From 62a4e1fffe039f434c5e4a09a781f34b3f094608 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 14:12:49 -0700
Subject: [PATCH 1/8] Move a transferring Workspace between snapshots on disk
 at the invoke
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The source omits a transferring Workspace from its next debounced save and
the target writes only after adoption, so a crash in the gap restored the
Workspace nowhere. begin_arrival now takes it out of the source's snapshot
and puts it into the target's — creating the target's file for a tear-out —
so the gap restores it once, in the target, with fresh shells. Every
hand-back path takes it out of the target's file again, since the source
persists it as soon as it clears the transferring mark.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PkPyEFCxiPo5UFeju5Ya9u
---
 docs/specs/standalone.md                 |  10 +-
 lib/src/lib/window-session-aggregator.ts |   4 +-
 scripts/spec-word-budgets.json           |   2 +-
 standalone/src-tauri/src/lib.rs          | 121 ++++++++++++++++++++++-
 4 files changed, 132 insertions(+), 5 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index e264b8a70..71795b29c 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -593,6 +593,14 @@ below reads that record rather than inferring itself from the suppression map.
 - **A boot's `pty_request_init` excludes every id an arrival claims.** Ownership
   moves at the invoke, so those shells would otherwise be listed as top-level
   panes beside the Workspace about to mount them.
+- **`begin_arrival` moves the Workspace between the two snapshots on disk** —
+  out of the source's file, then into the target's (a tear-out target gets a
+  file holding just it) — so a crash before the target's first flush restores
+  it once, in the target, with fresh shells. The webviews' own debounced saves
+  would otherwise leave a gap in which no file held it. Every hand-back path
+  takes it out of the target's file again, since the source persists it as soon
+  as it clears the transferring mark; a file emptied that way is removed
+  (`a_staged_arrival_is_in_the_target_snapshot_until_it_is_handed_back`).
 - **An arrival unadopted after `ARRIVAL_MAX` is handed back** by a watchdog armed
   at `begin_arrival`, retiring only the record it was armed for (`queued_at`):
   a target alive but wedged never reaches `adopt_failed` or `Destroyed`, and the
@@ -601,7 +609,7 @@ below reads that record rather than inferring itself from the suppression map.
 
 Source of truth: `Arrival` / `sweep_awaiting` / `expire_arrival` / `boot_list_ids` in
 `standalone/src-tauri/src/routing.rs`; `begin_arrival` / `adopt_ready` /
-`adopt_done` / `adopt_failed` / `hand_back_arrival` in
+`adopt_done` / `adopt_failed` / `hand_back_arrival` / `stage_arrival_on_disk` in
 `standalone/src-tauri/src/lib.rs`; `standalone/src/workspace-move.ts`;
 `markWorkspaceTransferring` in `lib/src/lib/window-session-aggregator.ts`.
 Pinned by `standalone/src/workspace-move.test.ts` and the arrival tests in
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index b19514bf5..dde0b9fd3 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -71,7 +71,9 @@ export function forgetWorkspaceSession(workspaceId: WorkspaceId): void {
  * mounted here, and its Sessions are still attached, because the target may
  * refuse it — but its shells already belong to the target, so a quit or a crash
  * in the gap must not leave the same Workspace persisted by two Windows and
- * restored twice. Cleared by `clearWorkspaceTransferring` (the target refused
+ * restored twice. The host already moved it into the target's snapshot on disk
+ * at the invoke (`docs/specs/standalone.md` → "Arrival queue"), so the gap
+ * restores it there. Cleared by `clearWorkspaceTransferring` (the target refused
  * it) or by `forgetWorkspaceSession` (it landed).
  */
 export function markWorkspaceTransferring(workspaceId: WorkspaceId): void {
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index a91e55258..d08887830 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 8850,
+  "docs/specs/standalone.md": 8950,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index b9ddc8944..d47a2d1d3 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -2403,6 +2403,55 @@ fn payload_terminal_ids(payload: &JsonValue) -> Vec<String> {
         .unwrap_or_default()
 }
 
+/// Put an arriving Workspace into the target's snapshot on disk **before** the
+/// target adopts it. The source omits a transferring Workspace from its own
+/// snapshot the moment the invoke returns (so a crash restores it once, not
+/// twice), and the target writes only after adoption — so until this landed, a
+/// crash in the gap restored it nowhere. Idempotent on the id; a target with no
+/// snapshot yet (a tear-out) gets one holding just this Workspace. Never
+/// fatal: a failed write is logged and the transfer proceeds.
+fn stage_arrival_on_disk(dir: &Path, to: &str, workspace: &JsonValue) -> Result<(), String> {
+    let Some(id) = workspace.get("id").and_then(JsonValue::as_str) else {
+        return Err("arrival payload names no workspace.id".to_string());
+    };
+    let mut snapshot = match read_session_from(dir, to)? {
+        Some(contents) => serde_json::from_str::<JsonValue>(&contents)
+            .map_err(|e| format!("unreadable snapshot for {to}: {e}"))?,
+        None => serde_json::json!({ "version": 1, "workspaces": [], "activeWorkspaceId": id }),
+    };
+    let workspaces = snapshot
+        .get_mut("workspaces")
+        .and_then(JsonValue::as_array_mut)
+        .ok_or_else(|| format!("snapshot for {to} has no workspaces list"))?;
+    workspaces.retain(|entry| entry.get("id").and_then(JsonValue::as_str) != Some(id));
+    workspaces.push(workspace.clone());
+    write_session_to(dir, to, &snapshot.to_string())
+}
+
+/// The inverse, for an arrival that will never be adopted: the source persists
+/// the Workspace again the moment it clears its transferring mark, so leaving
+/// it in the target's file would restore it twice. A snapshot holding nothing
+/// else is removed outright — it is a torn-out window that never opened.
+fn unstage_arrival_on_disk(dir: &Path, to: &str, workspace_id: &str) -> Result<(), String> {
+    let Some(contents) = read_session_from(dir, to)? else {
+        return Ok(());
+    };
+    let mut snapshot = serde_json::from_str::<JsonValue>(&contents)
+        .map_err(|e| format!("unreadable snapshot for {to}: {e}"))?;
+    let Some(workspaces) = snapshot.get_mut("workspaces").and_then(JsonValue::as_array_mut) else {
+        return Ok(());
+    };
+    let before = workspaces.len();
+    workspaces.retain(|entry| entry.get("id").and_then(JsonValue::as_str) != Some(workspace_id));
+    if workspaces.len() == before {
+        return Ok(());
+    }
+    if workspaces.is_empty() {
+        return remove_session_from(dir, to);
+    }
+    write_session_to(dir, to, &snapshot.to_string())
+}
+
 /// The record one drop becomes.
 fn arrival_from(from: &str, to: &str, payload: JsonValue) -> Result<routing::Arrival, String> {
     let workspace_id = payload
@@ -2443,6 +2492,23 @@ fn begin_arrival(
         windows.reassign(&arrival.terminal_ids, &arrival.to, true);
         routing::queue_arrival(&mut arrivals, arrival.clone());
     }
+    // Moved on disk here, not left to the two webviews' debounced saves: out of
+    // the source's snapshot first, then into the target's, so a crash in the
+    // gap restores the Workspace once — in the target, with fresh shells — and
+    // never twice (§Arrival queue). Never fatal.
+    if let Some(workspace) = arrival.payload.get("workspace") {
+        match sessions_dir(app) {
+            Ok(dir) => {
+                if let Err(e) = unstage_arrival_on_disk(&dir, &arrival.from, &arrival.workspace_id) {
+                    append_log(format!("[window] could not unstage {} from disk: {e}", arrival.workspace_id));
+                }
+                if let Err(e) = stage_arrival_on_disk(&dir, &arrival.to, workspace) {
+                    append_log(format!("[window] could not stage {} on disk: {e}", arrival.workspace_id));
+                }
+            }
+            Err(e) => append_log(format!("[window] {e}")),
+        }
+    }
     spawn_arrival_watchdog(app.clone(), &arrival);
     Ok(())
 }
@@ -2488,6 +2554,13 @@ fn hand_back_arrival(
         "[window] {} never arrived in {} ({reason}); handing it back to {}",
         arrival.workspace_id, arrival.to, arrival.from
     ));
+    // Out of the target's file first: the source persists it again as soon as
+    // it clears the transferring mark below.
+    if let Ok(dir) = sessions_dir(app) {
+        if let Err(e) = unstage_arrival_on_disk(&dir, &arrival.to, &arrival.workspace_id) {
+            append_log(format!("[window] could not unstage {} on disk: {e}", arrival.workspace_id));
+        }
+    }
     if app.get_webview_window(&arrival.from).is_some() {
         windows.reassign(&arrival.terminal_ids, &arrival.from, false);
         let _ = app.emit_to(
@@ -2556,6 +2629,9 @@ fn open_workspace_window(
             routing::take_arrival(&mut guard(&windows.arrivals), &workspace_id, &label)
         {
             windows.reassign(&arrival.terminal_ids, &arrival.from, false);
+            if let Ok(dir) = sessions_dir(&app) {
+                let _ = unstage_arrival_on_disk(&dir, &label, &arrival.workspace_id);
+            }
         }
         return Err(err);
     }
@@ -3761,8 +3837,8 @@ mod tests {
         find_node_binary, notepad_archive_lock_path, read_notepad_archive_from, read_session_from,
         reset_notepad_archive_at, resolve_dor_cli_paths, resolve_sidecar_path, session_file_name,
         state_root_from, strip_windows_verbatim_prefix, sweep_orphan_session_temps,
-        temp_write_path, write_notepad_archive_to, write_session_to, SESSION_TEMP_SUFFIX,
-        NOTEPAD_ARCHIVE_FILE,
+        stage_arrival_on_disk, temp_write_path, unstage_arrival_on_disk, write_notepad_archive_to,
+        write_session_to, JsonValue, SESSION_TEMP_SUFFIX, NOTEPAD_ARCHIVE_FILE,
     };
     use super::guard;
     use std::collections::HashSet;
@@ -3794,6 +3870,47 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_staged_arrival_is_in_the_target_snapshot_until_it_is_handed_back() {
+        let dir = TempDir::new("arrival-stage");
+        let workspace = serde_json::json!({ "id": "workspace-7", "name": "Docs", "session": { "version": 3 } });
+
+        // A tear-out target has no snapshot yet: it gets one holding the arrival.
+        stage_arrival_on_disk(dir.path(), "ws-2", &workspace).unwrap();
+        let read = || -> JsonValue {
+            serde_json::from_str(&read_session_from(dir.path(), "ws-2").unwrap().unwrap()).unwrap()
+        };
+        assert_eq!(read()["activeWorkspaceId"], "workspace-7");
+        assert_eq!(read()["workspaces"].as_array().unwrap().len(), 1);
+
+        // Staging the same id again replaces rather than duplicates.
+        stage_arrival_on_disk(dir.path(), "ws-2", &workspace).unwrap();
+        assert_eq!(read()["workspaces"].as_array().unwrap().len(), 1);
+
+        // An existing target keeps what it had and its own active Workspace.
+        write_session_to(
+            dir.path(),
+            "main",
+            &serde_json::json!({ "version": 1, "workspaces": [{ "id": "workspace-2", "name": "A" }], "activeWorkspaceId": "workspace-2" }).to_string(),
+        )
+        .unwrap();
+        stage_arrival_on_disk(dir.path(), "main", &workspace).unwrap();
+        let main: JsonValue =
+            serde_json::from_str(&read_session_from(dir.path(), "main").unwrap().unwrap()).unwrap();
+        assert_eq!(main["activeWorkspaceId"], "workspace-2");
+        assert_eq!(main["workspaces"].as_array().unwrap().len(), 2);
+
+        // Handing back removes it, and an emptied snapshot goes entirely.
+        unstage_arrival_on_disk(dir.path(), "main", "workspace-7").unwrap();
+        let main: JsonValue =
+            serde_json::from_str(&read_session_from(dir.path(), "main").unwrap().unwrap()).unwrap();
+        assert_eq!(main["workspaces"].as_array().unwrap().len(), 1);
+        unstage_arrival_on_disk(dir.path(), "ws-2", "workspace-7").unwrap();
+        assert!(read_session_from(dir.path(), "ws-2").unwrap().is_none());
+        // Unstaging what was never staged is a no-op, not an error.
+        unstage_arrival_on_disk(dir.path(), "ws-9", "workspace-7").unwrap();
+    }
+
     /// The Windows half of `restrict_to_owner`: after it runs, the DACL must be
     /// protected from inheritance and grant exactly one principal — this user.
     ///

