From 66be240123ca1fa07ae3d157b7fc3095026db9ff Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 14:09:35 -0700
Subject: [PATCH 1/3] Hold the Workspace registry in Rust and make dor refs
 stable

Each webview's store sees only its own Workspaces, so nothing could route a
dor request naming a sibling window's, and workspace:<n> was a strip
position that a reorder renumbered.

Rust now holds the union: every window reports its list on change and the
union is broadcast with a revision. Ids are minted only in Rust,
workspace-<n> off one counter seeded above every id on disk and handed to
webviews in blocks, so the ref workspace:<n> is the id's number and never
changes; a host with no registry (VS Code, an older snapshot) still numbers
by position. A dor request naming a Workspace or Window is routed to the
window holding it, ahead of the caller's own Surface; one the registry
cannot place falls through to the caller's window to be refused by name.

The browser harness answers the same three commands for its one window.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PkPyEFCxiPo5UFeju5Ya9u
---
 docs/specs/dor-cli.md                     |  43 ++--
 docs/specs/glossary.md                    |   2 +-
 docs/specs/standalone.md                  |  30 ++-
 dor/src/commands/list.ts                  |   2 +-
 dor/src/commands/workspace.ts             |   2 +-
 dor/test/snapshots/help/list.md           |   2 +-
 dor/test/snapshots/help/workspace.md      |   2 +-
 lib/src/lib/workspace-store.test.ts       |  45 +++-
 lib/src/lib/workspace-store.ts            |  72 +++++--
 scripts/spec-word-budgets.json            |   4 +-
 standalone/scripts/dev-agent-browser.mjs  |  30 +++
 standalone/src-tauri/src/lib.rs           |  86 ++++++++
 standalone/src-tauri/src/routing.rs       |  86 ++++++++
 standalone/src-tauri/src/workspaces.rs    | 237 ++++++++++++++++++++++
 standalone/src/browser-sidecar-adapter.ts |  17 ++
 standalone/src/tauri-adapter.ts           |   8 +
 standalone/src/workspace-registry.test.ts |  81 ++++++++
 standalone/src/workspace-registry.ts      | 105 ++++++++++
 18 files changed, 805 insertions(+), 49 deletions(-)
 create mode 100644 standalone/src-tauri/src/workspaces.rs
 create mode 100644 standalone/src/workspace-registry.test.ts
 create mode 100644 standalone/src/workspace-registry.ts

diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index a0bfaced0..5bda51fa4 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -143,11 +143,15 @@ Control direction: `dor` → sidecar JSON-lines net socket → Rust command/even
 bridge → `TauriAdapter` `CustomEvent("dormouse:control-request")` → Wall
 handler, and back along the same hops.
 
-**A request is routed to the window that owns its `DORMOUSE_SURFACE_ID`**, and
-one naming no Surface goes to the focused window. **A Surface no window owns
-fails** — `No Dormouse window owns surface '<id>'` — rather than being handed to
-a sibling, which would act on the wrong terminal. **A cancel follows its own
-request** to the window holding it (`docs/specs/standalone.md` → Routing).
+**A request naming a Workspace or a Window is routed to the window holding
+it**, whichever window the caller sits in; one naming neither goes to the
+window that owns its `DORMOUSE_SURFACE_ID`, and one naming no Surface to the
+focused window. A target the registry cannot place — an unknown ref, or a name
+two windows use — reaches the caller's own window, which refuses it by name.
+**A Surface no window owns fails** — `No Dormouse window owns surface '<id>'` —
+rather than being handed to a sibling, which would act on the wrong terminal.
+**A cancel follows its own request** to the window holding it
+(`docs/specs/standalone.md` → Routing).
 
 ### VS Code
 
@@ -289,14 +293,16 @@ Invariants:
 - Text list output defaults to refs; commands that list handles accept
   `--id-format refs|ids|both` (`uuids` is a compatibility alias for `ids`). JSON
   list output always includes both refs and stable ids.
-- `workspace:<n>` selects a container and is **positional**, so a strip reorder
-  renumbers it; `workspace:<name>` is the stable handle and **resolves only when
-  exactly one Workspace carries that name**, else the error lists the
-  candidates. Both are accepted bare (`2`, `build`), and **a ref that reads as a
-  number is positional**, never a name. **A Window is `window:<label>` — its
-  host's own name for it** (`window:main`, `window:ws-2`), and a host with
-  one Window answers `window:1`; each accepts its own ref bare, and **rejects
-  every other Window's**, there being nothing it could do with one.
+- `workspace:<n>` selects a container and is **stable**: `n` is the number of
+  the Workspace's registry-minted id (`docs/specs/standalone.md` → "Workspace
+  registry"), so a strip reorder and a move between Windows rename nothing. A
+  host with no registry — VS Code, a snapshot from before it — numbers by
+  position instead. `workspace:<name>` **resolves only when exactly one
+  Workspace carries that name**, else the error lists the candidates. Both are
+  accepted bare (`2`, `build`), and **a ref that reads as a number is a ref**,
+  never a name. **A Window is `window:<label>` — its host's own name for it**
+  (`window:main`, `window:ws-2`), and a host with one Window answers
+  `window:1`; each accepts its own ref bare.
   **Every Workspace has a `surface:1`**, so a Surface ref alone
   never identifies a Workspace.
 - **One Wall answers each request**, resolved in order: the Window's own verbs
@@ -647,12 +653,11 @@ Source of truth: `buildDorSurfacesInternal` in `lib/src/components/Wall.tsx`; `d
   npm) distributes the bootstrap stub, never a copy of the content. A user-level
   `--global` install variant waits until a story needs it.
 
-- **Cross-Window targeting.** `window:<label>` is a listing ref today: a Window
-  accepts its own and rejects every other's (Handle Model), so no command can
-  reach a sibling Window's Surfaces. What it would take is a route above the
-  per-Window router — Rust already owns the window↔Surface map it would consult
-  (`docs/specs/standalone.md` → Routing) — plus a `--window` flag whose refs
-  survive a Workspace moving between Windows.
+- **Cross-Window listing and moves.** `--workspace` and `--window` already reach
+  a sibling Window's Workspace ([Standalone](#standalone)); `dor list --all`
+  still lists the answering Window alone, and no verb moves a Workspace between
+  Windows or reorders the strip. Both read the registry
+  (`docs/specs/standalone.md` → "Workspace registry").
 - **Cross-Workspace listing in VS Code.** Each Workspace is its own webview
   there, so `dor list --all` would have to aggregate at the extension host
   rather than in a per-webview control handler; until it does, VS Code refuses
diff --git a/docs/specs/glossary.md b/docs/specs/glossary.md
index e2e4c3b64..e099b2a06 100644
--- a/docs/specs/glossary.md
+++ b/docs/specs/glossary.md
@@ -201,7 +201,7 @@ A user verb is an intentional action that produces a single observable change.
 | `createWorkspace` | Add a Workspace and mount its Wall, which spawns one pane; activate by default, unless `activate: false`. |
 | `closeWorkspace` | `kill` each member Surface, then remove the Workspace; the last remaining Workspace cannot be closed. |
 | `renameWorkspace` | Update a Workspace's `name`; touches no Session |
-| `moveWorkspace` | Reorder a Workspace within its Window; renumbers the positional `workspace:<n>` refs and touches no Session |
+| `moveWorkspace` | Reorder a Workspace within its Window; refs are stable, so it renames nothing and touches no Session |
 | `transferWorkspace` | Move a Workspace to another Window, Surfaces and Sessions intact: `release` each member Session (detached, Process still Live) and resume it there. Kills nothing and archives nothing — not a `closeWorkspace`. |
 | `tearOut` | `transferWorkspace` into a Window created for it. A Window whose last Workspace leaves closes itself. |
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 983369d61..e264b8a70 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -331,6 +331,34 @@ which structurally enforces that the install runs in the window the walk tears
 down last (`docs/specs/auto-update.md`). Custom commands need no capability
 entry. `standalone/scripts/tauri-conf.test.mjs` pins both.
 
+### Workspace registry
+
+**Rust holds the union of every window's Workspaces**, since each webview's
+store (`lib/src/lib/workspace-store.ts`) sees only its own. Each window reports
+its list on every change, coalesced per microtask, and the union is broadcast as
+`dormouse://workspaces` with a monotonic `revision`; a webview drops a snapshot
+behind the one it holds.
+
+- **Ids are minted only in Rust**, `workspace-<n>` off one counter, handed to a
+  webview in blocks (`workspace_reserve_ids`) so a create mints synchronously.
+  The ref `workspace:<n>` is the id's number, so it never renumbers and never
+  collides across windows; an unused reservation is a gap, nothing more.
+- **The counter is seeded above every id any snapshot on disk names**, and
+  above every id a window reports, so a fresh id never meets a restored one.
+  Never below 2: `workspace-1` is a bare Wall's only Workspace.
+- **A `dor` request naming a Workspace or Window routes to the window holding
+  it** (§Routing precedence); a target the registry cannot place falls through
+  to the caller's window, which refuses it by name.
+- **`Destroyed` forgets the window's entries** and broadcasts.
+
+Source of truth: `standalone/src-tauri/src/workspaces.rs`;
+`workspace_reserve_ids` / `workspace_report` / `workspace_registry` in
+`standalone/src-tauri/src/lib.rs`; `installWorkspaceRegistry` in
+`standalone/src/workspace-registry.ts`; `installWorkspaceIdPool` /
+`workspaceRefFor` in `lib/src/lib/workspace-store.ts`. Pinned by the tests in
+`standalone/src-tauri/src/workspaces.rs` and
+`an_explicit_target_routes_to_the_window_holding_it`.
+
 ### Routing
 
 Source of truth: `route` in `standalone/src-tauri/src/routing.rs`,
@@ -343,7 +371,7 @@ Source of truth: `route` in `standalone/src-tauri/src/routing.rs`,
 | `pty:exit`, `pty:replay` | `data.id` | its owner, never suppressed |
 | `pty:list` | `data.forWindow` | the window that asked |
 | `alert:*` carrying `data.id` | `data.id` | its owner |
-| `dor:controlRequest` | `data.surfaceId` | its owner; no Surface named → the focused window |
+| `dor:controlRequest` | `params.workspace`, `params.window`, `data.surfaceId` | in that precedence: the window holding the named Workspace (§Workspace registry), the named window, the caller's Surface's owner; none → the focused window |
 | `dor:controlCancel` | `data.requestId` | the window its request went to; unknown → every window |
 | `burrow:ask` | `data.params.surfaceId` | its owner; a Surface with no PTY here, or an ask naming none, → every window (§Burrow service) |
 | everything else | — | every window |
diff --git a/dor/src/commands/list.ts b/dor/src/commands/list.ts
index a00cfc6eb..726ad8b5e 100644
--- a/dor/src/commands/list.ts
+++ b/dor/src/commands/list.ts
@@ -65,7 +65,7 @@ Filters are ANDed. --command is an exact match against the running command repor
 
 JSON output (--json) always includes both stable ids and refs, and each row carries has_terminal (a PTY) and has_browser (a browser renderer) — gate on those, not on kind, so a Surface that has both still matches. It adds top-level caller_surface_ref/caller_surface_id and focused_surface_ref/focused_surface_id — the calling and focused Surfaces, null when neither is in the list — plus workspace_ref, window_ref, and a host block (app, workspace, cli_js_path, node_path): the identity dump dor identify used to print.
 
---workspace <ref> lists another Workspace of this Window instead: workspace:<n> (positional) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build").
+--workspace <ref> lists another Workspace instead, in this window or another: workspace:<n> (a stable number) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build").
 
 --all lists every Workspace of this Window, grouped under a Workspace header — every Workspace keeps its header, including one holding nothing and one the filters emptied. Rows keep their own Workspace-scoped surface:N refs, so several groups have a surface:1, but only the active Workspace's selection carries the focus marker; each JSON row adds workspace_ref, and the payload adds a workspaces array. Target a row from another Workspace by its stable id, or pass --workspace.
 
diff --git a/dor/src/commands/workspace.ts b/dor/src/commands/workspace.ts
index 05f2ca302..9f0dcc12c 100644
--- a/dor/src/commands/workspace.ts
+++ b/dor/src/commands/workspace.ts
@@ -92,7 +92,7 @@ export const workspaceCommand: Command = {
       customUsage: USAGE,
       fullDescription: `Manages this Window's Workspaces. Listing them is dor list --workspaces (the overview) and dor list --all (every Workspace's Surfaces); this command only mutates.
 
-A <workspace> target is workspace:<n> — positional, so a strip reorder renumbers it — or workspace:<name>, which resolves only when exactly one Workspace carries that name and otherwise fails listing the candidates. Both forms are also accepted bare ("2", "build").
+A <workspace> target is workspace:<n> — a stable number that a strip reorder or a move between windows never changes — or workspace:<name>, which resolves only when exactly one Workspace carries that name and otherwise fails listing the candidates. Both forms are also accepted bare ("2", "build"). A target in another window is routed there.
 
 new creates a Workspace in the background and prints its ref: it never moves the user to it, since that is a larger theft than the focus a bare dor split takes. Use dor workspace switch to activate one. Without a name, the Workspace is named "Workspace N".
 
diff --git a/dor/test/snapshots/help/list.md b/dor/test/snapshots/help/list.md
index 7c32bdcd2..2274c9642 100644
--- a/dor/test/snapshots/help/list.md
+++ b/dor/test/snapshots/help/list.md
@@ -20,7 +20,7 @@ Filters are ANDed. --command is an exact match against the running command repor
 
 JSON output (--json) always includes both stable ids and refs, and each row carries has_terminal (a PTY) and has_browser (a browser renderer) — gate on those, not on kind, so a Surface that has both still matches. It adds top-level caller_surface_ref/caller_surface_id and focused_surface_ref/focused_surface_id — the calling and focused Surfaces, null when neither is in the list — plus workspace_ref, window_ref, and a host block (app, workspace, cli_js_path, node_path): the identity dump dor identify used to print.
 
