From dcc36fc36dd3aa42da2c8617791ac52f5b7a00cc Mon Sep 17 00:00:00 2001
From: PathGao <42336971+PathGao@users.noreply.github.com>
Date: Tue, 20 Oct 2026 19:39:53 +0800
Subject: [PATCH 1/2] feat(windows): keep a restore snapshot per window label

Main keeps window-state-v2.json and restore-progress-v1.json, so an
existing session is main's entry with no migration. Every window-* label
gets window-state/<label>.json and restore-progress/<label>.json, each
written only by the window that owns the label, so windows closing at
once (quit) can no longer overwrite one another.

New commands: forget_window_state drops the caller's snapshot and
breadcrumb; reopen_remembered_windows rebuilds each remembered window
under its saved label through the same factory as tear-off windows.
clear_window_state now clears every window's state.

The window-state plugin no longer folds window-* labels into one
"secondary" entry, so each window gets its own size and position back.
---
 ...ssion.spec.ts => perWindowSession.spec.ts} |   0
 src-tauri/src/app.rs                          |  16 +-
 src-tauri/src/window_runtime.rs               | 339 +++++++++++++++---
 3 files changed, 297 insertions(+), 58 deletions(-)
 rename scripts/{lastWindowWritesSession.spec.ts => perWindowSession.spec.ts} (100%)

diff --git a/scripts/lastWindowWritesSession.spec.ts b/scripts/perWindowSession.spec.ts
similarity index 100%
rename from scripts/lastWindowWritesSession.spec.ts
rename to scripts/perWindowSession.spec.ts
diff --git a/src-tauri/src/app.rs b/src-tauri/src/app.rs
index c2cb57db..d0d06e34 100644
--- a/src-tauri/src/app.rs
+++ b/src-tauri/src/app.rs
@@ -55,15 +55,11 @@ pub fn run() {
                         | tauri_plugin_window_state::StateFlags::VISIBLE
                         | tauri_plugin_window_state::StateFlags::FULLSCREEN,
                 )
-                // Detached tab windows share one saved state instead of
-                // accumulating a state entry per generated label.
-                .map_label(|label| {
-                    if label.starts_with("window-") {
-                        "secondary"
-                    } else {
-                        label
-                    }
-                })
+                // No `map_label`: a secondary window keeps its label across
+                // relaunches, so each one gets its own size and position back.
+                // ponytail: entries of windows that never come back stay in
+                // the plugin's file (~200 bytes each, no removal API); prune it
+                // before the plugin loads if that ever matters.
                 .build(),
         )
         .setup(|app| {
@@ -275,6 +271,8 @@ pub fn run() {
             window_runtime::save_window_state,
             window_runtime::load_window_state,
             window_runtime::clear_window_state,
+            window_runtime::forget_window_state,
+            window_runtime::reopen_remembered_windows,
             window_runtime::save_unsaved_recovery,
             window_runtime::load_unsaved_recovery,
             window_runtime::clear_unsaved_recovery,
diff --git a/src-tauri/src/window_runtime.rs b/src-tauri/src/window_runtime.rs
index 9c93a2b8..112893fa 100644
--- a/src-tauri/src/window_runtime.rs
+++ b/src-tauri/src/window_runtime.rs
@@ -92,9 +92,7 @@ pub struct PinnedTag {
 
 /// `name` in the app config dir, which is created if missing.
 pub(crate) fn config_file(app: &AppHandle, name: &str) -> Result<PathBuf, crate::error::Error> {
-    let dir = app.path().app_config_dir().map_err(|e| e.to_string())?;
-    fs::create_dir_all(&dir)?;
-    Ok(dir.join(name))
+    Ok(config_dir(app)?.join(name))
 }
 
 fn remove_if_exists(path: &Path) -> Result<(), String> {
@@ -458,11 +456,119 @@ pub async fn show_window(window: tauri::Window) {
     let _ = window.set_focus();
 }
 
-fn window_state_path(app: &AppHandle) -> Result<PathBuf, crate::error::Error> {
-    config_file(app, "window-state-v2.json")
+/// Main's snapshot keeps its pre-per-window name, so an existing session is
+/// main's entry without a migration and an older build still finds it.
+const MAIN_WINDOW_STATE: &str = "window-state-v2.json";
+/// Every other remembered window has a snapshot here, named by its label.
+/// One file per window: N windows closing at once never write the same file.
+const WINDOW_STATE_DIR: &str = "window-state";
+const MAIN_RESTORE_PROGRESS: &str = "restore-progress-v1.json";
+const RESTORE_PROGRESS_DIR: &str = "restore-progress";
+
+fn config_dir(app: &AppHandle) -> Result<PathBuf, crate::error::Error> {
+    let dir = app.path().app_config_dir().map_err(|e| e.to_string())?;
+    fs::create_dir_all(&dir)?;
+    Ok(dir)
+}
+
+/// `label`'s file in a per-window directory. Only `window-*` windows have one:
+/// main has its own file, and anything else is not a window startup reopens.
+fn secondary_window_file(dir: &Path, label: &str) -> Result<PathBuf, String> {
+    if !label.starts_with("window-") {
+        return Err(format!("not a secondary window label: {label}"));
+    }
+    label_file(dir, label)
+}
+
+fn window_state_path_in(config: &Path, label: &str) -> Result<PathBuf, String> {
+    if label == "main" {
+        return Ok(config.join(MAIN_WINDOW_STATE));
+    }
+    secondary_window_file(&config.join(WINDOW_STATE_DIR), label)
+}
+
+fn restore_progress_path_in(config: &Path, label: &str) -> Result<PathBuf, String> {
+    if label == "main" {
+        return Ok(config.join(MAIN_RESTORE_PROGRESS));
+    }
+    secondary_window_file(&config.join(RESTORE_PROGRESS_DIR), label)
+}
+
+/// Writes a file Markpad owns in one of its per-window directories. Like
+/// `atomic_write`, but refuses to follow a symlink into a document.
+fn write_owned_file(path: &Path, json: &str) -> Result<(), String> {
+    if let Some(dir) = path.parent() {
+        fs::create_dir_all(dir).map_err(|error| error.to_string())?;
+    }
+    match fs::symlink_metadata(path) {
+        Ok(metadata) if !metadata.file_type().is_file() => {
+            return Err("target is not a regular file".to_string());
+        }
+        Ok(_) => {}
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error.to_string()),
+    }
+    atomic_write(path, json.as_bytes()).map_err(|error| error.to_string())
+}
+
+fn save_window_state_in(config: &Path, label: &str, json: &str) -> Result<(), String> {
+    let path = window_state_path_in(config, label)?;
+    if label == "main" {
+        return atomic_write(&path, json.as_bytes()).map_err(|e| e.to_string());
+    }
+    write_owned_file(&path, json)
+}
+
+fn load_window_state_in(config: &Path, label: &str) -> Option<String> {
+    fs::read_to_string(window_state_path_in(config, label).ok()?).ok()
+}
+
+/// A window closed on its own is not reopened. Its crash-guard breadcrumb goes
+/// with it; main's stays, because main's deferrals outlive any one session.
+fn forget_window_state_in(config: &Path, label: &str) -> Result<(), String> {
+    remove_if_exists(&window_state_path_in(config, label)?)?;
+    if label != "main" {
+        remove_if_exists(&restore_progress_path_in(config, label)?)?;
+    }
+    Ok(())
 }
 
