[Shell] Render the active tab's head in the top bar, not just the page body (#1027)

A tab's title + primary-actions head sits above its screen today, but
that row is inside the page the workspace's tabs sit on, which cannot
reach the window's own top bar -- the issue's repro.
ShellFrame gains a dedicated _headSlot beside the title, built in the
constructor like every other top-bar child, with its own independent
stretch so it keeps claiming width even while the mounted row is
invisible (a screen with no head). Workspace::headRowForActive()
exposes the same reactive head Node headRow() already builds for the
in-body rendering, read directly off the model's own active tab id --
splitting headRow()'s construction into a Row-returning helper both
methods share, since a Node, once built, cannot be mutated further.

shell.cpp mounts it, re-mounting only on a genuine active-tab change
(compared by tab id, not Workspace::active()'s own index, which is a
bar position and not stable across a close) -- the mounted Node is
itself reactive, so in-tab status/action changes update without a
re-mount. The mount and its comparison key reset together, ahead of
_workspace, on every path that tears the workspace down directly
rather than through its own model callback: the destructor and
buildFrame()'s own rebuild (where a fresh Workspace instance restarts
its tab-id numbering from 1, which would otherwise collide with the
pre-rebuild key and silently drop the head on the very screen a sign-in
just opened).

Trailing-edge action alignment inside the row is deliberately not
attempted here: pushing the row's own spacer to stretch would need a
change to ui::spacer() that also affects the existing in-body
rendering, out of scope for a change that only adds a new mount point.
Part (b) of the issue -- an optional second builder for arbitrary
document-authored chrome content -- is explicitly out of scope; this
covers only the ScreenHead-shaped repro the issue actually reports.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Yaraslaut

docs/spec/client/client.md

@@ -85,7 +85,9 @@ route the history holds at start, a move back or forward) signs it in the same w
 shell's own fact, not read from the source: a local source's signed-out principal is its `--user` name and its
 signed-out catalog lists the screens, so neither tells signed in from signed out. The navigator lists the catalog's
 screens either way. The top bar's title and the navigator's current entry follow the active tab: each change of the
-workspace sets the title to the tab's caption and `Navigator::setCurrent` to its screen.
+workspace sets the title to the tab's caption and `Navigator::setCurrent` to its screen. The top bar's head slot
+follows the same way, but only re-mounts on a genuine active-tab change (compared by the model's own tab id, not the
+bar's index), since the mounted row is itself reactive to its own content.
 
 ## Sign-in mapping
 

docs/spec/ui/shell_frame.md

@@ -19,11 +19,16 @@ and the page the workspace's tabs sit on. It is built from backend widgets, so e
 | a row, stretch × stretch | `shell` | the whole frame |
 | a row, surface `sidebar`, `fixed(kShellSidebarWidth)` (28) × stretch, gap 3, its content padded by spacers | `shell_sidebar` | the application's name (`shell_application`, a heading) and a `ui::Navigator` over `ShellFrameOptions::navigator`, whose group headings are sections and whose entries are body text, so the scale runs name, section, entry |
 | a column, stretch × stretch | — | the main column |
-| a row, surface `toolbar`, gap 3, `align: center`, padded by spacers at both ends | `shell_topbar` | the shown screen's title (`shell_title`, a heading that stretches), the principal (`shell_principal`, muted) and a sign-out button (`shell_signOut`) |
+| a row, surface `toolbar`, gap 3, `align: center`, padded by spacers at both ends | `shell_topbar` | the shown screen's title (`shell_title`, a heading that stretches), a slot for its active tab's head row (`shell_head`, its own independent stretch), the principal (`shell_principal`, muted) and a sign-out button (`shell_signOut`) |
 | a column, surface `page`, stretch × stretch | `shell_page` | the page: zero-sized spacers above and either side of the content, each a gap of step 4 away, so the content is padded by step 4 |
 
 - `page()` is the content container, where the client places the workspace.
 - `navigator()` is the navigator, for its pins and search.
+- `headSlot()` is the container a client mounts the active tab's own head row into — `Workspace::
+  headRowForActive()` builds it — beside the title. Its own `stretch` is independent of whether the mounted row is
+  currently visible (a screen with no head mounts an invisible row), so the slot keeps claiming its share of the
+  bar's width either way; `_title` keeps its own separate stretch, so the two split the bar's spare width, and the
+  mounted row renders at its own natural width within the slot rather than reaching the slot's own trailing edge.
 - `setTitle` and `setPrincipal` set the top bar's texts. The bar centres its children across it, so the principal's
   line sits level with the sign-out button's label rather than on the bar's top edge.
 - The sign-out button calls `ShellFrameOptions::onSignOut`; with none, it is hidden.

docs/spec/ui/workspace.md

@@ -114,6 +114,13 @@ mounted after the screen, since it reads the handle, and moved above it. It read
 tracked read of `tabs()`, so a row mounted while the model is still opening the tab reads the head once the model
 holds it, and one whose handle has gone reads nothing.
 
