Fix drag-out giving live drags to OLE: prove the pointer left REAPER

OffReaper leaves the surface vocabulary; OsHandoff now gates on a window-ownership
proof resolved in the shell, so no in-REAPER surface can reach DoDragDrop.

src/core/ui/CLAUDE.md

@@ -88,7 +88,9 @@ L7 sub-pass, 2026-07-27):
   between evaluations. That is what makes every transition reversible and what
   makes drag speed (WM_MOUSEMOVE coalescing) unable to change an outcome. Leaving
   REAPER entirely is the one irreversible transition, because the OS hand-off goes
-  modal. A first-move class lock and a drag-lifetime "cannot hand off" latch both
+  modal — so it must be PROVEN (a window-ownership test in the shell), never inferred
+  from a hit-test token REAPER could not name; an unrecognised surface *inside* REAPER
+  refuses. A first-move class lock and a drag-lifetime "cannot hand off" latch both
   existed here and were removed — do not reintroduce either.
 
 ## Modules
@@ -97,7 +99,7 @@ L7 sub-pass, 2026-07-27):
 - `bank_grid` — REAPER-free grid layout, selection, keyboard-nav, and thumbnail-cache-key logic for the docked bank panel.
 - `tab_strip` — REAPER-free scrollable tab-strip layout + hit-test for the named-banks strip.
 - `prune_button` — pure layout/hit-test for the `bank_panel` footer Prune button.
-- `drag_out` — the pure drag-out gesture law plus path-list assembly. Owns the `ReaperSurface` vocabulary (OffReaper / TrackPanel / FxSurface / FxEmbed / Arrange / Other — `core/wire/instrument_drop` classifies REAPER's info token INTO it), `decideDropClass` (surface × single-vs-multi payload → Internal / InstrumentDrop / ArrangeInsert / Refuse / OsHandoff / None), and `cueForDropClass`. **No `DropClass` means "nothing happens"**: a surface with no defined outcome for the payload resolves to `Refuse`, which the shell shows as a cursor, so "no silent no-op release" is a property of the enumeration rather than of any call site.
+- `drag_out` — the pure drag-out gesture law plus path-list assembly. Owns the `ReaperSurface` vocabulary (TrackPanel / FxSurface / FxEmbed / Arrange / Other — `core/wire/instrument_drop` classifies REAPER's info token INTO it; there is deliberately no off-REAPER member, since no token can carry that fact), `decideDropClass` (surface × single-vs-multi payload → Internal / InstrumentDrop / ArrangeInsert / Refuse / OsHandoff / None), and `cueForDropClass`. `OsHandoff` is reachable ONLY through `DropContext::pointerOffHost`, a positive window-ownership proof the shell owes the law (`drag_out_win::pointerOverHostWindow`), gated ahead of the surface switch — so no reading of REAPER's hit-test can give a live drag away to OLE. **No `DropClass` means "nothing happens"**: a surface with no defined outcome for the payload resolves to `Refuse`, which the shell shows as a cursor, so "no silent no-op release" is a property of the enumeration rather than of any call site.
 - `theme` — pure palette module: role→color mapping, REAPER-grey neutral ladder + the pastel accent system, the keyboard strip's spectral ramp, WCAG contrast-floor helpers + `compositeOver` (the effective color of a translucent fill, so alpha overlays are testable). Only the ramp's MID stop is its own constant; lo/hi are still aliases of `accent/primary`/`accent/tertiary`, so a categorical accent move CAN still reorder the ramp — `testSpectralRampLuminanceIsMonotonic` is the build-time catch, not the structure.
 - `component_geometry` — pure button/slider/list-row geometry + hover hit-test helpers.
 - `action_bar` — pure task-grouped action-bar layout/hit-test: clusters (Capture / Placement / Maintenance / Tagging / Switching).

src/core/ui/drag_out.cpp

@@ -24,10 +24,12 @@ DropClass decideDropClass(int px, int py, const PanelClientRect& client,
     if (!ctx.drag.dragging || !ctx.drag.hasArmedSamples) return DropClass::None;
     if (insideClient(px, py, client)) return DropClass::Internal;
 
-    switch (ctx.surface) {
-        case ReaperSurface::OffReaper:
-            return DropClass::OsHandoff;
+    // The hand-off gate sits AHEAD of the surface switch and is the only route to OsHandoff, so
+    // no reading of REAPER's hit-test — recognised, unrecognised, or empty — can reach the modal
+    // OLE loop while the pointer is still over a host window.
+    if (ctx.pointerOffHost) return DropClass::OsHandoff;
 