---workspace <ref> lists another Workspace of this Window instead: workspace:<n> (positional) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build").
+--workspace <ref> lists another Workspace instead, in this window or another: workspace:<n> (a stable number) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build").
 
 --all lists every Workspace of this Window, grouped under a Workspace header — every Workspace keeps its header, including one holding nothing and one the filters emptied. Rows keep their own Workspace-scoped surface:N refs, so several groups have a surface:1, but only the active Workspace's selection carries the focus marker; each JSON row adds workspace_ref, and the payload adds a workspaces array. Target a row from another Workspace by its stable id, or pass --workspace.
 
diff --git a/dor/test/snapshots/help/workspace.md b/dor/test/snapshots/help/workspace.md
index 74e1b480a..32ad32a3b 100644
--- a/dor/test/snapshots/help/workspace.md
+++ b/dor/test/snapshots/help/workspace.md
@@ -12,7 +12,7 @@ USAGE
 
 Manages this Window's Workspaces. Listing them is dor list --workspaces (the overview) and dor list --all (every Workspace's Surfaces); this command only mutates.
 
-A <workspace> target is workspace:<n> — positional, so a strip reorder renumbers it — or workspace:<name>, which resolves only when exactly one Workspace carries that name and otherwise fails listing the candidates. Both forms are also accepted bare ("2", "build").
+A <workspace> target is workspace:<n> — a stable number that a strip reorder or a move between windows never changes — or workspace:<name>, which resolves only when exactly one Workspace carries that name and otherwise fails listing the candidates. Both forms are also accepted bare ("2", "build"). A target in another window is routed there.
 
 new creates a Workspace in the background and prints its ref: it never moves the user to it, since that is a larger theft than the focus a bare dor split takes. Use dor workspace switch to activate one. Without a name, the Workspace is named "Workspace N".
 
diff --git a/lib/src/lib/workspace-store.test.ts b/lib/src/lib/workspace-store.test.ts
index 312c8f8e4..c0f72aefd 100644
--- a/lib/src/lib/workspace-store.test.ts
+++ b/lib/src/lib/workspace-store.test.ts
@@ -2,6 +2,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   closeWorkspace,
   createWorkspace,
+  generateWorkspaceId,
+  installWorkspaceIdPool,
   getActiveWorkspaceId,
   getWorkspacesSnapshot,
   moveWorkspace,
@@ -154,22 +156,47 @@ describe('workspace-store', () => {
     expect(getActiveWorkspaceId()).toBe('ws-3');
   });
 
-  it('workspace refs are positional and renumber on reorder', () => {
-    createWorkspace({ id: 'ws-2' });
+  it('workspace refs are the minted id number, and survive a reorder', () => {
+    createWorkspace({ id: 'workspace-7' });
     expect(workspaceRefFor(DEFAULT_WORKSPACE_ID)).toBe('workspace:1');
-    expect(workspaceRefFor('ws-2')).toBe('workspace:2');
+    expect(workspaceRefFor('workspace-7')).toBe('workspace:7');
     // A Workspace already gone (its Wall is mid-unmount) answers the first ref.
     expect(workspaceRefFor('missing')).toBe('workspace:1');
     // A resolution carries the Workspace, so a caller needs no second lookup.
-    expect(resolveWorkspaceRef('workspace:2')).toEqual({ ok: true, id: 'ws-2', name: 'Workspace 2', ref: 'workspace:2' });
-    expect(resolveWorkspaceRef('2')).toMatchObject({ ok: true, id: 'ws-2' });
-    for (const ref of ['workspace:9', 'workspace:0', 'nonsense']) {
+    expect(resolveWorkspaceRef('workspace:7')).toEqual({ ok: true, id: 'workspace-7', name: 'Workspace 2', ref: 'workspace:7' });
+    expect(resolveWorkspaceRef('7')).toMatchObject({ ok: true, id: 'workspace-7' });
+    // The strip position is not a ref once ids are minted.
+    for (const ref of ['workspace:2', 'workspace:9', 'workspace:0', 'nonsense']) {
       expect(resolveWorkspaceRef(ref)).toEqual({ ok: false, message: `unknown workspace target '${ref}'` });
     }
 
-    moveWorkspace('ws-2', 0);
-    expect(workspaceRefFor('ws-2')).toBe('workspace:1');
-    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: 'ws-2', ref: 'workspace:1' });
+    moveWorkspace('workspace-7', 0);
+    expect(workspaceRefFor('workspace-7')).toBe('workspace:7');
+    expect(resolveWorkspaceRef('workspace:7')).toMatchObject({ ok: true, id: 'workspace-7', ref: 'workspace:7' });
+    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: DEFAULT_WORKSPACE_ID });
+  });
+
+  it('an id the registry did not mint keeps a positional ref', () => {
+    createWorkspace({ id: 'ws-random' });
+    expect(workspaceRefFor('ws-random')).toBe('workspace:2');
+    expect(resolveWorkspaceRef('workspace:2')).toMatchObject({ ok: true, id: 'ws-random', ref: 'workspace:2' });
+    moveWorkspace('ws-random', 0);
+    // Position 1 now belongs to a minted id, which the number names first.
+    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: DEFAULT_WORKSPACE_ID });
+    expect(workspaceRefFor('ws-random')).toBe('workspace:1');
+  });
+
+  it('mints ids from the host pool once one is installed', async () => {
+    const reserve = vi.fn(async (count: number) => Array.from({ length: count }, (_, i) => `workspace-${100 + i}`));
+    await installWorkspaceIdPool(reserve);
+    expect(reserve).toHaveBeenCalledWith(16);
+    expect(generateWorkspaceId()).toBe('workspace-100');
+    expect(createWorkspace().id).toBe('workspace-101');
+    expect(workspaceRefFor('workspace-101')).toBe('workspace:101');
+    // Draining past the low-water mark refills in the background.
+    for (let i = 0; i < 12; i++) generateWorkspaceId();
+    await Promise.resolve();
+    expect(reserve).toHaveBeenCalledTimes(2);
   });
 
   it('resolves a Workspace by name, and refuses an ambiguous one', () => {
diff --git a/lib/src/lib/workspace-store.ts b/lib/src/lib/workspace-store.ts
index 003c0ae16..0cb3f27b8 100644
--- a/lib/src/lib/workspace-store.ts
+++ b/lib/src/lib/workspace-store.ts
@@ -57,9 +57,47 @@ export function hasWorkspace(id: WorkspaceId): boolean {
 
 let workspaceSequence = 0;
 
-/** A process-unique WorkspaceId, even when the random source repeats. */
+/** Ids the host reserved for this Window to mint from (`docs/specs/standalone.md`
+ *  → "Workspace registry"): `workspace-<n>` off one counter, so a ref is stable
+ *  and unique across windows. Refilled in the background; below the low-water
+ *  mark a burst of creates still finds one. */
+const idPool: WorkspaceId[] = [];
+const ID_POOL_SIZE = 16;
+const ID_POOL_LOW = 4;
+let reserveIds: ((count: number) => Promise<WorkspaceId[]>) | null = null;
+let refilling: Promise<void> | null = null;
+
+function refillIdPool(): Promise<void> {
+  if (!reserveIds || refilling) return refilling ?? Promise.resolve();
+  const reserve = reserveIds;
+  refilling = reserve(ID_POOL_SIZE)
+    .then((ids) => { idPool.push(...ids); })
+    .catch(() => {})
+    .finally(() => { refilling = null; });
+  return refilling;
+}
+
+/** Give this Window a host that mints ids. Resolves once the first block is
+ *  in hand, so a create that follows never falls back to a random id. */
+export function installWorkspaceIdPool(reserve: (count: number) => Promise<WorkspaceId[]>): Promise<void> {
+  reserveIds = reserve;
+  idPool.length = 0;
+  return refillIdPool();
+}
+
+/** The next id: one the host reserved when it has, else a process-unique
+ *  random one — a host with no registry (VS Code, tests) whose refs are then
+ *  positional (`workspaceRefFor`). */
 export function generateWorkspaceId(): WorkspaceId {
-  return `workspace-${Math.random().toString(36).slice(2, 10)}-${++workspaceSequence}`;
+  const reserved = idPool.shift();
+  if (idPool.length < ID_POOL_LOW) void refillIdPool();
+  return reserved ?? `workspace-${Math.random().toString(36).slice(2, 10)}-${++workspaceSequence}`;
+}
+
+/** The registry number of a `workspace-<n>` id; a random or bare id has none. */
+export function workspaceRefNumber(id: WorkspaceId): number | null {
+  const match = /^workspace-(\d+)$/.exec(id);
+  return match ? Number(match[1]) : null;
 }
 
 /** "Workspace N", one past the highest existing `Workspace <n>` name. */
@@ -147,9 +185,8 @@ export function closeWorkspace(id: WorkspaceId): boolean {
 
 /**
  * Move a Workspace to `toIndex` (clamped into range), keeping every other
- * Workspace's relative order. Returns whether the list changed. Reordering
- * renumbers `workspace:<n>` refs, which are positional by design
- * (`docs/specs/dor-cli.md` → "Handle Model").
+ * Workspace's relative order. Returns whether the list changed. Refs are
+ * stable, so a reorder renames nothing (`docs/specs/dor-cli.md` → "Handle Model").
  */
 export function moveWorkspace(id: WorkspaceId, toIndex: number): boolean {
   const from = state.workspaces.findIndex((ws) => ws.id === id);
@@ -189,15 +226,19 @@ export function isWindowRef(ref: string): boolean {
   return trimmed === windowRef || `window:${trimmed}` === windowRef;
 }
 
-/** A Workspace's positional `dor` ref. One no longer in this Window — its Wall is
- *  mid-unmount — reports the first ref, which is what a lone Workspace answers. */
+/** A Workspace's `dor` ref: **stable**, the number of its registry-minted id, so
+ *  a reorder renames nothing. An id the registry did not mint — a bare Wall's,
+ *  or one restored from before the registry — falls back to its position; one
+ *  no longer in this Window (its Wall mid-unmount) reports the first ref, which
+ *  is what a lone Workspace answers. */
 export function workspaceRefFor(id: WorkspaceId): string {
+  const number = workspaceRefNumber(id);
+  if (number !== null) return `workspace:${number}`;
   const index = state.workspaces.findIndex((ws) => ws.id === id);
   return `workspace:${index === -1 ? 1 : index + 1}`;
 }
 
-/** A Workspace a target named: its identity, plus the positional ref it had
- *  when it was resolved (a later reorder renumbers it). */
+/** A Workspace a target named: its identity, plus its ref as resolved. */
 export interface ResolvedWorkspace extends WorkspaceMeta {
   ref: string;
 }
@@ -210,17 +251,22 @@ export type WorkspaceRefResolution =
 /**
  * Resolve `workspace:<n>` / `workspace:<name>` — or either bare — to a
  * Workspace of this Window (`docs/specs/dor-cli.md` → "Handle Model"). A
- * positional ref wins over a name that reads as one; a name resolves only when
- * exactly one Workspace carries it, and an ambiguous one lists the candidates
- * rather than picking.
+ * number is the stable ref of a registry-minted id, and only where no id was
+ * minted that way does it read as a position; a numeric ref wins over a name
+ * that reads as one; a name resolves only when exactly one Workspace carries
+ * it, and an ambiguous one lists the candidates rather than picking.
  */
 export function resolveWorkspaceRef(ref: string): WorkspaceRefResolution {
   const { target, position, name } = parseWorkspaceRef(ref);
   const found = (meta: WorkspaceMeta): WorkspaceRefResolution =>
     ({ ok: true, ...meta, ref: workspaceRefFor(meta.id) });
   if (position !== null) {
+    // The one Workspace whose ref reads `workspace:<position>`: a minted id
+    // first, else the unminted one standing at that position.
+    const stable = state.workspaces.find((ws) => workspaceRefNumber(ws.id) === position);
+    if (stable) return found(stable);
     const positional = state.workspaces[position - 1];
-    if (positional) return found(positional);
+    if (positional && workspaceRefNumber(positional.id) === null) return found(positional);
   } else if (name) {
     const matches = state.workspaces.filter((workspace) => workspace.name === name);
     if (matches.length === 1) return found(matches[0]);
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 3d780bc14..a91e55258 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -6,7 +6,7 @@
   "docs/specs/auto-update.md": 1100,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4500,
-  "docs/specs/dor-cli.md": 5700,
+  "docs/specs/dor-cli.md": 5750,
   "docs/specs/dor-tool.md": 2100,
   "docs/specs/glossary.md": 3000,
   "docs/specs/layout.md": 8450,
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 8650,
+  "docs/specs/standalone.md": 8850,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/scripts/dev-agent-browser.mjs b/standalone/scripts/dev-agent-browser.mjs
index 9db74a369..87739af9d 100644
--- a/standalone/scripts/dev-agent-browser.mjs
+++ b/standalone/scripts/dev-agent-browser.mjs
@@ -149,8 +149,38 @@ const invokeMap = {
   // is a quit-only step and the harness has no quit.
   take_recovery_commands: ({ paneIds }) =>
     requestSidecar('recovery:take', { paneIds }, 'recovery:commands', (data) => data.commands ?? {}),
+  // The Workspace registry (docs/specs/standalone.md -> "Workspace registry"):
+  // one id counter and one window, since the harness simulates no second one.
+  workspace_reserve_ids: ({ count }) => {
+    const n = Math.max(1, Math.min(64, Number(count) || 1));
+    const first = nextWorkspaceId;
+    nextWorkspaceId += n;
+    return Array.from({ length: n }, (_, i) => `workspace-${first + i}`);
+  },
+  workspace_report: ({ entries }) => {
+    const next = JSON.stringify(entries ?? []);
+    if (next === registryEntries) return null;
+    registryEntries = next;
+    registryRevision += 1;
+    broadcast('sidecar', { event: 'dormouse://workspaces', data: registrySnapshot() });
+    return null;
+  },
+  workspace_registry: () => registrySnapshot(),
 };
 
