Ψ-W1-T4 remediation: gate silent arrange drops, pin surface totality, hedge unverified SDK claims, close comment/exception-safety minors

src/core/ui/drag_out.cpp

@@ -15,6 +15,10 @@ bool insideClient(int px, int py, const PanelClientRect& c) {
 
 } // namespace
 
+bool needsSurfaceProbe(int px, int py, const PanelClientRect& client) {
+    return !insideClient(px, py, client);
+}
+
 DropClass decideDropClass(int px, int py, const PanelClientRect& client,
                           const DropContext& ctx) {
     if (!ctx.drag.dragging || !ctx.drag.hasArmedSamples) return DropClass::None;

src/core/ui/drag_out.h

@@ -40,6 +40,9 @@ enum class ReaperSurface {
     FxEmbed,     // tcp.fxembed / mcp.fxembed — an instance already draws there
     Arrange,     // the timeline
     Other,       // ruler, transport, spacers, docker chrome, unknown future tokens
+    Count,       // sentinel, NOT a real surface — tests/test_drag_out.cpp's kAllSurfaces is
+                 // pinned against this via static_assert so a 7th surface can't silently skip
+                 // the exhaustiveness matrix
 };
 
 // The resolved target class. Every value is a DEFINED outcome the shell executes or visibly
@@ -67,6 +70,11 @@ struct DropContext {
 // so re-entry into the client always returns Internal and a surface transition always reverses.
 DropClass decideDropClass(int px, int py, const PanelClientRect& client, const DropContext& ctx);
 
+// True outside the panel client rect — the same half-open test decideDropClass gates the SDK
+// hit-test on. Exported so the shell reads this one pure predicate instead of reimplementing the
+// inside-client math inline (core/ui/CLAUDE.md forbids hit-test geometry living in shell code).
+bool needsSurfaceProbe(int px, int py, const PanelClientRect& client);
+
 // The pointer cue for a class, so "will this work" is visible BEFORE release. Internal defers
 // to card_drag's own cue; OsOwned means the OS drag loop draws the cursor and we must not fight
 // it.