fix(macos): close the window without quitting Buzz

[mahanti]

Closing the last Buzz window with Cmd-W or the red close button currently quits the app on macOS. Keep the main window and its webview alive while hidden, then restore it when macOS reopens the app. Cmd-Q continues through the existing agent, terminal, and browser shutdown path.

The change is limited to src-tauri/src/lib.rs (18 insertions, 1 deletion). Other platforms and auxiliary windows retain their existing behavior. The close handler returns before embedded-browser teardown so closing the main window does not discard its browser session.

Validation

Checked source matches commit 58622f38.

Human author confirmed that Cmd-W → Dock reopen → Cmd-Q works correctly.

buzz-review-completed

• Independent agent review: no blockers; minimalness 10/10, elegance 9/10, correctness 9/10; native checks and human confirmation completed as recorded below.
• Apple Silicon macOS debug build and isolated app bundle succeeded.
• Native regression checks on the isolated bundle: five repeated Cmd-W / Finder reopen cycles retained the unsubmitted identity-import form; red-close / reopen also retained it. Reopening after minimization was exercised. Cmd-Q from both visible and closed-window states terminated the test process.
• bin/cargo clippy -p buzz-foundation --all-targets -- -D warnings passed.
• bin/cargo fmt --all -- --check and git diff --check passed.
• bin/cargo test -p buzz-foundation --lib: 103 passed, 1 failed, 3 ignored. The unchanged terminal::tests::real_spawn_fences_secrets_and_preserves_login_context failed because the machine's interactive shell waits for a corporate security acknowledgment, preventing the fixture command from executing. No assertion, timeout, or security setting was weakened.
• Explicit staged-runtime test native_start_restore_disconnect_stop_and_quit_fence_late_credentials -- --ignored: passed.

No browser journeys were added or removed: browser automation cannot establish native window and process lifecycle. Tauri's mock runtime implements hide/show/focus as no-ops, so the OS behavior was exercised in the native bundle instead. The test bundle used a separate application identifier and no registered URL schemes; it had no identity or connected community.

Remaining checks

• Direct Dock clicking was verified by the human author. Agent automation used Finder app reopening because the Dock UI tool timed out.
• Retention of a live embedded website, connected-agent behavior across close/reopen, and packaged release behavior have not been manually exercised.
• Hosted CI/DCO status is tracked by the PR checks. The local terminal test failure above remains disclosed.

Screenshots are not applicable to this lifecycle-only change; there is no new visual design.

[wesbillman]

Star Lord automated source review (via Wes’s account)

No actionable findings in this change.

Reviewed head 58622f38144f314b85f0b26c24919faa6ff080cb against target base 6e37bbd8cf711c80617daff7fae40b0a62be217a (PR merge-base b279fe556d6aa050bb791d723edaaa490c117580). Scope: the 18 additions/1 deletion in src-tauri/src/lib.rs; pinned Git objects only, no dirty working-tree inputs.

• The macOS/main-window guard cancels destruction before hiding the existing window, and returns before browser::window_event would discard the embedded browser session (lib.rs:470–482, browser/mod.rs:161–175). Other platforms and auxiliary windows retain the previous event dispatch.
• Reopen reuses the existing main-thread foregrounding path, including show/unminimize/focus (lib.rs:487–490, deep_links.rs:70–82, notifications.rs:107–122). It does not recreate the webview or agent host.
• Explicit Quit cleanup remains in the existing run-event handling (lib.rs:491–508). I traced the locked Tauri/Tao/Muda close, reopen and quit dispatch separately; the new close interception does not intercept the native Quit action.

Source-level assessment: minimalness 10/10, elegance 9/10, correctness 9/10. No requested code changes.

Validation limits: source-only review; no builds, tests, app launches or PR code execution. One read-only hosted-check snapshot showed CI required, Linux/native integration, browser lanes and DCO passing; Windows native validation was skipped. Those checks do not prove macOS window behavior. The PR’s native/human acceptance report was read, not independently reproduced. Its disclosed local terminal-test failure, live embedded-site retention, connected-agent close/reopen and packaged-release gaps remain outside this review’s verification. This COMMENT is not an approval or merge authorization.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

No actionable findings. This is an appropriately scoped native-shell change. Reviewed head 58622f38144f314b85f0b26c24919faa6ff080cb against target 6e37bbd8cf711c80617daff7fae40b0a62be217a (merge-base b279fe556d6aa050bb791d723edaaa490c117580), including independent review of the pinned macOS runtime.

The exact macOS/main-window guard cancels destruction before hiding and returns before embedded-browser teardown. Reopen reuses the existing main-thread show/unminimize/focus helper. Other platforms and auxiliary windows retain their existing dispatch. Keeping agents, terminals, relay connections and the document alive while the window is closed is intentional; Close is no longer Stop/Quit.

Explicit Cmd-Q still reaches existing RunEvent::Exit cleanup. Precision on the shutdown guarantee: the pinned macOS native Quit path goes directly to Exit, not the cancellable ExitRequested gate. That was already true before this PR; this change neither introduces nor repairs that limitation.

Non-blocking validation gaps: add a native fullscreen → Cmd-W → Dock reopen smoke test when practical; the supplied evidence covers windowed/minimized states, not fullscreen. Connected-agent and live embedded-site retention, and packaged-release behavior remain unverified as disclosed. These are not reproduced defects or requested production changes.

Required hosted CI and DCO passed at this head. The PR reports native debug-bundle checks and human Dock confirmation; I read that evidence but did not independently launch/build/test the app. Full diff and public PR text inspected with no internal-information leakage or generated artifacts found. This COMMENT is not an approval or merge authorization.