From 162e3100b347550e798de50e3e672d3328755699 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 14:37:37 -0700
Subject: [PATCH 1/3] Add dor workspace move, dor list --window, and the iframe
 move gate

`dor workspace move <ref> --window <label|new> --index <n>` runs the same
transfer the strip's drag does, through a platform hook the Tauri adapter
fills; `--index` alone reorders, and a host with one window reorders only.
`dor list --window <label>` lists a sibling window, routed there by Rust.

A move between windows cannot carry a plain iframe's document: it reopens at
its saved URL. The Wall handle now names its iframe Surfaces, Doored ones
included; the drag release raises the kill's typed-letter confirmation when
there are any, and the CLI refuses unless
--dangerously-destroy-iframe-page-state is passed, naming them. Agent-browser
Surfaces reconnect and are not gated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PkPyEFCxiPo5UFeju5Ya9u
---
 docs/specs/dor-cli.md                         | 13 +++--
 docs/specs/layout.md                          |  7 ++-
 docs/specs/layout.rationale.md                |  2 +
 dor/src/commands/list.ts                      | 17 ++++--
 dor/src/commands/types.ts                     | 16 +++++-
 dor/src/commands/workspace.ts                 | 41 +++++++++++++-
 dor/src/control-client.ts                     | 11 ++++
 dor/src/protocol.ts                           |  1 +
 dor/test/snapshots/help/dor.md                |  6 +-
 dor/test/snapshots/help/list.md               |  7 ++-
 dor/test/snapshots/help/workspace.md          | 15 +++--
 .../snapshots/workspace-missing-action.snap   |  2 +-
 .../snapshots/workspace-unknown-action.snap   |  2 +-
 lib/src/components/KillConfirm.tsx            |  9 ++-
 lib/src/components/Wall.tsx                   | 11 ++++
 lib/src/components/WorkspaceStrip.tsx         | 33 +++++++++--
 lib/src/components/wall/wall-handles.ts       |  6 ++
 .../components/wall/workspace-control.test.ts | 46 ++++++++++++++++
 lib/src/components/wall/workspace-control.ts  | 55 +++++++++++++++++++
 lib/src/lib/platform/types.ts                 |  5 ++
 lib/src/lib/workspace-ui-store.ts             | 11 +++-
 scripts/spec-word-budgets.json                |  2 +-
 standalone/src/tauri-adapter.ts               | 12 ++++
 standalone/src/workspace-drag.test.ts         | 31 +++++++++++
 standalone/src/workspace-drag.ts              | 16 +++++-
 standalone/src/workspace-move.ts              | 30 +++++-----
 26 files changed, 357 insertions(+), 50 deletions(-)

diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index 5bda51fa4..dcb6e177c 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -144,7 +144,8 @@ bridge → `TauriAdapter` `CustomEvent("dormouse:control-request")` → Wall
 handler, and back along the same hops.
 
 **A request naming a Workspace or a Window is routed to the window holding
-it**, whichever window the caller sits in; one naming neither goes to the
+it** (`--workspace`, or `dor list --window <label>`), whichever window the
+caller sits in; one naming neither goes to the
 window that owns its `DORMOUSE_SURFACE_ID`, and one naming no Surface to the
 focused window. A target the registry cannot place — an unknown ref, or a name
 two windows use — reaches the caller's own window, which refuses it by name.
@@ -455,6 +456,7 @@ Wall (Handle Model), and each takes a `workspace:<n|name>` target except `new`:
 | `rename <ref> <name>` | Renames the Workspace only — no Surface title (`docs/specs/layout.md` → "Workspaces"). |
 | `close <ref> [--force]` | **Refuses, raising no confirmation, when the Workspace holds a touched or running Surface** unless `--force` — the caller is a command, not someone watching the Wall, exactly as `dor kill` archives silently. The last Workspace, a Workspace whose close meets another already in flight, and one whose Wall never registers (`still mounting`, after the routing retry — closing past it would leave its Sessions running with nothing holding them) refuse too. Member Surfaces close through the closure coordinator, and a refusal leaves the Workspace open and the user where they were (`docs/specs/notepad.md` → "Closure"). |
 | `switch <ref>` | Activates it. |
+| `move <ref> [--window <label\|new>] [--index <n>] [--dangerously-destroy-iframe-page-state]` | To another Window (`new` tears out), a strip position, or both; the Window handling it runs the same transfer the strip's drag does (`docs/specs/standalone.md` → Transfer), with no pointer to place the tab by. **Refuses a move between Windows while the Workspace holds a plain iframe Surface unless the flag is passed**, naming them: the page state is lost (`docs/specs/layout.md` → Workspaces). A host with one Window reorders only. |
 
 **Each verb ships as one action of one command**, not a route map: the published
 CLI reference renders one help page per top-level command
@@ -653,11 +655,10 @@ Source of truth: `buildDorSurfacesInternal` in `lib/src/components/Wall.tsx`; `d
   npm) distributes the bootstrap stub, never a copy of the content. A user-level
   `--global` install variant waits until a story needs it.
 
-- **Cross-Window listing and moves.** `--workspace` and `--window` already reach
-  a sibling Window's Workspace ([Standalone](#standalone)); `dor list --all`
-  still lists the answering Window alone, and no verb moves a Workspace between
-  Windows or reorders the strip. Both read the registry
-  (`docs/specs/standalone.md` → "Workspace registry").
+- **Cross-Window `--all`.** `dor list --window <label>` lists one other Window
+  and `--workspace` reaches a sibling's Workspace ([Standalone](#standalone)),
+  but `dor list --all` still lists the answering Window alone; a union would
+  read the registry (`docs/specs/standalone.md` → "Workspace registry").
 - **Cross-Workspace listing in VS Code.** Each Workspace is its own webview
   there, so `dor list --all` would have to aggregate at the extension host
   rather than in a per-webview control handler; until it does, VS Code refuses
diff --git a/docs/specs/layout.md b/docs/specs/layout.md
index c891103cb..10ed1e170 100644
--- a/docs/specs/layout.md
+++ b/docs/specs/layout.md
@@ -158,6 +158,11 @@ its own window, or dropped onto an existing one — carrying its Surfaces, its
 Sessions and its notes with it, and killing nothing on the way
 (`docs/specs/standalone.md` → Transfer). Leaving is not a close and arriving is
 not a create: a Workspace that arrives mounts from the record it brought.
+**Must confirm before a move that would destroy an iframe's page state**: a
+plain iframe Surface's document cannot leave its webview, so it reopens at its
+saved URL, and a Workspace holding one — Doored ones included — asks with the
+kill's typed letter before it leaves; agent-browser Surfaces reconnect and ask
+nothing (`iframeSurfaceIds` on the Wall handle; `workspace-drag.test.ts`).
 
 **Create** adds a Workspace named `Workspace N`, makes it active, and gives its Wall no restored record, so Lath's fresh branch spawns one default-shell pane. **Close** confirms first when the Workspace holds touched Surfaces or running work, reusing the kill-confirm letter and key rule over the Window's content area, then routes every member Surface through the closure coordinator; **the last remaining Workspace cannot be closed** — there is always one active Workspace, as there is always one visible pane (corner case #5). **One close runs at a time for the whole Window**, with the count re-checked after the confirmation, so two of them cannot empty two Walls between them; **a close the store then refuses hands the Wall back its auto-spawn** rather than leaving it mounted and empty. **Rename** edits the Workspace `name` only — no Surface title, and not the per-pane inline rename. **Reorder** moves a tab in the strip and renumbers the positional `workspace:<n>` refs with it. **Every Workspace verb runs outside the strip**, which renders the rename editor and confirmation from a store, so a tab gesture and a command-mode key take one path.
 
@@ -165,7 +170,7 @@ The union projection and its indicators are owned by `docs/specs/alert.md` → W
 
 Source of truth: `WorkspaceWindow` in `lib/src/components/WorkspaceWindow.tsx`; `registerWallHandle` in `lib/src/components/wall/wall-handles.ts`; `closeAll` in `lib/src/components/Wall.tsx`; `requestWorkspaceClose` in `lib/src/components/wall/workspace-lifecycle.ts`; `createWorkspace` / `closeWorkspace` / `renameWorkspace` / `moveWorkspace` / `setActiveWorkspace` in `lib/src/lib/workspace-store.ts`; `getWorkspaceUiSnapshot` in `lib/src/lib/workspace-ui-store.ts`; `setWorkspaceSurfaces` in `lib/src/lib/workspace-surfaces.ts`.
 
-**Create, rename, close, and switch have `dor` counterparts** (`docs/specs/dor-cli.md` → "dor workspace"); reorder, transfer, and tear-out are drag-only until `docs/specs/dor-cli.md` → Future "Cross-Window targeting" lands. Each takes the same route as the strip and the command-mode keys: a command close raises no confirmation, refusing instead, and closes its member Surfaces silently.
+**Every Workspace verb has a `dor` counterpart** (`docs/specs/dor-cli.md` → "dor workspace"), taking the same route as the strip and the command-mode keys: a command close raises no confirmation, refusing instead, and closes its member Surfaces silently.
 
 ## Modes
 
diff --git a/docs/specs/layout.rationale.md b/docs/specs/layout.rationale.md
index f7c0d1461..33e9b15da 100644
--- a/docs/specs/layout.rationale.md
+++ b/docs/specs/layout.rationale.md
@@ -20,6 +20,8 @@ xterm.js paints only its own rendered surface, and integer row fitting leaves a
 
 **Why a hidden Workspace's terminals are detached rather than merely hidden.** xterm pauses rendering only when its screen element stops intersecting (`RenderService` in `@xterm/xterm`), and a `visibility: hidden` box still intersects, so a hidden pane kept rasterizing every output frame and holding a GL context. Reusing the minimize primitives pauses it and releases the context; the box stays laid out, so the reattach fit finds the same grid and sends no PTY resize (2026-09).
 
+**Why a move confirms for iframes but not for agent-browser Surfaces.** An agent-browser Surface's session lives in the host process; the target window reconnects its viewer and the page is as it was. A plain iframe is a document inside the source webview, and no API carries a document between webviews — the alternative, keeping every Workspace in its own native child webview and reparenting it, was prototyped on a vendored Tauri fork and rejected for the fork (2026-09). The confirmation is the kill's typed letter rather than a button because what is lost is as gone as a killed process, and the same gesture already means that.
+
 **Why `inert` is only defense in depth.** `visibility: hidden` already removes focusability, so the attribute exists for a future presentation that keeps the subtree visible.
 
 **Why the strip's reorder drag does not capture the pointer on press.** A captured pointer retargets the following `click` to the capture element, so capturing on `pointerdown` swallowed the activate button's click and no tab could be activated by mouse (found in the browser-dev harness, 2026-09). Capture is only useful once the gesture is a drag, which is where it now happens.
diff --git a/dor/src/commands/list.ts b/dor/src/commands/list.ts
index 726ad8b5e..07b78229a 100644
--- a/dor/src/commands/list.ts
+++ b/dor/src/commands/list.ts
@@ -51,6 +51,7 @@ interface ListFlags extends WorkspaceScopedFlags {
   readonly ports?: boolean;
   readonly view?: SurfaceView;
   readonly workspaces?: boolean;
+  readonly window?: string;
 }
 
 const FULL_DESCRIPTION = `Lists every Surface in the current Workspace — terminals and browser Surfaces, including minimized ones (view "minimized").
@@ -65,7 +66,7 @@ Filters are ANDed. --command is an exact match against the running command repor
 
 JSON output (--json) always includes both stable ids and refs, and each row carries has_terminal (a PTY) and has_browser (a browser renderer) — gate on those, not on kind, so a Surface that has both still matches. It adds top-level caller_surface_ref/caller_surface_id and focused_surface_ref/focused_surface_id — the calling and focused Surfaces, null when neither is in the list — plus workspace_ref, window_ref, and a host block (app, workspace, cli_js_path, node_path): the identity dump dor identify used to print.
 
---workspace <ref> lists another Workspace instead, in this window or another: workspace:<n> (a stable number) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build").
+--workspace <ref> lists another Workspace instead, in this window or another: workspace:<n> (a stable number) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build"). --window <label> lists another window's Surfaces or Workspaces (window:main, ws-2).
 
 --all lists every Workspace of this Window, grouped under a Workspace header — every Workspace keeps its header, including one holding nothing and one the filters emptied. Rows keep their own Workspace-scoped surface:N refs, so several groups have a surface:1, but only the active Workspace's selection carries the focus marker; each JSON row adds workspace_ref, and the payload adds a workspaces array. Target a row from another Workspace by its stable id, or pass --workspace.
 