-/// Persists the session snapshot atomically.
+fn remove_dir_if_exists(dir: &Path) -> Result<(), String> {
+    match fs::remove_dir_all(dir) {
+        Ok(()) => Ok(()),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        Err(error) => Err(error.to_string()),
+    }
+}
+
+/// Every window's snapshot, for the setting that turns restore off.
+fn clear_window_state_in(config: &Path) -> Result<(), String> {
+    remove_if_exists(&config.join(MAIN_WINDOW_STATE))?;
+    remove_dir_if_exists(&config.join(WINDOW_STATE_DIR))?;
+    remove_dir_if_exists(&config.join(RESTORE_PROGRESS_DIR))
+}
+
+/// The secondary windows that were open when the last session ended.
+fn remembered_window_labels_in(config: &Path) -> Vec<String> {
+    let dir = config.join(WINDOW_STATE_DIR);
+    let Ok(entries) = fs::read_dir(&dir) else {
+        return Vec::new();
+    };
+    let mut labels: Vec<String> = entries
+        .flatten()
+        .filter(|entry| entry.file_type().is_ok_and(|kind| kind.is_file()))
+        .filter_map(|entry| {
+            let name = entry.file_name();
+            let label = name.to_str()?.strip_suffix(".json")?.to_string();
+            secondary_window_file(&dir, &label).ok()?;
+            Some(label)
+        })
+        .collect();
+    labels.sort();
+    labels
+}
+
+/// Persists the calling window's restore snapshot atomically.
 ///
 /// This runs while the last window is closing — the moment the WebKit storage
 /// process is already tearing down — so a partial write is a realistic
@@ -475,35 +581,64 @@ fn window_state_path(app: &AppHandle) -> Result<PathBuf, crate::error::Error> {
 /// Off the main thread: the two fsyncs cost ~8 ms, and closing main freezes
 /// every other window for that long. The caller still awaits the write.
 #[tauri::command]
-pub async fn save_window_state(app: AppHandle, json: String) -> Result<(), String> {
-    let path = window_state_path(&app)?;
-    crate::commands::blocking(move || {
-        atomic_write(&path, json.as_bytes()).map_err(|e| e.to_string())
-    })
-    .await
+pub async fn save_window_state(
+    window: tauri::Window,
+    app: AppHandle,
+    json: String,
+) -> Result<(), String> {
+    let config = config_dir(&app)?;
+    let label = window.label().to_string();
+    crate::commands::blocking(move || save_window_state_in(&config, &label, &json)).await
 }
 
 #[tauri::command]
-pub fn load_window_state(app: AppHandle) -> Option<String> {
-    fs::read_to_string(window_state_path(&app).ok()?).ok()
+pub fn load_window_state(window: tauri::Window, app: AppHandle) -> Option<String> {
+    load_window_state_in(&config_dir(&app).ok()?, window.label())
+}
+
+#[tauri::command]
+pub fn forget_window_state(window: tauri::Window, app: AppHandle) -> Result<(), String> {
+    forget_window_state_in(&config_dir(&app)?, window.label())
 }
 
 #[tauri::command]
 pub fn clear_window_state(app: AppHandle) -> Result<(), String> {
-    remove_if_exists(&window_state_path(&app)?)
+    clear_window_state_in(&config_dir(&app)?)
+}
+
+/// Rebuilds each remembered secondary window under its saved label, and
+/// returns the labels that now have a window. Each one restores its own
+/// snapshot and unsaved backup; a label missing from the answer could not be
+/// built, so its backup is left for main to take in.
+///
+/// Async for the reason `create_transfer_window` is.
+#[tauri::command]
+pub async fn reopen_remembered_windows(app: AppHandle) -> Result<Vec<String>, String> {
+    let config = config_dir(&app)?;
+    let mut open = Vec::new();
+    for label in remembered_window_labels_in(&config) {
+        if app.get_webview_window(&label).is_none() {
+            if let Err(error) = build_viewer_window(&app, &label) {
+                eprintln!("Failed to reopen window {label}: {error}");
+                continue;
+            }
+        }
+        open.push(label);
+    }
+    Ok(open)
 }
 
 fn unsaved_recovery_dir(app: &AppHandle) -> Result<PathBuf, crate::error::Error> {
     config_file(app, "unsaved-recovery")
 }
 
-fn recovery_path(dir: &Path, label: &str) -> Result<PathBuf, String> {
+fn label_file(dir: &Path, label: &str) -> Result<PathBuf, String> {
     if label.is_empty()
         || !label
             .bytes()
             .all(|byte| byte.is_ascii_alphanumeric() || byte == b'-' || byte == b'_')
     {
-        return Err(format!("invalid recovery window label: {label}"));
+        return Err(format!("invalid window label: {label}"));
     }
     Ok(dir.join(format!("{label}.json")))
 }
@@ -518,21 +653,11 @@ fn remove_recovery_file(path: &Path) -> Result<(), String> {
 
 /// Each window replaces only its own snapshot, never a document on disk.
 fn save_unsaved_recovery_at(dir: &Path, label: &str, json: &str) -> Result<(), String> {
-    let path = recovery_path(dir, label)?;
+    let path = label_file(dir, label)?;
     if json.trim() == "[]" {
         return remove_recovery_file(&path);
     }
-    fs::create_dir_all(dir).map_err(|error| error.to_string())?;
-    // atomic_write follows symlinks for document saves; recovery must not.
-    match fs::symlink_metadata(&path) {
-        Ok(metadata) if !metadata.file_type().is_file() => {
-            return Err("recovery target is not a regular file".to_string());
-        }
-        Ok(_) => {}
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
-        Err(error) => return Err(error.to_string()),
-    }
-    atomic_write(&path, json.as_bytes()).map_err(|error| error.to_string())
+    write_owned_file(&path, json)
 }
 
 fn load_unsaved_recovery_at(dir: &Path) -> Result<Vec<(String, String)>, String> {
@@ -547,8 +672,7 @@ fn load_unsaved_recovery_at(dir: &Path) -> Result<Vec<(String, String)>, String>
         let Some(label) = name.to_str().and_then(|name| name.strip_suffix(".json")) else {
             continue;
         };
-        if recovery_path(dir, label).is_err() || !entry.file_type().is_ok_and(|kind| kind.is_file())
-        {
+        if label_file(dir, label).is_err() || !entry.file_type().is_ok_and(|kind| kind.is_file()) {
             continue;
         }
         // One unreadable file must not hide the others. It arrives empty, which
@@ -564,7 +688,7 @@ fn clear_unsaved_recovery_at(dir: &Path, labels: &[String]) -> Result<(), String
     // Validate the whole request before deleting any snapshot.
     let paths = labels
         .iter()
-        .map(|label| recovery_path(dir, label))
+        .map(|label| label_file(dir, label))
         .collect::<Result<Vec<_>, _>>()?;
     for path in paths {
         remove_recovery_file(&path)?;
@@ -595,10 +719,6 @@ pub async fn clear_unsaved_recovery(app: AppHandle, labels: Vec<String>) -> Resu
     crate::commands::blocking(move || clear_unsaved_recovery_at(&dir, &labels)).await
 }
 
-fn restore_progress_path(app: &AppHandle) -> Result<PathBuf, crate::error::Error> {
-    config_file(app, "restore-progress-v1.json")
-}
-
 /// Publishes the restore breadcrumb by rename, but without `atomic_write`'s
 /// fsyncs.
 ///
@@ -624,9 +744,17 @@ fn restore_progress_path(app: &AppHandle) -> Result<PathBuf, crate::error::Error
 /// measured on macOS/APFS with a 122-byte payload, `atomic_write`'s two fsyncs
 /// cost ~8 ms per call against ~0.2 ms for temp-file-plus-rename.
 fn write_restore_progress(path: &Path, json: &str) -> std::io::Result<()> {
-    // Two Markpad processes (Windows, Linux) would otherwise share a temp name
-    // and the loser would delete the winner's file out from under its rename.
-    let temp = path.with_file_name(format!(".restore-progress-{}.tmp", std::process::id()));
+    // Two Markpad processes (Windows, Linux), or two windows of one, would
+    // otherwise share a temp name and the loser would delete the winner's file
+    // out from under its rename.
+    let name = path
+        .file_name()
+        .and_then(OsStr::to_str)
+        .unwrap_or("restore-progress");
+    let temp = path.with_file_name(format!(".{name}-{}.tmp", std::process::id()));
+    if let Some(dir) = path.parent() {
+        fs::create_dir_all(dir)?;
+    }
     let write = (|| -> std::io::Result<()> {
         let mut file = fs::File::create(&temp)?;
         std::io::Write::write_all(&mut file, json.as_bytes())?;
@@ -643,19 +771,28 @@ fn write_restore_progress(path: &Path, json: &str) -> std::io::Result<()> {
     Ok(())
 }
 
