From 86dd7d4206cc36bd1745a37ff0c224f741cafb38 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 17:26:58 -0700
Subject: [PATCH 1/5] Hold one Workspace confirmation; a starting verb answers
 it no

The Workspace close, the cross-Window iframe move gate and the Surface move
iframe consent shared the strip as three typed-letter slots with their own
precedence. They are now one slot: a newer confirmation, or any close,
cross-Window move or Surface move starting by gesture or dor, answers the
pending one no first.

A declined consent releases the Surface move's guard and transfer flags
synchronously, so the verb that cancelled it starts at once and the
superseded move's cleanup cannot clear a newer move's flags. Move
eligibility is one surfaceMoveRefusal shared by the coordinator, the drag
targets and the picker; it no longer refuses for an open dialog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/specs/layout.md                          | 21 +++--
 lib/src/components/WorkspaceStrip.test.tsx    | 40 ++++-----
 lib/src/components/WorkspaceStrip.tsx         | 63 ++++----------
 lib/src/components/WorkspaceWindow.test.tsx   | 82 +++++++++++++++----
 .../components/wall/MoveWorkspaceAction.tsx   | 16 +++-
 .../handle-workspace-shortcuts.test.ts        |  2 +-
 lib/src/components/wall/surface-move.ts       | 64 +++++++++++----
 .../wall/surface-workspace-drag.test.ts       |  2 +-
 .../components/wall/surface-workspace-drag.ts | 16 ++--
 .../components/wall/workspace-control.test.ts | 18 ++++
 lib/src/components/wall/workspace-control.ts  |  3 +
 .../wall/workspace-lifecycle.test.ts          | 35 +++++---
 .../components/wall/workspace-lifecycle.ts    | 19 ++++-
 .../wall/workspace-transfer.test.ts           | 14 ++--
 lib/src/lib/workspace-ui-store.test.ts        | 50 +++++++++++
 lib/src/lib/workspace-ui-store.ts             | 70 ++++++++++------
 scripts/spec-word-budgets.json                |  2 +-
 standalone/src/quit-confirm-store.test.ts     |  9 +-
 standalone/src/workspace-drag.test.ts         | 26 ++++--
 standalone/src/workspace-drag.ts              | 11 ++-
 20 files changed, 375 insertions(+), 188 deletions(-)
 create mode 100644 lib/src/lib/workspace-ui-store.test.ts

diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index 12f57087a..d009aa38e 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -254,7 +254,7 @@ Source of truth: `createWorkspaceMotion` in `lib/src/components/workspace-motion
 - **Must offer `+` and New workspace only when the source has more than one Surface**, counting Panes and Doors; create a receiving Wall with only the moved Surface. Disable the picker item and `+` drop otherwise, and refuse CLI `--new`.
 - **Must offer Move to workspace in terminal and Tool context** (placement: the Title row above), using the same coordinator as dragging. **Never add a browser context menu. Never add a command-mode move binding.** Browser Surfaces move by dragging or CLI.
 - **Must retain stable Surface identity and Session state while remounting in the destination Wall**: terminals keep their registry instance, browser automation reconnects, and a retained helper follows its source. Never close a departing Session. Pin a moved preview slot by removing its preview mark.
-- **Must confirm plain iframe and serving iframe Tool moves before creating a destination or changing membership**, with a stable random character over the Window content area. Doors remain minimized while waiting. Show “moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page”; the prompted character confirms, anything else cancels. Saved URLs are last-known URLs, not necessarily the page's current location. CLI consent follows `docs/specs/dor-cli.md` → dor move.
+- **Must confirm plain iframe and serving iframe Tool moves before creating a destination or changing membership**, with a stable random character over the Window content area ([one pending confirmation](#workspace-lifecycle)). Doors remain minimized while waiting. Show “moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page”; the prompted character confirms, anything else cancels. Saved URLs are last-known URLs, not necessarily the page's current location. CLI consent follows `docs/specs/dor-cli.md` → dor move.
 - **Must refuse dirty Tools, pending Tool approval, browser startup, closing Surfaces/Workspaces and helper promotion**, rechecking after consent and asynchronous preparation. Dirty/pending refusals cannot be bypassed by iframe consent.
 - **Must follow a GUI move into destination passthrough** (acknowledgement: `docs/specs/alert.md` → Workspace union); CLI focus policy follows `docs/specs/dor-cli.md` → dor move. Remove a source with no Panes or Doors; if Doors remain but no pane does, refill normally.
 - **Must prepare before departure and roll back failed adoption**, restoring layout, Doors, parked state, selection, zoom, metadata and refs. Ref allocation belongs to `docs/specs/dor-cli.md` → Handle Model; coordinated durable publication belongs to `docs/specs/transport.md` → Persisted session types; Activity follows `docs/specs/alert.md` → Workspace union.
@@ -296,17 +296,22 @@ nothing (`iframeSurfaceRefs` on the Wall handle; `standalone/src/workspace-drag.
 - **Must drop the closing Workspace’s rename editor and pending confirmation, and no other’s** (`releases the rename lease when the tab being renamed is middle-clicked closed` in `lib/src/components/WorkspaceStrip.test.tsx`; `preserves another Workspace’s rename and close confirmation when closing a sibling` in `lib/src/components/wall/workspace-lifecycle.test.ts`).
 - **Every Workspace verb runs outside the strip**, which renders the rename editor and confirmation from a store, so tab gestures and `dor` commands take one path.
 
-**Must use `WorkspaceKillConfirm` for Workspace close, the iframe move gate,
+**Must use `WorkspaceKillConfirm` for Workspace close, the iframe move gates,
 and host termination confirmations**, titled “Confirm kill workspace” except the
-move gate: **a bare matching letter confirms, another bare key cancels, and a
+move gates: **a bare matching letter confirms, another bare key cancels, and a
 modifier or chord never answers**, so `Cmd+Q` still quits. **Must ignore
-its confirmation key while that Workspace transfers.** A successful transfer
-dismisses only the departing Workspace's pending close, move, and rename UI;
-a failed transfer retains them. No pending kill follows a Workspace to its
+the close confirmation's key while that Workspace transfers.**
+**Must hold at most one pending Workspace confirmation** (close, cross-Window
+move gate, Surface move iframe consent), **answered no when a newer one is
+raised or any close, cross-Window move, or Surface move starts**, by gesture or
+`dor`, even one that refuses. A move refusal waits behind it and rename
+(`lib/src/components/WorkspaceWindow.test.tsx`, `lib/src/lib/workspace-ui-store.test.ts`).
+A successful transfer dismisses only the departing Workspace's pending
+confirmation and rename UI; a failed transfer retains them. No pending kill follows a Workspace to its
 destination. Pinned by `does not accept a pending kill during transfer and releases its keyboard lease on departure`
 in `lib/src/components/WorkspaceStrip.test.tsx` and `keeps the pending kill until commit, then dismisses only the departing Workspace`
 in `lib/src/components/wall/workspace-transfer.test.ts`.
-Source of truth: `dismissWorkspaceUi` in `lib/src/lib/workspace-ui-store.ts`;
+Source of truth: `requestConfirmation` / `cancelPendingConfirmation` / `dismissWorkspaceUi` in `lib/src/lib/workspace-ui-store.ts`;
 `prepareWorkspaceTransfer` in `lib/src/components/wall/workspace-transfer.ts`.
 
 The union projection and its indicators are owned by `docs/specs/alert.md` → Workspace union; the strip that renders them by `docs/specs/standalone.md` → AppBar. Persisted containers are owned by `docs/specs/transport.md`: standalone stores one `PersistedWindow` per window, so a relaunch restores every Workspace ([Session persistence](#session-persistence)).
@@ -355,7 +360,7 @@ That order is load-bearing twice: a rename input suppresses the pane shortcuts b
 
 **Every open dialog holds its own reference-counted lease on that gate**, and command-mode dispatch resumes only once the last lease is released — so a dialog closing over another cannot lift the survivor's suppression (`createDialogKeyboardCoordinator` in `lib/src/components/wall/wall-context.tsx`).
 
-**Must defer Workspace close and move confirmations while an inline Workspace rename editor is open**, leaving its keys to the input; the pending gate appears after rename ends. Pinned by `defers the %s gate while another Workspace is being renamed` in `lib/src/components/WorkspaceStrip.test.tsx`.
+**Must defer the pending Workspace confirmation while an inline Workspace rename editor is open**, leaving its keys to the input; it appears after rename ends. Pinned by `defers the %s gate while another Workspace is being renamed` in `lib/src/components/WorkspaceStrip.test.tsx`.
 
 **Chrome outside every Wall takes the chrome keyboard lease instead**: the Workspace strip's rename editor and close confirmation live in the app bar, where `stopPropagation` cannot reach a capture-phase window listener. **The Workspace branch is inert on a Wall with no Workspace id**, which is what leaves those keys unbound on a bare Wall. Source of truth: `acquireChromeKeyboardLease` in `lib/src/components/wall/chrome-keyboard-lease.ts`; `handleWorkspaceShortcuts` in `lib/src/components/wall/keyboard/handle-workspace-shortcuts.ts`.
 
diff --git a/lib/src/components/WorkspaceStrip.test.tsx b/lib/src/components/WorkspaceStrip.test.tsx
index 3b5076d61..49ec0b348 100644
--- a/lib/src/components/WorkspaceStrip.test.tsx
+++ b/lib/src/components/WorkspaceStrip.test.tsx
@@ -8,7 +8,7 @@ import { WorkspaceStrip } from './WorkspaceStrip';
 import { chromeKeyboardHeld, resetChromeKeyboardLeases } from './wall/chrome-keyboard-lease';
 import { registerWallHandle, resetWallHandles, stubWallHandle, type WallHandle } from './wall/wall-handles';
 import { ensureResizeObserver } from './wall/wall-test-utils';
-import { requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
+import { requestWorkspaceClose, requestWorkspaceRename, workspaceCloseConfirmation } from './wall/workspace-lifecycle';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../lib/workspace-surfaces';
 import { clearTerminalActivity, setTerminalActivity } from '../lib/terminal-registry';
 import { createAlertEpisode } from '../lib/alert-episode';
@@ -18,8 +18,7 @@ import {
   getWorkspaceUiSnapshot,
   dismissWorkspaceUi,
   resetWorkspaceUi,
-  setPendingWorkspaceClose,
-  setPendingWorkspaceMove,
+  requestConfirmation,
   setWorkspaceMoveError,
 } from '../lib/workspace-ui-store';
 import {
@@ -525,8 +524,7 @@ describe('WorkspaceStrip', () => {
     await render();
     await act(async () => { requestWorkspaceRename(first); });
     await act(async () => {
-      if (kind === 'close') setPendingWorkspaceClose({ id: 'ws-2', char: 'q' });
-      else setPendingWorkspaceMove({ id: 'ws-2', char: 'q', iframeCount: 1, proceed });
+      requestConfirmation(kind === 'close' ? workspaceCloseConfirmation('ws-2', 'q') : { id: 'ws-2', char: 'q', answer: ok => { if (ok) void proceed(); } });
     });
     const input = container.querySelector<HTMLInputElement>(`[data-workspace-rename-for="${first}"]`)!;
     expect(document.body.querySelector('#kill-confirm-title')).toBeNull();
@@ -540,7 +538,7 @@ describe('WorkspaceStrip', () => {
     expect(proceed).toHaveBeenCalledOnce();
   });
 
-  it('keeps the move gate behind a close confirmation, and ignores modifiers and chords', async () => {
+  it('answers the pending confirmation no when a newer one is raised, and ignores modifiers and chords', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
     await act(async () => { createWorkspace({ id: 'ws-2' }); });
     stubHandle(first);
@@ -548,7 +546,8 @@ describe('WorkspaceStrip', () => {
     stubHandle('ws-2', { closeAll: closed });
     await render();
     const proceed = vi.fn();
-    await act(async () => { setPendingWorkspaceMove({ id: first, char: 'k', iframeCount: 1, proceed }); });
+    const move = vi.fn((ok: boolean) => { if (ok) proceed(); });
+    await act(async () => { requestConfirmation({ id: first, char: 'k', title: 'Move and lose page state?', answer: move }); });
     expect(document.body.querySelector('#kill-confirm-title')).not.toBeNull();
 
     // A bare modifier or a chord is never an answer, even on the gate's letter.
@@ -559,27 +558,22 @@ describe('WorkspaceStrip', () => {
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', ctrlKey: true, bubbles: true }));
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', metaKey: true, bubbles: true }));
     });
-    expect(proceed).not.toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingMove).not.toBeNull();
+    expect(move).not.toHaveBeenCalled();
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBeNull();
 
-    // A close raised over it shows its own letter; the same letter typed at it
-    // closes and must not also move, however the two were minted.
-    await act(async () => { setPendingWorkspaceClose({ id: 'ws-2', char: 'k' }); });
+    // A close raised over it answers the move no; the same letter typed at the
+    // close closes and must not also move, however the two were minted.
+    await act(async () => { requestConfirmation(workspaceCloseConfirmation('ws-2', 'k')); });
+    expect(move).toHaveBeenCalledExactlyOnceWith(false);
+    expect(document.body.querySelector('#kill-confirm-title')?.textContent).toBe('Confirm kill workspace');
     await act(async () => {
       window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', bubbles: true }));
     });
     await act(async () => { await Promise.resolve(); });
     expect(closed).toHaveBeenCalledTimes(1);
     expect(proceed).not.toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingMove).not.toBeNull();
-
-    // With the close resolved the gate is armed again, and its letter moves.
-    await act(async () => {
-      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', bubbles: true }));
-    });
-    expect(proceed).toHaveBeenCalledTimes(1);
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+    expect(document.body.querySelector('#kill-confirm-title')).toBeNull();
   });
 
   it('releases the rename lease when the tab being renamed is middle-clicked closed', async () => {
@@ -637,13 +631,13 @@ describe('WorkspaceStrip', () => {
     const closeAll = vi.fn(async () => null);
     stubHandle('ws-2', { hasTouchedSurfaces: () => true, closeAll });
     await render();
-    await act(async () => { setPendingWorkspaceClose({ id: 'ws-2', char: 'q' }); });
+    await act(async () => { requestConfirmation(workspaceCloseConfirmation('ws-2', 'q')); });
     expect(document.body.querySelector('#kill-confirm-title')?.textContent).toBe('Confirm kill workspace');
     expect(chromeKeyboardHeld()).toBe(true);
     setWorkspaceTransferPending('ws-2', true);
     await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: 'q', bubbles: true })); });
     expect(closeAll).not.toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-2');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-2');
     // A failed transfer leaves this prompt usable; successful commit dismisses it.
     setWorkspaceTransferPending('ws-2', false);
     await act(async () => { dismissWorkspaceUi('ws-2'); });
diff --git a/lib/src/components/WorkspaceStrip.tsx b/lib/src/components/WorkspaceStrip.tsx
index 738004eae..74fdfc87b 100644
--- a/lib/src/components/WorkspaceStrip.tsx
+++ b/lib/src/components/WorkspaceStrip.tsx
@@ -20,16 +20,14 @@ import { createWorkspaceStripDrag, type StripDragHost } from './workspace-strip-
 import { acquireChromeKeyboardLease } from './wall/chrome-keyboard-lease';
 import { getWallHandle } from './wall/wall-handles';
 import { useDialogKeyboardOwner } from './wall/wall-context';
-import { closeWorkspaceWithSurfaces, enterWorkspace, requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
+import { enterWorkspace, requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
 import { getActivitySnapshot, subscribeToActivity } from '../lib/terminal-registry';
 import { getWorkspaceSurfacesSnapshot, subscribeToWorkspaceSurfaces } from '../lib/workspace-surfaces';
 import { computeWorkspaceUnion, type WorkspaceUnion } from '../lib/workspace-union';
 import { spotlightTodo } from '../lib/todo-spotlight';
-import { isWorkspaceTransferPending } from '../lib/window-session-aggregator';
 import {
   getWorkspaceUiSnapshot,
-  setPendingWorkspaceClose,
-  setPendingWorkspaceMove,
+  settleConfirmation,
   setWorkspaceMoveError,
   setRenamingWorkspace,
   subscribeToWorkspaceUi,
@@ -72,7 +70,7 @@ export function WorkspaceStrip({
   const { workspaces, activeId } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
   const membership = useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
   const activity = useSyncExternalStore(subscribeToActivity, getActivitySnapshot);
-  const { renamingId, pendingClose, pendingMove, pendingSurfaceMove, moveError } = useSyncExternalStore(subscribeToWorkspaceUi, getWorkspaceUiSnapshot);
+  const { renamingId, confirmation, moveError } = useSyncExternalStore(subscribeToWorkspaceUi, getWorkspaceUiSnapshot);
   const [draggingId, setDraggingId] = useState<WorkspaceId | null>(null);
 
   const stripRef = useRef<HTMLDivElement>(null);
@@ -80,7 +78,7 @@ export function WorkspaceStrip({
 