From 4c41d2c132bbbf1d3e80b88b2912eb40565a5796 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 17:36:52 -0700
Subject: [PATCH 2/8] Keep a transferring Workspace in its own arrivals file,
 not a snapshot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Staging the arriving Workspace into the target's sessions/<label>.json at
the invoke broke two ways. A tear-out window then had a snapshot before it
opened, so bootFromTearOut treated it as an ordinary restore, cold-restored
the staged copy, and threw Duplicate Workspace id adopting the real one —
the arrival was handed back and both windows persisted the id. And for a
live target, its own debounced flush iterates the store, which does not
hold the Workspace yet, so it rewrote the file without the staged entry
before adoption. Unstaging the source also went through the per-window
close path, dropping a live window's geometry.

begin_arrival now appends {workspaceId, from, to, workspace} to
sessions/arrivals.json; adopt_done and every hand-back path (adopt_failed,
the target's Destroyed, the watchdog, a failed build_window) drop the
record. Neither snapshot is written. A record still there at boot is a
crash's leftover: setup merges it into the target's snapshot (creating a
tear-out target's file) before restore_windows, takes it out of a source
snapshot that still names it, and deletes the file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RChsJ5rMUMyfu22UZDfUus
---
 docs/specs/security-local.md             |   4 +-
 docs/specs/standalone.md                 |  28 +-
 docs/specs/standalone.rationale.md       |  14 +
 lib/src/lib/window-session-aggregator.ts |   6 +-
 standalone/src-tauri/src/lib.rs          | 414 ++++++++++++++++++-----
 5 files changed, 372 insertions(+), 94 deletions(-)

diff --git a/docs/specs/security-local.md b/docs/specs/security-local.md
index 623fe8a0b..b3cbb1bf3 100644
--- a/docs/specs/security-local.md
+++ b/docs/specs/security-local.md
@@ -139,7 +139,9 @@ behind is `docs/specs/security-remote.md` -> "Credentials at rest".
 persists one window's structure per file as `<state root>/sessions/<label>.json`
 — panes, cwds, titles, doors, layout, TODO flags, never terminal text
 (`docs/specs/standalone.md` -> "Persistence"), plus a
-`<label>.geometry.json` sibling holding that window's box and nothing else.
+`<label>.geometry.json` sibling holding that window's box and nothing else, and
+`arrivals.json`, the Workspaces mid-transfer between windows, written the same way
+(`docs/specs/standalone.md` -> "Arrival queue").
 `restrict_to_owner` locks the directory and, *first*, the temp file renamed into
 it, applying a protected single-ACE DACL on Windows where a unix mode is a
 silent no-op. The same helper
diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 71795b29c..e5a0d805f 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -593,14 +593,20 @@ below reads that record rather than inferring itself from the suppression map.
 - **A boot's `pty_request_init` excludes every id an arrival claims.** Ownership
   moves at the invoke, so those shells would otherwise be listed as top-level
   panes beside the Workspace about to mount them.
-- **`begin_arrival` moves the Workspace between the two snapshots on disk** —
-  out of the source's file, then into the target's (a tear-out target gets a
-  file holding just it) — so a crash before the target's first flush restores
-  it once, in the target, with fresh shells. The webviews' own debounced saves
-  would otherwise leave a gap in which no file held it. Every hand-back path
-  takes it out of the target's file again, since the source persists it as soon
-  as it clears the transferring mark; a file emptied that way is removed
-  (`a_staged_arrival_is_in_the_target_snapshot_until_it_is_handed_back`).
+- **`begin_arrival` records the arrival in `sessions/arrivals.json`** — a JSON
+  array of `{ workspaceId, from, to, workspace }`, never an entry in either
+  window's snapshot (rationale) — and `adopt_done` and every hand-back path
+  (`adopt_failed`, the target's `Destroyed`, the watchdog, a failed
+  `build_window`) drop the record; a record left at boot is merged into its
+  target's snapshot before `restore_windows` — a tear-out target gets a file
+  holding just it, active; a source snapshot still naming the id loses it, an
+  emptied one is removed — so the Workspace restores once, with fresh shells,
+  and the file is deleted
+  (`an_arrival_record_round_trips_until_it_is_forgotten`,
+  `a_leftover_arrival_boots_into_an_existing_target_snapshot`,
+  `a_leftover_arrival_boots_into_a_tear_out_targets_new_snapshot`,
+  `a_leftover_arrival_leaves_a_source_snapshot_that_still_names_it`,
+  `the_arrivals_file_is_gone_after_the_boot_merge`).
 - **An arrival unadopted after `ARRIVAL_MAX` is handed back** by a watchdog armed
   at `begin_arrival`, retiring only the record it was armed for (`queued_at`):
   a target alive but wedged never reaches `adopt_failed` or `Destroyed`, and the
@@ -609,7 +615,8 @@ below reads that record rather than inferring itself from the suppression map.
 
 Source of truth: `Arrival` / `sweep_awaiting` / `expire_arrival` / `boot_list_ids` in
 `standalone/src-tauri/src/routing.rs`; `begin_arrival` / `adopt_ready` /
-`adopt_done` / `adopt_failed` / `hand_back_arrival` / `stage_arrival_on_disk` in
+`adopt_done` / `adopt_failed` / `hand_back_arrival` / `record_arrival_on_disk` /
+`forget_arrival_on_disk` / `restore_arrivals` in
 `standalone/src-tauri/src/lib.rs`; `standalone/src/workspace-move.ts`;
 `markWorkspaceTransferring` in `lib/src/lib/window-session-aggregator.ts`.
 Pinned by `standalone/src/workspace-move.test.ts` and the arrival tests in
@@ -718,7 +725,8 @@ written.
 - **The writer removes its own temp file on every error path**, so only a crash
   can leave one behind.
 - **A per-window close removes the blob, its temp sibling and its geometry**
-  (§Per-window close); nothing else deletes a snapshot.
+  (§Per-window close); nothing else deletes a snapshot but the boot merge
+  (§Arrival queue).
 - **`sweep_orphan_session_temps` runs once in `setup()`** and deletes every
   `<label>.json.tmp` — the legacy and hard-crash migration, given the rule above.
   `SESSION_TEMP_SUFFIX` is pinned against the writer by
diff --git a/docs/specs/standalone.rationale.md b/docs/specs/standalone.rationale.md
index 66685ab07..f0fe7d3d1 100644
--- a/docs/specs/standalone.rationale.md
+++ b/docs/specs/standalone.rationale.md
@@ -128,6 +128,20 @@ left to fall back on. With the record settling at `adopt_done` the drain is
 idempotent, and a reload mid-arrival finds its Workspace again instead of losing
 it. The webview's `adopting` set is what makes repeated drains safe.
 
+The pending-arrival record is its own file rather than an entry staged into a
+snapshot. The first durability attempt wrote the arriving Workspace into the
+target's `sessions/<label>.json` at the invoke and it failed two ways. A torn-out
+window then had a snapshot before it opened, and `bootFromTearOut` reads "this
+window has a snapshot" as "this is an ordinary restore": the new window
+cold-restored the staged copy over fresh shells, drained the arrival, and threw
+`Duplicate Workspace id` adopting the real one — the tear-out was handed back and
+both windows persisted the id. And for a transfer into a live window the staged
+entry did not survive to adoption: `getWindowSnapshot` iterates the target's
+store, which does not hold the Workspace yet, so the target's next debounced
+flush (500 ms after any change, inside the 3 s arrival timeout) rewrote its file
+without it. A file neither webview writes has neither problem, and merging it at
+boot is the only moment no flush can race it.
+
 ## Dragging a Workspace between windows
 
 Spiked before the drag was built, because it was the one unverified platform
diff --git a/lib/src/lib/window-session-aggregator.ts b/lib/src/lib/window-session-aggregator.ts
index dde0b9fd3..11fd02885 100644
--- a/lib/src/lib/window-session-aggregator.ts
+++ b/lib/src/lib/window-session-aggregator.ts
@@ -71,9 +71,9 @@ export function forgetWorkspaceSession(workspaceId: WorkspaceId): void {
  * mounted here, and its Sessions are still attached, because the target may
  * refuse it — but its shells already belong to the target, so a quit or a crash
  * in the gap must not leave the same Workspace persisted by two Windows and
- * restored twice. The host already moved it into the target's snapshot on disk
- * at the invoke (`docs/specs/standalone.md` → "Arrival queue"), so the gap
- * restores it there. Cleared by `clearWorkspaceTransferring` (the target refused
+ * restored twice. The host keeps its own record of the arrival on disk for the
+ * gap (`docs/specs/standalone.md` → "Arrival queue"), so a crash restores it
+ * in the target. Cleared by `clearWorkspaceTransferring` (the target refused
  * it) or by `forgetWorkspaceSession` (it landed).
  */
 export function markWorkspaceTransferring(workspaceId: WorkspaceId): void {
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index d47a2d1d3..e4ede01e4 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -2403,53 +2403,179 @@ fn payload_terminal_ids(payload: &JsonValue) -> Vec<String> {
         .unwrap_or_default()
 }
 
-/// Put an arriving Workspace into the target's snapshot on disk **before** the
-/// target adopts it. The source omits a transferring Workspace from its own
-/// snapshot the moment the invoke returns (so a crash restores it once, not
-/// twice), and the target writes only after adoption — so until this landed, a
-/// crash in the gap restored it nowhere. Idempotent on the id; a target with no
-/// snapshot yet (a tear-out) gets one holding just this Workspace. Never
-/// fatal: a failed write is logged and the transfer proceeds.
-fn stage_arrival_on_disk(dir: &Path, to: &str, workspace: &JsonValue) -> Result<(), String> {
-    let Some(id) = workspace.get("id").and_then(JsonValue::as_str) else {
-        return Err("arrival payload names no workspace.id".to_string());
+// ── Pending arrivals on disk (docs/specs/standalone.md §Arrival queue) ───────
+//
+// A transferring Workspace is in neither window's snapshot: the source omits it
+// from its saves the moment the invoke returns and the target writes only after
+// adoption. `sessions/arrivals.json` — a JSON array of
+// `{ workspaceId, from, to, workspace }` — is what a crash in that gap restores
+// it from. Its own file, never an entry planted in a snapshot: a tear-out
+// window that finds a snapshot boots as a restore (`bootFromTearOut`) and then
+// throws on adopting the same id, and a live target's own debounced flush
+// rewrites its file without anything it has not adopted yet. On the normal
+// path the record is gone before either window flushes, so the file is absent.
+
+const ARRIVALS_FILE: &str = "arrivals.json";
+
+fn arrivals_path(dir: &Path) -> PathBuf {
+    dir.join(ARRIVALS_FILE)
+}
+
+fn read_arrivals_from(dir: &Path) -> Result<Vec<JsonValue>, String> {
+    match std::fs::read_to_string(arrivals_path(dir)) {
+        Ok(contents) => serde_json::from_str::<Vec<JsonValue>>(&contents)
+            .map_err(|e| format!("unreadable {ARRIVALS_FILE}: {e}")),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(Vec::new()),
+        Err(e) => Err(format!("read {ARRIVALS_FILE}: {e}")),
+    }
+}
+
+/// An empty list removes the file, so a run with nothing in flight leaves none.
+fn write_arrivals_to(dir: &Path, records: &[JsonValue]) -> Result<(), String> {
+    if records.is_empty() {
+        return match std::fs::remove_file(arrivals_path(dir)) {
+            Ok(()) => Ok(()),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+            Err(e) => Err(format!("remove {ARRIVALS_FILE}: {e}")),
+        };
+    }
+    write_file_atomically(&arrivals_path(dir), &JsonValue::Array(records.to_vec()).to_string())
+}
+
+fn record_workspace_id(record: &JsonValue) -> Option<&str> {
+    record.get("workspaceId").and_then(JsonValue::as_str)
+}
+
+/// Append one arrival's record, replacing any earlier record of the same id.
+fn record_arrival_on_disk(dir: &Path, arrival: &routing::Arrival) -> Result<(), String> {
+    let Some(workspace) = arrival.payload.get("workspace") else {
+        return Err("arrival payload carries no workspace".to_string());
     };
-    let mut snapshot = match read_session_from(dir, to)? {
-        Some(contents) => serde_json::from_str::<JsonValue>(&contents)
-            .map_err(|e| format!("unreadable snapshot for {to}: {e}"))?,
-        None => serde_json::json!({ "version": 1, "workspaces": [], "activeWorkspaceId": id }),
+    let mut records = read_arrivals_from(dir)?;
+    records.retain(|record| record_workspace_id(record) != Some(&arrival.workspace_id));
+    records.push(serde_json::json!({
+        "workspaceId": arrival.workspace_id,
+        "from": arrival.from,
+        "to": arrival.to,
+        "workspace": workspace,
+    }));
+    write_arrivals_to(dir, &records)
+}
+
+/// Drop the record: the arrival settled, one way or the other. Adopted, the
+/// target flushes the Workspace itself; handed back, the source persists it
+/// again as soon as it clears the transferring mark. A no-op for an id that
+/// was never recorded.
+fn forget_arrival_on_disk(dir: &Path, workspace_id: &str) -> Result<(), String> {
+    let mut records = read_arrivals_from(dir)?;
+    let before = records.len();
+    records.retain(|record| record_workspace_id(record) != Some(workspace_id));
+    if records.len() == before {
+        return Ok(());
+    }
+    write_arrivals_to(dir, &records)
+}
+
+/// `snapshot` (a `PersistedWindow`, or none for a window that never wrote one)
+/// with `workspace` in its list, replacing any entry of the same id. A snapshot
+/// created here holds just this Workspace, active.
+fn snapshot_with_workspace(
+    snapshot: Option<JsonValue>,
+    workspace: &JsonValue,
+) -> Result<JsonValue, String> {
+    let Some(id) = workspace.get("id").and_then(JsonValue::as_str) else {
+        return Err("arrival record names no workspace.id".to_string());
     };
+    let mut snapshot = snapshot.unwrap_or_else(
+        || serde_json::json!({ "version": 1, "workspaces": [], "activeWorkspaceId": id }),
+    );
     let workspaces = snapshot
         .get_mut("workspaces")
         .and_then(JsonValue::as_array_mut)
-        .ok_or_else(|| format!("snapshot for {to} has no workspaces list"))?;
+        .ok_or_else(|| "snapshot has no workspaces list".to_string())?;
     workspaces.retain(|entry| entry.get("id").and_then(JsonValue::as_str) != Some(id));
     workspaces.push(workspace.clone());
-    write_session_to(dir, to, &snapshot.to_string())
+    Ok(snapshot)
+}
+
+/// Take `id` out of `snapshot`'s list; whether it was there.
+fn snapshot_without_workspace(snapshot: &mut JsonValue, id: &str) -> bool {
+    let Some(workspaces) = snapshot.get_mut("workspaces").and_then(JsonValue::as_array_mut) else {
+        return false;
+    };
+    let before = workspaces.len();
+    workspaces.retain(|entry| entry.get("id").and_then(JsonValue::as_str) != Some(id));
+    workspaces.len() != before
 }
 
