diff --git a/scripts/tabTransfer.test.ts b/scripts/tabTransfer.test.ts
new file mode 100644
index 0000000..bac40d2
--- /dev/null
+++ b/scripts/tabTransfer.test.ts
@@ -0,0 +1,219 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+import type { Tab } from '../src/lib/stores/tabs.svelte.js';
+import {
+	buildTransferredTab,
+	snapshotTab,
+	transferredTabTitle,
+	validateTransferPayload,
+	type TransferableTab,
+} from '../src/lib/utils/tabTransfer.js';
+
+// Cross-window tab transfer: snapshot in the source window → JSON through
+// the Rust broker → strict validation → rebuild in the destination. The
+// snapshot is independent of serializeState (window shape only, no content):
+// a transferred tab MUST carry its unsaved buffer. Validation is strict and
+// rejecting — a past bug built tabs with undefined rawContent, the editor
+// attributed a stale buffer to them, and auto-save destroyed real files.
+
+function makeTab(overrides: Partial<Tab> = {}): Tab {
+	return {
+		id: 'source-id',
+		path: '/notes/todo.md',
+		title: 'todo.md',
+		content: '<p>rendered</p>',
+		rawContent: '# unsaved edits',
+		originalContent: '# saved on disk',
+		scrollTop: 120,
+		isDirty: true,
+		isEditing: true,
+		history: ['/notes/readme.md', '/notes/todo.md'],
+		historyIndex: 1,
+		editorViewState: { cursorState: 'monaco-live-object' },
+		scrollPercentage: 0.42,
+		anchorLine: 7,
+		isSplit: true,
+		splitRatio: 0.3,
+		isScrollSynced: true,
+		...overrides,
+	};
+}
+
+function roundTrip(tab: Tab): TransferableTab {
+	const snap = snapshotTab(tab);
+	const validated = validateTransferPayload(JSON.stringify(snap));
+	assert.ok(validated, 'a snapshot of a real tab must validate');
+	return validated;
+}
+
+test('snapshot → JSON → validate → insert preserves the tab, including unsaved content', () => {
+	const source = makeTab();
+	const arrived = buildTransferredTab(roundTrip(source), [], 'Untitled');
+
+	assert.equal(arrived.path, source.path);
+	assert.equal(arrived.title, source.title);
+	assert.equal(arrived.rawContent, source.rawContent);
+	assert.equal(arrived.originalContent, source.originalContent);
+	assert.equal(arrived.isDirty, true);
+	assert.equal(arrived.isEditing, true);
+	assert.equal(arrived.isSplit, true);
+	assert.equal(arrived.splitRatio, source.splitRatio);
+	assert.equal(arrived.isScrollSynced, true);
+	assert.equal(arrived.scrollTop, source.scrollTop);
+	assert.equal(arrived.scrollPercentage, source.scrollPercentage);
+	assert.equal(arrived.anchorLine, source.anchorLine);
+	assert.deepEqual(arrived.history, source.history);
+	assert.equal(arrived.historyIndex, source.historyIndex);
+
+	// regenerated / non-serializable state starts fresh at the destination
+	assert.equal(arrived.content, '');
+	assert.equal(arrived.editorViewState, null);
+	assert.notEqual(arrived.id, source.id);
+});
+
+test('each insert gets a fresh id', () => {
+	const snap = snapshotTab(makeTab());
+	const a = buildTransferredTab(snap, [], 'Untitled');
+	const b = buildTransferredTab(snap, [], 'Untitled');
+	assert.notEqual(a.id, b.id);
+});
+
+test('snapshot never mutates the source tab', () => {
+	const source = makeTab();
+	const snap = snapshotTab(source);
+
+	snap.history.push('/injected.md');
+	snap.rawContent = 'clobbered';
+	snap.title = 'clobbered';
+
+	assert.deepEqual(source.history, ['/notes/readme.md', '/notes/todo.md']);
+	assert.equal(source.rawContent, '# unsaved edits');
+	assert.equal(source.title, 'todo.md');
+	assert.equal(source.editorViewState.cursorState, 'monaco-live-object');
+});
+
+test('the snapshot excludes rendered content and editorViewState', () => {
+	const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+	assert.ok(!('content' in snap));
+	assert.ok(!('editorViewState' in snap));
+	assert.ok(!('id' in snap));
+});
+
+test('validation rejects invalid JSON', () => {
+	assert.equal(validateTransferPayload('not json {'), null);
+	assert.equal(validateTransferPayload(''), null);
+});
+
+test('validation rejects non-object payloads', () => {
+	assert.equal(validateTransferPayload('null'), null);
+	assert.equal(validateTransferPayload('[]'), null);
+	assert.equal(validateTransferPayload('"a tab"'), null);
+});
+
+test('validation rejects a missing rawContent — no default, no coercion', () => {
+	const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+	delete snap.rawContent;
+	assert.equal(validateTransferPayload(JSON.stringify(snap)), null);
+});
+
+test('validation rejects a non-string rawContent', () => {
+	const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+	snap.rawContent = 5;
+	assert.equal(validateTransferPayload(JSON.stringify(snap)), null);
+});
+
+test('validation rejects a history that is not an array', () => {
+	const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+	snap.history = 'nope';
+	assert.equal(validateTransferPayload(JSON.stringify(snap)), null);
+});
+
+test('validation rejects history entries that are not strings', () => {
+	const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+	snap.history = [1, 2];
+	assert.equal(validateTransferPayload(JSON.stringify(snap)), null);
+});
+
+test('validation is strict for every field — even cosmetic numerics get no default', () => {
+	for (const field of [
+		'path',
+		'title',
+		'originalContent',
+		'isDirty',
+		'isEditing',
+		'isSplit',
+		'isScrollSynced',
+		'splitRatio',
+		'scrollTop',
+		'scrollPercentage',
+		'anchorLine',
+		'historyIndex',
+	]) {
+		const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+		delete snap[field];
+		assert.equal(validateTransferPayload(JSON.stringify(snap)), null, `missing ${field}`);
+	}
+});
+
+test('validation rejects non-finite numbers (NaN serializes to null)', () => {
+	const snap = snapshotTab(makeTab()) as Record<string, unknown>;
+	snap.scrollTop = NaN; // JSON.stringify turns this into null
+	assert.equal(validateTransferPayload(JSON.stringify(snap)), null);
+});
+
+test('untitled arrivals keep their title unless the destination has taken it', () => {
+	const source = makeTab({ path: '', title: 'Untitled 2' });
+	const snap = roundTrip(source);
+
+	// The title is the document's identity: a fresh detach window (or any
+	// destination without a clash) never renames.
+	assert.equal(transferredTabTitle(snap, [], 'Untitled'), 'Untitled 2');
+	assert.equal(transferredTabTitle(snap, ['Untitled 1'], 'Untitled'), 'Untitled 2');
+	assert.equal(transferredTabTitle(snap, ['notes.md'], 'Untitled'), 'Untitled 2');
+
+	// Only an exact clash re-numbers, to the destination's smallest free
+	// number per untitledTitle semantics.
+	assert.equal(
+		transferredTabTitle(snap, ['Untitled 1', 'Untitled 2'], 'Untitled'),
+		'Untitled 3',
+	);
+	assert.equal(transferredTabTitle(snap, ['Untitled 2'], 'Untitled'), 'Untitled 1');
+
+	const arrived = buildTransferredTab(snap, ['Untitled 1', 'Untitled 2'], 'Untitled');
+	assert.equal(arrived.title, 'Untitled 3');
+	// the buffer still travels even when the title changed
+	assert.equal(arrived.rawContent, source.rawContent);
+});
+
+test('file-backed arrivals keep their title', () => {
+	const snap = roundTrip(makeTab());
+	assert.equal(transferredTabTitle(snap, ['todo.md'], 'Untitled'), 'todo.md');
+});
+
+// insertTransferredTab lives in the Svelte store ($state rune, not loadable
+// in node), so — like windowStateRestore.test.ts — the thin store wrapper is
+// checked statically; all decision logic above is exercised directly.
+test('insertTransferredTab is a thin wrapper: build, push, activate, return the id', () => {
+	const tabs = readFileSync('src/lib/stores/tabs.svelte.ts', 'utf8');
+	const start = tabs.indexOf('insertTransferredTab(');
+	assert.ok(start !== -1, 'insertTransferredTab not found');
+	const fn = tabs.slice(start, tabs.indexOf('closeTab(', start));
+
+	assert.match(fn, /buildTransferredTab\(/);
+	// untitled re-numbering uses this window's titles and localized base
+	assert.match(fn, /this\.tabs\.map\(\(tab\) => tab\.title\)/);
+	assert.match(fn, /t\('tabs\.untitled', settings\.language\)/);
+	// the new tab is pushed, activated, and its id returned
+	assert.match(fn, /this\.tabs\.push\(tab\);/);
+	assert.match(fn, /this\.activeTabId = tab\.id;/);
+	assert.match(fn, /return tab\.id;/);
+});
+
+test('serializeState still persists window shape only (untouched by transfer)', () => {
+	const tabs = readFileSync('src/lib/stores/tabs.svelte.ts', 'utf8');
+	const fn = tabs.slice(tabs.indexOf('serializeState()'), tabs.indexOf('restoreState('));
+	assert.doesNotMatch(fn, /rawContent/);
+	assert.doesNotMatch(fn, /TransferableTab/);
+});
diff --git a/scripts/untitledTitle.test.ts b/scripts/untitledTitle.test.ts
new file mode 100644
index 0000000..f87b283
--- /dev/null
+++ b/scripts/untitledTitle.test.ts
@@ -0,0 +1,45 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+import { nextUntitledTitle } from '../src/lib/utils/untitledTitle.js';
+
+// Untitled tabs get distinct numbered titles ("Untitled 1", "Untitled 2", …)
+// so the tab strip — and the per-tab close dialogs — can name exactly which
+// tab they are talking about. Two dirty untitled tabs used to both be called
+// "Untitled", making the close dialog ambiguous.
+
+test('the first untitled tab is number 1', () => {
+	assert.equal(nextUntitledTitle([], 'Untitled'), 'Untitled 1');
+});
+
+test('numbers increment past the ones in use', () => {
+	assert.equal(nextUntitledTitle(['Untitled 1', 'Untitled 2'], 'Untitled'), 'Untitled 3');
+});
+
+test('freed numbers are reused (smallest available wins)', () => {
+	assert.equal(nextUntitledTitle(['Untitled 1', 'Untitled 3'], 'Untitled'), 'Untitled 2');
+});
+
+test('a legacy unnumbered title occupies slot 1', () => {
+	assert.equal(nextUntitledTitle(['Untitled'], 'Untitled'), 'Untitled 2');
+});
+
+test('titled tabs and lookalike names are ignored', () => {
+	assert.equal(
+		nextUntitledTitle(['notes.md', 'Untitled draft', 'Untitled 1x'], 'Untitled'),
+		'Untitled 1',
+	);
+});
+
+test('works with localized bases', () => {
+	assert.equal(nextUntitledTitle(['无标题 1'], '无标题'), '无标题 2');
+});
+
+test('new tabs are created with numbered untitled titles', () => {
+	const tabs = readFileSync('src/lib/stores/tabs.svelte.ts', 'utf8');
+	assert.match(tabs, /nextUntitledTitle\(/);
+	// both creation paths go through the helper
+	const addNewTab = tabs.slice(tabs.indexOf('addNewTab()'), tabs.indexOf('addHomeTab()'));
+	assert.match(addNewTab, /nextUntitledTitle\(/);
+});
diff --git a/scripts/windowClosePerTab.test.ts b/scripts/windowClosePerTab.test.ts
new file mode 100644
index 0000000..dbcad0c
--- /dev/null
+++ b/scripts/windowClosePerTab.test.ts
@@ -0,0 +1,86 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const viewer = readFileSync('src/lib/MarkdownViewer.svelte', 'utf8');
+
+// Window close (issue #189): instead of one aggregate "you have N unsaved
+// files" modal, the red close button walks the dirty tabs one at a time —
+// activating each and showing the SAME localized unsaved-changes dialog a
+// single tab close shows (canCloseTab). Cancel stops the walk; the window
+// stays open with the remaining tabs.
+
+function closeHandler(): string {
+	const start = viewer.indexOf('appWindow.onCloseRequested');
+	assert.ok(start !== -1, 'close handler registration not found');
+	return viewer.slice(start, viewer.indexOf('onDragDropEvent', start));
+}
+
+test('the aggregate unsaved-files modal is gone from the close handler', () => {
+	const handler = closeHandler();
+	assert.doesNotMatch(handler, /youHaveUnsavedFiles/);
+	// and the old "clear all dirty flags then close" discard path with it
+	assert.doesNotMatch(handler, /tabManager\.tabs\.forEach\(\(t\) => \(t\.isDirty = false\)\)/);
+});
+
+test('dirty tabs are reviewed one at a time through the existing canCloseTab flow', () => {
+	const handler = closeHandler();
+	// activate the tab under review so the user sees what the dialog is about
+	assert.match(handler, /tabManager\.setActive\(dirty\.id\);/);
+	// the existing localized per-tab dialog decides save / discard / cancel
+	assert.match(handler, /await canCloseTab\(dirty\.id\)/);
+	// a resolved tab actually closes before moving on
+	assert.match(handler, /tabManager\.closeTab\(dirty\.id\);/);
+});
+
+test('cancelling the per-tab dialog stops the walk and keeps the window open', () => {
+	const handler = closeHandler();
+	assert.match(handler, /if \(!\(await canCloseTab\(dirty\.id\)\)\) return;/);
+});
+
+test('the close is prevented synchronously before the per-tab walk', () => {
+	const handler = closeHandler();
+	const branchStart = handler.indexOf('if (dirtyTabs.length > 0) {');
+	assert.ok(branchStart !== -1, 'dirty branch not found');
+	const prevent = handler.indexOf('event.preventDefault()', branchStart);
+	const walk = handler.indexOf('canCloseTab(dirty.id)', branchStart);
+	assert.ok(prevent !== -1 && walk !== -1 && prevent < walk);
+});
+
+test('the window closes only after every dirty tab is resolved', () => {
+	const handler = closeHandler();
+	const walk = handler.indexOf('canCloseTab(dirty.id)');
+	const close = handler.indexOf('appWindow.close()', walk);
+	assert.ok(walk !== -1 && close !== -1 && walk < close);
+});
+
+test('a second close request cannot start a competing walk', () => {
+	const handler = closeHandler();
+	// The native red button bypasses the dialog overlay; re-entry must be
+	// swallowed while a walk is active, or two walks fight over setActive
+	// and the highlighted tab stops matching the dialog.
+	assert.match(handler, /if \(isCloseWalkActive\) \{\s*event\.preventDefault\(\);\s*return;\s*\}/);
+	// and the flag is always released, even when the user cancels mid-walk
+	assert.match(handler, /finally \{\s*isCloseWalkActive = false;\s*\}/);
+});
+
+test('the walk proceeds in strict tab-strip order', () => {
+	const handler = closeHandler();
+	// Predictable left-to-right order: always the first dirty tab in the
+	// array; no active-first shortcut that made the sequence look random.
+	assert.match(handler, /const dirty = tabManager\.tabs\.find\(\(t\) => t\.isDirty\);/);
+	assert.doesNotMatch(handler, /active\?\.isDirty/);
+});
+
+test('the untitled save dialog prefills the numbered tab title', () => {
+	const fn = viewer.slice(viewer.indexOf('async function saveContent'));
+	const scope = fn.slice(0, fn.indexOf('async function saveContentAs'));
+	assert.match(scope, /defaultPath: tab\.title/);
+});
+
+test('the restore-on-reopen branch persists window state via the shared helper', () => {
+	const handler = closeHandler();
+	assert.match(handler, /persistWindowState\(\);/);
+	// no durable-write experiment left behind
+	assert.doesNotMatch(viewer, /saveSessionState|sessionState\.js/);
+});
diff --git a/scripts/windowStateRestore.test.ts b/scripts/windowStateRestore.test.ts
new file mode 100644
index 0000000..a564364
--- /dev/null
+++ b/scripts/windowStateRestore.test.ts
@@ -0,0 +1,114 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const tabs = readFileSync('src/lib/stores/tabs.svelte.ts', 'utf8');
+const viewer = readFileSync('src/lib/MarkdownViewer.svelte', 'utf8');
+
+// Session restore persists WINDOW state only: which files are open, the
+// active tab, and per-tab UI (edit mode, split, scroll). Document content
+// always lives on disk — the snapshot never carries rawContent, so unsaved
+// changes are handled exclusively by the per-tab close dialogs.
+
+function slice(source: string, from: string, to: string): string {
+	const start = source.indexOf(from);
+	assert.ok(start !== -1, `${from} not found`);
+	const end = source.indexOf(to, start);
+	assert.ok(end !== -1, `${to} not found after ${from}`);
+	return source.slice(start, end);
+}
+
+test('serializeState writes window state only', () => {
+	const fn = slice(tabs, 'serializeState()', 'restoreState(');
+	assert.match(fn, /version: 2/);
+	// untitled tabs have no disk backing; they are resolved at close, never persisted
+	assert.match(fn, /filter\(\(t\) => t\.path !== ''\)/);
+	// no full-object spread and no content fields in the snapshot
+	assert.doesNotMatch(fn, /\.\.\.t/);
+	assert.doesNotMatch(fn, /rawContent/);
+	assert.doesNotMatch(fn, /originalContent/);
+	assert.doesNotMatch(fn, /isDirty/);
+	assert.doesNotMatch(fn, /history/);
+});
+
+test('restoreState rebuilds clean tabs and drops legacy untitled entries', () => {
+	const fn = slice(tabs, 'restoreState(', 'addTab(');
+	// path is the identity of a restored tab; entries without one are skipped
+	assert.match(fn, /saved\.path === ''\) continue;/);
+	// restored tabs start clean; content is read from disk afterwards
+	assert.match(fn, /isDirty: false/);
+	assert.match(fn, /rawContent: ''/);
+	// a stale activeTabId falls back to the first restored tab
+	assert.match(fn, /activeTabId/);
+});
+
+test('startup restore reads content from disk, not from the snapshot', () => {
+	const init = slice(viewer, 'localStorage.getItem(WINDOW_STATE_KEY)', 'urlParams');
+	assert.match(init, /read_file_content/);
+	// a missing file drops its tab instead of restoring a ghost
+	assert.match(init, /closeTab\(/);
+});
+
+test('the discard choice reverts the tab to its last saved content', () => {
+	const fn = slice(viewer, 'async function canCloseTab', 'async function toggleEdit');
+	assert.match(fn, /tab\.rawContent = tab\.originalContent;/);
+	assert.match(fn, /tab\.isDirty = false;/);
+});
+
+test('the close flow resolves dirty tabs before serializing window state', () => {
+	const handlerStart = viewer.indexOf('appWindow.onCloseRequested');
+	const handler = viewer.slice(handlerStart, viewer.indexOf('onDragDropEvent', handlerStart));
+	const walk = handler.indexOf('canCloseTab(dirty.id)');
+	const persist = handler.indexOf('persistWindowState()');
+	assert.ok(walk !== -1, 'per-tab walk not found');
+	assert.ok(persist !== -1, 'window-state serialization not found');
+	assert.ok(walk < persist, 'dirty tabs must be resolved before the snapshot is written');
+});
+
+test('v2 snapshots are invisible to legacy builds (Rust file, localStorage keys removed)', () => {
+	// An older build restoring a snapshot it cannot understand ends up with
+	// undefined tab content; its editor then attributes a stale buffer to the
+	// wrong tab and auto-save writes it to disk. The snapshot now lives in a
+	// Rust-written file (setItem is an async message to the WebKit storage
+	// process and loses a flush race when the last window's close ends the
+	// process); both localStorage keys are removed on write, so a downgraded
+	// build starts a fresh session instead of misreading anything.
+	const helper = viewer.slice(viewer.indexOf('async function persistWindowState'));
+	const scope = helper.slice(0, helper.indexOf('\n\t}'));
+	assert.match(scope, /invoke\('save_window_state'/);
+	assert.doesNotMatch(scope, /setItem\(/);
+	assert.match(scope, /removeItem\(WINDOW_STATE_KEY\)/);
+	assert.match(scope, /removeItem\(LEGACY_STATE_KEY\)/);
+	assert.match(viewer, /const WINDOW_STATE_KEY = 'savedTabsDataV2';/);
+	// only the main window persists: secondary labels are per-session, and a
+	// shared write slot would let the last window closed overwrite the rest
+	assert.match(scope, /if \(!isMainWindow\) return;/);
+	// startup prefers the Rust file and falls back to the localStorage keys
+	// (v2 first, then legacy) for one-time migration of older snapshots
+	assert.match(viewer, /invoke\('load_window_state'\)/);
+	assert.match(
+		viewer,
+		/localStorage\.getItem\(WINDOW_STATE_KEY\) \?\?\n?\s*localStorage\.getItem\(LEGACY_STATE_KEY\)/,
+	);
+	// explicit exit clears the file and both keys
+	const exitFn = viewer.slice(viewer.indexOf('async function appExit'));
+	const exitScope = exitFn.slice(0, exitFn.indexOf('\n\t}'));
+	assert.match(exitScope, /clear_window_state/);
+	assert.match(exitScope, /removeItem\(WINDOW_STATE_KEY\)/);
+	assert.match(exitScope, /removeItem\(LEGACY_STATE_KEY\)/);
+});
+
+test('with restore enabled resolved titled tabs stay open for the snapshot', () => {
+	const handlerStart = viewer.indexOf('appWindow.onCloseRequested');
+	const handler = viewer.slice(handlerStart, viewer.indexOf('onDragDropEvent', handlerStart));
+	// tabs are closed one-by-one only when restore is off (or untitled)
+	assert.match(handler, /restoreStateOnReopen \|\| dirty\.path === ''/);
+});
+
+test('auto-save fast path silently saves titled tabs before the walk', () => {
+	const handlerStart = viewer.indexOf('appWindow.onCloseRequested');
+	const handler = viewer.slice(handlerStart, viewer.indexOf('onDragDropEvent', handlerStart));
+	const fastPath = handler.indexOf('settings.autoSave && !settings.confirmBeforeSave');
+	const walk = handler.indexOf('canCloseTab(dirty.id)');
+	assert.ok(fastPath !== -1 && walk !== -1 && fastPath < walk);
+});
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index dce211d..625b673 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "Markpad"
-version = "2.6.11"
+version = "2.6.12"
 dependencies = [
  "arboard",
  "base64 0.22.1",
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
index 4fe2319..955f675 100644
--- a/src-tauri/capabilities/default.json
+++ b/src-tauri/capabilities/default.json
@@ -1,10 +1,11 @@
 {
   "$schema": "../gen/schemas/desktop-schema.json",
   "identifier": "default",
-  "description": "Capability for the main window",
+  "description": "Capability for all Markpad windows",
   "windows": [
     "main",
-    "installer"
+    "installer",
+    "window-*"
   ],
   "permissions": [
     "core:default",
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 542b325..8aec434 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -135,10 +135,11 @@ mod tests {
 }
 