   // The editor and the confirmation both sit outside every Wall, so a
   // capture-phase command-mode shortcut would still fire behind them.
-  useDialogKeyboardOwner(renamingId !== null || pendingClose !== null || pendingMove !== null || pendingSurfaceMove !== null || moveError !== null, acquireChromeKeyboardLease);
+  useDialogKeyboardOwner(renamingId !== null || confirmation !== null || moveError !== null, acquireChromeKeyboardLease);
 
   const activate = useCallback((id: WorkspaceId) => {
     getWallHandle(id)?.enterCommandMode();
@@ -160,8 +158,8 @@ export function WorkspaceStrip({
   // confirmation lands in the same place whichever Workspace it is about. No
   // Window (Storybook) leaves it viewport-centered.
   const confirmTarget = useMemo(
-    () => (pendingClose || pendingMove || pendingSurfaceMove || moveError ? document.querySelector<HTMLElement>('[data-workspace-content]') : null),
-    [pendingClose, pendingMove, pendingSurfaceMove, moveError],
+    () => (confirmation || moveError ? document.querySelector<HTMLElement>('[data-workspace-content]') : null),
+    [confirmation, moveError],
   );
 
   // One union per tab, computed in the loop it is rendered in: every tab shows
@@ -232,11 +230,10 @@ export function WorkspaceStrip({
       >
         <PlusIcon size={12} weight="bold" aria-hidden="true" />
       </button>
-      {/* Rename owns its input until it ends; both typed gates wait behind it.
-          The move gate is the same typed letter (the page state it destroys is
-          as gone as a killed pane's process) and waits behind a close, so only
-          one gate ever listens for the letter on screen. */}
-      {moveError && !pendingSurfaceMove && !pendingClose && !pendingMove && !renamingId && (
+      {/* Rename owns its input until it ends, and the confirmation waits behind
+          it; a refusal waits behind both (`docs/specs/layout.md` → "Workspace
+          lifecycle"). */}
+      {moveError && !confirmation && !renamingId && (
         <ModalFrame titleId="workspace-move-error" targetElement={confirmTarget}
           onEscape={() => setWorkspaceMoveError(null)} className={clsx("w-80 max-w-full overflow-auto text-sm", OVERLAY_MAX_HEIGHT.modal)}>
           <h2 id="workspace-move-error" className="mb-2 font-semibold">Move could not complete</h2>
@@ -244,40 +241,16 @@ export function WorkspaceStrip({
           <button type="button" className={modalActionButton()} onClick={() => setWorkspaceMoveError(null)}>Close</button>
         </ModalFrame>
       )}
-      {pendingClose && !pendingSurfaceMove && !renamingId && (
+      {confirmation && !renamingId && (
         <WorkspaceKillConfirm
-          char={pendingClose.char}
-          detail={workspaces.find(workspace => workspace.id === pendingClose.id)?.name}
-          canConfirm={() => !isWorkspaceTransferPending(pendingClose.id)}
-          onConfirm={() => {
-            const id = pendingClose.id;
-            setPendingWorkspaceClose(null);
-            void closeWorkspaceWithSurfaces(id);
-          }}
+          char={confirmation.char}
+          title={confirmation.title}
+          detail={confirmation.detail}
+          cancelHint={confirmation.cancelHint}
+          canConfirm={confirmation.canConfirm}
           targetElement={confirmTarget}
-          onCancel={() => setPendingWorkspaceClose(null)}
-        />
-      )}
-      {pendingSurfaceMove && (
-        <WorkspaceKillConfirm char={pendingSurfaceMove.char} targetElement={confirmTarget}
-          title="Move iframe?"
-          detail="moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page."
-          cancelHint="anything else to cancel"
-          onConfirm={() => pendingSurfaceMove.answer(true)}
-          onCancel={() => pendingSurfaceMove.answer(false)} />
-      )}
-      {pendingMove && !pendingSurfaceMove && !pendingClose && !renamingId && (
-        <WorkspaceKillConfirm
-          char={pendingMove.char}
-          targetElement={confirmTarget}
-          title="Move and lose page state?"
-          detail={`${pendingMove.iframeCount === 1 ? 'An iframe Surface' : `${pendingMove.iframeCount} iframe Surfaces`} in this Workspace will reload at ${pendingMove.iframeCount === 1 ? 'its' : 'their'} saved URL; a page cannot leave its window.`}
-          onConfirm={() => {
-            const { proceed } = pendingMove;
-            setPendingWorkspaceMove(null);
-            proceed();
-          }}
-          onCancel={() => setPendingWorkspaceMove(null)}
+          onConfirm={() => settleConfirmation(confirmation, true)}
+          onCancel={() => settleConfirmation(confirmation, false)}
         />
       )}
     </div>
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index deb03d105..16e661bfe 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -30,8 +30,8 @@ import { getWallHandle, listWallHandles, resetWallHandles } from './wall/wall-ha
 import { resetWorkspaceBootPlans, setWorkspaceBootPlan } from './wall/workspace-boot-plans';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { getWorkspaceSurfacesSnapshot, resetWorkspaceSurfaces } from '../lib/workspace-surfaces';
-import { previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator, seedWindowSession, setWorkspaceTransferPending } from '../lib/window-session-aggregator';
-import { getWorkspaceUiSnapshot, resetWorkspaceUi } from '../lib/workspace-ui-store';
+import { isWorkspaceTransferPending, previousWorkspaceSession, publishWorkspaceSession, resetWindowSessionAggregator, seedWindowSession, setWorkspaceTransferPending } from '../lib/window-session-aggregator';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, settleConfirmation } from '../lib/workspace-ui-store';
 import { resetTodoSpotlight } from '../lib/todo-spotlight';
 import {
   closeWorkspace,
@@ -160,23 +160,23 @@ describe('WorkspaceWindow', () => {
     expect(getActiveWorkspaceId()).toBe(first);
     await press(killKey);
     expect(getActiveWorkspaceId()).toBe('ws-2');
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-2');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-2');
     expect(leafIdsIn('ws-2')).toHaveLength(1);
     await press('Escape');
     expect(getWorkspacesSnapshot().workspaces).toHaveLength(3);
     await close();
-    await press(getWorkspaceUiSnapshot().pendingClose!.char);
+    await press(getWorkspaceUiSnapshot().confirmation!.char);
     await flush();
     expect(getActiveWorkspaceId()).toBe('ws-3');
     expect(getWorkspacesSnapshot().workspaces.map(workspace => workspace.id)).toEqual([first, 'ws-3']);
     await close();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-3');
-    await press(getWorkspaceUiSnapshot().pendingClose!.char);
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-3');
+    await press(getWorkspaceUiSnapshot().confirmation!.char);
     await flush();
     expect(getActiveWorkspaceId()).toBe(first);
     await close();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe(first);
-    await press(getWorkspaceUiSnapshot().pendingClose!.char);
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe(first);
+    await press(getWorkspaceUiSnapshot().confirmation!.char);
     const replacement = getActiveWorkspaceId();
     expect(replacement).not.toBe(first);
     expect(getWorkspacesSnapshot().workspaces).toHaveLength(1);
@@ -184,7 +184,7 @@ describe('WorkspaceWindow', () => {
     expect(getWallHandle(first)).toBeNull();
     expect(leafIdsIn(replacement)).not.toContain('pane-a');
     await close();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe(replacement);
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe(replacement);
   });
 
   it('returns from the successor tab to pane navigation after a Workspace close', async () => {
@@ -296,7 +296,7 @@ describe('WorkspaceWindow', () => {
       expect(getActiveWorkspaceId()).toBe(first);
       expect(getWorkspacesSnapshot().workspaces).toHaveLength(2);
       expect(getWorkspaceUiSnapshot().renamingId).toBeNull();
-      expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+      expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
       expect(wallFor(first).querySelector('[data-focused="true"]')).toBeNull();
     }
     await act(async () => { window.dispatchEvent(new KeyboardEvent('keydown', { key: '2', bubbles: true, cancelable: true })); });
@@ -1091,10 +1091,10 @@ describe('Surface moves between Workspaces', () => {
     await act(async () => { await expect(moveSurface('frame', request({ workspace: 'workspace:2' }))).rejects.toThrow('dangerously-destroy'); });
     let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
     await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
-    expect(getWorkspaceUiSnapshot().pendingSurfaceMove).not.toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBeNull();
     expect(document.body.textContent).toContain('saved URL');
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
-    await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(false); await pending; });
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, false); await pending; });
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
     if (kind === 'tool') {
       recordToolDirty('frame', true);
@@ -1102,15 +1102,65 @@ describe('Surface moves between Workspaces', () => {
       recordToolDirty('frame', false);
       await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
       recordToolDirty('frame', true);
-      await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(true); await expect(pending).rejects.toThrow('edits'); });
+      await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, true); await expect(pending).rejects.toThrow('edits'); });
       expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
       recordToolDirty('frame', false);
     }
     await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
-    await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(true); await pending; });
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, true); await pending; });
     expect(getWallHandle('ws-2')!.ownsSurface('frame')).toBe(true);
   });
 
+  /** A source holding only a plain iframe, beside two terminal Workspaces. */
+  async function iframeWalls() {
+    const source = getActiveWorkspaceId();
+    createWorkspace({ id: 'ws-2', activate: false });
+    createWorkspace({ id: 'ws-3', activate: false });
+    const meta = browserLeafMeta('Frame', { surfaceType: 'browser', renderMode: 'iframe', url: 'http://localhost:3000/saved' });
+    await render(<><WorkspaceStrip /><WorkspaceWindow initialPlans={{ [source]: { restoredLathLayout: { version: 1, tree: leafTree('frame'), leafMeta: { frame: meta } } }, 'ws-2': { initialPaneIds: ['pane-x'] }, 'ws-3': { initialPaneIds: ['pane-y'] } }} /></>);
+    return source;
+  }
+
+  it('answers a pending confirmation no when a Surface move starts', async () => {
+    await twoWalls();
+    const answer = vi.fn();
+    requestConfirmation({ id: 'ws-2', char: 'q', answer });
+    await act(async () => { await moveSurface('pane-a', request({ workspace: 'workspace:2' })); });
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+    expect(getWallHandle('ws-2')!.ownsSurface('pane-a')).toBe(true);
+  });
+
+  it('answers a pending iframe consent no when a Workspace close is requested', async () => {
+    const source = await iframeWalls();
+    let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
+    expect(getWorkspaceUiSnapshot().confirmation?.title).toBe('Move iframe?');
+    await act(async () => { requestWorkspaceClose('ws-2'); expect(await pending).toBeNull(); });
+    expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
+    expect(isWorkspaceTransferPending(source)).toBe(false);
+    // The released destination is no longer guarded, so its untouched close runs.
+    await act(async () => { await vi.waitFor(() => expect(getWorkspacesSnapshot().workspaces.map(ws => ws.id)).toEqual([source, 'ws-3'])); });
+    expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
+  });
+
+  it('lets a second GUI iframe move supersede the first one’s consent and complete', async () => {
+    const source = await iframeWalls();
+    let first!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    let second!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    await act(async () => { first = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
+    const firstConsent = getWorkspaceUiSnapshot().confirmation;
+    await act(async () => { second = moveSurface('frame', request({ workspace: workspaceStore.workspaceRefFor('ws-3') }), true); });
+    await act(async () => { expect(await first).toBeNull(); });
+    // The superseded move's cleanup leaves the second one's guards in place.
+    expect(isWorkspaceTransferPending(source)).toBe(true);
+    expect(isWorkspaceTransferPending('ws-3')).toBe(true);
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBe(firstConsent);
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, true); await second; });
+    expect(getWallHandle('ws-3')!.ownsSurface('frame')).toBe(true);
+    expect(getWallHandle('ws-2')!.ownsSurface('frame')).toBe(false);
+    expect([source, 'ws-2', 'ws-3'].some(isWorkspaceTransferPending)).toBe(false);
+  });
+
   it('rechecks a Tool that becomes dirty in the final preparation microtask', async () => {
     const source = getActiveWorkspaceId();
     createWorkspace({ id: 'ws-2', activate: false });
@@ -1149,9 +1199,9 @@ describe('Surface moves between Workspaces', () => {
     notYetServing();
     let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
     await act(async () => { pending = moveSurface('frame', request({ workspace: 'workspace:2' }), true); });
-    expect(getWorkspaceUiSnapshot().pendingSurfaceMove).not.toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).not.toBeNull();
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
-    await act(async () => { getWorkspaceUiSnapshot().pendingSurfaceMove!.answer(false); expect(await pending).toBeNull(); });
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, false); expect(await pending).toBeNull(); });
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
   });
 });
diff --git a/lib/src/components/wall/MoveWorkspaceAction.tsx b/lib/src/components/wall/MoveWorkspaceAction.tsx
index 658f365c7..3d1575230 100644
--- a/lib/src/components/wall/MoveWorkspaceAction.tsx
+++ b/lib/src/components/wall/MoveWorkspaceAction.tsx
@@ -5,13 +5,18 @@ import type { WorkspaceId } from '../../lib/session-types';
 import { getWorkspacesSnapshot, subscribeToWorkspaces, workspaceRefFor } from '../../lib/workspace-store';
 import { getWorkspaceSurfacesSnapshot, subscribeToWorkspaceSurfaces } from '../../lib/workspace-surfaces';
 import { WindowFocusedContext } from './wall-context';
-import { requestSurfaceMove } from './surface-move';
+import { requestSurfaceMove, surfaceMoveRefusal } from './surface-move';
+import { getWallHandle } from './wall-handles';
 import { ACTION_BOX_CLASS, closedSelectKeyDown } from './TerminalContextView';
 