-/// The inverse, for an arrival that will never be adopted: the source persists
-/// the Workspace again the moment it clears its transferring mark, so leaving
-/// it in the target's file would restore it twice. A snapshot holding nothing
-/// else is removed outright — it is a torn-out window that never opened.
-fn unstage_arrival_on_disk(dir: &Path, to: &str, workspace_id: &str) -> Result<(), String> {
-    let Some(contents) = read_session_from(dir, to)? else {
+fn read_snapshot_from(dir: &Path, label: &str) -> Result<Option<JsonValue>, String> {
+    read_session_from(dir, label)?
+        .map(|contents| {
+            serde_json::from_str::<JsonValue>(&contents)
+                .map_err(|e| format!("unreadable snapshot for {label}: {e}"))
+        })
+        .transpose()
+}
+
+/// Every record still on disk at boot is a crash's leftover, so the Workspace
+/// is in no snapshot. Put it into its target's — a tear-out target that never
+/// opened gets a file, which the boot enumeration then reopens — and take it
+/// out of the source's where that still names it (the source crashed before its
+/// own flush), so it restores once. A source emptied that way is removed like
+/// a closed window: its last Workspace left. The file goes last, so a crash
+/// mid-merge replays it; a record that cannot be merged, or a file that cannot
+/// be read, is logged and dropped rather than replayed on every launch.
+fn restore_arrivals(dir: &Path) -> Result<(), String> {
+    let records = match read_arrivals_from(dir) {
+        Ok(records) => records,
+        Err(e) => {
+            let _ = write_arrivals_to(dir, &[]);
+            return Err(e);
+        }
+    };
+    if records.is_empty() {
         return Ok(());
+    }
+    for record in &records {
+        if let Err(e) = restore_arrival(dir, record) {
+            append_log(format!("[window] dropping a record from {ARRIVALS_FILE}: {e}"));
+        }
+    }
+    write_arrivals_to(dir, &[])
+}
+
+/// One record of the boot merge above: into the target's snapshot, out of the
+/// source's.
+fn restore_arrival(dir: &Path, record: &JsonValue) -> Result<(), String> {
+    let fields = (
+        record_workspace_id(record),
+        record.get("from").and_then(JsonValue::as_str),
+        record.get("to").and_then(JsonValue::as_str),
+        record.get("workspace"),
+    );
+    let (Some(id), Some(from), Some(to), Some(workspace)) = fields else {
+        return Err("malformed record".to_string());
     };
-    let mut snapshot = serde_json::from_str::<JsonValue>(&contents)
-        .map_err(|e| format!("unreadable snapshot for {to}: {e}"))?;
-    let Some(workspaces) = snapshot.get_mut("workspaces").and_then(JsonValue::as_array_mut) else {
+    append_log(format!(
+        "[window] {id} was in flight from {from} to {to} at the last exit; restoring it in {to}"
+    ));
+    let merged = snapshot_with_workspace(read_snapshot_from(dir, to)?, workspace)?;
+    write_session_to(dir, to, &merged.to_string())?;
+    let Some(mut source) = read_snapshot_from(dir, from)? else {
         return Ok(());
     };
-    let before = workspaces.len();
-    workspaces.retain(|entry| entry.get("id").and_then(JsonValue::as_str) != Some(workspace_id));
-    if workspaces.len() == before {
+    if !snapshot_without_workspace(&mut source, id) {
         return Ok(());
     }
-    if workspaces.is_empty() {
-        return remove_session_from(dir, to);
+    let emptied = source
+        .get("workspaces")
+        .and_then(JsonValue::as_array)
+        .is_some_and(Vec::is_empty);
+    if emptied {
+        remove_session_from(dir, from)
+    } else {
+        write_session_to(dir, from, &source.to_string())
     }
-    write_session_to(dir, to, &snapshot.to_string())
 }
 
 /// The record one drop becomes.
@@ -2492,22 +2618,18 @@ fn begin_arrival(
         windows.reassign(&arrival.terminal_ids, &arrival.to, true);
         routing::queue_arrival(&mut arrivals, arrival.clone());
     }
-    // Moved on disk here, not left to the two webviews' debounced saves: out of
-    // the source's snapshot first, then into the target's, so a crash in the
-    // gap restores the Workspace once — in the target, with fresh shells — and
-    // never twice (§Arrival queue). Never fatal.
-    if let Some(workspace) = arrival.payload.get("workspace") {
-        match sessions_dir(app) {
-            Ok(dir) => {
-                if let Err(e) = unstage_arrival_on_disk(&dir, &arrival.from, &arrival.workspace_id) {
-                    append_log(format!("[window] could not unstage {} from disk: {e}", arrival.workspace_id));
-                }
-                if let Err(e) = stage_arrival_on_disk(&dir, &arrival.to, workspace) {
-                    append_log(format!("[window] could not stage {} on disk: {e}", arrival.workspace_id));
-                }
+    // Recorded on disk here, in neither window's snapshot: the source omits a
+    // transferring Workspace from its saves and the target writes only after
+    // adoption, so a crash in the gap would otherwise restore it nowhere
+    // (§Arrival queue). Never fatal: a failed write is logged and the transfer
+    // proceeds.
+    match sessions_dir(app) {
+        Ok(dir) => {
+            if let Err(e) = record_arrival_on_disk(&dir, &arrival) {
+                append_log(format!("[window] could not record {} on disk: {e}", arrival.workspace_id));
             }
-            Err(e) => append_log(format!("[window] {e}")),
         }
+        Err(e) => append_log(format!("[window] {e}")),
     }
     spawn_arrival_watchdog(app.clone(), &arrival);
     Ok(())
@@ -2554,11 +2676,12 @@ fn hand_back_arrival(
         "[window] {} never arrived in {} ({reason}); handing it back to {}",
         arrival.workspace_id, arrival.to, arrival.from
     ));
-    // Out of the target's file first: the source persists it again as soon as
-    // it clears the transferring mark below.
+    // The record goes first: the source persists the Workspace again as soon as
+    // it clears the transferring mark below, and a boot must not restore it
+    // twice.
     if let Ok(dir) = sessions_dir(app) {
-        if let Err(e) = unstage_arrival_on_disk(&dir, &arrival.to, &arrival.workspace_id) {
-            append_log(format!("[window] could not unstage {} on disk: {e}", arrival.workspace_id));
+        if let Err(e) = forget_arrival_on_disk(&dir, &arrival.workspace_id) {
+            append_log(format!("[window] could not forget {} on disk: {e}", arrival.workspace_id));
         }
     }
     if app.get_webview_window(&arrival.from).is_some() {
@@ -2630,7 +2753,7 @@ fn open_workspace_window(
         {
             windows.reassign(&arrival.terminal_ids, &arrival.from, false);
             if let Ok(dir) = sessions_dir(&app) {
-                let _ = unstage_arrival_on_disk(&dir, &label, &arrival.workspace_id);
+                let _ = forget_arrival_on_disk(&dir, &arrival.workspace_id);
             }
         }
         return Err(err);
@@ -2733,6 +2856,12 @@ fn adopt_done(
     )
     .ok_or_else(|| format!("no arrival of '{workspace_id}' into {}", window.label()))?;
     windows.clear_suppression(&arrival.terminal_ids);
+    // The target's own flush persists the Workspace from here (§Arrival queue).
+    if let Ok(dir) = sessions_dir(&app) {
+        if let Err(e) = forget_arrival_on_disk(&dir, &workspace_id) {
+            append_log(format!("[window] could not forget {workspace_id} on disk: {e}"));
+        }
+    }
     append_log(format!(
         "[window] {workspace_id} adopted by {}; telling {}",
         arrival.to, arrival.from
@@ -3716,6 +3845,13 @@ pub fn run() {
             // already up from the config; the rest are cloned from it.
             match sessions_dir(app.handle()) {
                 Ok(dir) => {
+                    // First: a Workspace in flight at the last exit is in no
+                    // snapshot until this puts it in its target's, and a
+                    // tear-out target's file must exist before the enumeration
+                    // below (§Arrival queue).
+                    if let Err(e) = restore_arrivals(&dir) {
+                        append_log(format!("[window] {e}"));
+                    }
                     let labels = routing::restorable_labels(session_file_names(&dir));
                     // Above every SAVED label too, not just the live ones: a
                     // torn-out window must never claim a snapshot still on disk.
@@ -3837,9 +3973,11 @@ mod tests {
         find_node_binary, notepad_archive_lock_path, read_notepad_archive_from, read_session_from,
         reset_notepad_archive_at, resolve_dor_cli_paths, resolve_sidecar_path, session_file_name,
         state_root_from, strip_windows_verbatim_prefix, sweep_orphan_session_temps,
-        stage_arrival_on_disk, temp_write_path, unstage_arrival_on_disk, write_notepad_archive_to,
+        arrivals_path, forget_arrival_on_disk, read_arrivals_from, record_arrival_on_disk,
+        restore_arrivals, session_file_names, temp_write_path, write_notepad_archive_to,
         write_session_to, JsonValue, SESSION_TEMP_SUFFIX, NOTEPAD_ARCHIVE_FILE,
     };
+    use super::routing;
     use super::guard;
     use std::collections::HashSet;
     use std::fs;
@@ -3870,45 +4008,161 @@ mod tests {
         }
     }
 
