feat(geometry): persist detached-tab window size and position

A popped-out tab window was excluded from geometry persistence
structurally, alongside the home surface, so every pop-out opened at the
consuming app's hardcoded default regardless of how the last one was
resized.

The exclusion was over-broad. What makes a window unpersistable is
having no stable identity to key on — true of the home surface (one
window, many states) but not of a detached tab: every consumer already
derives its detach token from a durable tab identity, so
`shell-detach:<token>` names the same tab across sessions. Dropping the
clause hands detached windows the whole existing restore path — work-area
clamp, most-overlap monitor pick, fullscreen guard, display-gone
fallback — with no new code.

The move/resize cache handler becomes load-bearing rather than a nicety:
closing a detached window IS how a tab redocks, so it is the normal path,
long before the exit-time flush.

Records the two invariants this creates for consumers: the detach token
must stay deterministic, and DetachSpec's width/height are now the
first-pop-out default only, so docked content must size off the built
window's real inner_size().

Author: Lockyc

CLAUDE.md

@@ -51,8 +51,10 @@ regardless of what it hosts. It is NOT a place to abstract things that merely *l
   scope, not a gap to close.
 - **`geometry`** (`runtime` feature) — per-window size/position persistence. It owns all of it:
   point-based storage, the fullscreen/minimized recording guard, the target-monitor clamp on
-  restore, and the structural exclusion of the home and every detached-tab window (for save as well
-  as restore — see `detach`'s label scheme above). Nothing stays per-app beyond handing it a
+  restore, and the structural exclusion of the home surface (for save as well as restore).
+  **A detached-tab window is persisted, not excluded** — its label is deterministic per tab, so a
+  popped-out tab reopens at the size and position it was last left at; see `detach`'s label scheme
+  below. Nothing stays per-app beyond handing it a
   resolved config path: the canonicalize→hash→format filename step
   (`.window-geometry-{fnv1a_64(canonicalize(path)):016x}.json`, `geometry_filename`) lives here
   once, since it was byte-identical across all three apps' old per-app copies. Uses its own
@@ -208,10 +210,19 @@ regardless of what it hosts. It is NOT a place to abstract things that merely *l
   things:
   - **A reserved label scheme.** `DETACH_LABEL_PREFIX = "shell-detach:"` + `detached_label(token)`
     build a window label for a popped-out tab; `is_detached_label`/`detach_token` are the inverse.
-    A consumer's hot-reload reconcile calls `is_detached_label` itself to skip these windows, and
-    `geometry` uses the same check internally to exclude them from persistence — the same
-    structural exclusion `home::HOME_LABEL` gets, generalized from a single fixed label to an
-    unbounded set (one per detached tab), whenever a detached window is created.
+    A consumer's hot-reload reconcile calls `is_detached_label` itself to skip these windows.
+    - **The `token` a consumer passes is load-bearing beyond uniqueness — it must derive from a
+      durable tab identity.** `geometry` persists a detached window's size and position keyed on
+      the resulting label; that is *why* a popped-out tab reopens at the shape you left it. A token
+      built from a per-session counter or allocation order would silently forget the geometry every
+      launch and orphan an entry each time. Every consumer already derives it from a stable
+      identity (warden hashes `origin_label:tab_key`; curator and lector hash the tab's own label),
+      and each pins that determinism with its own test.
+    - **`DetachSpec`'s `width`/`height` are the first-pop-out default only.** Restore overwrites
+      them inside `open_detached`'s `build()` for any tab popped out before, so a consumer sizing
+      its docked content must read the built window's real `inner_size()` inside `birth_content`,
+      never the constants it passed in. warden hit exactly this: its reparented native surface was
+      born at the default rect and only snapped right once `detach.html` reported the true hole.
   - **A banner-only shell page** (`detach.html` — title + origin accent, no sidebar), served over
     its own custom protocol `DETACH_SCHEME`, registered on the `Builder` by
     `register_detach_protocol` (chained into `register_plugins` alongside `home`'s). Same reasoning

