendingClose.id)}
-          onConfirm={() => {
-            const id = pendingClose.id;
-            setPendingWorkspaceClose(null);
-            void closeWorkspaceWithSurfaces(id);
-          }}
+          char={confirmation.char}
+          title={confirmation.title}
+          detail={confirmation.detail}
+          cancelHint={confirmation.cancelHint}
+          canConfirm={confirmation.canConfirm}
           targetElement={confirmTarget}
-          onCancel={() => setPendingWorkspaceClose(null)}
-        />
-      )}
-      {pendingSurfaceMove && (
-        <WorkspaceKillConfirm char={pendingSurfaceMove.char} targetElement={confirmTarget}
-          title="Move iframe?"
-          detail="moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page."
-          cancelHint="anything else to cancel"
-          onConfirm={() => pendingSurfaceMove.answer(true)}
-          onCancel={() => pendingSurfaceMove.answer(false)} />
-      )}
-      {pendingMove && !pendingSurfaceMove && !pendingClose && !renamingId && (
-        <WorkspaceKillConfirm
-          char={pendingMove.char}
-          targetElement={confirmTarget}
-          title="Move and lose page state?"
-          detail={`${pendingMove.iframeCount === 1 ? 'An iframe Surface' : `${pendingMove.iframeCount} iframe Surfaces`} in this Workspace will reload at ${pendingMove.iframeCount === 1 ? 'its' : 'their'} saved URL; a page cannot leave its window.`}
-          onConfirm={() => {
-            const { proceed } = pendingMove;
-            setPendingWorkspaceMove(null);
-            proceed();
-          }}
-          onCancel={() => setPendingWorkspaceMove(null)}
+          onConfirm={() => settleConfirmation(confirmation, true)}
+          onCancel={() => settleConfirmation(confirmation, false)}
         />
       )}
     </div>
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index deb03d105..3fa312bc9 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -27,11 +27,12 @@ import { FakePtyAdapter } from '../lib/platform/fake-adapter';
 import { getActivitySnapshot, setTerminalActivity } from '../lib/terminal-registry';
 import { createAlertEpisode } from '../lib/alert-episode';
 import { getWallHandle, listWallHandles, resetWallHandles } from './wall/wall-handles';
+import * as wallHandles from './wall/wall-handles';
 import { resetWorkspaceBootPlans, setWorkspaceBootPlan } from './wall/workspace-boot-plans';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { getWorkspaceSurfacesSnapshot, resetWorkspaceSurfaces } from '../lib/workspace-surfaces';
-import { previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator, seedWindowSession, setWorkspaceTransferPending } from '../lib/window-session-aggregator';
-import { getWorkspaceUiSnapshot, resetWorkspaceUi } from '../lib/workspace-ui-store';
+import { isWorkspaceTransferPending, previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator, seedWindowSession, setWorkspaceTransferPending } from '../lib/window-session-aggregator';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, settleConfirmation } from '../lib/workspace-ui-store';
 import { resetTodoSpotlight } from '../lib/todo-spotlight';
 import {
   closeWorkspace,
@@ -160,23 +161,23 @@ describe('WorkspaceWindow', () => {
     expect(getActiveWorkspaceId()).toBe(first);
     await press(killKey);
     expect(getActiveWorkspaceId()).toBe('ws-2');
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-2');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-2');
     expect(leafIdsIn('ws-2')).toHaveLength(1);
     await press('Escape');
     expect(getWorkspacesSnapshot().workspaces).toHaveLength(3);
     await close();
-    await press(getWorkspaceUiSnapshot().pendingClose!.char);
+    await press(getWorkspaceUiSnapshot().confirmation!.char);
     await flush();
     expect(getActiveWorkspaceId()).toBe('ws-3');
     expect(getWorkspacesSnapshot().workspaces.map(workspace => workspace.id)).toEqual([first, 'ws-3']);
     await close();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-3');
-    await press(getWorkspaceUiSnapshot().pendingClose!.char);
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-3');
+    await press(getWorkspaceUiSnapshot().confirmation!.char);
     await flush();
     expect(getActiveWorkspaceId()).toBe(first);
     await close();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe(first);
-    await press(getWorkspaceUiSnapshot().pendingClose!.char);
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe(first);
+    await press(getWorkspaceUiSnapshot().confirmation!.char);
     const replacement = getActiveWorkspaceId();
     expect(replacement).not.toBe(first);
     expect(getWorkspacesSnapshot().workspaces).toHaveLength(1);
@@ -184,7 +185,7 @@ describe('WorkspaceWindow', () => {
     expect(getWallHandle(first)).toBeNull();
     expect(leafIdsIn(replacement)).not.toContain('pane-a');
     await close();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe(replacement);
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe(replacement);
   });
 
   it('returns from the successor tab to pane navigation after a Workspace close', async () => {
@@ -296,7 +297,7 @@ describe('WorkspaceWindow', () => {
       expect(getActiveWorkspaceId()).toBe(first);
       expect(getWorkspacesSnapshot().workspaces).toHaveLength(2);
       expect(getWorkspaceUiSnapshot().renamingId).toBeNull();
-      expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+      expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
       expect(wallFor(first).querySelector('[data-focused="true"]')).toBeNull();
     }
     await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: '2', bubbles: true, cancelable: true })); });
@@ -968,6 +969,23 @@ describe('Surface moves between Workspaces', () => {
     expect(respond).toHaveBeenCalledWith(expect.objectContaining({ ok: false }));
   });
 
+  it('fences a save collected during adoption before the retained cwd migrates', async () => {
+    const source = await twoWalls();
+    publishWorkspaceSession(source, { version: 3, panes: [{ id: 'pane-a', title: 'exited', cwd: '/retained' }, { id: 'pane-b', title: 'other' }] });
+    const target = getWallHandle('ws-2')!;
+    const finish = target.finishSurfaceMove;
+    let duringCommit!: Promise<void>;
+    vi.spyOn(target, 'finishSurfaceMove').mockImplementation(() => {
+      finish();
+      duringCommit = target.flushPersistence({ probeCwd: false });
+    });
+    await act(async () => {
+      await moveSurface('pane-a', request({ workspace: 'workspace:2' }));
+      await duringCommit;
+    });
+    expect(previousWorkspaceSession('ws-2')?.panes.find(pane => pane.id === 'pane-a')?.cwd).toBe('/retained');
+  });
+
   it('routes a moved dor caller to its destination: short refs can name another pane and ensure can duplicate work left behind', async () => {
     const source = await twoWalls();
     terminalRegistry.seedTerminalManualCwd('pane-b', '/repo');
@@ -1021,10 +1039,21 @@ describe('Surface moves between Workspaces', () => {
     await act(async () => { await expect(moveSurface('pane-a', request({ workspace: 'workspace:2' }))).rejects.toThrow('placement failed'); });
     expect(getWallHandle(source)!.surfaceIds()).toEqual(['pane-a', 'pane-b']);
     expect(target.surfaceIds()).toEqual(['pane-x']);
-    expect((await getWallHandle(source)!.serializePersistence({ probeCwd: false })).surfaceRefs).toEqual({ 'pane-a': 'surface:1', 'pane-b': 'surface:2' });
+    expect(getWallHandle(source)!.serializeNow().surfaceRefs).toEqual({ 'pane-a': 'surface:1', 'pane-b': 'surface:2' });
     adoption.mockRestore();
   });
 
+  it('refuses a move to a new Workspace whose Wall is not registered synchronously, and discards it', async () => {
+    const source = await twoWalls();
+    const real = wallHandles.getWallHandle;
+    vi.spyOn(wallHandles, 'getWallHandle').mockImplementation(id => id === source || id === 'ws-2' ? real(id) : null);
+    await act(async () => { await expect(moveSurface('pane-a', request({ new: true }))).rejects.toThrow('The new Workspace did not mount'); });
+    vi.mocked(wallHandles.getWallHandle).mockRestore();
+    expect(getWorkspacesSnapshot().workspaces.map(ws => ws.id)).toEqual([source, 'ws-2']);
+    expect(getWallHandle(source)!.surfaceIds()).toEqual(['pane-a', 'pane-b']);
+    expect(getActiveWorkspaceId()).toBe(source);
+  });
+
   it('fences a pre-departure save collected during new Workspace mounting', async () => {
     const source = await twoWalls();
     let finishProbe!: (cwd: string | null) => void;
@@ -1091,10 +1120,10 @@ describe('Surface moves between Workspaces', () => {
     await act(async () => { await expect(moveSurface('frame', request({ workspace: 'workspace:2' }))).rejects.toThrow('dangerously-destroy'); });
     let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
     await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
-    expect(getWorkspaceUiSnapshot().pendingSurfaceMove).not.toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBeNull();
     expect(document.body.textContent).toContain('saved URL');
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
-    await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(false); await pending; });
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, false); await pending; });
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
     if (kind === 'tool') {
       recordToolDirty('frame', true);
@@ -1102,15 +1131,78 @@ describe('Surface moves between Workspaces', () => {
       recordToolDirty('frame', false);
       await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
       recordToolDirty('frame', true);
-      await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(true); await expect(pending).rejects.toThrow('edits'); });
+      await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, true); await expect(pending).rejects.toThrow('edits'); });
       expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
       recordToolDirty('frame', false);
     }
     await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
-    await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(true); await pending; });
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, true); await pending; });
     expect(getWallHandle('ws-2')!.ownsSurface('frame')).toBe(true);
   });
 