@@ -149,14 +150,21 @@ function buildListCommand(): Command['command'] {
       optional: true,
       withNegated: false,
     },
+    window: {
+      kind: 'parsed',
+      parse: stringParser,
+      brief: "Another window to list, by its label (window:main, ws-2).",
+      optional: true,
+      placeholder: 'label',
+    },
   };
 
   return buildCommand<ListFlags, [], DorCommandContext>({
     docs: {
       brief: 'List Dormouse Surfaces.',
       customUsage: [
-        '[--workspace ref|--all] [--kind terminal|browser] [--view paned|zoomed|minimized] [--command text] [--cwd path] [--port number] [--ports] [--json] [--id-format refs|ids|both]',
-        '--workspaces [--json]',
+        '[--workspace ref|--all] [--window label] [--kind terminal|browser] [--view paned|zoomed|minimized] [--command text] [--cwd path] [--port number] [--ports] [--json] [--id-format refs|ids|both]',
+        '--workspaces [--window label] [--json]',
       ],
       fullDescription: FULL_DESCRIPTION,
     },
@@ -179,7 +187,7 @@ async function runListCommand(
 
   try {
     if (flags.workspaces === true) {
-      const overview = await client.listWorkspaces({});
+      const overview = await client.listWorkspaces(flags.window === undefined ? {} : { window: flags.window });
       writeStdout(context, flags.json === true
         ? renderWorkspacesJson(overview)
         : renderWorkspacesText(overview));
@@ -190,6 +198,7 @@ async function runListCommand(
       includePorts,
       ...(flags.all === true ? { scope: 'all' as const } : {}),
       ...workspaceParam(flags.workspace),
+      ...(flags.window === undefined ? {} : { window: flags.window }),
     });
     const env = context.options.env ?? {};
     const filtered = applyListFilters(response, flags, env);
diff --git a/dor/src/commands/types.ts b/dor/src/commands/types.ts
index 33fcd2a75..f526d788f 100644
--- a/dor/src/commands/types.ts
+++ b/dor/src/commands/types.ts
@@ -178,11 +178,24 @@ export interface SwitchWorkspaceRequest {
   window?: string;
 }
 
+/** Move a Workspace: to another Window (`toWindow`, a label or `new` for a
+ *  torn-out one), to a strip position (`index`, 0-based), or both. */
+export interface MoveWorkspaceRequest {
+  workspace: string;
+  toWindow?: string;
+  index?: number;
+  /** A move between Windows destroys every plain iframe's page state (the
+   *  document cannot leave its webview); the host refuses such a move unless
+   *  the caller passed this. */
+  dangerouslyDestroyIframePageState: boolean;
+  window?: string;
+}
+
 /** The answer every mutating Workspace verb gives: what it did, and the
  *  Workspace it did it to. `workspaceRef` is positional, so for `close` it is
  *  the ref the Workspace had. */
 export interface WorkspaceMutationResponse {
-  status: 'created' | 'renamed' | 'closed' | 'active';
+  status: 'created' | 'renamed' | 'closed' | 'active' | 'moved';
   workspaceId: string;
   workspaceRef: string;
   name: string;
@@ -397,6 +410,7 @@ export interface ControlClient {
   renameWorkspace(request: RenameWorkspaceRequest): Promise<WorkspaceMutationResponse>;
   closeWorkspace(request: CloseWorkspaceRequest): Promise<WorkspaceMutationResponse>;
   switchWorkspace(request: SwitchWorkspaceRequest): Promise<WorkspaceMutationResponse>;
+  moveWorkspace(request: MoveWorkspaceRequest): Promise<WorkspaceMutationResponse>;
 }
 
 export interface AgentBrowserExecResult {
diff --git a/dor/src/commands/workspace.ts b/dor/src/commands/workspace.ts
index 9f0dcc12c..a3992c32f 100644
--- a/dor/src/commands/workspace.ts
+++ b/dor/src/commands/workspace.ts
@@ -28,6 +28,9 @@ import {
 interface WorkspaceFlags {
   readonly force?: boolean;
   readonly json?: boolean;
+  readonly window?: string;
+  readonly index?: number;
+  readonly dangerouslyDestroyIframePageState?: boolean;
 }
 
 /** One action of `dor workspace`: how it is spelled in help, what argument
@@ -66,6 +69,17 @@ const ACTIONS = {
     arityError: 'dor workspace switch takes one workspace',
     run: (client, args) => client.switchWorkspace({ workspace: args[0] }),
   },
+  move: {
+    usage: '<workspace> [--window <label|new>] [--index <n>] [--dangerously-destroy-iframe-page-state] [--json]',
+    accepts: (args) => args.length === 1,
+    arityError: 'dor workspace move takes one workspace',
+    run: (client, args, flags) => client.moveWorkspace({
+      workspace: args[0],
+      ...(flags.window === undefined ? {} : { toWindow: flags.window }),
+      ...(flags.index === undefined ? {} : { index: flags.index }),
+      dangerouslyDestroyIframePageState: flags.dangerouslyDestroyIframePageState === true,
+    }),
+  },
 } as const satisfies Record<string, WorkspaceActionSpec>;
 
 type WorkspaceAction = keyof typeof ACTIONS;
@@ -81,14 +95,14 @@ export const workspaceCommand: Command = {
       // actions collapse to the shape they share.
       scope: 'root',
       findReplace: [
-        '  dor workspace [--force] [--json]<TO-EOL>',
-        `  dor workspace ${ACTION_NAMES.join('|')} [args...] [--force] [--json]\n`,
+        '  dor workspace [--force] [--json] [--window label] [--index n] [--dangerously-destroy-iframe-page-state]<TO-EOL>',
+        `  dor workspace ${ACTION_NAMES.join('|')} [args...] [flags...]\n`,
       ],
     },
   ],
   command: buildCommand<WorkspaceFlags, string[], DorCommandContext>({
     docs: {
-      brief: 'Create, rename, close, or switch Workspaces.',
+      brief: 'Create, rename, close, switch, or move Workspaces.',
       customUsage: USAGE,
       fullDescription: `Manages this Window's Workspaces. Listing them is dor list --workspaces (the overview) and dor list --all (every Workspace's Surfaces); this command only mutates.
 
@@ -98,9 +112,12 @@ new creates a Workspace in the background and prints its ref: it never moves the
 
 close archives and kills every Surface in the Workspace. It refuses — raising no confirmation, because the caller is a command rather than someone watching the Wall — when the Workspace holds a Surface the user has typed into or a running command; --force closes it anyway. The last remaining Workspace cannot be closed.
 
+move puts a Workspace in another window (--window <label>, or --window new to tear it out into its own) and/or at a strip position (--index <n>, 0-based). Nothing is archived or killed: its terminals, notes, and pins travel whole. The one thing a move between windows cannot carry is a plain iframe's page state — the document cannot leave its webview, so the iframe reopens at its saved URL — and the move is refused when the Workspace holds one unless --dangerously-destroy-iframe-page-state is passed. Agent-browser Surfaces are not affected.
+
 Text output:
   created workspace:2 "build"
   closed workspace:2 "build"
+  moved workspace:2 "build"
 
 JSON output:
   {
@@ -114,6 +131,9 @@ JSON output:
       flags: {
         force: { kind: 'boolean', brief: 'Close even when the Workspace holds running or touched Surfaces.', optional: true, withNegated: false },
         json: { kind: 'boolean', brief: 'Print JSON output.', optional: true, withNegated: false },
+        window: { kind: 'parsed', parse: stringParser, brief: 'move: the window to move to (a label, or "new").', optional: true, placeholder: 'label' },
+        index: { kind: 'parsed', parse: indexParser, brief: 'move: the 0-based strip position to move to.', optional: true, placeholder: 'n' },
+        dangerouslyDestroyIframePageState: { kind: 'boolean', brief: 'move: accept losing every iframe Surface\'s page state.', optional: true, withNegated: false },
       },
       positional: {
         kind: 'array',
@@ -138,6 +158,15 @@ async function runWorkspaceCommand(
   if (flags.force === true && parsed.value !== 'close') {
     return new Error('--force applies only to dor workspace close');
   }
+  if (parsed.value !== 'move') {
+    if (flags.window !== undefined) return new Error('--window applies only to dor workspace move');
+    if (flags.index !== undefined) return new Error('--index applies only to dor workspace move');
+    if (flags.dangerouslyDestroyIframePageState === true) {
+      return new Error('--dangerously-destroy-iframe-page-state applies only to dor workspace move');
+    }
+  } else if (flags.window === undefined && flags.index === undefined) {
+    return new Error('dor workspace move needs --window, --index, or both');
+  }
 
   const client = requireControlClient(this.options);
   if (client instanceof Error) return client;
@@ -151,6 +180,12 @@ async function runWorkspaceCommand(
   }
 }
 
+function indexParser(value: string): number {
+  const index = Number(value);
+  if (!Number.isInteger(index) || index < 0) throw new Error(`--index must be a non-negative integer, got '${value}'`);
+  return index;
+}
+
 function parseAction(value: string | undefined): ParseResult<WorkspaceAction> {
   const action = ACTION_NAMES.find((candidate) => candidate === value);
   if (action) return { ok: true, value: action };
diff --git a/dor/src/control-client.ts b/dor/src/control-client.ts
index 4c4915ca0..f30518325 100644
--- a/dor/src/control-client.ts
+++ b/dor/src/control-client.ts
@@ -19,6 +19,7 @@ import type {
   NewWorkspaceRequest,
   CloseWorkspaceRequest,
   RenameWorkspaceRequest,
+  MoveWorkspaceRequest,
   SwitchWorkspaceRequest,
   WorkspaceMutationResponse,
   ReadSurfaceRequest,
@@ -176,6 +177,16 @@ export class SocketControlClient implements ControlClient {
     return this.request<WorkspaceMutationResponse>(WORKSPACE_CONTROL_METHODS.switch, request);
   }
 
+  // A move between windows serializes every terminal and waits for the target
+  // to adopt the Workspace, so it too can outlast the ordinary deadline.
+  moveWorkspace(request: MoveWorkspaceRequest): Promise<WorkspaceMutationResponse> {
+    return this.request<WorkspaceMutationResponse>(
+      WORKSPACE_CONTROL_METHODS.move,
+      request,
+      { timeoutMs: CLOSE_WORKSPACE_TIMEOUT_MS },
+    );
+  }
+
   /**
    * One request over one socket, preceded by a mutual handshake.
    *
diff --git a/dor/src/protocol.ts b/dor/src/protocol.ts
index 29ffc7174..55d7b1e5b 100644
--- a/dor/src/protocol.ts
+++ b/dor/src/protocol.ts
@@ -41,6 +41,7 @@ export const WORKSPACE_CONTROL_METHODS = {
   rename: 'workspace.rename',
   close: 'workspace.close',
   switch: 'workspace.switch',
+  move: 'workspace.move',
 } as const;
 
 export type WorkspaceControlMethod = (typeof WORKSPACE_CONTROL_METHODS)[keyof typeof WORKSPACE_CONTROL_METHODS];
diff --git a/dor/test/snapshots/help/dor.md b/dor/test/snapshots/help/dor.md
index ab0a809a9..e2c2aa5c8 100644
--- a/dor/test/snapshots/help/dor.md
+++ b/dor/test/snapshots/help/dor.md
@@ -14,8 +14,8 @@ USAGE
   dor kill <surface> [--confirm-if-read text|--confirm-dangerously] [--json] [--workspace ref]
   dor iframe [--json] [--minimize] [--surface id|ref] [--workspace ref] <target>
   dor agent-browser [--key name|--session name|--surface handle] [--workspace ref] [args...]
-  dor list [--all] [--command text] [--cwd path] [--id-format refs|ids|both] [--json] [--kind terminal|browser] [--port number] [--ports] [--view paned|zoomed|minimized] [--workspace ref] [--workspaces]
-  dor workspace new|rename|close|switch [args...] [--force] [--json]
+  dor list [--all] [--command text] [--cwd path] [--id-format refs|ids|both] [--json] [--kind terminal|browser] [--port number] [--ports] [--view paned|zoomed|minimized] [--workspace ref] [--workspaces] [--window label]
+  dor workspace new|rename|close|switch|move [args...] [flags...]
   dor --help
 
 Dormouse bundles the dor CLI into every terminal it launches.
@@ -36,6 +36,6 @@ COMMANDS
   iframe         Open a target in an iframe surface.
   agent-browser  Drive a browser surface via your agent-browser install (alias: dor ab).
   list           List Dormouse Surfaces.
-  workspace      Create, rename, close, or switch Workspaces.
+  workspace      Create, rename, close, switch, or move Workspaces.
 
 ```
diff --git a/dor/test/snapshots/help/list.md b/dor/test/snapshots/help/list.md
index 2274c9642..72874dc46 100644
--- a/dor/test/snapshots/help/list.md
+++ b/dor/test/snapshots/help/list.md
@@ -4,8 +4,8 @@ Invocation: `dor list --help`
 
 ```text
 USAGE
-  dor list [--workspace ref|--all] [--kind terminal|browser] [--view paned|zoomed|minimized] [--command text] [--cwd path] [--port number] [--ports] [--json] [--id-format refs|ids|both]
-  dor list --workspaces [--json]
+  dor list [--workspace ref|--all] [--window label] [--kind terminal|browser] [--view paned|zoomed|minimized] [--command text] [--cwd path] [--port number] [--ports] [--json] [--id-format refs|ids|both]
+  dor list --workspaces [--window label] [--json]
   dor list --help
 
 Lists every Surface in the current Workspace — terminals and browser Surfaces, including minimized ones (view "minimized").
@@ -20,7 +20,7 @@ Filters are ANDed. --command is an exact match against the running command repor
 
 JSON output (--json) always includes both stable ids and refs, and each row carries has_terminal (a PTY) and has_browser (a browser renderer) — gate on those, not on kind, so a Surface that has both still matches. It adds top-level caller_surface_ref/caller_surface_id and focused_surface_ref/focused_surface_id — the calling and focused Surfaces, null when neither is in the list — plus workspace_ref, window_ref, and a host block (app, workspace, cli_js_path, node_path): the identity dump dor identify used to print.
 
---workspace <ref> lists another Workspace instead, in this window or another: workspace:<n> (a stable number) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build").
+--workspace <ref> lists another Workspace instead, in this window or another: workspace:<n> (a stable number) or workspace:<name>, which resolves only when exactly one Workspace carries that name. Both are accepted bare ("2", "build"). --window <label> lists another window's Surfaces or Workspaces (window:main, ws-2).
 
 --all lists every Workspace of this Window, grouped under a Workspace header — every Workspace keeps its header, including one holding nothing and one the filters emptied. Rows keep their own Workspace-scoped surface:N refs, so several groups have a surface:1, but only the active Workspace's selection carries the focus marker; each JSON row adds workspace_ref, and the payload adds a workspaces array. Target a row from another Workspace by its stable id, or pass --workspace.
 
@@ -47,6 +47,7 @@ FLAGS
      [--view]        Surface view to show.
      [--workspace]   Workspace to act in, instead of the caller's.
      [--workspaces]  Print the Workspace overview instead of Surfaces.
+     [--window]      Another window to list, by its label (window:main, ws-2).
   -h  --help         Print help information and exit
       --             All subsequent inputs should be interpreted as arguments
 
diff --git a/dor/test/snapshots/help/workspace.md b/dor/test/snapshots/help/workspace.md
index 32ad32a3b..3e21bd195 100644
--- a/dor/test/snapshots/help/workspace.md
+++ b/dor/test/snapshots/help/workspace.md
@@ -8,6 +8,7 @@ USAGE
   dor workspace rename <workspace> <name> [--json]
   dor workspace close <workspace> [--force] [--json]
   dor workspace switch <workspace> [--json]
+  dor workspace move <workspace> [--window <label|new>] [--index <n>] [--dangerously-destroy-iframe-page-state] [--json]
   dor workspace --help
 
 Manages this Window's Workspaces. Listing them is dor list --workspaces (the overview) and dor list --all (every Workspace's Surfaces); this command only mutates.
@@ -18,9 +19,12 @@ new creates a Workspace in the background and prints its ref: it never moves the
 
 close archives and kills every Surface in the Workspace. It refuses — raising no confirmation, because the caller is a command rather than someone watching the Wall — when the Workspace holds a Surface the user has typed into or a running command; --force closes it anyway. The last remaining Workspace cannot be closed.
 