+`Workspace::headRowForActive()` builds the same row for whichever tab is active, as a public `Node` a host can mount
+somewhere else entirely (a client's own shell chrome, outside the page the in-body row above already sits in) —
+`morph::client::Shell` mounts it into `ShellFrame::headSlot()`, beside the title in the top bar. It reads
+`WorkspaceModel::active()` directly, not the public `Workspace::active()` index, since the index is a position in
+the tab bar, not an identity, and is unsafe to compare across a close. With no tab open it returns a defined,
+invisible row — never a null `Node` — so a caller mounting it need not handle a null case itself.
+
 ## Captions
 
 A tab's caption is its screen's `title`, followed by ` •` while `dirty` is true. Each tab of the model has an effect

include/morph/ui/shell_frame.hpp

@@ -36,9 +36,9 @@ struct ShellFrameOptions {
 ///
 /// A row filling the window: the sidebar (surface `sidebar`, `kShellSidebarWidth` units wide), holding the
 /// application's name and a `Navigator`, and the main column holding the top bar (surface `toolbar`: the shown
-/// screen's title, the principal and a sign-out button) above the page (surface `page`), where the client places the
-/// workspace. Signed out, the sidebar and the top bar are hidden and the page is all there is. Neither copyable nor
-/// movable; owned by the owner thread of its backend.
+/// screen's title, a slot for its active tab's head row, the principal and a sign-out button) above the page
+/// (surface `page`), where the client places the workspace. Signed out, the sidebar and the top bar are hidden and
+/// the page is all there is. Neither copyable nor movable; owned by the owner thread of its backend.
 class ShellFrame {
 public:
     /// @brief The frame, appended to @p parent.
@@ -59,6 +59,7 @@ class ShellFrame {
           _topBar{backend.createStack(_main.get(), Axis::Horizontal)},
           _topStart{backend.createSpacer(_topBar.get())},
           _title{backend.createText(_topBar.get())},
+          _headSlot{backend.createStack(_topBar.get(), Axis::Horizontal)},
           _principal{backend.createText(_topBar.get())},
           _signOut{backend.createButton(_topBar.get())},
           _topEnd{backend.createSpacer(_topBar.get())},
@@ -97,6 +98,11 @@ class ShellFrame {
         _title->setRole(TextRole::Heading);
         _title->setLayout({.width = Sizing::stretch(), .height = {}});
         _title->setTestId("shell_title");
+        // Its own stretch, independent of whether the row mounted inside it is currently visible: the mounted
+        // content's own visibility (hidden while a screen has no head) must not collapse the slot's width, since
+        // MorphStack.qml reads the *slot's* widthKind to decide whether the bar as a whole stretches or packs.
+        _headSlot->setLayout({.width = Sizing::stretch(), .height = {}});
+        _headSlot->setTestId("shell_head");
         _principal->setRole(TextRole::Muted);
         _principal->setTestId("shell_principal");
         _signOut->setLabel("Sign out");
@@ -131,6 +137,10 @@ class ShellFrame {
     /// @return It.
     [[nodiscard]] Navigator& navigator() noexcept { return *_navigator; }
 
+    /// @brief The container in the top bar a client mounts the active screen's head row into, beside the title.
+    /// @return It.
+    [[nodiscard]] ContainerWidget& headSlot() noexcept { return *_headSlot; }
+
     /// @brief Shows the shown screen's title in the top bar.
     /// @param title The title; empty shows none.
     void setTitle(std::string_view title) { _title->setText(title); }
@@ -175,6 +185,7 @@ class ShellFrame {
     std::unique_ptr<StackWidget> _topBar;
     std::unique_ptr<SpacerWidget> _topStart;
     std::unique_ptr<TextWidget> _title;
+    std::unique_ptr<StackWidget> _headSlot;
     std::unique_ptr<TextWidget> _principal;
     std::unique_ptr<ButtonWidget> _signOut;
     std::unique_ptr<SpacerWidget> _topEnd;

include/morph/ui/workspace.hpp

@@ -215,6 +215,22 @@ class Workspace {
         return shown ? handleOf(*shown) : nullptr;
     }
 