src/detach.rs

@@ -4,10 +4,11 @@
 //! behind each piece here.
 //!
 //! - The **label scheme** (`DETACH_LABEL_PREFIX`/`detached_label`/`is_detached_label`/
-//!   `detach_token`) marks a window as an ephemeral "popped out" tab so a consuming app's
-//!   hot-reload reconcile can skip it, and so [`crate::geometry`] can exclude it from persistence
-//!   internally (both save and restore) — the same exclusion [`crate::home::HOME_LABEL`] gets,
-//!   generalized to an unbounded set of ephemeral windows (one per detached tab).
+//!   `detach_token`) marks a window as a "popped out" tab so a consuming app's hot-reload
+//!   reconcile can skip it. The label is *stable per tab* — every consumer derives `token` from a
+//!   durable tab identity — which is what lets [`crate::geometry`] persist a detached window's
+//!   size and position like any other window's, rather than excluding it the way
+//!   [`crate::home::HOME_LABEL`] is excluded.
 //! - The **banner-shell page** (`DETACH_SCHEME`/`DetachSpec`/`register_detach_protocol`) is the
 //!   slim identity banner (title + accent stripe) a detached window shows above its transparent
 //!   content hole, reporting that hole's rect to the app via `set_hole_rect` — every app already
@@ -17,20 +18,23 @@
 
 /// Prefix marking a window label as a detached-tab window. A label under this prefix is never a
 /// real (config-defined) window label, so a consuming app's reconcile can use [`is_detached_label`]
-/// to skip it, and [`crate::geometry`] uses the same check internally to exclude it from
-/// persistence — the same exclusion `home::HOME_LABEL` gets, generalized to an unbounded set of
-/// ephemeral windows (one per detached tab) rather than a single fixed label.
+/// to skip it.
 pub const DETACH_LABEL_PREFIX: &str = "shell-detach:";
 
 /// Build the Tauri window label for a detached tab identified by `token` (an opaque,
 /// caller-chosen identifier — e.g. the tab's own key).
+///
+/// **`token` must be derived from a durable tab identity, not a per-session counter or an
+/// allocation order.** [`crate::geometry`] keys a detached window's remembered size and position
+/// on the resulting label, so a token that changes between sessions silently forgets the tab's
+/// geometry and leaves an orphan entry behind each time. Every consumer already does this
+/// (warden hashes `origin_label:tab_key`; curator and lector hash the tab's own label).
 pub fn detached_label(token: &str) -> String {
     format!("{DETACH_LABEL_PREFIX}{token}")
 }
 
 /// Whether `label` names a detached-tab window (as opposed to a real config-defined window or the
-/// home surface). A consuming app's reconcile, and [`crate::geometry`] internally, both use this
-/// to skip these windows.
+/// home surface). A consuming app's reconcile uses this to skip these windows.
 pub fn is_detached_label(label: &str) -> bool {
     label.starts_with(DETACH_LABEL_PREFIX)
 }
@@ -58,6 +62,11 @@ const DETACH_HTML: &str = include_str!("detach.html");
 /// What a popped-out tab's banner shows, plus the size the detached window should open at.
 /// `colour` is the tab's/window's accent colour (the same hex the sidebar swatch uses); `None`
 /// falls back to the page's own default stripe colour.
+///
+/// `width`/`height` are the **first-pop-out default only**. Once this tab has been popped out and
+/// resized, [`crate::geometry`] restores its remembered size and position over them during
+/// [`open_detached`]'s `build()` — so a caller sizing its own content off these constants rather
+/// than off the built window's real `inner_size()` will get it wrong for every subsequent pop-out.
 pub struct DetachSpec {
     pub title: String,
     pub colour: Option<String>,

src/geometry.rs

@@ -166,14 +166,24 @@ struct GeometryState {
     cache: Mutex<HashMap<String, Rect>>,
 }
 