+  /** A source holding only a plain iframe, beside two terminal Workspaces. */
+  async function iframeWalls() {
+    const source = getActiveWorkspaceId();
+    createWorkspace({ id: 'ws-2', activate: false });
+    createWorkspace({ id: 'ws-3', activate: false });
+    const meta = browserLeafMeta('Frame', { surfaceType: 'browser', renderMode: 'iframe', url: 'http://localhost:3000/saved' });
+    await render(<><WorkspaceStrip /><WorkspaceWindow initialPlans={{ [source]: { restoredLathLayout: { version: 1, tree: leafTree('frame'), leafMeta: { frame: meta } } }, 'ws-2': { initialPaneIds: ['pane-x'] }, 'ws-3': { initialPaneIds: ['pane-y'] } }} /></>);
+    return source;
+  }
+
+  it('answers a pending confirmation no when a Surface move starts', async () => {
+    await twoWalls();
+    const answer = vi.fn();
+    requestConfirmation({ id: 'ws-2', char: 'q', answer });
+    await act(async () => { await moveSurface('pane-a', request({ workspace: 'workspace:2' })); });
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+    expect(getWallHandle('ws-2')!.ownsSurface('pane-a')).toBe(true);
+  });
+
+  it('answers a pending iframe consent no when a Workspace close is requested', async () => {
+    const source = await iframeWalls();
+    let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
+    expect(getWorkspaceUiSnapshot().confirmation?.title).toBe('Move iframe?');
+    await act(async () => { requestWorkspaceClose('ws-2'); expect(await pending).toBeNull(); });
+    expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
+    expect(isWorkspaceTransferPending(source)).toBe(false);
+    // The released destination is no longer guarded, so its untouched close runs.
+    await act(async () => { await vi.waitFor(() => expect(getWorkspacesSnapshot().workspaces.map(ws => ws.id)).toEqual([source, 'ws-3'])); });
+    expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
+  });
+
+  it('does not let an older close awaiting its Wall replace a newer iframe consent', async () => {
+    const source = await iframeWalls();
+    vi.spyOn(getWallHandle('ws-2')!, 'hasTouchedSurfaces').mockReturnValue(true);
+    let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    await act(async () => {
+      requestWorkspaceClose('ws-2');
+      pending = moveSurface('frame', request({ workspace: workspaceStore.workspaceRefFor('ws-3') }), true);
+    });
+    expect(getWorkspaceUiSnapshot().confirmation?.title).toBe('Move iframe?');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe(source);
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, false); await pending; });
+  });
+
+  it('lets a second GUI iframe move supersede the first one’s consent and complete', async () => {
+    const source = await iframeWalls();
+    let first!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    let second!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    await act(async () => { first = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
+    const firstConsent = getWorkspaceUiSnapshot().confirmation;
+    await act(async () => { second = moveSurface('frame', request({ workspace: workspaceStore.workspaceRefFor('ws-3') }), true); });
+    await act(async () => { expect(await first).toBeNull(); });
+    // The superseded move's cleanup leaves the second one's guards in place.
+    expect(isWorkspaceTransferPending(source)).toBe(true);
+    expect(isWorkspaceTransferPending('ws-3')).toBe(true);
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBe(firstConsent);
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, true); await second; });
+    expect(getWallHandle('ws-3')!.ownsSurface('frame')).toBe(true);
+    expect(getWallHandle('ws-2')!.ownsSurface('frame')).toBe(false);
+    expect([source, 'ws-2', 'ws-3'].some(isWorkspaceTransferPending)).toBe(false);
+  });
+
   it('rechecks a Tool that becomes dirty in the final preparation microtask', async () => {
     const source = getActiveWorkspaceId();
     createWorkspace({ id: 'ws-2', activate: false });
@@ -1149,9 +1241,9 @@ describe('Surface moves between Workspaces', () => {
     notYetServing();
     let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
     await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
-    expect(getWorkspaceUiSnapshot().pendingSurfaceMove).not.toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBeNull();
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
-    await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(false); expect(await pending).toBeNull(); });
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, false); expect(await pending).toBeNull(); });
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
   });
 });
diff --git a/lib/src/components/wall/MoveWorkspaceAction.tsx b/lib/src/components/wall/MoveWorkspaceAction.tsx
index 658f365c7..3d1575230 100644
--- a/lib/src/components/wall/MoveWorkspaceAction.tsx
+++ b/lib/src/components/wall/MoveWorkspaceAction.tsx
@@ -5,13 +5,18 @@ import type { WorkspaceId } from '../../lib/session-types';
 import { getWorkspacesSnapshot, subscribeToWorkspaces, workspaceRefFor } from '../../lib/workspace-store';
 import { getWorkspaceSurfacesSnapshot, subscribeToWorkspaceSurfaces } from '../../lib/workspace-surfaces';
 import { WindowFocusedContext } from './wall-context';
-import { requestSurfaceMove } from './surface-move';
+import { requestSurfaceMove, surfaceMoveRefusal } from './surface-move';
+import { getWallHandle } from './wall-handles';
 import { ACTION_BOX_CLASS, closedSelectKeyDown } from './TerminalContextView';
 
 /** Native picker matches the context's browser actions and escapes its clipping. */
 export function MoveWorkspaceAction({ id, sourceId }: { id: string; sourceId: WorkspaceId }) {
   const { workspaces } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
-  const members = useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
+  // Membership decides whether New workspace is offered.
+  useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
+  const source = getWallHandle(sourceId);
+  const refusal = (destination: { workspace: WorkspaceId } | { new: true }) => surfaceMoveRefusal(source, destination) ?? undefined;
+  const newRefusal = refusal({ new: true });
   const focused = useContext(WindowFocusedContext);
   return <span className={`relative ${ACTION_BOX_CLASS} ${SUBTLE_ACTION_REST_COLOR_CLASS} ${focused ? SUBTLE_ACTION_WRAPPER_INTERACTION_CLASS : ''}`}>
     move to workspace…<CaretDownIcon size={10} weight="fill" />
@@ -22,8 +27,11 @@ export function MoveWorkspaceAction({ id, sourceId }: { id: string; sourceId: Wo
         else if (event.target.value) requestSurfaceMove(id, { workspace: event.target.value });
       }}>
       <option value="">move to workspace…</option>
-      {workspaces.filter(workspace => workspace.id !== sourceId).map(workspace => <option key={workspace.id} value={workspace.id}>{workspaceRefFor(workspace.id)} — {workspace.name}</option>)}
-      <option value="+" disabled={(members.get(sourceId)?.length ?? 0) <= 1}>New workspace</option>
+      {workspaces.filter(workspace => workspace.id !== sourceId).map(workspace => {
+        const why = refusal({ workspace: workspace.id });
+        return <option key={workspace.id} value={workspace.id} disabled={!!why} title={why}>{workspaceRefFor(workspace.id)} — {workspace.name}</option>;
+      })}
+      <option value="+" disabled={!!newRefusal} title={newRefusal}>New workspace</option>
     </select>
   </span>;
 }
diff --git a/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts b/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts
index 4d36b7a77..4b29ec2ae 100644
--- a/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts
+++ b/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts
@@ -74,7 +74,7 @@ describe('handleWorkspaceShortcuts', () => {
     }
     expect(getWorkspacesSnapshot()).toBe(before);
     expect(getWorkspaceUiSnapshot().renamingId).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
   });
 
   it.each(['active', 'inactive'])('renames the selected %s Workspace without activating it', target => {
diff --git a/lib/src/components/wall/surface-move.ts b/lib/src/components/wall/surface-move.ts
index cd44b0be8..fc74e1e92 100644
--- a/lib/src/components/wall/surface-move.ts
+++ b/lib/src/components/wall/surface-move.ts
@@ -1,27 +1,47 @@
 import { flushSync } from 'react-dom';
 import type { MoveSurfaceRequest, MoveSurfaceResponse } from 'dor/commands/types';
 import { closeWorkspace, createWorkspace, generateWorkspaceId, getActiveWorkspaceId, hasWorkspace, resolveWorkspaceRef, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
-import { beginWorkspaceSessionBatch, forgetWorkspaceSession, invalidateWorkspaceSaves, isWorkspaceTransferPending, moveRetainedSurfaceRecord, previousWorkspaceSession, publishWorkspaceSession, setWorkspaceTransferPending } from '../../lib/window-session-aggregator';
-import { dismissWorkspaceUi, getWorkspaceUiSnapshot, setPendingSurfaceMove, setWorkspaceMoveError } from '../../lib/workspace-ui-store';
-import type { PersistedSession, WorkspaceId } from '../../lib/session-types';
+import { forgetWorkspaceSession, invalidateWorkspaceSaves, isWorkspaceTransferPending, moveRetainedSurfaceRecord, publishWorkspaceSessions, setWorkspaceTransferPending } from '../../lib/window-session-aggregator';
+import { cancelPendingConfirmation, dismissWorkspaceUi, requestConfirmation, setWorkspaceMoveError } from '../../lib/workspace-ui-store';
+import type { WorkspaceId } from '../../lib/session-types';
 import { sanitizeText } from '../../lib/osc-sanitize';
 import { getTerminalInstance } from '../../lib/terminal-registry';
 import { randomKillChar } from '../KillConfirm';
-import { awaitWallHandle, errorText } from './dor-control-shared';
+import { errorText } from './dor-control-shared';
 import { forgetWorkspaceBootPlan, setWorkspaceBootPlan } from './workspace-boot-plans';
 import { getWallHandle, wallHandleOwning, type WallHandle } from './wall-handles';
 
-let moving = false;
+/** The move in flight, if any. A declined consent releases it synchronously,
+ *  so whichever verb cancelled it can start at once. */
+let moving: object | null = null;
 
 const IFRAME_FLAG_REQUIRED = 'Moving this iframe reopens at its saved URL; pass --dangerously-destroy-iframe-page-state to accept losing page state';
 
-function consent(source: string): Promise<boolean> {
-  const ui = getWorkspaceUiSnapshot();
-  if (ui.pendingClose || ui.pendingMove || ui.pendingSurfaceMove || ui.renamingId) throw new Error('Finish the open Workspace dialog before moving this Surface');
-  return new Promise(resolve => setPendingSurfaceMove({ id: source, char: randomKillChar(), answer: accepted => {
-    setPendingSurfaceMove(null);
-    resolve(accepted);
-  } }));
+/** Why `source` cannot move a Surface to `destination`, or null when it can:
+ *  the coordinator, the drag's targets and the picker share it. */
+export function surfaceMoveRefusal(source: WallHandle | null, destination: { workspace: WorkspaceId } | { new: true }): string | null {
+  if (!source?.canMoveSurfaces) return 'This host does not support moving Surfaces between Workspaces';
+  const target = 'workspace' in destination ? destination.workspace : null;
+  if (target === source.workspaceId) return 'The Surface is already in that Workspace';
+  if (!target && source.surfaceIds().length <= 1) return 'The only Surface is already in its own Workspace';
+  if (isWorkspaceTransferPending(source.workspaceId) || (target && isWorkspaceTransferPending(target))) return 'A Workspace is already moving';
+  return null;
+}
+
+/** False when the user declines, or when a newer verb cancels the question;
+ *  a no releases the move before it resolves. */
+function consent(source: WorkspaceId, release: () => void): Promise<boolean> {
+  return new Promise(resolve => requestConfirmation({
+    id: source,
+    char: randomKillChar(),
+    title: 'Move iframe?',
+    detail: 'moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page.',
+    cancelHint: 'anything else to cancel',
+    answer: accepted => {
+      if (!accepted) release();
+      resolve(accepted);
+    },
+  }));
 }
 