+move puts a Workspace in another window (--window <label>, or --window new to tear it out into its own) and/or at a strip position (--index <n>, 0-based). Nothing is archived or killed: its terminals, notes, and pins travel whole. The one thing a move between windows cannot carry is a plain iframe's page state — the document cannot leave its webview, so the iframe reopens at its saved URL — and the move is refused when the Workspace holds one unless --dangerously-destroy-iframe-page-state is passed. Agent-browser Surfaces are not affected.
+
 Text output:
   created workspace:2 "build"
   closed workspace:2 "build"
+  moved workspace:2 "build"
 
 JSON output:
   {
@@ -31,10 +35,13 @@ JSON output:
   }
 
 FLAGS
-     [--force]  Close even when the Workspace holds running or touched Surfaces.
-     [--json]   Print JSON output.
-  -h  --help    Print help information and exit
-      --        All subsequent inputs should be interpreted as arguments
+     [--force]                                  Close even when the Workspace holds running or touched Surfaces.
+     [--json]                                   Print JSON output.
+     [--window]                                 move: the window to move to (a label, or "new").
+     [--index]                                  move: the 0-based strip position to move to.
+     [--dangerously-destroy-iframe-page-state]  move: accept losing every iframe Surface's page state.
+  -h  --help                                    Print help information and exit
+      --                                        All subsequent inputs should be interpreted as arguments
 
 ARGUMENTS
   args...  Action, then its arguments.
diff --git a/dor/test/snapshots/workspace-missing-action.snap b/dor/test/snapshots/workspace-missing-action.snap
index 64d36e5e5..29c6d1f6a 100644
--- a/dor/test/snapshots/workspace-missing-action.snap
+++ b/dor/test/snapshots/workspace-missing-action.snap
@@ -2,4 +2,4 @@ exitCode: 1
 stdout:
 
 stderr:
-Error: dor workspace requires an action: new, rename, close, switch
+Error: dor workspace requires an action: new, rename, close, switch, move
diff --git a/dor/test/snapshots/workspace-unknown-action.snap b/dor/test/snapshots/workspace-unknown-action.snap
index 2c7a1981e..1034eb469 100644
--- a/dor/test/snapshots/workspace-unknown-action.snap
+++ b/dor/test/snapshots/workspace-unknown-action.snap
@@ -2,4 +2,4 @@ exitCode: 1
 stdout:
 
 stderr:
-Error: unknown dor workspace action 'destroy' (expected new, rename, close, switch)
+Error: unknown dor workspace action 'destroy' (expected new, rename, close, switch, move)
diff --git a/lib/src/components/KillConfirm.tsx b/lib/src/components/KillConfirm.tsx
index b72081458..675814a57 100644
--- a/lib/src/components/KillConfirm.tsx
+++ b/lib/src/components/KillConfirm.tsx
@@ -24,11 +24,17 @@ export function KillConfirmModal({
   onCancel,
   exit,
   targetElement,
+  title = 'Confirm kill',
+  detail,
 }: {
   char: string;
   onCancel?: () => void;
   exit?: KillExit;
   targetElement?: HTMLElement | null;
+  /** The same typed-letter gate stands in front of other destructive steps
+   *  (a Workspace move that loses iframe page state); they name themselves. */
+  title?: string;
+  detail?: string;
 }) {
   const cancelButtonRef = useRef<HTMLButtonElement>(null);
   return (
@@ -43,8 +49,9 @@ export function KillConfirmModal({
       onEscape={onCancel}
     >
       <h2 id="kill-confirm-title" className="text-base font-bold mb-3 text-foreground">
-        Confirm kill
+        {title}
       </h2>
+      {detail && <p className="text-sm text-muted mb-3 max-w-xs">{detail}</p>}
       <div className="bg-app-bg py-2 px-6 rounded border border-border inline-block mb-2">
         <span
           className={`text-xl font-bold${exit === 'confirm' ? ' kill-letter-flash' : ''}`}
diff --git a/lib/src/components/Wall.tsx b/lib/src/components/Wall.tsx
index 9ef49511e..44ac7678c 100644
--- a/lib/src/components/Wall.tsx
+++ b/lib/src/components/Wall.tsx
@@ -79,6 +79,7 @@ import {
   agentBrowserSessionFromParams,
   browserDisplayModeFromParams,
   browserUrlFromParams,
+  isBrowserParams,
   surfaceKindFromParams,
 } from './wall/browser-surface';
 import { hostPathDisplay } from './wall/browser-url';
@@ -941,6 +942,15 @@ export function Wall({
     [lath],
   );
 
+  /** The members whose live document a move between Windows cannot carry. */
+  const iframeSurfaceIds = useCallback(
+    (): string[] => memberSurfaceIds().filter((id) => {
+      const params = lath.getMeta(id)?.params;
+      return isBrowserParams(params) && resolveRenderMode(params) === 'iframe';
+    }),
+    [lath, memberSurfaceIds],
+  );
+
   /** Whether a member Surface has a PTY behind it, as against a browser view. */
   const surfaceHasTerminal = useCallback(
     (id: string): boolean => hasTerminal(surfaceKindFromParams(lath.getMeta(id)?.params)),
@@ -1554,6 +1564,7 @@ export function Wall({
   const methods: Omit<WallHandle, 'workspaceId'> = {
     surfaceIds: memberSurfaceIds,
     ownsSurface,
+    iframeSurfaceIds,
     hasTouchedSurfaces: () => memberSurfaceIds().some((id) => {
       // A browser Surface has no "untouched" notion and always holds a page, so
       // it counts; a terminal counts once its Session exists and has input.
diff --git a/lib/src/components/WorkspaceStrip.tsx b/lib/src/components/WorkspaceStrip.tsx
index 4db31ed31..cfb5a1e75 100644
--- a/lib/src/components/WorkspaceStrip.tsx
+++ b/lib/src/components/WorkspaceStrip.tsx
@@ -26,6 +26,7 @@ import { computeWorkspaceUnion, EMPTY_WORKSPACE_UNION, type WorkspaceUnion } fro
 import {
   getWorkspaceUiSnapshot,
   setPendingWorkspaceClose,
+  setPendingWorkspaceMove,
   setRenamingWorkspace,
   subscribeToWorkspaceUi,
 } from '../lib/workspace-ui-store';
@@ -65,7 +66,7 @@ export function WorkspaceStrip({
   const { workspaces, activeId } = useSyncExternalStore(subscribeToWorkspaces, getWorkspacesSnapshot);
   const membership = useSyncExternalStore(subscribeToWorkspaceSurfaces, getWorkspaceSurfacesSnapshot);
   const activity = useSyncExternalStore(subscribeToActivity, getActivitySnapshot);
-  const { renamingId, pendingClose } = useSyncExternalStore(subscribeToWorkspaceUi, getWorkspaceUiSnapshot);
+  const { renamingId, pendingClose, pendingMove } = useSyncExternalStore(subscribeToWorkspaceUi, getWorkspaceUiSnapshot);
   const [draggingId, setDraggingId] = useState<WorkspaceId | null>(null);
 
   const stripRef = useRef<HTMLDivElement>(null);
@@ -73,7 +74,7 @@ export function WorkspaceStrip({
 
   // The editor and the confirmation both sit outside every Wall, so a
   // capture-phase command-mode shortcut would still fire behind them.
-  useDialogKeyboardOwner(renamingId !== null || pendingClose !== null, acquireChromeKeyboardLease);
+  useDialogKeyboardOwner(renamingId !== null || pendingClose !== null || pendingMove !== null, acquireChromeKeyboardLease);
 
   const activate = useCallback((id: WorkspaceId) => {
     setActiveWorkspace(id);
@@ -140,13 +141,28 @@ export function WorkspaceStrip({
     return () => window.removeEventListener('keydown', onKeyDown, true);
   }, [pendingClose]);
 
+  // The move gate is the same typed letter: the page state it destroys is as
+  // gone as a killed pane's process.
+  useEffect(() => {
+    if (!pendingMove) return;
+    const { char, proceed } = pendingMove;
+    const onKeyDown = (event: KeyboardEvent) => {
+      event.preventDefault();
+      event.stopPropagation();
+      setPendingWorkspaceMove(null);
+      if (acceptsKillChar(event.key, char)) proceed();
+    };
+    window.addEventListener('keydown', onKeyDown, true);
+    return () => window.removeEventListener('keydown', onKeyDown, true);
+  }, [pendingMove]);
+
   // Anchored to the Window's content area, not the tab: a 24px tab is too small
   // a box to center a dialog over, and every Wall shares one grid cell, so the
   // confirmation lands in the same place whichever Workspace it is about. No
   // Window (Storybook) leaves it viewport-centered.
   const confirmTarget = useMemo(
-    () => (pendingClose ? document.querySelector<HTMLElement>('[data-workspace-content]') : null),
-    [pendingClose],
+    () => (pendingClose || pendingMove ? document.querySelector<HTMLElement>('[data-workspace-content]') : null),
+    [pendingClose, pendingMove],
   );
 
   // One union per tab, computed in the loop it is rendered in. The visible
@@ -215,6 +231,15 @@ export function WorkspaceStrip({
           onCancel={() => setPendingWorkspaceClose(null)}
         />
       )}
+      {pendingMove && !pendingClose && (
+        <KillConfirmModal
+          char={pendingMove.char}
+          targetElement={confirmTarget}
+          title="Move and lose page state?"
+          detail={`${pendingMove.iframeCount === 1 ? 'An iframe Surface' : `${pendingMove.iframeCount} iframe Surfaces`} in this Workspace will reload at ${pendingMove.iframeCount === 1 ? 'its' : 'their'} saved URL; a page cannot leave its window.`}
+          onCancel={() => setPendingWorkspaceMove(null)}
+        />
+      )}
     </div>
   );
 }
diff --git a/lib/src/components/wall/wall-handles.ts b/lib/src/components/wall/wall-handles.ts
index bebdd24a9..fbf05a0c6 100644
--- a/lib/src/components/wall/wall-handles.ts
+++ b/lib/src/components/wall/wall-handles.ts
@@ -16,6 +16,11 @@ export interface WallHandle {
   /** The Wall's member Surfaces: visible panes ∪ Doors. */
   surfaceIds(): string[];
   ownsSurface(id: string): boolean;
+  /** Member Surfaces rendered as plain iframes, Doored ones included: the page
+   *  state a move between Windows destroys (`docs/specs/layout.md` →
+   *  Workspaces). Agent-browser Surfaces are not among them — their session
+   *  lives in the host and reconnects. */
+  iframeSurfaceIds(): string[];
   /** Any member terminal Session the user has typed into (the close confirmation
    *  gate, alongside `runningCount`). */
   hasTouchedSurfaces(): boolean;
@@ -84,6 +89,7 @@ export function stubWallHandle(workspaceId: WorkspaceId, overrides: Partial<Wall
     workspaceId,
     surfaceIds: () => [],
     ownsSurface: () => false,
+    iframeSurfaceIds: () => [],
     hasTouchedSurfaces: () => false,
     runningCount: () => 0,
     flushPersistence: async () => {},
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index d4b22d3f9..e1d60a832 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -130,6 +130,52 @@ describe('workspace mutation verbs', () => {
   });
 });
 
+describe('workspace.move', () => {
+  it('reorders within the Window without a host, and refuses a move between Windows there', async () => {
+    const second = createWorkspace({ id: 'workspace-7', name: 'build', activate: false }).id;
+    handleFor(getWorkspacesSnapshot().workspaces[0].id);
+    handleFor(second);
+    const reorder = request('workspace.move', { workspace: 'workspace:7', index: 0 });
+    await handleWorkspaceControl(reorder);
+    expect(answer(reorder)).toMatchObject({ status: 'moved', workspaceId: second, workspaceRef: 'workspace:7' });
+    expect(getWorkspacesSnapshot().workspaces[0].id).toBe(second);
+
+    setPlatform({} as unknown as PlatformAdapter);
+    const across = request('workspace.move', { workspace: 'workspace:7', toWindow: 'ws-2' });
+    await handleWorkspaceControl(across);
+    expect(answer(across)).toMatch(/one window/);
+
+    const neither = request('workspace.move', { workspace: 'workspace:7' });
+    await handleWorkspaceControl(neither);
+    expect(answer(neither)).toMatch(/needs a window, an index, or both/);
+  });
+
+  it('refuses to move a Workspace holding iframes unless told to destroy their page state', async () => {
+    const second = createWorkspace({ id: 'workspace-7', name: 'build', activate: false }).id;
+    handleFor(getWorkspacesSnapshot().workspaces[0].id);
+    handleFor(second, { iframeSurfaceIds: () => ['browser-1'] });
+    const transferWorkspace = vi.fn(async () => {});
+    setPlatform({ transferWorkspace } as unknown as PlatformAdapter);
+
+    const refused = request('workspace.move', { workspace: 'workspace:7', toWindow: 'window:ws-2' });
+    await handleWorkspaceControl(refused);
+    expect(answer(refused)).toMatch(/1 iframe Surface\(s\).*surface:browser-1.*--dangerously-destroy-iframe-page-state/);
+    expect(transferWorkspace).not.toHaveBeenCalled();
+
+    const forced = request('workspace.move', {
+      workspace: 'workspace:7', toWindow: 'window:ws-2', dangerouslyDestroyIframePageState: true,
+    });
+    await handleWorkspaceControl(forced);
+    expect(transferWorkspace).toHaveBeenCalledWith(second, 'ws-2');
+    expect(answer(forced)).toMatchObject({ status: 'moved', workspaceRef: 'workspace:7' });
+
+    transferWorkspace.mockRejectedValueOnce(new Error('the host refused'));
+    const failed = request('workspace.move', { workspace: 'workspace:7', toWindow: 'new', dangerouslyDestroyIframePageState: true });
+    await handleWorkspaceControl(failed);
+    expect(answer(failed)).toMatch(/was not moved: the host refused/);
+  });
+});
+
 describe('workspace.close', () => {
   it('refuses a Workspace holding work, and closes it with force', async () => {
     const second = createWorkspace({ id: 'ws-2', name: 'build', activate: false }).id;
diff --git a/lib/src/components/wall/workspace-control.ts b/lib/src/components/wall/workspace-control.ts
index e23f20bbe..e4cf9b29b 100644
--- a/lib/src/components/wall/workspace-control.ts
+++ b/lib/src/components/wall/workspace-control.ts
@@ -6,12 +6,15 @@ import type {
   WorkspaceMutationResponse,
   WorkspaceRow,
 } from 'dor/commands/types';
+import { getPlatformOrNull } from '../../lib/platform';
 import { getActivitySnapshot } from '../../lib/session-activity-store';
 import type { WorkspaceId } from '../../lib/session-types';
 import {
   createWorkspace,
   currentWindowRef,
   getWorkspacesSnapshot,
+  isWindowRef,
+  moveWorkspace,
   renameWorkspace,
   resolveWorkspaceRef,
   setActiveWorkspace,
@@ -40,6 +43,9 @@ export type WindowControlParams = DorControlParams & {
   scope?: unknown;
   name?: unknown;
   force?: unknown;
+  toWindow?: unknown;
+  index?: unknown;
+  dangerouslyDestroyIframePageState?: unknown;
 };
 
