Remember and restore window geometry per monitor configuration (#2135) - #7477

…low-ai#2135)

When the user switches between monitor setups (dock/undock, reconnect a
display, home-dual ↔ office-single ↔ laptop-only), each main window now
returns to the position and size it last had on that configuration.
Previously cmux kept only one last frame, so reconnecting the external
monitor left the window on the built-in display (manaflow-ai#2135); the just-merged
manaflow-ai#6913 reconcile keeps a stranded window reachable but does not remember
where it was.

Design (per-window config-frame ring, folded into the manaflow-ai#6913 reconcile):

- Stable display key: NSScreen.cmuxStableDisplayKey prefers
  CGDisplayCreateUUIDFromDisplayID (stable across reboot, GPU-mux, and
  port/reconnect — unlike the raw CGDirectDisplayID) with an EDID-triple
  fallback; nil when neither resolves, so such a display is excluded from
  any persisted key rather than keyed unstably.

- Display-configuration signature (DisplayConfigurationSignature, pure /
  in CmuxWindowing): sorted and order-independent; excludes visibleFrame
  (so Dock/menu-bar/notch changes don't re-key the same setup); includes
  frame origin+size (so resolution changes re-key, and two identical-model
  monitors are disambiguated left/right by position); mirror sets get a
  distinct marker so they never collide with laptop-only.

- Per-window LRU ring (SessionConfigFrameEntry, cap 8) stored additively on
  SessionWindowSnapshot (optional field → older snapshots decode
  unchanged) and mirrored in memory for capture/restore.

- Capture firewall (the manaflow-ai#2135 corruption guard): captures run only on
  non-reactive paths (session snapshot, window close, plus a leading-edge
  snapshot at the top of the didChangeScreenParameters handler that records
  the still-good frame under the PRE-change signature). Every write is
  suppressed during session restore, teardown, and the settling window
  after a screen change; skipped when reconciledFrameAfterScreenChange
  would move the frame (never persist a stranded frame); and keyed to the
  write-time signature so a slipped write can only land in the
  currently-connected slot, never overwrite a disconnected one.

- Restore folds into the existing manaflow-ai#6913 debounced reconcile pass (no second
  observer). It fires only when the connected-display signature genuinely
  changes vs lastAppliedConfigurationSignature (seeded at
  didFinishLaunching), so sleep/wake and Dock resize are no-ops. Remembered
  frames are routed through resolvedWindowFrame (re-clamped if they no
  longer fit), fullscreen windows are skipped, and the reachability safety
  net still runs afterward.

Tests: 9 pure signature tests (CmuxWindowing package) covering
order-independence, visibleFrame-exclusion, resolution sensitivity,
identical-panel position disambiguation, mirror distinctness, and
refuse-to-key; 4 app-target tests including the headline round-trip
(place on external → disconnect must NOT mutate the external slot →
reconnect restores exactly), LRU upsert/eviction, and clamp-when-oversized.
New test file wired into project.pbxproj.

DEBUG-only cmuxDebugLog tracing so the dock/undock round-trip can be
verified from the event log:

- monitorMemory.screenChange — a display reconfiguration was observed
  (with display count + names).
- monitorMemory.capture / .capture.skip — a window frame was recorded
  under a configuration signature, or which guard rejected the capture
  (settling/restore/teardown, fullscreen, noStableSignature, strandedFrame).
- monitorMemory.reconcile — whether the connected-display signature
  changed since the last applied one (drives whether restore runs).
- monitorMemory.restore.hit / .restore.miss — a remembered frame was
  restored for the new configuration, or none was found.

Signatures are rendered via a compact token (display count + short
suffix) so lines stay readable with several displays.

Dogfood on real hardware showed the window landing on the wrong screen
after reconnecting monitors. Debug logs pinpointed the cause: the
"leading-edge" capture in the didChangeScreenParameters handler was built
on a false assumption — that the notification fires BEFORE NSScreen.screens
updates. It fires AFTER. So the leading-edge capture stored the outgoing
window frame (still the laptop position) under the INCOMING configuration
signature, overwriting the good remembered frame for that configuration.
Restore then faithfully applied the corrupted frame.

The log sequence on reconnect:
  capture reason=screenChange.leadingEdge sig=[2-monitor] frame={laptop pos}
  restore.hit  sig=[2-monitor] applied={laptop pos}   ← wrong screen

A DELL monitor's ~2s EDID handshake made it worse: each transient
screen-change fired another leading-edge capture that wrote junk under a
transient signature.

Fix: remove the leading-edge capture entirely — there is no correct
"pre-change" frame to capture once the screens have already changed. The
per-config ring is populated only while a configuration is STABLE (the
session-autosave tick and window close), which are correctly keyed to the
current signature. Transient handshake configs now simply produce a
restore.miss (harmless; the window stays put) and the final real config
restores from the correctly-captured slot.

…space enum

CI's package-conventions-lint flagged `enum DisplayConfigurationSignature`
as a namespace-type (all-static public surface, not instantiable). The
repo rule: receiver-natural pure transforms belong in an extension on the
receiver type, not a caseless namespace enum.

Convert to `extension [SessionDisplayGeometry]` with a
`displayConfigurationSignature(isMirrored:)` method (and a fileprivate
per-element `displayConfigurationComponent`). Call sites read better too:
`displays.displayConfigurationSignature(...)`. Pure logic unchanged; the 9
package signature tests and the app-target round-trip tests are updated to
the new call form and still pass. The ios-tests / workflow-guard failures
were gated on this lint and clear with it.

- Seed windowConfigFrames in createMainWindow(sessionWindowSnapshot:) so
  additional startup windows, previous-session reopen, and closed-window
  restore keep their per-configuration frames under the assigned window id
- Reschedule the screen-change reconcile when session restore completes so
  a display change that lands mid-restore is consumed instead of dropped
- Clear the capture firewall only when a reconcile pass actually consumes
  the settled configuration; skipped passes now fail closed instead of
  reopening on elapsed time
- Extract AppDelegate+MonitorMemory.swift and SessionDisplayFrames.swift
  so AppDelegate.swift and SessionPersistence.swift return under the Swift
  file length budget without touching the budget TSVs
- Add regression tests for snapshot-window seeding, fail-closed settling
  during restore, and the post-restore reconcile reschedule

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>