Function attach_view 

async fn attach_view<S>(
    socket: &mut ClientSocket<S>,
    state: &Arc<TransportState>,
    viewing: &mut Option<Viewing>,
    me: u64,
    seat: SessionSlot,
    reply_to: Option<u64>,
    tab: Option<u16>,
    page: Option<String>,
) -> Result<()>
where
    S: Sink<Message, Error = Error> + Unpin + Send,

One viewer’s attach: the same body for a tab number and for a hand-off’s page, because everything after the resolution is identical.

The attach moves the viewer, it does not first drop it. Un-attaching here and re-attaching below read as a move even when the request is the tab this connection is already on, and it took the controller role with it: the person’s second Open left their surface driving a tab whose every gesture was refused. The move - old tab lets go, same tab keeps its role - is BrowserHost::attach’s own decision, where the resolved profile and tab are known.