 /** This Window's Workspaces in strip order, each with its union status. */
@@ -219,6 +225,55 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
       return;
     }
 
+    case WORKSPACE_CONTROL_METHODS.move: {
+      const target = requireWorkspace(detail);
+      if (!target) return;
+      const toWindow = stringParam(params.toWindow)?.trim();
+      const index = typeof params.index === 'number' && Number.isInteger(params.index) && params.index >= 0
+        ? params.index : undefined;
+      if (toWindow === undefined && index === undefined) {
+        detail.respond({ ok: false, error: 'workspace.move needs a window, an index, or both' });
+        return;
+      }
+      if (toWindow !== undefined && !isWindowRef(toWindow)) {
+        const handle = await awaitWallHandle(target.id);
+        if (!handle) {
+          detail.respond({ ok: false, error: mountingRefusal(target.ref) });
+          return;
+        }
+        const platform = getPlatformOrNull();
+        if (!platform?.transferWorkspace) {
+          detail.respond({ ok: false, error: 'this host has one window; workspace.move can only reorder here' });
+          return;
+        }
+        // The one thing a move between Windows cannot carry is a plain
+        // iframe's document: it reopens at its saved URL, its page state gone
+        // (`docs/specs/layout.md` → Workspaces). The caller says so explicitly.
+        const iframes = handle.iframeSurfaceIds();
+        if (iframes.length > 0 && params.dangerouslyDestroyIframePageState !== true) {
+          const refs = iframes.map((id) => `surface:${id}`).join(', ');
+          detail.respond({
+            ok: false,
+            error: `workspace '${target.ref}' holds ${iframes.length} iframe Surface(s) whose page state a move destroys (${refs}); `
+              + 'pass --dangerously-destroy-iframe-page-state to move it anyway',
+          });
+          return;
+        }
+        const label = toWindow.startsWith('window:') ? toWindow.slice('window:'.length) : toWindow;
+        try {
+          await platform.transferWorkspace(target.id, label);
+        } catch (err) {
+          detail.respond({ ok: false, error: `workspace '${target.ref}' was not moved: ${errorText(err)}` });
+          return;
+        }
+        respondMutation('moved', target);
+        return;
+      }
+      if (index !== undefined) moveWorkspace(target.id, index);
+      respondMutation('moved', target);
+      return;
+    }
+
     case WORKSPACE_CONTROL_METHODS.close: {
       const target = requireWorkspace(detail);
       if (!target) return;
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 232fe313d..7334d84c1 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -411,6 +411,11 @@ export interface PlatformAdapter {
   /** Hosts that hand Workspaces between windows stamp marks; returns the
    *  unsubscribe. Absent on hosts with one window. */
   onPtyMarked?(handler: (detail: PtyMarkedDetail) => void): () => void;
+  /** Hand a Workspace to another window — a label, or `'new'` for one torn out
+   *  — through the host's transfer (`docs/specs/standalone.md` → Transfer).
+   *  Resolves once the host has accepted the hand-off. Absent on hosts with
+   *  one window. */
+  transferWorkspace?(workspaceId: string, toWindow: string): Promise<void>;
 
   // Host-initiated session persistence
   onRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void;
diff --git a/lib/src/lib/workspace-ui-store.ts b/lib/src/lib/workspace-ui-store.ts
index 2828ccecc..27648f3bc 100644
--- a/lib/src/lib/workspace-ui-store.ts
+++ b/lib/src/lib/workspace-ui-store.ts
@@ -12,9 +12,13 @@ export interface WorkspaceUiState {
   /** The Workspace awaiting its typed close confirmation, and the letter that
    *  accepts it (minted once, so a re-render cannot change the letter on screen). */
   pendingClose: { id: WorkspaceId; char: string } | null;
+  /** A move between Windows awaiting its typed confirmation, because it would
+   *  destroy the page state of `iframeCount` iframe Surfaces; `proceed` runs the
+   *  move (`docs/specs/layout.md` → "Workspaces"). */
+  pendingMove: { id: WorkspaceId; char: string; iframeCount: number; proceed: () => void } | null;
 }
 
-const EMPTY: WorkspaceUiState = { renamingId: null, pendingClose: null };
+const EMPTY: WorkspaceUiState = { renamingId: null, pendingClose: null, pendingMove: null };
 
 let state: WorkspaceUiState = EMPTY;
 const listeners = new Set<() => void>();
@@ -46,6 +50,11 @@ export function setPendingWorkspaceClose(pending: WorkspaceUiState['pendingClose
   emit({ ...state, pendingClose: pending });
 }
 
+export function setPendingWorkspaceMove(pending: WorkspaceUiState['pendingMove']): void {
+  if (state.pendingMove === pending) return;
+  emit({ ...state, pendingMove: pending });
+}
+
 /** Drop both (a Workspace closed, or tests). */
 export function resetWorkspaceUi(): void {
   if (state === EMPTY) return;
diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index ca385ef4c..454c8d124 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -6,7 +6,7 @@
   "docs/specs/auto-update.md": 1100,
   "docs/specs/deploy.md": 1900,
   "docs/specs/dor-browser.md": 4500,
-  "docs/specs/dor-cli.md": 5750,
+  "docs/specs/dor-cli.md": 5850,
   "docs/specs/dor-tool.md": 2100,
   "docs/specs/glossary.md": 3000,
   "docs/specs/layout.md": 8450,
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index c9cd935b2..524cca24e 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -583,6 +583,18 @@ export class TauriAdapter implements PlatformAdapter {
     this.replayHandlers.add(handler);
   }
 
+  /** `dor workspace move` between windows: the same transfer the strip's drag
+   *  runs, with no pointer to place the tab by (docs/specs/standalone.md →
+   *  Transfer). Imported on use: `workspace-move` pulls the whole move
+   *  protocol in, which a window that never moves anything need not load. */
+  async transferWorkspace(workspaceId: string, toWindow: string): Promise<void> {
+    const { tearOutWorkspace, transferWorkspaceTo } = await import("./workspace-move");
+    const accepted = toWindow === "new"
+      ? await tearOutWorkspace(workspaceId, { x: 0, y: 0 })
+      : await transferWorkspaceTo(workspaceId, toWindow);
+    if (!accepted) throw new Error(`the host refused to move the Workspace to '${toWindow}'`);
+  }
+
   onPtyMarked(handler: (detail: PtyMarkedDetail) => void): () => void {
     this.markedHandlers.add(handler);
     return () => { this.markedHandlers.delete(handler); };
diff --git a/standalone/src/workspace-drag.test.ts b/standalone/src/workspace-drag.test.ts
index d9b4a38e4..b20d7e26b 100644
--- a/standalone/src/workspace-drag.test.ts
+++ b/standalone/src/workspace-drag.test.ts
@@ -27,6 +27,8 @@ import {
   _resetWorkspaceDragForTesting,
 } from "./workspace-drag";
 import { _setWindowLabelForTesting } from "./window-label";
+import { registerWallHandle, resetWallHandles, stubWallHandle } from "dormouse-lib/components/wall/wall-handles";
+import { getWorkspaceUiSnapshot, resetWorkspaceUi } from "dormouse-lib/lib/workspace-ui-store";
 
 const settle = () => vi.advanceTimersByTimeAsync(0);
 /** Past the hit-test throttle, so the next move probes again. */
@@ -183,6 +185,35 @@ describe("releasing the drag", () => {
     expect(mocks.tearOutWorkspace).not.toHaveBeenCalled();
   });
 
+  it("asks first when the Workspace holds an iframe, and moves only on the typed letter", async () => {
+    resetWallHandles();
+    resetWorkspaceUi();
+    registerWallHandle(stubWallHandle("ws-1", { iframeSurfaceIds: () => ["browser-1", "browser-2"] }));
+    hit = { label: "ws-2", x: 120, y: 9 };
+    onDropOnOtherWindow("ws-1", { clientX: 900, clientY: 9 }, false);
+    await settle();
+    // Nothing moved: the gate is up, naming what it would cost.
+    expect(mocks.transferWorkspaceTo).not.toHaveBeenCalled();
+    const pending = getWorkspaceUiSnapshot().pendingMove;
+    expect(pending).toMatchObject({ id: "ws-1", iframeCount: 2 });
+    // The strip's key handler settles it; here, the letter's own effect.
+    pending!.proceed();
+    expect(mocks.transferWorkspaceTo).toHaveBeenCalledWith("ws-1", "ws-2", { x: 120, y: 9 });
+    resetWallHandles();
+    resetWorkspaceUi();
+  });
+
+  it("does not ask for a Workspace of terminals and agent-browser Surfaces", async () => {
+    resetWallHandles();
+    registerWallHandle(stubWallHandle("ws-1", { iframeSurfaceIds: () => [] }));
+    hit = null;
+    onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
+    await settle();
+    expect(mocks.tearOutWorkspace).toHaveBeenCalled();
+    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+    resetWallHandles();
+  });
+
   it("tears out when released over no window", async () => {
     hit = null;
     onDropOnOtherWindow("ws-1", { clientX: 2000, clientY: 800 }, false);
diff --git a/standalone/src/workspace-drag.ts b/standalone/src/workspace-drag.ts
index b0c3acfbe..94283dd6b 100644
--- a/standalone/src/workspace-drag.ts
+++ b/standalone/src/workspace-drag.ts
@@ -4,6 +4,9 @@ import type { WorkspaceId } from "dormouse-lib/lib/session-types";
 import type { StripDragPoint } from "dormouse-lib/components/workspace-strip-drag";
 import { currentWindowLabel } from "./window-label";
 import { tearOutWorkspace, transferWorkspaceTo } from "./workspace-move";
+import { getWallHandle } from "dormouse-lib/components/wall/wall-handles";
+import { randomKillChar } from "dormouse-lib/components/KillConfirm";
+import { setPendingWorkspaceMove } from "dormouse-lib/lib/workspace-ui-store";
 import { workspaceTabRect } from "./workspace-tabs";
 
 /**
@@ -162,11 +165,18 @@ export function onDropOnOtherWindow(
     // Probed fresh rather than reusing the throttled answer: up to
     // HIT_TEST_THROTTLE_MS of pointer travel could otherwise choose the window.
     const hit = await probe();
-    if (hit && hit.label !== currentWindowLabel()) {
-      await transferWorkspaceTo(id, hit.label, { x: hit.x, y: hit.y });
+    const move = hit && hit.label !== currentWindowLabel()
+      ? () => void transferWorkspaceTo(id, hit.label, { x: hit.x, y: hit.y })
+      : () => void tearOutWorkspace(id, grab);
+    // The one thing a move cannot carry is a plain iframe's document, Doored
+    // ones included; it reopens at its saved URL. The user says so first, with
+    // the same typed letter a kill takes (docs/specs/layout.md → Workspaces).
+    const iframes = getWallHandle(id)?.iframeSurfaceIds() ?? [];
+    if (iframes.length > 0) {
+      setPendingWorkspaceMove({ id, char: randomKillChar(), iframeCount: iframes.length, proceed: move });
       return;
     }
-    await tearOutWorkspace(id, grab);
+    move();
   })();
 }
 
diff --git a/standalone/src/workspace-move.ts b/standalone/src/workspace-move.ts
index c5cc5bb1b..54c25b28e 100644
--- a/standalone/src/workspace-move.ts
+++ b/standalone/src/workspace-move.ts
@@ -102,12 +102,12 @@ async function handOff(
   prepared: PreparedWorkspaceTransfer,
   command: string,
   args: Record<string, unknown>,
-): Promise<void> {
+): Promise<boolean> {
   try {
     await invoke(command, args);
   } catch (err) {
     console.warn(`[workspace-move] ${command} refused; the Workspace stays here`, err);
-    return;
+    return false;
   }
   const { workspaceId, terminalIds } = prepared.payload;
   inFlight.set(workspaceId, prepared);
@@ -116,7 +116,7 @@ async function handOff(
   // holds is exactly the bytes before the mark. Serialized here, attached to the
   // arrival by Rust, and only then drained by the target.
   const marks = await marksFor(terminalIds, `mark-${workspaceId}`);
-  if (!inFlight.has(workspaceId)) return; // handed back while we waited
+  if (!inFlight.has(workspaceId)) return true; // handed back while we waited; the host had accepted
   const content = await captureTransferContent(terminalIds, marks);
   try {
     await invoke("transfer_workspace_content", { workspaceId, content });
@@ -125,6 +125,7 @@ async function handOff(
     // `workspace-arrival-failed` has put, or will put, this Window back.
     console.warn("[workspace-move] transfer_workspace_content refused", err);
   }
+  return true;
 }
 