 /** Native picker matches the context's browser actions and escapes its clipping. */
 export function MoveWorkspaceAction({ id, sourceId }: { id: string; sourceId: WorkspaceId }) {
   const { workspaces } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
-  const members = useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
+  // Membership decides whether New workspace is offered.
+  useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
+  const source = getWallHandle(sourceId);
+  const refusal = (destination: { workspace: WorkspaceId } | { new: true }) => surfaceMoveRefusal(source, destination) ?? undefined;
+  const newRefusal = refusal({ new: true });
   const focused = useContext(WindowFocusedContext);
   return <span className={`relative ${ACTION_BOX_CLASS} ${SUBTLE_ACTION_REST_COLOR_CLASS} ${focused ? SUBTLE_ACTION_WRAPPER_INTERACTION_CLASS : ''}`}>
     move to workspace…<CaretDownIcon size={10} weight="fill" />
@@ -22,8 +27,11 @@ export function MoveWorkspaceAction({ id, sourceId }: { id: string; sourceId: Wo
         else if (event.target.value) requestSurfaceMove(id, { workspace: event.target.value });
       }}>
       <option value="">move to workspace…</option>
-      {workspaces.filter(workspace => workspace.id !== sourceId).map(workspace => <option key={workspace.id} value={workspace.id}>{workspaceRefFor(workspace.id)} — {workspace.name}</option>)}
-      <option value="+" disabled={(members.get(sourceId)?.length ?? 0) <= 1}>New workspace</option>
+      {workspaces.filter(workspace => workspace.id !== sourceId).map(workspace => {
+        const why = refusal({ workspace: workspace.id });
+        return <option key={workspace.id} value={workspace.id} disabled={!!why} title={why}>{workspaceRefFor(workspace.id)} — {workspace.name}</option>;
+      })}
+      <option value="+" disabled={!!newRefusal} title={newRefusal}>New workspace</option>
     </select>
   </span>;
 }
diff --git a/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts b/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts
index 4d36b7a77..4b29ec2ae 100644
--- a/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts
+++ b/lib/src/components/wall/keyboard/handle-workspace-shortcuts.test.ts
@@ -74,7 +74,7 @@ describe('handleWorkspaceShortcuts', () => {
     }
     expect(getWorkspacesSnapshot()).toBe(before);
     expect(getWorkspaceUiSnapshot().renamingId).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
   });
 
   it.each(['active', 'inactive'])('renames the selected %s Workspace without activating it', target => {
diff --git a/lib/src/components/wall/surface-move.ts b/lib/src/components/wall/surface-move.ts
index cd44b0be8..8f45f3238 100644
--- a/lib/src/components/wall/surface-move.ts
+++ b/lib/src/components/wall/surface-move.ts
@@ -2,7 +2,7 @@ import { flushSync } from 'react-dom';
 import type { MoveSurfaceRequest, MoveSurfaceResponse } from 'dor/commands/types';
 import { closeWorkspace, createWorkspace, generateWorkspaceId, getActiveWorkspaceId, hasWorkspace, resolveWorkspaceRef, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
 import { beginWorkspaceSessionBatch, forgetWorkspaceSession, invalidateWorkspaceSaves, isWorkspaceTransferPending, moveRetainedSurfaceRecord, previousWorkspaceSession, publishWorkspaceSession, setWorkspaceTransferPending } from '../../lib/window-session-aggregator';
-import { dismissWorkspaceUi, getWorkspaceUiSnapshot, setPendingSurfaceMove, setWorkspaceMoveError } from '../../lib/workspace-ui-store';
+import { cancelPendingConfirmation, dismissWorkspaceUi, requestConfirmation, setWorkspaceMoveError } from '../../lib/workspace-ui-store';
 import type { PersistedSession, WorkspaceId } from '../../lib/session-types';
 import { sanitizeText } from '../../lib/osc-sanitize';
 import { getTerminalInstance } from '../../lib/terminal-registry';
@@ -11,17 +11,37 @@ import { awaitWallHandle, errorText } from './dor-control-shared';
 import { forgetWorkspaceBootPlan, setWorkspaceBootPlan } from './workspace-boot-plans';
 import { getWallHandle, wallHandleOwning, type WallHandle } from './wall-handles';
 
-let moving = false;
+/** The move in flight, if any. A declined consent releases it synchronously,
+ *  so whichever verb cancelled it can start at once. */
+let moving: object | null = null;
 
 const IFRAME_FLAG_REQUIRED = 'Moving this iframe reopens at its saved URL; pass --dangerously-destroy-iframe-page-state to accept losing page state';
 
-function consent(source: string): Promise<boolean> {
-  const ui = getWorkspaceUiSnapshot();
-  if (ui.pendingClose || ui.pendingMove || ui.pendingSurfaceMove || ui.renamingId) throw new Error('Finish the open Workspace dialog before moving this Surface');
-  return new Promise(resolve => setPendingSurfaceMove({ id: source, char: randomKillChar(), answer: accepted => {
-    setPendingSurfaceMove(null);
-    resolve(accepted);
-  } }));
+/** Why `source` cannot move a Surface to `destination`, or null when it can:
+ *  the coordinator, the drag's targets and the picker share it. */
+export function surfaceMoveRefusal(source: WallHandle | null, destination: { workspace: WorkspaceId } | { new: true }): string | null {
+  if (!source?.canMoveSurfaces) return 'This host does not support moving Surfaces between Workspaces';
+  const target = 'workspace' in destination ? destination.workspace : null;
+  if (target === source.workspaceId) return 'The Surface is already in that Workspace';
+  if (!target && source.surfaceIds().length <= 1) return 'The only Surface is already in its own Workspace';
+  if (isWorkspaceTransferPending(source.workspaceId) || (target && isWorkspaceTransferPending(target))) return 'A Workspace is already moving';
+  return null;
+}
+
+/** False when the user declines, or when a newer verb cancels the question;
+ *  a no releases the move before it resolves. */
+function consent(source: WorkspaceId, release: () => void): Promise<boolean> {
+  return new Promise(resolve => requestConfirmation({
+    id: source,
+    char: randomKillChar(),
+    title: 'Move iframe?',
+    detail: 'moving this iframe will trigger a refresh and reopen at its saved URL, possibly losing page state or returning to an earlier page.',
+    cancelHint: 'anything else to cancel',
+    answer: accepted => {
+      if (!accepted) release();
+      resolve(accepted);
+    },
+  }));
 }
 
 /** The same close tail as `closeWorkspaceWithSurfaces`, for a Wall left empty. */
@@ -35,14 +55,17 @@ function discardWorkspace(id: WorkspaceId): void {
 /** One coordinator for GUI and dor. Preparation and consent change no membership;
  * the synchronous departure/adoption is reversible until both records are published. */
 export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest, 'surface' | 'workspace'>, gui = false): Promise<MoveSurfaceResponse | null> {
+  // A move still awaiting its consent is answered no and released here.
+  cancelPendingConfirmation();
   if (moving) throw new Error('Another Surface move is in progress');
-  const source = wallHandleOwning(id);
-  if (!source?.canMoveSurfaces) throw new Error('This host does not support moving Surfaces between Workspaces');
+  const owner = wallHandleOwning(id);
   const destination = request.destination;
   const resolved = 'workspace' in destination ? resolveWorkspaceRef(destination.workspace) : null;
   if (resolved && !resolved.ok) throw new Error(resolved.message);
   let targetId = resolved?.ok ? resolved.id : null;
-  if (targetId === source.workspaceId) throw new Error('The Surface is already in that Workspace');
+  const refusal = surfaceMoveRefusal(owner, targetId ? { workspace: targetId } : { new: true });
+  if (refusal) throw new Error(refusal);
+  const source = owner!;
   const toNew = !targetId;
   let target: WallHandle | null = targetId ? getWallHandle(targetId) : null;
   /** Rechecked after every await: either Wall may close or remount meanwhile. */
@@ -52,7 +75,6 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     if (targetId && (!hasWorkspace(targetId) || !target?.canMoveSurfaces || getWallHandle(targetId) !== target)) throw new Error('The destination Workspace is unavailable');
   };
   checkEndpoints();
-  if (isWorkspaceTransferPending(source.workspaceId) || (targetId && isWorkspaceTransferPending(targetId))) throw new Error('A Workspace is already moving');
   let prepared = source.prepareSurfaceMove(id);
   let iframeConsented = request.dangerouslyDestroyIframePageState;
   if (prepared.iframe && !iframeConsented && !gui) throw new Error(IFRAME_FLAG_REQUIRED);
@@ -60,12 +82,20 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
   const ensureIframeConsent = async (): Promise<boolean> => {
     if (!prepared.iframe || iframeConsented) return true;
     if (!gui) throw new Error(IFRAME_FLAG_REQUIRED);
-    if (!await consent(source.workspaceId)) return false;
+    if (!await consent(source.workspaceId, release)) return false;
     iframeConsented = true;
     prepared = source.prepareSurfaceMove(id);
     return true;
   };
-  moving = true;
+  const token = {};
+  /** Idempotent, and inert once a newer move holds the guard. */
+  const release = () => {
+    if (moving !== token) return;
+    moving = null;
+    setWorkspaceTransferPending(source.workspaceId, false);
+    if (targetId) setWorkspaceTransferPending(targetId, false);
+  };
+  moving = token;
   setWorkspaceTransferPending(source.workspaceId, true);
   if (targetId) setWorkspaceTransferPending(targetId, true);
   const activeBefore = getActiveWorkspaceId();
@@ -168,9 +198,7 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     throw error;
   } finally {
     endBatch?.();
-    setWorkspaceTransferPending(source.workspaceId, false);
-    if (targetId) setWorkspaceTransferPending(targetId, false);
-    moving = false;
+    release();
   }
 }
 
diff --git a/lib/src/components/wall/surface-workspace-drag.test.ts b/lib/src/components/wall/surface-workspace-drag.test.ts
index 3dace6c87..4046d6f27 100644
--- a/lib/src/components/wall/surface-workspace-drag.test.ts
+++ b/lib/src/components/wall/surface-workspace-drag.test.ts
@@ -5,7 +5,7 @@ import { registerWallHandle, resetWallHandles, stubWallHandle } from './wall-han
 import { requestSurfaceMove } from './surface-move';
 import { surfaceWorkspaceDrag } from './surface-workspace-drag';
 
-vi.mock('./surface-move', () => ({ requestSurfaceMove: vi.fn() }));
+vi.mock('./surface-move', async importOriginal => ({ ...await importOriginal<typeof import('./surface-move')>(), requestSurfaceMove: vi.fn() }));
 
 let count: number;
 let sourceTab: HTMLElement;
diff --git a/lib/src/components/wall/surface-workspace-drag.ts b/lib/src/components/wall/surface-workspace-drag.ts
index 90de02210..a5e7a7543 100644
--- a/lib/src/components/wall/surface-workspace-drag.ts
+++ b/lib/src/components/wall/surface-workspace-drag.ts
@@ -1,7 +1,6 @@
-import { getWorkspaceUiSnapshot } from '../../lib/workspace-ui-store';
 import { workspaceStripElement, workspaceTabElement, workspaceTabElements } from '../workspace-tab-elements';
 import { wallHandleOwning } from './wall-handles';
-import { requestSurfaceMove } from './surface-move';
+import { requestSurfaceMove, surfaceMoveRefusal } from './surface-move';
 
 /** A pane press owns this path; only a tab press owns reorder/tear-out. */
 export interface SurfaceWorkspaceDrag {
@@ -20,11 +19,14 @@ function targetAt(x: number, y: number): HTMLElement | null {
   const targets = [...workspaceTabElements(), workspaceTabElement(null)];
   return targets.find(target => target && inside(target.getBoundingClientRect(), x, y)) ?? strip;
 }
+/** The drop's destination, or null for the strip's gaps. */
+function destinationOf(target: HTMLElement): { workspace: string } | { new: true } | null {
+  if (target.hasAttribute('data-workspace-new')) return { new: true };
+  return target.dataset.workspaceTab ? { workspace: target.dataset.workspaceTab } : null;
+}
 function eligible(id: string, target: HTMLElement): boolean {
-  const source = wallHandleOwning(id);
-  const ui = getWorkspaceUiSnapshot();
-  return !!source?.canMoveSurfaces && !ui.pendingSurfaceMove && !ui.pendingMove && !ui.pendingClose
-    && (target.hasAttribute('data-workspace-new') ? source.surfaceIds().length > 1 : !!target.dataset.workspaceTab && target.dataset.workspaceTab !== source.workspaceId);
+  const destination = destinationOf(target);
+  return !!destination && !surfaceMoveRefusal(wallHandleOwning(id), destination);
 }
 function highlight(target: HTMLElement | null): void {
   if (target === highlighted) return;
@@ -45,7 +47,7 @@ export const surfaceWorkspaceDrag: SurfaceWorkspaceDrag = {
     const target = targetAt(x, y);
     end();
     if (!target) return false;
-    if (eligible(id, target)) requestSurfaceMove(id, target.hasAttribute('data-workspace-new') ? { new: true } : { workspace: target.dataset.workspaceTab! });
+    if (eligible(id, target)) requestSurfaceMove(id, destinationOf(target)!);
     return true;
   },
   end,
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index 985460bfb..1d9487fe2 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -17,6 +17,7 @@ import { clearTerminalActivity, setTerminalActivity } from '../../lib/session-ac
 import { createAlertEpisode } from '../../lib/alert-episode';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../../lib/workspace-surfaces';
 import { resetWindowSessionAggregator } from '../../lib/window-session-aggregator';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi } from '../../lib/workspace-ui-store';
 import { setPlatform } from '../../lib/platform';
 import type { OpenPort, PlatformAdapter } from '../../lib/platform/types';
 
@@ -331,6 +332,23 @@ function terminalRows(prefix: string, refs: string[]): Array<Record<string, unkn
   return refs.map((ref, index) => ({ ref, id: `${prefix}-${ref}`, kind: 'terminal', focused: index === 0 }));
 }
 
+it.each([
+  ['close', { workspace: 'workspace:2' }],
+  ['move', { workspace: 'workspace:2', toWindow: 'new' }],
+] as const)('answers a pending confirmation no as workspace.%s starts, even when it refuses', async (verb, params) => {
+  createWorkspace({ id: 'ws-2', activate: false });
+  handleFor('ws-2', { runningCount: () => 1 });
+  setPlatform({} as unknown as PlatformAdapter);
+  const confirmed = vi.fn();
+  requestConfirmation({ id: 'ws-2', char: 'q', answer: confirmed });
+  const detail = request(`workspace.${verb}`, params);
+  await handleWorkspaceControl(detail);
+  expect(answer(detail)).toEqual(expect.any(String));
+  expect(confirmed).toHaveBeenCalledExactlyOnceWith(false);
+  expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+  resetWorkspaceUi();
+});
+
 describe('surface.list --all', () => {
   it('tags every row with its Workspace and carries the directory', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
diff --git a/lib/src/components/wall/workspace-control.ts b/lib/src/components/wall/workspace-control.ts
index 6d8ddf5aa..60696ea9f 100644
--- a/lib/src/components/wall/workspace-control.ts
+++ b/lib/src/components/wall/workspace-control.ts
@@ -24,6 +24,7 @@ import {
   type ResolvedWorkspace,
 } from '../../lib/workspace-store';
 import { getWorkspaceSurfacesSnapshot } from '../../lib/workspace-surfaces';
+import { cancelPendingConfirmation } from '../../lib/workspace-ui-store';
 import { computeWorkspaceUnion } from '../../lib/workspace-union';
 import { awaitWallHandle, errorText, mountingRefusal, stringParam } from './dor-control-shared';
 import { attachSurfacePorts } from './surface-ports';
@@ -247,6 +248,7 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
         return;
       }
       if (toWindow !== undefined && !isWindowRef(toWindow)) {
+        cancelPendingConfirmation();
         const handle = await awaitWallHandle(target.id);
         if (!handle) {
           detail.respond({ ok: false, error: mountingRefusal(target.ref) });
@@ -294,6 +296,7 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
     }
 
     case WORKSPACE_CONTROL_METHODS.close: {
+      cancelPendingConfirmation();
       const target = requireWorkspace(detail);
       if (!target) return;
       // A close is answered only once the Workspace's Wall is there to answer
diff --git a/lib/src/components/wall/workspace-lifecycle.test.ts b/lib/src/components/wall/workspace-lifecycle.test.ts
index b5116f670..c2f25e6c2 100644
--- a/lib/src/components/wall/workspace-lifecycle.test.ts
+++ b/lib/src/components/wall/workspace-lifecycle.test.ts
@@ -10,7 +10,7 @@ import {
   requestWorkspaceClose,
 } from './workspace-lifecycle';
 import { registerWallHandle, resetWallHandles, stubWallHandle, type WallHandle } from './wall-handles';
-import { getWorkspaceUiSnapshot, resetWorkspaceUi, setPendingWorkspaceClose, setPendingWorkspaceMove, setRenamingWorkspace } from '../../lib/workspace-ui-store';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, setRenamingWorkspace } from '../../lib/workspace-ui-store';
 import {
   closeWorkspace,
   createWorkspace,
@@ -89,7 +89,7 @@ describe('closeWorkspaceWithSurfaces', () => {
     expect(secondCloseAll).not.toHaveBeenCalled();
     // The verb the strip and the keys share takes the same lock.
     requestWorkspaceClose('ws-2');
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
 
     releaseFirst();
     expect(await firstClose).toBeNull();
@@ -125,13 +125,13 @@ describe('closeWorkspaceWithSurfaces', () => {
     // The rename editor is open on the Workspace being closed: nothing unmounts
     // it through `blur`, so the verb itself has to clear it.
     setRenamingWorkspace('ws-2');
-    setPendingWorkspaceClose({ id: 'ws-2', char: 'x' });
-    setPendingWorkspaceMove({ id: 'ws-2', char: 'a', iframeCount: 1, proceed: vi.fn() });
+    const answer = vi.fn();
+    requestConfirmation({ id: 'ws-2', char: 'a', answer });
 
     expect(await closeWorkspaceWithSurfaces('ws-2')).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
     expect(getWorkspaceUiSnapshot().renamingId).toBeNull();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
   });
 });
 