 /** The same close tail as `closeWorkspaceWithSurfaces`, for a Wall left empty. */
@@ -33,16 +53,20 @@ function discardWorkspace(id: WorkspaceId): void {
 }
 
 /** One coordinator for GUI and dor. Preparation and consent change no membership;
- * the synchronous departure/adoption is reversible until both records are published. */
+ * after the last await, departure, adoption and both records' publication run
+ * in one synchronous step, reversible until both Walls finish. */
 export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest, 'surface' | 'workspace'>, gui = false): Promise<MoveSurfaceResponse | null> {
+  // A move still awaiting its consent is answered no and released here.
+  cancelPendingConfirmation();
   if (moving) throw new Error('Another Surface move is in progress');
-  const source = wallHandleOwning(id);
-  if (!source?.canMoveSurfaces) throw new Error('This host does not support moving Surfaces between Workspaces');
+  const owner = wallHandleOwning(id);
   const destination = request.destination;
   const resolved = 'workspace' in destination ? resolveWorkspaceRef(destination.workspace) : null;
   if (resolved && !resolved.ok) throw new Error(resolved.message);
   let targetId = resolved?.ok ? resolved.id : null;
-  if (targetId === source.workspaceId) throw new Error('The Surface is already in that Workspace');
+  const refusal = surfaceMoveRefusal(owner, targetId ? { workspace: targetId } : { new: true });
+  if (refusal) throw new Error(refusal);
+  const source = owner!;
   const toNew = !targetId;
   let target: WallHandle | null = targetId ? getWallHandle(targetId) : null;
   /** Rechecked after every await: either Wall may close or remount meanwhile. */
@@ -52,7 +76,6 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     if (targetId && (!hasWorkspace(targetId) || !target?.canMoveSurfaces || getWallHandle(targetId) !== target)) throw new Error('The destination Workspace is unavailable');
   };
   checkEndpoints();
-  if (isWorkspaceTransferPending(source.workspaceId) || (targetId && isWorkspaceTransferPending(targetId))) throw new Error('A Workspace is already moving');
   let prepared = source.prepareSurfaceMove(id);
   let iframeConsented = request.dangerouslyDestroyIframePageState;
   if (prepared.iframe && !iframeConsented && !gui) throw new Error(IFRAME_FLAG_REQUIRED);
@@ -60,23 +83,28 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
   const ensureIframeConsent = async (): Promise<boolean> => {
     if (!prepared.iframe || iframeConsented) return true;
     if (!gui) throw new Error(IFRAME_FLAG_REQUIRED);
-    if (!await consent(source.workspaceId)) return false;
+    if (!await consent(source.workspaceId, release)) return false;
     iframeConsented = true;
     prepared = source.prepareSurfaceMove(id);
     return true;
   };
-  moving = true;
+  const token = {};
+  /** Idempotent, and inert once a newer move holds the guard. */
+  const release = () => {
+    if (moving !== token) return;
+    moving = null;
+    setWorkspaceTransferPending(source.workspaceId, false);
+    if (targetId) setWorkspaceTransferPending(targetId, false);
+  };
+  moving = token;
   setWorkspaceTransferPending(source.workspaceId, true);
   if (targetId) setWorkspaceTransferPending(targetId, true);
   const activeBefore = getActiveWorkspaceId();
   const oldWorkspaceRef = workspaceRefFor(source.workspaceId);
   let created = false;
   let committed = false;
-  let endBatch: (() => void) | undefined;
   let undoDeparture: (() => void) | undefined;
   let undoAdoption: (() => void) | undefined;
-  let sourceRecord: PersistedSession | null = null;
-  let targetRecord: PersistedSession | null = null;
   try {
     if (!await ensureIframeConsent()) return null;
     // Neither a dialog nor a cwd probe reserves the Surface's kind or dirty state.
@@ -86,24 +114,22 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     // A Tool may start serving an iframe while the persistence flush awaits.
     if (!await ensureIframeConsent()) return null;
     checkEndpoints();
-    endBatch = beginWorkspaceSessionBatch();
-    sourceRecord = previousWorkspaceSession(source.workspaceId);
-    invalidateWorkspaceSaves(source.workspaceId);
+    // From here to the end nothing awaits: no save, write or verb interleaves.
     if (!targetId) {
       targetId = generateWorkspaceId();
       setWorkspaceBootPlan(targetId, { emptyForMove: true });
+      // A synchronous render flushes the new Wall's registering effects.
       flushSync(() => createWorkspace({ id: targetId!, activate: false }));
       created = true;
       setWorkspaceTransferPending(targetId, true);
-      target = getWallHandle(targetId) ?? await awaitWallHandle(targetId);
+      target = getWallHandle(targetId);
       if (!target) throw new Error('The new Workspace did not mount');
-      // Revalidate after the new Wall's passive registration; no prompt here.
       checkEndpoints();
     }
-    // No await may separate this final dirty/kind check from departure.
     prepared = source.prepareSurfaceMove(id);
     if (prepared.iframe && !iframeConsented) throw new Error('This Surface started serving an iframe; retry the move to confirm its refresh');
-    targetRecord = previousWorkspaceSession(targetId);
+    // Fence saves collected before the ownership change, a new Wall's included.
+    invalidateWorkspaceSaves(source.workspaceId);
     invalidateWorkspaceSaves(targetId);
     const receiver = target!;
     let surfaceRef = '';
@@ -117,19 +143,16 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
       receiver.finishSurfaceMove();
       source.finishSurfaceMove();
     });
-    // Mounting a new Wall can let saves collect the pre-departure layout. Fence
-    // those too, once both ownership changes have completed synchronously.
+    // React effects and store subscribers can collect saves synchronously
+    // during the commit, before the retained cwd/alert migrates. Their promise
+    // callbacks run later: fence them as well as pre-departure saves.
     invalidateWorkspaceSaves(source.workspaceId);
     invalidateWorkspaceSaves(targetId);
-    moveRetainedSurfaceRecord(id, source.workspaceId, targetId);
-    const [sourceSession, targetSession] = await Promise.all([
-      source.serializePersistence({ probeCwd: false }), receiver.serializePersistence({ probeCwd: false }),
-    ]);
-    publishWorkspaceSession(source.workspaceId, sourceSession);
-    publishWorkspaceSession(targetId, targetSession);
-    // Closing the source is irreversible. Later UI/notice failures must never
-    // restore membership into a Wall that has already unmounted.
+    // A finished Wall may have refilled, and closing the source is
+    // irreversible: nothing after this point restores membership.
     committed = true;
+    moveRetainedSurfaceRecord(id, source.workspaceId, targetId);
+    publishWorkspaceSessions([[source.workspaceId, source.serializeNow()], [targetId, receiver.serializeNow()]]);
     const sourceEmpty = source.surfaceIds().length === 0;
     flushSync(() => {
       if (sourceEmpty) discardWorkspace(source.workspaceId);
@@ -155,22 +178,17 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     return { status: 'moved', surfaceId: id, surfaceRef, workspaceId: targetId, workspaceRef };
   } catch (error) {
     if (committed) throw error;
-    invalidateWorkspaceSaves(source.workspaceId);
-    if (targetId) invalidateWorkspaceSaves(targetId);
     flushSync(() => {
       undoAdoption?.(); undoDeparture?.();
       source.finishSurfaceMove(); target?.finishSurfaceMove();
       if (created && targetId) discardWorkspace(targetId);
       if (hasWorkspace(activeBefore)) setActiveWorkspace(activeBefore);
     });
-    if (sourceRecord) publishWorkspaceSession(source.workspaceId, sourceRecord);
-    if (!created && targetId && targetRecord) publishWorkspaceSession(targetId, targetRecord);
+    invalidateWorkspaceSaves(source.workspaceId);
+    if (targetId) invalidateWorkspaceSaves(targetId);
     throw error;
   } finally {
-    endBatch?.();
-    setWorkspaceTransferPending(source.workspaceId, false);
-    if (targetId) setWorkspaceTransferPending(targetId, false);
-    moving = false;
+    release();
   }
 }
 
diff --git a/lib/src/components/wall/surface-workspace-drag.test.ts b/lib/src/components/wall/surface-workspace-drag.test.ts
index 3dace6c87..4046d6f27 100644
--- a/lib/src/components/wall/surface-workspace-drag.test.ts
+++ b/lib/src/components/wall/surface-workspace-drag.test.ts
@@ -5,7 +5,7 @@ import { registerWallHandle, resetWallHandles, stubWallHandle } from './wall-han
 import { requestSurfaceMove } from './surface-move';
 import { surfaceWorkspaceDrag } from './surface-workspace-drag';
 
-vi.mock('./surface-move', () => ({ requestSurfaceMove: vi.fn() }));
+vi.mock('./surface-move', async importOriginal => ({ ...await importOriginal<typeof import('./surface-move')>(), requestSurfaceMove: vi.fn() }));
 
 let count: number;
 let sourceTab: HTMLElement;
diff --git a/lib/src/components/wall/surface-workspace-drag.ts b/lib/src/components/wall/surface-workspace-drag.ts
index 90de02210..a5e7a7543 100644
--- a/lib/src/components/wall/surface-workspace-drag.ts
+++ b/lib/src/components/wall/surface-workspace-drag.ts
@@ -1,7 +1,6 @@
-import { getWorkspaceUiSnapshot } from '../../lib/workspace-ui-store';
 import { workspaceStripElement, workspaceTabElement, workspaceTabElements } from '../workspace-tab-elements';
 import { wallHandleOwning } from './wall-handles';
-import { requestSurfaceMove } from './surface-move';
+import { requestSurfaceMove, surfaceMoveRefusal } from './surface-move';
 