+    switch (ctx.surface) {
         case ReaperSurface::TrackPanel:
         case ReaperSurface::FxSurface:
             // One instance holds one capture, so a multi payload names no instrument to build —

src/core/ui/drag_out.h

@@ -6,8 +6,10 @@
 //
 // THE LAW: the class is resolved from what is under the cursor on EVERY move; every transition
 // is reversible until release or until the pointer leaves REAPER entirely; the OS hand-off is
-// reserved for leaving REAPER, and every REAPER-internal target executes natively on release.
-// Do not reintroduce a first-move class lock or a drag-lifetime "blocked" latch.
+// reserved for leaving REAPER — which the shell must PROVE (DropContext::pointerOffHost), never
+// infer from a hit-test token it could not name — and every REAPER-internal target executes
+// natively on release. Do not reintroduce a first-move class lock or a drag-lifetime "blocked"
+// latch.
 //
 // Path-list assembly: turns armed sample ids into the absolute path list an OS drop carries
 // (Windows CF_HDROP / macOS file-list pasteboard) — set algebra only; the shell resolves each id
@@ -32,16 +34,18 @@ struct DragState {
 };
 
 // What REAPER reports under the pointer, reduced to the surfaces the law distinguishes.
-// Produced from GetThingFromPoint's info token by wire::classifyReaperSurface.
+// Produced from GetThingFromPoint's info token by wire::classifyReaperSurface. There is
+// deliberately NO off-REAPER member: this vocabulary describes what REAPER's own hit-test
+// named, and "the pointer left REAPER" is a window-ownership fact no token can carry —
+// it enters through DropContext::pointerOffHost instead.
 enum class ReaperSurface {
-    OffReaper,   // not over REAPER at all — the one irreversible exit
     TrackPanel,  // TCP/MCP, ANY sub-element: the WHOLE panel is the instrument hotspot
     FxSurface,   // fx_* — the FX chain and floating-FX windows
     FxEmbed,     // tcp.fxembed / mcp.fxembed — an instance already draws there
     Arrange,     // the timeline
-    Other,       // ruler, transport, spacers, docker chrome, unknown future tokens
+    Other,       // ruler, transport, spacers, docker chrome, unknown/empty future tokens
     Count,       // sentinel, NOT a real surface — tests/test_drag_out.cpp's kAllSurfaces is
-                 // pinned against this via static_assert so a 7th surface can't silently skip
+                 // pinned against this via static_assert so a 6th surface can't silently skip
                  // the exhaustiveness matrix
 };
 
@@ -62,8 +66,15 @@ enum class DropClass {
 struct DropContext {
     DragState drag;
     bool singlePayload = false;  // payload holds EXACTLY one capture (arms InstrumentDrop)
-    ReaperSurface surface = ReaperSurface::OffReaper;  // only read outside the client rect
+    ReaperSurface surface = ReaperSurface::Other;  // only read outside the client rect
     bool haveTrack = false;      // GetThingFromPoint returned a non-null MediaTrack*
+    // The ONE gate on the irreversible OS hand-off, and the only member whose true value can
+    // produce it. It is a POSITIVE proof the shell owes the law — a window-ownership test
+    // (drag_out_win::pointerOverHostWindow), not "the hit-test named nothing I recognise",
+    // which is equally true of the transport, the toolbar and the docker chrome. Defaults
+    // false so an unset context stays inside REAPER: the failure mode of forgetting to
+    // resolve it must be a refusal, never a drag given away to OLE.
+    bool pointerOffHost = false;
 };
 