+    // --- Pending arrivals on disk (§Arrival queue) ---------------------------
+
+    fn workspace_json(id: &str, name: &str) -> JsonValue {
+        serde_json::json!({ "id": id, "name": name, "session": { "version": 3, "panes": [] } })
+    }
+
+    fn arrival_of(id: &str, from: &str, to: &str) -> routing::Arrival {
+        routing::Arrival {
+            workspace_id: id.to_string(),
+            from: from.to_string(),
+            to: to.to_string(),
+            terminal_ids: Vec::new(),
+            payload: serde_json::json!({ "workspaceId": id, "workspace": workspace_json(id, "Moved") }),
+            queued_at: std::time::Instant::now(),
+        }
+    }
+
+    fn snapshot_json(entries: &[(&str, &str)], active: &str) -> String {
+        let workspaces: Vec<JsonValue> =
+            entries.iter().map(|(id, name)| workspace_json(id, name)).collect();
+        serde_json::json!({ "version": 1, "workspaces": workspaces, "activeWorkspaceId": active })
+            .to_string()
+    }
+
+    fn read_snapshot(dir: &Path, label: &str) -> Option<JsonValue> {
+        read_session_from(dir, label)
+            .unwrap()
+            .map(|contents| serde_json::from_str(&contents).unwrap())
+    }
+
+    fn snapshot_ids(snapshot: &JsonValue) -> Vec<String> {
+        super::workspaces::snapshot_ids(snapshot)
+    }
+
     #[test]
-    fn a_staged_arrival_is_in_the_target_snapshot_until_it_is_handed_back() {
-        let dir = TempDir::new("arrival-stage");
-        let workspace = serde_json::json!({ "id": "workspace-7", "name": "Docs", "session": { "version": 3 } });
-
-        // A tear-out target has no snapshot yet: it gets one holding the arrival.
-        stage_arrival_on_disk(dir.path(), "ws-2", &workspace).unwrap();
-        let read = || -> JsonValue {
-            serde_json::from_str(&read_session_from(dir.path(), "ws-2").unwrap().unwrap()).unwrap()
-        };
-        assert_eq!(read()["activeWorkspaceId"], "workspace-7");
-        assert_eq!(read()["workspaces"].as_array().unwrap().len(), 1);
+    fn an_arrival_record_round_trips_until_it_is_forgotten() {
+        let dir = TempDir::new("arrivals-round-trip");
+        // Nothing in flight is no file at all, and forgetting is then a no-op.
+        assert!(read_arrivals_from(dir.path()).unwrap().is_empty());
+        forget_arrival_on_disk(dir.path(), "workspace-7").unwrap();
+        assert!(!arrivals_path(dir.path()).exists());
+
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-8", "main", "ws-3")).unwrap();
+        // Recording the same id again replaces rather than duplicates.
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        let records = read_arrivals_from(dir.path()).unwrap();
+        assert_eq!(records.len(), 2);
+        assert_eq!(records[1]["workspaceId"], "workspace-7");
+        assert_eq!(records[1]["from"], "main");
+        assert_eq!(records[1]["to"], "ws-2");
+        assert_eq!(records[1]["workspace"]["name"], "Moved");
+        // Neither window's snapshot was touched.
+        assert!(read_session_from(dir.path(), "main").unwrap().is_none());
+        assert!(read_session_from(dir.path(), "ws-2").unwrap().is_none());
+        // The file is never a window the boot enumeration would reopen.
+        assert_eq!(
+            routing::restorable_labels(session_file_names(dir.path())),
+            Vec::<String>::new()
+        );
 
-        // Staging the same id again replaces rather than duplicates.
-        stage_arrival_on_disk(dir.path(), "ws-2", &workspace).unwrap();
-        assert_eq!(read()["workspaces"].as_array().unwrap().len(), 1);
+        forget_arrival_on_disk(dir.path(), "workspace-7").unwrap();
+        let records = read_arrivals_from(dir.path()).unwrap();
+        assert_eq!(records.len(), 1);
+        assert_eq!(records[0]["workspaceId"], "workspace-8");
+        // Forgetting the last record removes the file.
+        forget_arrival_on_disk(dir.path(), "workspace-8").unwrap();
+        assert!(!arrivals_path(dir.path()).exists());
+    }
 
-        // An existing target keeps what it had and its own active Workspace.
+    #[test]
+    fn a_leftover_arrival_boots_into_an_existing_target_snapshot() {
+        let dir = TempDir::new("arrivals-existing-target");
         write_session_to(
             dir.path(),
             "main",
-            &serde_json::json!({ "version": 1, "workspaces": [{ "id": "workspace-2", "name": "A" }], "activeWorkspaceId": "workspace-2" }).to_string(),
+            &snapshot_json(&[("workspace-2", "A"), ("workspace-7", "Stale")], "workspace-2"),
         )
         .unwrap();
-        stage_arrival_on_disk(dir.path(), "main", &workspace).unwrap();
-        let main: JsonValue =
-            serde_json::from_str(&read_session_from(dir.path(), "main").unwrap().unwrap()).unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "ws-3", "main")).unwrap();
+
+        restore_arrivals(dir.path()).unwrap();
+
+        // Appended, or here replaced by id: the target keeps what it had and
+        // its own active Workspace.
+        let main = read_snapshot(dir.path(), "main").unwrap();
+        assert_eq!(snapshot_ids(&main), vec!["workspace-2", "workspace-7"]);
         assert_eq!(main["activeWorkspaceId"], "workspace-2");
-        assert_eq!(main["workspaces"].as_array().unwrap().len(), 2);
-
-        // Handing back removes it, and an emptied snapshot goes entirely.
-        unstage_arrival_on_disk(dir.path(), "main", "workspace-7").unwrap();
-        let main: JsonValue =
-            serde_json::from_str(&read_session_from(dir.path(), "main").unwrap().unwrap()).unwrap();
-        assert_eq!(main["workspaces"].as_array().unwrap().len(), 1);
-        unstage_arrival_on_disk(dir.path(), "ws-2", "workspace-7").unwrap();
+        assert_eq!(main["workspaces"][1]["name"], "Moved");
+        // A source that never had a snapshot gets none.
+        assert!(read_session_from(dir.path(), "ws-3").unwrap().is_none());
+    }
+
+    #[test]
+    fn a_leftover_arrival_boots_into_a_tear_out_targets_new_snapshot() {
+        let dir = TempDir::new("arrivals-tear-out-target");
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
         assert!(read_session_from(dir.path(), "ws-2").unwrap().is_none());
-        // Unstaging what was never staged is a no-op, not an error.
-        unstage_arrival_on_disk(dir.path(), "ws-9", "workspace-7").unwrap();
+
+        restore_arrivals(dir.path()).unwrap();
+
+        let ws2 = read_snapshot(dir.path(), "ws-2").unwrap();
+        assert_eq!(snapshot_ids(&ws2), vec!["workspace-7"]);
+        assert_eq!(ws2["activeWorkspaceId"], "workspace-7");
+        assert_eq!(ws2["version"], 1);
+        // The window the merge created is one the boot enumeration reopens.
+        assert_eq!(routing::restorable_labels(session_file_names(dir.path())), vec!["ws-2"]);
+    }
+
+    #[test]
+    fn a_leftover_arrival_leaves_a_source_snapshot_that_still_names_it() {
+        let dir = TempDir::new("arrivals-source");
+        // The source crashed before its own flush omitted the Workspace.
+        write_session_to(
+            dir.path(),
+            "ws-3",
+            &snapshot_json(&[("workspace-7", "Docs"), ("workspace-8", "Keep")], "workspace-7"),
+        )
+        .unwrap();
+        // A source whose only Workspace left is a closed window.
+        write_session_to(dir.path(), "ws-4", &snapshot_json(&[("workspace-9", "Only")], "workspace-9"))
+            .unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "ws-3", "main")).unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-9", "ws-4", "main")).unwrap();
+
+        restore_arrivals(dir.path()).unwrap();
+
+        let ws3 = read_snapshot(dir.path(), "ws-3").unwrap();
+        assert_eq!(snapshot_ids(&ws3), vec!["workspace-8"]);
+        assert!(read_session_from(dir.path(), "ws-4").unwrap().is_none());
+        let main = read_snapshot(dir.path(), "main").unwrap();
+        assert_eq!(snapshot_ids(&main), vec!["workspace-7", "workspace-9"]);
+        // Each id is now in exactly one snapshot.
+        assert_eq!(
+            routing::restorable_labels(session_file_names(dir.path())),
+            vec!["main", "ws-3"]
+        );
+    }
+
+    #[test]
+    fn the_arrivals_file_is_gone_after_the_boot_merge() {
+        let dir = TempDir::new("arrivals-gone");
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        assert!(arrivals_path(dir.path()).exists());
+
+        restore_arrivals(dir.path()).unwrap();
+        assert!(!arrivals_path(dir.path()).exists());
+        // Idempotent: a second boot has nothing to merge and changes nothing.
+        restore_arrivals(dir.path()).unwrap();
+        assert_eq!(snapshot_ids(&read_snapshot(dir.path(), "ws-2").unwrap()), vec!["workspace-7"]);
+
+        // An unreadable file is dropped rather than replayed on every launch.
+        fs::write(arrivals_path(dir.path()), "{not json").unwrap();
+        assert!(restore_arrivals(dir.path()).is_err());
+        assert!(!arrivals_path(dir.path()).exists());
     }
 
     /// The Windows half of `restrict_to_owner`: after it runs, the DACL must be

From 4363add382606c2a7fe47c0e47a4429571a1e3bc Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 18:31:07 -0700
Subject: [PATCH 3/8] Retain transfer journal until both Window snapshots
 reflect adoption

---
 docs/specs/standalone.md        |  11 ++-
 scripts/spec-word-budgets.json  |   2 +-
 standalone/src-tauri/src/lib.rs | 121 ++++++++++++++++++++++++++------
 3 files changed, 107 insertions(+), 27 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 6631b3f66..1a478f914 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -626,13 +626,17 @@ below reads that record rather than inferring itself from the suppression map.
   panes beside the Workspace about to mount them.
 - **`begin_arrival` records the arrival in `sessions/arrivals.json`** — a JSON
   array of `{ workspaceId, from, to, workspace }`, never an entry in either
-  window's snapshot (rationale) — and `adopt_done` and every hand-back path
+  window's snapshot (rationale). **Must retain an adopted record until target
+  and source snapshots both reflect the move**, marking it settled at
+  `adopt_done` and checking after each `save_session`
+  (`adoption_keeps_the_journal_until_both_snapshots_are_durable`). Every hand-back path
   (`adopt_failed`, the target's `Destroyed`, the watchdog, a failed
   `build_window`) drop the record; a record left at boot is merged into its
   target's snapshot before `restore_windows` — a tear-out target gets a file
   holding just it, active; a source snapshot still naming the id loses it, an
   emptied one is removed — so the Workspace restores once, with fresh shells,
-  and the file is deleted
+  and successful records are deleted; **must retain failed records for retry
+  and roll back the target if trimming the source fails**
   (`an_arrival_record_round_trips_until_it_is_forgotten`,
   `a_leftover_arrival_boots_into_an_existing_target_snapshot`,
   `a_leftover_arrival_boots_into_a_tear_out_targets_new_snapshot`,
@@ -650,7 +654,8 @@ Source of truth: `Arrival` / `sweep_awaiting` / `expire_arrival` / `boot_list_id
 `forget_arrival_on_disk` / `restore_arrivals` in
 `standalone/src-tauri/src/lib.rs`; `standalone/src/workspace-move.ts`;
 `markWorkspaceTransferring` in `lib/src/lib/window-session-aggregator.ts`.
-Pinned by `standalone/src/workspace-move.test.ts` and the arrival tests in
+Pinned by `standalone/src/workspace-move.test.ts`, the disk tests in
+`standalone/src-tauri/src/lib.rs`, and the arrival tests in
 `standalone/src-tauri/src/routing.rs`.
 