 /** A pane press owns this path; only a tab press owns reorder/tear-out. */
 export interface SurfaceWorkspaceDrag {
@@ -20,11 +19,14 @@ function targetAt(x: number, y: number): HTMLElement | null {
   const targets = [...workspaceTabElements(), workspaceTabElement(null)];
   return targets.find(target => target && inside(target.getBoundingClientRect(), x, y)) ?? strip;
 }
+/** The drop's destination, or null for the strip's gaps. */
+function destinationOf(target: HTMLElement): { workspace: string } | { new: true } | null {
+  if (target.hasAttribute('data-workspace-new')) return { new: true };
+  return target.dataset.workspaceTab ? { workspace: target.dataset.workspaceTab } : null;
+}
 function eligible(id: string, target: HTMLElement): boolean {
-  const source = wallHandleOwning(id);
-  const ui = getWorkspaceUiSnapshot();
-  return !!source?.canMoveSurfaces && !ui.pendingSurfaceMove && !ui.pendingMove && !ui.pendingClose
-    && (target.hasAttribute('data-workspace-new') ? source.surfaceIds().length > 1 : !!target.dataset.workspaceTab && target.dataset.workspaceTab !== source.workspaceId);
+  const destination = destinationOf(target);
+  return !!destination && !surfaceMoveRefusal(wallHandleOwning(id), destination);
 }
 function highlight(target: HTMLElement | null): void {
   if (target === highlighted) return;
@@ -45,7 +47,7 @@ export const surfaceWorkspaceDrag: SurfaceWorkspaceDrag = {
     const target = targetAt(x, y);
     end();
     if (!target) return false;
-    if (eligible(id, target)) requestSurfaceMove(id, target.hasAttribute('data-workspace-new') ? { new: true } : { workspace: target.dataset.workspaceTab! });
+    if (eligible(id, target)) requestSurfaceMove(id, destinationOf(target)!);
     return true;
   },
   end,
diff --git a/lib/src/components/wall/use-session-persistence.ts b/lib/src/components/wall/use-session-persistence.ts
index f6f7cbdb3..d38f2977c 100644
--- a/lib/src/components/wall/use-session-persistence.ts
+++ b/lib/src/components/wall/use-session-persistence.ts
@@ -2,7 +2,7 @@ import { DEFAULT_WORKSPACE_ID, readPersistedSession } from '../../lib/session-ty
 import { useCallback, useEffect, useMemo, useRef, type RefObject } from 'react';
 import { pasteFilePaths } from '../../lib/clipboard';
 import { getPlatform } from '../../lib/platform';
-import { buildPersistedSession, saveSession, type SaveOptions, type SaveSink } from '../../lib/session-save';
+import { assemblePersistedSession, buildPersistedSession, saveSession, type SaveOptions, type SaveSink } from '../../lib/session-save';
 import { createSessionDirtyTracker } from '../../lib/session-dirty';
 import { previousWorkspaceSession, publishWorkspaceSession, workspaceSessionRevision, SESSION_SAVE_DEBOUNCE_MS } from '../../lib/window-session-aggregator';
 import { getWorkspace, setWorkspaceAlertDelivery, subscribeToWorkspaces, hasWorkspace } from '../../lib/workspace-store';
@@ -24,6 +24,9 @@ export interface SessionPersistenceHandle {
   /** Build this Workspace's record without publishing it — what a Workspace
    *  leaving for another Window carries with it. */
   serialize: (options?: SaveOptions) => Promise<PersistedSession>;
+  /** This Workspace's record now, with no cwd probe: what a Surface move
+   *  publishes in the same synchronous run as its ownership change. */
+  serializeNow: () => PersistedSession;
 }
 
 export function useSessionPersistence({
@@ -140,6 +143,14 @@ export function useSessionPersistence({
     );
   }, [collect, sink, saveOptions]);
 
+  const serializeNow = useCallback((): PersistedSession => {
+    const { panes, doors, lathLayout, surfaceRefs } = collect();
+    return assemblePersistedSession(
+      panes, doors, lathLayout, surfaceRefs?.refs, surfaceRefs?.next,
+      sink?.previous() ?? null, null, saveOptions().alertDelivery,
+    );
+  }, [collect, sink, saveOptions]);
+
   const doSave = useCallback((options?: SaveOptions): Promise<void> => {
     if (workspaceId === undefined) {
       const { panes, doors, lathLayout, surfaceRefs } = collect();
@@ -320,5 +331,5 @@ export function useSessionPersistence({
     selectedTypeRef,
   ]);
 
-  return { flush: flushSessionSave, serialize };
+  return { flush: flushSessionSave, serialize, serializeNow };
 }
diff --git a/lib/src/components/wall/wall-handles.ts b/lib/src/components/wall/wall-handles.ts
index 01c0dafec..1e75358f5 100644
--- a/lib/src/components/wall/wall-handles.ts
+++ b/lib/src/components/wall/wall-handles.ts
@@ -29,7 +29,8 @@ export interface WallHandle {
   finishSurfaceMove(): void;
   focusSurface(id: string, acknowledge: boolean): void;
   showMoveNotice(id: string, text: string): void;
-  serializePersistence(options?: SaveOptions): Promise<PersistedSession>;
+  /** This Workspace's record now, with no cwd probe. */
+  serializeNow(): PersistedSession;
   workspaceId: WorkspaceId;
   /** The Wall's member Surfaces: visible panes ∪ Doors. */
   surfaceIds(): string[];
@@ -128,7 +129,7 @@ export function stubWallHandle(workspaceId: WorkspaceId, overrides: Partial<Wall
     finishSurfaceMove: () => {},
     focusSurface: () => {},
     showMoveNotice: () => {},
-    serializePersistence: async () => ({ version: 3, panes: [] }),
+    serializeNow: () => ({ version: 3, panes: [] }),
     surfaceIds: () => [],
     ownsSurface: () => false,
     iframeSurfaceRefs: () => [],
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index 985460bfb..bea742b39 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -17,6 +17,7 @@ import { clearTerminalActivity, setTerminalActivity } from '../../lib/session-ac
 import { createAlertEpisode } from '../../lib/alert-episode';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../../lib/workspace-surfaces';
 import { resetWindowSessionAggregator } from '../../lib/window-session-aggregator';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi } from '../../lib/workspace-ui-store';
 import { setPlatform } from '../../lib/platform';
 import type { OpenPort, PlatformAdapter } from '../../lib/platform/types';
 
@@ -304,6 +305,8 @@ describe('workspace.close', () => {
 
     const first = request('workspace.close', { workspace: 'workspace:2', force: true });
     const running = handleWorkspaceControl(first);
+    // The first close has passed its Wall lookup and acquired the close lock.
+    await Promise.resolve();
 
     const second = request('workspace.close', { workspace: 'workspace:3', force: true });
     await handleWorkspaceControl(second);
@@ -331,6 +334,45 @@ function terminalRows(prefix: string, refs: string[]): Array<Record<string, unkn
   return refs.map((ref, index) => ({ ref, id: `${prefix}-${ref}`, kind: 'terminal', focused: index === 0 }));
 }
 
+it.each([
+  ['close', { workspace: 'workspace:2' }],
+  ['move', { workspace: 'workspace:2', toWindow: 'new' }],
+] as const)('answers a pending confirmation no as workspace.%s starts, even when it refuses', async (verb, params) => {
+  createWorkspace({ id: 'ws-2', activate: false });
+  handleFor('ws-2', { runningCount: () => 1 });
+  setPlatform({} as unknown as PlatformAdapter);
+  const confirmed = vi.fn();
+  requestConfirmation({ id: 'ws-2', char: 'q', answer: confirmed });
+  const detail = request(`workspace.${verb}`, params);
+  await handleWorkspaceControl(detail);
+  expect(answer(detail)).toEqual(expect.any(String));
+  expect(confirmed).toHaveBeenCalledExactlyOnceWith(false);
+  expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+  resetWorkspaceUi();
+});
+
+it.each(['close', 'move'] as const)('refuses workspace.%s if a newer confirmation supersedes its Wall lookup', async verb => {
+  createWorkspace({ id: 'ws-2', activate: false });
+  handleFor('ws-2');
+  const detail = request(`workspace.${verb}`, { workspace: 'workspace:2', toWindow: 'new', force: true });
+  const pending = handleWorkspaceControl(detail);
+  const newer = { id: 'ws-2', char: 'q', answer: vi.fn() };
+  requestConfirmation(newer);
+  await pending;
+  expect(answer(detail)).toContain('superseded');
+  expect(getWorkspaceUiSnapshot().confirmation).toBe(newer);
+  expect(newer.answer).not.toHaveBeenCalled();
+  resetWorkspaceUi();
+});
+
+it('cancels pending consent even when a cross-Window move names an invalid Workspace', async () => {
+  const answer = vi.fn();
+  requestConfirmation({ id: 'ws-2', char: 'q', answer });
+  await handleWorkspaceControl(request('workspace.move', { workspace: 'missing', toWindow: 'new' }));
+  expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+  resetWorkspaceUi();
+});
+
 describe('surface.list --all', () => {
   it('tags every row with its Workspace and carries the directory', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
diff --git a/lib/src/components/wall/workspace-control.ts b/lib/src/components/wall/workspace-control.ts
index 6d8ddf5aa..15f205dc7 100644
--- a/lib/src/components/wall/workspace-control.ts
+++ b/lib/src/components/wall/workspace-control.ts
@@ -24,6 +24,7 @@ import {
   type ResolvedWorkspace,
 } from '../../lib/workspace-store';
 import { getWorkspaceSurfacesSnapshot } from '../../lib/workspace-surfaces';
+import { cancelPendingConfirmation } from '../../lib/workspace-ui-store';
 import { computeWorkspaceUnion } from '../../lib/workspace-union';
 import { awaitWallHandle, errorText, mountingRefusal, stringParam } from './dor-control-shared';
 import { attachSurfacePorts } from './surface-ports';
@@ -237,9 +238,10 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
     }
 
     case WORKSPACE_CONTROL_METHODS.move: {
+      const toWindow = stringParam(params.toWindow)?.trim();
+      const isCurrent = toWindow !== undefined && !isWindowRef(toWindow) ? cancelPendingConfirmation() : () => true;
       const target = requireWorkspace(detail);
       if (!target) return;
-      const toWindow = stringParam(params.toWindow)?.trim();
       const index = typeof params.index === 'number' && Number.isInteger(params.index) && params.index >= 0
         ? params.index : undefined;
       if (toWindow === undefined && index === undefined) {
@@ -248,6 +250,10 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
       }
       if (toWindow !== undefined && !isWindowRef(toWindow)) {
         const handle = await awaitWallHandle(target.id);
+        if (!isCurrent()) {
+          detail.respond({ ok: false, error: 'Workspace move was superseded by a newer close or move' });
+          return;
+        }
         if (!handle) {
           detail.respond({ ok: false, error: mountingRefusal(target.ref) });
           return;
@@ -294,6 +300,7 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
     }
 