 // Resolves the class for a drag at pointer (px, py) over `client`. Position-and-context only,

src/core/wire/CLAUDE.md

@@ -81,7 +81,7 @@ This directory owns two cross-artifact contracts specifically:
 - `reasampler_uid.h` — SDK-free header owning the FOREVER-FROZEN VST3 class-UID integer macros (stable + beta pairs, `REASAMPLER_PROC_UID_*` / `REASAMPLER_PROC_UID_BETA_*`) and the `REASAMPLER_ACTIVE_UID_*` channel-selector macros. Split out of `reasampler_vst.h` so the pure extension side (`instrument_drop`) can derive the `.vstpreset` class-ID hex string without pulling in the VST3 SDK. Both `reasampler_vst.h` (runtime `FUID`) and `instrument_drop` (preset hex string) source from this single header — the binary identity and the preset-file identity cannot diverge.
 - `assignment_request` — pure ingest-assign wire: typed request record carrying the drop payload from the `ingest` shell through to the VST3 bridge.
 - `bake_wire` — the resample bake's request/outcome pair on ONE per-instance key (`rsbake_<guid>`): the instrument writes a `BakeRequest`, invokes the extension's action synchronously, and reads the extension's `BakeOutcome` back over the same key inside that one call. Not a handshake — a call and a return, and it must not grow a claim protocol. Also the ONE home of the bake action's command-id suffix and of the leading underscore `NamedCommandLookup` needs but `rec->Register("command_id", …)` does not, so both artifacts name one action. `BakeStatus` values are WIRE INTEGERS: never renumber, only append, and an unrecognized value decodes as `Failed` rather than as the numeric default `Ok`. It owns BOTH ends' reading of that key, since the key's contents are the only evidence either side gets: `classifyBakeAnswer` (instrument side — six kinds, of which `Unanswered`, the request still sitting there untouched, separates "nothing wrote an outcome over our key" from a refusal — it does NOT identify a landing that never ran, since a skipped key and a rejected answer-write look identical from here) and `classifyBakeScan` + `kMaxRequestAgeSeconds` (extension side — the per-key Land / RefuseWrongProject / ClearStale / IgnoreUnreadable / IgnoreNotARequest verdict over every open tab, stated without a REAPER type so the multi-tab matrix is unit-provable). `BakeScanTally` + `describeBakeScan` + `describeBakeKey` are that same reading counted and spoken — the rationale lives at the types. **The report's absence is NOT evidence the landing never ran**, and no sentence either artifact prints may say it is: `answered` is pass-wide and counts a QUEUED write, so a pass can answer some other key while skipping ours, or have our own answer's `SetProjExtState` rejected. The summary is therefore silent only when the pass answered somebody, left no key unanswered, and every answer was READ BACK from its own key; `describeBakeKey` prints one line per enumerated key regardless, which is the only thing that names WHICH key — the counts cannot. The read-back verdict behind `BakeWriteProof` is `ext_state_read.h`'s `extStateWriteLanded`, above. `bakeLandingAfterPersist` is the ONE route to a `Banked` landing: every `Land` verdict is assigned `Unpersisted` and passed through it, so no shell path — a dedup hit least of all, since its target may be an entry the same pass just added — can claim the word without the pass's persist having reported success. What `Banked` claims is exactly that `persisted` input — a saved project was active and the bank write was issued — and the enum comment is that claim's one home.
-- `instrument_drop` — pure FX-drop payload builder: constructs a Steinberg-format `.vstpreset` image (channel-active class ID + the instrument's own component state, capture pre-selected) the shell applies via `TrackFX_SetPreset`; owns `classifyReaperSurface`, the prefix classifier mapping a `GetThingFromPoint` (info token, track-present) pair onto `core/ui/drag_out`'s `ReaperSurface`. Classifier ordering is load-bearing: the embed strip is matched before the `tcp`/`mcp` panel family, which now claims the WHOLE track panel rather than just its FX sub-elements. All-or-nothing contract — caller rolls back via `TrackFX_Delete` on any failure.
+- `instrument_drop` — pure FX-drop payload builder: constructs a Steinberg-format `.vstpreset` image (channel-active class ID + the instrument's own component state, capture pre-selected) the shell applies via `TrackFX_SetPreset`; owns `classifyReaperSurface`, the prefix classifier mapping a `GetThingFromPoint` info token onto `core/ui/drag_out`'s `ReaperSurface`. Classifier ordering is load-bearing: the embed strip is matched before the `tcp`/`mcp` panel family, which claims the WHOLE track panel rather than just its FX sub-elements. An empty token is `Other`, never an off-REAPER verdict — the SDK documents no off-REAPER return, so the toolbar/transport/docker chrome all report nothing REAPER names. All-or-nothing contract — caller rolls back via `TrackFX_Delete` on any failure.
 - `sample_usage` — instance-usage wire: `UsageRecord`, `planUsagePublish` (fresh/heal/clean-replace/union/remint publish plan), `foldUsageRecords`/`usageHeldPaths` (liveness fold — protect-all when records exist but no instance is live; abort→protect-all on unreadable record; `counted` carries key-attributed live records), `identityMatches` (ReaSampler 9000 FX identity). REAPER-free, unit-tested. The mirror of `assignment_request` on the instrument→extension direction: the wire format and the two safety-critical decisions (what to write on publish, which records count at prune time) are pure so they are provable without a DAW. It lives here because it is a *wire format* with an instrument-side writer; the fold's output is consumed by `core/tracking`'s authority, which owns every consumer-facing decision built on it.
 