 /** The host stamps marks well inside this; past it, an unmarked id is
@@ -158,28 +159,31 @@ function marksFor(ids: readonly string[], requestId: string): Promise<Map<string
   });
 }
 
-/** Hand this Workspace to a window that already exists. */
+/** Hand this Workspace to a window that already exists. `at` is where the
+ *  pointer released in the target's strip; a move with no pointer (`dor
+ *  workspace move`) appends. Resolves to whether the host accepted it. */
 export async function transferWorkspaceTo(
   workspaceId: WorkspaceId,
   to: string,
-  at: { x: number; y: number },
-): Promise<void> {
+  at?: { x: number; y: number },
+): Promise<boolean> {
   const prepared = await prepare(workspaceId);
-  if (!prepared) return;
-  await handOff(prepared, "transfer_workspace", {
+  if (!prepared) return false;
+  return handOff(prepared, "transfer_workspace", {
     to,
-    payload: { ...prepared.payload, at } satisfies MovePayload,
+    payload: { ...prepared.payload, ...(at ? { at } : {}) } satisfies MovePayload,
   });
 }
 
-/** Tear this Workspace out into a new window under the cursor. */
+/** Tear this Workspace out into a new window under the cursor. Resolves to
+ *  whether the host accepted it. */
 export async function tearOutWorkspace(
   workspaceId: WorkspaceId,
   grab: { x: number; y: number },
-): Promise<void> {
+): Promise<boolean> {
   const prepared = await prepare(workspaceId);
-  if (!prepared) return;
-  await handOff(prepared, "open_workspace_window", {
+  if (!prepared) return false;
+  return handOff(prepared, "open_workspace_window", {
     payload: { ...prepared.payload, grab } satisfies MovePayload,
   });
 }

From 3de7748fd4aca344c3996328dc961fa0be94ac12 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 17:38:04 -0700
Subject: [PATCH 2/3] Answer moved once the target adopts, and carry --index
 across windows

`dor workspace move` reported `moved` the moment Rust took the invoke,
but the target can still close mid-transfer or the watchdog can hand the
Workspace back, so a script chaining `dor list --window` behind it read a
move that never happened. `transferWorkspaceTo` / `tearOutWorkspace` now
resolve only when `workspace-departed` (adopted) or
`workspace-arrival-failed` (handed back, with Rust's reason) arrives for
that Workspace, from a per-Workspace deferred settled by `handleDeparted`
and `handleArrivalFailed`; a refused invoke settles at once. The Tauri
adapter rejects with the reason, so the CLI prints `was not moved: ...`.
A window emptied by the move now issues `close_window` on a later task,
so the answer leaves the webview before Rust destroys it. The drag
callers keep ignoring the outcome.

`--index` was dropped on a move between windows: the cross-window branch
answered before the reorder and the payload carried no slot. The payload
now has an optional `index`, which the target reads ahead of the
pointer-derived slot; it is threaded through `PlatformAdapter.
transferWorkspace(workspaceId, toWindow, { index })`. A tear-out has one
tab, so the adapter does not forward it there.

The strip's move gate now waits behind a close confirmation (the two key
handlers are siblings on one node, so with both pending the close's
letter could also move the Workspace), and ignores a bare Shift or Meta
the way the pane kill confirmation does.

`--index` parses through a shared `parseNonNegativeInt` beside
`parsePositiveInt`, so its failure reads like every other flag's
(`invalid --index 'x'`). `dor list --workspaces --window <label>` was
refused by the overview's flag allowlist despite its usage line; the
allowlist now admits `--window`.

dor tests pin the `move` request shape, the four flag-misuse errors, the
invalid index, and `list --window`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RChsJ5rMUMyfu22UZDfUus
---
 docs/specs/dor-cli.md                         |   2 +-
 dor/src/commands/list.ts                      |   4 +-
 dor/src/commands/shared.ts                    |   9 ++
 dor/src/commands/workspace.ts                 |  11 +-
 dor/test/cli-output.test.mjs                  |  37 ++++++
 dor/test/snapshots/help/workspace.md          |   2 +-
 .../list-workspaces-with-filter.snap          |   2 +-
 .../workspace-destroy-iframe-misuse.snap      |   5 +
 .../snapshots/workspace-index-misuse.snap     |   5 +
 .../snapshots/workspace-invalid-index.snap    |   5 +
 .../snapshots/workspace-move-needs-flag.snap  |   5 +
 dor/test/snapshots/workspace-move.snap        |   5 +
 .../snapshots/workspace-window-misuse.snap    |   5 +
 lib/src/components/WorkspaceStrip.test.tsx    |  46 +++++++-
 lib/src/components/WorkspaceStrip.tsx         |  12 +-
 .../components/wall/workspace-control.test.ts |  41 ++++++-
 lib/src/components/wall/workspace-control.ts  |   6 +-
 lib/src/lib/platform/types.ts                 |   9 +-
 standalone/src/tauri-adapter.ts               |  15 ++-
 standalone/src/workspace-move.test.ts         |  91 +++++++++++----
 standalone/src/workspace-move.ts              | 107 ++++++++++++------
 21 files changed, 341 insertions(+), 83 deletions(-)
 create mode 100644 dor/test/snapshots/workspace-destroy-iframe-misuse.snap
 create mode 100644 dor/test/snapshots/workspace-index-misuse.snap
 create mode 100644 dor/test/snapshots/workspace-invalid-index.snap
 create mode 100644 dor/test/snapshots/workspace-move-needs-flag.snap
 create mode 100644 dor/test/snapshots/workspace-move.snap
 create mode 100644 dor/test/snapshots/workspace-window-misuse.snap

diff --git a/docs/specs/dor-cli.md b/docs/specs/dor-cli.md
index dcb6e177c..77f687d6d 100644
--- a/docs/specs/dor-cli.md
+++ b/docs/specs/dor-cli.md
@@ -456,7 +456,7 @@ Wall (Handle Model), and each takes a `workspace:<n|name>` target except `new`:
 | `rename <ref> <name>` | Renames the Workspace only — no Surface title (`docs/specs/layout.md` → "Workspaces"). |
 | `close <ref> [--force]` | **Refuses, raising no confirmation, when the Workspace holds a touched or running Surface** unless `--force` — the caller is a command, not someone watching the Wall, exactly as `dor kill` archives silently. The last Workspace, a Workspace whose close meets another already in flight, and one whose Wall never registers (`still mounting`, after the routing retry — closing past it would leave its Sessions running with nothing holding them) refuse too. Member Surfaces close through the closure coordinator, and a refusal leaves the Workspace open and the user where they were (`docs/specs/notepad.md` → "Closure"). |
 | `switch <ref>` | Activates it. |
-| `move <ref> [--window <label\|new>] [--index <n>] [--dangerously-destroy-iframe-page-state]` | To another Window (`new` tears out), a strip position, or both; the Window handling it runs the same transfer the strip's drag does (`docs/specs/standalone.md` → Transfer), with no pointer to place the tab by. **Refuses a move between Windows while the Workspace holds a plain iframe Surface unless the flag is passed**, naming them: the page state is lost (`docs/specs/layout.md` → Workspaces). A host with one Window reorders only. |
+| `move <ref> [--window <label\|new>] [--index <n>] [--dangerously-destroy-iframe-page-state]` | To another Window (`new` tears out), a strip position, or both — with both, the position is in the target's strip; the Window handling it runs the same transfer the strip's drag does (`docs/specs/standalone.md` → Transfer), with no pointer to place the tab by. **Answers `moved` only once the target Window has adopted the Workspace**; one handed back (the target closed mid-transfer, or never answered) is an error naming the reason, and the Workspace stays where it was. **Refuses a move between Windows while the Workspace holds a plain iframe Surface unless the flag is passed**, naming them: the page state is lost (`docs/specs/layout.md` → Workspaces). A host with one Window reorders only. |
 
 **Each verb ships as one action of one command**, not a route map: the published
 CLI reference renders one help page per top-level command
diff --git a/dor/src/commands/list.ts b/dor/src/commands/list.ts
index 07b78229a..beab009b5 100644
--- a/dor/src/commands/list.ts
+++ b/dor/src/commands/list.ts
@@ -215,7 +215,7 @@ async function runListCommand(
 
 /** The only flags the Workspace overview takes — an allowlist, so a flag added
  *  to this command is refused there until it is named here. */
-const WORKSPACES_FLAGS: ReadonlySet<keyof ListFlags> = new Set(['json', 'workspaces']);
+const WORKSPACES_FLAGS: ReadonlySet<keyof ListFlags> = new Set(['json', 'window', 'workspaces']);
 
 /** A flag as the user typed it, from the name stricli parsed it into. */
 function flagSpelling(name: string): string {
@@ -234,7 +234,7 @@ function checkScopeFlags(flags: ListFlags): { ok: true } | { ok: false; message:
       .map((name) => flagSpelling(name))
       .sort();
     if (others.length > 0) {
-      return { ok: false, message: `dor list --workspaces takes only --json, not ${others.join(', ')}` };
+      return { ok: false, message: `dor list --workspaces takes only --json and --window, not ${others.join(', ')}` };
     }
   }
   return { ok: true };
diff --git a/dor/src/commands/shared.ts b/dor/src/commands/shared.ts
index 80772d39d..dd921b042 100644
--- a/dor/src/commands/shared.ts
+++ b/dor/src/commands/shared.ts
@@ -34,6 +34,15 @@ export function parsePositiveInt(input: string, flag: string, max = Number.POSIT
   return value;
 }
 
+/** Flag parser for non-negative integers (`--index`, 0-based). */
+export function parseNonNegativeInt(input: string, flag: string): number {
+  const value = Number(input);
+  if (input.trim() === '' || !Number.isInteger(value) || value < 0) {
+    throw new SyntaxError(`invalid ${flag} '${input}'`);
+  }
+  return value;
+}
+
 export function renderJson(payload: unknown): string {
   return `${JSON.stringify(payload, null, 2)}\n`;
 }
diff --git a/dor/src/commands/workspace.ts b/dor/src/commands/workspace.ts
index a3992c32f..c472cacb0 100644
--- a/dor/src/commands/workspace.ts
+++ b/dor/src/commands/workspace.ts
@@ -19,6 +19,7 @@ import type {
 } from './types.js';
 import {
   errorMessage,
+  parseNonNegativeInt,
   renderJson,
   requireControlClient,
   stringParser,
@@ -112,7 +113,7 @@ new creates a Workspace in the background and prints its ref: it never moves the
 
 close archives and kills every Surface in the Workspace. It refuses — raising no confirmation, because the caller is a command rather than someone watching the Wall — when the Workspace holds a Surface the user has typed into or a running command; --force closes it anyway. The last remaining Workspace cannot be closed.
 
-move puts a Workspace in another window (--window <label>, or --window new to tear it out into its own) and/or at a strip position (--index <n>, 0-based). Nothing is archived or killed: its terminals, notes, and pins travel whole. The one thing a move between windows cannot carry is a plain iframe's page state — the document cannot leave its webview, so the iframe reopens at its saved URL — and the move is refused when the Workspace holds one unless --dangerously-destroy-iframe-page-state is passed. Agent-browser Surfaces are not affected.
+move puts a Workspace in another window (--window <label>, or --window new to tear it out into its own) and/or at a strip position (--index <n>, 0-based; with --window, a position in that window's strip). Nothing is archived or killed: its terminals, notes, and pins travel whole. "moved" is printed only once the target window has adopted the Workspace; one it hands back (it closed mid-transfer, or never answered) is an error naming the reason, and the Workspace stays where it was. The one thing a move between windows cannot carry is a plain iframe's page state — the document cannot leave its webview, so the iframe reopens at its saved URL — and the move is refused when the Workspace holds one unless --dangerously-destroy-iframe-page-state is passed. Agent-browser Surfaces are not affected.
 
 Text output:
   created workspace:2 "build"
@@ -132,7 +133,7 @@ JSON output:
         force: { kind: 'boolean', brief: 'Close even when the Workspace holds running or touched Surfaces.', optional: true, withNegated: false },
         json: { kind: 'boolean', brief: 'Print JSON output.', optional: true, withNegated: false },
         window: { kind: 'parsed', parse: stringParser, brief: 'move: the window to move to (a label, or "new").', optional: true, placeholder: 'label' },
-        index: { kind: 'parsed', parse: indexParser, brief: 'move: the 0-based strip position to move to.', optional: true, placeholder: 'n' },
+        index: { kind: 'parsed', parse: (value) => parseNonNegativeInt(value, '--index'), brief: 'move: the 0-based strip position to move to.', optional: true, placeholder: 'n' },
         dangerouslyDestroyIframePageState: { kind: 'boolean', brief: 'move: accept losing every iframe Surface\'s page state.', optional: true, withNegated: false },
       },
       positional: {
@@ -180,12 +181,6 @@ async function runWorkspaceCommand(
   }
 }
 
-function indexParser(value: string): number {
-  const index = Number(value);
-  if (!Number.isInteger(index) || index < 0) throw new Error(`--index must be a non-negative integer, got '${value}'`);
-  return index;
-}
-
 function parseAction(value: string | undefined): ParseResult<WorkspaceAction> {
   const action = ACTION_NAMES.find((candidate) => candidate === value);
   if (action) return { ok: true, value: action };
diff --git a/dor/test/cli-output.test.mjs b/dor/test/cli-output.test.mjs
index 8fc7cbfa2..1c07e4255 100644
--- a/dor/test/cli-output.test.mjs
+++ b/dor/test/cli-output.test.mjs
@@ -306,6 +306,11 @@ function fixtureClient(surfacesFixture = fixtureSurfaces) {
       const target = fixtureWorkspace(request.workspace);
       return { status: 'active', workspaceId: target.id, workspaceRef: target.ref, name: target.name };
     },
+    async moveWorkspace(request) {
+      this.requests.push({ method: 'moveWorkspace', request });
+      const target = fixtureWorkspace(request.workspace);
+      return { status: 'moved', workspaceId: target.id, workspaceRef: target.ref, name: target.name };
+    },
     async resolveOpenTarget(request) {
       this.requests.push({ method: 'resolveOpenTarget', request });
       // Mirror the host: surface:1 owns port 5173; surface:2 owns nothing.
@@ -1473,6 +1478,38 @@ test('workspace close refuses running work until forced', async () => {
   assert.deepEqual(client.requests, [{ method: 'closeWorkspace', request: { workspace: 'workspace:2', force: true } }]);
 });
 