     case WORKSPACE_CONTROL_METHODS.close: {
+      const isCurrent = cancelPendingConfirmation();
       const target = requireWorkspace(detail);
       if (!target) return;
       // A close is answered only once the Workspace's Wall is there to answer
@@ -304,6 +311,10 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
         detail.respond({ ok: false, error: mountingRefusal(target.ref) });
         return;
       }
+      if (!isCurrent()) {
+        detail.respond({ ok: false, error: 'Workspace close was superseded by a newer close or move' });
+        return;
+      }
       // Like `dor kill`, a command close raises no prompt: it refuses instead,
       // and `--force` is the caller's answer to the confirmation the strip would
       // have shown (`docs/specs/dor-cli.md` → "dor workspace").
diff --git a/lib/src/components/wall/workspace-lifecycle.test.ts b/lib/src/components/wall/workspace-lifecycle.test.ts
index b5116f670..129921c32 100644
--- a/lib/src/components/wall/workspace-lifecycle.test.ts
+++ b/lib/src/components/wall/workspace-lifecycle.test.ts
@@ -10,7 +10,7 @@ import {
   requestWorkspaceClose,
 } from './workspace-lifecycle';
 import { registerWallHandle, resetWallHandles, stubWallHandle, type WallHandle } from './wall-handles';
-import { getWorkspaceUiSnapshot, resetWorkspaceUi, setPendingWorkspaceClose, setPendingWorkspaceMove, setRenamingWorkspace } from '../../lib/workspace-ui-store';
+import { cancelPendingConfirmation, getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, setRenamingWorkspace } from '../../lib/workspace-ui-store';
 import {
   closeWorkspace,
   createWorkspace,
@@ -75,6 +75,20 @@ describe('closeWorkspaceWithSurfaces', () => {
     expect(closeAll).toHaveBeenCalledWith(['a', 'b']);
   });
 
+  it('abandons a close awaiting dirty-editor consent when a newer move starts', async () => {
+    const [only] = ids();
+    const closeAll = vi.fn(async () => null);
+    handleFor(only, { closeAll, dirtyToolIds: () => ['editor'] });
+    recordToolDirty('editor', true);
+    const pending = closeWorkspaceWithSurfaces(only);
+    expect(getEditorClosePrompt()).not.toBeNull();
+    cancelPendingConfirmation();
+    await decideEditorClose('discard');
+    expect(await pending).toContain('superseded');
+    expect(closeAll).not.toHaveBeenCalled();
+    expect(ids()).toContain(only);
+  });
+
   it('refuses a second close while one is in flight, so both Walls cannot empty', async () => {
     const [first] = ids();
     createWorkspace({ id: 'ws-2' });
@@ -89,7 +103,7 @@ describe('closeWorkspaceWithSurfaces', () => {
     expect(secondCloseAll).not.toHaveBeenCalled();
     // The verb the strip and the keys share takes the same lock.
     requestWorkspaceClose('ws-2');
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
 
     releaseFirst();
     expect(await firstClose).toBeNull();
@@ -125,13 +139,13 @@ describe('closeWorkspaceWithSurfaces', () => {
     // The rename editor is open on the Workspace being closed: nothing unmounts
     // it through `blur`, so the verb itself has to clear it.
     setRenamingWorkspace('ws-2');
-    setPendingWorkspaceClose({ id: 'ws-2', char: 'x' });
-    setPendingWorkspaceMove({ id: 'ws-2', char: 'a', iframeCount: 1, proceed: vi.fn() });
+    const answer = vi.fn();
+    requestConfirmation({ id: 'ws-2', char: 'a', answer });
 
     expect(await closeWorkspaceWithSurfaces('ws-2')).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
     expect(getWorkspaceUiSnapshot().renamingId).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
   });
 });
 
@@ -152,7 +166,7 @@ describe('requestWorkspaceClose', () => {
       await vi.advanceTimersByTimeAsync(0);
       expect(closeAll).toHaveBeenCalled();
       expect(ids()).toEqual([first]);
-      expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+      expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
     } finally {
       vi.useRealTimers();
     }
@@ -164,7 +178,7 @@ describe('requestWorkspaceClose', () => {
     handleFor('ws-2', { runningCount: () => 1 });
     requestWorkspaceClose('ws-2');
     await Promise.resolve();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-2');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-2');
     expect(ids()).toEqual([first, 'ws-2']);
   });
 });
@@ -172,13 +186,22 @@ describe('requestWorkspaceClose', () => {
 it('preserves another Workspace’s rename and close confirmation when closing a sibling', async () => {
   const [first] = ids();
   createWorkspace({ id: 'ws-2' });
-  handleFor('ws-2');
+  const answer = vi.fn();
+  // A confirmation raised while the close walks its Surfaces is a newer question.
+  handleFor('ws-2', { closeAll: async () => { requestConfirmation({ id: first, char: 'x', answer }); return null; } });
   setRenamingWorkspace(first);
-  setPendingWorkspaceClose({ id: first, char: 'x' });
-  setPendingWorkspaceMove({ id: first, char: 'a', iframeCount: 1, proceed: vi.fn() });
-  const before = getWorkspaceUiSnapshot();
   expect(await closeWorkspaceWithSurfaces('ws-2')).toBeNull();
-  expect(getWorkspaceUiSnapshot()).toBe(before);
+  expect(getWorkspaceUiSnapshot()).toMatchObject({ renamingId: first, confirmation: { id: first, char: 'x' } });
+  expect(answer).not.toHaveBeenCalled();
+});
+
+it('answers a pending confirmation no when a close is requested', () => {
+  createWorkspace({ id: 'ws-2' });
+  const answer = vi.fn();
+  requestConfirmation({ id: 'ws-2', char: 'a', answer });
+  requestWorkspaceClose('ws-2');
+  expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+  expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
 });
 
 
diff --git a/lib/src/components/wall/workspace-lifecycle.ts b/lib/src/components/wall/workspace-lifecycle.ts
index cbae7c50a..778a9cae4 100644
--- a/lib/src/components/wall/workspace-lifecycle.ts
+++ b/lib/src/components/wall/workspace-lifecycle.ts
@@ -3,8 +3,8 @@ import { flushSync } from 'react-dom';
 import { awaitWallHandle, mountingRefusal } from './dor-control-shared';
 import { getWallHandle } from './wall-handles';
 import { forgetWorkspaceSession, isWorkspaceTransferPending } from '../../lib/window-session-aggregator';
-import { dismissWorkspaceUi, setPendingWorkspaceClose, setRenamingWorkspace } from '../../lib/workspace-ui-store';
-import { closeWorkspace, getActiveWorkspaceId, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
+import { cancelPendingConfirmation, dismissWorkspaceUi, requestConfirmation, setRenamingWorkspace, type WorkspaceConfirmation } from '../../lib/workspace-ui-store';
+import { closeWorkspace, getActiveWorkspaceId, getWorkspacesSnapshot, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
 import type { WorkspaceId } from '../../lib/session-types';
 import type { WorkspaceCloseMode } from './wall-types';
 import { confirmToolEditorsClose, UNSAVED_TOOL_REFUSAL } from '../../lib/tool-editor';
@@ -72,6 +72,7 @@ export async function closeWorkspaceWithSurfaces(
   id: WorkspaceId,
   mode: WorkspaceCloseMode = 'prompt',
 ): Promise<string | null> {
+  const isCurrent = cancelPendingConfirmation();
   if (isWorkspaceTransferPending(id)) return 'Workspace is transferring';
   if (closeInFlight) return CLOSE_IN_FLIGHT_REFUSAL;
   const handle = getWallHandle(id);
@@ -87,6 +88,7 @@ export async function closeWorkspaceWithSurfaces(
     // close refuses instead (`docs/specs/dor-tool.md` → Closing unsaved Tools).
     const editors = handle.dirtyToolIds();
     if (editors.length && (mode === 'silent' || !await confirmToolEditorsClose(editors))) return UNSAVED_TOOL_REFUSAL;
+    if (!isCurrent()) return 'Workspace close was superseded by a newer close or move';
     const refusal = await handle.closeAll(editors);
     if (refusal) {
       // A refusal returns to its prompt if the user navigated away during close.
@@ -113,8 +115,9 @@ export async function closeWorkspaceWithSurfaces(
  * confirmation, otherwise close immediately.
  */
 export function requestWorkspaceClose(id: WorkspaceId): void {
+  const isCurrent = cancelPendingConfirmation();
   if (closeInFlight || isWorkspaceTransferPending(id)) return;
-  void closeOnceWallRegisters(id);
+  void closeOnceWallRegisters(id, isCurrent);
 }
 
 /**
@@ -124,20 +127,32 @@ export function requestWorkspaceClose(id: WorkspaceId): void {
  * one effect away and having the close refused where nobody reads the refusal
  * (`docs/specs/layout.md` → "Workspaces").
  */
-async function closeOnceWallRegisters(id: WorkspaceId): Promise<void> {
+async function closeOnceWallRegisters(id: WorkspaceId, isCurrent: () => boolean): Promise<void> {
   const handle = await awaitWallHandle(id);
+  if (!isCurrent()) return;
   if (closeInFlight || isWorkspaceTransferPending(id)) return;
   if (!handle) return;
   if (workspaceNeedsCloseConfirmation(id)) {
     // An immediate close reveals the Workspace itself.
     setActiveWorkspace(id);
     handle.selectWorkspaceTab();
-    setPendingWorkspaceClose({ id, char: randomKillChar() });
+    requestConfirmation(workspaceCloseConfirmation(id));
     return;
   }
   await closeWorkspaceWithSurfaces(id);
 }
 