 struct WatcherState {
-    watcher: Mutex<Option<RecommendedWatcher>>,
+    watchers: Mutex<std::collections::HashMap<String, RecommendedWatcher>>,
 }
 
 mod setup;
+mod tab_transfer;
 
 #[tauri::command]
 async fn show_window(window: tauri::Window) {
@@ -147,12 +148,127 @@ async fn show_window(window: tauri::Window) {
     let _ = window.set_focus();
 }
 
+// Window-state snapshots are written through Rust instead of localStorage:
+// setItem is an async message to the WebKit storage process and dies in
+// transit when the last window's close ends the process, whereas an
+// awaited invoke keeps the close handler — and therefore the process —
+// alive until the bytes are on disk.
+fn window_state_path(app: &AppHandle) -> Result<std::path::PathBuf, String> {
+    let dir = app
+        .path()
+        .app_config_dir()
+        .map_err(|e| e.to_string())?;
+    fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
+    Ok(dir.join("window-state-v2.json"))
+}
+
+#[tauri::command]
+fn save_window_state(app: AppHandle, json: String) -> Result<(), String> {
+    fs::write(window_state_path(&app)?, json).map_err(|e| e.to_string())
+}
+
+#[tauri::command]
+fn load_window_state(app: AppHandle) -> Option<String> {
+    fs::read_to_string(window_state_path(&app).ok()?).ok()
+}
+
+#[tauri::command]
+fn clear_window_state(app: AppHandle) -> Result<(), String> {
+    let path = window_state_path(&app)?;
+    if path.exists() {
+        fs::remove_file(path).map_err(|e| e.to_string())?;
+    }
+    Ok(())
+}
+
 fn bring_webview_window_to_front(window: &tauri::WebviewWindow) {
     let _ = window.show();
     let _ = window.unminimize();
     let _ = window.set_focus();
 }
 
+/// Picks the viewer window that should receive an externally opened file:
+/// the focused viewer if any, else the viewer the user focused most
+/// recently, else any viewer. The middle rung matters for Finder opens —
+/// Finder is frontmost at that moment, so is_focused() is false for every
+/// Markpad window and delivery would otherwise degrade to arbitrary map
+/// order. Viewer windows are "main" and detached "window-*" windows;
+/// "installer" never receives files.
+fn pick_delivery_window(app: &AppHandle) -> Option<tauri::WebviewWindow> {
+    let viewers: Vec<tauri::WebviewWindow> = app
+        .webview_windows()
+        .into_iter()
+        .filter(|(label, _)| label == "main" || label.starts_with("window-"))
+        .map(|(_, window)| window)
+        .collect();
+
+    if let Some(focused) = viewers
+        .iter()
+        .find(|window| window.is_focused().unwrap_or(false))
+    {
+        return Some(focused.clone());
+    }
+
+    let last = app
+        .state::<AppState>()
+        .last_focused_viewer
+        .lock()
+        .unwrap()
+        .clone();
+    if let Some(label) = last {
+        if let Some(window) = viewers.iter().find(|w| w.label() == label) {
+            return Some(window.clone());
+        }
+    }
+
+    viewers.into_iter().next()
+}
+
+/// Creates the destination window for a tab transfer. The window's label
+/// embeds the transfer token ("window-<token>"), so the new frontend can
+/// derive which pending transfer to claim from its own label — no URL
+/// query involved (the asset protocol 404s on "index.html?x=y" paths).
+/// Deliberately NOT async: sync commands run on the main thread, which
+/// window creation requires on macOS.
+#[tauri::command]
+fn create_transfer_window(app: AppHandle, token: String) -> Result<(), String> {
+    let label = format!("window-{token}");
+
+    #[allow(unused_mut)]
+    let mut window_builder = tauri::WebviewWindowBuilder::new(
+        &app,
+        &label,
+        tauri::WebviewUrl::App("index.html".into()),
+    )
+    .title("Markpad")
+    .inner_size(1000.0, 800.0)
+    .min_inner_size(400.0, 300.0)
+    .visible(false)
+    .resizable(true);
+
+    #[cfg(target_os = "macos")]
+    {
+        // Decorated macOS windows keep their shadow. The main window's
+        // shadow(false) is resurrected as a side effect of the window-state
+        // plugin restoring its frame at startup; a fresh secondary window
+        // gets no such restore, so it must opt in explicitly or it renders
+        // shadowless and blends into the window behind it.
+        window_builder = window_builder
+            .decorations(true)
+            .title_bar_style(tauri::TitleBarStyle::Overlay)
+            .hidden_title(true)
+            .shadow(true);
+    }
+
+    #[cfg(not(target_os = "macos"))]
+    {
+        window_builder = window_builder.decorations(false).shadow(false);
+    }
+
+    window_builder.build().map_err(|e| e.to_string())?;
+    Ok(())
+}
+
 fn process_internal_embeds(content: &str) -> Cow<'_, str> {
     let re = Regex::new(r"(?s)```.*?```|`.*?`|!\[\[(.*?)\]\]").unwrap();
 