 ### Dragging a Workspace between windows
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index eb680a879..4ce6a3a29 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 9500,
+  "docs/specs/standalone.md": 9550,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 094ecf944..4b047148f 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -1818,7 +1818,10 @@ async fn save_session(window: tauri::Window, state: String) -> Result<(), String
             return Ok(());
         }
     }
-    write_session_to(&sessions_dir(window.app_handle())?, window.label(), &state)
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
+    let dir = sessions_dir(window.app_handle())?;
+    write_session_to(&dir, window.label(), &state)?;
+    retire_saved_arrivals(&dir)
 }
 
 /// The suffix `write_file_atomically` leaves on a session snapshot's temp
@@ -2461,9 +2464,42 @@ fn payload_terminal_ids(payload: &JsonValue) -> Vec<String> {
 // window that finds a snapshot boots as a restore (`bootFromTearOut`) and then
 // throws on adopting the same id, and a live target's own debounced flush
 // rewrites its file without anything it has not adopted yet. On the normal
-// path the record is gone before either window flushes, so the file is absent.
+// path the record retires after both windows flush their new membership.
 
 const ARRIVALS_FILE: &str = "arrivals.json";
+// Serializes journal updates with snapshot writes and retirement checks. Never
+// acquired while emitting events; helpers below do not acquire it recursively.
+static ARRIVAL_DISK_LOCK: Mutex<()> = Mutex::new(());
+
+/// An adopted arrival stays recoverable until BOTH snapshots reflect the move.
+fn retire_saved_arrivals(dir: &Path) -> Result<(), String> {
+    let records = read_arrivals_from(dir)?;
+    let mut keep = Vec::new();
+    for record in &records {
+        let durable = (|| -> Result<bool, String> {
+            if record.get("settled").and_then(JsonValue::as_bool) != Some(true) { return Ok(false); }
+            let Some(id) = record_workspace_id(record) else { return Ok(false); };
+            let Some(from) = record.get("from").and_then(JsonValue::as_str) else { return Ok(false); };
+            let Some(to) = record.get("to").and_then(JsonValue::as_str) else { return Ok(false); };
+            let target_has = read_snapshot_from(dir, to)?.is_some_and(|s| workspaces::snapshot_ids(&s).iter().any(|v| v == id));
+            let source_has = read_snapshot_from(dir, from)?.is_some_and(|s| workspaces::snapshot_ids(&s).iter().any(|v| v == id));
+            Ok(target_has && !source_has)
+        })();
+        if !matches!(durable, Ok(true)) { keep.push(record.clone()); }
+    }
+    if keep.len() != records.len() { write_arrivals_to(dir, &keep)?; }
+    Ok(())
+}
+
+fn mark_arrival_adopted_on_disk(dir: &Path, workspace_id: &str) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
+    let mut records = read_arrivals_from(dir)?;
+    for record in &mut records {
+        if record_workspace_id(record) == Some(workspace_id) { record["settled"] = JsonValue::Bool(true); }
+    }
+    write_arrivals_to(dir, &records)?;
+    retire_saved_arrivals(dir)
+}
 
 fn arrivals_path(dir: &Path) -> PathBuf {
     dir.join(ARRIVALS_FILE)
@@ -2496,6 +2532,7 @@ fn record_workspace_id(record: &JsonValue) -> Option<&str> {
 
 /// Append one arrival's record, replacing any earlier record of the same id.
 fn record_arrival_on_disk(dir: &Path, arrival: &routing::Arrival) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
     let Some(workspace) = arrival.payload.get("workspace") else {
         return Err("arrival payload carries no workspace".to_string());
     };
@@ -2515,6 +2552,7 @@ fn record_arrival_on_disk(dir: &Path, arrival: &routing::Arrival) -> Result<(),
 /// again as soon as it clears the transferring mark. A no-op for an id that
 /// was never recorded.
 fn forget_arrival_on_disk(dir: &Path, workspace_id: &str) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
     let mut records = read_arrivals_from(dir)?;
     let before = records.len();
     records.retain(|record| record_workspace_id(record) != Some(workspace_id));
@@ -2571,9 +2609,10 @@ fn read_snapshot_from(dir: &Path, label: &str) -> Result<Option<JsonValue>, Stri
 /// out of the source's where that still names it (the source crashed before its
 /// own flush), so it restores once. A source emptied that way is removed like
 /// a closed window: its last Workspace left. The file goes last, so a crash
-/// mid-merge replays it; a record that cannot be merged, or a file that cannot
-/// be read, is logged and dropped rather than replayed on every launch.
+/// mid-merge replays it; a failed record stays for retry. An unreadable journal
+/// is logged and dropped because its entries cannot be recovered.
 fn restore_arrivals(dir: &Path) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
     let records = match read_arrivals_from(dir) {
         Ok(records) => records,
         Err(e) => {
@@ -2584,12 +2623,14 @@ fn restore_arrivals(dir: &Path) -> Result<(), String> {
     if records.is_empty() {
         return Ok(());
     }
+    let mut failed = Vec::new();
     for record in &records {
         if let Err(e) = restore_arrival(dir, record) {
-            append_log(format!("[window] dropping a record from {ARRIVALS_FILE}: {e}"));
+            append_log(format!("[window] retaining a record from {ARRIVALS_FILE}: {e}"));
+            failed.push(record.clone());
         }
     }
-    write_arrivals_to(dir, &[])
+    write_arrivals_to(dir, &failed)
 }
 
 /// One record of the boot merge above: into the target's snapshot, out of the
@@ -2607,23 +2648,28 @@ fn restore_arrival(dir: &Path, record: &JsonValue) -> Result<(), String> {
     append_log(format!(
         "[window] {id} was in flight from {from} to {to} at the last exit; restoring it in {to}"
     ));
-    let merged = snapshot_with_workspace(read_snapshot_from(dir, to)?, workspace)?;
+    // Read both before writing either. If trimming the source fails after the
+    // target write, restore its old bytes and retain the journal for retry.
+    let previous_target = read_snapshot_from(dir, to)?;
+    let source = read_snapshot_from(dir, from)?;
+    let merged = snapshot_with_workspace(previous_target.clone(), workspace)?;
     write_session_to(dir, to, &merged.to_string())?;
-    let Some(mut source) = read_snapshot_from(dir, from)? else {
-        return Ok(());
-    };
-    if !snapshot_without_workspace(&mut source, id) {
-        return Ok(());
-    }
-    let emptied = source
-        .get("workspaces")
-        .and_then(JsonValue::as_array)
-        .is_some_and(Vec::is_empty);
-    if emptied {
-        remove_session_from(dir, from)
-    } else {
-        write_session_to(dir, from, &source.to_string())
+    let trim = (|| -> Result<(), String> {
+        let Some(mut source) = source else { return Ok(()); };
+        if !snapshot_without_workspace(&mut source, id) { return Ok(()); }
+        let emptied = source.get("workspaces").and_then(JsonValue::as_array).is_some_and(Vec::is_empty);
+        if emptied { remove_session_from(dir, from) }
+        else { write_session_to(dir, from, &source.to_string()) }
+    })();
+    if let Err(error) = trim {
+        let rollback = match previous_target {
+            Some(snapshot) => write_session_to(dir, to, &snapshot.to_string()),
+            None => std::fs::remove_file(dir.join(session_file_name(to))).map_err(|e| e.to_string()),
+        };
+        if let Err(e) = rollback { append_log(format!("[window] arrival rollback failed: {e}")); }
+        return Err(error);
     }
+    Ok(())
 }
 
 /// The record one drop becomes.
@@ -2904,9 +2950,9 @@ fn adopt_done(
     )
     .ok_or_else(|| format!("no arrival of '{workspace_id}' into {}", window.label()))?;
     windows.clear_suppression(&arrival.terminal_ids);
-    // The target's own flush persists the Workspace from here (§Arrival queue).
+    // Keep the journal until source and target saves both reflect the move.
     if let Ok(dir) = sessions_dir(&app) {
-        if let Err(e) = forget_arrival_on_disk(&dir, &workspace_id) {
+        if let Err(e) = mark_arrival_adopted_on_disk(&dir, &workspace_id) {
             append_log(format!("[window] could not forget {workspace_id} on disk: {e}"));
         }
     }
@@ -4217,6 +4263,35 @@ mod tests {
         );
     }
 
+    #[test]
+    fn adoption_keeps_the_journal_until_both_snapshots_are_durable() {
+        let dir = TempDir::new("arrival-commit");
+        write_session_to(dir.path(), "main", &snapshot_json(&[("workspace-7", "Moved")], "workspace-7")).unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        super::mark_arrival_adopted_on_disk(dir.path(), "workspace-7").unwrap();
+        assert_eq!(read_arrivals_from(dir.path()).unwrap().len(), 1);
+        write_session_to(dir.path(), "ws-2", &snapshot_json(&[("workspace-7", "Moved")], "workspace-7")).unwrap();
+        super::retire_saved_arrivals(dir.path()).unwrap();
+        assert_eq!(read_arrivals_from(dir.path()).unwrap().len(), 1);
+        write_session_to(dir.path(), "main", &snapshot_json(&[], "workspace-1")).unwrap();
+        super::retire_saved_arrivals(dir.path()).unwrap();
+        assert!(!arrivals_path(dir.path()).exists());
+    }
+
+    #[test]
+    fn an_unreadable_source_retains_the_record_without_changing_the_target() {
+        let dir = TempDir::new("arrival-retry");
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        write_session_to(dir.path(), "main", "broken json").unwrap();
+        restore_arrivals(dir.path()).unwrap();
+        assert!(read_session_from(dir.path(), "ws-2").unwrap().is_none());
+        assert_eq!(read_arrivals_from(dir.path()).unwrap().len(), 1);
+        write_session_to(dir.path(), "main", &snapshot_json(&[("workspace-7", "Moved")], "workspace-7")).unwrap();
+        restore_arrivals(dir.path()).unwrap();
+        assert!(!arrivals_path(dir.path()).exists());
+        assert_eq!(snapshot_ids(&read_snapshot(dir.path(), "ws-2").unwrap()), vec!["workspace-7"]);
+    }
+
     #[test]
     fn the_arrivals_file_is_gone_after_the_boot_merge() {
         let dir = TempDir::new("arrivals-gone");

From 269bd1cc17d30de8f11ed75af1d72ad0204f7f6e Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 18:42:07 -0700
Subject: [PATCH 4/8] Preserve newer adopted snapshots and retire journals when
 sources close

---
 docs/specs/standalone.md        |  5 ++--
 standalone/src-tauri/src/lib.rs | 43 ++++++++++++++++++++++++++++++---
 2 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 1a478f914..829ab229c 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -628,7 +628,7 @@ below reads that record rather than inferring itself from the suppression map.
   array of `{ workspaceId, from, to, workspace }`, never an entry in either
   window's snapshot (rationale). **Must retain an adopted record until target
   and source snapshots both reflect the move**, marking it settled at
-  `adopt_done` and checking after each `save_session`
+  `adopt_done` and checking after each `save_session` or source-window close
   (`adoption_keeps_the_journal_until_both_snapshots_are_durable`). Every hand-back path
   (`adopt_failed`, the target's `Destroyed`, the watchdog, a failed
   `build_window`) drop the record; a record left at boot is merged into its
@@ -636,7 +636,8 @@ below reads that record rather than inferring itself from the suppression map.
   holding just it, active; a source snapshot still naming the id loses it, an
   emptied one is removed — so the Workspace restores once, with fresh shells,
   and successful records are deleted; **must retain failed records for retry
-  and roll back the target if trimming the source fails**
+  and roll back the target if trimming the source fails**. **Must preserve a
+  settled arrival’s newer target record during boot recovery**
   (`an_arrival_record_round_trips_until_it_is_forgotten`,
   `a_leftover_arrival_boots_into_an_existing_target_snapshot`,
   `a_leftover_arrival_boots_into_a_tear_out_targets_new_snapshot`,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 4b047148f..2af13a8ac 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -704,7 +704,8 @@ fn finish_window_close(app: &AppHandle, label: &str) {
         state.begin_closing(label);
     }
     if let Ok(dir) = sessions_dir(app) {
-        if let Err(err) = remove_session_from(&dir, label) {
+        let _disk = guard(&ARRIVAL_DISK_LOCK);
+        if let Err(err) = remove_session_from(&dir, label).and_then(|_| retire_saved_arrivals(&dir)) {
             append_log(format!("[session] {err}"));
         }
     }
@@ -1810,6 +1811,7 @@ async fn load_session(window: tauri::Window) -> Result<Option<String>, String> {
 
 #[tauri::command]
 async fn save_session(window: tauri::Window, state: String) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
     // A deliberate close removes the snapshot; a save still in flight from the
     // webview that is going away must not put it back
     // (docs/specs/standalone.md §Per-window close).
@@ -1818,7 +1820,6 @@ async fn save_session(window: tauri::Window, state: String) -> Result<(), String
             return Ok(());
         }
     }
-    let _disk = guard(&ARRIVAL_DISK_LOCK);
     let dir = sessions_dir(window.app_handle())?;
     write_session_to(&dir, window.label(), &state)?;
     retire_saved_arrivals(&dir)
@@ -2652,7 +2653,15 @@ fn restore_arrival(dir: &Path, record: &JsonValue) -> Result<(), String> {
     // target write, restore its old bytes and retain the journal for retry.
     let previous_target = read_snapshot_from(dir, to)?;
     let source = read_snapshot_from(dir, from)?;
-    let merged = snapshot_with_workspace(previous_target.clone(), workspace)?;
+    // Once adoption settled, the target may already hold a newer snapshot.
+    // Preserve that record while finishing the source side of the transaction.
+    let existing = previous_target.as_ref()
+        .and_then(|s| s.get("workspaces")).and_then(JsonValue::as_array)
+        .and_then(|entries| entries.iter().find(|entry| entry.get("id").and_then(JsonValue::as_str) == Some(id)));
+    let restore = if record.get("settled").and_then(JsonValue::as_bool) == Some(true) {
+        existing.unwrap_or(workspace)
+    } else { workspace };
+    let merged = snapshot_with_workspace(previous_target.clone(), restore)?;
     write_session_to(dir, to, &merged.to_string())?;
     let trim = (|| -> Result<(), String> {
         let Some(mut source) = source else { return Ok(()); };
@@ -4278,6 +4287,34 @@ mod tests {
         assert!(!arrivals_path(dir.path()).exists());
     }
 