@@ -152,7 +152,7 @@ describe('requestWorkspaceClose', () => {
       await vi.advanceTimersByTimeAsync(0);
       expect(closeAll).toHaveBeenCalled();
       expect(ids()).toEqual([first]);
-      expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+      expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
     } finally {
       vi.useRealTimers();
     }
@@ -164,7 +164,7 @@ describe('requestWorkspaceClose', () => {
     handleFor('ws-2', { runningCount: () => 1 });
     requestWorkspaceClose('ws-2');
     await Promise.resolve();
-    expect(getWorkspaceUiSnapshot().pendingClose?.id).toBe('ws-2');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe('ws-2');
     expect(ids()).toEqual([first, 'ws-2']);
   });
 });
@@ -172,13 +172,22 @@ describe('requestWorkspaceClose', () => {
 it('preserves another Workspace’s rename and close confirmation when closing a sibling', async () => {
   const [first] = ids();
   createWorkspace({ id: 'ws-2' });
-  handleFor('ws-2');
+  const answer = vi.fn();
+  // A confirmation raised while the close walks its Surfaces is a newer question.
+  handleFor('ws-2', { closeAll: async () => { requestConfirmation({ id: first, char: 'x', answer }); return null; } });
   setRenamingWorkspace(first);
-  setPendingWorkspaceClose({ id: first, char: 'x' });
-  setPendingWorkspaceMove({ id: first, char: 'a', iframeCount: 1, proceed: vi.fn() });
-  const before = getWorkspaceUiSnapshot();
   expect(await closeWorkspaceWithSurfaces('ws-2')).toBeNull();
-  expect(getWorkspaceUiSnapshot()).toBe(before);
+  expect(getWorkspaceUiSnapshot()).toMatchObject({ renamingId: first, confirmation: { id: first, char: 'x' } });
+  expect(answer).not.toHaveBeenCalled();
+});
+
+it('answers a pending confirmation no when a close is requested', () => {
+  createWorkspace({ id: 'ws-2' });
+  const answer = vi.fn();
+  requestConfirmation({ id: 'ws-2', char: 'a', answer });
+  requestWorkspaceClose('ws-2');
+  expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+  expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
 });
 
 
diff --git a/lib/src/components/wall/workspace-lifecycle.ts b/lib/src/components/wall/workspace-lifecycle.ts
index cbae7c50a..03f51108d 100644
--- a/lib/src/components/wall/workspace-lifecycle.ts
+++ b/lib/src/components/wall/workspace-lifecycle.ts
@@ -3,8 +3,8 @@ import { flushSync } from 'react-dom';
 import { awaitWallHandle, mountingRefusal } from './dor-control-shared';
 import { getWallHandle } from './wall-handles';
 import { forgetWorkspaceSession, isWorkspaceTransferPending } from '../../lib/window-session-aggregator';
-import { dismissWorkspaceUi, setPendingWorkspaceClose, setRenamingWorkspace } from '../../lib/workspace-ui-store';
-import { closeWorkspace, getActiveWorkspaceId, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
+import { cancelPendingConfirmation, dismissWorkspaceUi, requestConfirmation, setRenamingWorkspace, type WorkspaceConfirmation } from '../../lib/workspace-ui-store';
+import { closeWorkspace, getActiveWorkspaceId, getWorkspacesSnapshot, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
 import type { WorkspaceId } from '../../lib/session-types';
 import type { WorkspaceCloseMode } from './wall-types';
 import { confirmToolEditorsClose, UNSAVED_TOOL_REFUSAL } from '../../lib/tool-editor';
@@ -72,6 +72,7 @@ export async function closeWorkspaceWithSurfaces(
   id: WorkspaceId,
   mode: WorkspaceCloseMode = 'prompt',
 ): Promise<string | null> {
+  cancelPendingConfirmation();
   if (isWorkspaceTransferPending(id)) return 'Workspace is transferring';
   if (closeInFlight) return CLOSE_IN_FLIGHT_REFUSAL;
   const handle = getWallHandle(id);
@@ -113,6 +114,7 @@ export async function closeWorkspaceWithSurfaces(
  * confirmation, otherwise close immediately.
  */
 export function requestWorkspaceClose(id: WorkspaceId): void {
+  cancelPendingConfirmation();
   if (closeInFlight || isWorkspaceTransferPending(id)) return;
   void closeOnceWallRegisters(id);
 }
@@ -132,12 +134,23 @@ async function closeOnceWallRegisters(id: WorkspaceId): Promise<void> {
     // An immediate close reveals the Workspace itself.
     setActiveWorkspace(id);
     handle.selectWorkspaceTab();
-    setPendingWorkspaceClose({ id, char: randomKillChar() });
+    requestConfirmation(workspaceCloseConfirmation(id));
     return;
   }
   await closeWorkspaceWithSurfaces(id);
 }
 
+/** The typed close question; the key is ignored while the Workspace transfers. */
+export function workspaceCloseConfirmation(id: WorkspaceId, char = randomKillChar()): WorkspaceConfirmation {
+  return {
+    id,
+    char,
+    detail: getWorkspacesSnapshot().workspaces.find(workspace => workspace.id === id)?.name,
+    canConfirm: () => !isWorkspaceTransferPending(id),
+    answer: accepted => { if (accepted) void closeWorkspaceWithSurfaces(id); },
+  };
+}
+
 /** Open the strip's inline rename editor on a Workspace. */
 export function requestWorkspaceRename(id: WorkspaceId): void {
   setRenamingWorkspace(id);
diff --git a/lib/src/components/wall/workspace-transfer.test.ts b/lib/src/components/wall/workspace-transfer.test.ts
index 88a656ff7..b222fcc43 100644
--- a/lib/src/components/wall/workspace-transfer.test.ts
+++ b/lib/src/components/wall/workspace-transfer.test.ts
@@ -1,4 +1,4 @@
-import { getWorkspaceUiSnapshot, setPendingWorkspaceClose, resetWorkspaceUi } from '../../lib/workspace-ui-store';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi } from '../../lib/workspace-ui-store';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { prepareWorkspaceTransfer } from './workspace-transfer';
 import type { PersistedSession } from '../../lib/session-types';
@@ -53,14 +53,16 @@ function deps(order: string[] = [], overrides: Partial<Parameters<typeof prepare
 
 describe('prepareWorkspaceTransfer', () => {
   it('keeps the pending kill until commit, then dismisses only the departing Workspace', async () => {
-    setPendingWorkspaceClose({ id: 'ws-id', char: 'q' });
+    const answer = vi.fn();
+    requestConfirmation({ id: 'ws-id', char: 'q', answer });
     const prepared = await prepareWorkspaceTransfer(deps());
-    expect(getWorkspaceUiSnapshot().pendingClose).toEqual({ id: 'ws-id', char: 'q' });
+    expect(getWorkspaceUiSnapshot().confirmation).toMatchObject({ id: 'ws-id', char: 'q' });
     prepared.commit();
-    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
-    setPendingWorkspaceClose({ id: 'sibling', char: 'k' });
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+    requestConfirmation({ id: 'sibling', char: 'k', answer: vi.fn() });
     prepared.commit();
-    expect(getWorkspaceUiSnapshot().pendingClose).toEqual({ id: 'sibling', char: 'k' });
+    expect(getWorkspaceUiSnapshot().confirmation).toMatchObject({ id: 'sibling', char: 'k' });
   });
 
   it('serializes with a live cwd probe before anything is detached', async () => {
diff --git a/lib/src/lib/workspace-ui-store.test.ts b/lib/src/lib/workspace-ui-store.test.ts
new file mode 100644
index 000000000..5e9193e77
--- /dev/null
+++ b/lib/src/lib/workspace-ui-store.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, expect, it, vi } from 'vitest';
+import {
+  cancelPendingConfirmation,
+  dismissWorkspaceUi,
+  getWorkspaceUiSnapshot,
+  requestConfirmation,
+  resetWorkspaceUi,
+  settleConfirmation,
+  subscribeToWorkspaceUi,
+} from './workspace-ui-store';
+
+const emitted = vi.fn();
+let unsubscribe: () => void;
+
+beforeEach(() => {
+  resetWorkspaceUi();
+  unsubscribe = subscribeToWorkspaceUi(emitted);
+  emitted.mockClear();
+});
+
+afterEach(() => unsubscribe());
+
+it('answers the pending confirmation no before installing a newer one, in one emit', () => {
+  const first = vi.fn(() => expect(getWorkspaceUiSnapshot().confirmation).toBeNull());
+  requestConfirmation({ id: 'a', char: 'q', answer: first });
+  emitted.mockClear();
+  const second = { id: 'b', char: 'r', answer: vi.fn() };
+  requestConfirmation(second);
+  expect(first).toHaveBeenCalledExactlyOnceWith(false);
+  expect(getWorkspaceUiSnapshot().confirmation).toBe(second);
+  expect(emitted).toHaveBeenCalledTimes(1);
+  // The superseded question's answer is stale now.
+  settleConfirmation({ id: 'a', char: 'q', answer: first }, true);
+  expect(getWorkspaceUiSnapshot().confirmation).toBe(second);
+});
+
+it.each([
+  ['cancel', () => cancelPendingConfirmation()],
+  ['dismiss', () => dismissWorkspaceUi('a')],
+  ['reset', () => resetWorkspaceUi()],
+] as const)('%s answers no once and emits once', (_, clear) => {
+  const answer = vi.fn();
+  requestConfirmation({ id: 'a', char: 'q', answer });
+  emitted.mockClear();
+  clear();
+  clear();
+  expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+  expect(emitted).toHaveBeenCalledTimes(1);
+  expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+});
diff --git a/lib/src/lib/workspace-ui-store.ts b/lib/src/lib/workspace-ui-store.ts
index 4316624b5..992a2c6cc 100644
--- a/lib/src/lib/workspace-ui-store.ts
+++ b/lib/src/lib/workspace-ui-store.ts
@@ -1,5 +1,20 @@
 import type { WorkspaceId } from './session-types';
 
+/** A typed-letter question about one Workspace: its close, a cross-Window move
+ *  losing iframe page state, or a Surface move refreshing an iframe. `answer`
+ *  runs once, after the slot has cleared. */
+export interface WorkspaceConfirmation {
+  id: WorkspaceId;
+  /** Minted once, so a re-render cannot change the letter on screen. */
+  char: string;
+  title?: string;
+  detail?: string;
+  cancelHint?: string;
+  /** False ignores the key, leaving the question up. */
+  canConfirm?: () => boolean;
+  answer: (accepted: boolean) => void;
+}
+
 /**
  * The Workspace strip's transient UI states, held outside it because the
  * Workspace verbs open them from outside any component (`docs/specs/layout.md`
@@ -9,22 +24,14 @@ import type { WorkspaceId } from './session-types';
 export interface WorkspaceUiState {
   /** The Workspace whose inline rename editor is open. */
   renamingId: WorkspaceId | null;
-  /** The Workspace awaiting its typed close confirmation, and the letter that
-   *  accepts it (minted once, so a re-render cannot change the letter on screen). */
-  pendingClose: { id: WorkspaceId; char: string } | null;
+  /** The one pending confirmation; a newer one answers it no
+   *  (`docs/specs/layout.md` → "Workspace lifecycle"). */
+  confirmation: WorkspaceConfirmation | null;
   /** A refused move stays visible until dismissed or retried. */
   moveError: { id: WorkspaceId; reason: string } | null;
-  /** A Surface move between Workspaces awaiting its typed iframe-refresh
-   *  confirmation; `answer` settles the move
-   *  (`docs/specs/layout.md` → "Moving Surfaces between Workspaces"). */
-  pendingSurfaceMove: { id: WorkspaceId; char: string; answer: (accepted: boolean) => void } | null;
-  /** A move between Windows awaiting its typed confirmation, because it would
-   *  destroy the page state of `iframeCount` iframe Surfaces; `proceed` runs the
-   *  move (`docs/specs/layout.md` → "Workspaces"). */
-  pendingMove: { id: WorkspaceId; char: string; iframeCount: number; proceed: () => void } | null;
 }
 
-const EMPTY: WorkspaceUiState = { renamingId: null, pendingClose: null, pendingMove: null, pendingSurfaceMove: null, moveError: null };
+const EMPTY: WorkspaceUiState = { renamingId: null, confirmation: null, moveError: null };
 
 let state: WorkspaceUiState = EMPTY;
 const listeners = new Set<() => void>();
@@ -51,18 +58,28 @@ export function setRenamingWorkspace(id: WorkspaceId | null): void {
   emit({ ...state, renamingId: id });
 }
 
-export function setPendingWorkspaceClose(pending: WorkspaceUiState['pendingClose']): void {
-  if (state.pendingClose?.id === pending?.id && state.pendingClose?.char === pending?.char) return;
-  emit({ ...state, pendingClose: pending });
+/** Ask `next`, first answering any pending confirmation no. */
+export function requestConfirmation(next: WorkspaceConfirmation): void {
+  const previous = state.confirmation;
+  state = { ...state, confirmation: null };
+  previous?.answer(false);
+  emit({ ...state, confirmation: next });
 }
 
-export function setPendingWorkspaceMove(pending: WorkspaceUiState['pendingMove']): void {
-  if (state.pendingMove === pending) return;
-  emit({ ...state, pendingMove: pending });
+/** Every Workspace verb calls this as it starts: a pending confirmation is
+ *  answered no. */
+export function cancelPendingConfirmation(): void {
+  const previous = state.confirmation;
+  if (!previous) return;
+  emit({ ...state, confirmation: null });
+  previous.answer(false);
 }
 
-export function setPendingSurfaceMove(pending: WorkspaceUiState['pendingSurfaceMove']): void {
-  emit({ ...state, pendingSurfaceMove: pending });
+/** Answer `confirmation` if it is still the pending one; a stale answer is ignored. */
+export function settleConfirmation(confirmation: WorkspaceConfirmation, accepted: boolean): void {
+  if (state.confirmation !== confirmation) return;
+  emit({ ...state, confirmation: null });
+  confirmation.answer(accepted);
 }
 
 export function setWorkspaceMoveError(error: WorkspaceUiState['moveError']): void {
@@ -73,20 +90,19 @@ export function setWorkspaceMoveError(error: WorkspaceUiState['moveError']): voi
  *  teardown dialog taking the window, and tests. */
 export function resetWorkspaceUi(): void {
   if (state === EMPTY) return;
-  state.pendingSurfaceMove?.answer(false);
+  const { confirmation } = state;
   emit(EMPTY);
+  confirmation?.answer(false);
 }
 