+    /// @brief The active tab's head row, the same reactive content `headRow` builds for the body-embedded rendering,
+    ///        for a host that mounts it elsewhere (a shell's own top bar, say). Never null: an invisible, empty row
+    ///        stands in for "no active tab" rather than a null `Node`, since a caller mounting this may not expect to
+    ///        handle one.
+    /// @return The row, reactive to the active tab changing and to its head's own content changing.
+    [[nodiscard]] Node headRowForActive() const {
+        std::optional<WorkspaceTabId> const tab = _model->active().peek();
+        if (tab) {
+            return ui::row(buildHeadRow(*tab));
+        }
+        Row empty{.children = {}, .gap = 0, .common = {}, .tone = std::nullopt};
+        empty.common.testId = "head";
+        empty.common.visible = false;
+        return ui::row(std::move(empty));
+    }
+
     /// @brief Closes every tab without asking, newest first: what signing out does, since no close guard may keep a
     ///        screen of the principal who is leaving.
     void forceCloseAll() { _model->forceCloseAll(); }
@@ -327,9 +343,12 @@ class Workspace {
         return handle == nullptr ? nullptr : handle->head();
     }
 
-    // The head row above a tab's screen: the subtitle (muted), the badges, a spacer and the actions as buttons. It is
-    // hidden while the head has none of them, so a screen without a head looks as it would without the row.
-    [[nodiscard]] Node headRow(WorkspaceTabId tab) const {
+    // The head row's own content, built but not yet wrapped into an immutable Node: the subtitle (muted), the
+    // badges, a spacer and the actions as buttons. Hidden while the head has none of them, so a screen without a
+    // head looks as it would without the row. Factored out of headRow() so a caller needing to set additional
+    // layout fields on the row -- which a Node, once built, can no longer be mutated to carry -- can do so on the
+    // still-mutable Row this returns, before wrapping it itself.
+    [[nodiscard]] Row buildHeadRow(WorkspaceTabId tab) const {
         auto const subtitle = [this, tab] {
             ScreenHead const* const head = headOf(tab);
             return head == nullptr ? std::string{} : head->subtitle().get();
@@ -387,9 +406,12 @@ class Workspace {
                 return ui::button(std::move(button));
             },
             Axis::Horizontal, 1));
-        return ui::row(std::move(row));
+        return row;
     }
 
+    // The head row above a tab's screen, exactly as buildHeadRow() builds it, wrapped into a Node.
+    [[nodiscard]] Node headRow(WorkspaceTabId tab) const { return ui::row(buildHeadRow(tab)); }
+
     // The model changed: the bar shows its tabs in order, with their captions, and the active tab's page.
     void showTabs() {
         if (_model == nullptr) {

src/client/shell.cpp

@@ -109,7 +109,9 @@ class Shell final : public ui::MountedShell {
 
     ~Shell() override {
         *_alive = false;
-        // The tabs first, then the frame they sit in.
+        // The head row's own mount first, since it is built from the Workspace's data and lives in the ShellFrame;
+        // then the tabs, then the frame they sit in.
+        resetHead();
         _workspace.reset();
         _frame.reset();
     }
@@ -293,6 +295,7 @@ class Shell final : public ui::MountedShell {
     // The frame and its workspace for the catalog the source holds now: the navigator lists its entries, so a new
     // session's catalog gets a new frame. Every tab of the old one is closed.
     void buildFrame() {
+        resetHead();
         _workspace.reset();
         _frame.reset();
         ui::CatalogReply const* const catalog = _source->catalogReply();
@@ -377,6 +380,29 @@ class Shell final : public ui::MountedShell {
         auto const tabs = _workspace->tabs();
         _frame->setTitle(shown && *shown < tabs.size() ? tabs.at(*shown).caption : std::string{});
         _frame->navigator().setCurrent(activeScreen());
+        showActiveHead();
+    }
+
+    // The top bar's head slot follows the active tab, but only re-mounts on a genuine tab change: onChanged also
+    // fires on title/dirty/identity changes, and the mounted row is itself reactive to a head's own
+    // subtitle/status/actions, so those update in place with no re-mount needed. Comparing the tab's id, not its
+    // index: an index is a position in the tab bar, not an identity, and is unsafe to compare across a close (two
+    // different tabs can share the same index at different times, and the same tab can shift index without
+    // changing).
+    void showActiveHead() {
+        std::optional<ui::WorkspaceTabId> const active = _workspace->model().active().peek();
+        if (active == _headTab) {
+            return;
+        }
+        _headTab = active;
+        _head.emplace(_context->runtime(), *_backend, _workspace->headRowForActive(), &_frame->headSlot());
+    }
+
+    // The head row's own mount and its comparison key, always reset together: resetting one without the other would
+    // leave the guard above comparing against a tab id from a Workspace instance that no longer exists.
+    void resetHead() {
+        _head.reset();
+        _headTab.reset();
     }
 