-/// Windows shell-core owns that are transient by construction and must never persist bounds: the
-/// home surface, and any popped-out tab window. Excluded structurally — for **save** as well as
-/// restore — rather than by a caller-supplied list, because a detached window is created long
-/// after startup and so could never have appeared in one.
+/// The one window shell-core owns that must never persist bounds: the home surface. Excluded
+/// structurally — for **save** as well as restore — rather than by a caller-supplied list, since
+/// every consumer has it and none of them should have to remember to list it. `skip` is the
+/// caller's own transient windows on top.
+///
+/// **A detached-tab window is deliberately NOT excluded**, though it is just as ephemeral. What
+/// makes it persistable is that its label is *deterministic per tab*: every consumer derives the
+/// detach token from a stable tab identity (warden from `origin_label:tab_key`, curator and lector
+/// from the tab's own label), so `shell-detach:<token>` names the same tab across sessions and its
+/// stored rect is meaningful on the next pop-out. The home surface has no such identity to key on
+/// — it is a single window whose bounds every state it shows would have to share.
+///
+/// The consequence, accepted: the store gains one entry per tab ever popped out, never pruned.
+/// Ordinary windows already accumulate the same way (a title change orphans an entry), an entry is
+/// a handful of bytes, and pruning would need tab-identity knowledge this module deliberately
+/// does not have.
 fn is_excluded(state: &GeometryState, label: &str) -> bool {
-    label == crate::home::HOME_LABEL
-        || crate::detach::is_detached_label(label)
-        || state.skip.contains(label)
+    label == crate::home::HOME_LABEL || state.skip.contains(label)
 }
 
 /// A monitor's work area (screen minus menu bar and Dock) in points, converted with **that
@@ -348,7 +358,8 @@ fn flush<R: Runtime>(app: &AppHandle<R>) {
 }
 
 /// Build the geometry plugin. `filename` comes from [`geometry_filename`]; `skip_labels` are an
-/// app's own transient windows (the home and detached surfaces are excluded structurally).
+/// app's own transient windows (the home surface is excluded structurally — see [`is_excluded`],
+/// which also records why a detached-tab window is not).
 pub fn plugin<R: Runtime>(filename: String, skip_labels: &[&str]) -> TauriPlugin<R> {
     let skip: HashSet<String> = skip_labels.iter().map(|s| s.to_string()).collect();
 
@@ -388,7 +399,10 @@ pub fn plugin<R: Runtime>(filename: String, skip_labels: &[&str]) -> TauriPlugin
             // Snapshot on move/resize so a window's bounds survive even when the window itself is
             // closed mid-session: by the time `flush` runs on `RunEvent::Exit`, a closed window is
             // gone from `app.windows()`, so without this event-driven cache its bounds would be
-            // lost entirely rather than merely stale. (The cache is memory-only and the exit-time
+            // lost entirely rather than merely stale. That is not a nicety for a detached-tab
+            // window — closing it IS how a popped-out tab redocks, so it is the *normal* path, and
+            // this handler is the only reason its remembered size survives at all.
+            // (The cache is memory-only and the exit-time
             // flush is the only write to disk, so this does *not* protect against an abnormal exit
             // or crash — only against a window closing before a normal one.) No suppression around
             // `restore` is needed: an echoed event records the geometry the window genuinely has,
@@ -593,19 +607,24 @@ mod tests {
         assert_eq!(fnv1a_64(b"foobar"), 0x8594_4171_f739_67e8);
     }
 
-    /// The one behavioural rule `is_excluded` enforces — home, detached, and caller-skip windows
-    /// never persist bounds — is exactly the kind of thing a future refactor could silently
-    /// invert with no error, just wrong windows restored next launch.
+    /// The one behavioural rule `is_excluded` enforces — home and caller-skip windows never
+    /// persist bounds, every other window does — is exactly the kind of thing a future refactor
+    /// could silently invert with no error, just wrong windows restored next launch.
+    ///
+    /// The detached case is asserted in the *negative* on purpose: a popped-out tab window
+    /// persists its size and position like any other window, keyed by its deterministic
+    /// `shell-detach:<token>` label. Re-adding it to the exclusion is the regression this
+    /// assertion exists to fail on.
     #[test]
-    fn is_excluded_covers_home_detached_and_the_skip_list_but_not_an_ordinary_window() {
+    fn is_excluded_covers_home_and_the_skip_list_but_not_an_ordinary_or_detached_window() {
         let state = GeometryState {
             filename: "test.json".to_string(),
             skip: ["sidebar".to_string()].into_iter().collect(),
             cache: Mutex::new(HashMap::new()),
         };
         assert!(is_excluded(&state, crate::home::HOME_LABEL));
-        assert!(is_excluded(&state, "shell-detach:abc123"));
         assert!(is_excluded(&state, "sidebar"));
         assert!(!is_excluded(&state, "main"));
+        assert!(!is_excluded(&state, "shell-detach:abc123"));
     }
 }