+let nextWorkspaceId = 2;
+let registryEntries = '[]';
+let registryRevision = 0;
+function registrySnapshot() {
+  const workspaces = JSON.parse(registryEntries).map((entry) => ({
+    id: entry.id,
+    ref: /^workspace-(\d+)$/.test(entry.id) ? `workspace:${entry.id.slice('workspace-'.length)}` : null,
+    name: entry.name,
+    active: Boolean(entry.active),
+  }));
+  return { revision: registryRevision, windows: [{ label: 'main', workspaces }] };
+}
+
 async function readJson(req) {
   // The application/json requirement is enforced in the gate below, before
   // routing, so that it also covers a route that never reads a body.
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index d808b6fa9..b9ddc8944 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -4,6 +4,7 @@ use serde_json::{Map as JsonMap, Value as JsonValue};
 mod log_tail;
 mod quit_state;
 mod routing;
+mod workspaces;
 // The Dock's Quit, an `osascript` quit and a logout reach AppKit without ever
 // raising `RunEvent::ExitRequested` (docs/specs/standalone.md §Trigger
 // interception).
@@ -116,6 +117,11 @@ struct WindowState {
     closing: Mutex<HashSet<String>>,
     /// The next `ws-<n>`, seeded above every live and saved label at setup.
     next_ws: AtomicU64,
+    /// Every window's Workspaces under their stable refs (§Workspace registry).
+    registry: Mutex<workspaces::Registry>,
+    /// The next `workspace-<n>`, seeded above every id on disk at setup and
+    /// handed out in blocks so a webview can mint synchronously.
+    next_workspace: AtomicU64,
 }
 
 impl RoutingState {
@@ -254,6 +260,9 @@ enum Delivery {
     UnownedSurface { request_id: String, surface_id: String },
 }
 
+static EMPTY_REGISTRY: std::sync::LazyLock<workspaces::Registry> =
+    std::sync::LazyLock::new(workspaces::Registry::default);
+
 /// Route one sidecar stdout line to the window it belongs to.
 ///
 /// The hot path — once per PTY chunk — so it takes the routing lock once, reads
@@ -282,6 +291,13 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
         } else {
             HashSet::new()
         };
+        // Only a `dor` request consults the registry; a PTY chunk never pays
+        // for the lock. Taken before the routing lock and released with it.
+        let registry_guard = (event == "dor:controlRequest").then(|| guard(&state.registry));
+        let registry: &workspaces::Registry = match registry_guard.as_deref() {
+            Some(registry) => registry,
+            None => &EMPTY_REGISTRY,
+        };
         let mut routing = guard(&state.routing);
         if state.suppressed.load(Ordering::Relaxed) > 0 {
             released = routing::sweep_awaiting(
@@ -310,6 +326,7 @@ fn dispatch_sidecar_event(app: &AppHandle, event: &str, data: JsonValue) {
                 owners: &routing.owners,
                 awaiting_replay: &routing.awaiting_replay,
                 dor_targets: &routing.dor_targets,
+                registry: &registry,
             },
         ) {
             Route::Drop => Delivery::Nowhere,
@@ -2676,6 +2693,63 @@ fn adopt_failed(
     Ok(())
 }
 
+/// Every Workspace id every snapshot on disk names. Read once at setup to
+/// seed the id counter; an unreadable file contributes nothing, which is safe
+/// because such a file restores nothing either.
+fn saved_workspace_ids(dir: &Path) -> Vec<String> {
+    session_file_names(dir)
+        .iter()
+        .filter_map(|name| name.strip_suffix(".json"))
+        .filter_map(|label| read_session_from(dir, label).ok().flatten())
+        .filter_map(|contents| serde_json::from_str::<JsonValue>(&contents).ok())
+        .flat_map(|snapshot| workspaces::snapshot_ids(&snapshot))
+        .collect()
+}
+
+/// Hand a webview a block of ids to mint from. Ids come only from this
+/// counter, so a ref is stable for the life of the Workspace and unique
+/// across windows; an unused reservation is a gap in the numbering, nothing
+/// more (§Workspace registry).
+#[tauri::command]
+fn workspace_reserve_ids(windows: tauri::State<'_, WindowState>, count: u64) -> Vec<String> {
+    let count = count.clamp(1, 64);
+    let first = windows.next_workspace.fetch_add(count, Ordering::SeqCst);
+    (first..first + count)
+        .map(|n| format!("workspace-{n}"))
+        .collect()
+}
+
+/// A window's Workspace list, as it stands. Broadcast to every window when it
+/// changed: the strip's move menu and `dor` routing read the union.
+#[tauri::command]
+fn workspace_report(
+    app: AppHandle,
+    window: tauri::Window,
+    windows: tauri::State<'_, WindowState>,
+    entries: Vec<workspaces::Entry>,
+) {
+    // A reported id above the counter (a snapshot restored from a newer
+    // build, say) must never be minted again.
+    let above = workspaces::seed_next(entries.iter().map(|entry| entry.id.as_str()));
+    windows.next_workspace.fetch_max(above, Ordering::SeqCst);
+    let changed = workspaces::report(&mut guard(&windows.registry), window.label(), entries);
+    if changed {
+        broadcast_registry(&app, &windows);
+    }
+}
+
+/// The registry as it stands, for a webview that booted after the last
+/// broadcast.
+#[tauri::command]
+fn workspace_registry(windows: tauri::State<'_, WindowState>) -> JsonValue {
+    workspaces::snapshot(&guard(&windows.registry))
+}
+
+fn broadcast_registry(app: &AppHandle, windows: &WindowState) {
+    let snapshot = workspaces::snapshot(&guard(&windows.registry));
+    let _ = app.emit("dormouse://workspaces", snapshot);
+}
+
 /// Every Workspace in flight into this window, oldest first.
 ///
 /// **Not consumed**: the record settles at `adopt_done`, so a webview that
@@ -3479,6 +3553,10 @@ pub fn run() {
                                 "the target window closed mid-arrival",
                             );
                         }
+                        let changed = workspaces::forget_window(&mut guard(&state.registry), &label);
+                        if changed {
+                            broadcast_registry(app, &state);
+                        }
                     }
                     if let Some(state) = app.try_state::<GeometryState>() {
                         state.forget(&label);
@@ -3568,6 +3646,11 @@ pub fn run() {
                     app.state::<WindowState>()
                         .next_ws
                         .store(routing::seed_next_ws(&labels), Ordering::SeqCst);
+                    // Likewise above every Workspace id any snapshot names, so
+                    // a fresh id never collides with one about to be restored.
+                    app.state::<WindowState>()
+                        .next_workspace
+                        .store(workspaces::seed_next(saved_workspace_ids(&dir)), Ordering::SeqCst);
                     restore_windows(app.handle(), &dir, &labels);
                 }
                 Err(e) => append_log(format!("[window] {e}")),
@@ -3618,6 +3701,9 @@ pub fn run() {
             adopt_done,
             adopt_failed,
             take_arrivals,
+            workspace_reserve_ids,
+            workspace_report,
+            workspace_registry,
             remove_window_session,
             window_at_cursor,
             hover_workspace_target,
diff --git a/standalone/src-tauri/src/routing.rs b/standalone/src-tauri/src/routing.rs
index 3c3a0a9a0..99d570284 100644
--- a/standalone/src-tauri/src/routing.rs
+++ b/standalone/src-tauri/src/routing.rs
@@ -67,6 +67,8 @@ pub struct RouteView<'a> {
     /// Which window took each outstanding `dor` request, so its cancel follows
     /// the request instead of waking every window.
     pub dor_targets: &'a HashMap<String, String>,
+    /// Every window's Workspaces, for a request naming one explicitly.
+    pub registry: &'a crate::workspaces::Registry,
 }
 
 fn str_field<'a>(data: &'a JsonValue, key: &str) -> Option<&'a str> {
@@ -128,7 +130,31 @@ pub fn route<'a>(event: &str, data: &'a JsonValue, view: &RouteView<'a>) -> Rout
             Some(label) => Route::EmitTo(label),
             None => Route::Broadcast,
         },
+        // Precedence: an explicit `--workspace` goes to the window holding it
+        // and an explicit `--window` to that window — cross-window targeting —
+        // then the caller's own Surface's owner, then the focused window. A
+        // target the registry cannot place falls through, so the caller's own
+        // window refuses it by name (docs/specs/dor-cli.md -> "Standalone").
         "dor:controlRequest" => {
+            let params = data.get("params");
+            if let Some(target) = params
+                .and_then(|params| params.get("workspace"))
+                .and_then(JsonValue::as_str)
+            {
+                if let Some(label) = crate::workspaces::window_of(view.registry, target) {
+                    return Route::EmitTo(label);
+                }
+            }
+            if let Some(target) = params
+                .and_then(|params| params.get("window"))
+                .and_then(JsonValue::as_str)
+            {
+                let label = target.trim();
+                let label = label.strip_prefix("window:").unwrap_or(label).trim();
+                if let Some((label, _)) = view.registry.windows.get_key_value(label) {
+                    return Route::EmitTo(label.as_str());
+                }
+            }
             let Some(surface_id) = str_field(data, "surfaceId") else {
                 return Route::Focused;
             };
@@ -482,16 +508,71 @@ mod tests {
         ids.iter().map(|id| ((*id).to_string(), now)).collect()
     }
 