+    #[test]
+    fn a_settled_recovery_preserves_the_targets_newer_snapshot() {
+        let dir = TempDir::new("arrival-newer-target");
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        super::mark_arrival_adopted_on_disk(dir.path(), "workspace-7").unwrap();
+        write_session_to(dir.path(), "ws-2", &snapshot_json(&[("workspace-7", "Renamed after adoption")], "workspace-7")).unwrap();
+        restore_arrivals(dir.path()).unwrap();
+        assert_eq!(read_snapshot(dir.path(), "ws-2").unwrap()["workspaces"][0]["name"], "Renamed after adoption");
+    }
+
+    #[test]
+    fn a_failed_source_write_rolls_back_the_target_and_retries() {
+        let dir = TempDir::new("arrival-source-write");
+        write_session_to(dir.path(), "main", &snapshot_json(&[("workspace-7", "Moved"), ("workspace-8", "Keep")], "workspace-8")).unwrap();
+        let before = snapshot_json(&[("workspace-9", "Target")], "workspace-9");
+        write_session_to(dir.path(), "ws-2", &before).unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        let blocked = temp_write_path(&dir.path().join(session_file_name("main")));
+        fs::create_dir(&blocked).unwrap();
+        restore_arrivals(dir.path()).unwrap();
+        assert_eq!(read_snapshot(dir.path(), "ws-2").unwrap(), serde_json::from_str::<serde_json::Value>(&before).unwrap());
+        assert_eq!(read_arrivals_from(dir.path()).unwrap().len(), 1);
+        fs::remove_dir(blocked).unwrap();
+        restore_arrivals(dir.path()).unwrap();
+        assert!(!arrivals_path(dir.path()).exists());
+        assert_eq!(snapshot_ids(&read_snapshot(dir.path(), "main").unwrap()), vec!["workspace-8"]);
+    }
+
     #[test]
     fn an_unreadable_source_retains_the_record_without_changing_the_target() {
         let dir = TempDir::new("arrival-retry");

From fd81afdc4a19c8eb7462440edf18e95d986e7c84 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 18:56:31 -0700
Subject: [PATCH 5/8] Keep transfer outcomes durable through refusal and target
 closure

---
 docs/specs/standalone.md        |  14 ++-
 scripts/spec-word-budgets.json  |   2 +-
 standalone/src-tauri/src/lib.rs | 169 ++++++++++++++++++++++++--------
 3 files changed, 139 insertions(+), 46 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 8d2c69814..ad237d194 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -629,10 +629,13 @@ below reads that record rather than inferring itself from the suppression map.
   window's snapshot (rationale). **Must retain an adopted record until target
   and source snapshots both reflect the move**, marking it settled at
   `adopt_done` and checking after each `save_session` or source-window close
-  (`adoption_keeps_the_journal_until_both_snapshots_are_durable`). Every hand-back path
-  (`adopt_failed`, the target's `Destroyed`, the watchdog, a failed
-  `build_window`) drop the record; a record left at boot is merged into its
-  target's snapshot before `restore_windows` — a tear-out target gets a file
+  (`adoption_keeps_the_journal_until_both_snapshots_are_durable`). **Must reverse
+  the durable destination on hand-back and retain the record until both
+  snapshots reflect the return** (`a_hand_back_is_recovered_in_the_source_before_its_next_flush`).
+  **Must tombstone settled arrivals into a deliberately closed Window until
+  both snapshots omit them**, including during boot recovery
+  (`closing_an_adopted_target_never_resurrects_either_copy`).
+  A record left at boot is merged into its recorded destination before `restore_windows` — a tear-out target gets a file
   holding just it, active; a source snapshot still naming the id loses it, an
   emptied one is removed — so the Workspace restores once, with fresh shells,
   and successful records are deleted; **must retain failed records for retry
@@ -643,6 +646,9 @@ below reads that record rather than inferring itself from the suppression map.
   `a_leftover_arrival_boots_into_a_tear_out_targets_new_snapshot`,
   `a_leftover_arrival_leaves_a_source_snapshot_that_still_names_it`,
   `the_arrivals_file_is_gone_after_the_boot_merge`).
+- **Must run journal I/O and its lock waits off the main thread**, including
+  transfer/settlement/close commands and destroyed-window cleanup
+  (`journal_commands_run_off_the_main_thread`).
 - **An arrival unadopted after `ARRIVAL_MAX` is handed back** by a watchdog armed
   at `begin_arrival`, retiring only the record it was armed for (`queued_at`):
   a target alive but wedged never reaches `adopt_failed` or `Destroyed`, and the
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 5c395b0ff..5b0f31827 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 9550,
+  "docs/specs/standalone.md": 9600,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index c2afd1388..5f7517421 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -704,8 +704,7 @@ fn finish_window_close(app: &AppHandle, label: &str) {
         state.begin_closing(label);
     }
     if let Ok(dir) = sessions_dir(app) {
-        let _disk = guard(&ARRIVAL_DISK_LOCK);
-        if let Err(err) = remove_session_from(&dir, label).and_then(|_| retire_saved_arrivals(&dir)) {
+        if let Err(err) = close_window_snapshot(&dir, label) {
             append_log(format!("[session] {err}"));
         }
     }
@@ -2487,7 +2486,9 @@ fn retire_saved_arrivals(dir: &Path) -> Result<(), String> {
             let Some(to) = record.get("to").and_then(JsonValue::as_str) else { return Ok(false); };
             let target_has = read_snapshot_from(dir, to)?.is_some_and(|s| workspaces::snapshot_ids(&s).iter().any(|v| v == id));
             let source_has = read_snapshot_from(dir, from)?.is_some_and(|s| workspaces::snapshot_ids(&s).iter().any(|v| v == id));
-            Ok(target_has && !source_has)
+            Ok(if record.get("discarded").and_then(JsonValue::as_bool) == Some(true) {
+                !target_has && !source_has
+            } else { target_has && !source_has })
         })();
         if !matches!(durable, Ok(true)) { keep.push(record.clone()); }
     }
@@ -2505,6 +2506,47 @@ fn mark_arrival_adopted_on_disk(dir: &Path, workspace_id: &str) -> Result<(), St
     retire_saved_arrivals(dir)
 }
 
+/// Refusal reverses the durable destination before the source is told to save.
+fn return_arrival_on_disk(dir: &Path, arrival: &routing::Arrival) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
+    let mut records = read_arrivals_from(dir)?;
+    records.retain(|r| record_workspace_id(r) != Some(&arrival.workspace_id));
+    records.push(serde_json::json!({
+        "workspaceId": arrival.workspace_id, "from": arrival.to, "to": arrival.from,
+        "workspace": arrival.payload["workspace"], "settled": true,
+    }));
+    write_arrivals_to(dir, &records)?;
+    retire_saved_arrivals(dir)
+}
+
+/// A deliberate close cancels recovery into this window. Keep a tombstone
+/// while another snapshot still contains the transferred Workspace, so boot
+/// removes that stale copy instead of resurrecting it in either window.
+fn close_window_snapshot(dir: &Path, label: &str) -> Result<(), String> {
+    let _disk = guard(&ARRIVAL_DISK_LOCK);
+    let mut records = read_arrivals_from(dir)?;
+    let mut changed = false;
+    for record in &mut records {
+        if record.get("to").and_then(JsonValue::as_str) == Some(label)
+            && record.get("settled").and_then(JsonValue::as_bool) == Some(true)
+        {
+            record["discarded"] = JsonValue::Bool(true);
+            changed = true;
+        }
+    }
+    if changed { write_arrivals_to(dir, &records)?; }
+    remove_session_from(dir, label)?;
+    retire_saved_arrivals(dir)
+}
+
+fn remove_workspace_from_disk(dir: &Path, label: &str, id: &str) -> Result<(), String> {
+    let Some(mut snapshot) = read_snapshot_from(dir, label)? else { return Ok(()); };
+    if !snapshot_without_workspace(&mut snapshot, id) { return Ok(()); }
+    if snapshot.get("workspaces").and_then(JsonValue::as_array).is_some_and(Vec::is_empty) {
+        remove_session_from(dir, label)
+    } else { write_session_to(dir, label, &snapshot.to_string()) }
+}
+
 fn arrivals_path(dir: &Path) -> PathBuf {
     dir.join(ARRIVALS_FILE)
 }
@@ -2649,6 +2691,10 @@ fn restore_arrival(dir: &Path, record: &JsonValue) -> Result<(), String> {
     let (Some(id), Some(from), Some(to), Some(workspace)) = fields else {
         return Err("malformed record".to_string());
     };
+    if record.get("discarded").and_then(JsonValue::as_bool) == Some(true) {
+        remove_workspace_from_disk(dir, from, id)?;
+        return remove_workspace_from_disk(dir, to, id);
+    }
     append_log(format!(
         "[window] {id} was in flight from {from} to {to} at the last exit; restoring it in {to}"
     ));
@@ -2782,15 +2828,12 @@ fn hand_back_arrival(
         "[window] {} never arrived in {} ({reason}); handing it back to {}",
         arrival.workspace_id, arrival.to, arrival.from
     ));
-    // The record goes first: the source persists the Workspace again as soon as
-    // it clears the transferring mark below, and a boot must not restore it
-    // twice.
-    if let Ok(dir) = sessions_dir(app) {
-        if let Err(e) = forget_arrival_on_disk(&dir, &arrival.workspace_id) {
-            append_log(format!("[window] could not forget {} on disk: {e}", arrival.workspace_id));
-        }
-    }
     if app.get_webview_window(&arrival.from).is_some() {
+        if let Ok(dir) = sessions_dir(app) {
+            if let Err(e) = return_arrival_on_disk(&dir, arrival) {
+                append_log(format!("[window] could not record hand-back: {e}"));
+            }
+        }
         windows.reassign(&arrival.terminal_ids, &arrival.from, false);
         let _ = app.emit_to(
             arrival.from.as_str(),
@@ -2799,6 +2842,11 @@ fn hand_back_arrival(
         );
         return;
     }
+    if let Ok(dir) = sessions_dir(app) {
+        if let Err(e) = forget_arrival_on_disk(&dir, &arrival.workspace_id) {
+            append_log(format!("[window] could not forget orphaned arrival: {e}"));
+        }
+    }
     // Both ends are gone, so these shells belong to no window and nothing would
     // ever paint them (`routing::owner`).
     for id in &arrival.terminal_ids {
@@ -2812,7 +2860,7 @@ fn hand_back_arrival(
 /// The payload is *queued*, never emitted: an `emit_to` a window that does not
 /// exist yet is lost, so the new webview drains it with `take_arrivals` during
 /// its own boot (docs/specs/standalone.md §Arrival queue).
-#[tauri::command]
+#[tauri::command(async)]
 fn open_workspace_window(
     app: AppHandle,
     window: tauri::Window,
@@ -2859,7 +2907,7 @@ fn open_workspace_window(
         {
             windows.reassign(&arrival.terminal_ids, &arrival.from, false);
             if let Ok(dir) = sessions_dir(&app) {
-                let _ = forget_arrival_on_disk(&dir, &arrival.workspace_id);
+                let _ = return_arrival_on_disk(&dir, &arrival);
             }
         }
         return Err(err);
@@ -2869,7 +2917,7 @@ fn open_workspace_window(
 }
 
 /// Move a Workspace into a window that already exists.
-#[tauri::command]
+#[tauri::command(async)]
 fn transfer_workspace(
     app: AppHandle,
     window: tauri::Window,
@@ -2948,7 +2996,7 @@ fn adopt_ready(
 ///
 /// One Workspace, one message: a source with two Workspaces in flight into the
 /// same window must not lose both because one of them landed.
-#[tauri::command]
+#[tauri::command(async)]
 fn adopt_done(
     app: AppHandle,
     window: tauri::Window,
@@ -2981,7 +3029,7 @@ fn adopt_done(
 }
 
 /// The target refused the arrival — its PTYs never answered, or the mount threw.
-#[tauri::command]
+#[tauri::command(async)]
 fn adopt_failed(
     app: AppHandle,
     window: tauri::Window,
@@ -3082,7 +3130,7 @@ async fn remove_window_session(window: tauri::Window) -> Result<(), String> {
     if let Some(windows) = app.try_state::<WindowState>() {
         windows.begin_closing(window.label());
     }
-    remove_session_from(&sessions_dir(app)?, window.label())
+    close_window_snapshot(&sessions_dir(app)?, window.label())
 }
 