+/** The typed close question; the key is ignored while the Workspace transfers. */
+export function workspaceCloseConfirmation(id: WorkspaceId, char = randomKillChar()): WorkspaceConfirmation {
+  return {
+    id,
+    char,
+    detail: getWorkspacesSnapshot().workspaces.find(workspace => workspace.id === id)?.name,
+    canConfirm: () => !isWorkspaceTransferPending(id),
+    answer: accepted => { if (accepted) void closeWorkspaceWithSurfaces(id); },
+  };
+}
+
 /** Open the strip's inline rename editor on a Workspace. */
 export function requestWorkspaceRename(id: WorkspaceId): void {
   setRenamingWorkspace(id);
diff --git a/lib/src/components/wall/workspace-transfer.test.ts b/lib/src/components/wall/workspace-transfer.test.ts
index 88a656ff7..b222fcc43 100644
--- a/lib/src/components/wall/workspace-transfer.test.ts
+++ b/lib/src/components/wall/workspace-transfer.test.ts
@@ -1,4 +1,4 @@
-import { getWorkspaceUiSnapshot, setPendingWorkspaceClose, resetWorkspaceUi } from '../../lib/workspace-ui-store';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi } from '../../lib/workspace-ui-store';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { prepareWorkspaceTransfer } from './workspace-transfer';
 import type { PersistedSession } from '../../lib/session-types';
@@ -53,14 +53,16 @@ function deps(order: string[] = [], overrides: Partial<Parameters<typeof prepare
 
 describe('prepareWorkspaceTransfer', () => {
   it('keeps the pending kill until commit, then dismisses only the departing Workspace', async () => {
-    setPendingWorkspaceClose({ id: 'ws-id', char: 'q' });
+    const answer = vi.fn();
+    requestConfirmation({ id: 'ws-id', char: 'q', answer });
     const prepared = await prepareWorkspaceTransfer(deps());
-    expect(getWorkspaceUiSnapshot().pendingClose).toEqual({ id: 'ws-id', char: 'q' });
+    expect(getWorkspaceUiSnapshot().confirmation).toMatchObject({ id: 'ws-id', char: 'q' });
     prepared.commit();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
-    setPendingWorkspaceClose({ id: 'sibling', char: 'k' });
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+    requestConfirmation({ id: 'sibling', char: 'k', answer: vi.fn() });
     prepared.commit();
-    expect(getWorkspaceUiSnapshot().pendingClose).toEqual({ id: 'sibling', char: 'k' });
+    expect(getWorkspaceUiSnapshot().confirmation).toMatchObject({ id: 'sibling', char: 'k' });
   });
 
   it('serializes with a live cwd probe before anything is detached', async () => {
diff --git a/lib/src/lib/session-save.ts b/lib/src/lib/session-save.ts
index 0fdf6745e..b5d6c7fa6 100644
--- a/lib/src/lib/session-save.ts
+++ b/lib/src/lib/session-save.ts
@@ -58,6 +58,14 @@ async function probeCwds(
   return cwds;
 }
 
+/** The Surfaces whose cwd a save probes: every non-browser pane and Door. */
+function cwdSurfaceIds(panes: SavePaneInput[], doors: PersistedDoor[]): string[] {
+  const browser = new Map<string, boolean>();
+  for (const pane of panes) browser.set(pane.id, pane.surfaceType === 'browser');
+  for (const door of doors) browser.set(door.id, door.component === 'browser');
+  return [...browser].filter(([, isBrowser]) => !isBrowser).map(([id]) => id);
+}
+
 /**
  * Build one Workspace's `PersistedSession` from its live panes and Doors.
  *
@@ -80,6 +88,27 @@ export async function buildPersistedSession(
   previous?: PersistedSession | null,
   options: SaveOptions = {},
 ): Promise<PersistedSession> {
+  // One probe for the whole set: a terminal pane's cwd is the only field here
+  // that costs a host round trip.
+  const cwds = await probeCwds(platform, cwdSurfaceIds(panes, doors), options.probeCwd !== false);
+  return assemblePersistedSession(panes, doors, lathLayout, surfaceRefs, surfaceRefsNext, previous, cwds, options.alertDelivery);
+}
+
+/**
+ * `buildPersistedSession` past its probe, synchronously: `cwds` null keeps each
+ * terminal's previous cwd. A Surface move publishes both Workspaces with no
+ * await between ownership change and publication.
+ */
+export function assemblePersistedSession(
+  panes: SavePaneInput[],
+  doors: PersistedDoor[],
+  lathLayout: unknown,
+  surfaceRefs: PersistedSurfaceRefs | undefined,
+  surfaceRefsNext: number | undefined,
+  previous: PersistedSession | null | undefined,
+  cwds: Record<string, string | null> | null,
+  alertDeliveryOverrides?: AlertDeliveryOverrides,
+): PersistedSession {
   const previousPanes = previousPaneMap(previous ?? null);
   const allPanes = new Map<string, { id: string; title: string; surfaceType: PersistedSurfaceType; params?: Record<string, unknown> }>();
   for (const pane of panes) {
@@ -103,14 +132,6 @@ export async function buildPersistedSession(
     allPanes.set(item.id, { id: item.id, title: item.title, surfaceType: doorSurfaceType, params: item.params });
   }
 
-  // One probe for the whole set, before the per-pane build: a terminal pane's cwd
-  // is the only field here that costs a host round trip.
-  const cwds = await probeCwds(
-    platform,
-    [...allPanes.values()].filter((pane) => pane.surfaceType !== 'browser').map((pane) => pane.id),
-    options.probeCwd !== false,
-  );
-
   const persisted: PersistedPane[] = [...allPanes.values()].map((pane) => {
     const previousPane = previousPanes.get(pane.id);
     if (pane.surfaceType === 'browser') {
@@ -138,7 +159,7 @@ export async function buildPersistedSession(
       ...(tool ? { tool } : {}),
     };
   });
-  const alertDelivery = normalizeAlertDeliveryOverrides(options.alertDelivery ?? previous?.alertDelivery);
+  const alertDelivery = normalizeAlertDeliveryOverrides(alertDeliveryOverrides ?? previous?.alertDelivery);
   return {
     version: 3,
     ...(Object.keys(alertDelivery).length ? { alertDelivery } : {}),
diff --git a/lib/src/lib/window-session-aggregator.test.ts b/lib/src/lib/window-session-aggregator.test.ts
index beea9eb7f..ed9ab8ebb 100644
--- a/lib/src/lib/window-session-aggregator.test.ts
+++ b/lib/src/lib/window-session-aggregator.test.ts
@@ -4,7 +4,6 @@
 // and there is no unload without a `window`.
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
-  beginWorkspaceSessionBatch,
   clearWorkspaceTransferring,
   flushWindowSession,
   forgetWorkspaceSession,
@@ -13,6 +12,7 @@ import {
   markWorkspaceTransferring,
   previousWorkspaceSession,
   publishWorkspaceSession,
+  publishWorkspaceSessions,
   resetWindowSessionAggregator,
   seedWindowSession,
 } from './window-session-aggregator';
@@ -274,20 +274,20 @@ describe('window session aggregator', () => {
 });
 
 
-it('holds every write through a Surface move, including pagehide and explicit flush, then writes both records once', async () => {
+it.each([false, true])('publishes several records behind one write (unloading: %s)', async (unloading) => {
   const first = getWorkspacesSnapshot().workspaces[0].id;
   const second = createWorkspace({ name: 'Second' }).id;
   publishWorkspaceSession(first, session('moving'));
   publishWorkspaceSession(second, session('other'));
   const write = vi.fn();
   installWindowSessionWriter(write);
-  const end = beginWorkspaceSessionBatch();
-  publishWorkspaceSession(first, { version: 3, panes: [] });
-  window.dispatchEvent(new Event('pagehide'));
-  await flushWindowSession();
-  expect(write).not.toHaveBeenCalled();
-  publishWorkspaceSession(second, { version: 3, panes: [...session('other').panes, ...session('moving').panes] });
-  end();
+  if (unloading) {
+    window.dispatchEvent(new Event('pagehide'));
+    write.mockClear();
+  }
+  publishWorkspaceSessions([[first, { version: 3, panes: [] }], [second, { version: 3, panes: [...session('other').panes, ...session('moving').panes] }]]);
+  // An unloading Window writes on every publish, synchronously; one publish is one write.
+  if (!unloading) await flushWindowSession();
   expect(write).toHaveBeenCalledTimes(1);
   const saved = write.mock.calls[0][0] as PersistedWindow;
   expect(saved.workspaces[0].session.panes).toEqual([]);
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index dea0cbc2e..0481d3560 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -15,20 +15,10 @@ import type { PersistedSession, PersistedWindow, PersistedWorkspace, WorkspaceId
  */
 
 const revisions = new Map<WorkspaceId, number>();
-/** Set while a Surface move publishes both Walls: no write sees one half. */
-let batchHeld = false;
 /** Fence asynchronous saves collected before ownership changed. */
 export function workspaceSessionRevision(id: WorkspaceId): number { return revisions.get(id) ?? 0; }
 export function invalidateWorkspaceSaves(id: WorkspaceId): void { revisions.set(id, workspaceSessionRevision(id) + 1); }
 
-/** Hold every write until both Walls have published. */
-export function beginWorkspaceSessionBatch(): () => void {
-  if (batchHeld) throw new Error('A Workspace persistence batch is already running');
-  batchHeld = true;
-  cancelPending();
-  return () => { batchHeld = false; scheduleWrite(); };
-}
-
 /** Preserve a dead Session's retained cwd/alert while its Wall changes. */
 export function moveRetainedSurfaceRecord(id: string, source: WorkspaceId, destination: WorkspaceId): void {
   const row = records.get(source)?.panes.find(pane => pane.id === id);
@@ -76,7 +66,13 @@ export function seedWindowSession(snapshot: PersistedWindow | null): void {
 /** Record a Workspace's latest session and schedule the Window write. Also how a
  *  Workspace arriving from another Window installs the record it brought. */
 export function publishWorkspaceSession(workspaceId: WorkspaceId, session: PersistedSession): void {
-  records.set(workspaceId, session);
+  publishWorkspaceSessions([[workspaceId, session]]);
+}
+
+/** Record several Workspaces' sessions behind one scheduled write, so no write
+ *  (not even one during `pagehide`) holds some of them without the rest. */
+export function publishWorkspaceSessions(entries: ReadonlyArray<readonly [WorkspaceId, PersistedSession]>): void {
+  for (const [workspaceId, session] of entries) records.set(workspaceId, session);
   scheduleWrite();
 }
 