+/// Each window guards its own restore: the breadcrumb is keyed by the caller's label.
 #[tauri::command]
-pub fn save_restore_progress(app: AppHandle, json: String) -> Result<(), String> {
-    write_restore_progress(&restore_progress_path(&app)?, &json).map_err(|e| e.to_string())
+pub fn save_restore_progress(
+    window: tauri::Window,
+    app: AppHandle,
+    json: String,
+) -> Result<(), String> {
+    let path = restore_progress_path_in(&config_dir(&app)?, window.label())?;
+    write_restore_progress(&path, &json).map_err(|e| e.to_string())
 }
 
 #[tauri::command]
-pub fn load_restore_progress(app: AppHandle) -> Option<String> {
-    fs::read_to_string(restore_progress_path(&app).ok()?).ok()
+pub fn load_restore_progress(window: tauri::Window, app: AppHandle) -> Option<String> {
+    fs::read_to_string(restore_progress_path_in(&config_dir(&app).ok()?, window.label()).ok()?).ok()
 }
 
 #[tauri::command]
-pub fn clear_restore_progress(app: AppHandle) -> Result<(), String> {
-    remove_if_exists(&restore_progress_path(&app)?)
+pub fn clear_restore_progress(window: tauri::Window, app: AppHandle) -> Result<(), String> {
+    remove_if_exists(&restore_progress_path_in(
+        &config_dir(&app)?,
+        window.label(),
+    )?)
 }
 
 /// A document window: the main one or a detached-tab one.
@@ -767,10 +904,14 @@ pub fn handle_single_instance(app: &AppHandle, args: Vec<String>, cwd: String) {
 /// deadlocks building a window there (tauri-apps/tauri#12521).
 #[tauri::command]
 pub async fn create_transfer_window(app: AppHandle, token: String) -> Result<(), String> {
-    let label = crate::tab_transfer::destination_label(&token);
+    build_viewer_window(&app, &crate::tab_transfer::destination_label(&token))
+}
+
+/// The one factory for secondary windows: built hidden, the frontend shows it.
+fn build_viewer_window(app: &AppHandle, label: &str) -> Result<(), String> {
     #[allow(unused_mut)]
     let mut builder =
-        tauri::WebviewWindowBuilder::new(&app, &label, tauri::WebviewUrl::App("index.html".into()))
+        tauri::WebviewWindowBuilder::new(app, label, tauri::WebviewUrl::App("index.html".into()))
             .title("Markpad")
             .inner_size(1000.0, 800.0)
             .min_inner_size(400.0, 300.0)
@@ -1004,14 +1145,14 @@ mod tests {
         let dir = Path::new("unsaved-recovery");
         for label in ["main", "window-123", "A_b-09"] {
             assert_eq!(
-                recovery_path(dir, label).unwrap(),
+                label_file(dir, label).unwrap(),
                 dir.join(format!("{label}.json"))
             );
         }
         for label in [
             "", ".", "..", "../main", "a/b", "a\\b", "/main", "a.json", "a b", "é",
         ] {
-            assert!(recovery_path(dir, label).is_err(), "accepted {label:?}");
+            assert!(label_file(dir, label).is_err(), "accepted {label:?}");
         }
     }
 
@@ -1087,6 +1228,106 @@ mod tests {
         fs::remove_dir_all(dir).unwrap();
     }
 
+    #[test]
+    fn main_keeps_its_old_files_and_other_windows_get_one_each() {
+        let config = Path::new("config");
+        assert_eq!(
+            window_state_path_in(config, "main").unwrap(),
+            config.join("window-state-v2.json")
+        );
+        assert_eq!(
+            restore_progress_path_in(config, "main").unwrap(),
+            config.join("restore-progress-v1.json")
+        );
+        assert_eq!(
+            window_state_path_in(config, "window-ab12").unwrap(),
+            config.join("window-state").join("window-ab12.json")
+        );
+        assert_eq!(
+            restore_progress_path_in(config, "window-ab12").unwrap(),
+            config.join("restore-progress").join("window-ab12.json")
+        );
+        for label in ["settings", "", "window-../main", "window-a/b", "window-a.b"] {
+            assert!(
+                window_state_path_in(config, label).is_err(),
+                "accepted {label:?}"
+            );
+            assert!(
+                restore_progress_path_in(config, label).is_err(),
+                "accepted {label:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn each_window_reads_and_forgets_only_its_own_snapshot() {
+        let config = temp_dir("window-state");
+        // A session written before snapshots were per window is main's entry.
+        fs::write(config.join("window-state-v2.json"), "legacy").unwrap();
+        assert_eq!(
+            load_window_state_in(&config, "main").as_deref(),
+            Some("legacy")
+        );
+        assert!(remembered_window_labels_in(&config).is_empty());
+
+        save_window_state_in(&config, "main", "m").unwrap();
+        save_window_state_in(&config, "window-b", "b").unwrap();
+        save_window_state_in(&config, "window-a", "a").unwrap();
+        write_restore_progress(
+            &restore_progress_path_in(&config, "window-a").unwrap(),
+            "{}",
+        )
+        .unwrap();
+        assert!(save_window_state_in(&config, "settings", "x").is_err());
+        fs::write(config.join("window-state").join("notes.json"), "x").unwrap();
+        assert_eq!(load_window_state_in(&config, "main").as_deref(), Some("m"));
+        assert_eq!(
+            load_window_state_in(&config, "window-a").as_deref(),
+            Some("a")
+        );
+        assert_eq!(load_window_state_in(&config, "window-c"), None);
+        assert_eq!(
+            remembered_window_labels_in(&config),
+            ["window-a", "window-b"]
+        );
+
+        forget_window_state_in(&config, "window-a").unwrap();
+        assert_eq!(remembered_window_labels_in(&config), ["window-b"]);
+        assert!(!config
+            .join("restore-progress")
+            .join("window-a.json")
+            .exists());
+        assert_eq!(load_window_state_in(&config, "main").as_deref(), Some("m"));
+        forget_window_state_in(&config, "main").unwrap();
+        assert_eq!(load_window_state_in(&config, "main"), None);
+        assert_eq!(
+            load_window_state_in(&config, "window-b").as_deref(),
+            Some("b")
+        );
+
+        save_window_state_in(&config, "main", "m").unwrap();
+        clear_window_state_in(&config).unwrap();
+        assert_eq!(load_window_state_in(&config, "main"), None);
+        assert!(remembered_window_labels_in(&config).is_empty());
+        clear_window_state_in(&config).unwrap();
+        fs::remove_dir_all(config).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_window_snapshot_does_not_follow_a_symlink_into_a_document() {
+        let config = temp_dir("window-state-symlink");
+        let document = config.join("original.md");
+        fs::write(&document, "original").unwrap();
+        fs::create_dir(config.join("window-state")).unwrap();
+        std::os::unix::fs::symlink(&document, config.join("window-state").join("window-a.json"))
+            .unwrap();
+        assert!(save_window_state_in(&config, "window-a", "x").is_err());
+        assert!(remembered_window_labels_in(&config).is_empty());
+        assert_eq!(fs::read_to_string(document).unwrap(), "original");
+        fs::remove_dir_all(config).unwrap();
+    }
+
     /// argv, as the shell would hand it over: `argv[0]` and then the arguments.
     fn argv(args: &[&str]) -> Vec<String> {
         std::iter::once("markpad")

From b58bdb3055588c2048a3b0cad9af74e4102bd783 Mon Sep 17 00:00:00 2001
From: PathGao <42336971+PathGao@users.noreply.github.com>
Date: Tue, 20 Oct 2026 19:39:53 +0800
Subject: [PATCH 2/2] feat(windows): reopen every window of the last session

Each window restores its own snapshot under the existing crash guard,
now keyed by its label. Main restores first, then reopens the other
remembered windows; a reopened window skips the tab-transfer claim and
the pinned-group load, so its snapshot owns its tabs.

