Fix the review's findings: drag on pointer events, read the window back

Ten findings from the review of the previous commit, all applied.

**The tab drag is now pointer events, not HTML5 drag-and-drop.** Two
independent reasons, either one fatal. Tauri's `dragDropEnabled` blocks
HTML5 drag inside the webview on Windows, and it cannot just be turned
off — `TerminalView` needs Tauri's native drag-drop event, which is the
only one that carries dropped *file paths*. And an HTML5 drag carries a
`DataTransfer`: released over any text field in the app, the default
handler types `term:<uuid>` into it, and in Config that is then saved
with the project. Pointer events have neither problem, and the drag is
measured from the tabs on screen rather than from the event target, so
the marker and the drop agree even over the marker itself. Escape
abandons a drag; a press under 4px stays a click; the click that ends a
drag does not select.

**`Ctrl+Shift+←/→` no longer swallows word-wise selection.** It is bound
on `document` in the capture phase, so in any input — the rename field,
Config, Settings — it was taking the OS's extend-selection chord *and*
silently reordering the strip. Guarded by `inTextField()`, which
excludes xterm's helper textarea: that is an input-method shim, and the
terminal is where the shortcut matters most.

**The pop-out's state is read from the window, never remembered.** The
pane is unmounted whenever another Project Home sub-tab is selected, so
"Keep on top" came back Off over a window still floating on top.
`get_browser_view_popout_state` returns both facts from the window
itself, and the change event carries them. `poppedOut` is tri-state:
until the answer arrives the iframe is not mounted, because guessing
"not popped out" is what flashes a second viewer onto the browser.

Also: `popout::close` and the off-status emit in the supervisor are
behind the same epoch guard as the deregistration above them, so a
supervisor whose teardown outlives a restart can no longer destroy the
*new* session's window; `close()` returns its `destroy()` error instead
of logging it and reporting success, since the pane restores its iframe
on success; the drop marker is `pointer-events-none` and is placed
before the first *visible* tab at or past the slot, so it neither
refuses a drop nor vanishes when a `tabOrder` entry renders nothing; and
the "Keep on top" Toggle's accessible name now matches its visible text.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/src-tauri/src/browser_view/commands.rs

@@ -128,23 +128,29 @@ pub async fn open_browser_view_popout(
 }
 
 /// Close the pop-out, putting the view back in the tab. No-op if it is closed.
+///
+/// Propagates a failed close rather than reporting success: the pane restores
+/// its iframe on success, and doing that with the window still up puts two
+/// viewers on one browser.
 #[tauri::command]
 pub async fn close_browser_view_popout(
     project_id: String,
     app_handle: AppHandle,
 ) -> Result<(), String> {
-    popout::close(&app_handle, &project_id);
-    Ok(())
+    popout::close(&app_handle, &project_id)
 }
 
-/// Whether the pop-out is open — asked on tab open, since a window can outlive
-/// the pane that spawned it.
+/// Whether the pop-out is open, and whether it is pinned on top.
+///
+/// Read on every pane mount: the window outlives the pane — which is unmounted
+/// whenever another Project Home sub-tab is selected — so neither fact can be
+/// carried in component state.
 #[tauri::command]
-pub async fn is_browser_view_popout_open(
+pub async fn get_browser_view_popout_state(
     project_id: String,
     app_handle: AppHandle,
-) -> Result<bool, String> {
-    Ok(popout::is_open(&app_handle, &project_id))
+) -> Result<popout::PopoutState, String> {
+    Ok(popout::state(&app_handle, &project_id))
 }
 
 /// Pin the pop-out above other windows, so it can be watched while working in

app/src-tauri/src/browser_view/mod.rs

@@ -468,17 +468,33 @@ async fn supervise(
     let _ = kill_dashboard(&container_id, &cli_entry).await;
 
     // Deregister, unless a newer session has already taken this project's slot.
-    {
+    let superseded = {
         let mut map = sessions.lock().await;
-        if map.get(&project_id).is_some_and(|s| s.epoch == epoch) {
-            map.remove(&project_id);
+        match map.get(&project_id) {
+            Some(session) if session.epoch == epoch => {
+                map.remove(&project_id);
+                false
+            }
+            // Someone else owns this project now: `stop` removes the session
+            // from the map *before* awaiting this task, and teardown below is
+            // seconds of Docker work, so a restart in that window is ordinary.
+            Some(_) => true,
+            None => false,
         }
+    };
+
+    // Everything past here speaks for the project as a whole, so a superseded
+    // supervisor must say nothing: closing the pop-out would destroy the *new*
+    // session's window, and the off-status would report a running view as
+    // stopped.
+    if superseded {
+        return;
     }
 
     // A pop-out outlives the tab, so nothing else would take it down: the
     // window would sit there showing a frozen last frame of a viewer that no
     // longer exists. The session owns it, and this is where the session ends.
-    popout::close(&app, &project_id);
+    let _ = popout::close(&app, &project_id);
 
     let enabled = manager().is_enabled(&project_id).await;
     emit(&app, &project_id, &BrowserViewStatus::off(enabled));

app/src-tauri/src/browser_view/popout.rs

@@ -27,15 +27,36 @@
 //! dead viewer is worse than no window. The reverse is not true; closing the
 //! window leaves the view running, and the pane takes it back into the tab.
 