 /** Forget only the departing Workspace's chrome, preserving sibling dialogs. */
 export function dismissWorkspaceUi(id: WorkspaceId): void {
-  const { renamingId, pendingClose, pendingMove, pendingSurfaceMove, moveError } = state;
-  if (renamingId !== id && pendingClose?.id !== id && pendingMove?.id !== id && pendingSurfaceMove?.id !== id && moveError?.id !== id) return;
-  if (pendingSurfaceMove?.id === id) pendingSurfaceMove.answer(false);
+  const { renamingId, confirmation, moveError } = state;
+  if (renamingId !== id && confirmation?.id !== id && moveError?.id !== id) return;
   emit({
-    pendingSurfaceMove: pendingSurfaceMove?.id === id ? null : pendingSurfaceMove,
     renamingId: renamingId === id ? null : renamingId,
-    pendingClose: pendingClose?.id === id ? null : pendingClose,
-    pendingMove: pendingMove?.id === id ? null : pendingMove,
+    confirmation: confirmation?.id === id ? null : confirmation,
     moveError: moveError?.id === id ? null : moveError,
   });
+  if (confirmation?.id === id) confirmation.answer(false);
 }
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 4a1bb7e36..238186ff8 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -13,7 +13,7 @@
   "docs/specs/dor-tools-lib.md": 400,
   "docs/specs/glossary.md": 3000,
   "docs/specs/hosted.md": 4800,
-  "docs/specs/layout.md": 11950,
+  "docs/specs/layout.md": 12050,
   "docs/specs/mobile-terminal-ui.md": 2300,
   "docs/specs/mouse-and-clipboard.md": 5250,
   "docs/specs/one-time.md": 3850,
diff --git a/standalone/src/quit-confirm-store.test.ts b/standalone/src/quit-confirm-store.test.ts
index b882e3cb5..249a51f45 100644
--- a/standalone/src/quit-confirm-store.test.ts
+++ b/standalone/src/quit-confirm-store.test.ts
@@ -15,7 +15,7 @@ import {
 
 import { chromeKeyboardHeld } from '../../lib/src/components/wall/chrome-keyboard-lease';
 import { createWorkspace, closeWorkspace, moveWorkspace, renameWorkspace, resetWorkspaces, setActiveWorkspace } from 'dormouse-lib/lib/workspace-store';
-import { getWorkspaceUiSnapshot, resetWorkspaceUi, setPendingWorkspaceClose, setPendingWorkspaceMove, setRenamingWorkspace, setWorkspaceMoveError } from 'dormouse-lib/lib/workspace-ui-store';
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, setRenamingWorkspace, setWorkspaceMoveError } from 'dormouse-lib/lib/workspace-ui-store';
 import { isWorkspaceTransferPending, resetWindowSessionAggregator, setWorkspaceTransferPending } from 'dormouse-lib/lib/window-session-aggregator';
 
 // The gate↔orchestrator seam itself is covered by quit.test.ts.
@@ -112,13 +112,14 @@ describe("quit-confirm store", () => {
   });
 
   it('clears competing chrome without dropping transfer guards', () => {
-    setPendingWorkspaceClose({ id: 'workspace-1', char: 'a' });
-    setPendingWorkspaceMove({ id: 'workspace-1', char: 'b', iframeCount: 1, proceed: vi.fn() });
+    const answer = vi.fn();
+    requestConfirmation({ id: 'workspace-1', char: 'a', answer });
     setRenamingWorkspace('workspace-1');
     setWorkspaceMoveError({ id: 'workspace-1', reason: 'Wait for the Tool browser to connect' });
     setWorkspaceTransferPending('workspace-1', true);
     openQuitConfirm(makeCtx());
-    expect(getWorkspaceUiSnapshot()).toEqual({ pendingClose: null, pendingMove: null, pendingSurfaceMove: null, renamingId: null, moveError: null });
+    expect(getWorkspaceUiSnapshot()).toEqual({ confirmation: null, renamingId: null, moveError: null });
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
     expect(isWorkspaceTransferPending('workspace-1')).toBe(true);
     expect(chromeKeyboardHeld()).toBe(true);
   });
diff --git a/standalone/src/workspace-drag.test.ts b/standalone/src/workspace-drag.test.ts
index 112252035..276b2165c 100644
--- a/standalone/src/workspace-drag.test.ts
+++ b/standalone/src/workspace-drag.test.ts
@@ -28,7 +28,7 @@ import {
 } from "./workspace-drag";
 import { _setWindowLabelForTesting } from "./window-label";
 import { registerWallHandle, resetWallHandles, stubWallHandle } from "dormouse-lib/components/wall/wall-handles";
-import { getWorkspaceUiSnapshot, resetWorkspaceUi } from "dormouse-lib/lib/workspace-ui-store";
+import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, settleConfirmation } from "dormouse-lib/lib/workspace-ui-store";
 
 import { cancelEditorClose, decideEditorClose, getEditorClosePrompt } from "dormouse-lib/lib/tool-editor";
 import { recordToolDirty, resetToolDirty } from "dormouse-lib/lib/tool-dirty-store";
@@ -185,7 +185,7 @@ describe("releasing the drag", () => {
     drop();
     await settle();
     expect(getEditorClosePrompt()?.items).toMatchObject([{ id: "editor" }]);
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
     await decideEditorClose("cancel");
     await settle();
     expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
@@ -195,11 +195,11 @@ describe("releasing the drag", () => {
     await settle();
     await decideEditorClose("discard");
     await settle();
-    const pending = getWorkspaceUiSnapshot().pendingMove;
-    expect(pending).toMatchObject({ iframeCount: 1 });
+    const pending = getWorkspaceUiSnapshot().confirmation;
+    expect(pending).toMatchObject({ detail: expect.stringContaining("An iframe Surface") });
     expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
     expect(mocks.tearOutWorkspace).not.toHaveBeenCalled();
-    pending!.proceed();
+    settleConfirmation(pending!, true);
     if (existing) expect(mocks.transferWorkspaceTo).toHaveBeenCalledWith("ws-1", "ws-2", { x: 120, y: 9 }, undefined, ["editor"]);
     else expect(mocks.tearOutWorkspace).toHaveBeenCalledWith("ws-1", expect.any(Object), ["editor"]);
   });
@@ -230,10 +230,10 @@ describe("releasing the drag", () => {
     await settle();
     // Nothing moved: the gate is up, naming what it would cost.
     expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
-    const pending = getWorkspaceUiSnapshot().pendingMove;
-    expect(pending).toMatchObject({ id: "ws-1", iframeCount: 2 });
+    const pending = getWorkspaceUiSnapshot().confirmation;
+    expect(pending).toMatchObject({ id: "ws-1", title: "Move and lose page state?", detail: expect.stringContaining("2 iframe Surfaces") });
     // The strip's key handler settles it; here, the letter's own effect.
-    pending!.proceed();
+    settleConfirmation(pending!, true);
     expect(mocks.transferWorkspaceTo).toHaveBeenCalledWith("ws-1", "ws-2", { x: 120, y: 9 }, undefined, []);
     resetWallHandles();
     resetWorkspaceUi();
@@ -246,10 +246,18 @@ describe("releasing the drag", () => {
     onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
     await settle();
     expect(mocks.tearOutWorkspace).toHaveBeenCalled();
-    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
     resetWallHandles();
   });
 
+  it("answers a pending confirmation no as the drop starts its move", () => {
+    const answer = vi.fn();
+    requestConfirmation({ id: "ws-other", char: "q", answer });
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+  });
+
   it("tears out when released over no window", async () => {
     hit = null;
     onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
diff --git a/standalone/src/workspace-drag.ts b/standalone/src/workspace-drag.ts
index 707b81c4a..4841e89ff 100644
--- a/standalone/src/workspace-drag.ts
+++ b/standalone/src/workspace-drag.ts
@@ -7,7 +7,7 @@ import { tearOutWorkspace, transferWorkspaceTo } from "./workspace-move";
 import { getWallHandle } from "dormouse-lib/components/wall/wall-handles";
 import { confirmToolEditorsClose } from "dormouse-lib/lib/tool-editor";
 import { randomKillChar } from "dormouse-lib/components/KillConfirm";
-import { setPendingWorkspaceMove, setWorkspaceMoveError } from "dormouse-lib/lib/workspace-ui-store";
+import { cancelPendingConfirmation, requestConfirmation, setWorkspaceMoveError } from "dormouse-lib/lib/workspace-ui-store";
 import { workspaceTabRect } from "./workspace-tabs";
 import { DOOR_TAB_HEIGHT_PX, DOOR_TAB_MAX_WIDTH_PX } from "dormouse-lib/components/design";
 
@@ -163,6 +163,7 @@ export function onDropOnOtherWindow(
   // the caret this is about to clear.
   endGesture();
   if (insideStrip) return;
+  cancelPendingConfirmation();
   const grab = grabOffset(id);
   void (async () => {
     // Probed fresh rather than reusing the throttled answer: up to
@@ -189,7 +190,13 @@ export function onDropOnOtherWindow(
     // the same typed letter a kill takes (docs/specs/layout.md → Workspaces).
     const iframes = getWallHandle(id)?.iframeSurfaceRefs() ?? [];
     if (iframes.length > 0) {
-      setPendingWorkspaceMove({ id, char: randomKillChar(), iframeCount: iframes.length, proceed: move });
+      requestConfirmation({
+        id,
+        char: randomKillChar(),
+        title: "Move and lose page state?",
+        detail: `${iframes.length === 1 ? "An iframe Surface" : `${iframes.length} iframe Surfaces`} in this Workspace will reload at ${iframes.length === 1 ? "its" : "their"} saved URL; a page cannot leave its window.`,
+        answer: (accepted) => { if (accepted) move(); },
+      });
       return;
     }
     move();

From 810fd5566ca87b720ebd4c290a1cc1da4337e512 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 17:31:28 -0700
Subject: [PATCH 2/5] Commit Surface moves in one synchronous step, without a
 persistence batch

With the cwd probe skipped, building a record never awaits, and a new
Workspace's Wall registers inside its flushSync render. So after the last
await the coordinator creates the destination, fences both revisions,
departs, adopts, finishes both Walls and publishes both records in one
synchronous run.

session-save splits a synchronous assemblePersistedSession out of
buildPersistedSession; the Wall handle's serializeNow replaces the async
serializePersistence. The aggregator's write batch becomes
publishWorkspaceSessions, which sets several records behind one scheduled
write, so even a pagehide write never holds half a move. Rollback can only
run before finishSurfaceMove, so it no longer disposes an auto-refill
shell, and no record needs republishing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/specs/transport.md                       |  2 +-
 lib/src/components/Wall.tsx                   | 11 ++---
 lib/src/components/WorkspaceWindow.test.tsx   | 14 +++++-
 lib/src/components/wall/surface-move.ts       | 45 ++++++-------------
 .../wall/use-session-persistence.ts           | 15 ++++++-
 lib/src/components/wall/wall-handles.ts       |  5 ++-
 lib/src/lib/session-save.ts                   | 39 ++++++++++++----
 lib/src/lib/window-session-aggregator.test.ts | 18 ++++----
 lib/src/lib/window-session-aggregator.ts      | 23 ++++------
 9 files changed, 96 insertions(+), 76 deletions(-)

diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index e270184ca..abd248162 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -243,7 +243,7 @@ Source of truth: `ManagedVoicePort` in `lib/src/lib/platform/managed-voice-types
 
 **Each mounted Workspace publishes its `PersistedSession` to a Window collector**, which orders them by the Workspace store and writes the whole Window through one debounced writer the host installs at boot. **A Workspace with neither a published nor a boot-seeded session is dropped rather than written empty**, so a snapshot taken mid-boot cannot replace a restored Workspace with a blank one. **A Workspace's save compares against its own previous record** — seeded from disk until its Wall publishes — never the Window's active one, or a dead PTY's retained cwd and alert would come from the wrong Workspace. **Reordering, renaming, or switching the active Workspace writes too**: each changes the blob with no Session changing. A `PersistedWorkspace` is a `WorkspaceId`, a `name`, `nameIsAuto`, and that Workspace's `PersistedSession`. **Always write `nameIsAuto`**; lacking it, only a `Workspace <n>` name is auto. The top-level snapshot is a `PersistedWindow` (its own `version: 1`) wrapping v3 sessions: the ordered `PersistedWorkspace` list plus the active `WorkspaceId`. **VS Code does not use it** — each webview persists one bare `PersistedSession`, its single Workspace, through its own per-surface state API (`docs/specs/vscode.md`).
 
-**Must publish both Workspace records together across a Surface move**, fencing saves collected before ownership changed and retaining a departed Session's previous cwd/alert in the destination. Window writes are held until both records publish or the move rolls back. Source of truth: `beginWorkspaceSessionBatch` / `invalidateWorkspaceSaves` / `moveRetainedSurfaceRecord` in `lib/src/lib/window-session-aggregator.ts`; `doSave` in `lib/src/components/wall/use-session-persistence.ts`.
+**Must publish both Workspace records in one synchronous step with the Surface move's ownership change**, unprobed and behind one Window write (`pagehide` included), fencing saves collected before ownership changed and retaining a departed Session's previous cwd/alert in the destination. Source of truth: `publishWorkspaceSessions` / `invalidateWorkspaceSaves` / `moveRetainedSurfaceRecord` in `lib/src/lib/window-session-aggregator.ts`; `serializeNow` / `doSave` in `lib/src/components/wall/use-session-persistence.ts`; `assemblePersistedSession` in `lib/src/lib/session-save.ts`.
 
 **The Window wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` owns the JSON and the storage slot over a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence); the shared save/restore code still operates on a bare `PersistedSession`, which the boot hands it per Workspace. **A Window-persisting adapter answers through `getWindowState` / `saveWindowState`, and answers nothing on the bare-Session `getState` / `saveState` pair** — its blob is a Window and every shared reader of `getState` wants a Session. **A blob written before standalone persisted Windows is wrapped as the window's one Workspace**; that is the only migration.
 
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 469525ab5..9be8420bd 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -1768,7 +1768,8 @@ export function Wall({
   // re-render never replaces a registered entry.
   // Capture before a synchronous commit. Rollback restores the complete Wall,
   // including a Door's held rect and the ref allocator, without killing Sessions.
-  const captureMoveRollback = (incomingId?: string) => {
+  // It runs only before `finishSurfaceMove`, so no refill has mounted a shell.
+  const captureMoveRollback = () => {
     const snapshot = lath.store.getSnapshot();
     const savedDoors = doorsRef.current;
     const refs = new Map(dorSurfaceRefsRef.current);
@@ -1780,10 +1781,6 @@ export function Wall({
     const context = terminalContextRef.current;
     return () => {
       movingSurfaceRef.current = true;
-      // A temporary auto-refill may already have mounted its default shell.
-      for (const member of memberSurfaceIds()) {
-        if (member !== incomingId && !snapshot.leafMeta.has(member)) disposeSession(member);
-      }
       doorsRef.current = savedDoors; setDoors(savedDoors);
       dorSurfaceRefsRef.current = refs; nextDorSurfaceRefIndexRef.current = next;
       lath.store.restoreSnapshot(snapshot);
@@ -1833,7 +1830,7 @@ export function Wall({
     },
     adoptSurfaceMove: (id, meta) => {
       if (ownsSurface(id) || closingWorkspaceRef.current) throw new Error('The destination cannot accept this Surface');
-      const rollback = captureMoveRollback(id);
+      const rollback = captureMoveRollback();
       movingSurfaceRef.current = true;
       const ref = livePaneId();
       if (!lath.store.addLeaf(id, meta, ref ? { refId: ref, edge: lath.store.autoEdgeFor(ref) } : null).ok) throw new Error('Could not place the Surface');
@@ -1850,7 +1847,7 @@ export function Wall({
       else enterTerminalMode(id);
     },
     showMoveNotice: (id, text) => showShellSpawnNotice(id, text, 8000),
-    serializePersistence: persistence.serialize,
+    serializeNow: persistence.serializeNow,
 
     surfaceIds: memberSurfaceIds,
     ownsSurface,
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index 16e661bfe..90c415799 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -27,6 +27,7 @@ import { FakePtyAdapter } from '../lib/platform/fake-adapter';
 import { getActivitySnapshot, setTerminalActivity } from '../lib/terminal-registry';
 import { createAlertEpisode } from '../lib/alert-episode';
 import { getWallHandle, listWallHandles, resetWallHandles } from './wall/wall-handles';
+import * as wallHandles from './wall/wall-handles';
 import { resetWorkspaceBootPlans, setWorkspaceBootPlan } from './wall/workspace-boot-plans';
 import { mountWallHarness, type WallHarness } from './wall/wall-test-utils';
 import { getWorkspaceSurfacesSnapshot, resetWorkspaceSurfaces } from '../lib/workspace-surfaces';
@@ -1021,10 +1022,21 @@ describe('Surface moves between Workspaces', () => {
     await act(async () => { await expect(moveSurface('pane-a', request({ workspace: 'workspace:2' }))).rejects.toThrow('placement failed'); });
     expect(getWallHandle(source)!.surfaceIds()).toEqual(['pane-a', 'pane-b']);
     expect(target.surfaceIds()).toEqual(['pane-x']);
-    expect((await getWallHandle(source)!.serializePersistence({ probeCwd: false })).surfaceRefs).toEqual({ 'pane-a': 'surface:1', 'pane-b': 'surface:2' });
+    expect(getWallHandle(source)!.serializeNow().surfaceRefs).toEqual({ 'pane-a': 'surface:1', 'pane-b': 'surface:2' });
     adoption.mockRestore();
   });
 