 /// Which window is under the cursor, in that window's own logical client space.
@@ -3227,7 +3275,7 @@ fn window_close_cancel(window: tauri::Window, state: tauri::State<'_, QuitState>
 // nothing to end at all. Rust's half is the same either way; what separates the
 // two is what the webview did first, so the intent lives at the call sites
 // (standalone/src/window-close.ts, standalone/src/workspace-move.ts).
-#[tauri::command]
+#[tauri::command(async)]
 fn close_window(app: AppHandle, window: tauri::Window) {
     finish_window_close(&app, window.label());
 }
@@ -3855,30 +3903,36 @@ pub fn run() {
                 // it out of `webview_windows()`.
                 WindowEvent::Destroyed => {
                     let label = window.label().to_string();
-                    if let Some(state) = app.try_state::<WindowState>() {
-                        // Shells it still owned belong to nobody now, and
-                        // unowned output routes nowhere.
-                        let (lost, orphaned) = state.drop_window(&label);
-                        // The webview is gone, so no save can arrive under this
-                        // label again and the refusal can go with it.
-                        guard(&state.closing).remove(&label);
-                        reap_orphaned_ptys(app, &label, orphaned);
-                        // A Workspace on its way here can never arrive: its
-                        // source still shows it, still holds its Sessions, and
-                        // has released nothing (§Arrival queue).
-                        for arrival in lost {
-                            hand_back_arrival(
-                                app,
-                                &state,
-                                &arrival,
-                                "the target window closed mid-arrival",
-                            );
-                        }
-                        let changed = workspaces::forget_window(&mut guard(&state.registry), &label);
-                        if changed {
-                            broadcast_registry(app, &state);
+                    let cleanup_app = app.clone();
+                    let cleanup_label = label.clone();
+                    tauri::async_runtime::spawn_blocking(move || {
+                        let app = &cleanup_app;
+                        let label = cleanup_label;
+                        if let Some(state) = app.try_state::<WindowState>() {
+                            // Shells it still owned belong to nobody now, and
+                            // unowned output routes nowhere.
+                            let (lost, orphaned) = state.drop_window(&label);
+                            // The webview is gone, so no save can arrive under this
+                            // label again and the refusal can go with it.
+                            guard(&state.closing).remove(&label);
+                            reap_orphaned_ptys(app, &label, orphaned);
+                            // A Workspace on its way here can never arrive: its
+                            // source still shows it, still holds its Sessions, and
+                            // has released nothing (§Arrival queue).
+                            for arrival in lost {
+                                hand_back_arrival(
+                                    app,
+                                    &state,
+                                    &arrival,
+                                    "the target window closed mid-arrival",
+                                );
+                            }
+                            let changed = workspaces::forget_window(&mut guard(&state.registry), &label);
+                            if changed {
+                                broadcast_registry(app, &state);
+                            }
                         }
-                    }
+                    });
                     if let Some(state) = app.try_state::<GeometryState>() {
                         state.forget(&label);
                     }
@@ -4290,6 +4344,39 @@ mod tests {
         assert!(!arrivals_path(dir.path()).exists());
     }
 
+    #[test]
+    fn a_hand_back_is_recovered_in_the_source_before_its_next_flush() {
+        let dir = TempDir::new("arrival-handback");
+        let arrival = arrival_of("workspace-7", "main", "ws-2");
+        record_arrival_on_disk(dir.path(), &arrival).unwrap();
+        super::return_arrival_on_disk(dir.path(), &arrival).unwrap();
+        assert_eq!(read_arrivals_from(dir.path()).unwrap()[0]["to"], "main");
+        restore_arrivals(dir.path()).unwrap();
+        assert_eq!(snapshot_ids(&read_snapshot(dir.path(), "main").unwrap()), vec!["workspace-7"]);
+        assert!(read_session_from(dir.path(), "ws-2").unwrap().is_none());
+    }
+
+    #[test]
+    fn closing_an_adopted_target_never_resurrects_either_copy() {
+        let dir = TempDir::new("arrival-target-close");
+        write_session_to(dir.path(), "main", &snapshot_json(&[("workspace-7", "Stale"), ("workspace-8", "Keep")], "workspace-8")).unwrap();
+        record_arrival_on_disk(dir.path(), &arrival_of("workspace-7", "main", "ws-2")).unwrap();
+        super::mark_arrival_adopted_on_disk(dir.path(), "workspace-7").unwrap();
+        super::close_window_snapshot(dir.path(), "ws-2").unwrap();
+        restore_arrivals(dir.path()).unwrap();
+        assert!(read_session_from(dir.path(), "ws-2").unwrap().is_none());
+        assert_eq!(snapshot_ids(&read_snapshot(dir.path(), "main").unwrap()), vec!["workspace-8"]);
+        assert!(!arrivals_path(dir.path()).exists());
+    }
+
+    #[test]
+    fn journal_commands_run_off_the_main_thread() {
+        let source = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap();
+        for command in ["transfer_workspace", "open_workspace_window", "adopt_done", "adopt_failed", "close_window"] {
+            assert!(source.contains(&format!("#[tauri::command(async)]\nfn {command}(")), "{command} must run off the UI thread");
+        }
+    }
+
     #[test]
     fn a_settled_recovery_preserves_the_targets_newer_snapshot() {
         let dir = TempDir::new("arrival-newer-target");

From 1e22d857c9e70fb8c23c3826a39b8a6fe0a1e4f7 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 19:08:43 -0700
Subject: [PATCH 6/8] Normalize Windows line endings in journal dispatch
 regression

---
 standalone/src-tauri/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 5f7517421..69b281e69 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -4371,7 +4371,7 @@ mod tests {
 
     #[test]
     fn journal_commands_run_off_the_main_thread() {
-        let source = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap();
+        let source = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap().replace("\r\n", "\n");
         for command in ["transfer_workspace", "open_workspace_window", "adopt_done", "adopt_failed", "close_window"] {
             assert!(source.contains(&format!("#[tauri::command(async)]\nfn {command}(")), "{command} must run off the UI thread");
         }

From 8d09f10879124661f015809a8218144e245b8438 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 19:31:31 -0700
Subject: [PATCH 7/8] Hold approved exit until destroyed-window handbacks
 finish

---
 docs/specs/standalone.md        |  22 ++++---
 scripts/spec-word-budgets.json  |   2 +-
 standalone/src-tauri/src/lib.rs | 106 ++++++++++++++++++++++----------
 3 files changed, 87 insertions(+), 43 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 2bef4e503..0427c8980 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -450,16 +450,18 @@ by `the_geometry_flush_slot_is_released_with_the_drain`.
 
 ### What a window's `Destroyed` settles
 
-**Everything keyed by a label is settled in the `Destroyed` arm, and only
-there**: Tauri takes the label out of `webview_windows()` at that moment and not
-before, so a `burrow:windows` push sent ahead of it names a window that can never
-answer — and every ask then waits out its whole budget. The arm forgets the
-window's PTY ownership and reaps what it still owned, hands back every arrival it
-will never take (§Arrival queue), drops the save refusal (nothing can save under
-a dead label), forgets its geometry, tells the quit machine (§Quit flow) and
-pushes the live labels to the sidecar. **An arriving Workspace's shells are taken
-out of the reap first**: they belong to its source again, which is still showing
-those terminals.
+**Must clear label-keyed ownership, registry, geometry, and close state in the
+`Destroyed` arm**, when Tauri has removed the window from `webview_windows()`.
+**Must remove incoming arrivals from the reap before killing orphaned PTYs**;
+the source still holds those Sessions. Hand-backs run in a blocking worker,
+then complete on the main thread. **Must defer every approved exit until all
+such workers have completed**, including exit requested through the quit walk
+or Tauri (`quit_waits_for_every_destroyed_window_handback`). The arm updates the
+quit machine and sends the remaining live labels to the sidecar; the Burrow’s
+ask collector must never wait for a window that cannot answer.
+
+Source of truth: `CleanupGate` and `WindowEvent::Destroyed` in
+`standalone/src-tauri/src/lib.rs`.
 
 ### Per-window close
 
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 5b0f31827..5c395b0ff 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 9600,
+  "docs/specs/standalone.md": 9550,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 69b281e69..4722e0345 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -502,6 +502,31 @@ fn send_window_labels(app: &AppHandle) {
 struct QuitState {
     machine: Mutex<QuitMachine>,
     close: Mutex<CloseMachine>,
+    cleanup: Mutex<CleanupGate>,
+}
+
+/// An approved quit waits for destroyed windows to journal their hand-backs.
+#[derive(Default)]
+struct CleanupGate {
+    pending: usize,
+    exit_requested: bool,
+}
+
+impl CleanupGate {
+    fn begin(&mut self) { self.pending += 1; }
+    fn request_exit(&mut self) -> bool {
+        if self.pending == 0 { return true; }
+        self.exit_requested = true;
+        false
+    }
+    fn finish(&mut self) -> bool {
+        self.pending -= 1;
+        self.pending == 0 && std::mem::take(&mut self.exit_requested)
+    }
+}
+
+fn exit_after_cleanup(app: &AppHandle) -> bool {
+    app.try_state::<QuitState>().is_none_or(|state| guard(&state.cleanup).request_exit())
 }
 
 // Phase 1: no ack within this window ⇒ a webview listener is dead — exit.
@@ -568,6 +593,7 @@ fn apply_quit_actions(app: &AppHandle, actions: Vec<QuitAction>) {
                 }
             }
             QuitAction::Exit => {
+                if !exit_after_cleanup(app) { continue; }
                 if let Some(state) = app.try_state::<QuitState>() {
                     guard(&state.machine).approved = true;
                 }
@@ -3898,41 +3924,41 @@ pub fn run() {
                         request_quit(app);
                     }
                 }
-                // The window is gone. Everything keyed by its label is settled
-                // here, and only here: this is the first moment Tauri has taken
-                // it out of `webview_windows()`.
+                // The window is gone: clear its label-keyed state here, after
+                // Tauri removes it from `webview_windows()`. Journal hand-backs
+                // run off-thread behind the approved-exit gate.
                 WindowEvent::Destroyed => {
                     let label = window.label().to_string();
-                    let cleanup_app = app.clone();
-                    let cleanup_label = label.clone();
-                    tauri::async_runtime::spawn_blocking(move || {
-                        let app = &cleanup_app;
-                        let label = cleanup_label;
-                        if let Some(state) = app.try_state::<WindowState>() {
-                            // Shells it still owned belong to nobody now, and
-                            // unowned output routes nowhere.
-                            let (lost, orphaned) = state.drop_window(&label);
-                            // The webview is gone, so no save can arrive under this
-                            // label again and the refusal can go with it.
-                            guard(&state.closing).remove(&label);
-                            reap_orphaned_ptys(app, &label, orphaned);
-                            // A Workspace on its way here can never arrive: its
-                            // source still shows it, still holds its Sessions, and
-                            // has released nothing (§Arrival queue).
-                            for arrival in lost {
-                                hand_back_arrival(
-                                    app,
-                                    &state,
-                                    &arrival,
-                                    "the target window closed mid-arrival",
-                                );
-                            }
-                            let changed = workspaces::forget_window(&mut guard(&state.registry), &label);
-                            if changed {
-                                broadcast_registry(app, &state);
-                            }
+                    let lost = if let Some(state) = app.try_state::<WindowState>() {
+                        // Drop label-keyed ownership synchronously; only the
+                        // returned arrivals need the blocking journal worker.
+                        let (lost, orphaned) = state.drop_window(&label);
+                        guard(&state.closing).remove(&label);
+                        reap_orphaned_ptys(app, &label, orphaned);
+                        let changed = workspaces::forget_window(&mut guard(&state.registry), &label);
+                        if changed { broadcast_registry(app, &state); }
+                        lost
+                    } else { Vec::new() };
+                    if !lost.is_empty() {
+                        if let Some(state) = app.try_state::<QuitState>() {
+                            guard(&state.cleanup).begin();
                         }
-                    });
+                        let cleanup_app = app.clone();
+                        tauri::async_runtime::spawn_blocking(move || {
+                            if let Some(state) = cleanup_app.try_state::<WindowState>() {
+                                for arrival in lost {
+                                    hand_back_arrival(&cleanup_app, &state, &arrival,
+                                        "the target window closed mid-arrival");
+                                }
+                            }
+                            let finish_app = cleanup_app.clone();
+                            let _ = cleanup_app.run_on_main_thread(move || {
+                                let exit = finish_app.try_state::<QuitState>()
+                                    .is_some_and(|state| guard(&state.cleanup).finish());
+                                if exit { apply_quit_actions(&finish_app, vec![QuitAction::Exit]); }
+                            });
+                        });
+                    }
                     if let Some(state) = app.try_state::<GeometryState>() {
                         state.forget(&label);
                     }
@@ -4123,6 +4149,8 @@ pub fn run() {
                 if !quit_approved(app) {
                     api.prevent_exit();
                     request_quit(app);
+                } else if !exit_after_cleanup(app) {
+                    api.prevent_exit();
                 }
             }
             // Harmless after teardown: the PTY map is already empty, so the
@@ -4369,6 +4397,20 @@ mod tests {
         assert!(!arrivals_path(dir.path()).exists());
     }
 