@@ -226,7 +222,7 @@ export async function flushWindowSession(): Promise<void> {
 }
 
 function scheduleWrite(): void {
-  if (!writer || batchHeld) return;
+  if (!writer) return;
   // A publish that lands during `pagehide` — the Walls flush there too — has no
   // later tick to be written on.
   if (unloading) {
@@ -242,7 +238,7 @@ function scheduleWrite(): void {
 }
 
 function writeNow(): void {
-  if (!writer || batchHeld) return;
+  if (!writer) return;
   const result = writer(getWindowSnapshot());
   inFlight = result ? Promise.resolve(result).catch(() => undefined) : null;
 }
@@ -257,7 +253,6 @@ function cancelPending(): void {
 export function resetWindowSessionAggregator(): void {
   records.clear();
   revisions.clear();
-  batchHeld = false;
   transferring.clear();
   pendingTransfers.clear();
   writer = null;
diff --git a/lib/src/lib/workspace-ui-store.test.ts b/lib/src/lib/workspace-ui-store.test.ts
new file mode 100644
index 000000000..5e9193e77
--- /dev/null
+++ b/lib/src/lib/workspace-ui-store.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest';
+import {
+  cancelPendingConfirmation,
+  dismissWorkspaceUi,
+  getWorkspaceUiSnapshot,
+  requestConfirmation,
+  resetWorkspaceUi,
+  settleConfirmation,
+  subscribeToWorkspaceUi,
+} from './workspace-ui-store';
+
+const emitted = vi.fn();
+let unsubscribe: () => void;
+
+beforeEach(() => {
+  resetWorkspaceUi();
+  unsubscribe = subscribeToWorkspaceUi(emitted);
+  emitted.mockClear();
+});
+
+afterEach(() => unsubscribe());
+
+it('answers the pending confirmation no before installing a newer one, in one emit', () => {
+  const first = vi.fn(() => expect(getWorkspaceUiSnapshot().confirmation).toBeNull());
+  requestConfirmation({ id: 'a', char: 'q', answer: first });
+  emitted.mockClear();
+  const second = { id: 'b', char: 'r', answer: vi.fn() };
+  requestConfirmation(second);
+  expect(first).toHaveBeenCalledExactlyOnceWith(false);
+  expect(getWorkspaceUiSnapshot().confirmation).toBe(second);
+  expect(emitted).toHaveBeenCalledTimes(1);
+  // The superseded question's answer is stale now.
+  settleConfirmation({ id: 'a', char: 'q', answer: first }, true);
+  expect(getWorkspaceUiSnapshot().confirmation).toBe(second);
+});
+
+it.each([
+  ['cancel', () => cancelPendingConfirmation()],
+  ['dismiss', () => dismissWorkspaceUi('a')],
+  ['reset', () => resetWorkspaceUi()],
+] as const)('%s answers no once and emits once', (_, clear) => {
+  const answer = vi.fn();
+  requestConfirmation({ id: 'a', char: 'q', answer });
+  emitted.mockClear();
+  clear();
+  clear();
+  expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+  expect(emitted).toHaveBeenCalledTimes(1);
+  expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+});
diff --git a/lib/src/lib/workspace-ui-store.ts b/lib/src/lib/workspace-ui-store.ts
index 4316624b5..3987e2e8b 100644
--- a/lib/src/lib/workspace-ui-store.ts
+++ b/lib/src/lib/workspace-ui-store.ts
@@ -1,5 +1,20 @@
 import type { WorkspaceId } from './session-types';
 
+/** A typed-letter question about one Workspace: its close, a cross-Window move
+ *  losing iframe page state, or a Surface move refreshing an iframe. `answer`
+ *  runs once, after the slot has cleared. */
+export interface WorkspaceConfirmation {
+  id: WorkspaceId;
+  /** Minted once, so a re-render cannot change the letter on screen. */
+  char: string;
+  title?: string;
+  detail?: string;
+  cancelHint?: string;
+  /** False ignores the key, leaving the question up. */
+  canConfirm?: () => boolean;
+  answer: (accepted: boolean) => void;
+}
+
 /**
  * The Workspace strip's transient UI states, held outside it because the
  * Workspace verbs open them from outside any component (`docs/specs/layout.md`
@@ -9,24 +24,17 @@ import type { WorkspaceId } from './session-types';
 export interface WorkspaceUiState {
   /** The Workspace whose inline rename editor is open. */
   renamingId: WorkspaceId | null;
-  /** The Workspace awaiting its typed close confirmation, and the letter that
-   *  accepts it (minted once, so a re-render cannot change the letter on screen). */
-  pendingClose: { id: WorkspaceId; char: string } | null;
+  /** The one pending confirmation; a newer one answers it no
+   *  (`docs/specs/layout.md` → "Workspace lifecycle"). */
+  confirmation: WorkspaceConfirmation | null;
   /** A refused move stays visible until dismissed or retried. */
   moveError: { id: WorkspaceId; reason: string } | null;
-  /** A Surface move between Workspaces awaiting its typed iframe-refresh
-   *  confirmation; `answer` settles the move
-   *  (`docs/specs/layout.md` → "Moving Surfaces between Workspaces"). */
-  pendingSurfaceMove: { id: WorkspaceId; char: string; answer: (accepted: boolean) => void } | null;
-  /** A move between Windows awaiting its typed confirmation, because it would
-   *  destroy the page state of `iframeCount` iframe Surfaces; `proceed` runs the
-   *  move (`docs/specs/layout.md` → "Workspaces"). */
-  pendingMove: { id: WorkspaceId; char: string; iframeCount: number; proceed: () => void } | null;
 }
 
-const EMPTY: WorkspaceUiState = { renamingId: null, pendingClose: null, pendingMove: null, pendingSurfaceMove: null, moveError: null };
+const EMPTY: WorkspaceUiState = { renamingId: null, confirmation: null, moveError: null };
 
 let state: WorkspaceUiState = EMPTY;
+let confirmationGeneration = 0;
 const listeners = new Set<() => void>();
 
 function emit(next: WorkspaceUiState): void {
@@ -51,18 +59,33 @@ export function setRenamingWorkspace(id: WorkspaceId | null): void {
   emit({ ...state, renamingId: id });
 }
 
-export function setPendingWorkspaceClose(pending: WorkspaceUiState['pendingClose']): void {
-  if (state.pendingClose?.id === pending?.id && state.pendingClose?.char === pending?.char) return;
-  emit({ ...state, pendingClose: pending });
+/** Ask `next`, first answering any pending confirmation no. */
+export function requestConfirmation(next: WorkspaceConfirmation): void {
+  confirmationGeneration++;
+  const previous = state.confirmation;
+  state = { ...state, confirmation: null };
+  previous?.answer(false);
+  emit({ ...state, confirmation: next });
 }
 
-export function setPendingWorkspaceMove(pending: WorkspaceUiState['pendingMove']): void {
-  if (state.pendingMove === pending) return;
-  emit({ ...state, pendingMove: pending });
+/** Close and move verbs call this as they start. Answer the pending question no;
+ *  the returned guard prevents asynchronous preparation from raising an older
+ *  question or acting after a newer verb starts, even when no question was up. */
+export function cancelPendingConfirmation(): () => boolean {
+  const generation = ++confirmationGeneration;
+  const previous = state.confirmation;
+  if (previous) {
+    emit({ ...state, confirmation: null });
+    previous.answer(false);
+  }
+  return () => generation === confirmationGeneration;
 }
 
-export function setPendingSurfaceMove(pending: WorkspaceUiState['pendingSurfaceMove']): void {
-  emit({ ...state, pendingSurfaceMove: pending });
+/** Answer `confirmation` if it is still the pending one; a stale answer is ignored. */
+export function settleConfirmation(confirmation: WorkspaceConfirmation, accepted: boolean): void {
+  if (state.confirmation !== confirmation) return;
+  emit({ ...state, confirmation: null });
+  confirmation.answer(accepted);
 }
 
 export function setWorkspaceMoveError(error: WorkspaceUiState['moveError']): void {
@@ -72,21 +95,21 @@ export function setWorkspaceMoveError(error: WorkspaceUiState['moveError']): voi
 /** Clear every transient Workspace UI state in one notification: the host's
  *  teardown dialog taking the window, and tests. */
 export function resetWorkspaceUi(): void {
+  confirmationGeneration++;
   if (state === EMPTY) return;
-  state.pendingSurfaceMove?.answer(false);
+  const { confirmation } = state;
   emit(EMPTY);
+  confirmation?.answer(false);
 }
 
 /** Forget only the departing Workspace's chrome, preserving sibling dialogs. */
 export function dismissWorkspaceUi(id: WorkspaceId): void {
-  const { renamingId, pendingClose, pendingMove, pendingSurfaceMove, moveError } = state;
-  if (renamingId !== id && pendingClose?.id !== id && pendingMove?.id !== id && pendingSurfaceMove?.id !== id && moveError?.id !== id) return;
-  if (pendingSurfaceMove?.id === id) pendingSurfaceMove.answer(false);
+  const { renamingId, confirmation, moveError } = state;
+  if (renamingId !== id && confirmation?.id !== id && moveError?.id !== id) return;
   emit({
-    pendingSurfaceMove: pendingSurfaceMove?.id === id ? null : pendingSurfaceMove,
     renamingId: renamingId === id ? null : renamingId,
-    pendingClose: pendingClose?.id === id ? null : pendingClose,
-    pendingMove: pendingMove?.id === id ? null : pendingMove,
+    confirmation: confirmation?.id === id ? null : confirmation,
     moveError: moveError?.id === id ? null : moveError,
   });
+  if (confirmation?.id === id) confirmation.answer(false);
 }
diff --git a/lib/src/stories/NetworkSettings.stories.tsx b/lib/src/stories/NetworkSettings.stories.tsx
index 97acbf4b5..cd8864dad 100644
--- a/lib/src/stories/NetworkSettings.stories.tsx
+++ b/lib/src/stories/NetworkSettings.stories.tsx
@@ -61,7 +61,9 @@ function hosted(policy: NetworkPolicy, status = UNENROLLED_STATUS, refusal: Path
 }
 
 /** 10:42 this morning, on whatever clock renders the story. */
-const AT_10_42 = new Date(2026, 9, 1, 10, 42).getTime();
+const morning = new Date();
+morning.setHours(10, 42, 0, 0);
+const AT_10_42 = morning.getTime();
 