A window is remembered on quit, when it is the last one, and on update.
Closing one of several windows, merging it away, or closing its last
tab forgets it, the same predicate #962 uses to decide hot exit.

Unsaved backups follow their window: a reopened window takes its own
record, and main takes only records no open or just-reopened window
will claim. With restore off nothing is reopened and every backup still
lands in main.

Tests: the single-slot contract is replaced. lastWindowWritesSession
becomes perWindowSession (each window writes or forgets its own entry
regardless of who else is open). windowTagPerWindow now checks that a
new window cannot read main's snapshot, and that a reopened window gets
its own tag back. Source-shape markers follow the new settleForExit
signature.
---
 scripts/perWindowSession.spec.ts         | 51 ++++++-------
 scripts/pinnedTagSave.test.ts            | 10 +--
 scripts/sessionRestoreResilience.spec.ts |  2 +-
 scripts/unsavedRecovery.test.ts          | 20 ++++--
 scripts/viewModeWithoutSaving.spec.ts    |  2 +-
 scripts/windowClosePerTab.test.ts        | 10 +--
 scripts/windowStateRestore.spec.ts       |  2 +-
 scripts/windowTagPerWindow.spec.ts       | 38 +++++++---
 src/lib/MarkdownViewer.svelte            | 91 ++++++++++++++----------
 src/lib/sessions/unsavedRecovery.ts      | 17 ++++-
 src/lib/sessions/windowSession.svelte.ts | 63 +++++++++-------
 11 files changed, 180 insertions(+), 126 deletions(-)

diff --git a/scripts/perWindowSession.spec.ts b/scripts/perWindowSession.spec.ts
index 5369a226..3232276f 100644
--- a/scripts/perWindowSession.spec.ts
+++ b/scripts/perWindowSession.spec.ts
@@ -2,12 +2,12 @@ import assert from 'node:assert/strict';
 
 import { test } from 'vitest';
 
-// #767. There is one snapshot slot, and startup restores it into main whoever
-// wrote it. A detached window left on its own used to skip writing it, so the
-// next launch brought back main's older tabs instead of the ones on screen.
+// Every window keeps its own snapshot, keyed by its label on the Rust side. A
+// secondary window writes its snapshot whoever else is open, and nobody else's:
+// that is what lets each window come back on relaunch, and what ended the quit
+// race where the last window to close overwrote main's single slot.
 
-let viewerWindows: Array<{ label: string }> = [];
-let saved: string | null = null;
+let calls: Array<{ cmd: string; args: any }> = [];
 
 (window as any).__TAURI_INTERNALS__ = {
 	metadata: {
@@ -15,28 +15,18 @@ let saved: string | null = null;
 		currentWebview: { windowLabel: 'window-abc', label: 'window-abc' },
 	},
 	invoke: (cmd: string, args: any) => {
-		switch (cmd) {
-			case 'get_os_type':
-				return Promise.resolve('macos');
-			case 'list_viewer_windows':
-				return Promise.resolve(viewerWindows);
-			case 'save_window_state':
-				saved = args.json;
-				return Promise.resolve(null);
-			default:
-				return Promise.resolve(null);
-		}
+		calls.push({ cmd, args });
+		return Promise.resolve(cmd === 'get_os_type' ? 'macos' : null);
 	},
 };
 
 const { tabManager } = await import('../src/lib/stores/tabs.svelte.js');
 const { createWindowSession } = await import('../src/lib/sessions/windowSession.svelte.js');
 
-async function persistFromDetachedWindow(open: string[]) {
+async function persistFromDetachedWindow(remember: boolean) {
 	tabManager.closeAll();
 	tabManager.addTab('/notes/a.md', '# a');
-	viewerWindows = open.map((label) => ({ label }));
-	saved = null;
+	calls = [];
 	await createWindowSession({
 		isMainWindow: false,
 		windowStateKey: 'savedTabsDataV2',
@@ -57,23 +47,22 @@ async function persistFromDetachedWindow(open: string[]) {
 		onError: () => {},
 		onWarning: () => {},
 		onInterrupted: () => {},
-	}).persistState();
+	}).persistState(remember);
 }
 
-test('the last window left writes the session, though it is not main', async () => {
-	await persistFromDetachedWindow(['window-abc']);
+test('a detached window writes its own snapshot without asking who else is open', async () => {
+	await persistFromDetachedWindow(true);
+	const saves = calls.filter((call) => call.cmd === 'save_window_state');
+	assert.equal(saves.length, 1);
 	assert.deepEqual(
-		JSON.parse(saved ?? '{"tabs":[]}').tabs.map((tab: { path: string }) => tab.path),
+		JSON.parse(saves[0].args.json).tabs.map((tab: { path: string }) => tab.path),
 		['/notes/a.md'],
 	);
+	assert.ok(!calls.some((call) => call.cmd === 'forget_window_state'));
 });
 
-test('while another window is open, a detached window leaves the session alone', async () => {
-	await persistFromDetachedWindow(['main', 'window-abc']);
-	assert.equal(saved, null);
-});
-
-test('a registry that has not heard from this window yet does not make it the last one', async () => {
-	await persistFromDetachedWindow(['main']);
-	assert.equal(saved, null);
+test('a window closed on its own is forgotten, not saved', async () => {
+	await persistFromDetachedWindow(false);
+	assert.ok(calls.some((call) => call.cmd === 'forget_window_state'));
+	assert.ok(!calls.some((call) => call.cmd === 'save_window_state'));
 });
diff --git a/scripts/pinnedTagSave.test.ts b/scripts/pinnedTagSave.test.ts
index 745c34cb..324a02df 100644
--- a/scripts/pinnedTagSave.test.ts
+++ b/scripts/pinnedTagSave.test.ts
@@ -116,7 +116,7 @@ test('with the window kept open, closing the empty window later does not empty t
 	await w.fns.closeTabAndWindowIfLast('a');
 	await w.fns.closeTabAndWindowIfLast('b');
 	assert.equal(w.isDestroyed(), false);
-	assert.equal(await w.fns.settleForExit(), true);
+	assert.equal(await w.fns.settleForExit(async () => true), true);
 	assert.deepEqual(w.saves.at(-1), ['/notes/b.md']);
 });
 
@@ -124,16 +124,16 @@ test('the close review with restore off keeps the dirty tabs it closes in the pi
 	const tabs = twoFiles();
 	tabs[0].isDirty = true;
 	const w = pinnedWindow(tabs);
-	assert.equal(await w.fns.settleForExit(), true);
+	assert.equal(await w.fns.settleForExit(async () => true), true);
 	assert.deepEqual(w.tabs.map((tab) => tab.id), ['b'], 'the review closed the dirty tab');
 	// The handler re-triggers the close after a review, and settles again.
-	assert.equal(await w.fns.settleForExit(), true);
+	assert.equal(await w.fns.settleForExit(async () => true), true);
 	assert.deepEqual(w.saves.at(-1), ['/notes/a.md', '/notes/b.md']);
 