+  it('refuses a move to a new Workspace whose Wall is not registered synchronously, and discards it', async () => {
+    const source = await twoWalls();
+    const real = wallHandles.getWallHandle;
+    vi.spyOn(wallHandles, 'getWallHandle').mockImplementation(id => id === source || id === 'ws-2' ? real(id) : null);
+    await act(async () => { await expect(moveSurface('pane-a', request({ new: true }))).rejects.toThrow('The new Workspace did not mount'); });
+    vi.mocked(wallHandles.getWallHandle).mockRestore();
+    expect(getWorkspacesSnapshot().workspaces.map(ws => ws.id)).toEqual([source, 'ws-2']);
+    expect(getWallHandle(source)!.surfaceIds()).toEqual(['pane-a', 'pane-b']);
+    expect(getActiveWorkspaceId()).toBe(source);
+  });
+
   it('fences a pre-departure save collected during new Workspace mounting', async () => {
     const source = await twoWalls();
     let finishProbe!: (cwd: string | null) => void;
diff --git a/lib/src/components/wall/surface-move.ts b/lib/src/components/wall/surface-move.ts
index 8f45f3238..eb91439f4 100644
--- a/lib/src/components/wall/surface-move.ts
+++ b/lib/src/components/wall/surface-move.ts
@@ -1,13 +1,13 @@
 import { flushSync } from 'react-dom';
 import type { MoveSurfaceRequest, MoveSurfaceResponse } from 'dor/commands/types';
 import { closeWorkspace, createWorkspace, generateWorkspaceId, getActiveWorkspaceId, hasWorkspace, resolveWorkspaceRef, setActiveWorkspace, workspaceRefFor } from '../../lib/workspace-store';
-import { beginWorkspaceSessionBatch, forgetWorkspaceSession, invalidateWorkspaceSaves, isWorkspaceTransferPending, moveRetainedSurfaceRecord, previousWorkspaceSession, publishWorkspaceSession, setWorkspaceTransferPending } from '../../lib/window-session-aggregator';
+import { forgetWorkspaceSession, invalidateWorkspaceSaves, isWorkspaceTransferPending, moveRetainedSurfaceRecord, publishWorkspaceSessions, setWorkspaceTransferPending } from '../../lib/window-session-aggregator';
 import { cancelPendingConfirmation, dismissWorkspaceUi, requestConfirmation, setWorkspaceMoveError } from '../../lib/workspace-ui-store';
-import type { PersistedSession, WorkspaceId } from '../../lib/session-types';
+import type { WorkspaceId } from '../../lib/session-types';
 import { sanitizeText } from '../../lib/osc-sanitize';
 import { getTerminalInstance } from '../../lib/terminal-registry';
 import { randomKillChar } from '../KillConfirm';
-import { awaitWallHandle, errorText } from './dor-control-shared';
+import { errorText } from './dor-control-shared';
 import { forgetWorkspaceBootPlan, setWorkspaceBootPlan } from './workspace-boot-plans';
 import { getWallHandle, wallHandleOwning, type WallHandle } from './wall-handles';
 
@@ -53,7 +53,8 @@ function discardWorkspace(id: WorkspaceId): void {
 }
 
 /** One coordinator for GUI and dor. Preparation and consent change no membership;
- * the synchronous departure/adoption is reversible until both records are published. */
+ * after the last await, departure, adoption and both records' publication run
+ * in one synchronous step, reversible until both Walls finish. */
 export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest, 'surface' | 'workspace'>, gui = false): Promise<MoveSurfaceResponse | null> {
   // A move still awaiting its consent is answered no and released here.
   cancelPendingConfirmation();
@@ -102,11 +103,8 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
   const oldWorkspaceRef = workspaceRefFor(source.workspaceId);
   let created = false;
   let committed = false;
-  let endBatch: (() => void) | undefined;
   let undoDeparture: (() => void) | undefined;
   let undoAdoption: (() => void) | undefined;
-  let sourceRecord: PersistedSession | null = null;
-  let targetRecord: PersistedSession | null = null;
   try {
     if (!await ensureIframeConsent()) return null;
     // Neither a dialog nor a cwd probe reserves the Surface's kind or dirty state.
@@ -116,24 +114,22 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     // A Tool may start serving an iframe while the persistence flush awaits.
     if (!await ensureIframeConsent()) return null;
     checkEndpoints();
-    endBatch = beginWorkspaceSessionBatch();
-    sourceRecord = previousWorkspaceSession(source.workspaceId);
-    invalidateWorkspaceSaves(source.workspaceId);
+    // From here to the end nothing awaits: no save, write or verb interleaves.
     if (!targetId) {
       targetId = generateWorkspaceId();
       setWorkspaceBootPlan(targetId, { emptyForMove: true });
+      // A synchronous render flushes the new Wall's registering effects.
       flushSync(() => createWorkspace({ id: targetId!, activate: false }));
       created = true;
       setWorkspaceTransferPending(targetId, true);
-      target = getWallHandle(targetId) ?? await awaitWallHandle(targetId);
+      target = getWallHandle(targetId);
       if (!target) throw new Error('The new Workspace did not mount');
-      // Revalidate after the new Wall's passive registration; no prompt here.
       checkEndpoints();
     }
-    // No await may separate this final dirty/kind check from departure.
     prepared = source.prepareSurfaceMove(id);
     if (prepared.iframe && !iframeConsented) throw new Error('This Surface started serving an iframe; retry the move to confirm its refresh');
-    targetRecord = previousWorkspaceSession(targetId);
+    // Fence saves collected before the ownership change, a new Wall's included.
+    invalidateWorkspaceSaves(source.workspaceId);
     invalidateWorkspaceSaves(targetId);
     const receiver = target!;
     let surfaceRef = '';
@@ -147,19 +143,11 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
       receiver.finishSurfaceMove();
       source.finishSurfaceMove();
     });
-    // Mounting a new Wall can let saves collect the pre-departure layout. Fence
-    // those too, once both ownership changes have completed synchronously.
-    invalidateWorkspaceSaves(source.workspaceId);
-    invalidateWorkspaceSaves(targetId);
-    moveRetainedSurfaceRecord(id, source.workspaceId, targetId);
-    const [sourceSession, targetSession] = await Promise.all([
-      source.serializePersistence({ probeCwd: false }), receiver.serializePersistence({ probeCwd: false }),
-    ]);
-    publishWorkspaceSession(source.workspaceId, sourceSession);
-    publishWorkspaceSession(targetId, targetSession);
-    // Closing the source is irreversible. Later UI/notice failures must never
-    // restore membership into a Wall that has already unmounted.
+    // A finished Wall may have refilled, and closing the source is
+    // irreversible: nothing after this point restores membership.
     committed = true;
+    moveRetainedSurfaceRecord(id, source.workspaceId, targetId);
+    publishWorkspaceSessions([[source.workspaceId, source.serializeNow()], [targetId, receiver.serializeNow()]]);
     const sourceEmpty = source.surfaceIds().length === 0;
     flushSync(() => {
       if (sourceEmpty) discardWorkspace(source.workspaceId);
@@ -185,19 +173,14 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
     return { status: 'moved', surfaceId: id, surfaceRef, workspaceId: targetId, workspaceRef };
   } catch (error) {
     if (committed) throw error;
-    invalidateWorkspaceSaves(source.workspaceId);
-    if (targetId) invalidateWorkspaceSaves(targetId);
     flushSync(() => {
       undoAdoption?.(); undoDeparture?.();
       source.finishSurfaceMove(); target?.finishSurfaceMove();
       if (created && targetId) discardWorkspace(targetId);
       if (hasWorkspace(activeBefore)) setActiveWorkspace(activeBefore);
     });
-    if (sourceRecord) publishWorkspaceSession(source.workspaceId, sourceRecord);
-    if (!created && targetId && targetRecord) publishWorkspaceSession(targetId, targetRecord);
     throw error;
   } finally {
-    endBatch?.();
     release();
   }
 }
diff --git a/lib/src/components/wall/use-session-persistence.ts b/lib/src/components/wall/use-session-persistence.ts
index f6f7cbdb3..d38f2977c 100644
--- a/lib/src/components/wall/use-session-persistence.ts
+++ b/lib/src/components/wall/use-session-persistence.ts
@@ -2,7 +2,7 @@ import { DEFAULT_WORKSPACE_ID, readPersistedSession } from '../../lib/session-ty
 import { useCallback, useEffect, useMemo, useRef, type RefObject } from 'react';
 import { pasteFilePaths } from '../../lib/clipboard';
 import { getPlatform } from '../../lib/platform';
-import { buildPersistedSession, saveSession, type SaveOptions, type SaveSink } from '../../lib/session-save';
+import { assemblePersistedSession, buildPersistedSession, saveSession, type SaveOptions, type SaveSink } from '../../lib/session-save';
 import { createSessionDirtyTracker } from '../../lib/session-dirty';
 import { previousWorkspaceSession, publishWorkspaceSession, workspaceSessionRevision, SESSION_SAVE_DEBOUNCE_MS } from '../../lib/window-session-aggregator';
 import { getWorkspace, setWorkspaceAlertDelivery, subscribeToWorkspaces, hasWorkspace } from '../../lib/workspace-store';
@@ -24,6 +24,9 @@ export interface SessionPersistenceHandle {
   /** Build this Workspace's record without publishing it — what a Workspace
    *  leaving for another Window carries with it. */
   serialize: (options?: SaveOptions) => Promise<PersistedSession>;
+  /** This Workspace's record now, with no cwd probe: what a Surface move
+   *  publishes in the same synchronous run as its ownership change. */
+  serializeNow: () => PersistedSession;
 }
 
 export function useSessionPersistence({
@@ -140,6 +143,14 @@ export function useSessionPersistence({
     );
   }, [collect, sink, saveOptions]);
 
+  const serializeNow = useCallback((): PersistedSession => {
+    const { panes, doors, lathLayout, surfaceRefs } = collect();
+    return assemblePersistedSession(
+      panes, doors, lathLayout, surfaceRefs?.refs, surfaceRefs?.next,
+      sink?.previous() ?? null, null, saveOptions().alertDelivery,
+    );
+  }, [collect, sink, saveOptions]);
+
   const doSave = useCallback((options?: SaveOptions): Promise<void> => {
     if (workspaceId === undefined) {
       const { panes, doors, lathLayout, surfaceRefs } = collect();
@@ -320,5 +331,5 @@ export function useSessionPersistence({
     selectedTypeRef,
   ]);
 
-  return { flush: flushSessionSave, serialize };
+  return { flush: flushSessionSave, serialize, serializeNow };
 }
diff --git a/lib/src/components/wall/wall-handles.ts b/lib/src/components/wall/wall-handles.ts
index 01c0dafec..1e75358f5 100644
--- a/lib/src/components/wall/wall-handles.ts
+++ b/lib/src/components/wall/wall-handles.ts
@@ -29,7 +29,8 @@ export interface WallHandle {
   finishSurfaceMove(): void;
   focusSurface(id: string, acknowledge: boolean): void;
   showMoveNotice(id: string, text: string): void;
-  serializePersistence(options?: SaveOptions): Promise<PersistedSession>;
+  /** This Workspace's record now, with no cwd probe. */
+  serializeNow(): PersistedSession;
   workspaceId: WorkspaceId;
   /** The Wall's member Surfaces: visible panes ∪ Doors. */
   surfaceIds(): string[];
@@ -128,7 +129,7 @@ export function stubWallHandle(workspaceId: WorkspaceId, overrides: Partial<Wall
     finishSurfaceMove: () => {},
     focusSurface: () => {},
     showMoveNotice: () => {},
-    serializePersistence: async () => ({ version: 3, panes: [] }),
+    serializeNow: () => ({ version: 3, panes: [] }),
     surfaceIds: () => [],
     ownsSurface: () => false,
     iframeSurfaceRefs: () => [],
diff --git a/lib/src/lib/session-save.ts b/lib/src/lib/session-save.ts
index 0fdf6745e..b5d6c7fa6 100644
--- a/lib/src/lib/session-save.ts
+++ b/lib/src/lib/session-save.ts
@@ -58,6 +58,14 @@ async function probeCwds(
   return cwds;
 }
 
+/** The Surfaces whose cwd a save probes: every non-browser pane and Door. */
+function cwdSurfaceIds(panes: SavePaneInput[], doors: PersistedDoor[]): string[] {
+  const browser = new Map<string, boolean>();
+  for (const pane of panes) browser.set(pane.id, pane.surfaceType === 'browser');
+  for (const door of doors) browser.set(door.id, door.component === 'browser');
+  return [...browser].filter(([, isBrowser]) => !isBrowser).map(([id]) => id);
+}
+
 /**
  * Build one Workspace's `PersistedSession` from its live panes and Doors.
  *
@@ -80,6 +88,27 @@ export async function buildPersistedSession(
   previous?: PersistedSession | null,
   options: SaveOptions = {},
 ): Promise<PersistedSession> {
+  // One probe for the whole set: a terminal pane's cwd is the only field here
+  // that costs a host round trip.
+  const cwds = await probeCwds(platform, cwdSurfaceIds(panes, doors), options.probeCwd !== false);
+  return assemblePersistedSession(panes, doors, lathLayout, surfaceRefs, surfaceRefsNext, previous, cwds, options.alertDelivery);
+}
+
+/**
+ * `buildPersistedSession` past its probe, synchronously: `cwds` null keeps each
+ * terminal's previous cwd. A Surface move publishes both Workspaces with no
+ * await between ownership change and publication.
+ */
+export function assemblePersistedSession(
+  panes: SavePaneInput[],
+  doors: PersistedDoor[],
+  lathLayout: unknown,
+  surfaceRefs: PersistedSurfaceRefs | undefined,
+  surfaceRefsNext: number | undefined,
+  previous: PersistedSession | null | undefined,
+  cwds: Record<string, string | null> | null,
+  alertDeliveryOverrides?: AlertDeliveryOverrides,
+): PersistedSession {
   const previousPanes = previousPaneMap(previous ?? null);
   const allPanes = new Map<string, { id: string; title: string; surfaceType: PersistedSurfaceType; params?: Record<string, unknown> }>();
   for (const pane of panes) {
@@ -103,14 +132,6 @@ export async function buildPersistedSession(
     allPanes.set(item.id, { id: item.id, title: item.title, surfaceType: doorSurfaceType, params: item.params });
   }
 
-  // One probe for the whole set, before the per-pane build: a terminal pane's cwd
-  // is the only field here that costs a host round trip.
-  const cwds = await probeCwds(
-    platform,
-    [...allPanes.values()].filter((pane) => pane.surfaceType !== 'browser').map((pane) => pane.id),
-    options.probeCwd !== false,
-  );
-
   const persisted: PersistedPane[] = [...allPanes.values()].map((pane) => {
     const previousPane = previousPanes.get(pane.id);
     if (pane.surfaceType === 'browser') {
@@ -138,7 +159,7 @@ export async function buildPersistedSession(
       ...(tool ? { tool } : {}),
     };
   });
-  const alertDelivery = normalizeAlertDeliveryOverrides(options.alertDelivery ?? previous?.alertDelivery);
+  const alertDelivery = normalizeAlertDeliveryOverrides(alertDeliveryOverrides ?? previous?.alertDelivery);
   return {
     version: 3,
     ...(Object.keys(alertDelivery).length ? { alertDelivery } : {}),
diff --git a/lib/src/lib/window-session-aggregator.test.ts b/lib/src/lib/window-session-aggregator.test.ts
index beea9eb7f..ed9ab8ebb 100644
--- a/lib/src/lib/window-session-aggregator.test.ts
+++ b/lib/src/lib/window-session-aggregator.test.ts
@@ -4,7 +4,6 @@
 // and there is no unload without a `window`.
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import {
-  beginWorkspaceSessionBatch,
   clearWorkspaceTransferring,
   flushWindowSession,
   forgetWorkspaceSession,
@@ -13,6 +12,7 @@ import {
   markWorkspaceTransferring,
   previousWorkspaceSession,
   publishWorkspaceSession,
+  publishWorkspaceSessions,
   resetWindowSessionAggregator,
   seedWindowSession,
 } from './window-session-aggregator';
@@ -274,20 +274,20 @@ describe('window session aggregator', () => {
 });
 