@@ -400,21 +516,24 @@ fn rename_file(old_path: String, new_path: String) -> Result<(), String> {
 
 #[tauri::command]
 fn watch_file(
+    window: tauri::Window,
     handle: AppHandle,
     state: State<'_, WatcherState>,
     path: String,
 ) -> Result<(), String> {
-    let mut watcher_lock = state.watcher.lock().unwrap();
+    let label = window.label().to_string();
+    let mut watchers_lock = state.watchers.lock().unwrap();
 
-    *watcher_lock = None;
+    watchers_lock.remove(&label);
 
     let path_to_watch = path.clone();
     let app_handle = handle.clone();
+    let event_label = label.clone();
 
     let mut watcher = RecommendedWatcher::new(
         move |res: Result<notify::Event, notify::Error>| {
             if let Ok(_) = res {
-                let _ = app_handle.emit("file-changed", ());
+                let _ = app_handle.emit_to(event_label.as_str(), "file-changed", ());
             }
         },
         Config::default(),
@@ -425,20 +544,121 @@ fn watch_file(
         .watch(Path::new(&path_to_watch), RecursiveMode::NonRecursive)
         .map_err(|e| e.to_string())?;
 
-    *watcher_lock = Some(watcher);
+    watchers_lock.insert(label, watcher);
 
     Ok(())
 }
 
 #[tauri::command]
-fn unwatch_file(state: State<'_, WatcherState>) -> Result<(), String> {
-    let mut watcher_lock = state.watcher.lock().unwrap();
-    *watcher_lock = None;
+fn unwatch_file(window: tauri::Window, state: State<'_, WatcherState>) -> Result<(), String> {
+    let mut watchers_lock = state.watchers.lock().unwrap();
+    watchers_lock.remove(window.label());
     Ok(())
 }
 
 struct AppState {
     startup_file: Mutex<Option<String>>,
+    // Label of the viewer window the user focused most recently. When an
+    // OS file-open arrives, Finder is frontmost and is_focused() is false
+    // for every Markpad window — without this the delivery target degrades
+    // to arbitrary HashMap order.
+    last_focused_viewer: Mutex<Option<String>>,
+    // Display metadata for every viewer window, pushed by each window's
+    // frontend (tab state lives in its own WebView, so Rust cannot derive
+    // it). Serves the "Move to window …" menu, the window tag chip, and
+    // the ⌘⇧M cycle order. `number` is a session-stable creation ordinal
+    // (main = 1); names/colors are the user's optional window tags.
+    window_registry: Mutex<std::collections::HashMap<String, WindowMeta>>,
+    window_counter: std::sync::atomic::AtomicU64,
+}
+
+#[derive(Clone, serde::Serialize, serde::Deserialize, Default)]
+struct WindowMeta {
+    number: u64,
+    tag_name: Option<String>,
+    tag_color: Option<String>,
+    active_tab_title: String,
+    tab_count: usize,
+}
+
+/// Registered by each viewer window's frontend on boot and whenever its
+/// displayable state changes (active tab, tab count, tag edits). The first
+/// call from a window assigns its session-stable number.
+#[tauri::command]
+fn set_window_meta(
+    window: tauri::Window,
+    state: State<'_, AppState>,
+    tag_name: Option<String>,
+    tag_color: Option<String>,
+    active_tab_title: String,
+    tab_count: usize,
+) {
+    let label = window.label().to_string();
+    if label != "main" && !label.starts_with("window-") {
+        return;
+    }
+    let mut registry = state.window_registry.lock().unwrap();
+    let entry = registry.entry(label).or_insert_with(|| WindowMeta {
+        number: state
+            .window_counter
+            .fetch_add(1, std::sync::atomic::Ordering::SeqCst)
+            + 1,
+        ..WindowMeta::default()
+    });
+    entry.tag_name = tag_name;
+    entry.tag_color = tag_color;
+    entry.active_tab_title = active_tab_title;
+    entry.tab_count = tab_count;
+}
+
+#[derive(Clone, serde::Serialize)]
+struct WindowListEntry {
+    label: String,
+    #[serde(flatten)]
+    meta: WindowMeta,
+}
+
+/// Live viewer windows in creation order (registry entries are pruned on
+/// window destruction, so no liveness filtering is needed beyond that).
+#[tauri::command]
+fn list_viewer_windows(state: State<'_, AppState>) -> Vec<WindowListEntry> {
+    let registry = state.window_registry.lock().unwrap();
+    let mut list: Vec<WindowListEntry> = registry
+        .iter()
+        .map(|(label, meta)| WindowListEntry {
+            label: label.clone(),
+            meta: meta.clone(),
+        })
+        .collect();
+    list.sort_by_key(|e| e.meta.number);
+    list
+}
+
+/// Brings a specific viewer window to the front — used when ⌘⇧M carries a
+/// tab to the next window and focus should follow it.
+#[tauri::command]
+fn focus_window(app: AppHandle, label: String) -> Result<(), String> {
+    let window = app
+        .get_webview_window(&label)
+        .ok_or_else(|| format!("no such window: {label}"))?;
+    bring_webview_window_to_front(&window);
+    Ok(())
+}
+
+/// Offers a staged tab transfer to an EXISTING window: the destination's
+/// frontend claims the token through the same broker path a detach window
+/// uses, and the source deletes its tab only on the claim acknowledgement.
+#[tauri::command]
+fn offer_tab_to_window(
+    app: AppHandle,
+    target_label: String,
+    token: String,
+) -> Result<(), String> {
+    if app.get_webview_window(&target_label).is_none() {
+        return Err(format!("no such window: {target_label}"));
+    }
+    app.emit_to(target_label.as_str(), "tab-transfer-offer", token)
+        .map_err(|e| e.to_string())
 }
 
 #[tauri::command]
@@ -448,9 +668,12 @@ fn send_markdown_path(state: State<'_, AppState>) -> Vec<String> {
         .filter(|arg| !arg.starts_with("-"))
         .collect();
 
-    if let Some(startup_path) = state.startup_file.lock().unwrap().as_ref() {
-        if !files.contains(startup_path) {
-            files.insert(0, startup_path.clone());
+    // take(): the stash is a one-shot boot buffer (Opened arriving before
+    // the frontend was ready); once delivered it must not feed any later
+    // caller another copy.
+    if let Some(startup_path) = state.startup_file.lock().unwrap().take() {
+        if !files.contains(&startup_path) {
+            files.insert(0, startup_path);
         }
     }
 
@@ -919,15 +1142,19 @@ pub fn run() {
     tauri::Builder::default()
         .manage(AppState {
             startup_file: Mutex::new(None),
+            last_focused_viewer: Mutex::new(None),
+            window_registry: Mutex::new(std::collections::HashMap::new()),
+            window_counter: std::sync::atomic::AtomicU64::new(0),
         })
         .manage(WatcherState {
-            watcher: Mutex::new(None),
+            watchers: Mutex::new(std::collections::HashMap::new()),
         })
+        .manage(tab_transfer::TabTransferBroker::new())
         .plugin(tauri_plugin_opener::init())
         .plugin(tauri_plugin_dialog::init())
         .plugin(tauri_plugin_single_instance::init(|app, args, cwd| {
             println!("Single Instance Args: {:?}", args);
-            let Some(window) = app.get_webview_window("main") else {
+            let Some(window) = pick_delivery_window(app) else {
                 return;
             };
 
@@ -947,7 +1174,7 @@ pub fn run() {
                     cwd_path.join(path).display().to_string()
                 };
 
-                let _ = window.emit("file-path", resolved_path);
+                let _ = app.emit_to(window.label(), "file-path", resolved_path);
             }
             bring_webview_window_to_front(&window);
         }))
@@ -963,6 +1190,15 @@ pub fn run() {
                         | tauri_plugin_window_state::StateFlags::VISIBLE
                         | tauri_plugin_window_state::StateFlags::FULLSCREEN,
                 )
+                // Detached tab windows share one saved state instead of
+                // accumulating a state entry per generated label.
+                .map_label(|label| {
+                    if label.starts_with("window-") {
+                        "secondary"
+                    } else {
+                        label
+                    }
+                })
                 .build(),
         )
         .setup(|app| {
@@ -1197,16 +1433,52 @@ pub fn run() {
             delete_file,
             copy_file,
             cleanup_empty_img_dir,
-            list_directory_contents
+            list_directory_contents,
+            tab_transfer::stage_detached_tab,
+            tab_transfer::claim_detached_tab,
+            tab_transfer::cancel_detached_tab,
+            create_transfer_window,
+            set_window_meta,
+            list_viewer_windows,
+            offer_tab_to_window,
+            focus_window,
+            save_window_state,
+            load_window_state,
+            clear_window_state
         ])
+        .on_window_event(|window, event| {
+            match event {
+                tauri::WindowEvent::Focused(true) => {
+                    let label = window.label();
+                    if label == "main" || label.starts_with("window-") {
+                        let state = window.state::<AppState>();
+                        *state.last_focused_viewer.lock().unwrap() = Some(label.to_string());
+                    }
+                }
+                tauri::WindowEvent::Destroyed => {
+                    // Drop this window's file watcher so a closed window
+                    // never leaves a dangling notify handle behind.
+                    let state = window.state::<WatcherState>();
+                    state.watchers.lock().unwrap().remove(window.label());
+                    // And its registry entry, so the "Move to window …"
+                    // menu never lists a dead destination.
+                    let app_state = window.state::<AppState>();
+                    app_state
+                        .window_registry
+                        .lock()
+                        .unwrap()
+                        .remove(window.label());
+                }
+                _ => {}
+            }
+        })
         .on_menu_event(|app, event| {
             let id = event.id().as_ref();
-            // Emit to the focused webview window rather than `app.emit(...)`,
-            // which would broadcast to every webview. Markpad is currently
-            // single-window, but additional webviews (e.g. detached tabs)
-            // would otherwise receive duplicate New/Close/Save invocations.
-            // Falls back to "main" if no window is focused (e.g. menu fired
-            // while the app is in the background).
+            // Emit to the focused webview window's label rather than
+            // `window.emit(...)`, which broadcasts to every webview and
+            // would fire menu actions (New/Close/Save…) in all windows at
+            // once. Falls back to "main" if no window is focused (e.g. menu
+            // fired while the app is in the background).
             let target = app
                 .webview_windows()
                 .into_values()
@@ -1215,12 +1487,12 @@ pub fn run() {
             let Some(window) = target else { return };
 
             if id == "check-updates" {
-                let _ = window.emit("menu-check-updates", ());
+                let _ = app.emit_to(window.label(), "menu-check-updates", ());
             } else if id == "menu-app-quit"
                 || id.starts_with("menu-file-")
                 || id.starts_with("menu-edit-")
             {
-                let _ = window.emit(id, ());
+                let _ = app.emit_to(window.label(), id, ());
             }
         })
         .build(tauri::generate_context!())
@@ -1235,8 +1507,8 @@ pub fn run() {
                         let state = _app_handle.state::<AppState>();
                         *state.startup_file.lock().unwrap() = Some(path_str.clone());
 