+    /// An explicit target crosses windows; an unplaceable one falls through to
+    /// the caller's window, which refuses it by name.
+    #[test]
+    fn an_explicit_target_routes_to_the_window_holding_it() {
+        let owned = labels(&[("a", "main"), ("b", "ws-2")]);
+        let none = awaiting(&[]);
+        let no_dor = HashMap::new();
+        let mut registry = crate::workspaces::Registry::default();
+        crate::workspaces::report(
+            &mut registry,
+            "main",
+            vec![crate::workspaces::Entry { id: "workspace-2".into(), name: "Build".into(), active: true }],
+        );
+        crate::workspaces::report(
+            &mut registry,
+            "ws-2",
+            vec![crate::workspaces::Entry { id: "workspace-5".into(), name: "Docs".into(), active: true }],
+        );
+        let view = RouteView {
+            owners: &owned,
+            awaiting_replay: &none,
+            dor_targets: &no_dor,
+            registry: &registry,
+        };
+        let from_main = |params: JsonValue| json!({ "surfaceId": "a", "params": params });
+        assert_eq!(
+            route("dor:controlRequest", &from_main(json!({ "workspace": "workspace:5" })), &view),
+            Route::EmitTo("ws-2")
+        );
+        assert_eq!(
+            route("dor:controlRequest", &from_main(json!({ "workspace": "Docs" })), &view),
+            Route::EmitTo("ws-2")
+        );
+        assert_eq!(
+            route("dor:controlRequest", &from_main(json!({ "window": "window:ws-2" })), &view),
+            Route::EmitTo("ws-2")
+        );
+        // The Workspace wins over the window when both are named.
+        assert_eq!(
+            route("dor:controlRequest", &from_main(json!({ "workspace": "workspace:2", "window": "ws-2" })), &view),
+            Route::EmitTo("main")
+        );
+        // Unknown: the caller's own window answers, and refuses by name.
+        assert_eq!(
+            route("dor:controlRequest", &from_main(json!({ "workspace": "workspace:9" })), &view),
+            Route::EmitTo("main")
+        );
+        assert_eq!(
+            route("dor:controlRequest", &from_main(json!({ "window": "ws-9" })), &view),
+            Route::EmitTo("main")
+        );
+    }
+
     /// Every row of the routing table (docs/specs/standalone.md -> "Windows").
     #[test]
     fn routes_every_sidecar_event_to_its_window() {
         let owned = labels(&[("a", "main"), ("b", "ws-2")]);
         let none = awaiting(&[]);
         let dor = labels(&[("dor-7", "ws-2")]);
+        let no_registry = crate::workspaces::Registry::default();
         let view = RouteView {
             owners: &owned,
             awaiting_replay: &none,
             dor_targets: &dor,
+            registry: &no_registry,
         };
         let cases: &[(&str, JsonValue, Route)] = &[
             ("pty:data", json!({"id":"a"}), Route::EmitTo("main")),
@@ -576,10 +657,12 @@ mod tests {
         let owned = labels(&[("a", "main")]);
         let none = awaiting(&[]);
         let no_dor = HashMap::new();
+        let no_registry = crate::workspaces::Registry::default();
         let view = RouteView {
             owners: &owned,
             awaiting_replay: &none,
             dor_targets: &no_dor,
+            registry: &no_registry,
         };
         assert_eq!(
             route(
@@ -624,10 +707,12 @@ mod tests {
         let held = awaiting(&["a"]);
         let none = awaiting(&[]);
         let no_dor = HashMap::new();
+        let no_registry = crate::workspaces::Registry::default();
         let suppressed = RouteView {
             owners: &owned,
             awaiting_replay: &held,
             dor_targets: &no_dor,
+            registry: &no_registry,
         };
         assert_eq!(route("pty:data", &json!({"id":"a"}), &suppressed), Route::Drop);
         // A chunk's derived events are in no replay: held, not dropped.
@@ -650,6 +735,7 @@ mod tests {
             owners: &owned,
             awaiting_replay: &none,
             dor_targets: &no_dor,
+            registry: &no_registry,
         };
         assert_eq!(
             route("pty:data", &json!({"id":"a"}), &released),
diff --git a/standalone/src-tauri/src/workspaces.rs b/standalone/src-tauri/src/workspaces.rs
new file mode 100644
index 000000000..d4f1d4948
--- /dev/null
+++ b/standalone/src-tauri/src/workspaces.rs
@@ -0,0 +1,237 @@
+//! The application-wide Workspace registry: which window holds which Workspace,
+//! under what stable ref (`docs/specs/standalone.md` → "Workspace registry").
+//!
+//! Each webview owns its own Workspace list (`lib/src/lib/workspace-store.ts`)
+//! and reports it here on every change; this is the one place that sees every
+//! window's, which is what a `dor` request naming a sibling window's Workspace
+//! routes through. Ids are minted only here — `workspace-<n>` from one counter
+//! seeded above every id on disk — so a ref never renumbers and never collides
+//! across windows.
+//!
+//! Pure over its own state, like `routing`; `lib.rs` holds the lock and emits.
+
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value as JsonValue};
+use std::collections::HashMap;
+
+/// One Workspace as its window reported it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Entry {
+    pub id: String,
+    pub name: String,
+    #[serde(default)]
+    pub active: bool,
+}
+
+#[derive(Debug, Default)]
+pub struct Registry {
+    /// Bumped on every change a window reports; the snapshot carries it so a
+    /// webview drops one that arrives behind a newer one.
+    pub revision: u64,
+    /// Window label → its Workspaces in strip order.
+    pub windows: HashMap<String, Vec<Entry>>,
+}
+
+/// The counter's suffix of a `workspace-<n>` id, if it has one. Ids minted
+/// elsewhere (a bare Wall's `workspace-1`, a pre-registry random id) carry no
+/// stable ref and are addressed by name or position instead.
+pub fn ref_number(id: &str) -> Option<u64> {
+    id.strip_prefix("workspace-")?.parse().ok()
+}
+
+/// The stable `dor` ref of an id, when it has one.
+pub fn ref_for(id: &str) -> Option<String> {
+    ref_number(id).map(|n| format!("workspace:{n}"))
+}
+
+/// The next counter value, above every id given. Never below 2: `workspace-1`
+/// is what a bare Wall calls its only Workspace, and a fresh window minting it
+/// would collide with a snapshot restored under that id.
+pub fn seed_next(ids: impl IntoIterator<Item = impl AsRef<str>>) -> u64 {
+    ids.into_iter()
+        .filter_map(|id| ref_number(id.as_ref()))
+        .max()
+        .map_or(2, |n| n.max(1) + 1)
+}
+
+/// Every Workspace id a persisted window snapshot names.
+pub fn snapshot_ids(snapshot: &JsonValue) -> Vec<String> {
+    snapshot
+        .get("workspaces")
+        .and_then(JsonValue::as_array)
+        .map(|workspaces| {
+            workspaces
+                .iter()
+                .filter_map(|workspace| workspace.get("id").and_then(JsonValue::as_str))
+                .map(str::to_string)
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// Record what `label` holds now. Returns whether anything changed, which is
+/// when the caller broadcasts.
+pub fn report(registry: &mut Registry, label: &str, entries: Vec<Entry>) -> bool {
+    if registry.windows.get(label) == Some(&entries) {
+        return false;
+    }
+    registry.windows.insert(label.to_string(), entries);
+    registry.revision += 1;
+    true
+}
+
+/// A window is gone, and with it everything it held.
+pub fn forget_window(registry: &mut Registry, label: &str) -> bool {
+    if registry.windows.remove(label).is_none() {
+        return false;
+    }
+    registry.revision += 1;
+    true
+}
+
+/// What a `dor` target names: `workspace:<n>` or bare `<n>` is a stable ref;
+/// anything else is a name.
+enum Target<'a> {
+    Number(u64),
+    Name(&'a str),
+}
+
+fn parse_target(target: &str) -> Target<'_> {
+    let bare = target
+        .trim()
+        .strip_prefix("workspace:")
+        .unwrap_or(target.trim())
+        .trim();
+    match bare.parse::<u64>() {
+        Ok(n) => Target::Number(n),
+        Err(_) => Target::Name(bare),
+    }
+}
+
+/// The window holding the Workspace a `dor` target names, or `None` when no
+/// window reports one — or when a name is ambiguous across windows, which the
+/// caller's own window then refuses with the candidates listed, as it would
+/// for a duplicate name inside one window.
+pub fn window_of<'a>(registry: &'a Registry, target: &str) -> Option<&'a str> {
+    match parse_target(target) {
+        Target::Number(n) => registry.windows.iter().find_map(|(label, entries)| {
+            entries
+                .iter()
+                .any(|entry| ref_number(&entry.id) == Some(n))
+                .then_some(label.as_str())
+        }),
+        Target::Name(name) => {
+            let mut holders = registry.windows.iter().filter_map(|(label, entries)| {
+                entries
+                    .iter()
+                    .any(|entry| entry.name == name)
+                    .then_some(label.as_str())
+            });
+            let first = holders.next()?;
+            holders.next().is_none().then_some(first)
+        }
+    }
+}
+
+/// What every webview receives after a change, ordered by label so the strip
+/// menus and `dor list` agree across windows.
+pub fn snapshot(registry: &Registry) -> JsonValue {
+    let mut labels: Vec<&String> = registry.windows.keys().collect();
+    labels.sort();
+    json!({
+        "revision": registry.revision,
+        "windows": labels.iter().map(|label| json!({
+            "label": label,
+            "workspaces": registry.windows[*label].iter().map(|entry| json!({
+                "id": entry.id,
+                "ref": ref_for(&entry.id),
+                "name": entry.name,
+                "active": entry.active,
+            })).collect::<Vec<_>>(),
+        })).collect::<Vec<_>>(),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn entry(id: &str, name: &str, active: bool) -> Entry {
+        Entry {
+            id: id.to_string(),
+            name: name.to_string(),
+            active,
+        }
+    }
+
+    #[test]
+    fn refs_come_from_the_id_and_never_from_position() {
+        assert_eq!(ref_for("workspace-7"), Some("workspace:7".to_string()));
+        assert_eq!(ref_for("workspace-abc12345-3"), None);
+        assert_eq!(ref_for("workspace-"), None);
+    }
+
+    #[test]
+    fn the_counter_seeds_above_every_id_on_disk_and_never_mints_one() {
+        assert_eq!(seed_next(Vec::<String>::new()), 2);
+        assert_eq!(seed_next(["workspace-1"]), 2);
+        assert_eq!(seed_next(["workspace-3", "workspace-12", "workspace-x"]), 13);
+        let ids = snapshot_ids(&json!({
+            "workspaces": [{ "id": "workspace-4" }, { "id": "workspace-9", "name": "n" }, { "name": "no id" }]
+        }));
+        assert_eq!(ids, vec!["workspace-4", "workspace-9"]);
+        assert_eq!(seed_next(ids), 10);
+    }
+
+    #[test]
+    fn a_report_bumps_the_revision_only_when_something_changed() {
+        let mut registry = Registry::default();
+        assert!(report(&mut registry, "main", vec![entry("workspace-2", "A", true)]));
+        assert_eq!(registry.revision, 1);
+        assert!(!report(&mut registry, "main", vec![entry("workspace-2", "A", true)]));
+        assert_eq!(registry.revision, 1);
+        assert!(report(&mut registry, "main", vec![entry("workspace-2", "B", true)]));
+        assert_eq!(registry.revision, 2);
+        assert!(forget_window(&mut registry, "main"));
+        assert!(!forget_window(&mut registry, "main"));
+        assert_eq!(registry.revision, 3);
+    }
+
+    #[test]
+    fn a_target_routes_to_the_window_holding_it() {
+        let mut registry = Registry::default();
+        report(
+            &mut registry,
+            "main",
+            vec![entry("workspace-2", "Build", true), entry("workspace-5", "Docs", false)],
+        );
+        report(
+            &mut registry,
+            "ws-2",
+            vec![entry("workspace-3", "Build", true)],
+        );
+        assert_eq!(window_of(&registry, "workspace:5"), Some("main"));
+        assert_eq!(window_of(&registry, " 3 "), Some("ws-2"));
+        assert_eq!(window_of(&registry, "Docs"), Some("main"));
+        assert_eq!(window_of(&registry, "workspace:Docs"), Some("main"));
+        // A name two windows use names nothing here; the caller's window
+        // refuses it with the candidates, as it does inside one window.
+        assert_eq!(window_of(&registry, "Build"), None);
+        assert_eq!(window_of(&registry, "workspace:9"), None);
+        assert_eq!(window_of(&registry, "nope"), None);
+    }
+
+    #[test]
+    fn the_snapshot_orders_windows_by_label_and_carries_refs() {
+        let mut registry = Registry::default();
+        report(&mut registry, "ws-2", vec![entry("workspace-3", "B", true)]);
+        report(&mut registry, "main", vec![entry("workspace-2", "A", true)]);
+        let snapshot = snapshot(&registry);
+        assert_eq!(snapshot["revision"], 2);
+        assert_eq!(snapshot["windows"][0]["label"], "main");
+        assert_eq!(snapshot["windows"][0]["workspaces"][0]["ref"], "workspace:2");
+        assert_eq!(snapshot["windows"][1]["label"], "ws-2");
+        assert_eq!(snapshot["windows"][1]["workspaces"][0]["active"], true);
+    }
+}
diff --git a/standalone/src/browser-sidecar-adapter.ts b/standalone/src/browser-sidecar-adapter.ts
index e0931208f..5833f855d 100644
--- a/standalone/src/browser-sidecar-adapter.ts
+++ b/standalone/src/browser-sidecar-adapter.ts
@@ -1,4 +1,5 @@
 import type { HelperIdentity, TerminalContextRequest, TerminalContextInfo } from '../../lib/src/lib/terminal-context-types';
+import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import type {
   AgentBrowserCommandResult,
   AgentBrowserEditOp,
@@ -71,6 +72,8 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   private alertStateHandlers = new Set<(detail: AlertStateDetail) => void>();
   private alertManager = new AlertManager();
   private unlistenHost: (() => void) | null = null;
+  private unlistenRegistry: (() => void) | null = null;
+  private onRegistrySnapshot: ((snapshot: WorkspaceRegistrySnapshot) => void) | null = null;
   private static STATE_KEY = 'dormouse.browser-sidecar.session';
   private windowSlot = windowStateSlot(localStorage, BrowserSidecarAdapter.STATE_KEY, 'browser-sidecar');
   // Remote-host bridge, identical in shape to TauriAdapter's — the dev harness
@@ -110,6 +113,14 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     await this.host.init();
     this.unlistenHost = this.host.onEvent(({ event, data }) => this.handleHostEvent(event, data));
     this.installConsoleForwarder();
+    this.unlistenRegistry = await installWorkspaceRegistry({
+      invoke: (cmd, args) => this.host.invoke(cmd, args),
+      // Through the one host subscription above, not a second one.
+      onSnapshot: (handler) => {
+        this.onRegistrySnapshot = handler;
+        return () => { this.onRegistrySnapshot = null; };
+      },
+    });
     // Started, not awaited — see TauriAdapter.
     this.recoveryReady = claimRecoveryCommands(
       (paneIds) => this.host.invoke<Record<string, string>>("take_recovery_commands", { paneIds }),
@@ -122,6 +133,8 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
     this.alertManager.dispose();
     this.unlistenHost?.();
     this.unlistenHost = null;
+    this.unlistenRegistry?.();
+    this.unlistenRegistry = null;
     this.burrowClient.dispose();
     this.host.send("kill_sidecar_now");
     this.host.close();
@@ -346,6 +359,10 @@ export class BrowserSidecarAdapter implements PlatformAdapter {
   readonly browserReservesNotepadChord = true;
 
   private handleHostEvent(event: string, data: unknown): void {
+    if (event === "dormouse://workspaces") {
+      this.onRegistrySnapshot?.(data as WorkspaceRegistrySnapshot);
+      return;
+    }
     if (event === "pty:data") {
       // Already parsed by the sidecar, which owns the PTY; its events arrive as
       // the two messages below (docs/specs/terminal-escapes.md).
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 1ecaedf85..f7cb2b217 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -48,6 +48,7 @@ import type { PersistedAlertState, PersistedWindow } from "dormouse-lib/lib/sess
 import { TauriSessionStore } from "./tauri-session-store";
 import { claimRecoveryCommands, windowStateSlot } from "./window-recovery";
 import { listenToWindow } from "./window-label";
+import { installWorkspaceRegistry, type WorkspaceRegistrySnapshot } from "./workspace-registry";
 import { withTimeout } from "./with-timeout";
 import {
   applyTerminalProtocolEvents,
@@ -254,6 +255,13 @@ export class TauriAdapter implements PlatformAdapter {
     ])));
 
     await this.hydrateSessionStore();
+    // Before restore too: a fresh Window mints its first Workspace id from
+    // the block this reserves (docs/specs/standalone.md → "Workspace registry").
+    this.unlistenFns.push(await installWorkspaceRegistry({
+      invoke: (cmd, args) => rawInvoke(cmd, args),
+      onSnapshot: (handler) =>
+        listenToWindow<WorkspaceRegistrySnapshot>("dormouse://workspaces", (event) => handler(event.payload)),
+    }));
   }
 