 	// A window that lives on after that (an update that failed to install)
 	// saves what it has open, not the list the review started from.
 	w.tabs.push({ id: 'c', path: '/notes/c.md', isDirty: false });
-	assert.equal(await w.fns.settleForExit(), true);
+	assert.equal(await w.fns.settleForExit(async () => true), true);
 	assert.deepEqual(w.saves.at(-1), ['/notes/b.md', '/notes/c.md']);
 });
 
@@ -163,7 +163,7 @@ test('merging a pinned window into another keeps its files in the pin', async ()
 test('a pin another window removed stays removed when this window closes', async () => {
 	const w = pinnedWindow(twoFiles());
 	w.pin.exists = false;
-	assert.equal(await w.fns.settleForExit(), true);
+	assert.equal(await w.fns.settleForExit(async () => true), true);
 	assert.deepEqual(w.tabManager.windowTag, { name: 'work', color: '#f00', pinned: false }, 'the window still claims the pin');
 });
 
diff --git a/scripts/sessionRestoreResilience.spec.ts b/scripts/sessionRestoreResilience.spec.ts
index ed177453..e0c3ba03 100644
--- a/scripts/sessionRestoreResilience.spec.ts
+++ b/scripts/sessionRestoreResilience.spec.ts
@@ -550,7 +550,7 @@ test('a deferred document is released once Markpad has read it', async () => {
 	const deferredTab = tabManager.tabs.find((tab) => tab.path === '/big.md')!;
 	tabManager.setTabRawContent(deferredTab.id, '# big');
 
-	await session.persistState();
+	await session.persistState(true);
 
 	assert.equal(breadcrumb(), null, 'the deferral is not permanent');
 });
diff --git a/scripts/unsavedRecovery.test.ts b/scripts/unsavedRecovery.test.ts
index d879c808..f7b23b7e 100644
--- a/scripts/unsavedRecovery.test.ts
+++ b/scripts/unsavedRecovery.test.ts
@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { createUnsavedRecovery, parseRecovery, recoverySnapshot, restoreRecords } from '../src/lib/sessions/unsavedRecovery.js';
+import { claimableRecords, createUnsavedRecovery, parseRecovery, recoverySnapshot, restoreRecords } from '../src/lib/sessions/unsavedRecovery.js';
 import { buildTransferredTab, type TransferableTab } from '../src/lib/utils/tabTransfer.js';
 import { asRendererLine } from '../src/lib/utils/lineCoordinates.js';
 import { HOME_TAB_PATH } from '../src/lib/utils/homeTab.js';
@@ -61,11 +61,11 @@ test('restore replaces clean session copies, keeps baselines, and skips live win
 		{ ...document, path: '/other.md' },
 	]);
 	const dirtyId = target.tabs[1].id;
-	const consumed = restoreRecords(target, [
+	const consumed = restoreRecords(target, claimableRecords([
 		['main', JSON.stringify([{ ...document, path: '/notes.md', originalContent: 'saved', isEditing: false, isSplit: true }])],
 		['window-2', JSON.stringify([{ ...document, path: '/other.md', rawContent: 'another unsaved copy' }, document])],
 		['window-3', JSON.stringify([{ ...document, rawContent: 'still open elsewhere' }])],
-	], new Set(['window-3']), 'main', (error) => { throw error; });
+	], 'main', true, new Set(['window-3'])), 'main', (error) => { throw error; });
 	assert.deepEqual(consumed, ['window-2']);
 	assert.deepEqual(target.tabs.map((tab) => tab.path), ['/other.md', '/notes.md', '/other.md', '']);
 	assert.equal(target.tabs[0].id, dirtyId);
@@ -83,7 +83,7 @@ test('a corrupt record of another window is reported, skipped, and left unconsum
 		['window-2', ''],
 		['window-3', JSON.stringify([document, {}])],
 		['window-4', JSON.stringify([document])],
-	], new Set(), 'main', (error) => errors.push(error));
+	], 'main', (error) => errors.push(error));
 	assert.equal(errors.length, 2);
 	assert.deepEqual(consumed, ['window-4']);
 	assert.equal(target.tabs.length, 1);
@@ -91,10 +91,20 @@ test('a corrupt record of another window is reported, skipped, and left unconsum
 
 test('a corrupt record of this window throws, so the caller never overwrites it', () => {
 	const target = manager();
-	assert.throws(() => restoreRecords(target, [['main', '{']], new Set(), 'main', () => {}));
+	assert.throws(() => restoreRecords(target, [['main', '{']], 'main', () => {}));
 	assert.equal(target.tabs.length, 0);
 });
 
+test('a backup follows its window: main takes its own and the orphans, a reopened window only its own', () => {
+	const records: [string, string][] = [['main', ''], ['window-crashed', ''], ['window-open', ''], ['window-reopened', '']];
+	const owned = new Set(['window-open', 'window-reopened']);
+	const labels = (taken: [string, string][]) => taken.map(([label]) => label);
+	assert.deepEqual(labels(claimableRecords(records, 'main', true, owned)), ['main', 'window-crashed']);
+	assert.deepEqual(labels(claimableRecords(records, 'window-reopened', false, owned)), ['window-reopened']);
+	// Restore off: no window is reopened, so every backup lands in main as before.
+	assert.deepEqual(labels(claimableRecords(records, 'main', true, new Set())), labels(records));
+});
+
 test('continuous changes reach disk within the bounded background delay', async (context) => {
 	context.mock.timers.enable({ apis: ['setTimeout'] });
 	const writes: string[] = [];
diff --git a/scripts/viewModeWithoutSaving.spec.ts b/scripts/viewModeWithoutSaving.spec.ts
index 147df251..c08cf497 100644
--- a/scripts/viewModeWithoutSaving.spec.ts
+++ b/scripts/viewModeWithoutSaving.spec.ts
@@ -424,7 +424,7 @@ test('closing the window still reviews unsaved tabs', () => {
 	assert.doesNotMatch(exit, /askCustom/, 'quit asks nothing of its own; the close handler does the asking');
 
 	const closeHandler = sliceBetween(viewer, 'appWindow.onCloseRequested', 'onDragDropEvent');
-	assert.match(closeHandler, /await settleForExit\(\)/, 'the close still runs the review');
+	assert.match(closeHandler, /await settleForExit\(/, 'the close still runs the review');
 	assert.match(pluck('settleForExit'), /canCloseTab,\n/, 'the walk still runs the per-tab dialog');
 });
 
diff --git a/scripts/windowClosePerTab.test.ts b/scripts/windowClosePerTab.test.ts
index 14229a2e..b21d23d0 100644
--- a/scripts/windowClosePerTab.test.ts
+++ b/scripts/windowClosePerTab.test.ts
@@ -125,7 +125,7 @@ test('the close is prevented synchronously before the walk starts', () => {
 	// Not the re-entry guard's `preventDefault`: the one between that guard and
 	// the walk.
 	const guardEnd = offsetOf(handler, 'return;', offsetOf(handler, 'if (isCloseWalkActive)'));
-	const walk = offsetOf(handler, 'await settleForExit()');
+	const walk = offsetOf(handler, 'await settleForExit(');
 	const prevent = handler.lastIndexOf('event.preventDefault()', walk);
 	assert.ok(guardEnd < prevent, 'the close is prevented before the walk starts');
 	assert.match(settle(), /reviewDirtyTabs\(\{/, 'and the walk is what settleForExit runs');
@@ -133,7 +133,7 @@ test('the close is prevented synchronously before the walk starts', () => {
 