 ## Gotchas

src/core/wire/instrument_drop.cpp

@@ -87,11 +87,10 @@ DropOutcome decideDropOutcome(const DropAttempt& attempt) {
     return out;
 }
 
-ui::ReaperSurface classifyReaperSurface(const std::string& info, bool haveTrack) {
+ui::ReaperSurface classifyReaperSurface(const std::string& info) {
     // See the header contract for the prefix rule and the ordering it depends on.
     auto startsWith = [&info](const char* p) { return info.rfind(p, 0) == 0; };
 
-    if (info.empty()) return haveTrack ? ui::ReaperSurface::Other : ui::ReaperSurface::OffReaper;
     if (startsWith("tcp.fxembed") || startsWith("mcp.fxembed")) return ui::ReaperSurface::FxEmbed;
     if (startsWith("fx_")) return ui::ReaperSurface::FxSurface;
     if (startsWith("tcp") || startsWith("mcp")) return ui::ReaperSurface::TrackPanel;

src/core/wire/instrument_drop.h

@@ -55,9 +55,9 @@ std::vector<std::uint8_t> buildVstPresetBytes(const std::string& classIdHex32,
 // preset. Deterministic.
 std::vector<std::uint8_t> buildInstrumentDropPreset(const std::string& sampleId);
 
-// Pure classifier for GetThingFromPoint's (info string, track-was-returned) pair
-// into the surfaces the drag-out gesture law distinguishes. The SDK warns future
-// versions may append information, so every rule is PREFIX-based:
+// Pure classifier for GetThingFromPoint's info string into the surfaces the drag-out
+// gesture law distinguishes. The SDK warns future versions may append information, so
+// every rule is PREFIX-based:
 //   "tcp.fxembed*" / "mcp.fxembed*" -> FxEmbed. Checked FIRST: it is the surface
 //       an existing instance already draws on, and a drop must not stack a second.
 //   "fx_*"                          -> FxSurface (FX chain + floating FX windows).
@@ -66,12 +66,15 @@ std::vector<std::uint8_t> buildInstrumentDropPreset(const std::string& sampleId)
 //       still means "sampler on this track", and the old glyph-only rule is exactly
 //       why such a drop landed nowhere.
 //   "arrange*"                      -> Arrange.
-//   ""  with no track               -> OffReaper (the pointer left REAPER).
-//   anything else, incl. "" WITH a track -> Other. Over REAPER on a surface we
-//       cannot name: refuse visibly, never guess an outcome.
+//   anything else, "" INCLUDED      -> Other. A surface we cannot name: refuse
+//       visibly, never guess an outcome. An empty token is NOT evidence the pointer
+//       left REAPER — the SDK documents no off-REAPER return at all, and the transport,
+//       toolbar, menu bar and docker chrome all report nothing REAPER names. Reading it
+//       as "off REAPER" is what handed live drags to OLE mid-gesture; whether the
+//       pointer left is a window-ownership fact, resolved in the shell.
 // The exact live token is DAW-only — confirm via
 // reaper.GetThingFromPoint(reaper.GetMousePosition()) in ReaScript if unsure.
-ui::ReaperSurface classifyReaperSurface(const std::string& info, bool haveTrack);
+ui::ReaperSurface classifyReaperSurface(const std::string& info);
 
 // The raw component-state bytes the preset carries, exposed so the round-trip
 // test can decode them back through sample_map::deserializeComponentState and

src/shell/actions/CLAUDE.md

@@ -41,8 +41,8 @@ is owned by other directories and only skinned here.
 