   // Seed the session cache from the Rust file store before restore reads it
diff --git a/standalone/src/workspace-registry.test.ts b/standalone/src/workspace-registry.test.ts
new file mode 100644
index 000000000..108f3aa51
--- /dev/null
+++ b/standalone/src/workspace-registry.test.ts
@@ -0,0 +1,81 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  createWorkspace,
+  generateWorkspaceId,
+  renameWorkspace,
+  resetWorkspaces,
+  setActiveWorkspace,
+} from "dormouse-lib/lib/workspace-store";
+import {
+  acceptRegistrySnapshot,
+  getRegistrySnapshot,
+  installWorkspaceRegistry,
+  resetWorkspaceRegistry,
+  type WorkspaceRegistrySnapshot,
+} from "./workspace-registry";
+
+function host() {
+  const invoke = vi.fn(async (cmd: string, args?: Record<string, unknown>): Promise<unknown> => {
+    if (cmd === "workspace_reserve_ids") {
+      const count = Number(args?.count);
+      return Array.from({ length: count }, (_, i) => `workspace-${50 + i}`);
+    }
+    if (cmd === "workspace_registry") return { revision: 3, windows: [{ label: "main", workspaces: [] }] };
+    return null;
+  });
+  let push: ((snapshot: WorkspaceRegistrySnapshot) => void) | null = null;
+  return {
+    invoke: invoke as <T>(cmd: string, args?: Record<string, unknown>) => Promise<T>,
+    onSnapshot: (handler: (snapshot: WorkspaceRegistrySnapshot) => void) => {
+      push = handler;
+      return () => { push = null; };
+    },
+    push: (snapshot: WorkspaceRegistrySnapshot) => push?.(snapshot),
+    reports: () => invoke.mock.calls.filter(([cmd]) => cmd === "workspace_report").map(([, args]) => args?.entries),
+  };
+}
+
+describe("workspace registry", () => {
+  let uninstall: (() => void) | null = null;
+  beforeEach(() => {
+    resetWorkspaces();
+    resetWorkspaceRegistry();
+  });
+  afterEach(() => {
+    uninstall?.();
+    uninstall = null;
+  });
+
+  it("mints from the host's block and reports the store once per change, coalesced", async () => {
+    const h = host();
+    uninstall = await installWorkspaceRegistry(h);
+    expect(h.invoke).toHaveBeenCalledWith("workspace_reserve_ids", { count: 16 });
+    expect(generateWorkspaceId()).toBe("workspace-50");
+    await Promise.resolve();
+    // The boot report: the store as it stood at install.
+    expect(h.reports()).toEqual([[{ id: "workspace-1", name: "Workspace 1", active: true }]]);
+
+    const created = createWorkspace({ name: "build" });
+    renameWorkspace(created.id, "docs");
+    setActiveWorkspace(created.id);
+    await Promise.resolve();
+    // Three mutations in one task: one report, with the final state.
+    expect(h.reports()).toHaveLength(2);
+    expect(h.reports()[1]).toEqual([
+      { id: "workspace-1", name: "Workspace 1", active: false },
+      { id: "workspace-51", name: "docs", active: true },
+    ]);
+  });
+
+  it("takes the host's snapshot at install and drops one older than it holds", async () => {
+    const h = host();
+    uninstall = await installWorkspaceRegistry(h);
+    expect(getRegistrySnapshot().revision).toBe(3);
+    h.push({ revision: 2, windows: [] });
+    expect(getRegistrySnapshot().revision).toBe(3);
+    h.push({ revision: 4, windows: [{ label: "ws-2", workspaces: [{ id: "workspace-9", ref: "workspace:9", name: "n", active: true }] }] });
+    expect(getRegistrySnapshot().windows[0].label).toBe("ws-2");
+    acceptRegistrySnapshot({ revision: 4, windows: [] });
+    expect(getRegistrySnapshot().windows).toEqual([]);
+  });
+});
diff --git a/standalone/src/workspace-registry.ts b/standalone/src/workspace-registry.ts
new file mode 100644
index 000000000..dba2e3dbc
--- /dev/null
+++ b/standalone/src/workspace-registry.ts
@@ -0,0 +1,105 @@
+/**
+ * This Window's half of the application-wide Workspace registry
+ * (docs/specs/standalone.md → "Workspace registry"): ids are minted from a
+ * block the host reserved, every store change is reported to the host, and the
+ * host's union of every window comes back as a snapshot the strip and `dor`
+ * can read.
+ */
+import { useSyncExternalStore } from "react";
+import {
+  getWorkspacesSnapshot,
+  installWorkspaceIdPool,
+  subscribeToWorkspaces,
+} from "dormouse-lib/lib/workspace-store";
+
+export interface RegistryWorkspace {
+  id: string;
+  /** `workspace:<n>` for a minted id; `null` for one the registry did not mint. */
+  ref: string | null;
+  name: string;
+  active: boolean;
+}
+
+export interface RegistryWindow {
+  label: string;
+  workspaces: RegistryWorkspace[];
+}
+
+export interface WorkspaceRegistrySnapshot {
+  revision: number;
+  windows: RegistryWindow[];
+}
+
+const EMPTY: WorkspaceRegistrySnapshot = { revision: 0, windows: [] };
+let snapshot: WorkspaceRegistrySnapshot = EMPTY;
+const listeners = new Set<() => void>();
+
+/** Accept a host snapshot, unless one newer is already held. */
+export function acceptRegistrySnapshot(next: WorkspaceRegistrySnapshot): void {
+  if (next.revision < snapshot.revision) return;
+  snapshot = next;
+  listeners.forEach((listener) => listener());
+}
+
+export function getRegistrySnapshot(): WorkspaceRegistrySnapshot {
+  return snapshot;
+}
+
+export function useWorkspaceRegistry(): WorkspaceRegistrySnapshot {
+  return useSyncExternalStore(
+    (listener) => {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    getRegistrySnapshot,
+  );
+}
+
+export function resetWorkspaceRegistry(): void {
+  snapshot = EMPTY;
+  listeners.forEach((listener) => listener());
+}
+
+export interface RegistryHost {
+  invoke<T>(cmd: string, args?: Record<string, unknown>): Promise<T>;
+  /** Subscribe to the host's registry broadcasts; returns the unsubscribe. */
+  onSnapshot(handler: (snapshot: WorkspaceRegistrySnapshot) => void): Promise<() => void> | (() => void);
+}
+
+/**
+ * Install this Window into the registry. Resolves once the first id block is
+ * in hand, so a Workspace created after boot never carries an unminted id.
+ * Reports coalesce per microtask: a restore that sets several Workspaces at
+ * once is one report, not one per entry.
+ */
+export async function installWorkspaceRegistry(host: RegistryHost): Promise<() => void> {
+  let scheduled = false;
+  let last = "";
+  const report = () => {
+    scheduled = false;
+    const { workspaces, activeId } = getWorkspacesSnapshot();
+    const entries = workspaces.map((ws) => ({ id: ws.id, name: ws.name, active: ws.id === activeId }));
+    const key = JSON.stringify(entries);
+    if (key === last) return;
+    last = key;
+    void host.invoke("workspace_report", { entries }).catch(() => {});
+  };
+  const schedule = () => {
+    if (scheduled) return;
+    scheduled = true;
+    queueMicrotask(report);
+  };
+  const unsubscribeStore = subscribeToWorkspaces(schedule);
+  const unlisten = await host.onSnapshot(acceptRegistrySnapshot);
+  await installWorkspaceIdPool((count) => host.invoke<string[]>("workspace_reserve_ids", { count }));
+  try {
+    acceptRegistrySnapshot(await host.invoke<WorkspaceRegistrySnapshot>("workspace_registry"));
+  } catch {
+    // A host without the registry (an older dev harness) leaves it empty.
+  }
+  schedule();
+  return () => {
+    unsubscribeStore();
+    unlisten();
+  };
+}

From a1fa36a1e9856ab0effe2c3bf895994a90937af8 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 17:37:40 -0700
Subject: [PATCH 2/3] Make Workspace refs all-or-nothing and never mint a
 random id under a pool

A non-minted id advertised a ref that resolved to a different Workspace:
workspaceRefFor gave it a strip position while resolveWorkspaceRef gave a
number to a minted id first, and in VS Code the default id is literally
workspace-1 beside random ones, so a reorder made workspace:1 name two
Workspaces. Refs are now positional only while no id in the Window was
minted, and an id reads as minted only once a host has installed its pool;
an unminted id beside minted ones has no number and is addressed by name,
so one ref names one Workspace under either reading.

A failed reservation used to fall back silently to a random id, which then
took a positional ref beside minted ones. generateWorkspaceId now throws
under an installed pool that ran dry, naming the in-flight or failed
reservation, and the refill logs the rejection; the block (32) and its
low-water mark (8) keep that unreachable in practice. The dor path answers
the throw as an error response through the router's catch.

Rust parse_target now mirrors POSITIONAL_WORKSPACE_REF, so a Workspace
named 007 or 0 is a name, and workspace_reserve_ids floors the counter at 2
at the one point that mints, independent of whether setup seeded it. The
ambiguous-name story is documented as it behaves: a name two windows carry
falls through to the caller's window, which refuses a duplicate of its own
and otherwise resolves its own.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RChsJ5rMUMyfu22UZDfUus
---
 docs/specs/dor-cli.md                     | 17 ++--
 docs/specs/glossary.md                    |  2 +-
 docs/specs/layout.md                      |  2 +-
 docs/specs/standalone.md                  | 13 ++-
 lib/src/lib/workspace-store.test.ts       | 99 +++++++++++++++++++----
 lib/src/lib/workspace-store.ts            | 91 +++++++++++++++------
 scripts/spec-word-budgets.json            |  4 +-
 standalone/src-tauri/src/lib.rs           |  4 +
 standalone/src-tauri/src/workspaces.rs    | 36 +++++++--
 standalone/src/workspace-registry.test.ts |  2 +-
 10 files changed, 210 insertions(+), 60 deletions(-)

diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index 5bda51fa4..4f9e60483 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -295,9 +295,11 @@ Invariants:
   list output always includes both refs and stable ids.
 - `workspace:<n>` selects a container and is **stable**: `n` is the number of
   the Workspace's registry-minted id (`docs/specs/standalone.md` → "Workspace
-  registry"), so a strip reorder and a move between Windows rename nothing. A
-  host with no registry — VS Code, a snapshot from before it — numbers by
-  position instead. `workspace:<name>` **resolves only when exactly one
+  registry"), so a strip reorder and a move between Windows rename nothing.
+  **Refs are positional only while no id in the Window was minted** — a host
+  with no registry (VS Code), or a snapshot from before it until its first
+  create — and an unminted id beside minted ones has no number and is addressed
+  by name, so one ref never reads two ways. `workspace:<name>` **resolves only when exactly one
   Workspace carries that name**, else the error lists the candidates. Both are
   accepted bare (`2`, `build`), and **a ref that reads as a number is a ref**,
   never a name. **A Window is `window:<label>` — its host's own name for it**
@@ -653,10 +655,11 @@ Source of truth: `buildDorSurfacesInternal` in `lib/src/components/Wall.tsx`; `d
   npm) distributes the bootstrap stub, never a copy of the content. A user-level
   `--global` install variant waits until a story needs it.
 
-- **Cross-Window listing and moves.** `--workspace` and `--window` already reach
-  a sibling Window's Workspace ([Standalone](#standalone)); `dor list --all`
-  still lists the answering Window alone, and no verb moves a Workspace between
-  Windows or reorders the strip. Both read the registry
+- **Cross-Window listing and moves.** `--workspace` already reaches a sibling
+  Window's Workspace ([Standalone](#standalone)); the router places a `window`
+  target too, but no command takes that flag yet. `dor list --all` still lists
+  the answering Window alone, and no verb moves a Workspace between Windows or
+  reorders the strip. Both read the registry
   (`docs/specs/standalone.md` → "Workspace registry").
 - **Cross-Workspace listing in VS Code.** Each Workspace is its own webview
   there, so `dor list --all` would have to aggregate at the extension host
diff --git a/docs/specs/glossary.md b/docs/specs/glossary.md
index e099b2a06..92ad50866 100644
--- a/docs/specs/glossary.md
+++ b/docs/specs/glossary.md
@@ -201,7 +201,7 @@ A user verb is an intentional action that produces a single observable change.
 | `createWorkspace` | Add a Workspace and mount its Wall, which spawns one pane; activate by default, unless `activate: false`. |
 | `closeWorkspace` | `kill` each member Surface, then remove the Workspace; the last remaining Workspace cannot be closed. |
 | `renameWorkspace` | Update a Workspace's `name`; touches no Session |
-| `moveWorkspace` | Reorder a Workspace within its Window; refs are stable, so it renames nothing and touches no Session |
+| `moveWorkspace` | Reorder a Workspace within its Window; a minted ref renames nothing (a host with no registry still numbers by position) and touches no Session |
 | `transferWorkspace` | Move a Workspace to another Window, Surfaces and Sessions intact: `release` each member Session (detached, Process still Live) and resume it there. Kills nothing and archives nothing — not a `closeWorkspace`. |
 | `tearOut` | `transferWorkspace` into a Window created for it. A Window whose last Workspace leaves closes itself. |
 
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index c891103cb..fa62386d0 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -159,7 +159,7 @@ Sessions and its notes with it, and killing nothing on the way
 (`docs/specs/standalone.md` → Transfer). Leaving is not a close and arriving is
 not a create: a Workspace that arrives mounts from the record it brought.
 
-**Create** adds a Workspace named `Workspace N`, makes it active, and gives its Wall no restored record, so Lath's fresh branch spawns one default-shell pane. **Close** confirms first when the Workspace holds touched Surfaces or running work, reusing the kill-confirm letter and key rule over the Window's content area, then routes every member Surface through the closure coordinator; **the last remaining Workspace cannot be closed** — there is always one active Workspace, as there is always one visible pane (corner case #5). **One close runs at a time for the whole Window**, with the count re-checked after the confirmation, so two of them cannot empty two Walls between them; **a close the store then refuses hands the Wall back its auto-spawn** rather than leaving it mounted and empty. **Rename** edits the Workspace `name` only — no Surface title, and not the per-pane inline rename. **Reorder** moves a tab in the strip and renumbers the positional `workspace:<n>` refs with it. **Every Workspace verb runs outside the strip**, which renders the rename editor and confirmation from a store, so a tab gesture and a command-mode key take one path.
+**Create** adds a Workspace named `Workspace N`, makes it active, and gives its Wall no restored record, so Lath's fresh branch spawns one default-shell pane. **Close** confirms first when the Workspace holds touched Surfaces or running work, reusing the kill-confirm letter and key rule over the Window's content area, then routes every member Surface through the closure coordinator; **the last remaining Workspace cannot be closed** — there is always one active Workspace, as there is always one visible pane (corner case #5). **One close runs at a time for the whole Window**, with the count re-checked after the confirmation, so two of them cannot empty two Walls between them; **a close the store then refuses hands the Wall back its auto-spawn** rather than leaving it mounted and empty. **Rename** edits the Workspace `name` only — no Surface title, and not the per-pane inline rename. **Reorder** moves a tab in the strip and renumbers `workspace:<n>` refs with it only where they are positional (`docs/specs/dor-cli.md` → "Handle Model"). **Every Workspace verb runs outside the strip**, which renders the rename editor and confirmation from a store, so a tab gesture and a command-mode key take one path.
 
 The union projection and its indicators are owned by `docs/specs/alert.md` → Workspace union; the strip that renders them by `docs/specs/standalone.md` → AppBar. Persisted containers are owned by `docs/specs/transport.md`: standalone stores one `PersistedWindow` per window, so a relaunch restores every Workspace ([Session persistence](#session-persistence)).
 