-                        if let Some(window) = _app_handle.get_webview_window("main") {
-                            let _ = window.emit("file-path", path_str);
+                        if let Some(window) = pick_delivery_window(_app_handle) {
+                            let _ = _app_handle.emit_to(window.label(), "file-path", path_str);
                             bring_webview_window_to_front(&window);
                         }
                     }
diff --git a/src-tauri/src/tab_transfer.rs b/src-tauri/src/tab_transfer.rs
new file mode 100644
index 0000000..7e944f6
--- /dev/null
+++ b/src-tauri/src/tab_transfer.rs
@@ -0,0 +1,143 @@
+use std::collections::HashMap;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Mutex;
+use tauri::{AppHandle, Emitter, State};
+
+/// Maximum number of staged transfers kept in memory; oldest entries are
+/// evicted first so an abandoned drag can never grow the map unbounded.
+const MAX_PENDING_TRANSFERS: usize = 16;
+
+pub struct PendingTransfer {
+    pub payload: String,
+    pub source_label: String,
+}
+
+#[derive(Default)]
+struct BrokerInner {
+    entries: HashMap<String, PendingTransfer>,
+    insertion_order: Vec<String>,
+}
+
+/// In-memory broker for moving a tab between windows: the source window
+/// stages a JSON snapshot and hands the returned token to the new window,
+/// which claims the payload exactly once.
+pub struct TabTransferBroker {
+    inner: Mutex<BrokerInner>,
+    counter: AtomicU64,
+}
+
+impl TabTransferBroker {
+    pub fn new() -> Self {
+        TabTransferBroker {
+            inner: Mutex::new(BrokerInner::default()),
+            counter: AtomicU64::new(0),
+        }
+    }
+
+    fn stage(&self, payload: String, source_label: String) -> String {
+        let token = format!("t{}", self.counter.fetch_add(1, Ordering::Relaxed) + 1);
+        let mut inner = self.inner.lock().unwrap();
+        inner.entries.insert(
+            token.clone(),
+            PendingTransfer {
+                payload,
+                source_label,
+            },
+        );
+        inner.insertion_order.push(token.clone());
+        while inner.entries.len() > MAX_PENDING_TRANSFERS {
+            let oldest = inner.insertion_order.remove(0);
+            inner.entries.remove(&oldest);
+        }
+        token
+    }
+
+    fn claim(&self, token: &str) -> Option<PendingTransfer> {
+        let mut inner = self.inner.lock().unwrap();
+        inner.insertion_order.retain(|t| t != token);
+        inner.entries.remove(token)
+    }
+
+    fn cancel(&self, token: &str) {
+        self.claim(token);
+    }
+}
+
+#[tauri::command]
+pub fn stage_detached_tab(
+    window: tauri::Window,
+    state: State<'_, TabTransferBroker>,
+    payload: String,
+) -> String {
+    state.stage(payload, window.label().to_string())
+}
+
+#[tauri::command]
+pub fn claim_detached_tab(
+    app: AppHandle,
+    state: State<'_, TabTransferBroker>,
+    token: String,
+) -> Option<String> {
+    let transfer = state.claim(&token)?;
+    let _ = app.emit_to(
+        transfer.source_label.as_str(),
+        "tab-transfer-claimed",
+        token,
+    );
+    Some(transfer.payload)
+}
+
+#[tauri::command]
+pub fn cancel_detached_tab(state: State<'_, TabTransferBroker>, token: String) {
+    state.cancel(&token);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn stage_then_claim_returns_payload_and_removes_entry() {
+        let broker = TabTransferBroker::new();
+        let token = broker.stage("{\"tab\":1}".to_string(), "main".to_string());
+
+        let transfer = broker.claim(&token).expect("staged transfer should exist");
+        assert_eq!(transfer.payload, "{\"tab\":1}");
+        assert_eq!(transfer.source_label, "main");
+
+        assert!(broker.claim(&token).is_none());
+    }
+
+    #[test]
+    fn cancel_then_claim_returns_none() {
+        let broker = TabTransferBroker::new();
+        let token = broker.stage("{}".to_string(), "window-1".to_string());
+
+        broker.cancel(&token);
+        assert!(broker.claim(&token).is_none());
+    }
+
+    #[test]
+    fn tokens_are_unique_across_stages() {
+        let broker = TabTransferBroker::new();
+        let first = broker.stage("a".to_string(), "main".to_string());
+        let second = broker.stage("b".to_string(), "main".to_string());
+        assert_ne!(first, second);
+    }
+
+    #[test]
+    fn staging_beyond_cap_evicts_oldest() {
+        let broker = TabTransferBroker::new();
+        let mut tokens = Vec::new();
+        for i in 0..=MAX_PENDING_TRANSFERS {
+            tokens.push(broker.stage(format!("payload-{}", i), "main".to_string()));
+        }
+
+        // The very first entry was evicted; every later one is still claimable.
+        assert!(broker.claim(&tokens[0]).is_none());
+        for (i, token) in tokens.iter().enumerate().skip(1) {
+            let transfer = broker.claim(token).expect("entry within cap should remain");
+            assert_eq!(transfer.payload, format!("payload-{}", i));
+        }
+    }
+}
diff --git a/src/lib/MarkdownViewer.svelte b/src/lib/MarkdownViewer.svelte
index 1d77a3c..cc127a3 100644
--- a/src/lib/MarkdownViewer.svelte
+++ b/src/lib/MarkdownViewer.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
 	import { invoke, convertFileSrc } from '@tauri-apps/api/core';
-	import { listen } from '@tauri-apps/api/event';
 	import { getCurrentWindow } from '@tauri-apps/api/window';
+	import { emitTo } from '@tauri-apps/api/event';
 	import { onMount, tick, untrack } from 'svelte';
-	import { fly } from 'svelte/transition';
+	import { fly, fade } from 'svelte/transition';
 	import { cubicOut } from 'svelte/easing';
 	import { openPath, openUrl } from '@tauri-apps/plugin-opener';
 	import { open, save, ask } from '@tauri-apps/plugin-dialog';
@@ -50,6 +50,7 @@ import {
 	import DOMPurify from 'dompurify';
 	import HomePage from './components/HomePage.svelte';
 import { tabManager } from './stores/tabs.svelte.js';
+import { snapshotTab, validateTransferPayload } from './utils/tabTransfer.js';
 import { settings } from './stores/settings.svelte.js';
 import { t } from './utils/i18n.js';
 
@@ -316,6 +317,31 @@ import { t } from './utils/i18n.js';
 		});
 	}
 
+	// "Identify" flash: hovering a "Move to window …" menu entry in another
+	// window makes THIS window raise its hand — a brief accent ring plus a
+	// centered badge naming it. Pure visuals; no focus or z-order change.
+	let identifyFlash = $state<{ show: boolean; display: string; color: string | null }>({
+		show: false,
+		display: '',
+		color: null,
+	});
+	let identifyFlashTimer: ReturnType<typeof setTimeout> | undefined;
+
+	// Every viewer window keeps its display metadata registered with Rust:
+	// the "Move to window …" menu, the ⌘⇧M cycle order, and identify badges
+	// are all served from that registry (tab state lives per WebView, so
+	// Rust cannot derive it).
+	$effect(() => {
+		const activeTabTitle = tabManager.activeTab?.title ?? '';
+		const tabCount = tabManager.tabs.length;
+		invoke('set_window_meta', {
+			tagName: null,
+			tagColor: null,
+			activeTabTitle,
+			tabCount,
+		}).catch(() => {});
+	});
+
 	function handleModalSave() {
 		if (modalState.resolve) modalState.resolve('save');
 		modalState.show = false;
@@ -365,6 +391,46 @@ import { t } from './utils/i18n.js';
 	}
 
 	let isForceExiting = $state(false);
+	// True while the window-close walk is showing per-tab dialogs; the native
+	// red button is not blocked by the dialog overlay, so this keeps a second
+	// close request from starting a competing walk.
+	let isCloseWalkActive = false;
+
+	// v2 window-state snapshots live under their own key, and the legacy key
+	// is removed on every write: an older Markpad build restoring a v2
+	// snapshot it cannot understand ends up with undefined tab content, and
+	// its editor then attributes a stale buffer to the wrong tab — which
+	// auto-save happily writes to disk. Keeping the formats on separate keys
+	// makes old and new builds invisible to each other.
+	const WINDOW_STATE_KEY = 'savedTabsDataV2';
+	const LEGACY_STATE_KEY = 'savedTabsData';
+
+	// localStorage is origin-scoped, so every window shares the one snapshot
+	// slot. Only the main window persists and restores tabs: secondary window
+	// labels carry a per-session token, so a snapshot of theirs could never
+	// be restored under the same label again, and letting N windows write the
+	// shared key means the last window closed overwrites everyone else.
+	const isMainWindow = appWindow.label === 'main';
+
+	// Persisted through Rust, not localStorage: setItem is an async message
+	// to the WebKit storage process that dies in transit when the last
+	// window's close ends the process (reproduced in QA as "close secondary
+	// first, then main → snapshot gone"). An awaited invoke keeps the close
+	// handler — and the process — alive until the bytes are on disk, so one
+	// deterministic write at close replaces any keep-writing-while-running
+	// scheme. The localStorage keys are read once for migration and removed
+	// after the first successful Rust write; a downgraded build then starts
+	// a fresh session instead of misreading anything.
+	async function persistWindowState() {
+		if (!isMainWindow) return;
+		try {
+			await invoke('save_window_state', { json: tabManager.serializeState() });
+			localStorage.removeItem(WINDOW_STATE_KEY);
+			localStorage.removeItem(LEGACY_STATE_KEY);
+		} catch (e) {
+			console.error('Failed to save state on close:', e);
+		}
+	}
 
 	async function appExit() {
 		if (settings.restoreStateOnReopen) {
@@ -377,8 +443,16 @@ import { t } from './utils/i18n.js';
 				});
 				if (response !== 'discard') return;
 			}
-			localStorage.removeItem('savedTabsData');
 			isForceExiting = true;
+			if (isMainWindow) {
+				try {
+					await invoke('clear_window_state');
+				} catch (e) {
+					console.error('Failed to clear window state:', e);
+				}
+				localStorage.removeItem(WINDOW_STATE_KEY);
+				localStorage.removeItem(LEGACY_STATE_KEY);
+			}
 		}
 		appWindow.close();
 	}
@@ -850,6 +924,11 @@ import { t } from './utils/i18n.js';
 				if (tabManager.activeTab && tabManager.activeTab.path === filePath) {
 					tabManager.closeTab(tabManager.activeTab.id);
 				}
+			} else {
+				// Permission denials (macOS TCC) and other read failures used
+				// to die silently in the console, leaving an empty tab with no
+				// explanation. Surface them.
+				addToast('Error loading file: ' + errStr, 'error');
 			}
 		}
 	}
@@ -1589,9 +1668,12 @@ import { t } from './utils/i18n.js';
 		}
 
 		// Discard: drop pending save so we don't write what the user just
-		// threw away. The effect will re-arm a timer if the tab gets edited
-		// again.
+		// threw away, and revert to the last saved content so the tab is
+		// clean — callers either close it (tab close) or keep it open for the
+		// window-state snapshot (window close with restore enabled).
 		cancelPendingAutoSave(tabId);
+		tab.rawContent = tab.originalContent;
+		tab.isDirty = false;
 		return true;
 	}
 
@@ -1710,12 +1792,14 @@ import { t } from './utils/i18n.js';
 		let targetPath = tab.path;
 
 		if (!targetPath) {
-			// Special handling for new (untitled) files
+			// Special handling for new (untitled) files. Prefill the numbered
+			// tab title so the dialog itself names which tab is being saved.
 			const selected = await save({
 				filters: [
 					{ name: 'Markdown', extensions: ['md'] },
 					{ name: 'All Files', extensions: ['*'] },
 				],
+				defaultPath: tab.title,
 			});
 			if (selected) {
 				targetPath = selected;
@@ -1978,7 +2062,7 @@ import { t } from './utils/i18n.js';
 
 	async function destroyWindowAfterTabsClosed() {
 		if (settings.restoreStateOnReopen) {
-			localStorage.setItem('savedTabsData', tabManager.serializeState());
+			await persistWindowState();
 		}
 
 		await appWindow.destroy();
@@ -2373,6 +2457,10 @@ import { t } from './utils/i18n.js';
 			e.preventDefault();
 			tabManager.addHomeTab();
 		}
+		if (cmdOrCtrl && e.shiftKey && key === 'm') {
+			e.preventDefault();
+			carryActiveTabToNextWindow();
+		}
 		if (cmdOrCtrl && !e.shiftKey && !e.altKey && key === 'o') {
 			e.preventDefault();
 			selectFile();
@@ -2514,24 +2602,146 @@ import { t } from './utils/i18n.js';
 		}
 	}
 
-	async function handleDetach(tabId: string) {
-		if (!(await canCloseTab(tabId))) return;
+	// Moving a tab preserves its state as-is — dirty content, edit/split
+	// mode, history — so there is deliberately no canCloseTab() save prompt:
+	// movement is not closing. The content travels through the Rust broker
+	// (never disk, never localStorage), and the source tab is deleted only
+	// after the destination confirms the claim, so any failure — window
+	// creation error, dead target, timeout — leaves the tab exactly where
+	// it was. `deliver` is the only step that differs between "to a new
+	// window" and "to an existing window".
+	async function transferTab(
+		tabId: string,
+		deliver: (token: string) => Promise<void>,
+		onMoved?: () => void,
+	): Promise<boolean> {
+		if (isCloseWalkActive) return false;
 		const tab = tabManager.tabs.find((t) => t.id === tabId);
-		if (!tab || !tab.path) return;
-
-		const path = tab.path;
-		tabManager.closeTab(tabId);
+		if (!tab || tab.path === 'HOME') return false;
+
+		const payload = JSON.stringify(snapshotTab(tab));
+		const token = (await invoke('stage_detached_tab', { payload })) as string;
+
+		// Resolves true on the claim acknowledgement (tab moved), false on
+		// timeout or delivery failure (tab stays) — callers that chain moves
+		// (merge) must await the acknowledgement, not just the delivery.
+		return new Promise<boolean>(async (resolve) => {
+			let settled = false;
+			const unlisten = await appWindow.listen<string>('tab-transfer-claimed', (event) => {
+				if (settled || event.payload !== token) return;
+				settled = true;
+				unlisten();
+				tabManager.closeTab(tabId);
+				onMoved?.();
+				resolve(true);
+			});
+			const cancel = () => {
+				if (settled) return;
+				settled = true;
+				unlisten();
+				invoke('cancel_detached_tab', { token }).catch(console.error);
+				resolve(false);
+			};
+			setTimeout(cancel, 15000);
 
-		const label = 'window-' + Date.now();
-		const { WebviewWindow } = await import('@tauri-apps/api/webviewWindow');
-		const webview = new WebviewWindow(label, {
-			url: 'index.html?file=' + encodeURIComponent(path),
-			title: 'Markpad - ' + path.split(/[/\\]/).pop(),
-			width: 1000,
-			height: 800,
+			try {
+				await deliver(token);
+			} catch (e) {
+				console.error('tab transfer delivery failed:', e);
+				addToast('Failed to move tab: ' + String(e), 'error');
+				cancel();
+			}
 		});
 	}
 