 
-it('holds every write through a Surface move, including pagehide and explicit flush, then writes both records once', async () => {
+it.each([false, true])('publishes several records behind one write (unloading: %s)', async (unloading) => {
   const first = getWorkspacesSnapshot().workspaces[0].id;
   const second = createWorkspace({ name: 'Second' }).id;
   publishWorkspaceSession(first, session('moving'));
   publishWorkspaceSession(second, session('other'));
   const write = vi.fn();
   installWindowSessionWriter(write);
-  const end = beginWorkspaceSessionBatch();
-  publishWorkspaceSession(first, { version: 3, panes: [] });
-  window.dispatchEvent(new Event('pagehide'));
-  await flushWindowSession();
-  expect(write).not.toHaveBeenCalled();
-  publishWorkspaceSession(second, { version: 3, panes: [...session('other').panes, ...session('moving').panes] });
-  end();
+  if (unloading) {
+    window.dispatchEvent(new Event('pagehide'));
+    write.mockClear();
+  }
+  publishWorkspaceSessions([[first, { version: 3, panes: [] }], [second, { version: 3, panes: [...session('other').panes, ...session('moving').panes] }]]);
+  // An unloading Window writes on every publish, synchronously; one publish is one write.
+  if (!unloading) await flushWindowSession();
   expect(write).toHaveBeenCalledTimes(1);
   const saved = write.mock.calls[0][0] as PersistedWindow;
   expect(saved.workspaces[0].session.panes).toEqual([]);
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index dea0cbc2e..0481d3560 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -15,20 +15,10 @@ import type { PersistedSession, PersistedWindow, PersistedWorkspace, WorkspaceId
  */
 
 const revisions = new Map<WorkspaceId, number>();
-/** Set while a Surface move publishes both Walls: no write sees one half. */
-let batchHeld = false;
 /** Fence asynchronous saves collected before ownership changed. */
 export function workspaceSessionRevision(id: WorkspaceId): number { return revisions.get(id) ?? 0; }
 export function invalidateWorkspaceSaves(id: WorkspaceId): void { revisions.set(id, workspaceSessionRevision(id) + 1); }
 
-/** Hold every write until both Walls have published. */
-export function beginWorkspaceSessionBatch(): () => void {
-  if (batchHeld) throw new Error('A Workspace persistence batch is already running');
-  batchHeld = true;
-  cancelPending();
-  return () => { batchHeld = false; scheduleWrite(); };
-}
-
 /** Preserve a dead Session's retained cwd/alert while its Wall changes. */
 export function moveRetainedSurfaceRecord(id: string, source: WorkspaceId, destination: WorkspaceId): void {
   const row = records.get(source)?.panes.find(pane => pane.id === id);
@@ -76,7 +66,13 @@ export function seedWindowSession(snapshot: PersistedWindow | null): void {
 /** Record a Workspace's latest session and schedule the Window write. Also how a
  *  Workspace arriving from another Window installs the record it brought. */
 export function publishWorkspaceSession(workspaceId: WorkspaceId, session: PersistedSession): void {
-  records.set(workspaceId, session);
+  publishWorkspaceSessions([[workspaceId, session]]);
+}
+
+/** Record several Workspaces' sessions behind one scheduled write, so no write
+ *  (not even one during `pagehide`) holds some of them without the rest. */
+export function publishWorkspaceSessions(entries: ReadonlyArray<readonly [WorkspaceId, PersistedSession]>): void {
+  for (const [workspaceId, session] of entries) records.set(workspaceId, session);
   scheduleWrite();
 }
 
@@ -226,7 +222,7 @@ export async function flushWindowSession(): Promise<void> {
 }
 
 function scheduleWrite(): void {
-  if (!writer || batchHeld) return;
+  if (!writer) return;
   // A publish that lands during `pagehide` — the Walls flush there too — has no
   // later tick to be written on.
   if (unloading) {
@@ -242,7 +238,7 @@ function scheduleWrite(): void {
 }
 
 function writeNow(): void {
-  if (!writer || batchHeld) return;
+  if (!writer) return;
   const result = writer(getWindowSnapshot());
   inFlight = result ? Promise.resolve(result).catch(() => undefined) : null;
 }
@@ -257,7 +253,6 @@ function cancelPending(): void {
 export function resetWindowSessionAggregator(): void {
   records.clear();
   revisions.clear();
-  batchHeld = false;
   transferring.clear();
   pendingTransfers.clear();
   writer = null;

From 516a761c94bba9ce8c6b69a6e7ac01a512cf9f04 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 17:50:20 -0700
Subject: [PATCH 3/5] Fence stale confirmations and saves collected during
 Surface moves

---
 TESTING_AND_MODIFICATION_GUIDE.md             |  2 +-
 docs/specs/layout.md                          |  2 +-
 docs/specs/transport.md                       |  2 +-
 lib/src/components/WorkspaceWindow.test.tsx   | 30 +++++++++++++++++++
 lib/src/components/wall/surface-move.ts       |  7 +++++
 .../components/wall/workspace-control.test.ts | 24 +++++++++++++++
 lib/src/components/wall/workspace-control.ts  | 14 +++++++--
 .../components/wall/workspace-lifecycle.ts    |  7 +++--
 lib/src/lib/workspace-ui-store.ts             | 19 ++++++++----
 standalone/src/workspace-drag.test.ts         | 29 +++++++++++++++++-
 standalone/src/workspace-drag.ts              |  5 ++--
 11 files changed, 123 insertions(+), 18 deletions(-)

diff --git a/TESTING_AND_MODIFICATION_GUIDE.md b/TESTING_AND_MODIFICATION_GUIDE.md
index f3b0a0beb..c4e38711c 100644
--- a/TESTING_AND_MODIFICATION_GUIDE.md
+++ b/TESTING_AND_MODIFICATION_GUIDE.md
@@ -196,7 +196,7 @@ the heading, and the rule gets a `(rationale)` marker.
 | Concern | Code | Spec |
 |---|---|---|
 | Strip look, tabs, menus, rename, indicators | `lib/src/components/WorkspaceStrip.tsx`, `workspace-strip-drag.ts`, stories in `lib/src/stories/` | `docs/specs/layout.md` → Workspaces; `standalone.md` → AppBar; `alert.md` → Workspace union |
-| Shared Workspace kill confirmation and iframe move gate | `lib/src/components/WorkspaceKillConfirm.tsx` ("Confirm kill workspace"), `lib/src/components/WorkspaceStrip.tsx` (`pendingClose` and the iframe `pendingMove` gate), `standalone/src/WorkspaceTeardownModal.tsx` (window close / app quit), `lib/src/lib/workspace-ui-store.ts` | `layout.md` → Workspaces; `standalone.md` → Confirmation UI |
+| Shared Workspace kill confirmation and iframe move gate | `lib/src/components/WorkspaceKillConfirm.tsx` ("Confirm kill workspace"), `lib/src/components/WorkspaceStrip.tsx` (`confirmation`), `standalone/src/WorkspaceTeardownModal.tsx` (window close / app quit), `lib/src/lib/workspace-ui-store.ts` | `layout.md` → Workspaces; `standalone.md` → Confirmation UI |
 | Command-mode keys (`c n p l 1-9 W & !` etc.) | `lib/src/components/wall/keyboard/handle-workspace-shortcuts.ts` | `layout.md` → Workspaces, `shortcuts.md` |
 | Composition, active/hidden Wall, input gating | `lib/src/components/WorkspaceWindow.tsx`, `Wall.tsx` (`WorkspaceActiveContext`) | `layout.md` → Workspaces |
 | Hidden-Workspace terminal minimize | `lib/src/components/TerminalPane.tsx` mount effect (gated on `workspaceActive`), `lib/src/lib/terminal-lifecycle.ts` (`mountElement`/`unmountElement`), `terminal-webgl.ts` | `layout.md` → Workspaces, Renderer; `layout.rationale.md` → Workspaces |
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index d009aa38e..1868527c1 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -304,7 +304,7 @@ the close confirmation's key while that Workspace transfers.**
 **Must hold at most one pending Workspace confirmation** (close, cross-Window
 move gate, Surface move iframe consent), **answered no when a newer one is
 raised or any close, cross-Window move, or Surface move starts**, by gesture or
-`dor`, even one that refuses. A move refusal waits behind it and rename
+`dor`, even one that refuses. **Must abandon superseded preparation while awaiting a Wall, window probe or editor decision**, so an older verb cannot later act or replace the newer question. A move refusal waits behind it and rename
 (`lib/src/components/WorkspaceWindow.test.tsx`, `lib/src/lib/workspace-ui-store.test.ts`).
 A successful transfer dismisses only the departing Workspace's pending
 confirmation and rename UI; a failed transfer retains them. No pending kill follows a Workspace to its
diff --git a/docs/specs/transport.md b/docs/specs/transport.md
index abd248162..892b964a1 100644
--- a/docs/specs/transport.md
+++ b/docs/specs/transport.md
@@ -243,7 +243,7 @@ Source of truth: `ManagedVoicePort` in `lib/src/lib/platform/managed-voice-types
 
 **Each mounted Workspace publishes its `PersistedSession` to a Window collector**, which orders them by the Workspace store and writes the whole Window through one debounced writer the host installs at boot. **A Workspace with neither a published nor a boot-seeded session is dropped rather than written empty**, so a snapshot taken mid-boot cannot replace a restored Workspace with a blank one. **A Workspace's save compares against its own previous record** — seeded from disk until its Wall publishes — never the Window's active one, or a dead PTY's retained cwd and alert would come from the wrong Workspace. **Reordering, renaming, or switching the active Workspace writes too**: each changes the blob with no Session changing. A `PersistedWorkspace` is a `WorkspaceId`, a `name`, `nameIsAuto`, and that Workspace's `PersistedSession`. **Always write `nameIsAuto`**; lacking it, only a `Workspace <n>` name is auto. The top-level snapshot is a `PersistedWindow` (its own `version: 1`) wrapping v3 sessions: the ordered `PersistedWorkspace` list plus the active `WorkspaceId`. **VS Code does not use it** — each webview persists one bare `PersistedSession`, its single Workspace, through its own per-surface state API (`docs/specs/vscode.md`).
 
-**Must publish both Workspace records in one synchronous step with the Surface move's ownership change**, unprobed and behind one Window write (`pagehide` included), fencing saves collected before ownership changed and retaining a departed Session's previous cwd/alert in the destination. Source of truth: `publishWorkspaceSessions` / `invalidateWorkspaceSaves` / `moveRetainedSurfaceRecord` in `lib/src/lib/window-session-aggregator.ts`; `serializeNow` / `doSave` in `lib/src/components/wall/use-session-persistence.ts`; `assemblePersistedSession` in `lib/src/lib/session-save.ts`.
+**Must publish both Workspace records in one synchronous step with the Surface move's ownership change**, unprobed and behind one Window write (`pagehide` included), fencing saves collected before or during the ownership change and retaining a departed Session's previous cwd/alert in the destination. Source of truth: `publishWorkspaceSessions` / `invalidateWorkspaceSaves` / `moveRetainedSurfaceRecord` in `lib/src/lib/window-session-aggregator.ts`; `serializeNow` / `doSave` in `lib/src/components/wall/use-session-persistence.ts`; `assemblePersistedSession` in `lib/src/lib/session-save.ts`.
 
 **The Window wrapping lives at the standalone adapter boundary, never in the shared save/restore code.** `window-persistence.ts` owns the JSON and the storage slot over a `SessionKeyValueStore` synchronous slot (`docs/specs/standalone.md` → Persistence); the shared save/restore code still operates on a bare `PersistedSession`, which the boot hands it per Workspace. **A Window-persisting adapter answers through `getWindowState` / `saveWindowState`, and answers nothing on the bare-Session `getState` / `saveState` pair** — its blob is a Window and every shared reader of `getState` wants a Session. **A blob written before standalone persisted Windows is wrapped as the window's one Workspace**; that is the only migration.
 
diff --git a/lib/src/components/WorkspaceWindow.test.tsx b/lib/src/components/WorkspaceWindow.test.tsx
index 90c415799..3fa312bc9 100644
--- a/lib/src/components/WorkspaceWindow.test.tsx
+++ b/lib/src/components/WorkspaceWindow.test.tsx
@@ -969,6 +969,23 @@ describe('Surface moves between Workspaces', () => {
     expect(respond).toHaveBeenCalledWith(expect.objectContaining({ ok: false }));
   });
 
+  it('fences a save collected during adoption before the retained cwd migrates', async () => {
+    const source = await twoWalls();
+    publishWorkspaceSession(source, { version: 3, panes: [{ id: 'pane-a', title: 'exited', cwd: '/retained' }, { id: 'pane-b', title: 'other' }] });
+    const target = getWallHandle('ws-2')!;
+    const finish = target.finishSurfaceMove;
+    let duringCommit!: Promise<void>;
+    vi.spyOn(target, 'finishSurfaceMove').mockImplementation(() => {
+      finish();
+      duringCommit = target.flushPersistence({ probeCwd: false });
+    });
+    await act(async () => {
+      await moveSurface('pane-a', request({ workspace: 'workspace:2' }));
+      await duringCommit;
+    });
+    expect(previousWorkspaceSession('ws-2')?.panes.find(pane => pane.id === 'pane-a')?.cwd).toBe('/retained');
+  });
+
   it('routes a moved dor caller to its destination: short refs can name another pane and ensure can duplicate work left behind', async () => {
     const source = await twoWalls();
     terminalRegistry.seedTerminalManualCwd('pane-b', '/repo');
@@ -1155,6 +1172,19 @@ describe('Surface moves between Workspaces', () => {
     expect(getWallHandle(source)!.ownsSurface('frame')).toBe(true);
   });
 
+  it('does not let an older close awaiting its Wall replace a newer iframe consent', async () => {
+    const source = await iframeWalls();
+    vi.spyOn(getWallHandle('ws-2')!, 'hasTouchedSurfaces').mockReturnValue(true);
+    let pending!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
+    await act(async () => {
+      requestWorkspaceClose('ws-2');
+      pending = moveSurface('frame', request({ workspace: workspaceStore.workspaceRefFor('ws-3') }), true);
+    });
+    expect(getWorkspaceUiSnapshot().confirmation?.title).toBe('Move iframe?');
+    expect(getWorkspaceUiSnapshot().confirmation?.id).toBe(source);
+    await act(async () => { settleConfirmation(getWorkspaceUiSnapshot().confirmation!, false); await pending; });
+  });
+
   it('lets a second GUI iframe move supersede the first one’s consent and complete', async () => {
     const source = await iframeWalls();
     let first!: Promise<Awaited<ReturnType<typeof moveSurface>>>;
diff --git a/lib/src/components/wall/surface-move.ts b/lib/src/components/wall/surface-move.ts
index eb91439f4..fc74e1e92 100644
--- a/lib/src/components/wall/surface-move.ts
+++ b/lib/src/components/wall/surface-move.ts
@@ -143,6 +143,11 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
       receiver.finishSurfaceMove();
       source.finishSurfaceMove();
     });
+    // React effects and store subscribers can collect saves synchronously
+    // during the commit, before the retained cwd/alert migrates. Their promise
+    // callbacks run later: fence them as well as pre-departure saves.
+    invalidateWorkspaceSaves(source.workspaceId);
+    invalidateWorkspaceSaves(targetId);
     // A finished Wall may have refilled, and closing the source is
     // irreversible: nothing after this point restores membership.
     committed = true;
@@ -179,6 +184,8 @@ export async function moveSurface(id: string, request: Omit<MoveSurfaceRequest,
       if (created && targetId) discardWorkspace(targetId);
       if (hasWorkspace(activeBefore)) setActiveWorkspace(activeBefore);
     });
+    invalidateWorkspaceSaves(source.workspaceId);
+    if (targetId) invalidateWorkspaceSaves(targetId);
     throw error;
   } finally {
     release();
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index 1d9487fe2..bea742b39 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -305,6 +305,8 @@ describe('workspace.close', () => {
 
     const first = request('workspace.close', { workspace: 'workspace:2', force: true });
     const running = handleWorkspaceControl(first);
+    // The first close has passed its Wall lookup and acquired the close lock.
+    await Promise.resolve();
 
     const second = request('workspace.close', { workspace: 'workspace:3', force: true });
     await handleWorkspaceControl(second);
@@ -349,6 +351,28 @@ it.each([
   resetWorkspaceUi();
 });
 