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index e264b8a70..1a36f64bf 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -343,12 +343,21 @@ behind the one it holds.
   webview in blocks (`workspace_reserve_ids`) so a create mints synchronously.
   The ref `workspace:<n>` is the id's number, so it never renumbers and never
   collides across windows; an unused reservation is a gap, nothing more.
+- **A webview with a pool installed never mints a random id**: an empty pool
+  fails the create, naming the reservation still in flight or the one that
+  failed (logged, never swallowed), since a random id beside minted ones would
+  take a ref no reading agrees with. The block (32) and its low-water mark (8)
+  keep that failure unreachable in practice.
 - **The counter is seeded above every id any snapshot on disk names**, and
   above every id a window reports, so a fresh id never meets a restored one.
   Never below 2: `workspace-1` is a bare Wall's only Workspace.
 - **A `dor` request naming a Workspace or Window routes to the window holding
-  it** (§Routing precedence); a target the registry cannot place falls through
-  to the caller's window, which refuses it by name.
+  it** (§Routing precedence). A target the registry cannot place — one no
+  window reports, or a name two windows carry — falls through to the caller's
+  window, which refuses a name duplicated there and otherwise resolves its own,
+  so a local Workspace wins. **A target routes as a number only when it reads
+  as `POSITIONAL_WORKSPACE_REF`** (`dor/src/protocol.ts`); `007` and `0` are
+  names (`a_number_with_a_leading_zero_is_a_name`).
 - **`Destroyed` forgets the window's entries** and broadcasts.
 
 Source of truth: `standalone/src-tauri/src/workspaces.rs`;
diff --git a/lib/src/lib/workspace-store.test.ts b/lib/src/lib/workspace-store.test.ts
index c0f72aefd..b91e1675d 100644
--- a/lib/src/lib/workspace-store.test.ts
+++ b/lib/src/lib/workspace-store.test.ts
@@ -8,6 +8,7 @@ import {
   getWorkspacesSnapshot,
   moveWorkspace,
   renameWorkspace,
+  resetWorkspaceIdPool,
   resetWorkspaces,
   setActiveWorkspace,
   setWorkspaces,
@@ -17,8 +18,17 @@ import {
 } from './workspace-store';
 import { DEFAULT_WORKSPACE_ID, DEFAULT_WORKSPACE_NAME } from './session-types';
 
+/** A host that mints: `workspace-<from>` upward, one block per call. */
+function minting(from = 100) {
+  let next = from;
+  return vi.fn(async (count: number) => Array.from({ length: count }, () => `workspace-${next++}`));
+}
+
 describe('workspace-store', () => {
-  beforeEach(() => resetWorkspaces());
+  beforeEach(() => {
+    resetWorkspaceIdPool();
+    resetWorkspaces();
+  });
 
   it('defaults to a single "Workspace 1", active', () => {
     expect(getWorkspacesSnapshot()).toEqual({
@@ -156,12 +166,15 @@ describe('workspace-store', () => {
     expect(getActiveWorkspaceId()).toBe('ws-3');
   });
 
-  it('workspace refs are the minted id number, and survive a reorder', () => {
-    createWorkspace({ id: 'workspace-7' });
+  it('workspace refs are the minted id number under a registry, and survive a reorder', async () => {
+    await installWorkspaceIdPool(minting(7));
+    // Under a registry the bare Wall's default id, `workspace-1`, is a minted one.
+    const second = createWorkspace();
+    expect(second.id).toBe('workspace-7');
     expect(workspaceRefFor(DEFAULT_WORKSPACE_ID)).toBe('workspace:1');
     expect(workspaceRefFor('workspace-7')).toBe('workspace:7');
-    // A Workspace already gone (its Wall is mid-unmount) answers the first ref.
-    expect(workspaceRefFor('missing')).toBe('workspace:1');
+    // A minted Workspace already gone (its Wall is mid-unmount) keeps its number.
+    expect(workspaceRefFor('workspace-9')).toBe('workspace:9');
     // A resolution carries the Workspace, so a caller needs no second lookup.
     expect(resolveWorkspaceRef('workspace:7')).toEqual({ ok: true, id: 'workspace-7', name: 'Workspace 2', ref: 'workspace:7' });
     expect(resolveWorkspaceRef('7')).toMatchObject({ ok: true, id: 'workspace-7' });
@@ -176,29 +189,83 @@ describe('workspace-store', () => {
     expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: DEFAULT_WORKSPACE_ID });
   });
 
-  it('an id the registry did not mint keeps a positional ref', () => {
-    createWorkspace({ id: 'ws-random' });
-    expect(workspaceRefFor('ws-random')).toBe('workspace:2');
-    expect(resolveWorkspaceRef('workspace:2')).toMatchObject({ ok: true, id: 'ws-random', ref: 'workspace:2' });
-    moveWorkspace('ws-random', 0);
-    // Position 1 now belongs to a minted id, which the number names first.
-    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: DEFAULT_WORKSPACE_ID });
-    expect(workspaceRefFor('ws-random')).toBe('workspace:1');
+  it('refs are positional only while nothing in the Window was minted', async () => {
+    await installWorkspaceIdPool(minting(7));
+    // A snapshot from before the registry: every id unminted, so refs are
+    // positions and a reorder renumbers them.
+    setWorkspaces({ workspaces: [{ id: 'ws-a', name: 'A' }, { id: 'ws-b', name: 'B' }], activeId: 'ws-a' });
+    expect(workspaceRefFor('ws-b')).toBe('workspace:2');
+    expect(resolveWorkspaceRef('workspace:2')).toMatchObject({ ok: true, id: 'ws-b', ref: 'workspace:2' });
+    moveWorkspace('ws-b', 0);
+    expect(workspaceRefFor('ws-b')).toBe('workspace:1');
+    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: 'ws-b' });
+    // A Workspace already gone reports the first ref.
+    expect(workspaceRefFor('missing')).toBe('workspace:1');
+
+    // The first minted id flips the whole Window to stable refs: the number
+    // names the minted Workspace and nothing else, and an unminted one is
+    // addressed by its name, so no ref reads two ways.
+    createWorkspace({ activate: false });
+    expect(workspaceRefFor('workspace-7')).toBe('workspace:7');
+    expect(resolveWorkspaceRef('workspace:1')).toEqual({ ok: false, message: "unknown workspace target 'workspace:1'" });
+    expect(resolveWorkspaceRef('workspace:2')).toEqual({ ok: false, message: "unknown workspace target 'workspace:2'" });
+    expect(workspaceRefFor('ws-b')).toBe('workspace:B');
+    expect(resolveWorkspaceRef('workspace:B')).toMatchObject({ ok: true, id: 'ws-b', ref: 'workspace:B' });
+    expect(workspaceRefFor('missing')).toBe('workspace:B');
+  });
+
+  it('a host with no registry numbers by position, its default id included', () => {
+    // VS Code: the default `workspace-1` beside random ids, and no pool. The
+    // default is not a minted id here, so a reorder renumbers it like the rest.
+    const second = createWorkspace();
+    expect(second.id).not.toMatch(/^workspace-\d+$/);
+    expect(workspaceRefFor(DEFAULT_WORKSPACE_ID)).toBe('workspace:1');
+    expect(workspaceRefFor(second.id)).toBe('workspace:2');
+    moveWorkspace(second.id, 0);
+    expect(workspaceRefFor(second.id)).toBe('workspace:1');
+    expect(workspaceRefFor(DEFAULT_WORKSPACE_ID)).toBe('workspace:2');
+    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: second.id, ref: 'workspace:1' });
+    expect(resolveWorkspaceRef('workspace:2')).toMatchObject({ ok: true, id: DEFAULT_WORKSPACE_ID, ref: 'workspace:2' });
+    // An explicit `workspace-<n>` id is no more minted than a random one.
+    createWorkspace({ id: 'workspace-7' });
+    expect(workspaceRefFor('workspace-7')).toBe('workspace:3');
+    expect(resolveWorkspaceRef('workspace:7')).toEqual({ ok: false, message: "unknown workspace target 'workspace:7'" });
   });
 
   it('mints ids from the host pool once one is installed', async () => {
-    const reserve = vi.fn(async (count: number) => Array.from({ length: count }, (_, i) => `workspace-${100 + i}`));
+    const reserve = minting(100);
     await installWorkspaceIdPool(reserve);
-    expect(reserve).toHaveBeenCalledWith(16);
+    expect(reserve).toHaveBeenCalledWith(32);
     expect(generateWorkspaceId()).toBe('workspace-100');
     expect(createWorkspace().id).toBe('workspace-101');
     expect(workspaceRefFor('workspace-101')).toBe('workspace:101');
     // Draining past the low-water mark refills in the background.
-    for (let i = 0; i < 12; i++) generateWorkspaceId();
+    for (let i = 0; i < 23; i++) generateWorkspaceId();
     await Promise.resolve();
     expect(reserve).toHaveBeenCalledTimes(2);
   });
 
+  it('an installed pool that ran dry throws rather than mint a random id', async () => {
+    const error = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      let reject: (reason: Error) => void = () => {};
+      const reserve = vi.fn(() => new Promise<string[]>((_, r) => { reject = r; }));
+      const installed = installWorkspaceIdPool(reserve);
+      // The first block is still in flight.
+      expect(() => generateWorkspaceId()).toThrow('still reserving a block');
+      reject(new Error('host down'));
+      await installed;
+      // The rejection is logged, not swallowed, and the next create names it.
+      expect(error).toHaveBeenCalledWith(expect.stringContaining('did not reserve Workspace ids'), expect.any(Error));
+      expect(() => createWorkspace()).toThrow('the last reservation failed');
+      // A host with no registry falls back to a random id.
+      resetWorkspaceIdPool();
+      expect(createWorkspace().id).toMatch(/^workspace-[a-z0-9]+-\d+$/);
+    } finally {
+      error.mockRestore();
+    }
+  });
+
   it('resolves a Workspace by name, and refuses an ambiguous one', () => {
     renameWorkspace(DEFAULT_WORKSPACE_ID, 'build');
     createWorkspace({ id: 'ws-2', name: 'agents' });
diff --git a/lib/src/lib/workspace-store.ts b/lib/src/lib/workspace-store.ts
index 0cb3f27b8..b38b1c542 100644
--- a/lib/src/lib/workspace-store.ts
+++ b/lib/src/lib/workspace-store.ts
@@ -62,17 +62,27 @@ let workspaceSequence = 0;
  *  and unique across windows. Refilled in the background; below the low-water
  *  mark a burst of creates still finds one. */
 const idPool: WorkspaceId[] = [];
-const ID_POOL_SIZE = 16;
-const ID_POOL_LOW = 4;
+// A block this size, refilled this early, keeps a burst of creates ahead of
+// the reservation round-trip; `generateWorkspaceId` throws rather than mint a
+// random id once a pool is installed, so the margin is what keeps that throw
+// unreachable in practice.
+const ID_POOL_SIZE = 32;
+const ID_POOL_LOW = 8;
 let reserveIds: ((count: number) => Promise<WorkspaceId[]>) | null = null;
 let refilling: Promise<void> | null = null;
+/** Whether a host that mints ids is installed. Only then does a `workspace-<n>`
+ *  id read as minted: a bare Wall's `DEFAULT_WORKSPACE_ID` is `workspace-1`,
+ *  which beside VS Code's random ids would otherwise make one store both. */
+let registryInstalled = false;
 
 function refillIdPool(): Promise<void> {
   if (!reserveIds || refilling) return refilling ?? Promise.resolve();
   const reserve = reserveIds;
   refilling = reserve(ID_POOL_SIZE)
-    .then((ids) => { idPool.push(...ids); })
-    .catch(() => {})
+    .then((ids) => { if (reserveIds === reserve) idPool.push(...ids); })
+    .catch((error: unknown) => {
+      console.error('[workspace-store] the host did not reserve Workspace ids; a create will fail until it does', error);
+    })
     .finally(() => { refilling = null; });
   return refilling;
 }
@@ -81,17 +91,35 @@ function refillIdPool(): Promise<void> {
  *  in hand, so a create that follows never falls back to a random id. */
 export function installWorkspaceIdPool(reserve: (count: number) => Promise<WorkspaceId[]>): Promise<void> {
   reserveIds = reserve;
+  registryInstalled = true;
   idPool.length = 0;
   return refillIdPool();
 }
 
-/** The next id: one the host reserved when it has, else a process-unique
- *  random one — a host with no registry (VS Code, tests) whose refs are then
- *  positional (`workspaceRefFor`). */
+/** Forget the installed pool, back to a host with no registry (tests). */
+export function resetWorkspaceIdPool(): void {
+  reserveIds = null;
+  registryInstalled = false;
+  idPool.length = 0;
+}
+
+/** The next id: one the host reserved when a pool is installed, else a
+ *  process-unique random one — a host with no registry (VS Code, tests) whose
+ *  refs are then positional (`workspaceRefFor`). An installed pool that ran dry
+ *  throws rather than fall back: a random id beside minted ones would take a
+ *  ref no other reading agrees with (`docs/specs/standalone.md` → "Workspace
+ *  registry"). */
 export function generateWorkspaceId(): WorkspaceId {
   const reserved = idPool.shift();
+  const reserving = refilling !== null;
   if (idPool.length < ID_POOL_LOW) void refillIdPool();
-  return reserved ?? `workspace-${Math.random().toString(36).slice(2, 10)}-${++workspaceSequence}`;
+  if (reserved !== undefined) return reserved;
+  if (registryInstalled) {
+    throw new Error(reserving
+      ? 'no Workspace id is reserved yet: the host is still reserving a block'
+      : 'no Workspace id is reserved: the last reservation failed');
+  }
+  return `workspace-${Math.random().toString(36).slice(2, 10)}-${++workspaceSequence}`;
 }
 
 /** The registry number of a `workspace-<n>` id; a random or bare id has none. */
@@ -100,6 +128,18 @@ export function workspaceRefNumber(id: WorkspaceId): number | null {
   return match ? Number(match[1]) : null;
 }
 