+    #[test]
+    fn quit_waits_for_every_destroyed_window_handback() {
+        let mut gate = super::CleanupGate::default();
+        gate.begin();
+        gate.begin();
+        assert!(!gate.request_exit());
+        assert!(!gate.finish());
+        assert!(!gate.request_exit());
+        assert!(gate.finish());
+        assert!(gate.request_exit());
+        gate.begin();
+        assert!(!gate.finish()); // ordinary close does not request a quit
+    }
+
     #[test]
     fn journal_commands_run_off_the_main_thread() {
         let source = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap().replace("\r\n", "\n");

From 6b4e11c41e2ead6dbed761b8996a698c4b344334 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 19:50:24 -0700
Subject: [PATCH 8/8] Bound handback cleanup waits and gate AppKit termination

---
 docs/specs/standalone.md                    | 17 ++++--
 scripts/spec-word-budgets.json              |  2 +-
 standalone/src-tauri/src/lib.rs             | 63 +++++++++++++++++++--
 standalone/src-tauri/src/macos_terminate.rs | 10 +++-
 4 files changed, 79 insertions(+), 13 deletions(-)

diff --git a/docs/specs/standalone.md b/docs/specs/standalone.md
index 0427c8980..dcd1f2dd3 100644
--- a/docs/specs/standalone.md
+++ b/docs/specs/standalone.md
@@ -453,10 +453,14 @@ by `the_geometry_flush_slot_is_released_with_the_drain`.
 **Must clear label-keyed ownership, registry, geometry, and close state in the
 `Destroyed` arm**, when Tauri has removed the window from `webview_windows()`.
 **Must remove incoming arrivals from the reap before killing orphaned PTYs**;
-the source still holds those Sessions. Hand-backs run in a blocking worker,
-then complete on the main thread. **Must defer every approved exit until all
+the source still holds those Sessions. Hand-backs run in a blocking worker that
+reports completion on the main thread. **Must defer every approved exit until all
 such workers have completed**, including exit requested through the quit walk
-or Tauri (`quit_waits_for_every_destroyed_window_handback`). The arm updates the
+or Tauri/AppKit (`every_approved_exit_path_checks_cleanup`;
+`quit_waits_for_every_destroyed_window_handback` pins the counter). **Must force an
+approved exit after `QUIT_PHASE_TIMEOUT_MS` waiting for cleanup**, logging the
+timeout; a stalled disk operation or completion callback cannot trap the app
+(`stalled_cleanup_cannot_block_an_approved_exit_forever`). The arm updates the
 quit machine and sends the remaining live labels to the sidecar; the Burrow’s
 ask collector must never wait for a window that cannot answer.
 
@@ -911,9 +915,9 @@ Every trigger funnels into `request_quit(app)`:
 | Arm | Fired by | Guard |
 |---|---|---|
 | `WindowEvent::CloseRequested` | the window close button | `api.prevent_close()` unless the quit is approved. Refused outright while the walk is running: a window taken out from under its own teardown leaves the walk emitting to a dead label. Only the **last** window's close is a quit; every other one is a per-window close (§Windows) |
-| `RunEvent::ExitRequested` | a window-level exit request | `api.prevent_exit()` unless approved. The event's `code` is ignored: the `approved` gate alone is what lets the flow's own terminating `app.exit(0)` through without re-catching it |
+| `RunEvent::ExitRequested` | a window-level exit request | `api.prevent_exit()` unless approved and cleared by the bounded cleanup gate (§What a window's `Destroyed` settles). The event's `code` is ignored |
 | the app menu's Quit item | the menu, and its `Cmd+Q` accelerator | a **custom** `MenuItem`, never `PredefinedMenuItem::quit`, whose event calls `request_quit`; muda wires the predefined one straight to AppKit's `terminate:` (macOS; rationale) |
-| `applicationShouldTerminate:` | the Dock's Quit, `osascript`, logout, restart | spliced onto tao's live delegate class at `Ready`, answering `NSTerminateCancel` and starting the flow, then `NSTerminateNow` once the flow's own `app.exit(0)` comes back through it (macOS; rationale) |
+| `applicationShouldTerminate:` | the Dock's Quit, `osascript`, logout, restart | spliced onto tao's live delegate class at `Ready`, answering `NSTerminateCancel` and starting the flow, then `NSTerminateNow` once approved and cleared by the bounded cleanup gate (§What a window's `Destroyed` settles; macOS; rationale) |
 
 Source of truth: `standalone/src-tauri/src/macos_terminate.rs`.
 
@@ -955,6 +959,9 @@ wedged webview, in three phases:
 | 2 — voting | acked, no window walking yet | **none** — a window may be parked on its confirmation dialog waiting on a human, who must never be force-quit out from under it. Only `quit_proceed` (`approved`) or `quit_cancel`/repeat-trigger (`seq` bump) ends the wait |
 | 3 — walking | one window tearing down | **per phase**, ~14 s, refreshed by its `quit_progress` bumps *and* by the walk advancing to the next window, so each phase and each window gets its own budget; no progress for the budget ⇒ log and exit |
 
+Approved exits from these watchdogs also pass the bounded cleanup gate
+(§What a window’s `Destroyed` settles).
+
 Phase 3's budget comfortably exceeds the webview's own teardown ceiling. Each
 watchdog captures the `seq` it was spawned for, so a **repeated quit trigger** —
 which bumps `seq`, spawns a fresh watchdog and re-emits — leaves the stale one to
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index 2c7f7747a..c11a2bdc5 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -24,7 +24,7 @@
   "docs/specs/security-supply-chain.md": 1150,
   "docs/specs/security.md": 1900,
   "docs/specs/shortcuts.md": 1050,
-  "docs/specs/standalone.md": 9550,
+  "docs/specs/standalone.md": 9600,
   "docs/specs/terminal-context.md": 900,
   "docs/specs/terminal-escapes.md": 3750,
   "docs/specs/terminal-state.md": 2350,
diff --git a/standalone/src-tauri/src/lib.rs b/standalone/src-tauri/src/lib.rs
index 4722e0345..1ab85d670 100644
--- a/standalone/src-tauri/src/lib.rs
+++ b/standalone/src-tauri/src/lib.rs
@@ -510,15 +510,21 @@ struct QuitState {
 struct CleanupGate {
     pending: usize,
     exit_requested: bool,
+    forced: bool,
 }
 
 impl CleanupGate {
     fn begin(&mut self) { self.pending += 1; }
     fn request_exit(&mut self) -> bool {
-        if self.pending == 0 { return true; }
+        if self.pending == 0 || self.forced { return true; }
         self.exit_requested = true;
         false
     }
+    fn force_if_waiting(&mut self) -> bool {
+        if self.pending == 0 || !self.exit_requested { return false; }
+        self.forced = true;
+        true
+    }
     fn finish(&mut self) -> bool {
         self.pending -= 1;
         self.pending == 0 && std::mem::take(&mut self.exit_requested)
@@ -526,7 +532,29 @@ impl CleanupGate {
 }
 
 fn exit_after_cleanup(app: &AppHandle) -> bool {
-    app.try_state::<QuitState>().is_none_or(|state| guard(&state.cleanup).request_exit())
+    let Some(state) = app.try_state::<QuitState>() else { return true; };
+    let (exit, start_watchdog) = {
+        let mut gate = guard(&state.cleanup);
+        let was_waiting = gate.exit_requested;
+        let exit = gate.request_exit();
+        (exit, !exit && !was_waiting)
+    };
+    if start_watchdog {
+        let app = app.clone();
+        tauri::async_runtime::spawn_blocking(move || {
+            std::thread::sleep(Duration::from_millis(QUIT_PHASE_TIMEOUT_MS));
+            let force = app.try_state::<QuitState>()
+                .is_some_and(|state| guard(&state.cleanup).force_if_waiting());
+            if force {
+                append_log("[quit] hand-back cleanup timed out; forcing exit");
+                if let Some(state) = app.try_state::<QuitState>() {
+                    guard(&state.machine).approved = true;
+                }
+                app.exit(0);
+            }
+        });
+    }
+    exit
 }
 
 // Phase 1: no ack within this window ⇒ a webview listener is dead — exit.
@@ -3952,11 +3980,13 @@ pub fn run() {
                                 }
                             }
                             let finish_app = cleanup_app.clone();
-                            let _ = cleanup_app.run_on_main_thread(move || {
+                            if let Err(err) = cleanup_app.run_on_main_thread(move || {
                                 let exit = finish_app.try_state::<QuitState>()
                                     .is_some_and(|state| guard(&state.cleanup).finish());
                                 if exit { apply_quit_actions(&finish_app, vec![QuitAction::Exit]); }
-                            });
+                            }) {
+                                append_log(format!("[quit] could not complete hand-back cleanup: {err}"));
+                            }
                         });
                     }
                     if let Some(state) = app.try_state::<GeometryState>() {
@@ -4397,6 +4427,31 @@ mod tests {
         assert!(!arrivals_path(dir.path()).exists());
     }
 
+    #[test]
+    fn every_approved_exit_path_checks_cleanup() {
+        let source = include_str!("lib.rs").split("#[cfg(test)]").next().unwrap();
+        let action = source.split("QuitAction::Exit => {").nth(1).unwrap().split("app.exit(0)").next().unwrap();
+        assert!(action.contains("exit_after_cleanup(app)"));
+        let event = source.split("RunEvent::ExitRequested { api, .. } => {").nth(1).unwrap().split("RunEvent::Exit =>").next().unwrap();
+        assert!(event.contains("exit_after_cleanup(app)"));
+        let macos = include_str!("macos_terminate.rs");
+        let delegate = macos.split("if quit_approved(app) {").nth(1).unwrap().split("append_log(").next().unwrap();
+        assert!(delegate.contains("exit_after_cleanup(app)"));
+        assert!(delegate.contains("TerminateCancel"));
+    }
+
+    #[test]
+    fn stalled_cleanup_cannot_block_an_approved_exit_forever() {
+        let mut gate = super::CleanupGate::default();
+        gate.begin();
+        assert!(!gate.force_if_waiting()); // no quit requested yet
+        assert!(!gate.request_exit());
+        assert!(gate.force_if_waiting()); // cleanup watchdog expired
+        assert!(gate.request_exit());
+        assert!(gate.finish()); // late completion remains safe
+        assert!(!gate.force_if_waiting());
+    }
+
     #[test]
     fn quit_waits_for_every_destroyed_window_handback() {
         let mut gate = super::CleanupGate::default();
diff --git a/standalone/src-tauri/src/macos_terminate.rs b/standalone/src-tauri/src/macos_terminate.rs
index edff7c665..a5b952bab 100644
--- a/standalone/src-tauri/src/macos_terminate.rs
+++ b/standalone/src-tauri/src/macos_terminate.rs
@@ -18,7 +18,7 @@ use objc2_app_kit::{NSApplication, NSApplicationTerminateReply};
 use std::sync::OnceLock;
 use tauri::AppHandle;
 
-use crate::{append_log, quit_approved, request_quit};
+use crate::{append_log, exit_after_cleanup, quit_approved, request_quit};
 
 /// The handle the spliced method answers on behalf of. Set once, at `Ready`.
 static APP: OnceLock<AppHandle> = OnceLock::new();
@@ -33,7 +33,7 @@ const SHOULD_TERMINATE_TYPES: &[u8] = b"L@:@\0";
 ///
 /// Answers `Cancel` and starts the flow the first time; the flow's own
 /// `app.exit(0)` comes back through here with the quit already approved, and
-/// that pass answers `Now`. Panic-free by construction: the release profile
+/// that pass answers `Now` once the bounded hand-back cleanup gate permits it. Panic-free by construction: the release profile
 /// aborts on unwind, and this runs inside AppKit's stack.
 unsafe extern "C-unwind" fn should_terminate(
     _this: *mut AnyObject,
@@ -45,7 +45,11 @@ unsafe extern "C-unwind" fn should_terminate(
         return NSApplicationTerminateReply::TerminateNow;
     };
     if quit_approved(app) {
-        return NSApplicationTerminateReply::TerminateNow;
+        return if exit_after_cleanup(app) {
+            NSApplicationTerminateReply::TerminateNow
+        } else {
+            NSApplicationTerminateReply::TerminateCancel
+        };
     }
     append_log("[quit] intercepted an AppKit terminate (Dock, logout, or script)");
     request_quit(app);