make spawned apps survive att_menu termination

services/AppLauncher.qml

@@ -12,6 +12,26 @@ import qs.config
 Singleton {
     id: root
 
+    // Set only when att_menu itself was started by systemd, which is the one
+    // case where the control group is worth escaping. Started from a shell or
+    // by the compositor the panel shares the session's group, and wrapping
+    // would buy nothing.
+    readonly property bool inSystemdUnit: !!Quickshell.env("INVOCATION_ID")
+
+    // Moves a launched app into a transient scope of its own, outside att_menu's
+    // control group. Stopping a systemd unit signals every process in its group
+    // and execDetached's fork does not leave it, so without this the panel takes
+    // down everything it ever launched — which is what happens each time tablet
+    // mode ends and the unit is stopped.
+    //
+    // A scope, not a service: the app keeps the environment, working directory
+    // and stdio it was given, so WAYLAND_DISPLAY and friends still reach it.
+    // The exec'd shell leaves no process of its own behind, and passing the app
+    // as "$@" keeps its arguments intact. systemd-run is only assumed to be on
+    // PATH when it is actually there — the panel runs on systems packaged
+    // without it too.
+    readonly property var scopeWrapper: ["sh", "-c", "command -v systemd-run >/dev/null 2>&1 && exec systemd-run --user --scope --collect --quiet -- \"$@\"; exec \"$@\"", "att_menu"]
+
     function withoutFieldCodes(command: var): var {
         const out = [];
 
@@ -37,7 +57,7 @@ Singleton {
 
         const argv = entry.runInTerminal ? [...Config.terminal, ...command] : command;
         const options = {
-            command: argv
+            command: root.inSystemdUnit ? [...root.scopeWrapper, ...argv] : argv
         };
 
         if (entry.workingDirectory)