+	async function handleDetach(tabId: string) {
+		if (tabManager.tabs.length < 2) return;
+		await transferTab(tabId, (token) => invoke('create_transfer_window', { token }));
+	}
+
+	async function moveTabToWindow(tabId: string, targetLabel: string, focusAfter = false) {
+		await transferTab(
+			tabId,
+			(token) => invoke('offer_tab_to_window', { targetLabel, token }),
+			focusAfter ? () => invoke('focus_window', { label: targetLabel }).catch(console.error) : undefined,
+		);
+	}
+
+	// ⌘⇧M carries the active tab to the next window (by creation order,
+	// cyclic) and focus follows it — pressing repeatedly walks the tab
+	// onward. With no other window it degrades to detach-to-new-window.
+	async function carryActiveTabToNextWindow() {
+		const activeId = tabManager.activeTabId;
+		if (!activeId) return;
+		const windows = (await invoke('list_viewer_windows')) as Array<{ label: string; number: number }>;
+		const others = windows.filter((w) => w.label !== appWindow.label);
+		if (others.length === 0) {
+			await handleDetach(activeId);
+			return;
+		}
+		const ordered = windows.slice().sort((a, b) => a.number - b.number);
+		const selfIdx = ordered.findIndex((w) => w.label === appWindow.label);
+		const next = ordered[(selfIdx + 1) % ordered.length];
+		await moveTabToWindow(activeId, next.label, true);
+	}
+
+	// "Merge all windows": every other window is asked to hand its tabs to
+	// this one. Each source pushes tab-by-tab through the same acknowledged
+	// broker path, then closes itself once empty (HOME tabs are recreatable
+	// and simply dropped).
+	async function mergeAllWindowsHere() {
+		const windows = (await invoke('list_viewer_windows')) as Array<{ label: string }>;
+		const others = windows.filter((w) => w.label !== appWindow.label);
+		if (others.length === 0) {
+			addToast(t('toast.noOtherWindows', settings.language), 'info');
+			return;
+		}
+		for (const w of others) {
+			emitTo(w.label, 'merge-into', appWindow.label).catch(console.error);
+		}
+	}
+
+	// Claims a staged transfer and builds the tab. The payload is validated
+	// strictly before any tab is constructed: a tab whose content fields are
+	// not strings must never exist (the editor would attribute a stale
+	// buffer to it and auto-save could destroy the file). Used both by a
+	// fresh detach window on boot (token from its own label) and by an
+	// existing window receiving a "tab-transfer-offer".
+	async function consumeTransferToken(token: string): Promise<boolean> {
+		try {
+			const payload = (await invoke('claim_detached_tab', { token })) as string | null;
+			const snap = payload ? validateTransferPayload(payload) : null;
+			if (!snap) {
+				console.warn('Tab transfer claim failed or payload invalid');
+				return false;
+			}
+			const id = tabManager.insertTransferredTab(snap);
+			const transferred = tabManager.tabs.find((t) => t.id === id);
+			if (transferred) {
+				await renderTabPreviewFromRaw(transferred);
+			}
+			showHome = false;
+			return true;
+		} catch (e) {
+			console.error('Tab transfer claim error:', e);
+			return false;
+		}
+	}
+
+	async function mergeSelfInto(targetLabel: string) {
+		if (isCloseWalkActive) return;
+		for (const tab of [...tabManager.tabs]) {
+			if (tab.path === 'HOME') {
+				tabManager.closeTab(tab.id);
+				continue;
+			}
+			await moveTabToWindow(tab.id, targetLabel);
+		}
+		if (tabManager.tabs.length === 0) {
+			await appWindow.destroy();
+		}
+	}
+
 	function startDrag(e: MouseEvent, tabId: string | null) {
 		if (!tabId) return;
 		e.preventDefault();
@@ -2651,26 +2861,72 @@ import { t } from './utils/i18n.js';
 				const appWindow = getCurrentWindow();
 				const appMode = (await invoke('get_app_mode')) as any;
 
-			if (settings.restoreStateOnReopen) {
-				const savedData = localStorage.getItem('savedTabsData');
+			if (isMainWindow && settings.restoreStateOnReopen) {
+				// localStorage first, Rust file as fallback. Startup always
+				// deletes the localStorage keys after migrating, so their
+				// presence means an OLDER build wrote them since our last
+				// run (fresh install upgrade, or a downgrade period) — in
+				// either case they are newer than the Rust file. Reading the
+				// file first would resurrect a pre-downgrade snapshot over
+				// the one the older build just wrote.
+				const savedData =
+					localStorage.getItem(WINDOW_STATE_KEY) ??
+					localStorage.getItem(LEGACY_STATE_KEY) ??
+					((await invoke('load_window_state').catch(() => null)) as string | null);
 				if (savedData) {
 					tabManager.restoreState(savedData);
-					for (const tab of tabManager.tabs) {
-						if (!tab.content && tab.rawContent) {
-							renderMarkdownPreview(tab.rawContent, tab.path)
-								.then((processed) => {
-									tabManager.updateTabContent(tab.id, processed);
-									if (tabManager.activeTabId === tab.id) {
-										tick().then(renderRichContent);
-									}
-								})
-								.catch(console.error);
+					// The snapshot carries window state only — content always
+					// comes from disk, so restored tabs show the file's real
+					// current bytes. A file that no longer exists drops its tab.
+					for (const tab of [...tabManager.tabs]) {
+						try {
+							const raw = (await invoke('read_file_content', { path: tab.path })) as string;
+							tab.rawContent = raw;
+							tab.originalContent = raw;
+							const processed = await renderMarkdownPreview(raw, tab.path);
+							tabManager.updateTabContent(tab.id, processed);
+							if (tabManager.activeTabId === tab.id) {
+								tick().then(renderRichContent);
+							}
+						} catch (e) {
+							console.warn('Restore: dropping tab for unreadable file', tab.path, e);
+							tabManager.closeTab(tab.id);
 						}
 					}
 				}
 			}
+			if (isMainWindow) {
+				// Hand the snapshot over to the Rust file NOW, then drop the
+				// localStorage keys: write-through first so a crash between
+				// the two steps can never lose the snapshot, and delete at
+				// startup rather than at close so the stale copy cannot
+				// outlive the migration (the close-time removal never runs
+				// for users who disabled restore-on-reopen, which would
+				// leave the old snapshot on disk forever).
+				if (settings.restoreStateOnReopen && tabManager.tabs.length > 0) {
+					await persistWindowState();
+				}
+				localStorage.removeItem(WINDOW_STATE_KEY);
+				localStorage.removeItem(LEGACY_STATE_KEY);
+			}
 
 			const urlParams = new URLSearchParams(window.location.search);
+
+			// A window created by "Move to New Window" claims its tab from the
+			// Rust broker. The transfer token rides in the window label itself
+			// ("window-<token>") — a URL query would 404 in the asset protocol.
+			// The payload is validated strictly before any tab is built: a tab
+			// whose content fields are not strings must never be constructed
+			// (the editor would attribute a stale buffer to it and auto-save
+			// could destroy the file). A failed claim or invalid payload just
+			// yields an empty window — the source kept its tab.
+			const claimToken = appWindow.label.startsWith('window-')
+				? appWindow.label.slice('window-'.length)
+				: null;
+			if (claimToken) {
+				await consumeTransferToken(claimToken);
+			}
+
 			const fileParam = urlParams.get('file');
 			if (fileParam) {
 				const decodedPath = decodeURIComponent(fileParam);
@@ -2683,7 +2939,7 @@ import { t } from './utils/i18n.js';
 				}),
 			);
 			unlisteners.push(
-				await listen('file-changed', () => {
+				await appWindow.listen('file-changed', () => {
 					if (!liveMode || !currentFile) return;
 					// Skip events caused by our own auto-save / save invocations,
 					// otherwise the reload would clobber any keystrokes that landed
@@ -2698,28 +2954,28 @@ import { t } from './utils/i18n.js';
 			);
 
 			unlisteners.push(
-				await listen('file-path', (event) => {
+				await appWindow.listen('file-path', (event) => {
 					const filePath = event.payload as string;
 					if (filePath) loadMarkdown(filePath);
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-close-file', () => {
+				await appWindow.listen('menu-close-file', () => {
 					closeFile();
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-edit-file', () => {
+				await appWindow.listen('menu-edit-file', () => {
 					toggleEdit();
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-edit-find', () => {
+				await appWindow.listen('menu-edit-find', () => {
 					triggerFindAction();
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-tab-rename', async (event) => {
+				await appWindow.listen('menu-tab-rename', async (event) => {
 					const tabId = event.payload as string;
 					const tab = tabManager.tabs.find((t) => t.id === tabId);
 					if (!tab || !tab.path) return;
@@ -2742,31 +2998,64 @@ import { t } from './utils/i18n.js';
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-tab-new', () => {
+				await appWindow.listen('menu-tab-new', () => {
 					tabManager.addNewTab();
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-tab-undo', () => {
+				await appWindow.listen('menu-tab-undo', () => {
 					console.log('Received menu-tab-undo event');
 					handleUndoCloseTab();
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-tab-close', async (event) => {
+				await appWindow.listen('menu-tab-close', async (event) => {
 					const tabId = event.payload as string;
 					await closeTabAndWindowIfLast(tabId);
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-tab-close-others', (event) => {
+				await appWindow.listen('menu-tab-detach', (event) => {
+					handleDetach(event.payload as string);
+				}),
+			);
+			unlisteners.push(
+				await appWindow.listen('menu-tab-move', (event) => {
+					const { tabId, targetLabel } = event.payload as { tabId: string; targetLabel: string };
+					moveTabToWindow(tabId, targetLabel);
+				}),
+			);
+			unlisteners.push(
+				await appWindow.listen<string>('tab-transfer-offer', (event) => {
+					// A close review in progress must not race arriving tabs;
+					// the untouched stage times out and the source keeps its
+					// tab.
+					if (isCloseWalkActive) return;
+					consumeTransferToken(event.payload);
+				}),
+			);
+			unlisteners.push(
+				await appWindow.listen<string>('merge-into', (event) => {
+					mergeSelfInto(event.payload);
+				}),
+			);
+			unlisteners.push(
+				await appWindow.listen('window-identify', (event) => {
+					const p = event.payload as { display: string; color: string | null };
+					identifyFlash = { show: true, display: p.display, color: p.color };
+					clearTimeout(identifyFlashTimer);
+					identifyFlashTimer = setTimeout(() => (identifyFlash.show = false), 700);
+				}),
+			);
+			unlisteners.push(
+				await appWindow.listen('menu-tab-close-others', (event) => {
 					const tabId = event.payload as string;
 					const tabsToClose = tabManager.tabs.filter((t) => t.id !== tabId).map((t) => t.id);
 					tabsToClose.forEach((id) => tabManager.closeTab(id));
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-tab-close-right', (event) => {
+				await appWindow.listen('menu-tab-close-right', (event) => {
 					const tabId = event.payload as string;
 					const index = tabManager.tabs.findIndex((t) => t.id === tabId);
 					if (index !== -1) {
@@ -2776,7 +3065,7 @@ import { t } from './utils/i18n.js';
 				}),
 			);
 			unlisteners.push(
-				await listen('menu-check-updates', () => {
+				await appWindow.listen('menu-check-updates', () => {
 					updateStore.openDialog();
 				}),
 			);
@@ -2785,114 +3074,106 @@ import { t } from './utils/i18n.js';
 			// menu and the burger stay behaviourally identical. Save mirrors
 			// the keydown guard (`isEditing || isSplit`) so menu ⌘S in pure
 			// view mode is a no-op, matching the keyboard shortcut.
-			unlisteners.push(await listen('menu-app-quit',         () => appExit()));
-			unlisteners.push(await listen('menu-file-new',         () => handleNewFile()));
-			unlisteners.push(await listen('menu-file-open',        () => selectFile()));
-			unlisteners.push(await listen('menu-file-reload',      () => reloadFromDisk()));
-			unlisteners.push(await listen('menu-file-close',       () => closeFile()));
-			unlisteners.push(await listen('menu-file-save',        () => {
+			unlisteners.push(await appWindow.listen('menu-app-quit',         () => appExit()));
+			unlisteners.push(await appWindow.listen('menu-file-new',         () => handleNewFile()));
+			unlisteners.push(await appWindow.listen('menu-file-open',        () => selectFile()));
+			unlisteners.push(await appWindow.listen('menu-file-reload',      () => reloadFromDisk()));
+			unlisteners.push(await appWindow.listen('menu-file-close',       () => closeFile()));
+			unlisteners.push(await appWindow.listen('menu-file-save',        () => {
 				if (isEditing || tabManager.activeTab?.isSplit) saveContent();
 			}));
-			unlisteners.push(await listen('menu-file-save-as',     () => saveContentAs()));
-			unlisteners.push(await listen('menu-file-export-html', () => exportAsHtml()));
-			unlisteners.push(await listen('menu-file-export-pdf', () => exportAsPdf()));
+			unlisteners.push(await appWindow.listen('menu-file-save-as',     () => saveContentAs()));
+			unlisteners.push(await appWindow.listen('menu-file-export-html', () => exportAsHtml()));
+			unlisteners.push(await appWindow.listen('menu-file-export-pdf', () => exportAsPdf()));
 			unlisteners.push(
 				await appWindow.onCloseRequested(async (event) => {
 					console.log('onCloseRequested triggered');
 					if (isForceExiting) return;
 
-					// CRITICAL: before serializing tab state to localStorage
-					// (the restore-on-reopen path), make sure all pending
-					// auto-save edits are actually flushed to disk. Without
-					// this, closing the window with auto-save on but
-					// confirmBeforeSave off would silently put unsaved edits
-					// in localStorage only and never persist them to file.
-					if (settings.autoSave && !settings.confirmBeforeSave) {
-						const dirtyWithPath = tabManager.tabs.filter(
-							(t) => t.isDirty && t.path !== '',
-						);
-						for (const tab of dirtyWithPath) {
-							cancelPendingAutoSave(tab.id);
-							try {
-								await saveContent(tab.id);
-							} catch (e) {
-								console.error('Flush-on-close save failed for tab', tab.id, e);
-							}
-						}
-					}
-
-					if (settings.restoreStateOnReopen) {
-						try {
-							const stateStr = tabManager.serializeState();
-							localStorage.setItem('savedTabsData', stateStr);
-						} catch (e) {
-							console.error('Failed to save state on close:', e);
-						}
+					// The red button is a native control, so it is NOT blocked
+					// by the in-app dialog overlay: a second click while the
+					// walk below is showing a dialog would re-enter this handler
+					// and start a competing walk whose setActive calls fight the
+					// first one — the highlighted tab stops matching the dialog.
+					// One walk at a time.
+					if (isCloseWalkActive) {
+						event.preventDefault();
 						return;
 					}
 