 /** A self-host build holding `policy`. */
 function selfHost(policy: NetworkPolicy, status = SELF_HOST_UNENROLLED_STATUS) {
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 4a1bb7e36..238186ff8 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -13,7 +13,7 @@
   "docs/specs/dor-tools-lib.md": 400,
   "docs/specs/glossary.md": 3000,
   "docs/specs/hosted.md": 4800,
-  "docs/specs/layout.md": 11950,
+  "docs/specs/layout.md": 12050,
   "docs/specs/mobile-terminal-ui.md": 2300,
   "docs/specs/mouse-and-clipboard.md": 5250,
   "docs/specs/one-time.md": 3850,
diff --git a/standalone/src/quit-confirm-store.test.ts b/standalone/src/quit-confirm-store.test.ts
index b882e3cb5..249a51f45 100644
--- a/standalone/src/quit-confirm-store.test.ts
+++ b/standalone/src/quit-confirm-store.test.ts
@@ -15,7 +15,7 @@ import {
 
 import { chromeKeyboardHeld } from '../../lib/src/components/wall/chrome-keyboard-lease';
 import { createWorkspace, closeWorkspace, moveWorkspace, renameWorkspace, resetWorkspaces, setActiveWorkspace } from 'dormouse-lib/lib/workspace-store';
-import { getWorkspaceUiSnapshot, resetWorkspaceUi, setPendingWorkspaceClose, setPendingWorkspaceMove, setRenamingWorkspace, setWorkspaceMoveError } from 'dormouse-lib/lib/workspace-ui-store';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, setRenamingWorkspace, setWorkspaceMoveError } from 'dormouse-lib/lib/workspace-ui-store';
 import { isWorkspaceTransferPending, resetWindowSessionAggregator, setWorkspaceTransferPending } from 'dormouse-lib/lib/window-session-aggregator';
 
 // The gate↔orchestrator seam itself is covered by quit.test.ts.
@@ -112,13 +112,14 @@ describe("quit-confirm store", () => {
   });
 
   it('clears competing chrome without dropping transfer guards', () => {
-    setPendingWorkspaceClose({ id: 'workspace-1', char: 'a' });
-    setPendingWorkspaceMove({ id: 'workspace-1', char: 'b', iframeCount: 1, proceed: vi.fn() });
+    const answer = vi.fn();
+    requestConfirmation({ id: 'workspace-1', char: 'a', answer });
     setRenamingWorkspace('workspace-1');
     setWorkspaceMoveError({ id: 'workspace-1', reason: 'Wait for the Tool browser to connect' });
     setWorkspaceTransferPending('workspace-1', true);
     openQuitConfirm(makeCtx());
-    expect(getWorkspaceUiSnapshot()).toEqual({ pendingClose: null, pendingMove: null, pendingSurfaceMove: null, renamingId: null, moveError: null });
+    expect(getWorkspaceUiSnapshot()).toEqual({ confirmation: null, renamingId: null, moveError: null });
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
     expect(isWorkspaceTransferPending('workspace-1')).toBe(true);
     expect(chromeKeyboardHeld()).toBe(true);
   });
diff --git a/standalone/src/workspace-drag.test.ts b/standalone/src/workspace-drag.test.ts
index 112252035..5120454de 100644
--- a/standalone/src/workspace-drag.test.ts
+++ b/standalone/src/workspace-drag.test.ts
@@ -28,7 +28,7 @@ import {
 } from "./workspace-drag";
 import { _setWindowLabelForTesting } from "./window-label";
 import { registerWallHandle, resetWallHandles, stubWallHandle } from "dormouse-lib/components/wall/wall-handles";
-import { getWorkspaceUiSnapshot, resetWorkspaceUi } from "dormouse-lib/lib/workspace-ui-store";
+import { cancelPendingConfirmation, getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, settleConfirmation } from "dormouse-lib/lib/workspace-ui-store";
 
 import { cancelEditorClose, decideEditorClose, getEditorClosePrompt } from "dormouse-lib/lib/tool-editor";
 import { recordToolDirty, resetToolDirty } from "dormouse-lib/lib/tool-dirty-store";
@@ -185,7 +185,7 @@ describe("releasing the drag", () => {
     drop();
     await settle();
     expect(getEditorClosePrompt()?.items).toMatchObject([{ id: "editor" }]);
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
     await decideEditorClose("cancel");
     await settle();
     expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
@@ -195,11 +195,11 @@ describe("releasing the drag", () => {
     await settle();
     await decideEditorClose("discard");
     await settle();
-    const pending = getWorkspaceUiSnapshot().pendingMove;
-    expect(pending).toMatchObject({ iframeCount: 1 });
+    const pending = getWorkspaceUiSnapshot().confirmation;
+    expect(pending).toMatchObject({ detail: expect.stringContaining("An iframe Surface") });
     expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
     expect(mocks.tearOutWorkspace).not.toHaveBeenCalled();
-    pending!.proceed();
+    settleConfirmation(pending!, true);
     if (existing) expect(mocks.transferWorkspaceTo).toHaveBeenCalledWith("ws-1", "ws-2", { x: 120, y: 9 }, undefined, ["editor"]);
     else expect(mocks.tearOutWorkspace).toHaveBeenCalledWith("ws-1", expect.any(Object), ["editor"]);
   });
@@ -230,10 +230,10 @@ describe("releasing the drag", () => {
     await settle();
     // Nothing moved: the gate is up, naming what it would cost.
     expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
-    const pending = getWorkspaceUiSnapshot().pendingMove;
-    expect(pending).toMatchObject({ id: "ws-1", iframeCount: 2 });
+    const pending = getWorkspaceUiSnapshot().confirmation;
+    expect(pending).toMatchObject({ id: "ws-1", title: "Move and lose page state?", detail: expect.stringContaining("2 iframe Surfaces") });
     // The strip's key handler settles it; here, the letter's own effect.
-    pending!.proceed();
+    settleConfirmation(pending!, true);
     expect(mocks.transferWorkspaceTo).toHaveBeenCalledWith("ws-1", "ws-2", { x: 120, y: 9 }, undefined, []);
     resetWallHandles();
     resetWorkspaceUi();
@@ -246,10 +246,45 @@ describe("releasing the drag", () => {
     onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
     await settle();
     expect(mocks.tearOutWorkspace).toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
     resetWallHandles();
   });
 
+  it("abandons an older window probe when a newer confirmation is raised", async () => {
+    let resolveProbe!: (hit: { label: string; x: number; y: number }) => void;
+    const probe = new Promise<{ label: string; x: number; y: number }>(resolve => { resolveProbe = resolve; });
+    mocks.invoke.mockImplementation(async cmd => cmd === "window_at_cursor" ? probe : undefined);
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    const newer = { id: "ws-other", char: "q", answer: vi.fn() };
+    requestConfirmation(newer);
+    resolveProbe({ label: "ws-2", x: 120, y: 9 });
+    await settle();
+    expect(getWorkspaceUiSnapshot().confirmation).toBe(newer);
+    expect(newer.answer).not.toHaveBeenCalled();
+    expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
+  });
+
+  it("abandons a dirty-editor decision when a newer move starts", async () => {
+    recordToolDirty("editor", true);
+    registerWallHandle(stubWallHandle("ws-1", { dirtyToolIds: () => ["editor"], iframeSurfaceRefs: () => ["surface:4"] }));
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    await settle();
+    expect(getEditorClosePrompt()).not.toBeNull();
+    cancelPendingConfirmation();
+    await decideEditorClose("discard");
+    await settle();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+    expect(mocks.tearOutWorkspace).not.toHaveBeenCalled();
+  });
+
+  it("answers a pending confirmation no as the drop starts its move", () => {
+    const answer = vi.fn();
+    requestConfirmation({ id: "ws-other", char: "q", answer });
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+  });
+
   it("tears out when released over no window", async () => {
     hit = null;
     onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
diff --git a/standalone/src/workspace-drag.ts b/standalone/src/workspace-drag.ts
index 707b81c4a..e2a76792d 100644
--- a/standalone/src/workspace-drag.ts
+++ b/standalone/src/workspace-drag.ts
@@ -7,7 +7,7 @@ import { tearOutWorkspace, transferWorkspaceTo } from "./workspace-move";
 import { getWallHandle } from "dormouse-lib/components/wall/wall-handles";
 import { confirmToolEditorsClose } from "dormouse-lib/lib/tool-editor";
 import { randomKillChar } from "dormouse-lib/components/KillConfirm";
-import { setPendingWorkspaceMove, setWorkspaceMoveError } from "dormouse-lib/lib/workspace-ui-store";
+import { cancelPendingConfirmation, requestConfirmation, setWorkspaceMoveError } from "dormouse-lib/lib/workspace-ui-store";
 import { workspaceTabRect } from "./workspace-tabs";
 import { DOOR_TAB_HEIGHT_PX, DOOR_TAB_MAX_WIDTH_PX } from "dormouse-lib/components/design";
 
@@ -163,14 +163,16 @@ export function onDropOnOtherWindow(
   // the caret this is about to clear.
   endGesture();
   if (insideStrip) return;
+  const isCurrent = cancelPendingConfirmation();
   const grab = grabOffset(id);
   void (async () => {
     // Probed fresh rather than reusing the throttled answer: up to
     // HIT_TEST_THROTTLE_MS of pointer travel could otherwise choose the window.
     const hit = await probe();
+    if (!isCurrent()) return;
     const handle = getWallHandle(id);
     const dirtyEditors = handle?.dirtyToolIds() ?? [];
-    if (!await confirmToolEditorsClose(dirtyEditors)) return;
+    if (!await confirmToolEditorsClose(dirtyEditors) || !isCurrent()) return;
     // Save must not authorize discarding edits typed later, while the iframe
     // confirmation or transfer preparation is awaiting. Only Discard leaves
     // these originally dirty editors dirty after consent.
@@ -189,7 +191,13 @@ export function onDropOnOtherWindow(
     // the same typed letter a kill takes (docs/specs/layout.md → Workspaces).
     const iframes = getWallHandle(id)?.iframeSurfaceRefs() ?? [];
     if (iframes.length > 0) {
-      setPendingWorkspaceMove({ id, char: randomKillChar(), iframeCount: iframes.length, proceed: move });
+      requestConfirmation({
+        id,
+        char: randomKillChar(),
+        title: "Move and lose page state?",
+        detail: `${iframes.length === 1 ? "An iframe Surface" : `${iframes.length} iframe Surfaces`} in this Workspace will reload at ${iframes.length === 1 ? "its" : "their"} saved URL; a page cannot leave its window.`,
+        answer: (accepted) => { if (accepted) move(); },
+      });
       return;
     }
     move();