Fix drag-out giving live drags to OLE: prove the pointer left REAPER

OffReaper leaves the surface vocabulary; OsHandoff now gates on a window-ownership
proof resolved in the shell, so no in-REAPER surface can reach DoDragDrop.

src/shell/actions/drag_out_win.h

@@ -1,7 +1,8 @@
 #pragma once
-// drag_out_win — the OS/COM initiation half of native OS drag-out: hands a resolved
-// existing-file path list to the OS's drag-drop machinery so the user can drop bank
-// samples into Explorer / another app / another DAW. The pure gesture-boundary
+// drag_out_win — the host/OS boundary of native OS drag-out: whether the pointer has
+// crossed it, whether the OS is ready to take the drag, and the hand-off itself, which
+// gives a resolved existing-file path list to the OS's drag-drop machinery so the user can
+// drop bank samples into Explorer / another app / another DAW. The pure gesture-boundary
 // decision + path-list assembly live in drag_out.*.
 //
 // COPY-ONLY is STRUCTURAL on Windows: DoDragDrop's effect mask is DROPEFFECT_COPY
@@ -32,4 +33,12 @@ bool initiateDragOut(HWND__* panelHwnd, const std::vector<std::string>& absolute
 // probe HGLOBAL immediately; SWELL exposes no probe, so macOS/Linux reduces to the non-empty check.
 bool canInitiateDragOut(const std::vector<std::string>& absolutePaths);
 
+// True iff a window belonging to the host (REAPER) process sits under the screen point —
+// the POSITIVE proof ui::DropContext::pointerOffHost is the negation of. Every REAPER
+// surface qualifies whether or not GetThingFromPoint can name it: the arrange, a TCP, a
+// floating FX or VST editor window, the transport, the toolbar, a menu, the docker chrome
+// and our own panel are all windows of this process, because the extension runs inside it.
+// Side-effect-free; safe on every mouse-move.
+bool pointerOverHostWindow(int screenX, int screenY);
+
 } // namespace reasampler