+test('workspace move sends the window and the index in one request', async () => {
+  // `--window` becomes `toWindow` and `--index` rides beside it: the slot is
+  // the target's, and the host carries it across rather than dropping it.
+  const client = fixtureClient();
+  await snapshot(
+    'workspace-move',
+    await runCli(['workspace', 'move', 'build', '--window', 'ws-2', '--index', '0'], { client, env: listEnv }),
+  );
+  assert.deepEqual(client.requests, [{
+    method: 'moveWorkspace',
+    request: { workspace: 'build', toWindow: 'ws-2', index: 0, dangerouslyDestroyIframePageState: false },
+  }]);
+});
+
+test('workspace move flags are refused off the action, and move needs one of them', async () => {
+  await snapshot('workspace-window-misuse', await runCli(['workspace', 'switch', '2', '--window', 'ws-2'], { client: fixtureClient(), env: listEnv }));
+  await snapshot('workspace-index-misuse', await runCli(['workspace', 'switch', '2', '--index', '0'], { client: fixtureClient(), env: listEnv }));
+  await snapshot('workspace-destroy-iframe-misuse', await runCli(['workspace', 'switch', '2', '--dangerously-destroy-iframe-page-state'], { client: fixtureClient(), env: listEnv }));
+  await snapshot('workspace-move-needs-flag', await runCli(['workspace', 'move', '2'], { client: fixtureClient(), env: listEnv }));
+  await snapshot('workspace-invalid-index', await runCli(['workspace', 'move', '2', '--index', 'x'], { client: fixtureClient(), env: listEnv }));
+});
+
+test('list --window asks the host for another window', async () => {
+  const client = fixtureClient();
+  await runCli(['list', '--window', 'ws-2'], { client, env: listEnv });
+  await runCli(['list', '--workspaces', '--window', 'ws-2'], { client, env: listEnv });
+  assert.deepEqual(client.requests, [
+    { includePorts: false, window: 'ws-2' },
+    { method: 'listWorkspaces', request: { window: 'ws-2' } },
+  ]);
+});
+
 test('workspace usage errors name the action', async () => {
   await snapshot('workspace-missing-action', await runCli(['workspace'], { client: fixtureClient(), env: listEnv }));
   await snapshot('workspace-unknown-action', await runCli(['workspace', 'destroy', 'x'], { client: fixtureClient(), env: listEnv }));
diff --git a/dor/test/snapshots/help/workspace.md b/dor/test/snapshots/help/workspace.md
index 3e21bd195..100dc562e 100644
--- a/dor/test/snapshots/help/workspace.md
+++ b/dor/test/snapshots/help/workspace.md
@@ -19,7 +19,7 @@ new creates a Workspace in the background and prints its ref: it never moves the
 
 close archives and kills every Surface in the Workspace. It refuses — raising no confirmation, because the caller is a command rather than someone watching the Wall — when the Workspace holds a Surface the user has typed into or a running command; --force closes it anyway. The last remaining Workspace cannot be closed.
 
-move puts a Workspace in another window (--window <label>, or --window new to tear it out into its own) and/or at a strip position (--index <n>, 0-based). Nothing is archived or killed: its terminals, notes, and pins travel whole. The one thing a move between windows cannot carry is a plain iframe's page state — the document cannot leave its webview, so the iframe reopens at its saved URL — and the move is refused when the Workspace holds one unless --dangerously-destroy-iframe-page-state is passed. Agent-browser Surfaces are not affected.
+move puts a Workspace in another window (--window <label>, or --window new to tear it out into its own) and/or at a strip position (--index <n>, 0-based; with --window, a position in that window's strip). Nothing is archived or killed: its terminals, notes, and pins travel whole. "moved" is printed only once the target window has adopted the Workspace; one it hands back (it closed mid-transfer, or never answered) is an error naming the reason, and the Workspace stays where it was. The one thing a move between windows cannot carry is a plain iframe's page state — the document cannot leave its webview, so the iframe reopens at its saved URL — and the move is refused when the Workspace holds one unless --dangerously-destroy-iframe-page-state is passed. Agent-browser Surfaces are not affected.
 
 Text output:
   created workspace:2 "build"
diff --git a/dor/test/snapshots/list-workspaces-with-filter.snap b/dor/test/snapshots/list-workspaces-with-filter.snap
index ca89853a5..c7d07795a 100644
--- a/dor/test/snapshots/list-workspaces-with-filter.snap
+++ b/dor/test/snapshots/list-workspaces-with-filter.snap
@@ -2,4 +2,4 @@ exitCode: 1
 stdout:
 
 stderr:
-Error: dor list --workspaces takes only --json, not --kind
+Error: dor list --workspaces takes only --json and --window, not --kind
diff --git a/dor/test/snapshots/workspace-destroy-iframe-misuse.snap b/dor/test/snapshots/workspace-destroy-iframe-misuse.snap
new file mode 100644
index 000000000..48bc1392a
--- /dev/null
+++ b/dor/test/snapshots/workspace-destroy-iframe-misuse.snap
@@ -0,0 +1,5 @@
+exitCode: 1
+stdout:
+
+stderr:
+Error: --dangerously-destroy-iframe-page-state applies only to dor workspace move
diff --git a/dor/test/snapshots/workspace-index-misuse.snap b/dor/test/snapshots/workspace-index-misuse.snap
new file mode 100644
index 000000000..6a9c3b571
--- /dev/null
+++ b/dor/test/snapshots/workspace-index-misuse.snap
@@ -0,0 +1,5 @@
+exitCode: 1
+stdout:
+
+stderr:
+Error: --index applies only to dor workspace move
diff --git a/dor/test/snapshots/workspace-invalid-index.snap b/dor/test/snapshots/workspace-invalid-index.snap
new file mode 100644
index 000000000..833ee3af9
--- /dev/null
+++ b/dor/test/snapshots/workspace-invalid-index.snap
@@ -0,0 +1,5 @@
+exitCode: 1
+stdout:
+
+stderr:
+Error: Failed to parse "x" for index: invalid --index 'x'
diff --git a/dor/test/snapshots/workspace-move-needs-flag.snap b/dor/test/snapshots/workspace-move-needs-flag.snap
new file mode 100644
index 000000000..e72cd5716
--- /dev/null
+++ b/dor/test/snapshots/workspace-move-needs-flag.snap
@@ -0,0 +1,5 @@
+exitCode: 1
+stdout:
+
+stderr:
+Error: dor workspace move needs --window, --index, or both
diff --git a/dor/test/snapshots/workspace-move.snap b/dor/test/snapshots/workspace-move.snap
new file mode 100644
index 000000000..ab3c99948
--- /dev/null
+++ b/dor/test/snapshots/workspace-move.snap
@@ -0,0 +1,5 @@
+exitCode: 0
+stdout:
+moved workspace:2 "build"
+
+stderr:
diff --git a/dor/test/snapshots/workspace-window-misuse.snap b/dor/test/snapshots/workspace-window-misuse.snap
new file mode 100644
index 000000000..85f40ab8a
--- /dev/null
+++ b/dor/test/snapshots/workspace-window-misuse.snap
@@ -0,0 +1,5 @@
+exitCode: 1
+stdout:
+
+stderr:
+Error: --window applies only to dor workspace move
diff --git a/lib/src/components/WorkspaceStrip.test.tsx b/lib/src/components/WorkspaceStrip.test.tsx
index 25e3f211a..668309d04 100644
--- a/lib/src/components/WorkspaceStrip.test.tsx
+++ b/lib/src/components/WorkspaceStrip.test.tsx
@@ -11,7 +11,12 @@ import { ensureResizeObserver } from './wall/wall-test-utils';
 import { requestWorkspaceClose, requestWorkspaceRename } from './wall/workspace-lifecycle';
 import { resetWorkspaceSurfaces, setWorkspaceSurfaces } from '../lib/workspace-surfaces';
 import { clearTerminalActivity, setTerminalActivity } from '../lib/terminal-registry';
-import { resetWorkspaceUi } from '../lib/workspace-ui-store';
+import {
+  getWorkspaceUiSnapshot,
+  resetWorkspaceUi,
+  setPendingWorkspaceClose,
+  setPendingWorkspaceMove,
+} from '../lib/workspace-ui-store';
 import {
   createWorkspace,
   getActiveWorkspaceId,
@@ -278,4 +283,43 @@ describe('WorkspaceStrip', () => {
     await act(async () => { requestWorkspaceClose('ws-2'); });
     expect(closed).toHaveBeenCalled();
   });
+
+  it('keeps the move gate behind a close confirmation, and ignores a bare Shift or Meta', async () => {
+    const first = getWorkspacesSnapshot().workspaces[0].id;
+    await act(async () => { createWorkspace({ id: 'ws-2' }); });
+    stubHandle(first);
+    const closed = vi.fn(async () => null);
+    stubHandle('ws-2', { closeAll: closed });
+    await render();
+    const proceed = vi.fn();
+    await act(async () => { setPendingWorkspaceMove({ id: first, char: 'k', iframeCount: 1, proceed }); });
+    expect(container.querySelector('#kill-confirm-title')).not.toBeNull();
+
+    // A bare modifier is the dual-tap detector's, never an answer to the gate.
+    await act(async () => {
+      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Shift', bubbles: true }));
+      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Meta', bubbles: true }));
+    });
+    expect(proceed).not.toHaveBeenCalled();
+    expect(getWorkspaceUiSnapshot().pendingMove).not.toBeNull();
+
+    // A close raised over it shows its own letter; the same letter typed at it
+    // closes and must not also move, however the two were minted.
+    await act(async () => { setPendingWorkspaceClose({ id: 'ws-2', char: 'k' }); });
+    await act(async () => {
+      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', bubbles: true }));
+    });
+    await act(async () => { await Promise.resolve(); });
+    expect(closed).toHaveBeenCalledTimes(1);
+    expect(proceed).not.toHaveBeenCalled();
+    expect(getWorkspaceUiSnapshot().pendingClose).toBeNull();
+    expect(getWorkspaceUiSnapshot().pendingMove).not.toBeNull();
+
+    // With the close resolved the gate is armed again, and its letter moves.
+    await act(async () => {
+      window.dispatchEvent(new KeyboardEvent('keydown', { key: 'k', bubbles: true }));
+    });
+    expect(proceed).toHaveBeenCalledTimes(1);
+    expect(getWorkspaceUiSnapshot().pendingMove).toBeNull();
+  });
 });
diff --git a/lib/src/components/WorkspaceStrip.tsx b/lib/src/components/WorkspaceStrip.tsx
index cfb5a1e75..c59829c8b 100644
--- a/lib/src/components/WorkspaceStrip.tsx
+++ b/lib/src/components/WorkspaceStrip.tsx
@@ -142,19 +142,25 @@ export function WorkspaceStrip({
   }, [pendingClose]);
 
   // The move gate is the same typed letter: the page state it destroys is as
-  // gone as a killed pane's process.
+  // gone as a killed pane's process. It waits behind a close confirmation,
+  // which the render below shows instead: the letter on screen is the close's,
+  // and a key typed at it must reach that handler alone — the two are siblings
+  // on one node, so `stopPropagation` would not keep it from this one.
   useEffect(() => {
-    if (!pendingMove) return;
+    if (!pendingMove || pendingClose) return;
     const { char, proceed } = pendingMove;
     const onKeyDown = (event: KeyboardEvent) => {
       event.preventDefault();
       event.stopPropagation();
+      // handleDualTap consumes a bare Shift or Meta before the pane kill
+      // confirmation sees it; the strip's own listener keeps the same rule.
+      if (event.key === 'Shift' || event.key === 'Meta') return;
       setPendingWorkspaceMove(null);
       if (acceptsKillChar(event.key, char)) proceed();
     };
     window.addEventListener('keydown', onKeyDown, true);
     return () => window.removeEventListener('keydown', onKeyDown, true);
-  }, [pendingMove]);
+  }, [pendingMove, pendingClose]);
 