+					// Unsaved content and session restore are separate concerns:
+					// dirty tabs are resolved FIRST through the per-tab dialogs,
+					// then the restore snapshot records window state only (open
+					// files, active tab, edit mode, split, scroll) — it never
+					// carries document content.
 					const dirtyTabs = tabManager.tabs.filter((t) => t.isDirty);
-					console.log('Dirty tabs:', dirtyTabs.length);
 					if (dirtyTabs.length > 0) {
-						console.log('Preventing default close');
-				event.preventDefault();
-
-				// Auto-save without confirmation: try silently saving every dirty
-				// tab that has a real path. If untitled tabs exist they need a
-				// Save dialog, so we just fall through to the modal — that is
-				// NOT a failure case and shouldn't show an error toast. We
-				// also DON'T clear pending timers up front: if the user picks
-				// Cancel in the modal below, we want the timers to keep
-				// running for tabs that are still dirty.
-				if (settings.autoSave && !settings.confirmBeforeSave) {
-					const tabsWithPath = dirtyTabs.filter((t) => t.path !== '');
-					const hasUntitled = dirtyTabs.some((t) => t.path === '');
-					if (!hasUntitled) {
-						let allOk = true;
-						for (const tab of tabsWithPath) {
-							cancelPendingAutoSave(tab.id);
-							const ok = await saveContent(tab.id);
-							if (!ok) { allOk = false; break; }
-						}
-						if (allOk) {
-							appWindow.close();
-							return;
-						}
-						// A real save failure happened — surface it.
-						addToast(t('toast.autoSaveFailed', settings.language), 'error');
-					}
-					// hasUntitled: skip toast, just fall through to the modal.
-				}
-
-				const response = await askCustom(t('modal.youHaveUnsavedFiles', settings.language).replace('{{count}}', dirtyTabs.length.toString()), {
-											title: t('modal.unsavedChanges', settings.language),
-					kind: 'warning',
-					showSave: true,
-				});
+						event.preventDefault();
+						isCloseWalkActive = true;
+						// The walk's dialogs are in-app modals inside THIS
+						// window: with multiple windows, another window may be
+						// covering it and the review would be invisible. Bring
+						// the reviewing window to the front first.
+						invoke('show_window').catch(console.error);
+						try {
+							// Auto-save without confirmation: silently save every
+							// dirty tab that has a real path. Untitled tabs need a
+							// Save dialog, so the walk below handles them. A failed
+							// silent save is surfaced and its tab also goes to the
+							// walk. Timers are cancelled per tab right before its
+							// save to avoid duplicate writes.
+							if (settings.autoSave && !settings.confirmBeforeSave) {
+								for (const tab of dirtyTabs.filter((t) => t.path !== '')) {
+									cancelPendingAutoSave(tab.id);
+									const ok = await saveContent(tab.id);
+									if (!ok) {
+										addToast(t('toast.autoSaveFailed', settings.language), 'error');
+										break;
+									}
+								}
+							}
 
-						if (response === 'save') {
-							// Attempt to save all dirty tabs
-							for (const tab of dirtyTabs) {
-								tabManager.setActive(tab.id);
+							// Close review (issue #189): walk the remaining dirty
+							// tabs one at a time — activate each and run the same
+							// localized unsaved-changes dialog a single tab close
+							// shows. Cancel stops the walk and keeps the window
+							// open. Strict tab-strip order (left to right) so the
+							// sequence is predictable; numbered untitled titles
+							// let the dialog name each tab. Re-find every round —
+							// a save can leave a tab dirty again (TOCTOU) and
+							// tabs can change while a dialog is up.
+							while (true) {
+								const dirty = tabManager.tabs.find((t) => t.isDirty);
+								if (!dirty) break;
+								tabManager.setActive(dirty.id);
 								await tick();
-								cancelPendingAutoSave(tab.id);
-								const saved = await saveContent(tab.id);
-								if (!saved) return; // Cancelled or failed
+								if (!(await canCloseTab(dirty.id))) return;
+								// Resolved tabs (saved, or reverted by Don't Save)
+								// stay open for the window-state snapshot when
+								// restore is enabled; untitled tabs have nothing to
+								// restore, and with restore off the red button
+								// closes tabs one by one.
+								if (!settings.restoreStateOnReopen || dirty.path === '') {
+									tabManager.closeTab(dirty.id);
+								}
 							}
-							// If all saved successfully, close the app
-							appWindow.close();
-						} else if (response === 'discard') {
-							// Force close by removing this listener or skipping check?
-							// Since we are inside the event handler, we can't easily remove "this" listener specifically
-							// without refactoring how unlisteners are stored/accessed relative to this callback.
-							// However, if we just want to exit, we can use exit() from rust or just appWindow.destroy()?
-							// WebviewWindow.close() triggers this event again.
-							// Solution: invoke a command to exit forcefully or set a flag.
-							// The simplest might be to just clear the dirty flags and close.
-							tabManager.tabs.forEach((t) => (t.isDirty = false));
-							appWindow.close();
+						} finally {
+							isCloseWalkActive = false;
 						}
 					}
+
+					// Session is clean now; record the window state for restore.
+					// Awaited: the close-requested handler holds the close open
+					// until the Rust write returns, so the process cannot exit
+					// under the snapshot.
+					if (settings.restoreStateOnReopen) {
+						await persistWindowState();
+					}
+
+					// If we intercepted the close to run the review, re-trigger
+					// it: the handler re-enters, finds nothing dirty, and the
+					// close proceeds.
+					if (dirtyTabs.length > 0) appWindow.close();
 				}),
 			);
 
@@ -2954,13 +3235,19 @@ import { t } from './utils/i18n.js';
 				}),
 			);
 
-			try {
-				const args: string[] = await invoke('send_markdown_path');
-				if (args?.length > 0) {
-					await loadMarkdown(args[0]);
+			// Startup-file delivery (argv / macOS Opened-before-ready stash) is
+			// a boot-time channel that belongs to the FIRST window only. It is
+			// process-global state: letting every window consume it meant each
+			// detached window re-opened the file the app was launched with.
+			if (isMainWindow) {
+				try {
+					const args: string[] = await invoke('send_markdown_path');
+					if (args?.length > 0) {
+						await loadMarkdown(args[0]);
+					}
+				} catch (error) {
+					console.error('Error receiving Markdown file path:', error);
 				}
-			} catch (error) {
-				console.error('Error receiving Markdown file path:', error);
 			}
 
 			mode = appMode;
@@ -2994,6 +3281,7 @@ import { t } from './utils/i18n.js';
 		onselectFile={selectFile}
 		onnewFile={handleNewFile}
 		onopenFile={selectFile}
+		onmergeAllWindows={mergeAllWindowsHere}
 		onsaveFile={saveContent}
 		onsaveFileAs={saveContentAs}
 		onreloadFromDisk={reloadFromDisk}
@@ -3037,6 +3325,7 @@ import { t } from './utils/i18n.js';
 		onselectFile={selectFile}
 		onnewFile={handleNewFile}
 		onopenFile={selectFile}
+		onmergeAllWindows={mergeAllWindowsHere}
 		onsaveFile={saveContent}
 		onsaveFileAs={saveContentAs}
 		onreloadFromDisk={reloadFromDisk}
@@ -3389,6 +3678,15 @@ import { t } from './utils/i18n.js';
 
 	<UpdateDialog />
 
+	{#if identifyFlash.show}
+		<div
+			class="identify-flash"
+			style:--identify-color={identifyFlash.color ?? 'var(--color-accent-fg)'}
+			transition:fade={{ duration: 150 }}>
+			<span class="identify-badge">{identifyFlash.display}</span>
+		</div>
+	{/if}
+
 	<div class="toast-container">
 		{#each toasts as toast (toast.id)}
 			<Toast 
@@ -3870,6 +4168,33 @@ import { t } from './utils/i18n.js';
 		to { opacity: 1; }
 	}
 
+	.identify-flash {
+		position: fixed;
+		inset: 0;
+		z-index: 40000;
+		pointer-events: none;
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		box-shadow: inset 0 0 0 3px var(--identify-color);
+		border-radius: 8px;
+	}
+
+	.identify-badge {
+		padding: 10px 22px;
+		border-radius: 10px;
+		background: var(--identify-color);
+		color: #fff;
+		font-size: 20px;
+		font-weight: 600;
+		font-family: var(--win-font);
+		box-shadow: 0 8px 30px rgba(0, 0, 0, 0.25);
+		max-width: 70vw;
+		overflow: hidden;
+		text-overflow: ellipsis;
+		white-space: nowrap;
+	}
+
 	.toast-container {
 		position: fixed;
 		bottom: 24px;
diff --git a/src/lib/components/ContextMenu.svelte b/src/lib/components/ContextMenu.svelte
index e50e42f..a9d10a8 100644
--- a/src/lib/components/ContextMenu.svelte
+++ b/src/lib/components/ContextMenu.svelte
@@ -4,6 +4,9 @@
 		shortcut?: string;
 		disabled?: boolean;
 		onClick?: () => void;
+		// Fired when the pointer enters the item — used by "Move to window…"
+		// entries to make the target window identify itself with a flash.
+		onHover?: () => void;
 		separator?: boolean;
 	};
 
@@ -60,6 +63,9 @@
 					<button
 						class="menu-item"
 						disabled={item.disabled}
+						onmouseenter={() => {
+							if (!item.disabled) item.onHover?.();
+						}}
 						onclick={() => {
 							if (!item.disabled && item.onClick) {
 								item.onClick();
diff --git a/src/lib/components/Tab.svelte b/src/lib/components/Tab.svelte
index 4a19ed4..bbef3e5 100644
--- a/src/lib/components/Tab.svelte
+++ b/src/lib/components/Tab.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
-	import type { Tab } from '../stores/tabs.svelte.js';
+	import { type Tab, tabManager } from '../stores/tabs.svelte.js';
 	import ContextMenu, { type ContextMenuItem } from './ContextMenu.svelte';
 	import { invoke } from '@tauri-apps/api/core';
-	import { emit } from '@tauri-apps/api/event';
+	import { emitTo } from '@tauri-apps/api/event';
+	import { getCurrentWindow } from '@tauri-apps/api/window';
 	import { t } from '../utils/i18n.js';
 	import { settings } from '../stores/settings.svelte.js';
 	import { getTabFileActions, hasRealFilePath } from '../utils/tabFileActions.js';
@@ -50,7 +51,21 @@
 		invoke('open_file_folder', { path: tab.path }).catch(console.error);
 	}
 
-	function handleContextMenu(e: MouseEvent) {
+	type ViewerWindowEntry = {
+		label: string;
+		number: number;
+		tag_name: string | null;
+		tag_color: string | null;
+		active_tab_title: string;
+		tab_count: number;
+	};
+
+	function windowDisplay(w: ViewerWindowEntry, lang: typeof settings.language): string {
+		const identity = w.tag_name ?? `${t('menu.window', lang)} ${w.number}`;
+		return w.active_tab_title ? `${identity} · ${w.active_tab_title}` : identity;
+	}
+
+	async function handleContextMenu(e: MouseEvent) {
 		e.preventDefault();
 		e.stopPropagation();
 
@@ -61,20 +76,53 @@
 			onClick: action.id === 'copy-path' ? copyTabPath : openTabFileLocation,
 		}));
 
+		// "Move to window …" targets come from the Rust window registry.
+		// Hovering an entry asks that window to identify itself with a
+		// flash, so the menu label never needs to be guessed at.
+		const selfLabel = getCurrentWindow().label;
+		let moveToWindowItems: ContextMenuItem[] = [];
+		try {
+			const windows = (await invoke('list_viewer_windows')) as ViewerWindowEntry[];
+			moveToWindowItems = windows
+				.filter((w) => w.label !== selfLabel)
+				.map((w) => ({
+					label: `${t('menu.moveToWindow', currentLang)} ${windowDisplay(w, currentLang)}`,
+					disabled: tab.path === 'HOME',
+					onHover: () =>
+						emitTo(w.label, 'window-identify', {
+							display: w.tag_name ?? `${t('menu.window', currentLang)} ${w.number}`,
+							color: w.tag_color,
+						}),
+					onClick: () =>
+						emitTo(selfLabel, 'menu-tab-move', { tabId: tab.id, targetLabel: w.label }),
+				}));
+		} catch (err) {
+			console.error('list_viewer_windows failed:', err);
+		}
+
 		tabContextMenu = {
 			show: true,
 			x: e.clientX,
 			y: e.clientY,
 			items: [
-				{ label: t('menu.newFile', currentLang), shortcut: 'Ctrl+T', onClick: () => emit('menu-tab-new') },
-				{ label: t('menu.undoCloseTab', currentLang), shortcut: 'Ctrl+Shift+T', onClick: () => emit('menu-tab-undo') },
-				{ label: t('menu.rename', currentLang), onClick: () => emit('menu-tab-rename', tab.id) },
+				{ label: t('menu.newFile', currentLang), shortcut: 'Ctrl+T', onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-new') },
+				{ label: t('menu.undoCloseTab', currentLang), shortcut: 'Ctrl+Shift+T', onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-undo') },
+				{ label: t('menu.rename', currentLang), onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-rename', tab.id) },
 				{ separator: true },
 				...fileActionItems,
 				{ separator: true },
-				{ label: t('menu.closeFile', currentLang), shortcut: 'Ctrl+W', onClick: () => emit('menu-tab-close', tab.id) },
-				{ label: t('menu.closeOtherTabs', currentLang), onClick: () => emit('menu-tab-close-others', tab.id) },
-				{ label: t('menu.closeTabsToRight', currentLang), onClick: () => emit('menu-tab-close-right', tab.id) },
+				{
+					label: t('menu.moveToNewWindow', currentLang),
+					// Moving the only tab would just churn windows, and the HOME
+					// tab is recreatable anywhere; both stay in place.
+					disabled: tab.path === 'HOME' || tabManager.tabs.length < 2,
+					onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-detach', tab.id),
+				},
+				...moveToWindowItems,
+				{ separator: true },
+				{ label: t('menu.closeFile', currentLang), shortcut: 'Ctrl+W', onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-close', tab.id) },
+				{ label: t('menu.closeOtherTabs', currentLang), onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-close-others', tab.id) },
+				{ label: t('menu.closeTabsToRight', currentLang), onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-close-right', tab.id) },
 			],
 		};
 	}
diff --git a/src/lib/components/TabList.svelte b/src/lib/components/TabList.svelte
index 2d223d6..23ffb21 100644
--- a/src/lib/components/TabList.svelte
+++ b/src/lib/components/TabList.svelte
@@ -4,7 +4,8 @@
 	import ContextMenu, { type ContextMenuItem } from './ContextMenu.svelte';
 	import { t } from '../utils/i18n.js';
 	import { settings } from '../stores/settings.svelte.js';
-	import { emit } from '@tauri-apps/api/event';
+	import { emitTo } from '@tauri-apps/api/event';
+	import { getCurrentWindow } from '@tauri-apps/api/window';
 