     // The screen id of the active tab; empty with none.
@@ -607,6 +633,11 @@ class Shell final : public ui::MountedShell {
     std::unique_ptr<ui::ShellFrame> _frame;
     std::unique_ptr<ui::Workspace> _workspace;
     std::optional<ui::Mounted> _message;
+    // The active tab's head row, mounted into the frame's top-bar slot; reset together with its own comparison key
+    // (never one without the other) ahead of _workspace, since both are built from the Workspace's own data and
+    // mounted into the ShellFrame.
+    std::optional<ui::Mounted> _head;
+    std::optional<ui::WorkspaceTabId> _headTab;
     // Whether a sign-in or sign-out has reloaded the catalog, and whether the session is now signed in.
     bool _changed = false;
     bool _signedIn = false;

tests/test_ui_shell_frame.cpp

@@ -49,6 +49,11 @@ TEST_CASE("shell frame: a sidebar with the navigator, a top bar and the page, on
     CHECK(backend.prop(backend.find("Text", "testId", "shell_principal").value(), "text") == "alice");
     CHECK(backend.prop(backend.find("Text", "testId", "shell_application").value(), "text") == "Morph Bookmarks");
 
+    // The head slot (#1027): its own stretch, independent of whatever is mounted inside it, so it keeps claiming
+    // room in the top bar even while an active tab's head row is hidden.
+    int const headSlot = backend.find("Row", "testId", "shell_head").value();
+    CHECK(backend.prop(headSlot, "layout") == "stretch(1)/content");
+
     backend.click(backend.find("Button", "testId", "nav_bookmarks.tags").value());
     CHECK(opened == std::vector<std::string>{"bookmarks.tags"});
     backend.click(backend.find("Button", "testId", "shell_signOut").value());

tests/test_ui_workspace.cpp

@@ -445,6 +445,37 @@ TEST_CASE("workspace: a screen without head parts leaves the head row hidden", "
     CHECK(harness.backend.prop(harness.byTestId("Row", "head"), "visible") == "false");
 }
 
+// Mutation: build headRowForActive() from Workspace::active()'s index rather than the model's own tab id (would
+// desync across a close that reindexes a later tab). Also covers: no tab open gives a defined, invisible row, never
+// a null Node (headRowForActive() must never throw inside Mounted's own null check).
+TEST_CASE("workspace: headRowForActive mounts the active tab's own head row, separately from the in-body one",
+          "[ui][workspace]") {
+    using morph::ui::Mounted;
+    Harness harness;
+    Host host{harness, std::nullopt};
+    Workspace shell{harness.runtime, harness.backend, host, catalog()};
+
+    // No tab open: a defined, invisible row, not a null Node.
+    {
+        Mounted const separate{harness.runtime, harness.backend, shell.headRowForActive()};
+        CHECK(harness.backend.prop(harness.byTestId("Row", "head"), "visible") == "false");
+    }
+
+    REQUIRE(shell.open("headed", {}) == 0U);
+    harness.settle();
+    Mounted const separate{harness.runtime, harness.backend, shell.headRowForActive()};
+    harness.settle();
+    // Two renderings of the same tab's head, both present -- confirming headRowForActive() reads the live active
+    // tab's own data, the same way the in-body headRow() does, not a stale snapshot.
+    std::string const dump = harness.backend.dump();
+    std::size_t rows = 0;
+    for (std::size_t at = dump.find("head_subtitle"); at != std::string::npos;
+         at = dump.find("head_subtitle", at + 1)) {
+        ++rows;
+    }
+    CHECK(rows == 2);
+}
+
 namespace {
 
 using morph::ui::WorkspaceModel;