   // Anchored to the Window's content area, not the tab: a 24px tab is too small
   // a box to center a dialog over, and every Wall shares one grid cell, so the
diff --git a/lib/src/components/wall/workspace-control.test.ts b/lib/src/components/wall/workspace-control.test.ts
index e1d60a832..d18275133 100644
--- a/lib/src/components/wall/workspace-control.test.ts
+++ b/lib/src/components/wall/workspace-control.test.ts
@@ -166,7 +166,7 @@ describe('workspace.move', () => {
       workspace: 'workspace:7', toWindow: 'window:ws-2', dangerouslyDestroyIframePageState: true,
     });
     await handleWorkspaceControl(forced);
-    expect(transferWorkspace).toHaveBeenCalledWith(second, 'ws-2');
+    expect(transferWorkspace).toHaveBeenCalledWith(second, 'ws-2', {});
     expect(answer(forced)).toMatchObject({ status: 'moved', workspaceRef: 'workspace:7' });
 
     transferWorkspace.mockRejectedValueOnce(new Error('the host refused'));
@@ -174,6 +174,45 @@ describe('workspace.move', () => {
     await handleWorkspaceControl(failed);
     expect(answer(failed)).toMatch(/was not moved: the host refused/);
   });
+
+  it('carries --index to the target window rather than reordering here', async () => {
+    const second = createWorkspace({ id: 'workspace-7', name: 'build', activate: false }).id;
+    handleFor(getWorkspacesSnapshot().workspaces[0].id);
+    handleFor(second);
+    const transferWorkspace = vi.fn(async () => {});
+    setPlatform({ transferWorkspace } as unknown as PlatformAdapter);
+
+    const both = request('workspace.move', { workspace: 'workspace:7', toWindow: 'ws-2', index: 0 });
+    await handleWorkspaceControl(both);
+    expect(transferWorkspace).toHaveBeenCalledWith(second, 'ws-2', { index: 0 });
+    expect(answer(both)).toMatchObject({ status: 'moved', workspaceRef: 'workspace:7' });
+    // The slot it names is the target's: this strip is not reordered on the way out.
+    expect(getWorkspacesSnapshot().workspaces.map((workspace) => workspace.id)[1]).toBe(second);
+  });
+
+  it('answers moved only once the target has adopted the Workspace, and the hand-back reason otherwise', async () => {
+    const second = createWorkspace({ id: 'workspace-7', name: 'build', activate: false }).id;
+    handleFor(getWorkspacesSnapshot().workspaces[0].id);
+    handleFor(second);
+    let adopt!: () => void;
+    const transferWorkspace = vi.fn(() => new Promise<void>((resolve) => { adopt = resolve; }));
+    setPlatform({ transferWorkspace } as unknown as PlatformAdapter);
+
+    const pending = request('workspace.move', { workspace: 'workspace:7', toWindow: 'ws-2' });
+    const running = handleWorkspaceControl(pending);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(transferWorkspace).toHaveBeenCalled();
+    // The host took the hand-off; nothing is said until the target settles it.
+    expect(pending.respond).not.toHaveBeenCalled();
+    adopt();
+    await running;
+    expect(answer(pending)).toMatchObject({ status: 'moved', workspaceRef: 'workspace:7' });
+
+    transferWorkspace.mockRejectedValueOnce(new Error('the target window closed mid-arrival'));
+    const handedBack = request('workspace.move', { workspace: 'workspace:7', toWindow: 'ws-2' });
+    await handleWorkspaceControl(handedBack);
+    expect(answer(handedBack)).toBe("workspace 'workspace:7' was not moved: the target window closed mid-arrival");
+  });
 });
 
 describe('workspace.close', () => {
diff --git a/lib/src/components/wall/workspace-control.ts b/lib/src/components/wall/workspace-control.ts
index e4cf9b29b..2c453178f 100644
--- a/lib/src/components/wall/workspace-control.ts
+++ b/lib/src/components/wall/workspace-control.ts
@@ -260,8 +260,12 @@ export async function handleWorkspaceControl(detail: DorControlRequest): Promise
           return;
         }
         const label = toWindow.startsWith('window:') ? toWindow.slice('window:'.length) : toWindow;
+        // The index travels with it: the slot it names is in the target's strip.
+        // `moved` only once that Window has adopted the Workspace; one handed
+        // back is an error naming why, and it is still here
+        // (`docs/specs/dor-cli.md` → "dor workspace").
         try {
-          await platform.transferWorkspace(target.id, label);
+          await platform.transferWorkspace(target.id, label, index === undefined ? {} : { index });
         } catch (err) {
           detail.respond({ ok: false, error: `workspace '${target.ref}' was not moved: ${errorText(err)}` });
           return;
diff --git a/lib/src/lib/platform/types.ts b/lib/src/lib/platform/types.ts
index 7334d84c1..735eae40f 100644
--- a/lib/src/lib/platform/types.ts
+++ b/lib/src/lib/platform/types.ts
@@ -412,10 +412,11 @@ export interface PlatformAdapter {
    *  unsubscribe. Absent on hosts with one window. */
   onPtyMarked?(handler: (detail: PtyMarkedDetail) => void): () => void;
   /** Hand a Workspace to another window — a label, or `'new'` for one torn out
-   *  — through the host's transfer (`docs/specs/standalone.md` → Transfer).
-   *  Resolves once the host has accepted the hand-off. Absent on hosts with
-   *  one window. */
-  transferWorkspace?(workspaceId: string, toWindow: string): Promise<void>;
+   *  — through the host's transfer (`docs/specs/standalone.md` → Transfer),
+   *  `index` naming its slot in the target's strip (appended without one).
+   *  Resolves once the target has adopted it; rejects when it was handed back.
+   *  Absent on hosts with one window. */
+  transferWorkspace?(workspaceId: string, toWindow: string, options?: { index?: number }): Promise<void>;
 
   // Host-initiated session persistence
   onRequestSessionFlush(handler: (detail: SessionFlushRequest) => void): void;
diff --git a/standalone/src/tauri-adapter.ts b/standalone/src/tauri-adapter.ts
index 524cca24e..1bf710dc4 100644
--- a/standalone/src/tauri-adapter.ts
+++ b/standalone/src/tauri-adapter.ts
@@ -585,14 +585,17 @@ export class TauriAdapter implements PlatformAdapter {
 
   /** `dor workspace move` between windows: the same transfer the strip's drag
    *  runs, with no pointer to place the tab by (docs/specs/standalone.md →
-   *  Transfer). Imported on use: `workspace-move` pulls the whole move
-   *  protocol in, which a window that never moves anything need not load. */
-  async transferWorkspace(workspaceId: string, toWindow: string): Promise<void> {
+   *  Transfer). Settles as the transaction does: resolved once the target has
+   *  adopted the Workspace, rejected with the host's reason when it was handed
+   *  back. Imported on use: `workspace-move` pulls the whole move protocol in,
+   *  which a window that never moves anything need not load. */
+  async transferWorkspace(workspaceId: string, toWindow: string, options: { index?: number } = {}): Promise<void> {
     const { tearOutWorkspace, transferWorkspaceTo } = await import("./workspace-move");
-    const accepted = toWindow === "new"
+    // A torn-out window has one tab, so an index names no slot there.
+    const outcome = toWindow === "new"
       ? await tearOutWorkspace(workspaceId, { x: 0, y: 0 })
-      : await transferWorkspaceTo(workspaceId, toWindow);
-    if (!accepted) throw new Error(`the host refused to move the Workspace to '${toWindow}'`);
+      : await transferWorkspaceTo(workspaceId, toWindow, undefined, options.index);
+    if (!outcome.moved) throw new Error(outcome.reason);
   }
 
   onPtyMarked(handler: (detail: PtyMarkedDetail) => void): () => void {
diff --git a/standalone/src/workspace-move.test.ts b/standalone/src/workspace-move.test.ts
index d95aa13b1..1117c7f6b 100644
--- a/standalone/src/workspace-move.test.ts
+++ b/standalone/src/workspace-move.test.ts
@@ -78,6 +78,12 @@ const WORKSPACE_ID = "ws-moving";
 /** Drain the microtask chain the arrival drain runs on. */
 const settle = () => new Promise((r) => setTimeout(r, 0));
 
+/** The source's second half has gone over: the marks passed and the content
+ *  followed. A hand-off resolves only when the target settles it, so a test
+ *  that needs the invoke sequence waits for this rather than the call. */
+const contentSent = () => vi.waitFor(() =>
+  expect(mocks.invoke).toHaveBeenCalledWith("transfer_workspace_content", expect.anything()));
+
 function payload(overrides: Partial<WorkspaceTransferPayload> = {}): WorkspaceTransferPayload {
   return {
     workspaceId: WORKSPACE_ID,
@@ -210,29 +216,45 @@ const emit = async (event: string, data: unknown) => {
 describe("the source half", () => {
   it("prepares the Workspace, tells the host, and commits only when it lands", async () => {
     const order: string[] = [];
-    mocks.invoke.mockImplementation(async (cmd: string) => void order.push(cmd));
     registerWallHandle(stubWallHandle(WORKSPACE_ID, {
       prepareWorkspaceTransfer: async () => {
         order.push("prepare");
         return prepared(() => order.push("commit"));
       },
     }));
-    initWorkspaceMoves(fakePlatform());
-    mocks.invoke.mockImplementation(async (cmd: string) => void order.push(cmd));
+    initWorkspaceMoves(fakePlatform(order));
 
-    await transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    const moved = transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    await contentSent();
 
     // The record is built while the Sessions are live. Nothing is released at
     // the invoke: the target can still refuse, and a Workspace released here
-    // would have no Sessions and no window that owned them.
-    // The content follows once the marks pass: the fake host stamps none,
-    // so it is serialized at once and replayed whole.
-    expect(order).toEqual(["prepare", "transfer_workspace", "transfer_workspace_content"]);
+    // would have no Sessions and no window that owned them. The content
+    // follows once the marks pass.
+    expect(order.filter((cmd) => cmd !== "take_arrivals"))
+      .toEqual(["prepare", "transfer_workspace", "transfer_workspace_content"]);
     const [, args] = mocks.invoke.mock.calls.find(([cmd]) => cmd === "transfer_workspace")!;
     expect(args).toMatchObject({ to: "ws-2", payload: { at: { x: 10, y: 4 }, terminalIds: ["pane-a"] } });
+    expect(order).not.toContain("commit");
 
     await emit("dormouse://workspace-departed", { workspaceId: WORKSPACE_ID });
     expect(order).toContain("commit");
+    // `moved` is the target's adoption, not the host taking the invoke: a
+    // caller told sooner (`dor workspace move`) would read a move that can
+    // still be handed back.
+    await expect(moved).resolves.toEqual({ moved: true });
+  });
+
+  it("carries a strip slot named outright, which the target reads ahead of a pointer", async () => {
+    registerWallHandle(stubWallHandle(WORKSPACE_ID, { prepareWorkspaceTransfer: async () => prepared() }));
+    initWorkspaceMoves(fakePlatform());
+
+    void transferWorkspaceTo(WORKSPACE_ID, "ws-2", undefined, 2);
+    await settle();
+
+    const [, args] = mocks.invoke.mock.calls.find(([cmd]) => cmd === "transfer_workspace")!;
+    expect(args).toMatchObject({ to: "ws-2", payload: { index: 2 } });
+    expect((args as { payload: { at?: unknown } }).payload.at).toBeUndefined();
   });
 
   it("keeps a transferring Workspace out of every snapshot until it settles", async () => {
@@ -246,12 +268,15 @@ describe("the source half", () => {
     }));
     expect(getWindowSnapshot().workspaces.map((w) => w.id)).toContain(WORKSPACE_ID);
 
-    await transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    const moved = transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    await settle();
     expect(getWindowSnapshot().workspaces.map((w) => w.id)).not.toContain(WORKSPACE_ID);
 
-    // Refused: it is this Window's again, snapshot included.
+    // Refused: it is this Window's again, snapshot included, and the caller
+    // hears the host's reason rather than `moved`.
     await emit("dormouse://workspace-arrival-failed", { workspaceId: WORKSPACE_ID, reason: "closed" });
     expect(getWindowSnapshot().workspaces.map((w) => w.id)).toContain(WORKSPACE_ID);
+    await expect(moved).resolves.toEqual({ moved: false, reason: "closed" });
   });
 
   it("keeps the Workspace, with its Sessions, when the target never adopts it", async () => {
@@ -264,7 +289,8 @@ describe("the source half", () => {
     }));
     createWorkspace({ id: WORKSPACE_ID, name: "Deploys" });
 
-    await transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    const moved = transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    await settle();
     await emit("dormouse://workspace-arrival-failed", {
       workspaceId: WORKSPACE_ID,
       reason: "the target window closed mid-arrival",
@@ -272,6 +298,7 @@ describe("the source half", () => {
 
     expect(committed).not.toHaveBeenCalled();
     expect(getWorkspacesSnapshot().workspaces.map((w) => w.id)).toContain(WORKSPACE_ID);
+    await expect(moved).resolves.toEqual({ moved: false, reason: "the target window closed mid-arrival" });
   });
 
   it("releases only the Workspace that departed", async () => {
@@ -284,7 +311,8 @@ describe("the source half", () => {
       registerWallHandle(stubWallHandle(id, {
         prepareWorkspaceTransfer: async () => prepared(commit, { workspaceId: id }),
       }));
-      await transferWorkspaceTo(id, "ws-2", { x: 0, y: 0 });
+      void transferWorkspaceTo(id, "ws-2", { x: 0, y: 0 });
+      await settle();
     }
 
     await emit("dormouse://workspace-departed", { workspaceId: "ws-a" });
@@ -302,7 +330,9 @@ describe("the source half", () => {
       prepareWorkspaceTransfer: async () => prepared(committed),
     }));
 
-    await transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 });
+    // A refused invoke settles at once, with the host's reason.
+    await expect(transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 10, y: 4 }))
+      .resolves.toEqual({ moved: false, reason: "no window 'ws-2'" });
 
     expect(committed).not.toHaveBeenCalled();
   });
@@ -314,7 +344,8 @@ describe("the source half", () => {
       prepareWorkspaceTransfer: async () => prepared(committed),
     }));
 
-    await tearOutWorkspace(WORKSPACE_ID, { x: 90, y: 12 });
+    await expect(tearOutWorkspace(WORKSPACE_ID, { x: 90, y: 12 }))
+      .resolves.toEqual({ moved: false, reason: "build window ws-3: no display" });
 
     expect(committed).not.toHaveBeenCalled();
   });
@@ -323,14 +354,15 @@ describe("the source half", () => {
     registerWallHandle(stubWallHandle(WORKSPACE_ID, { prepareWorkspaceTransfer: async () => prepared() }));
     // Only Rust knows where the cursor is on screen, so the payload carries
     // where the tab should sit inside the new window rather than a position.
-    await tearOutWorkspace(WORKSPACE_ID, { x: 90, y: 12 });
+    void tearOutWorkspace(WORKSPACE_ID, { x: 90, y: 12 });
+    await settle();
     expect(mocks.invoke).toHaveBeenCalledWith("open_workspace_window", {
       payload: expect.objectContaining({ grab: { x: 90, y: 12 } }),
     });
   });
 
   it("does nothing when the Workspace has no mounted Wall", async () => {
-    await transferWorkspaceTo("gone", "ws-2", { x: 0, y: 0 });
+    await expect(transferWorkspaceTo("gone", "ws-2", { x: 0, y: 0 })).resolves.toMatchObject({ moved: false });
     expect(mocks.invoke).not.toHaveBeenCalled();
   });
 });
@@ -419,6 +451,18 @@ describe("the target half", () => {
     expect(getWorkspacesSnapshot().workspaces.filter((w) => w.id === WORKSPACE_ID)).toHaveLength(1);
   });
 
