feat: independent native windows with menu-based tab transfer

[PathGao]

Stacked on #211 (and sharing #210's baseline) — please review only the last 4 commits. This branch is based on the two in-flight PRs; the multiwindow work semantically depends on #211's window-state snapshot, per-tab close review, and untitled numbering. I will rebase onto master as soon as they land, which will reduce the diff to the 4 commits listed below.

Implements #74: multiple independent native Markpad windows. A tab moves to a new window via its context menu ("Move to New Window"), carrying its full state — unsaved content, edit/split mode, scroll, history — with no save prompt: moving is not closing.

Why menu-move instead of Chrome-style tab dragging

An earlier drag-based design was abandoned: nearly all of its cost served the drag gesture itself (cross-display coordinate math, window-bounds hit testing, cancel-anytime transactionality). An explicit menu action delivers the same user value (two documents side by side) at a fraction of the complexity, and the transfer broker introduced here is deliberately shaped so drag can be added on top later.

Architecture

Each Tauri window is an isolated WebView/JS context, so the existing singleton stores are naturally per-window — the frontend needed no store refactor at all. The real work was three shared resources that multiwindow exposes:

1. Moving a tab between JS contexts — an in-memory Rust broker. The source stages a serialized tab; the destination window is created with the transfer token embedded in its label (window-<token> — a URL query would 404 in the asset protocol); the destination claims the payload and the source deletes its tab only after a targeted claim acknowledgement. Any failure (timeout, window-creation error) cancels and leaves the source tab untouched. Payloads are strictly validated — a tab whose content fields are not strings is never constructed (see Editor attributes the previous tab's content to a restored tab whose rawContent is missing (silent file corruption with auto-save) #213 for what stale/undefined buffers do).

2. The shared window-state snapshot — only the main window persists and restores it. Secondary labels are per-session, so their snapshots could never be restored anyway; letting N windows share one write slot meant the last window closed overwrote everyone else, and every new window restored the full previous tab set. Persistence now goes through Rust (fs::write behind an awaited invoke): setItem is an async message to the WebKit storage process and loses its flush race when the last window's close exits the process. The localStorage keys are read once for migration and then removed; a downgraded build starts a fresh session instead of misreading anything. The key/format is unchanged (savedTabsDataV2) — nothing about the stored bytes changed, so no new key.

   Authority principle: the disk file is the sole authority for document content. The persistence snapshot never carries content (it must survive a power-off gap during which the file may change elsewhere); the transfer payload may (it lives ~a second inside one process, with the source alive until acknowledged). Whether a content-carrying snapshot is safe depends on the time span it must survive, not where it is stored.

3. Broadcast events and global state — Tauri's emit/window.emit broadcast to every window, so e.g. "New File" from a tab context menu would create a tab in all windows. Per-window intents now use emit_to + window-bound listeners. The file watcher was a single global slot (any window toggling auto-reload killed every other window's watcher) and is now keyed per window label. OS file-opens (single-instance argv and macOS RunEvent::Opened) previously hardcoded the main window — and silently dropped the file once main was closed; they now deliver to the focused viewer window, falling back to any viewer (Focus the existing window when opening Markdown files #193 fixed bringing the receiving window forward; this fixes choosing the receiver).

Smaller pieces: untitled tabs keep their title on move unless the destination already uses it (the title is the document's identity; per-window smallest-free numbering is unchanged); the reviewing window raises itself before its close-review dialogs (they are in-app modals and could sit hidden behind another window); the capability ACL now covers window-* labels; tauri-plugin-window-state maps all secondary labels onto one state entry.

Out of scope

Cross-window tab dragging, "move to existing window", restoring the multi-window layout across restarts, and the macOS double-copy file-open swallow (#212). Two pre-existing issues noticed during QA are filed separately rather than fixed here: context menus are not mutually exclusive, and the document context menu opens over modal dialogs.

Testing

• Automated: 16 new node tests for the transfer snapshot (round-trip fidelity incl. unsaved content, strict validation rejections, arrival titling), 4 Rust broker unit tests (stage/claim/cancel/eviction), all existing suites green, svelte-check clean. The windowStateRestore guard test was updated for the Rust write-through (same invariant — v2 snapshots invisible to legacy builds — new mechanism).
• Manual (macOS): dirty and untitled tab moves; both window-close orders restore main's tabs; file-open routing via open -a, second-instance argv, and with main closed; per-window auto-reload watchers (toggling one window's off leaves the other's alive); two windows running their close reviews concurrently; event isolation (context-menu New File / Cmd+W / menu-bar Open all act on their own window only).
• Environment note: utilities that force-quit "windowless" apps (e.g. Supercharge) terminate via a Cocoa-level Quit that bypasses every window-close path; persistence semantics are "state as of the last graceful close". Ad-hoc-signed dev bundles are invisible to such utilities' accessibility checks and get culled — excluded during QA.

🤖 Generated with Claude Code

Closes #125