 - `shell/actions` (`action_registry` / `design_view_actions` / `bank_actions` / `prune_action`) — the bindable action families, all routed via the `command_id`/`gaccel`/`hookcommand` contract. `action_registry` owns the shared registration plumbing (interned channel-qualified id strings; register and mirror-unregister present the identical pointer) **and the Q-W6 registration TABLE**: `main.cpp`'s own family (capture scopes, panel toggle, insert, batch, realtime, recapture, version) is one `ActionTableRow` array — suffix, phrase, flat function-pointer handler — that registration, hookcommand dispatch, and the unload mirror-unregister all iterate, so adding an action touches the table only (OCP). Bank mutations flow through the promptless `shell/bank_ops` verbs (`bankOp*` + `persistBankOp`, taking `ReaSamplerSession&`), which the panel menus and `bank_actions` consume as thin UX skins. **Every bank index verb wraps its mutation in a batched REAPER undo point (`Undo_BeginBlock2`/`EndBlock2`, `UNDO_STATE_MISCCFG`) so one bank operation is one Ctrl-Z.** The prune action (`prune_action`, `BANK_PRUNE_FOLDER`) is **the ONLY file-deletion action in the system**; it opens no undo point (file deletion is not REAPER-undoable). `BANK_PRUNE_FOLDER` halts on `blockedByTracking` and prints each blocker that fired, with recovery instructions.
 - `package_export_action` — the "export bank as package" skin: survey and report first, confirm what is absent (and, separately, a destination being replaced), pick a destination, write. Every prompt in the flow lives here so `shell/package/export_bank` stays promptless. Read-only against the project — it holds the session by `const&`, so no ext-state write, generation bump or undo point is reachable. Registration rides `main.cpp`'s action table (`EXPORT_BANK_PACKAGE`); the panel's tab menu is the second skin over the same body.
-- `drag_out_win` — OS drag-out shell: Windows OLE `DoDragDrop`/`CF_HDROP`, copy-only (`DROPEFFECT_MOVE` not offered); macOS/Linux via `SWELL_InitiateDragDropOfFileList`.
-- `instrument_drop_win` — instrument-drop shell: `probeDropTarget` resolves a screen point to a track + a `ReaperSurface` (via the pure `wire::classifyReaperSurface`, whose token rules `core/wire/CLAUDE.md` owns), and the drop half adds a ReaSampler 9000 instance and applies the dragged capture's state via a transient `.vstpreset` + `TrackFX_SetPreset` (the former `TrackFX_SetNamedConfigParm` "vst_chunk" write was silently unappliable for VST3). Exposes `loadInstrumentOntoTrack` (inner half, no own undo block) and `performInstrumentDrop` (wraps in its own undo block). **Never captures, never writes the bank, never inserts a timeline item.**
+- `drag_out_win` — the host/OS boundary of drag-out: Windows OLE `DoDragDrop`/`CF_HDROP`, copy-only (`DROPEFFECT_MOVE` not offered); macOS/Linux via `SWELL_InitiateDragDropOfFileList`. Also owns `pointerOverHostWindow`, the window-ownership test behind `ui::DropContext::pointerOffHost` — process identity on Windows (`WindowFromPoint` + `GetWindowThreadProcessId`), non-null `WindowFromPoint` under SWELL, whose window list is already this-process-only.
+- `instrument_drop_win` — instrument-drop shell: `probeDropTarget` resolves a screen point to a track + a `ReaperSurface` (via the pure `wire::classifyReaperSurface`, whose token rules `core/wire/CLAUDE.md` owns) — it answers only what REAPER named, never whether the pointer is still in REAPER, which is `drag_out_win`'s — and the drop half adds a ReaSampler 9000 instance and applies the dragged capture's state via a transient `.vstpreset` + `TrackFX_SetPreset` (the former `TrackFX_SetNamedConfigParm` "vst_chunk" write was silently unappliable for VST3). Exposes `loadInstrumentOntoTrack` (inner half, no own undo block) and `performInstrumentDrop` (wraps in its own undo block). **Never captures, never writes the bank, never inserts a timeline item.**
 - `arrange_drop_win` — the drag-out gesture's arrange outcome: `arrangeTimeAtScreenX` (pointer column → time via `GetSet_ArrangeView2`'s one-pixel-span reading — inferred, not SDK-documented) and `performArrangeDrop` (snap the drop time, then one `InsertMedia` per capture on the pointer's track — assumed, not confirmed, to land end-to-end via REAPER's own cursor advance — in ONE undo block, counting only InsertMedia's reported successes, with the caller's track selection and edit cursor restored). The one timeline-placing shell here, per the invariant above; it never captures and never writes the bank.
 - `package_import_action` — the bindable / bank-menu / file-drop skin over `shell/package`'s `importBankPackage`. Owns the **ledger gate**, which runs BEFORE the file picker (a refusal must not cost the user a file choice) and is keyed on the session's `LedgerStatus` alone — never on `PruneReport::blockedByTracking`, whose undecodable-`rsusage_*` arm governs deletion-time protection and would refuse an import that only writes birth records. Builds and shows every message the import produces, but the ledger-refusal body itself is `core/package::ledgerRefusalMessage` — a pure fold this TU only supplies the channel-correct namespace to — so the wording is assertable without a DAW. `doImportBankPackage`/`doImportBankPackageFile` return the minted bank id on a landed import (empty otherwise) so a caller can focus it; the verb itself is promptless.
 - `ingest` — ingest-through-the-bank shell on the EXTENSION side: three surfaces — (1) arrange capture→bank→assign (bindable action), (2) Media-Explorer import→bank→instrument on the selected track, (3) file drop onto the bank panel→bank only. Only surface (1) writes the `assignment_request` ext-state wire. **ingest NEVER inserts a timeline item.** Surface (2)'s action is the one in this directory published into a NON-main action section (Media Explorer) as well as Main — two ids, one handler, two dispatch hooks; see root `CLAUDE.md` §"REAPER extension contract" for the mechanism.