 test('the window closes only after every dirty tab is resolved', () => {
 	const handler = closeHandler();
-	const walk = offsetOf(handler, 'await settleForExit()');
+	const walk = offsetOf(handler, 'await settleForExit(');
 	const close = offsetOf(handler, 'appWindow.close()', walk);
 	assert.ok(walk < close, 'the window closes after the walk, not during it');
 });
@@ -142,10 +142,10 @@ test('a cancelled walk stops the handler before it persists or closes', () => {
 	const body = settle();
 	const walk = offsetOf(body, 'reviewDirtyTabs({');
 	const bail = offsetOf(body, 'return false;', offsetOf(body, 'if (!resolved)', walk));
-	assert.ok(bail < offsetOf(body, 'persistWindowState()', walk), 'cancel returns before the snapshot');
+	assert.ok(bail < offsetOf(body, 'persistWindowState(', walk), 'cancel returns before the snapshot');
 
 	const handler = closeHandler();
-	const stop = offsetOf(handler, 'return;', offsetOf(handler, 'if (!(await settleForExit())) {'));
+	const stop = offsetOf(handler, 'return;', offsetOf(handler, 'if (!(await settleForExit(endsSession))) {'));
 	assert.ok(stop < offsetOf(handler, 'appWindow.close()', stop), 'and before the close is re-triggered');
 });
 
@@ -181,7 +181,7 @@ test('save-as writes a snapshot rather than the buffer as it stands', () => {
 });
 
 test('the restore-on-reopen branch persists window state via the shared helper', () => {
-	assert.match(settle(), /persistWindowState\(\);/);
+	assert.match(settle(), /persistWindowState\(await remember\(\)\);/);
 	// no durable-write experiment left behind
 	assert.doesNotMatch(viewer, /saveSessionState|sessionState\.js/);
 });
diff --git a/scripts/windowStateRestore.spec.ts b/scripts/windowStateRestore.spec.ts
index fc5a3f4b..478d9c66 100644
--- a/scripts/windowStateRestore.spec.ts
+++ b/scripts/windowStateRestore.spec.ts
@@ -138,7 +138,7 @@ test('startup restore reads content from disk, not from the snapshot', () => {
 test('the close flow resolves dirty tabs before serializing window state', () => {
 	const body = settleForExit();
 	const walk = offsetOf(body, 'reviewDirtyTabs({');
-	const persist = offsetOf(body, 'persistWindowState()');
+	const persist = offsetOf(body, 'persistWindowState(');
 	assert.ok(walk < persist, 'dirty tabs must be resolved before the snapshot is written');
 });
 
diff --git a/scripts/windowTagPerWindow.spec.ts b/scripts/windowTagPerWindow.spec.ts
index 82f5fa7d..1ce81fee 100644
--- a/scripts/windowTagPerWindow.spec.ts
+++ b/scripts/windowTagPerWindow.spec.ts
@@ -16,7 +16,7 @@ import { test } from 'vitest';
  * here rather than read:
  *
  *   1. `TabManager.windowTag`'s own initial value;
- *   2. session restore, which is where a window gets its previous state back;
+ *   2. session restore, which gives a window back only its own previous state;
  *   3. the tab-transfer claim, the only channel through which one window's
  *      content reaches another.
  *
@@ -63,6 +63,8 @@ const TRANSFER_PAYLOAD = JSON.stringify({
 });
 
 let invokeCalls: Array<{ cmd: string; args: any }> = [];
+/** What Rust holds for this window's label: snapshots are keyed by the caller. */
+let ownSnapshot: string | null = null;
 
 (window as any).__TAURI_INTERNALS__ = {
 	// A detached window, which is what `create_transfer_window` builds.
@@ -76,7 +78,7 @@ let invokeCalls: Array<{ cmd: string; args: any }> = [];
 			case 'get_os_type':
 				return Promise.resolve('macos');
 			case 'load_window_state':
-				return Promise.resolve(TAGGED_SNAPSHOT);
+				return Promise.resolve(ownSnapshot);
 			case 'claim_detached_tab':
 				return Promise.resolve(TRANSFER_PAYLOAD);
 			case 'read_file_content_checked':
@@ -132,30 +134,44 @@ function reset() {
 	tabManager.setWindowTag(null);
 	localStorage.clear();
 	invokeCalls = [];
+	ownSnapshot = null;
 }
 
 test('a freshly constructed TabManager holds no window tag', () => {
 	assert.equal(INITIAL_WINDOW_TAG, null, 'the store starts a window off under a tag');
 });
 
-test('a detached window does not restore, so it cannot pick up the tag in the snapshot', async () => {
+test('a new window has no snapshot of its own, so it cannot pick up another window’s tag', async () => {
+	// Main's snapshot from a build that kept it in localStorage, which every
+	// window shares. Only main may read it.
 	reset();
+	localStorage.setItem(WINDOW_STATE_KEY, TAGGED_SNAPSHOT);
 
-	await makeSession(false).restore();
+	const restored = await makeSession(false).restore();
 
+	assert.equal(restored, false, 'a new window reported a snapshot of its own');
 	assert.equal(tabManager.windowTag, null, 'a new window came up wearing the saved window tag');
 	assert.deepEqual(tabManager.tabs, [], 'a new window restored the previous session');
-	assert.equal(
-		invokeCalls.filter((call) => call.cmd === 'load_window_state').length,
-		0,
-		'a new window read the saved session at all',
-	);
+});
+
+test('a reopened window gets its own tag back', async () => {
+	// The window was open when the app quit, and comes back under its label.
+	reset();
+	ownSnapshot = TAGGED_SNAPSHOT;
+
+	const restored = await makeSession(false).restore();
+
+	assert.equal(restored, true);
+	assert.deepEqual(tabManager.windowTag, { name: 'Research', color: '#188038', pinned: true });
+	assert.equal(tabManager.tabs.length, 1);
 });
 
 test('the main window does restore its own tag — this is not a test that restore is broken', async () => {
-	// The fence. Without it the test above passes for a build that simply never
-	// restores anything, which is a much worse defect than the one it guards.
+	// The fence. Without it the first restore test passes for a build that
+	// simply never restores anything, which is a much worse defect than the
+	// one it guards.
 	reset();
+	ownSnapshot = TAGGED_SNAPSHOT;
 
 	await makeSession(true).restore();
 
diff --git a/src/lib/MarkdownViewer.svelte b/src/lib/MarkdownViewer.svelte
index 401d8868..f1d6c168 100644
--- a/src/lib/MarkdownViewer.svelte
+++ b/src/lib/MarkdownViewer.svelte
@@ -127,7 +127,7 @@ import { t } from './utils/i18n.js';
 import { formatChord, modifierFor, opensInNewTab } from './utils/shortcuts.js';
 import { jumpScrollBehavior } from './utils/motion.js';
 import { createWindowSession } from './sessions/windowSession.svelte.js';
-import { createUnsavedRecovery, restoreRecords, recoverySnapshot } from './sessions/unsavedRecovery.js';
+import { claimableRecords, createUnsavedRecovery, restoreRecords, recoverySnapshot } from './sessions/unsavedRecovery.js';
 import { createDocumentSession, type LoadMarkdownOptions } from './sessions/documentSession.svelte.js';
 
 	import 'highlight.js/styles/github-dark.css';
@@ -649,10 +649,9 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 	const LEGACY_STATE_KEY = 'savedTabsData';
 	const RESTORE_IN_PROGRESS_KEY = 'markpad-window-restore-in-progress';
 
-	// Every window shares the one snapshot slot. Only the main window persists
-	// and restores tabs: secondary window labels carry a per-session token, so
-	// their snapshot could never be restored under the same label, and N
-	// writers would leave whichever window closed last.
+	// Each window persists and restores its own snapshot, keyed by its label.
+	// Main always opens and reopens the other windows of the last session
+	// under the labels they had.
 	const isMainWindow = appWindow.label === 'main';
 	let recoveryReady = $state(false);
 	let recoveryErrorShown = false;
@@ -676,18 +675,19 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 	});
 