 	import { flip } from 'svelte/animate';
 	import { tick } from 'svelte';
@@ -167,8 +168,8 @@
 			x: e.clientX,
 			y: e.clientY,
 			items: [
-				{ label: t('menu.newFile', currentLang), shortcut: 'Ctrl+T', onClick: () => emit('menu-tab-new') },
-				{ label: t('menu.undoCloseTab', currentLang), shortcut: 'Ctrl+Shift+T', onClick: () => emit('menu-tab-undo') },
+				{ label: t('menu.newFile', currentLang), shortcut: 'Ctrl+T', onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-new') },
+				{ label: t('menu.undoCloseTab', currentLang), shortcut: 'Ctrl+Shift+T', onClick: () => emitTo(getCurrentWindow().label, 'menu-tab-undo') },
 			]
 		};
 	}
diff --git a/src/lib/components/TitleBar.svelte b/src/lib/components/TitleBar.svelte
index 9383894..60d96fc 100644
--- a/src/lib/components/TitleBar.svelte
+++ b/src/lib/components/TitleBar.svelte
@@ -29,6 +29,7 @@
 		onselectFile,
 		onnewFile,
 		onopenFile,
+		onmergeAllWindows,
 		onsaveFile,
 		onsaveFileAs,
 		onreloadFromDisk,
@@ -70,6 +71,7 @@
 		onselectFile?: () => void;
 		onnewFile?: () => void;
 		onopenFile?: () => void;
+		onmergeAllWindows?: () => void;
 		onsaveFile?: () => void;
 		onsaveFileAs?: () => void;
 		onreloadFromDisk?: () => void;
@@ -386,6 +388,16 @@
 					></svg>
 				{t('menu.openFile', currentLanguage)}
 				<span class="menu-shortcut">{modifier}+O</span>
+			</button>
+					<button
+				class="home-menu-item"
+				onclick={() => {
+					homeMenuOpen = false;
+					onmergeAllWindows?.();
+				}}>
+				<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+					><rect x="3" y="3" width="7" height="18" rx="1"></rect><rect x="14" y="3" width="7" height="7" rx="1"></rect><path d="M17.5 14v6"></path><path d="M14.5 17h6"></path></svg>
+				{t('menu.mergeAllWindows', currentLanguage)}
 			</button>
 					{#if currentFile !== '' || (tabManager.activeTab && tabManager.activeTab.isEditing)}
 						<button
diff --git a/src/lib/stores/tabs.svelte.ts b/src/lib/stores/tabs.svelte.ts
index 73506d4..5458c6c 100644
--- a/src/lib/stores/tabs.svelte.ts
+++ b/src/lib/stores/tabs.svelte.ts
@@ -1,5 +1,7 @@
 import { t } from '../utils/i18n.js';
+import { nextUntitledTitle } from '../utils/untitledTitle.js';
 import { settings } from './settings.svelte.js';
+import { buildTransferredTab, type TransferableTab } from '../utils/tabTransfer.js';
 import {
 	canGoBackInHistory,
 	canGoForwardInHistory,
@@ -54,21 +56,77 @@ class TabManager {
 		return this.tabs.find((t) => t.id === this.activeTabId);
 	}
 
+	/**
+	 * Serialize WINDOW state only: which files are open, the active tab, and
+	 * per-tab UI (edit mode, split, scroll). Document content always lives on
+	 * disk — the snapshot never carries rawContent, so unsaved changes are
+	 * handled exclusively by the close dialogs, never smuggled through here.
+	 * Untitled tabs have no disk backing and are resolved at close, so they
+	 * are not persisted.
+	 */
 	serializeState(): string {
 		const stateData = {
+			version: 2,
 			activeTabId: this.activeTabId,
-			tabs: this.tabs.map(t => ({ ...t, editorViewState: null, content: '' }))
+			tabs: this.tabs
+				.filter((t) => t.path !== '')
+				.map((t) => ({
+					id: t.id,
+					path: t.path,
+					title: t.title,
+					isEditing: t.isEditing,
+					isSplit: t.isSplit,
+					splitRatio: t.splitRatio,
+					isScrollSynced: t.isScrollSynced,
+					scrollTop: t.scrollTop,
+					scrollPercentage: t.scrollPercentage,
+					anchorLine: t.anchorLine
+				}))
 		};
 		return JSON.stringify(stateData);
 	}
 
+	/**
+	 * Rebuild clean tabs from a window-state snapshot. Content starts empty —
+	 * the caller reads each file from disk afterwards. Also accepts the legacy
+	 * full-tab format, from which only the window-state fields are taken
+	 * (legacy untitled entries are dropped).
+	 */
 	restoreState(jsonBuffer: string) {
 		try {
 			const data = JSON.parse(jsonBuffer);
-			if (data && Array.isArray(data.tabs)) {
-				this.tabs = data.tabs;
-				this.activeTabId = data.activeTabId;
+			if (!data || !Array.isArray(data.tabs)) return;
+
+			const restored: Tab[] = [];
+			for (const saved of data.tabs) {
+				if (!saved || typeof saved.path !== 'string' || saved.path === '') continue;
+				const filename = saved.path.split('\\').pop()?.split('/').pop() || saved.path;
+				const fileHistory = createFileHistory(saved.path, '');
+				restored.push({
+					id: typeof saved.id === 'string' ? saved.id : crypto.randomUUID(),
+					path: saved.path,
+					title: typeof saved.title === 'string' && saved.title !== '' ? saved.title : filename,
+					content: '',
+					rawContent: '',
+					originalContent: '',
+					scrollTop: typeof saved.scrollTop === 'number' ? saved.scrollTop : 0,
+					isDirty: false,
+					isEditing: saved.isEditing === true,
+					history: fileHistory.history,
+					historyIndex: fileHistory.historyIndex,
+					editorViewState: null,
+					scrollPercentage: typeof saved.scrollPercentage === 'number' ? saved.scrollPercentage : 0,
+					anchorLine: typeof saved.anchorLine === 'number' ? saved.anchorLine : 0,
+					isSplit: saved.isSplit === true,
+					splitRatio: typeof saved.splitRatio === 'number' ? saved.splitRatio : 0.5,
+					isScrollSynced: saved.isScrollSynced === true
+				});
 			}
+
+			this.tabs = restored;
+			this.activeTabId = restored.some((t) => t.id === data.activeTabId)
+				? data.activeTabId
+				: restored[0]?.id ?? null;
 		} catch (e) {
 			console.error('Failed to restore tab state', e);
 		}
@@ -76,7 +134,12 @@ class TabManager {
 
 	addTab(path: string, content: string = '') {
 		const id = crypto.randomUUID();
-		const filename = path.split('\\').pop()?.split('/').pop() || t('tabs.untitled', settings.language);
+		const filename =
+			path.split('\\').pop()?.split('/').pop() ||
+			nextUntitledTitle(
+				this.tabs.map((tab) => tab.title),
+				t('tabs.untitled', settings.language),
+			);
 		const fileHistory = createFileHistory(path, content);
 
 		this.tabs.push({
@@ -109,7 +172,10 @@ class TabManager {
 		this.tabs.push({
 			id,
 			path: '',
-			title: t('tabs.untitled', settings.language),
+			title: nextUntitledTitle(
+				this.tabs.map((tab) => tab.title),
+				t('tabs.untitled', settings.language),
+			),
 			content,
 			rawContent: content,
 			originalContent: content,
@@ -160,6 +226,24 @@ class TabManager {
 		this.activeTabId = id;
 	}
 