src/shell/actions/drag_out_win.cpp

@@ -244,6 +244,23 @@ bool canInitiateDragOut(const std::vector<std::string>& absolutePaths) {
     return true;
 }
 
+bool pointerOverHostWindow(int screenX, int screenY) {
+    // Process identity, not window identity: REAPER's arrange, its floating FX and VST editor
+    // windows, its menus and its docker chrome are separate top-level HWNDs with no common
+    // ancestor, so no GetAncestor/GetParent walk reaches them all — but every one of them is
+    // created by the process this extension is loaded into.
+    // Mouse capture does not affect WindowFromPoint: it hit-tests the desktop window tree, not
+    // input routing. It does skip hidden and DISABLED windows, so a REAPER window disabled
+    // behind a modal dialog could fall through to whatever sits beneath — no such dialog can be
+    // up while our panel holds capture for a drag.
+    const POINT pt{screenX, screenY};
+    const HWND hwnd = WindowFromPoint(pt);
+    if (!hwnd) return false;
+    DWORD pid = 0;
+    GetWindowThreadProcessId(hwnd, &pid);
+    return pid == GetCurrentProcessId();
+}
+
 }  // namespace reasampler
 
 #else  // ---- macOS / Linux (SWELL) -----------------------------------------------------
@@ -277,6 +294,15 @@ bool canInitiateDragOut(const std::vector<std::string>& absolutePaths) {
     return !absolutePaths.empty();
 }
 
+// SWELL's WindowFromPoint walks only THIS process's window list (SWELL_topwindows on
+// generic/GDK, [NSApp orderedWindows] on macOS — swell-wnd-generic.cpp / swell-wnd.mm), so a
+// non-null return already carries the process-ownership meaning Win32 needs GetWindowThread-
+// ProcessId for, and a point over any other application returns null.
+bool pointerOverHostWindow(int screenX, int screenY) {
+    POINT pt{screenX, screenY};
+    return WindowFromPoint(pt) != nullptr;
+}
+
 }  // namespace reasampler
 
 #endif

src/shell/actions/drag_out_win.h

@@ -1,7 +1,8 @@
 #pragma once
-// drag_out_win — the OS/COM initiation half of native OS drag-out: hands a resolved
-// existing-file path list to the OS's drag-drop machinery so the user can drop bank
-// samples into Explorer / another app / another DAW. The pure gesture-boundary
+// drag_out_win — the host/OS boundary of native OS drag-out: whether the pointer has
+// crossed it, whether the OS is ready to take the drag, and the hand-off itself, which
+// gives a resolved existing-file path list to the OS's drag-drop machinery so the user can
+// drop bank samples into Explorer / another app / another DAW. The pure gesture-boundary
 // decision + path-list assembly live in drag_out.*.
 //
 // COPY-ONLY is STRUCTURAL on Windows: DoDragDrop's effect mask is DROPEFFECT_COPY
@@ -32,4 +33,12 @@ bool initiateDragOut(HWND__* panelHwnd, const std::vector<std::string>& absolute
 // probe HGLOBAL immediately; SWELL exposes no probe, so macOS/Linux reduces to the non-empty check.
 bool canInitiateDragOut(const std::vector<std::string>& absolutePaths);
 