+  it("lands at the slot the payload names, ahead of the pointer's", async () => {
+    // `dor workspace move --window ws-2 --index 0` names the target's slot
+    // outright; a drag sends only a point, and with no tab under it appends.
+    createWorkspace({ id: "ws-here", name: "Here" });
+    arrivals = [{ ...payload(), index: 0, at: { x: 900, y: 0 } } as WorkspaceTransferPayload];
+
+    initWorkspaceMoves(fakePlatform());
+    await settle();
+
+    expect(getWorkspacesSnapshot().workspaces[0]?.id).toBe(WORKSPACE_ID);
+  });
+
   it("seeds a persisted TODO into this window's own AlertManager", async () => {
     const platform = fakePlatform();
     const alert = { kind: "todo" } as never;
@@ -458,13 +502,19 @@ describe("the target half", () => {
     registerWallHandle(stubWallHandle(workspaceId, {
       prepareWorkspaceTransfer: async () => prepared(() => {}, { workspaceId }),
     }));
-    await transferWorkspaceTo(workspaceId, "ws-2", { x: 0, y: 0 });
+    const moved = transferWorkspaceTo(workspaceId, "ws-2", { x: 0, y: 0 });
+    await contentSent();
+    const order: string[] = [];
+    void moved.then(() => order.push("answered"));
+    mocks.invoke.mockImplementation(async (cmd: string) => void order.push(cmd));
 
     await emit("dormouse://workspace-departed", { workspaceId });
 
     // Nothing ended — the Surfaces are alive in another window — so this is a
-    // close with no confirmation, no archive and no kill.
-    expect(mocks.invoke).toHaveBeenCalledWith("close_window");
+    // close with no confirmation, no archive and no kill. The caller's answer
+    // goes first: Rust destroys the window on `close_window`, and a `dor
+    // workspace move` that emptied it still has `moved` to say.
+    expect(order).toEqual(["answered", "close_window"]);
     expect(getWorkspacesSnapshot().workspaces).toHaveLength(1);
   });
 });
@@ -477,7 +527,8 @@ describe("a transfer's content", () => {
       prepareWorkspaceTransfer: async () => prepared(),
     }));
 
-    await transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 1, y: 1 });
+    void transferWorkspaceTo(WORKSPACE_ID, "ws-2", { x: 1, y: 1 });
+    await contentSent();
 
     expect(order.filter((cmd) => cmd !== "take_arrivals")).toEqual(["transfer_workspace", "transfer_workspace_content"]);
     const [, args] = mocks.invoke.mock.calls.find(([cmd]) => cmd === "transfer_workspace_content")!;
diff --git a/standalone/src/workspace-move.ts b/standalone/src/workspace-move.ts
index 54c25b28e..fa94ebb8d 100644
--- a/standalone/src/workspace-move.ts
+++ b/standalone/src/workspace-move.ts
@@ -60,6 +60,10 @@ interface MovePayload extends WorkspaceTransferPayload, Partial<WorkspaceTransfe
   /** Where the pointer released, in the target window's logical client space.
    *  The target turns it into a strip index; it alone knows its own tabs. */
   at?: { x: number; y: number };
+  /** The strip slot the caller named outright (`dor workspace move --index`);
+   *  wins over `at`. A drag never sends one, and a tear-out has no use for
+   *  one: its window has one tab. */
+  index?: number;
   /** Where the dragged tab should sit inside the new window, so it lands under
    *  the cursor. Rust turns it into the window's position, because only Rust
    *  knows where the cursor is on the screen. */
@@ -74,6 +78,16 @@ const ARRIVAL_TIMEOUT_MS = 3000;
 
 // --- Source ------------------------------------------------------------------
 
+/** How a hand-off ended: the target adopted the Workspace, or it came back. */
+export type MoveOutcome = { moved: true } | { moved: false; reason: string };
+
+interface InFlightMove {
+  prepared: PreparedWorkspaceTransfer;
+  /** Settles the caller's promise: `handleDeparted` with `moved`,
+   *  `handleArrivalFailed` with the host's reason. */
+  settle: (outcome: MoveOutcome) => void;
+}
+
 /**
  * Workspaces this Window has handed over and not yet released, by id.
  *
@@ -82,7 +96,9 @@ const ARRIVAL_TIMEOUT_MS = 3000;
  * Wall stays mounted, the notes stay put, and the only thing that changed here
  * is that the Workspace is in no snapshot (`markWorkspaceTransferring`).
  */
-const inFlight = new Map<WorkspaceId, PreparedWorkspaceTransfer>();
+const inFlight = new Map<WorkspaceId, InFlightMove>();
+
+const reasonOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));
 
 async function prepare(workspaceId: WorkspaceId): Promise<PreparedWorkspaceTransfer | null> {
   const handle = getWallHandle(workspaceId);
@@ -92,7 +108,12 @@ async function prepare(workspaceId: WorkspaceId): Promise<PreparedWorkspaceTrans
 
 /**
  * Hand the prepared Workspace to Rust and mark it transferring **only on
- * success**.
+ * success**, then wait for the transaction to settle: **`moved` means the
+ * target adopted it** (`workspace-departed`), and a hand-back
+ * (`workspace-arrival-failed`) is the reason Rust gave. The host accepting the
+ * invoke is not a move: the target can still close mid-transfer, or the
+ * watchdog can hand the Workspace back, and a caller told `moved` then would
+ * read one that never happened (`dor workspace move`).
  *
  * A rejected invoke is an ordinary state — the target window can close between
  * the drag's last probe and the drop — and Rust hands the PTYs back to this
@@ -102,30 +123,31 @@ async function handOff(
   prepared: PreparedWorkspaceTransfer,
   command: string,
   args: Record<string, unknown>,
-): Promise<boolean> {
+): Promise<MoveOutcome> {
   try {
     await invoke(command, args);
   } catch (err) {
     console.warn(`[workspace-move] ${command} refused; the Workspace stays here`, err);
-    return false;
+    return { moved: false, reason: reasonOf(err) };
   }
   const { workspaceId, terminalIds } = prepared.payload;
-  inFlight.set(workspaceId, prepared);
+  const outcome = new Promise<MoveOutcome>((settle) => inFlight.set(workspaceId, { prepared, settle }));
   markWorkspaceTransferring(workspaceId);
   // The second half: once every terminal's mark has passed this window, what it
   // holds is exactly the bytes before the mark. Serialized here, attached to the
   // arrival by Rust, and only then drained by the target.
   const marks = await marksFor(terminalIds, `mark-${workspaceId}`);
-  if (!inFlight.has(workspaceId)) return true; // handed back while we waited; the host had accepted
-  const content = await captureTransferContent(terminalIds, marks);
-  try {
-    await invoke("transfer_workspace_content", { workspaceId, content });
-  } catch (err) {
-    // The arrival is gone (the target closed, or the watchdog handed it back);
-    // `workspace-arrival-failed` has put, or will put, this Window back.
-    console.warn("[workspace-move] transfer_workspace_content refused", err);
+  if (inFlight.has(workspaceId)) { // else handed back while we waited: nothing to send
+    const content = await captureTransferContent(terminalIds, marks);
+    try {
+      await invoke("transfer_workspace_content", { workspaceId, content });
+    } catch (err) {
+      // The arrival is gone (the target closed, or the watchdog handed it back);
+      // `workspace-arrival-failed` has put, or will put, this Window back.
+      console.warn("[workspace-move] transfer_workspace_content refused", err);
+    }
   }
-  return true;
+  return outcome;
 }
 
 /** The host stamps marks well inside this; past it, an unmarked id is
@@ -160,29 +182,35 @@ function marksFor(ids: readonly string[], requestId: string): Promise<Map<string
 }
 
 /** Hand this Workspace to a window that already exists. `at` is where the
- *  pointer released in the target's strip; a move with no pointer (`dor
- *  workspace move`) appends. Resolves to whether the host accepted it. */
+ *  pointer released in the target's strip, `index` a slot named outright (`dor
+ *  workspace move --index`), which wins; with neither the target appends.
+ *  Resolves once the target has adopted it, or handed it back. */
 export async function transferWorkspaceTo(
   workspaceId: WorkspaceId,
   to: string,
   at?: { x: number; y: number },
-): Promise<boolean> {
+  index?: number,
+): Promise<MoveOutcome> {
   const prepared = await prepare(workspaceId);
-  if (!prepared) return false;
+  if (!prepared) return { moved: false, reason: `no mounted Wall for '${workspaceId}'` };
   return handOff(prepared, "transfer_workspace", {
     to,
-    payload: { ...prepared.payload, ...(at ? { at } : {}) } satisfies MovePayload,
+    payload: {
+      ...prepared.payload,
+      ...(at ? { at } : {}),
+      ...(index === undefined ? {} : { index }),
+    } satisfies MovePayload,
   });
 }
 
-/** Tear this Workspace out into a new window under the cursor. Resolves to
- *  whether the host accepted it. */
+/** Tear this Workspace out into a new window under the cursor. Resolves once
+ *  the new window has adopted it, or handed it back. */
 export async function tearOutWorkspace(
   workspaceId: WorkspaceId,
   grab: { x: number; y: number },
-): Promise<boolean> {
+): Promise<MoveOutcome> {
   const prepared = await prepare(workspaceId);
-  if (!prepared) return false;
+  if (!prepared) return { moved: false, reason: `no mounted Wall for '${workspaceId}'` };
   return handOff(prepared, "open_workspace_window", {
     payload: { ...prepared.payload, grab } satisfies MovePayload,
   });
@@ -194,20 +222,26 @@ export async function tearOutWorkspace(
  * the Workspace out of the strip.
  */
 function handleDeparted(workspaceId: WorkspaceId): void {
-  const prepared = inFlight.get(workspaceId);
-  if (!prepared) {
+  const move = inFlight.get(workspaceId);
+  if (!move) {
     console.warn("[workspace-move] a departure for a Workspace that was not in flight", workspaceId);
     return;
   }
   inFlight.delete(workspaceId);
-  prepared.commit();
+  move.prepared.commit();
+  move.settle({ moved: true });
   // Moving a Window's last Workspace away closes it — without confirming,
   // archiving or killing, because nothing ended: the Surfaces are alive
   // somewhere else (`docs/specs/standalone.md` → "Transfer").
   if (getWorkspacesSnapshot().workspaces.length <= 1) {
     forgetWorkspaceSession(workspaceId);
-    void invoke("close_window").catch((err) =>
-      console.error("[workspace-move] close_window failed", err));
+    // On a later task, so the caller's answer leaves first: a `dor workspace
+    // move` that empties this window reports `moved` through this webview,
+    // and Rust destroys the window the moment it takes `close_window`.
+    setTimeout(() => {
+      void invoke("close_window").catch((err) =>
+        console.error("[workspace-move] close_window failed", err));
+    }, 0);
     return;
   }
   closeWorkspace(workspaceId);
@@ -220,9 +254,12 @@ function handleDeparted(workspaceId: WorkspaceId): void {
  * xterms receiving output again the moment Rust unsuppresses them.
  */
 function handleArrivalFailed(workspaceId: WorkspaceId, reason: string): void {
-  if (!inFlight.delete(workspaceId)) return;
+  const move = inFlight.get(workspaceId);
+  if (!move) return;
+  inFlight.delete(workspaceId);
   clearWorkspaceTransferring(workspaceId);
   console.warn(`[workspace-move] ${workspaceId} was not adopted (${reason}); it stays here`);
+  move.settle({ moved: false, reason });
 }
 
 // --- Target ------------------------------------------------------------------
@@ -313,9 +350,11 @@ async function adoptWorkspace(platform: PlatformAdapter, payload: MovePayload):
     // Before the store change too, so the Window blob it triggers already carries
     // the arriving Workspace's record rather than an empty one.
     publishWorkspaceSession(id, session);
-    // Where in this window's strip the pointer released. This window alone knows
-    // its own tabs, which is why the source sends a point rather than an index.
-    const index = payload.at ? workspaceDropTarget(payload.at.x).index : undefined;
+    // Where in this window's strip it lands: the slot the caller named, else
+    // the one under the pointer's release — this window alone knows its own
+    // tabs, which is why a drag sends a point rather than an index — else the
+    // end.
+    const index = payload.index ?? (payload.at ? workspaceDropTarget(payload.at.x).index : undefined);
     createWorkspace({ id, name });
     if (index !== undefined) moveWorkspace(id, index);
     setActiveWorkspace(id);
@@ -323,7 +362,7 @@ async function adoptWorkspace(platform: PlatformAdapter, payload: MovePayload):
     settle("adopt_done", id);
   } catch (err) {
     console.error("[workspace-move] adoption failed; handing the Workspace back", err);
-    settle("adopt_failed", id, err instanceof Error ? err.message : String(err));
+    settle("adopt_failed", id, reasonOf(err));
   } finally {
     adopting.delete(id);
   }
@@ -393,7 +432,7 @@ export async function bootFromTearOut(platform: PlatformAdapter): Promise<WallBo
     // is a window the user can use rather than a blank one. Anything else in
     // the queue is left for `initWorkspaceMoves` to drain over it.
     console.error("[workspace-move] the torn-out Workspace could not be resumed", err);
-    settle("adopt_failed", id, err instanceof Error ? err.message : String(err));
+    settle("adopt_failed", id, reasonOf(err));
     adopting.delete(id);
     return null;
   }

From 092ce8dd78c95a57244c6b186783c9cca2fb2b75 Mon Sep 17 00:00:00 2001
From: Ned Twigg <ned.twigg@diffplug.com>
Date: Thu, 10 Sep 2026 18:34:56 -0700
Subject: [PATCH 3/3] Account for merged Workspace invariants in spec budgets

---
 scripts/spec-word-budgets.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/spec-word-budgets.json b/scripts/spec-word-budgets.json
index f50d031ff..a066af1be 100644
--- a/scripts/spec-word-budgets.json
+++ b/scripts/spec-word-budgets.json
@@ -9,7 +9,7 @@
   "docs/specs/dor-cli.md": 5950,
   "docs/specs/dor-tool.md": 2100,
   "docs/specs/glossary.md": 3000,
-  "docs/specs/layout.md": 8550,
+  "docs/specs/layout.md": 8600,
   "docs/specs/mobile-terminal-ui.md": 1950,
   "docs/specs/mouse-and-clipboard.md": 3750,
   "docs/specs/notepad.md": 3950,