+/** Whether the registry minted `id`: a `workspace-<n>` id under an installed pool. */
+function isMintedId(id: WorkspaceId): boolean {
+  return registryInstalled && workspaceRefNumber(id) !== null;
+}
+
+/** Whether refs number by strip position: only while no id in this Window was
+ *  minted — a host with no registry, or a snapshot from before it until its
+ *  first create. All-or-nothing, so one ref names one Workspace. */
+function refsArePositional(): boolean {
+  return !state.workspaces.some((ws) => isMintedId(ws.id));
+}
+
 /** "Workspace N", one past the highest existing `Workspace <n>` name. */
 function nextDefaultName(): string {
   let max = 0;
@@ -227,15 +267,21 @@ export function isWindowRef(ref: string): boolean {
 }
 
 /** A Workspace's `dor` ref: **stable**, the number of its registry-minted id, so
- *  a reorder renames nothing. An id the registry did not mint — a bare Wall's,
- *  or one restored from before the registry — falls back to its position; one
- *  no longer in this Window (its Wall mid-unmount) reports the first ref, which
+ *  a reorder renames nothing. Only while nothing in this Window was minted
+ *  (`refsArePositional`) is it the strip position instead; an unminted id
+ *  beside minted ones — restored from before the registry — has no number and
+ *  is addressed by its name. One no longer in this Window (its Wall
+ *  mid-unmount) keeps its number; unnumbered, it reports the first ref, which
  *  is what a lone Workspace answers. */
 export function workspaceRefFor(id: WorkspaceId): string {
+  if (refsArePositional()) {
+    const index = state.workspaces.findIndex((ws) => ws.id === id);
+    return `workspace:${index === -1 ? 1 : index + 1}`;
+  }
   const number = workspaceRefNumber(id);
   if (number !== null) return `workspace:${number}`;
-  const index = state.workspaces.findIndex((ws) => ws.id === id);
-  return `workspace:${index === -1 ? 1 : index + 1}`;
+  const meta = state.workspaces.find((ws) => ws.id === id);
+  return meta ? `workspace:${meta.name}` : workspaceRefFor(state.workspaces[0].id);
 }
 
 /** A Workspace a target named: its identity, plus its ref as resolved. */
@@ -251,22 +297,21 @@ export type WorkspaceRefResolution =
 /**
  * Resolve `workspace:<n>` / `workspace:<name>` — or either bare — to a
  * Workspace of this Window (`docs/specs/dor-cli.md` → "Handle Model"). A
- * number is the stable ref of a registry-minted id, and only where no id was
- * minted that way does it read as a position; a numeric ref wins over a name
- * that reads as one; a name resolves only when exactly one Workspace carries
- * it, and an ambiguous one lists the candidates rather than picking.
+ * number is the stable ref of a registry-minted id, and only while no id in
+ * the Window was minted does it read as a position (`refsArePositional`, the
+ * same rule `workspaceRefFor` prints by); a numeric ref wins over a name that
+ * reads as one; a name resolves only when exactly one Workspace carries it,
+ * and an ambiguous one lists the candidates rather than picking.
  */
 export function resolveWorkspaceRef(ref: string): WorkspaceRefResolution {
   const { target, position, name } = parseWorkspaceRef(ref);
   const found = (meta: WorkspaceMeta): WorkspaceRefResolution =>
     ({ ok: true, ...meta, ref: workspaceRefFor(meta.id) });
   if (position !== null) {
-    // The one Workspace whose ref reads `workspace:<position>`: a minted id
-    // first, else the unminted one standing at that position.
-    const stable = state.workspaces.find((ws) => workspaceRefNumber(ws.id) === position);
-    if (stable) return found(stable);
-    const positional = state.workspaces[position - 1];
-    if (positional && workspaceRefNumber(positional.id) === null) return found(positional);
+    const match = refsArePositional()
+      ? state.workspaces[position - 1]
+      : state.workspaces.find((ws) => workspaceRefNumber(ws.id) === position);
+    if (match) return found(match);
   } else if (name) {
     const matches = state.workspaces.filter((workspace) => workspace.name === name);
     if (matches.length === 1) return found(matches[0]);
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index a91e55258..3f29589d5 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -6,7 +6,7 @@
   "docs/specs/auto-update.md": 1100,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4500,
-  "docs/specs/dor-cli.md": 5750,
+  "docs/specs/dor-cli.md": 5800,
   "docs/specs/dor-tool.md": 2100,
   "docs/specs/glossary.md": 3000,
   "docs/specs/layout.md": 8450,
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 8850,
+  "docs/specs/standalone.md": 8950,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index b9ddc8944..53c58c4b6 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -2713,6 +2713,10 @@ fn saved_workspace_ids(dir: &Path) -> Vec<String> {
 #[tauri::command]
 fn workspace_reserve_ids(windows: tauri::State<'_, WindowState>, count: u64) -> Vec<String> {
     let count = count.clamp(1, 64);
+    // Setup seeds this above every id on disk, but skips that when
+    // `sessions_dir` fails; `workspace-1` is the bare Wall's own and
+    // `workspace:0` names nothing (§Workspace registry).
+    windows.next_workspace.fetch_max(2, Ordering::SeqCst);
     let first = windows.next_workspace.fetch_add(count, Ordering::SeqCst);
     (first..first + count)
         .map(|n| format!("workspace-{n}"))
diff --git a/standalone/src-tauri/src/workspaces.rs b/standalone/src-tauri/src/workspaces.rs
index d4f1d4948..7a0344d1b 100644
--- a/standalone/src-tauri/src/workspaces.rs
+++ b/standalone/src-tauri/src/workspaces.rs
@@ -103,16 +103,19 @@ fn parse_target(target: &str) -> Target<'_> {
         .strip_prefix("workspace:")
         .unwrap_or(target.trim())
         .trim();
+    // Mirrors `POSITIONAL_WORKSPACE_REF` in `dor/src/protocol.ts`: a ref is a
+    // digit run with no leading zero, so a Workspace named "007" stays a name
+    // rather than routing as `workspace:7`.
     match bare.parse::<u64>() {
-        Ok(n) => Target::Number(n),
-        Err(_) => Target::Name(bare),
+        Ok(n) if !bare.starts_with('0') && bare.bytes().all(|b| b.is_ascii_digit()) => Target::Number(n),
+        _ => Target::Name(bare),
     }
 }
 
 /// The window holding the Workspace a `dor` target names, or `None` when no
-/// window reports one — or when a name is ambiguous across windows, which the
-/// caller's own window then refuses with the candidates listed, as it would
-/// for a duplicate name inside one window.
+/// window reports one — or when a name is ambiguous across windows, which
+/// falls through to the caller's own window: it refuses a name duplicated
+/// there, and otherwise resolves its own, so a local Workspace wins.
 pub fn window_of<'a>(registry: &'a Registry, target: &str) -> Option<&'a str> {
     match parse_target(target) {
         Target::Number(n) => registry.windows.iter().find_map(|(label, entries)| {
@@ -215,13 +218,32 @@ mod tests {
         assert_eq!(window_of(&registry, " 3 "), Some("ws-2"));
         assert_eq!(window_of(&registry, "Docs"), Some("main"));
         assert_eq!(window_of(&registry, "workspace:Docs"), Some("main"));
-        // A name two windows use names nothing here; the caller's window
-        // refuses it with the candidates, as it does inside one window.
+        // A name two windows use names nothing here: it falls through to the
+        // caller's window, which refuses a duplicate of its own and otherwise
+        // resolves its own, so a local Workspace wins.
         assert_eq!(window_of(&registry, "Build"), None);
         assert_eq!(window_of(&registry, "workspace:9"), None);
         assert_eq!(window_of(&registry, "nope"), None);
     }
 
+    #[test]
+    fn a_number_with_a_leading_zero_is_a_name() {
+        let mut registry = Registry::default();
+        report(
+            &mut registry,
+            "main",
+            vec![entry("workspace-7", "Build", true), entry("workspace-8", "0", false)],
+        );
+        report(&mut registry, "ws-2", vec![entry("workspace-9", "007", true)]);
+        // `POSITIONAL_WORKSPACE_REF` reads neither as a ref, so each routes to
+        // the window holding the Workspace so named, never to `workspace-7`.
+        assert_eq!(window_of(&registry, "007"), Some("ws-2"));
+        assert_eq!(window_of(&registry, "workspace:007"), Some("ws-2"));
+        assert_eq!(window_of(&registry, "0"), Some("main"));
+        assert_eq!(window_of(&registry, "+7"), None);
+        assert_eq!(window_of(&registry, "7"), Some("main"));
+    }
+
     #[test]
     fn the_snapshot_orders_windows_by_label_and_carries_refs() {
         let mut registry = Registry::default();
diff --git a/standalone/src/workspace-registry.test.ts b/standalone/src/workspace-registry.test.ts
index 108f3aa51..9fac91143 100644
--- a/standalone/src/workspace-registry.test.ts
+++ b/standalone/src/workspace-registry.test.ts
@@ -49,7 +49,7 @@ describe("workspace registry", () => {
   it("mints from the host's block and reports the store once per change, coalesced", async () => {
     const h = host();
     uninstall = await installWorkspaceRegistry(h);
-    expect(h.invoke).toHaveBeenCalledWith("workspace_reserve_ids", { count: 16 });
+    expect(h.invoke).toHaveBeenCalledWith("workspace_reserve_ids", { count: 32 });
     expect(generateWorkspaceId()).toBe("workspace-50");
     await Promise.resolve();
     // The boot report: the store as it stood at install.

From e1bf9d088eefe539ec76b418ea4642e54c098218 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 18:28:28 -0700
Subject: [PATCH 3/3] Keep legacy Workspace refs stable across windows and
 reservation failures

---
 docs/specs/dor-cli.md                  |  8 ++--
 docs/specs/standalone.md               | 10 ++--
 lib/src/lib/workspace-store.test.ts    | 54 ++++++++-------------
 lib/src/lib/workspace-store.ts         | 65 ++++++++------------------
 standalone/src-tauri/src/workspaces.rs | 25 ++++++++--
 5 files changed, 67 insertions(+), 95 deletions(-)

diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index bb1f780d5..d711ea8a2 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -296,10 +296,10 @@ Invariants:
 - `workspace:<n>` selects a container and is **stable**: `n` is the number of
   the Workspace's registry-minted id (`docs/specs/standalone.md` → "Workspace
   registry"), so a strip reorder and a move between Windows rename nothing.
-  **Refs are positional only while no id in the Window was minted** — a host
-  with no registry (VS Code), or a snapshot from before it until its first
-  create — and an unminted id beside minted ones has no number and is addressed
-  by name, so one ref never reads two ways. `workspace:<name>` **resolves only when exactly one
+  **Must use positional refs only on hosts without a registry (VS Code).**
+  **Must address unnumbered registry Workspaces as `workspace:<id>`, resolving
+  exact ids before names**, so legacy snapshots, duplicate names, and numeric
+  names cannot redirect a ref. `workspace:<name>` **resolves only when exactly one
   Workspace carries that name**, else the error lists the candidates. Both are
   accepted bare (`2`, `build`), and **a ref that reads as a number is a ref**,
   never a name. **A Window is `window:<label>` — its host's own name for it**
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 262f56232..7fe3cc8a8 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -340,15 +340,13 @@ its list on every change, coalesced per microtask, and the union is broadcast as
 `dormouse://workspaces` with a monotonic `revision`; a webview drops a snapshot
 behind the one it holds.
 
-- **Ids are minted only in Rust**, `workspace-<n>` off one counter, handed to a
+- **Must mint numbered ids only in Rust**, `workspace-<n>` off one counter, handed to a
   webview in blocks (`workspace_reserve_ids`) so a create mints synchronously.
   The ref `workspace:<n>` is the id's number, so it never renumbers and never
   collides across windows; an unused reservation is a gap, nothing more.
-- **A webview with a pool installed never mints a random id**: an empty pool
-  fails the create, naming the reservation still in flight or the one that
-  failed (logged, never swallowed), since a random id beside minted ones would
-  take a ref no reading agrees with. The block (32) and its low-water mark (8)
-  keep that failure unreachable in practice.
+- **Must allow boot and creation when reservation fails**, using opaque UUID
+  ids until the pool recovers; log the failure. Canonical refs follow
+  `docs/specs/dor-cli.md` → "Handle Model" (`workspace-store.test.ts`).
 - **The counter is seeded above every id any snapshot on disk names**, and
   above every id a window reports, so a fresh id never meets a restored one.
   Never below 2: `workspace-1` is a bare Wall's only Workspace.
diff --git a/lib/src/lib/workspace-store.test.ts b/lib/src/lib/workspace-store.test.ts
index b91e1675d..5578d6d15 100644
--- a/lib/src/lib/workspace-store.test.ts
+++ b/lib/src/lib/workspace-store.test.ts
@@ -189,29 +189,20 @@ describe('workspace-store', () => {
     expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: DEFAULT_WORKSPACE_ID });
   });
 