+	/**
+	 * Insert a tab that arrived from another window (cross-window transfer).
+	 * The snapshot carries the unsaved buffer — see tabTransfer.ts. Rendered
+	 * content starts empty (the caller re-renders); untitled arrivals are
+	 * re-numbered against THIS window's tabs. Independent of serializeState/
+	 * restoreState, which persist window shape only.
+	 */
+	insertTransferredTab(snap: TransferableTab): string {
+		const tab = buildTransferredTab(
+			snap,
+			this.tabs.map((tab) => tab.title),
+			t('tabs.untitled', settings.language),
+		);
+		this.tabs.push(tab);
+		this.activeTabId = tab.id;
+		return tab.id;
+	}
+
 	closeTab(id: string) {
 		const index = this.tabs.findIndex((t) => t.id === id);
 		if (index === -1) return;
diff --git a/src/lib/utils/i18n.ts b/src/lib/utils/i18n.ts
index d5c5040..f91d5f1 100644
--- a/src/lib/utils/i18n.ts
+++ b/src/lib/utils/i18n.ts
@@ -151,6 +151,10 @@ export const translations: Record<LanguageCode, Translation> = {
             reloadFromDisk: 'Reload from Disk',
             closeFile: 'Close File',
             closeWindow: 'Close Window',
+            moveToNewWindow: 'Move to New Window',
+            moveToWindow: 'Move to',
+            window: 'Window',
+            mergeAllWindows: 'Merge All Windows Here',
             undo: 'Undo',
             redo: 'Redo',
             cut: 'Cut',
@@ -238,6 +242,7 @@ export const translations: Record<LanguageCode, Translation> = {
             failedToCopyCode: 'Failed to copy code',
             unsupportedFile: 'Unsupported file type: {{filename}}',
             autoSaveFailed: 'Auto-save failed — unsaved changes still in memory',
+            noOtherWindows: 'No other windows to merge',
             savedNewerEdits: 'Saved — staying in edit mode because you have newer edits',
             openExportedFileFailed: 'Could not open exported file'
         },
@@ -465,6 +470,10 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: '另存为',
             closeFile: '关闭文件',
             closeWindow: '关闭窗口',
+            moveToNewWindow: '移动到新窗口',
+            moveToWindow: '移动到',
+            window: '窗口',
+            mergeAllWindows: '合并所有窗口到本窗口',
             undo: '撤销',
             redo: '重做',
             cut: '剪切',
@@ -535,6 +544,7 @@ export const translations: Record<LanguageCode, Translation> = {
             failedToCopyCode: '复制代码失败',
             unsupportedFile: '不支持的文件类型: {{filename}}',
             autoSaveFailed: '自动保存失败 — 未保存的更改仍在内存中',
+            noOtherWindows: '没有其他窗口可合并',
             savedNewerEdits: '已保存 — 因为存在更新的编辑,继续保持编辑模式'
         },
         modal: {
@@ -727,6 +737,10 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: '名前を付けて保存',
             closeFile: 'ファイルを閉じる',
             closeWindow: 'ウィンドウを閉じる',
+            moveToNewWindow: '新しいウィンドウに移動',
+            moveToWindow: '移動先:',
+            window: 'ウィンドウ',
+            mergeAllWindows: 'すべてのウィンドウをここに結合',
             undo: '元に戻す',
             redo: 'やり直し',
             cut: '切り取り',
@@ -797,6 +811,7 @@ export const translations: Record<LanguageCode, Translation> = {
             failedToCopyCode: 'コードのコピーに失敗しました',
             unsupportedFile: 'サポートされていないファイル形式: {{filename}}',
             autoSaveFailed: '自動保存に失敗しました — 未保存の変更はメモリ内に残っています',
+            noOtherWindows: '結合できる他のウィンドウがありません',
             savedNewerEdits: '保存しました — 新しい編集があるため編集モードを継続します'
         },
         modal: {
@@ -989,6 +1004,10 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: '另存為',
             closeFile: '關閉文件',
             closeWindow: '關閉窗口',
+            moveToNewWindow: '移動到新窗口',
+            moveToWindow: '移動到',
+            window: '窗口',
+            mergeAllWindows: '合併所有窗口到本窗口',
             undo: '撤銷',
             redo: '重做',
             cut: '剪切',
@@ -1059,6 +1078,7 @@ export const translations: Record<LanguageCode, Translation> = {
             failedToCopyCode: '複製代碼失敗',
             unsupportedFile: '不支持的文件類型: {{filename}}',
             autoSaveFailed: '自動儲存失敗 — 未儲存的變更仍在記憶體中',
+            noOtherWindows: '沒有其他窗口可合併',
             savedNewerEdits: '已儲存 — 因有較新的編輯,繼續保持編輯模式'
         },
         modal: {
@@ -1245,6 +1265,7 @@ export const translations: Record<LanguageCode, Translation> = {
             reloadFromDisk: '디스크에서 다시 로드',
             closeFile: '파일 닫기',
             closeWindow: '창 닫기',
+            moveToNewWindow: '새 창으로 이동',
             undo: '실행 취소',
             redo: '다시 실행',
             cut: '잘라내기',
@@ -1562,6 +1583,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Сохранить как',
             closeFile: 'Закрыть файл',
             closeWindow: 'Закрыть окно',
+            moveToNewWindow: 'Переместить в новое окно',
             undo: 'Отменить',
             redo: 'Повторить',
             cut: 'Вырезать',
@@ -1777,6 +1799,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Guardar como',
             closeFile: 'Cerrar archivo',
             closeWindow: 'Cerrar ventana',
+            moveToNewWindow: 'Mover a nueva ventana',
             undo: 'Deshacer',
             redo: 'Rehacer',
             cut: 'Cortar',
@@ -1992,6 +2015,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Enregistrer sous',
             closeFile: 'Fermer le fichier',
             closeWindow: 'Fermer la fenêtre',
+            moveToNewWindow: 'Déplacer vers une nouvelle fenêtre',
             undo: 'Annuler',
             redo: 'Rétablir',
             cut: 'Couper',
@@ -2207,6 +2231,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Speichern unter',
             closeFile: 'Datei schließen',
             closeWindow: 'Fenster schließen',
+            moveToNewWindow: 'In neues Fenster verschieben',
             undo: 'Rückgängig',
             redo: 'Wiederholen',
             cut: 'Ausschneiden',
@@ -2422,6 +2447,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Salvar como',
             closeFile: 'Fechar arquivo',
             closeWindow: 'Fechar janela',
+            moveToNewWindow: 'Mover para nova janela',
             undo: 'Desfazer',
             redo: 'Refazer',
             cut: 'Recortar',
@@ -2637,6 +2663,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Salva come',
             closeFile: 'Chiudi file',
             closeWindow: 'Chiudi finestra',
+            moveToNewWindow: 'Sposta in una nuova finestra',
             undo: 'Annulla',
             redo: 'Ripristina',
             cut: 'Taglia',
@@ -2864,6 +2891,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Zapisz jako',
             closeFile: 'Zamknij plik',
             closeWindow: 'Zamknij okno',
+            moveToNewWindow: 'Przenieś do nowego okna',
             undo: 'Cofnij',
             redo: 'Ponów',
             cut: 'Wytnij',
@@ -3089,6 +3117,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Opslaan als',
             closeFile: 'Sluit bestand',
             closeWindow: 'Sluit venster',
+            moveToNewWindow: 'Verplaats naar nieuw venster',
             undo: 'Ongedaan maken',
             redo: 'Opnieuw',
             cut: 'Knippen',
@@ -3304,6 +3333,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Spara som',
             closeFile: 'Stäng fil',
             closeWindow: 'Stäng fönster',
+            moveToNewWindow: 'Flytta till nytt fönster',
             undo: 'Ångra',
             redo: 'Gör om',
             cut: 'Klipp ut',
@@ -3519,6 +3549,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Lưu dưới dạng',
             closeFile: 'Đóng tệp',
             closeWindow: 'Đóng cửa sổ',
+            moveToNewWindow: 'Chuyển sang cửa sổ mới',
             undo: 'Hoàn tác',
             redo: 'Làm lại',
             cut: 'Cắt',
@@ -3734,6 +3765,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Guardar como',
             closeFile: 'Fechar ficheiro',
             closeWindow: 'Fechar janela',
+            moveToNewWindow: 'Mover para nova janela',
             undo: 'Desfazer',
             redo: 'Refazer',
             cut: 'Cortar',
@@ -3949,6 +3981,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Salvare ca',
             closeFile: 'Închidere fișier',
             closeWindow: 'Închidere fereastră',
+            moveToNewWindow: 'Mutare într-o fereastră nouă',
             undo: 'Anulare',
             redo: 'Refacere',
             cut: 'Decupare',
@@ -4164,6 +4197,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Mentés másként',
             closeFile: 'Fájl bezárása',
             closeWindow: 'Ablak bezárása',
+            moveToNewWindow: 'Áthelyezés új ablakba',
             undo: 'Visszavonás',
             redo: 'Újra',
             cut: 'Kivágás',
@@ -4379,6 +4413,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Uložit jako',
             closeFile: 'Zavřít soubor',
             closeWindow: 'Zavřít okno',
+            moveToNewWindow: 'Přesunout do nového okna',
             undo: 'Zpět',
             redo: 'Znovu',
             cut: 'Vyjmout',
@@ -4600,6 +4635,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Uložiť ako',
             closeFile: 'Zatvoriť súbor',
             closeWindow: 'Zatvoriť okno',
+            moveToNewWindow: 'Presunúť do nového okna',
             undo: 'Späť',
             redo: 'Znovu',
             cut: 'Vystrihnúť',
@@ -4815,6 +4851,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Αποθήκευση ως',
             closeFile: 'Κλείσιμο αρχείου',
             closeWindow: 'Κλείσιμο παραθύρου',
+            moveToNewWindow: 'Μετακίνηση σε νέο παράθυρο',
             undo: 'Αναίρεση',
             redo: 'Επανάληψη',
             cut: 'Αποκοπή',
@@ -5030,6 +5067,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Tallenna nimellä',
             closeFile: 'Sulje tiedosto',
             closeWindow: 'Sulje ikkuna',
+            moveToNewWindow: 'Siirrä uuteen ikkunaan',
             undo: 'Kumoa',
             redo: 'Tee uudelleen',
             cut: 'Leikkaa',
@@ -5245,6 +5283,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Gem som',
             closeFile: 'Luk fil',
             closeWindow: 'Luk vindue',
+            moveToNewWindow: 'Flyt til nyt vindue',
             undo: 'Fortryd',
             redo: 'Gentag',
             cut: 'Klip',
@@ -5460,6 +5499,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Lagre som',
             closeFile: 'Lukk fil',
             closeWindow: 'Lukk vindu',
+            moveToNewWindow: 'Flytt til nytt vindu',
             undo: 'Angre',
             redo: 'Gjør om',
             cut: 'Klipp ut',
@@ -5675,6 +5715,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Simpan Sebagai',
             closeFile: 'Tutup Berkas',
             closeWindow: 'Tutup Jendela',
+            moveToNewWindow: 'Pindahkan ke Jendela Baru',
             undo: 'Urungkan',
             redo: 'Ulangi',
             cut: 'Potong',
@@ -5890,6 +5931,7 @@ export const translations: Record<LanguageCode, Translation> = {
             saveAs: 'Farklı Kaydet',
             closeFile: 'Dosyayı Kapat',
             closeWindow: 'Pencereyi Kapat',
+            moveToNewWindow: 'Yeni Pencereye Taşı',
             undo: 'Geri Al',
             redo: 'Yinele',
             cut: 'Kes',
diff --git a/src/lib/utils/tabTransfer.ts b/src/lib/utils/tabTransfer.ts
new file mode 100644
index 0000000..ac128cb
--- /dev/null
+++ b/src/lib/utils/tabTransfer.ts
@@ -0,0 +1,167 @@
+import type { Tab } from '../stores/tabs.svelte.js';
+import { nextUntitledTitle } from './untitledTitle.js';
+
+/**
+ * Cross-window tab transfer: a tab is snapshotted in the source window,
+ * carried through the Rust broker as JSON, and rebuilt in the destination.
+ *
+ * This snapshot is deliberately INDEPENDENT of TabManager.serializeState()
+ * (localStorage `savedTabsDataV2`), which persists window shape only and
+ * never carries content. A transferred tab, by contrast, MUST carry its
+ * unsaved buffer — rawContent/originalContent/isDirty travel with it, so a
+ * dirty tab arrives dirty and nothing is lost or silently "cleaned".
+ *
+ * Excluded on purpose:
+ * - `content` (rendered HTML): regenerated at the destination.
+ * - `editorViewState`: a live Monaco object, not serializable.
+ */
+export interface TransferableTab {
+	path: string;
+	title: string;
+	rawContent: string;
+	originalContent: string;
+	isDirty: boolean;
+	isEditing: boolean;
+	isSplit: boolean;
+	isScrollSynced: boolean;
+	splitRatio: number;
+	scrollTop: number;
+	scrollPercentage: number;
+	anchorLine: number;
+	historyIndex: number;
+	history: string[];
+}
+
+const STRING_FIELDS = ['path', 'title', 'rawContent', 'originalContent'] as const;
+const BOOLEAN_FIELDS = ['isDirty', 'isEditing', 'isSplit', 'isScrollSynced'] as const;
+const NUMBER_FIELDS = [
+	'splitRatio',
+	'scrollTop',
+	'scrollPercentage',
+	'anchorLine',
+	'historyIndex',
+] as const;
+
+/** Copy the transferable fields of a tab. Never mutates the source. */
+export function snapshotTab(tab: Tab): TransferableTab {
+	return {
+		path: tab.path,
+		title: tab.title,
+		rawContent: tab.rawContent,
+		originalContent: tab.originalContent,
+		isDirty: tab.isDirty,
+		isEditing: tab.isEditing,
+		isSplit: tab.isSplit,
+		isScrollSynced: tab.isScrollSynced,
+		splitRatio: tab.splitRatio,
+		scrollTop: tab.scrollTop,
+		scrollPercentage: tab.scrollPercentage,
+		anchorLine: tab.anchorLine,
+		historyIndex: tab.historyIndex,
+		history: [...tab.history],
+	};
+}
+
+/**
+ * Parse and STRICTLY validate a transfer payload. Every field must have
+ * exactly the declared type — no coercion, no defaults. A payload that is
+ * even slightly off is rejected (null) rather than patched up: a past bug
+ * built tabs whose rawContent was undefined, the editor attributed a stale
+ * buffer to them, and auto-save then destroyed real files.
+ */
+export function validateTransferPayload(json: string): TransferableTab | null {
+	let data: unknown;
+	try {
+		data = JSON.parse(json);
+	} catch {
+		return null;
+	}
+	if (typeof data !== 'object' || data === null || Array.isArray(data)) return null;
+	const obj = data as Record<string, unknown>;
+
+	for (const field of STRING_FIELDS) {
+		if (typeof obj[field] !== 'string') return null;
+	}
+	for (const field of BOOLEAN_FIELDS) {
+		if (typeof obj[field] !== 'boolean') return null;
+	}
+	for (const field of NUMBER_FIELDS) {
+		const value = obj[field];
+		if (typeof value !== 'number' || !Number.isFinite(value)) return null;
+	}
+	const history = obj.history;
+	if (!Array.isArray(history)) return null;
+	for (const entry of history) {
+		if (typeof entry !== 'string') return null;
+	}
+
+	// Rebuild explicitly so unknown extra fields are dropped.
+	return {
+		path: obj.path as string,
+		title: obj.title as string,
+		rawContent: obj.rawContent as string,
+		originalContent: obj.originalContent as string,
+		isDirty: obj.isDirty as boolean,
+		isEditing: obj.isEditing as boolean,
+		isSplit: obj.isSplit as boolean,
+		isScrollSynced: obj.isScrollSynced as boolean,
+		splitRatio: obj.splitRatio as number,
+		scrollTop: obj.scrollTop as number,
+		scrollPercentage: obj.scrollPercentage as number,
+		anchorLine: obj.anchorLine as number,
+		historyIndex: obj.historyIndex as number,
+		history: [...history] as string[],
+	};
+}
+
+/**
+ * Title for a transferred tab in its destination window. The title is the
+ * document's identity, so movement keeps it whenever possible: an untitled
+ * tab (path === '') is re-numbered ONLY when the destination already has a
+ * tab with that exact title — impossible for a fresh detach window, only
+ * reachable by a future move-to-existing-window. Numbering exists to
+ * disambiguate a window's own close dialogs; cross-window duplicate titles
+ * are the status quo for file tabs (two folders' notes.md) and are fine.
+ */
+export function transferredTabTitle(
+	snap: TransferableTab,
+	existingTitles: readonly string[],
+	untitledBase: string,
+): string {
+	if (snap.path === '' && existingTitles.includes(snap.title)) {
+		return nextUntitledTitle(existingTitles, untitledBase);
+	}
+	return snap.title;
+}
+
+/**
+ * Build a full Tab for the destination window from a validated snapshot.
+ * Pure aside from crypto.randomUUID(); TabManager.insertTransferredTab is a
+ * thin wrapper that pushes the result and activates it. Rendered `content`
+ * starts empty (the caller re-renders) and editorViewState starts null.
+ */
+export function buildTransferredTab(
+	snap: TransferableTab,
+	existingTitles: readonly string[],
+	untitledBase: string,
+): Tab {
+	return {
+		id: crypto.randomUUID(),
+		path: snap.path,
+		title: transferredTabTitle(snap, existingTitles, untitledBase),
+		content: '',
+		rawContent: snap.rawContent,
+		originalContent: snap.originalContent,
+		scrollTop: snap.scrollTop,
+		isDirty: snap.isDirty,
+		isEditing: snap.isEditing,
+		history: [...snap.history],
+		historyIndex: snap.historyIndex,
+		editorViewState: null,
+		scrollPercentage: snap.scrollPercentage,
+		anchorLine: snap.anchorLine,
+		isSplit: snap.isSplit,
+		splitRatio: snap.splitRatio,
+		isScrollSynced: snap.isScrollSynced,
+	};
+}
diff --git a/src/lib/utils/untitledTitle.ts b/src/lib/utils/untitledTitle.ts
new file mode 100644
index 0000000..042d7b0
--- /dev/null
+++ b/src/lib/utils/untitledTitle.ts
@@ -0,0 +1,24 @@
+/**
+ * Numbered titles for untitled tabs ("Untitled 1", "Untitled 2", …).
+ *
+ * Untitled tabs used to share one identical title, so any UI that names a
+ * tab — the tab strip, and especially the per-tab unsaved-changes dialog at
+ * window close — could not tell the user which tab it was talking about.
+ * The smallest free number is reused, matching common editor behavior.
+ */
+export function nextUntitledTitle(existingTitles: readonly string[], base: string): string {
+	const used = new Set<number>();
+	for (const title of existingTitles) {
+		if (title === base) {
+			// A legacy unnumbered tab occupies slot 1.
+			used.add(1);
+			continue;
+		}
+		if (!title.startsWith(base + ' ')) continue;
+		const suffix = title.slice(base.length + 1);
+		if (/^[1-9][0-9]*$/.test(suffix)) used.add(Number(suffix));
+	}
+	let n = 1;
+	while (used.has(n)) n++;
+	return `${base} ${n}`;
+}