+use serde::Serialize;
 use tauri::{AppHandle, Emitter, Manager, WebviewUrl, WebviewWindowBuilder, WindowEvent};
 
-/// Emitted when a pop-out opens or closes. Payload: `{ project_id, open }`.
+/// Emitted when a pop-out opens or closes. Payload: [`PopoutState`] plus the
+/// project id.
 ///
 /// The window can close without the app asking it to — the user hits its X, or
 /// a teardown takes it — so the pane learns about it the same way it learns
 /// about everything else here, by listening.
 const POPOUT_EVENT: &str = "browser-view-popout-changed";
 
+/// What the pane needs to render its pop-out controls.
+///
+/// Both fields are read from the window itself rather than remembered on either
+/// side: the pane is unmounted whenever another Project Home sub-tab is
+/// selected, so anything it merely *remembers* about the window is gone by the
+/// time the user comes back, while the window is still there.
+#[derive(Debug, Clone, Copy, Serialize)]
+pub struct PopoutState {
+    pub open: bool,
+    pub always_on_top: bool,
+}
+
+impl PopoutState {
+    const CLOSED: Self = Self {
+        open: false,
+        always_on_top: false,
+    };
+}
+
 /// Tauri window labels admit `[a-zA-Z0-9-/:_]` only. Project ids are UUIDs, so
 /// this never fires in practice; it exists so a hand-edited `projects.json`
 /// cannot produce a label Tauri rejects at build time.
@@ -65,7 +86,7 @@ pub fn open(
         let _ = window.unminimize();
         let _ = window.set_focus();
         let _ = window.set_always_on_top(always_on_top);
-        emit(app, project_id, true);
+        emit(app, project_id, state(app, project_id));
         return Ok(());
     }
 
@@ -88,12 +109,12 @@ pub fn open(
     // to take the view back into the tab.
     window.on_window_event(move |event| {
         if matches!(event, WindowEvent::Destroyed) {
-            emit(&app_for_event, &project_id_owned, false);
+            emit(&app_for_event, &project_id_owned, PopoutState::CLOSED);
         }
     });
 
     log::info!("Browser view: popped out for project {}", project_id);
-    emit(app, project_id, true);
+    emit(app, project_id, state(app, project_id));
     Ok(())
 }
 
@@ -102,23 +123,39 @@ pub fn open(
 /// `destroy`, not `close`: `close` raises `CloseRequested`, and the app's
 /// window-event handler treats that as a request to quit for the main window.
 /// Nothing here should ever be able to be mistaken for that.
-pub fn close(app: &AppHandle, project_id: &str) {
+///
+/// A failure is **returned, not logged and forgotten**. The pane puts its
+/// iframe back the moment it believes the window is gone, so reporting a close
+/// that did not happen is how you end up with two viewers driving one browser —
+/// the exact state the iframe is dropped to prevent.
+pub fn close(app: &AppHandle, project_id: &str) -> Result<(), String> {
     if let Some(window) = app.get_webview_window(&window_label(project_id)) {
-        if let Err(e) = window.destroy() {
+        window.destroy().map_err(|e| {
             log::warn!(
                 "Browser view: could not close the pop-out for project {}: {}",
                 project_id,
                 e
             );
-        }
+            format!("Could not close the browser window: {}", e)
+        })?;
     }
-    // Unconditional: `Destroyed` covers the normal path, but a window that was
-    // already gone still owes the pane an answer.
-    emit(app, project_id, false);
+    // `Destroyed` covers the normal path; a window that was already gone still
+    // owes the pane an answer.
+    emit(app, project_id, PopoutState::CLOSED);
+    Ok(())
 }
 
-pub fn is_open(app: &AppHandle, project_id: &str) -> bool {
-    app.get_webview_window(&window_label(project_id)).is_some()
+/// Whether the window exists and how it is stacked, read from the window.
+pub fn state(app: &AppHandle, project_id: &str) -> PopoutState {
+    match app.get_webview_window(&window_label(project_id)) {
+        Some(window) => PopoutState {
+            open: true,
+            // A window that cannot answer is not a reason to fail the call; the
+            // pin is a preference, and "not pinned" is the safe reading.
+            always_on_top: window.is_always_on_top().unwrap_or(false),
+        },
+        None => PopoutState::CLOSED,
+    }
 }
 
 /// Pin the pop-out above other windows, or unpin it. No-op when it is closed.
@@ -128,13 +165,19 @@ pub fn set_always_on_top(app: &AppHandle, project_id: &str, on_top: bool) -> Res
     };
     window
         .set_always_on_top(on_top)
-        .map_err(|e| format!("Could not change the window's stacking: {}", e))
+        .map_err(|e| format!("Could not change the window's stacking: {}", e))?;
+    emit(app, project_id, state(app, project_id));
+    Ok(())
 }
 
-fn emit(app: &AppHandle, project_id: &str, open: bool) {
+fn emit(app: &AppHandle, project_id: &str, state: PopoutState) {
     let _ = app.emit(
         POPOUT_EVENT,
-        serde_json::json!({ "project_id": project_id, "open": open }),
+        serde_json::json!({
+            "project_id": project_id,
+            "open": state.open,
+            "always_on_top": state.always_on_top,
+        }),
     );
 }
 

app/src-tauri/src/lib.rs

@@ -438,7 +438,7 @@ pub fn run() {
             browser_view::commands::install_browser_view_browser,
             browser_view::commands::open_browser_view_popout,
             browser_view::commands::close_browser_view_popout,
-            browser_view::commands::is_browser_view_popout_open,
+            browser_view::commands::get_browser_view_popout_state,
             browser_view::commands::set_browser_view_popout_always_on_top,
             // Shared Claude Code auth token
             commands::auth_token_commands::acquire_claude_token,