-  it('refs are positional only while nothing in the Window was minted', async () => {
+  it('legacy ids keep unambiguous refs before and after a numbered create', async () => {
     await installWorkspaceIdPool(minting(7));
-    // A snapshot from before the registry: every id unminted, so refs are
-    // positions and a reorder renumbers them.
-    setWorkspaces({ workspaces: [{ id: 'ws-a', name: 'A' }, { id: 'ws-b', name: 'B' }], activeId: 'ws-a' });
-    expect(workspaceRefFor('ws-b')).toBe('workspace:2');
-    expect(resolveWorkspaceRef('workspace:2')).toMatchObject({ ok: true, id: 'ws-b', ref: 'workspace:2' });
+    setWorkspaces({ workspaces: [{ id: 'ws-a', name: '2' }, { id: 'ws-b', name: '2' }], activeId: 'ws-a' });
+    expect(resolveWorkspaceRef('workspace:2').ok).toBe(false);
+    for (const id of ['ws-a', 'ws-b']) {
+      expect(workspaceRefFor(id)).toBe(`workspace:${id}`);
+      expect(resolveWorkspaceRef(workspaceRefFor(id))).toMatchObject({ ok: true, id });
+    }
     moveWorkspace('ws-b', 0);
-    expect(workspaceRefFor('ws-b')).toBe('workspace:1');
-    expect(resolveWorkspaceRef('workspace:1')).toMatchObject({ ok: true, id: 'ws-b' });
-    // A Workspace already gone reports the first ref.
-    expect(workspaceRefFor('missing')).toBe('workspace:1');
-
-    // The first minted id flips the whole Window to stable refs: the number
-    // names the minted Workspace and nothing else, and an unminted one is
-    // addressed by its name, so no ref reads two ways.
     createWorkspace({ activate: false });
-    expect(workspaceRefFor('workspace-7')).toBe('workspace:7');
-    expect(resolveWorkspaceRef('workspace:1')).toEqual({ ok: false, message: "unknown workspace target 'workspace:1'" });
-    expect(resolveWorkspaceRef('workspace:2')).toEqual({ ok: false, message: "unknown workspace target 'workspace:2'" });
-    expect(workspaceRefFor('ws-b')).toBe('workspace:B');
-    expect(resolveWorkspaceRef('workspace:B')).toMatchObject({ ok: true, id: 'ws-b', ref: 'workspace:B' });
-    expect(workspaceRefFor('missing')).toBe('workspace:B');
+    renameWorkspace('workspace-7', 'ws-b');
+    expect(resolveWorkspaceRef('workspace:ws-b')).toMatchObject({ ok: true, id: 'ws-b' });
+    expect(resolveWorkspaceRef('workspace:7')).toMatchObject({ ok: true, id: 'workspace-7' });
+    expect(resolveWorkspaceRef('workspace:2').ok).toBe(false);
   });
 
   it('a host with no registry numbers by position, its default id included', () => {
@@ -245,22 +236,17 @@ describe('workspace-store', () => {
     expect(reserve).toHaveBeenCalledTimes(2);
   });
 
-  it('an installed pool that ran dry throws rather than mint a random id', async () => {
+  it('a failed first reservation still creates stable opaque refs and can recover', async () => {
     const error = vi.spyOn(console, 'error').mockImplementation(() => {});
     try {
-      let reject: (reason: Error) => void = () => {};
-      const reserve = vi.fn(() => new Promise<string[]>((_, r) => { reject = r; }));
-      const installed = installWorkspaceIdPool(reserve);
-      // The first block is still in flight.
-      expect(() => generateWorkspaceId()).toThrow('still reserving a block');
-      reject(new Error('host down'));
-      await installed;
-      // The rejection is logged, not swallowed, and the next create names it.
-      expect(error).toHaveBeenCalledWith(expect.stringContaining('did not reserve Workspace ids'), expect.any(Error));
-      expect(() => createWorkspace()).toThrow('the last reservation failed');
-      // A host with no registry falls back to a random id.
-      resetWorkspaceIdPool();
-      expect(createWorkspace().id).toMatch(/^workspace-[a-z0-9]+-\d+$/);
+      await installWorkspaceIdPool(async () => { throw new Error('host down'); });
+      const first = createWorkspace({ name: '7' });
+      expect(first.id).toMatch(/^workspace-[0-9a-f-]{36}$/);
+      expect(resolveWorkspaceRef(workspaceRefFor(first.id))).toMatchObject({ ok: true, id: first.id });
+      await installWorkspaceIdPool(minting(7));
+      createWorkspace({ name: '7' });
+      expect(resolveWorkspaceRef(workspaceRefFor(first.id))).toMatchObject({ ok: true, id: first.id });
+      expect(resolveWorkspaceRef('workspace:7')).toMatchObject({ ok: true, id: 'workspace-7' });
     } finally {
       error.mockRestore();
     }
diff --git a/lib/src/lib/workspace-store.ts b/lib/src/lib/workspace-store.ts
index b38b1c542..14cfff149 100644
--- a/lib/src/lib/workspace-store.ts
+++ b/lib/src/lib/workspace-store.ts
@@ -63,9 +63,7 @@ let workspaceSequence = 0;
  *  mark a burst of creates still finds one. */
 const idPool: WorkspaceId[] = [];
 // A block this size, refilled this early, keeps a burst of creates ahead of
-// the reservation round-trip; `generateWorkspaceId` throws rather than mint a
-// random id once a pool is installed, so the margin is what keeps that throw
-// unreachable in practice.
+// the reservation round-trip; an exhausted pool uses an opaque UUID ref.
 const ID_POOL_SIZE = 32;
 const ID_POOL_LOW = 8;
 let reserveIds: ((count: number) => Promise<WorkspaceId[]>) | null = null;
@@ -78,19 +76,21 @@ let registryInstalled = false;
 function refillIdPool(): Promise<void> {
   if (!reserveIds || refilling) return refilling ?? Promise.resolve();
   const reserve = reserveIds;
-  refilling = reserve(ID_POOL_SIZE)
+  const pending = reserve(ID_POOL_SIZE)
     .then((ids) => { if (reserveIds === reserve) idPool.push(...ids); })
     .catch((error: unknown) => {
-      console.error('[workspace-store] the host did not reserve Workspace ids; a create will fail until it does', error);
+      console.error('[workspace-store] the host did not reserve Workspace ids; using opaque ids until it does', error);
     })
-    .finally(() => { refilling = null; });
-  return refilling;
+    .finally(() => { if (refilling === pending) refilling = null; });
+  refilling = pending;
+  return pending;
 }
 
 /** Give this Window a host that mints ids. Resolves once the first block is
  *  in hand, so a create that follows never falls back to a random id. */
 export function installWorkspaceIdPool(reserve: (count: number) => Promise<WorkspaceId[]>): Promise<void> {
   reserveIds = reserve;
+  refilling = null;
   registryInstalled = true;
   idPool.length = 0;
   return refillIdPool();
@@ -99,26 +99,18 @@ export function installWorkspaceIdPool(reserve: (count: number) => Promise<Works
 /** Forget the installed pool, back to a host with no registry (tests). */
 export function resetWorkspaceIdPool(): void {
   reserveIds = null;
+  refilling = null;
   registryInstalled = false;
   idPool.length = 0;
 }
 
-/** The next id: one the host reserved when a pool is installed, else a
- *  process-unique random one — a host with no registry (VS Code, tests) whose
- *  refs are then positional (`workspaceRefFor`). An installed pool that ran dry
- *  throws rather than fall back: a random id beside minted ones would take a
- *  ref no other reading agrees with (`docs/specs/standalone.md` → "Workspace
- *  registry"). */
+/** Prefer a Rust-reserved number; a failed reservation must not prevent boot
+ *  from installing persistence. Opaque UUIDs have stable refs too. */
 export function generateWorkspaceId(): WorkspaceId {
   const reserved = idPool.shift();
-  const reserving = refilling !== null;
   if (idPool.length < ID_POOL_LOW) void refillIdPool();
   if (reserved !== undefined) return reserved;
-  if (registryInstalled) {
-    throw new Error(reserving
-      ? 'no Workspace id is reserved yet: the host is still reserving a block'
-      : 'no Workspace id is reserved: the last reservation failed');
-  }
+  if (registryInstalled) return `workspace-${crypto.randomUUID()}`;
   return `workspace-${Math.random().toString(36).slice(2, 10)}-${++workspaceSequence}`;
 }
 
@@ -128,16 +120,9 @@ export function workspaceRefNumber(id: WorkspaceId): number | null {
   return match ? Number(match[1]) : null;
 }
 
-/** Whether the registry minted `id`: a `workspace-<n>` id under an installed pool. */
-function isMintedId(id: WorkspaceId): boolean {
-  return registryInstalled && workspaceRefNumber(id) !== null;
-}
-
-/** Whether refs number by strip position: only while no id in this Window was
- *  minted — a host with no registry, or a snapshot from before it until its
- *  first create. All-or-nothing, so one ref names one Workspace. */
+/** Positions exist only on hosts without an application-wide registry. */
 function refsArePositional(): boolean {
-  return !state.workspaces.some((ws) => isMintedId(ws.id));
+  return !registryInstalled;
 }
 
 /** "Workspace N", one past the highest existing `Workspace <n>` name. */
@@ -266,13 +251,8 @@ export function isWindowRef(ref: string): boolean {
   return trimmed === windowRef || `window:${trimmed}` === windowRef;
 }
 
-/** A Workspace's `dor` ref: **stable**, the number of its registry-minted id, so
- *  a reorder renames nothing. Only while nothing in this Window was minted
- *  (`refsArePositional`) is it the strip position instead; an unminted id
- *  beside minted ones — restored from before the registry — has no number and
- *  is addressed by its name. One no longer in this Window (its Wall
- *  mid-unmount) keeps its number; unnumbered, it reports the first ref, which
- *  is what a lone Workspace answers. */
+/** Registry refs are stable numbers or opaque ids, independent of names and
+ *  strip order. Hosts without a registry retain positional refs. */
 export function workspaceRefFor(id: WorkspaceId): string {
   if (refsArePositional()) {
     const index = state.workspaces.findIndex((ws) => ws.id === id);
@@ -280,8 +260,7 @@ export function workspaceRefFor(id: WorkspaceId): string {
   }
   const number = workspaceRefNumber(id);
   if (number !== null) return `workspace:${number}`;
-  const meta = state.workspaces.find((ws) => ws.id === id);
-  return meta ? `workspace:${meta.name}` : workspaceRefFor(state.workspaces[0].id);
+  return `workspace:${id}`;
 }
 
 /** A Workspace a target named: its identity, plus its ref as resolved. */
@@ -294,15 +273,7 @@ export type WorkspaceRefResolution =
   | ({ ok: true } & ResolvedWorkspace)
   | { ok: false; message: string };
 
-/**
- * Resolve `workspace:<n>` / `workspace:<name>` — or either bare — to a
- * Workspace of this Window (`docs/specs/dor-cli.md` → "Handle Model"). A
- * number is the stable ref of a registry-minted id, and only while no id in
- * the Window was minted does it read as a position (`refsArePositional`, the
- * same rule `workspaceRefFor` prints by); a numeric ref wins over a name that
- * reads as one; a name resolves only when exactly one Workspace carries it,
- * and an ambiguous one lists the candidates rather than picking.
- */
+/** Resolve the host's canonical ref first, then an unambiguous name. */
 export function resolveWorkspaceRef(ref: string): WorkspaceRefResolution {
   const { target, position, name } = parseWorkspaceRef(ref);
   const found = (meta: WorkspaceMeta): WorkspaceRefResolution =>
@@ -313,6 +284,8 @@ export function resolveWorkspaceRef(ref: string): WorkspaceRefResolution {
       : state.workspaces.find((ws) => workspaceRefNumber(ws.id) === position);
     if (match) return found(match);
   } else if (name) {
+    const byId = registryInstalled && state.workspaces.find((ws) => ws.id === name);
+    if (byId) return found(byId);
     const matches = state.workspaces.filter((workspace) => workspace.name === name);
     if (matches.length === 1) return found(matches[0]);
     if (matches.length > 1) {
diff --git a/standalone/src-tauri/src/workspaces.rs b/standalone/src-tauri/src/workspaces.rs
index 7a0344d1b..218eef79a 100644
--- a/standalone/src-tauri/src/workspaces.rs
+++ b/standalone/src-tauri/src/workspaces.rs
@@ -34,15 +34,14 @@ pub struct Registry {
 }
 
 /// The counter's suffix of a `workspace-<n>` id, if it has one. Ids minted
-/// elsewhere (a bare Wall's `workspace-1`, a pre-registry random id) carry no
-/// stable ref and are addressed by name or position instead.
+/// elsewhere retain their opaque id as a stable ref.
 pub fn ref_number(id: &str) -> Option<u64> {
     id.strip_prefix("workspace-")?.parse().ok()
 }
 
 /// The stable `dor` ref of an id, when it has one.
 pub fn ref_for(id: &str) -> Option<String> {
-    ref_number(id).map(|n| format!("workspace:{n}"))
+    Some(ref_number(id).map_or_else(|| format!("workspace:{id}"), |n| format!("workspace:{n}")))
 }
 
 /// The next counter value, above every id given. Never below 2: `workspace-1`
@@ -125,6 +124,12 @@ pub fn window_of<'a>(registry: &'a Registry, target: &str) -> Option<&'a str> {
                 .then_some(label.as_str())
         }),
         Target::Name(name) => {
+            // Canonical opaque ids win over mutable names in every window.
+            if let Some((label, _)) = registry.windows.iter().find(|(_, entries)| {
+                entries.iter().any(|entry| entry.id == name)
+            }) {
+                return Some(label.as_str());
+            }
             let mut holders = registry.windows.iter().filter_map(|(label, entries)| {
                 entries
                     .iter()
@@ -171,8 +176,8 @@ mod tests {
     #[test]
     fn refs_come_from_the_id_and_never_from_position() {
         assert_eq!(ref_for("workspace-7"), Some("workspace:7".to_string()));
-        assert_eq!(ref_for("workspace-abc12345-3"), None);
-        assert_eq!(ref_for("workspace-"), None);
+        assert_eq!(ref_for("workspace-abc12345-3"), Some("workspace:workspace-abc12345-3".to_string()));
+        assert_eq!(ref_for("workspace-"), Some("workspace:workspace-".to_string()));
     }
 
     #[test]
@@ -226,6 +231,16 @@ mod tests {
         assert_eq!(window_of(&registry, "nope"), None);
     }
 
+    #[test]
+    fn legacy_ids_never_route_as_positions_or_conflicting_names() {
+        let mut registry = Registry::default();
+        report(&mut registry, "main", vec![entry("ws-a", "2", true), entry("ws-b", "2", false)]);
+        report(&mut registry, "ws-2", vec![entry("workspace-2", "ws-b", true)]);
+        assert_eq!(window_of(&registry, "workspace:ws-b"), Some("main"));
+        assert_eq!(window_of(&registry, "workspace:2"), Some("ws-2"));
+        assert_eq!(window_of(&registry, &ref_for("ws-a").unwrap()), Some("main"));
+    }
+
     #[test]
     fn a_number_with_a_leading_zero_is_a_name() {
         let mut registry = Registry::default();