+it.each(['close', 'move'] as const)('refuses workspace.%s if a newer confirmation supersedes its Wall lookup', async verb => {
+  createWorkspace({ id: 'ws-2', activate: false });
+  handleFor('ws-2');
+  const detail = request(`workspace.${verb}`, { workspace: 'workspace:2', toWindow: 'new', force: true });
+  const pending = handleWorkspaceControl(detail);
+  const newer = { id: 'ws-2', char: 'q', answer: vi.fn() };
+  requestConfirmation(newer);
+  await pending;
+  expect(answer(detail)).toContain('superseded');
+  expect(getWorkspaceUiSnapshot().confirmation).toBe(newer);
+  expect(newer.answer).not.toHaveBeenCalled();
+  resetWorkspaceUi();
+});
+
+it('cancels pending consent even when a cross-Window move names an invalid Workspace', async () => {
+  const answer = vi.fn();
+  requestConfirmation({ id: 'ws-2', char: 'q', answer });
+  await handleWorkspaceControl(request('workspace.move', { workspace: 'missing', toWindow: 'new' }));
+  expect(answer).toHaveBeenCalledExactlyOnceWith(false);
+  resetWorkspaceUi();
+});
+
 describe('surface.list --all', () => {
   it('tags every row with its Workspace and carries the directory', async () => {
     const first = getWorkspacesSnapshot().workspaces[0].id;
diff --git a/lib/src/components/wall/workspace-control.ts b/lib/src/components/wall/workspace-control.ts
index 60696ea9f..15f205dc7 100644
--- a/lib/src/components/wall/workspace-control.ts
+++ b/lib/src/components/wall/workspace-control.ts
@@ -238,9 +238,10 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
     }
 
     case WORKSPACE_CONTROL_METHODS.move: {
+      const toWindow = stringParam(params.toWindow)?.trim();
+      const isCurrent = toWindow !== undefined && !isWindowRef(toWindow) ? cancelPendingConfirmation() : () => true;
       const target = requireWorkspace(detail);
       if (!target) return;
-      const toWindow = stringParam(params.toWindow)?.trim();
       const index = typeof params.index === 'number' && Number.isInteger(params.index) && params.index >= 0
         ? params.index : undefined;
       if (toWindow === undefined && index === undefined) {
@@ -248,8 +249,11 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
         return;
       }
       if (toWindow !== undefined && !isWindowRef(toWindow)) {
-        cancelPendingConfirmation();
         const handle = await awaitWallHandle(target.id);
+        if (!isCurrent()) {
+          detail.respond({ ok: false, error: 'Workspace move was superseded by a newer close or move' });
+          return;
+        }
         if (!handle) {
           detail.respond({ ok: false, error: mountingRefusal(target.ref) });
           return;
@@ -296,7 +300,7 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
     }
 
     case WORKSPACE_CONTROL_METHODS.close: {
-      cancelPendingConfirmation();
+      const isCurrent = cancelPendingConfirmation();
       const target = requireWorkspace(detail);
       if (!target) return;
       // A close is answered only once the Workspace's Wall is there to answer
@@ -307,6 +311,10 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
         detail.respond({ ok: false, error: mountingRefusal(target.ref) });
         return;
       }
+      if (!isCurrent()) {
+        detail.respond({ ok: false, error: 'Workspace close was superseded by a newer close or move' });
+        return;
+      }
       // Like `dor kill`, a command close raises no prompt: it refuses instead,
       // and `--force` is the caller's answer to the confirmation the strip would
       // have shown (`docs/specs/dor-cli.md` → "dor workspace").
diff --git a/lib/src/components/wall/workspace-lifecycle.ts b/lib/src/components/wall/workspace-lifecycle.ts
index 03f51108d..ee2df669f 100644
--- a/lib/src/components/wall/workspace-lifecycle.ts
+++ b/lib/src/components/wall/workspace-lifecycle.ts
@@ -114,9 +114,9 @@ export async function closeWorkspaceWithSurfaces(
  * confirmation, otherwise close immediately.
  */
 export function requestWorkspaceClose(id: WorkspaceId): void {
-  cancelPendingConfirmation();
+  const isCurrent = cancelPendingConfirmation();
   if (closeInFlight || isWorkspaceTransferPending(id)) return;
-  void closeOnceWallRegisters(id);
+  void closeOnceWallRegisters(id, isCurrent);
 }
 
 /**
@@ -126,8 +126,9 @@ export function requestWorkspaceClose(id: WorkspaceId): void {
  * one effect away and having the close refused where nobody reads the refusal
  * (`docs/specs/layout.md` → "Workspaces").
  */
-async function closeOnceWallRegisters(id: WorkspaceId): Promise<void> {
+async function closeOnceWallRegisters(id: WorkspaceId, isCurrent: () => boolean): Promise<void> {
   const handle = await awaitWallHandle(id);
+  if (!isCurrent()) return;
   if (closeInFlight || isWorkspaceTransferPending(id)) return;
   if (!handle) return;
   if (workspaceNeedsCloseConfirmation(id)) {
diff --git a/lib/src/lib/workspace-ui-store.ts b/lib/src/lib/workspace-ui-store.ts
index 992a2c6cc..3987e2e8b 100644
--- a/lib/src/lib/workspace-ui-store.ts
+++ b/lib/src/lib/workspace-ui-store.ts
@@ -34,6 +34,7 @@ export interface WorkspaceUiState {
 const EMPTY: WorkspaceUiState = { renamingId: null, confirmation: null, moveError: null };
 
 let state: WorkspaceUiState = EMPTY;
+let confirmationGeneration = 0;
 const listeners = new Set<() => void>();
 
 function emit(next: WorkspaceUiState): void {
@@ -60,19 +61,24 @@ export function setRenamingWorkspace(id: WorkspaceId | null): void {
 
 /** Ask `next`, first answering any pending confirmation no. */
 export function requestConfirmation(next: WorkspaceConfirmation): void {
+  confirmationGeneration++;
   const previous = state.confirmation;
   state = { ...state, confirmation: null };
   previous?.answer(false);
   emit({ ...state, confirmation: next });
 }
 
-/** Every Workspace verb calls this as it starts: a pending confirmation is
- *  answered no. */
-export function cancelPendingConfirmation(): void {
+/** Close and move verbs call this as they start. Answer the pending question no;
+ *  the returned guard prevents asynchronous preparation from raising an older
+ *  question or acting after a newer verb starts, even when no question was up. */
+export function cancelPendingConfirmation(): () => boolean {
+  const generation = ++confirmationGeneration;
   const previous = state.confirmation;
-  if (!previous) return;
-  emit({ ...state, confirmation: null });
-  previous.answer(false);
+  if (previous) {
+    emit({ ...state, confirmation: null });
+    previous.answer(false);
+  }
+  return () => generation === confirmationGeneration;
 }
 
 /** Answer `confirmation` if it is still the pending one; a stale answer is ignored. */
@@ -89,6 +95,7 @@ export function setWorkspaceMoveError(error: WorkspaceUiState['moveError']): voi
 /** Clear every transient Workspace UI state in one notification: the host's
  *  teardown dialog taking the window, and tests. */
 export function resetWorkspaceUi(): void {
+  confirmationGeneration++;
   if (state === EMPTY) return;
   const { confirmation } = state;
   emit(EMPTY);
diff --git a/standalone/src/workspace-drag.test.ts b/standalone/src/workspace-drag.test.ts
index 276b2165c..5120454de 100644
--- a/standalone/src/workspace-drag.test.ts
+++ b/standalone/src/workspace-drag.test.ts
@@ -28,7 +28,7 @@ import {
 } from "./workspace-drag";
 import { _setWindowLabelForTesting } from "./window-label";
 import { registerWallHandle, resetWallHandles, stubWallHandle } from "dormouse-lib/components/wall/wall-handles";
-import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, settleConfirmation } from "dormouse-lib/lib/workspace-ui-store";
+import { cancelPendingConfirmation, getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, settleConfirmation } from "dormouse-lib/lib/workspace-ui-store";
 
 import { cancelEditorClose, decideEditorClose, getEditorClosePrompt } from "dormouse-lib/lib/tool-editor";
 import { recordToolDirty, resetToolDirty } from "dormouse-lib/lib/tool-dirty-store";
@@ -250,6 +250,33 @@ describe("releasing the drag", () => {
     resetWallHandles();
   });
 
+  it("abandons an older window probe when a newer confirmation is raised", async () => {
+    let resolveProbe!: (hit: { label: string; x: number; y: number }) => void;
+    const probe = new Promise<{ label: string; x: number; y: number }>(resolve => { resolveProbe = resolve; });
+    mocks.invoke.mockImplementation(async cmd => cmd === "window_at_cursor" ? probe : undefined);
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    const newer = { id: "ws-other", char: "q", answer: vi.fn() };
+    requestConfirmation(newer);
+    resolveProbe({ label: "ws-2", x: 120, y: 9 });
+    await settle();
+    expect(getWorkspaceUiSnapshot().confirmation).toBe(newer);
+    expect(newer.answer).not.toHaveBeenCalled();
+    expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
+  });
+
+  it("abandons a dirty-editor decision when a newer move starts", async () => {
+    recordToolDirty("editor", true);
+    registerWallHandle(stubWallHandle("ws-1", { dirtyToolIds: () => ["editor"], iframeSurfaceRefs: () => ["surface:4"] }));
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    await settle();
+    expect(getEditorClosePrompt()).not.toBeNull();
+    cancelPendingConfirmation();
+    await decideEditorClose("discard");
+    await settle();
+    expect(getWorkspaceUiSnapshot().confirmation).toBeNull();
+    expect(mocks.tearOutWorkspace).not.toHaveBeenCalled();
+  });
+
   it("answers a pending confirmation no as the drop starts its move", () => {
     const answer = vi.fn();
     requestConfirmation({ id: "ws-other", char: "q", answer });
diff --git a/standalone/src/workspace-drag.ts b/standalone/src/workspace-drag.ts
index 4841e89ff..e2a76792d 100644
--- a/standalone/src/workspace-drag.ts
+++ b/standalone/src/workspace-drag.ts
@@ -163,15 +163,16 @@ export function onDropOnOtherWindow(
   // the caret this is about to clear.
   endGesture();
   if (insideStrip) return;
-  cancelPendingConfirmation();
+  const isCurrent = cancelPendingConfirmation();
   const grab = grabOffset(id);
   void (async () => {
     // Probed fresh rather than reusing the throttled answer: up to
     // HIT_TEST_THROTTLE_MS of pointer travel could otherwise choose the window.
     const hit = await probe();
+    if (!isCurrent()) return;
     const handle = getWallHandle(id);
     const dirtyEditors = handle?.dirtyToolIds() ?? [];
-    if (!await confirmToolEditorsClose(dirtyEditors)) return;
+    if (!await confirmToolEditorsClose(dirtyEditors) || !isCurrent()) return;
     // Save must not authorize discarding edits typed later, while the iframe
     // confirmation or transfer preparation is awaiting. Only Discard leaves
     // these originally dirty editors dirty after consent.

From 797c7116eb8cee18c86f1118e870a73a6b1598a5 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 17:53:30 -0700
Subject: [PATCH 4/5] Abandon superseded Workspace closes awaiting editor
 consent

---
 .../components/wall/workspace-lifecycle.test.ts  | 16 +++++++++++++++-
 lib/src/components/wall/workspace-lifecycle.ts   |  3 ++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/lib/src/components/wall/workspace-lifecycle.test.ts b/lib/src/components/wall/workspace-lifecycle.test.ts
index c2f25e6c2..129921c32 100644
--- a/lib/src/components/wall/workspace-lifecycle.test.ts
+++ b/lib/src/components/wall/workspace-lifecycle.test.ts
@@ -10,7 +10,7 @@ import {
   requestWorkspaceClose,
 } from './workspace-lifecycle';
 import { registerWallHandle, resetWallHandles, stubWallHandle, type WallHandle } from './wall-handles';
-import { getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, setRenamingWorkspace } from '../../lib/workspace-ui-store';
+import { cancelPendingConfirmation, getWorkspaceUiSnapshot, requestConfirmation, resetWorkspaceUi, setRenamingWorkspace } from '../../lib/workspace-ui-store';
 import {
   closeWorkspace,
   createWorkspace,
@@ -75,6 +75,20 @@ describe('closeWorkspaceWithSurfaces', () => {
     expect(closeAll).toHaveBeenCalledWith(['a', 'b']);
   });
 
+  it('abandons a close awaiting dirty-editor consent when a newer move starts', async () => {
+    const [only] = ids();
+    const closeAll = vi.fn(async () => null);
+    handleFor(only, { closeAll, dirtyToolIds: () => ['editor'] });
+    recordToolDirty('editor', true);
+    const pending = closeWorkspaceWithSurfaces(only);
+    expect(getEditorClosePrompt()).not.toBeNull();
+    cancelPendingConfirmation();
+    await decideEditorClose('discard');
+    expect(await pending).toContain('superseded');
+    expect(closeAll).not.toHaveBeenCalled();
+    expect(ids()).toContain(only);
+  });
+
   it('refuses a second close while one is in flight, so both Walls cannot empty', async () => {
     const [first] = ids();
     createWorkspace({ id: 'ws-2' });
diff --git a/lib/src/components/wall/workspace-lifecycle.ts b/lib/src/components/wall/workspace-lifecycle.ts
index ee2df669f..778a9cae4 100644
--- a/lib/src/components/wall/workspace-lifecycle.ts
+++ b/lib/src/components/wall/workspace-lifecycle.ts
@@ -72,7 +72,7 @@ export async function closeWorkspaceWithSurfaces(
   id: WorkspaceId,
   mode: WorkspaceCloseMode = 'prompt',
 ): Promise<string | null> {
-  cancelPendingConfirmation();
+  const isCurrent = cancelPendingConfirmation();
   if (isWorkspaceTransferPending(id)) return 'Workspace is transferring';
   if (closeInFlight) return CLOSE_IN_FLIGHT_REFUSAL;
   const handle = getWallHandle(id);
@@ -88,6 +88,7 @@ export async function closeWorkspaceWithSurfaces(
     // close refuses instead (`docs/specs/dor-tool.md` → Closing unsaved Tools).
     const editors = handle.dirtyToolIds();
     if (editors.length && (mode === 'silent' || !await confirmToolEditorsClose(editors))) return UNSAVED_TOOL_REFUSAL;
+    if (!isCurrent()) return 'Workspace close was superseded by a newer close or move';
     const refusal = await handle.closeAll(editors);
     if (refusal) {
       // A refusal returns to its prompt if the user navigated away during close.

From 45bed76452aa8c12fcece2474fee478eb898051b Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 1 Oct 2026 18:03:53 -0700
Subject: [PATCH 5/5] Keep network refusal story timestamps on the rendering
 day

---
 lib/src/stories/NetworkSettings.stories.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/src/stories/NetworkSettings.stories.tsx b/lib/src/stories/NetworkSettings.stories.tsx
index 97acbf4b5..cd8864dad 100644
--- a/lib/src/stories/NetworkSettings.stories.tsx
+++ b/lib/src/stories/NetworkSettings.stories.tsx
@@ -61,7 +61,9 @@ function hosted(policy: NetworkPolicy, status = UNENROLLED_STATUS, refusal: Path
 }
 
 /** 10:42 this morning, on whatever clock renders the story. */
-const AT_10_42 = new Date(2026, 9, 1, 10, 42).getTime();
+const morning = new Date();
+morning.setHours(10, 42, 0, 0);
+const AT_10_42 = morning.getTime();
 
 /** A self-host build holding `policy`. */
 function selfHost(policy: NetworkPolicy, status = SELF_HOST_UNENROLLED_STATUS) {