+// True iff a window belonging to the host (REAPER) process sits under the screen point —
+// the POSITIVE proof ui::DropContext::pointerOffHost is the negation of. Every REAPER
+// surface qualifies whether or not GetThingFromPoint can name it: the arrange, a TCP, a
+// floating FX or VST editor window, the transport, the toolbar, a menu, the docker chrome
+// and our own panel are all windows of this process, because the extension runs inside it.
+// Side-effect-free; safe on every mouse-move.
+bool pointerOverHostWindow(int screenX, int screenY);
+
 } // namespace reasampler

src/shell/actions/instrument_drop_win.cpp

@@ -83,7 +83,7 @@ DropProbe probeDropTarget(int screenX, int screenY) {
     // doc-comment says so), so the track and the surface are two independent facts and both
     // are reported. The pure classifier owns every token rule.
     out.track = GetThingFromPoint(screenX, screenY, info, sizeof(info));
-    out.surface = classifyReaperSurface(info, out.track != nullptr);
+    out.surface = classifyReaperSurface(info);
     return out;
 }
 

src/shell/actions/instrument_drop_win.h

@@ -29,12 +29,14 @@ namespace reasampler {
 // (ui::decideDropClass) turns this plus the payload size into an outcome.
 struct DropProbe {
     MediaTrack* track = nullptr;  // the track under the pointer (null if none / not a track)
-    ui::ReaperSurface surface = ui::ReaperSurface::OffReaper;
+    ui::ReaperSurface surface = ui::ReaperSurface::Other;
 };
 
-// Wraps GetThingFromPoint and hands its (info string, track) pair to the pure
+// Wraps GetThingFromPoint: its track comes back as-is, its info string goes to the pure
 // wire::classifyReaperSurface. Cheap enough to run on every mouse-move, but the panel
 // evaluates it only OUTSIDE its own client rect — the internal drag never pays for it.
+// It reports only what REAPER named; whether the pointer is still inside REAPER at all is
+// drag_out_win::pointerOverHostWindow's, and no surface reported here implies an exit.
 DropProbe probeDropTarget(int screenX, int screenY);
 
 // Adds a fresh ReaSampler 9000 instance to `track` and applies `presetBytes` as its

src/shell/panel/panel_drag.cpp

@@ -199,6 +199,12 @@ LiveDrop resolveLiveDrop(int x, int y) {
         const DropProbe probe = probeDropTarget(sp.x, sp.y);
         ctx.surface = probe.surface;
         ctx.haveTrack = probe.track != nullptr;
+        // Two independent probes because they answer two independent questions: REAPER's
+        // hit-test names the surface, window ownership decides whether we are still in REAPER
+        // at all. The SDK hit-test cannot answer the second — GetThingFromPoint documents no
+        // off-REAPER return, so its silence over the transport or the toolbar used to read as
+        // "the user left" and gave the live drag away to OLE.
+        ctx.pointerOffHost = !pointerOverHostWindow(sp.x, sp.y);
         out.track = probe.track;
         out.screenX = sp.x;
     }
@@ -219,11 +225,12 @@ LiveDrop resolveLiveDrop(int x, int y) {
 // loop, so the internal drag must be fully wound down first, and only once the payload is known
 // to be hand-off-able. This runs on every qualifying move — do not memoize a failed attempt.
 //
-// Residual (accepted): once the pointer has left REAPER, dragging back INTO a REAPER window
+// Residual (accepted): once the pointer has genuinely left every REAPER window, dragging back IN
 // mid-modal-loop delivers a CF_HDROP to REAPER's own file-import drop target rather than to our
 // gesture law. NOT confirmed by experiment — inferred from REAPER's handling of external file
 // drops, and the inferred outcome (an item at the drop point) coincides with what our own
-// arrange path would have done.
+// arrange path would have done. This is now the ONLY way to see that import ghost mid-drag;
+// reaching it from a surface still inside REAPER was the defect pointerOffHost closed.
 void handOffToOs() {
     // Resolve BEFORE tearing anything down (the resolver reads the live drag payload), then let
     // the pure rule couple the two side effects: an unresolvable payload leaves the internal