 	// Startup, setting on. Without it nothing is read, written or removed.
-	async function restoreUnsavedChanges() {
+	// `reopened`: the windows main just rebuilt, which take their own backups
+	// and may not be in `list_viewer_windows` yet.
+	async function restoreUnsavedChanges(reopened: ReadonlySet<string>) {
 		try {
-			if (isMainWindow) {
-				const records = await invoke<Array<[string, string]>>('load_unsaved_recovery');
-				const windows = await invoke<Array<{ label: string }>>('list_viewer_windows');
-				const live = new Set(windows.map((win) => win.label).filter((label) => label !== appWindow.label));
-				const consumed = restoreRecords(tabManager, records, live, appWindow.label, reportRecoveryError);
-				// Publish the new owner before removing stale window copies.
-				await invoke('save_unsaved_recovery', { json: recoverySnapshot(tabManager.tabs) });
-				await invoke('clear_unsaved_recovery', { labels: consumed });
-				for (const id of await documentSession.dirtyTabsChangedOnDisk()) noteExternalChangeConflict(id);
-			}
+			const records = await invoke<Array<[string, string]>>('load_unsaved_recovery');
+			const windows = isMainWindow ? await invoke<Array<{ label: string }>>('list_viewer_windows') : [];
+			const owned = new Set([...reopened, ...windows.map((win) => win.label)].filter((label) => label !== appWindow.label));
+			const claimable = claimableRecords(records, appWindow.label, isMainWindow, owned);
+			const consumed = restoreRecords(tabManager, claimable, appWindow.label, reportRecoveryError);
+			// Publish the new owner before removing stale window copies.
+			await invoke('save_unsaved_recovery', { json: recoverySnapshot(tabManager.tabs) });
+			await invoke('clear_unsaved_recovery', { labels: consumed });
+			for (const id of await documentSession.dirtyTabsChangedOnDisk()) noteExternalChangeConflict(id);
 			recoveryReady = true;
 		} catch (error) {
 			// Not ready: nothing overwrites the record, and close asks as usual.
@@ -714,7 +714,7 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 			isCloseWalkActive = false;
 		}
 		await savePinnedTagIfNeeded();
-		if (settings.restoreStateOnReopen) await persistWindowState();
+		await persistWindowState(true);
 		return true;
 	}
 
@@ -980,8 +980,13 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 	// scheme. The localStorage keys are read once for migration and removed
 	// after the first successful Rust write; a downgraded build then starts
 	// a fresh session instead of misreading anything.
-	async function persistWindowState() {
-		await windowSession.persistState();
+	//
+	// `remember` false: this window closed on its own while others stay, so it
+	// is forgotten — even with restore off, or a later quit with it back on
+	// would reopen it from a stale snapshot.
+	async function persistWindowState(remember: boolean) {
+		if (!remember) await windowSession.persistState(false);
+		else if (settings.restoreStateOnReopen) await windowSession.persistState(true);
 	}
 
 	/**
@@ -997,7 +1002,7 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 	 * `downloadAndInstall`, `relaunch()` requests an exit elsewhere — so
 	 * CloseRequested never fires, and both jobs used to go down with it (#761).
 	 */
-	async function settleForExit(): Promise<boolean> {
+	async function settleForExit(remember: () => Promise<boolean>): Promise<boolean> {
 		// Unsaved content and session restore are separate concerns: dirty tabs
 		// are resolved FIRST through the per-tab dialogs, then the restore
 		// snapshot records window state only (open files, active tab, edit mode,
@@ -1064,9 +1069,8 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 		await savePinnedTagIfNeeded();
 		// The re-triggered close finds nothing to review and uses the list last.
 		if (dirtyTabs.length === 0) pinFilesAtClose = null;
-		if (settings.restoreStateOnReopen) {
-			await persistWindowState();
-		}
+		// Asked now, not when the close began: the review above can take minutes.
+		await persistWindowState(await remember());
 		return true;
 	}
 
@@ -1079,7 +1083,8 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 	async function settleForUpdate(): Promise<boolean> {
 		if (settings.persistOpenEditors && (await keepUnsavedForExit())) return true;
 		try {
-			return await settleForExit();
+			// The process exits with every window, so this one is remembered.
+			return await settleForExit(async () => true);
 		} finally {
 			pinFilesAtClose = null;
 		}
@@ -2993,9 +2998,7 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 	async function destroyWindowAfterTabsClosed() {
 		// No tabs left: drop this window's backup so a discarded buffer stays gone.
 		if (recoveryReady) await unsavedRecovery.flush('[]');
-		if (settings.restoreStateOnReopen) {
-			await persistWindowState();
-		}
+		await persistWindowState(false);
 
 		await appWindow.destroy();
 	}
@@ -3665,6 +3668,7 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 		}
 		if (tabManager.tabs.length === 0) {
 			if (recoveryReady) await unsavedRecovery.flush('[]');
+			await persistWindowState(false);
 			await appWindow.destroy();
 		}
 	}
@@ -3747,18 +3751,31 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 				const appWindow = getCurrentWindow();
 				if (isDisposed) return;
 
-			await windowSession.restore();
+			const restoredOwnState = await windowSession.restore();
 			if (isDisposed) return;
 			// The first window reopens the last folder; windows opened later start without one.
 			if (appWindow.label === 'main') void folderManager.restore();
-			if (settings.persistOpenEditors) await restoreUnsavedChanges();
+			// After main's own restore, which discards every snapshot when restore is off.
+			const reopened = new Set(
+				isMainWindow && settings.restoreStateOnReopen
+					? await invoke<string[]>('reopen_remembered_windows').catch((error) => {
+							console.error('Failed to reopen windows', error);
+							return [];
+						})
+					: [],
+			);
+			if (settings.persistOpenEditors) await restoreUnsavedChanges(reopened);
 			if (isDisposed) return;
-			const pinnedName = pinnedTagFromWindowLabel(appWindow.label);
-			if (pinnedName === null) await windowSession.claimTransferredTab();
-			else {
-				const tags = (await invoke('list_pinned_tags')) as typeof pinnedTags;
-				const tag = tags.find((pinned) => pinned.name === pinnedName);
-				if (tag) await openPinnedTag(tag);
+			// A reopened window's snapshot owns its tabs, a pinned one's included:
+			// opening the pinned group as well would open its files twice.
+			if (!restoredOwnState) {
+				const pinnedName = pinnedTagFromWindowLabel(appWindow.label);
+				if (pinnedName === null) await windowSession.claimTransferredTab();
+				else {
+					const tags = (await invoke('list_pinned_tags')) as typeof pinnedTags;
+					const tag = tags.find((pinned) => pinned.name === pinnedName);
+					if (tag) await openPinnedTag(tag);
+				}
 			}
 			if (isDisposed) return;
 
@@ -3907,7 +3924,9 @@ import { createDocumentSession, type LoadMarkdownOptions } from './sessions/docu
 					// finds nothing dirty, and the close proceeds.
 					const hadDirtyTabs = tabManager.tabs.some((t) => t.isDirty);
 					if (hadDirtyTabs) event.preventDefault();
-					if (!(await settleForExit())) {
+					// Closing one of several windows forgets it; quit or the last window remembers.
+					const endsSession = () => invoke<boolean>('keeps_unsaved_on_close').catch(() => true);
+					if (!(await settleForExit(endsSession))) {
 						// A cancelled close cancels the quit, so the windows left ask again.
 						invoke('set_quitting', { quitting: false }).catch(console.error);
 						return;
diff --git a/src/lib/sessions/unsavedRecovery.ts b/src/lib/sessions/unsavedRecovery.ts
index 23024038..22b8cd08 100644
--- a/src/lib/sessions/unsavedRecovery.ts
+++ b/src/lib/sessions/unsavedRecovery.ts
@@ -47,19 +47,30 @@ function restoreRecoveryTabs(manager: RecoveryTarget, json: string) {
 	}
 }
 
-/** Restore the records of windows that are gone and return the other labels consumed.
+/** The backups a window takes in at startup: its own, and on main every record
+ * no other window will claim. `owned` names the windows that will: open now, or
+ * reopened from the last session, which may not have registered yet. A backup
+ * of a window nobody reopens (after a crash, say) lands in main. */
+export function claimableRecords(
+	records: readonly [string, string][],
+	ownLabel: string,
+	isMain: boolean,
+	owned: ReadonlySet<string>,
+): [string, string][] {
+	return records.filter(([label]) => label === ownLabel || (isMain && !owned.has(label)));
+}
+
+/** Restore the given records and return the other labels consumed.
  * A corrupt record of another window is reported and left on disk. A corrupt
  * record of this window throws: the caller must not overwrite it. */
 export function restoreRecords(
 	manager: RecoveryTarget,
 	records: readonly [string, string][],
-	live: ReadonlySet<string>,
 	ownLabel: string,
 	onError: (error: unknown) => void,
 ): string[] {
 	const consumed: string[] = [];
 	for (const [label, json] of records) {
-		if (live.has(label)) continue;
 		try {
 			restoreRecoveryTabs(manager, json);
 		} catch (error) {
diff --git a/src/lib/sessions/windowSession.svelte.ts b/src/lib/sessions/windowSession.svelte.ts
index c029fafc..211ae0a4 100644
--- a/src/lib/sessions/windowSession.svelte.ts
+++ b/src/lib/sessions/windowSession.svelte.ts
@@ -108,12 +108,13 @@ export function createWindowSession(options: WindowSessionOptions) {
 	 * `restoreInProgressKey` stays as a read-once migration path: a breadcrumb
 	 * an older build left behind is still honoured, and dropped as soon as a
 	 * Rust write succeeds. The Rust file wins when both exist, so a downgrade
-	 * and re-upgrade cannot resurrect a stale localStorage record.
+	 * and re-upgrade cannot resurrect a stale localStorage record. Only main
+	 * reads it: localStorage is shared by every window, and the record is main's.
 	 */
 	async function readProgress(): Promise<RestoreProgress | null> {
 		const raw =
 			((await invoke('load_restore_progress').catch(() => null)) as string | null) ??
-			localStorage.getItem(options.restoreInProgressKey);
+			(options.isMainWindow ? localStorage.getItem(options.restoreInProgressKey) : null);
 		if (!raw) return null;
 		try {
 			const data = JSON.parse(raw) as Partial<RestoreProgress> | null;
@@ -174,19 +175,19 @@ export function createWindowSession(options: WindowSessionOptions) {
 	}
 
 	/**
-	 * Main writes the snapshot, and so does the last window left. Startup
-	 * restores the one slot into main whoever wrote it, so a lone detached
-	 * window overwrites nobody, and skipping it brought back main's older tabs
-	 * instead of the ones on screen (#767).
+	 * Every window keeps its own snapshot, keyed by its label on the Rust side,
+	 * so no window can overwrite another's. `remember` false is a window closed
+	 * on its own while others stay: it is not reopened next launch.
 	 */
-	async function ownsSnapshot(): Promise<boolean> {
-		if (options.isMainWindow) return true;
-		const windows = ((await invoke('list_viewer_windows').catch(() => null)) ?? []) as Array<{ label: string }>;
-		return windows.length === 1 && windows[0].label === appWindow.label;
-	}
-
-	async function persistState() {
-		if (!(await ownsSnapshot())) return;
+	async function persistState(remember: boolean) {
+		if (!remember) {
+			try {
+				await invoke('forget_window_state');
+			} catch (error) {
+				options.onError('Failed to forget window state on close', error);
+			}
+			return;
+		}
 		await releaseReadableDeferrals();
 		try {
 			await invoke('save_window_state', { json: options.serializeState() });
@@ -197,8 +198,12 @@ export function createWindowSession(options: WindowSessionOptions) {
 		}
 	}
 
-	async function restore() {
-		if (!options.isMainWindow || options.isDisposed()) return;
+	/**
+	 * Restores this window's own snapshot. True when it had one: a reopened
+	 * window, which has no tab transfer or pinned group to claim.
+	 */
+	async function restore(): Promise<boolean> {
+		if (options.isDisposed()) return false;
 		if (!options.shouldRestoreState()) {
 			// Through `discardPersistedState`, because the snapshot is a file on
 			// the Rust side now. This branch is what makes turning the setting off
@@ -211,7 +216,7 @@ export function createWindowSession(options: WindowSessionOptions) {
 			// Nothing will be restored, so there is nothing for a breadcrumb to
 			// say about the next launch.
 			await writeProgress({ running: false, pending: null, deferred: [], interruptions: 0 });
-			return;
+			return false;
 		}
 		const previous = await readProgress();
 		const deferred = previous ? [...previous.deferred] : [];
@@ -253,10 +258,11 @@ export function createWindowSession(options: WindowSessionOptions) {
 		const progress: RestoreProgress = { running: true, pending: null, deferred, interruptions };
 		await writeProgress(progress);
 
+		// The localStorage copies are main's, from builds that kept one snapshot.
 		const savedData =
-			localStorage.getItem(options.windowStateKey) ??
-			localStorage.getItem(options.legacyStateKey) ??
-			((await invoke('load_window_state').catch(() => null)) as string | null);
+			(options.isMainWindow
+				? (localStorage.getItem(options.windowStateKey) ?? localStorage.getItem(options.legacyStateKey))
+				: null) ?? ((await invoke('load_window_state').catch(() => null)) as string | null);
 		if (savedData) {
 			try {
 				options.restoreState(savedData);
@@ -284,13 +290,13 @@ export function createWindowSession(options: WindowSessionOptions) {
 						// nothing could decode is never written back over, and the
 						// encoding so a legacy one is written back as itself.
 						const [raw, lossy, encoding] = (await invoke('read_file_content_checked', { path: tab.path })) as [string, boolean, string];
-						if (options.isDisposed()) return;
+						if (options.isDisposed()) return true;
 						await options.applyRestoredContent(tab.id, raw);
 						tabManager.setTabDecodedLossy(tab.id, lossy);
 						tabManager.setTabEncoding(tab.id, encoding);
-						if (options.isDisposed()) return;
+						if (options.isDisposed()) return true;
 					} catch (error) {
-						if (options.isDisposed()) return;
+						if (options.isDisposed()) return true;
 						// One failed read is not a decision to close the document.
 						// The file may be on a share that is down or a drive that is
 						// not plugged in; dropping the tab here also dropped it from
@@ -317,10 +323,13 @@ export function createWindowSession(options: WindowSessionOptions) {
 			// restore, so claiming early cannot accumulate phantom strikes.
 			await writeProgress({ running: false, pending: null, deferred, interruptions: 0 });
 		}
-		if (options.isDisposed()) return;
-		if (options.restoredTabs().length > 0) await persistState();
-		localStorage.removeItem(options.windowStateKey);
-		localStorage.removeItem(options.legacyStateKey);
+		if (options.isDisposed()) return Boolean(savedData);
+		if (options.restoredTabs().length > 0) await persistState(true);
+		if (options.isMainWindow) {
+			localStorage.removeItem(options.windowStateKey);
+			localStorage.removeItem(options.legacyStateKey);
+		}
+		return Boolean(savedData);
 	}
 
 	/**