Close the bridged-process hole in the drag-out hand-off gate

OsHandoff now needs the window-ownership proof AND a hit-test that named
nothing, so a bridged plugin's UI can't read as off-REAPER.

src/core/ui/CLAUDE.md

@@ -90,8 +90,12 @@ L7 sub-pass, 2026-07-27):
   REAPER entirely is the one irreversible transition, because the OS hand-off goes
   modal — so it must be PROVEN (a window-ownership test in the shell), never inferred
   from a hit-test token REAPER could not name; an unrecognised surface *inside* REAPER
-  refuses. A first-move class lock and a drag-lifetime "cannot hand off" latch both
-  existed here and were removed — do not reintroduce either.
+  refuses. That proof is necessary but NOT sufficient: a plugin bridged into
+  `reaper_host*.exe` fails the process test while still being REAPER's own UI, so the
+  hand-off additionally requires REAPER's hit-test to have named nothing — a recognised
+  token can only ever veto the hand-off, never produce one. A first-move class lock and
+  a drag-lifetime "cannot hand off" latch both existed here and were removed — do not
+  reintroduce either.
 
 ## Modules
 
@@ -99,7 +103,7 @@ L7 sub-pass, 2026-07-27):
 - `bank_grid` — REAPER-free grid layout, selection, keyboard-nav, and thumbnail-cache-key logic for the docked bank panel.
 - `tab_strip` — REAPER-free scrollable tab-strip layout + hit-test for the named-banks strip.
 - `prune_button` — pure layout/hit-test for the `bank_panel` footer Prune button.
-- `drag_out` — the pure drag-out gesture law plus path-list assembly. Owns the `ReaperSurface` vocabulary (TrackPanel / FxSurface / FxEmbed / Arrange / Other — `core/wire/instrument_drop` classifies REAPER's info token INTO it; there is deliberately no off-REAPER member, since no token can carry that fact), `decideDropClass` (surface × single-vs-multi payload → Internal / InstrumentDrop / ArrangeInsert / Refuse / OsHandoff / None), and `cueForDropClass`. `OsHandoff` is reachable ONLY through `DropContext::pointerOffHost`, a positive window-ownership proof the shell owes the law (`drag_out_win::pointerOverHostWindow`), gated ahead of the surface switch — so no reading of REAPER's hit-test can give a live drag away to OLE. **No `DropClass` means "nothing happens"**: a surface with no defined outcome for the payload resolves to `Refuse`, which the shell shows as a cursor, so "no silent no-op release" is a property of the enumeration rather than of any call site.
+- `drag_out` — the pure drag-out gesture law plus path-list assembly. Owns the `ReaperSurface` vocabulary (TrackPanel / FxSurface / FxEmbed / Arrange / Other — `core/wire/instrument_drop` classifies REAPER's info token INTO it; there is deliberately no off-REAPER member, since no token can carry that fact), `decideDropClass` (surface × single-vs-multi payload → Internal / InstrumentDrop / ArrangeInsert / Refuse / OsHandoff / None), and `cueForDropClass`. `OsHandoff` is reachable ONLY through `DropContext::pointerOffHost` — a positive window-ownership proof the shell owes the law (`drag_out_win::pointerOverHostWindow`) — AND only where REAPER's own hit-test named nothing (`Other`, no track), gated ahead of the surface switch, so neither evidence source can give a live drag away to OLE on its own. **No `DropClass` means "nothing happens"**: a surface with no defined outcome for the payload resolves to `Refuse`, which the shell shows as a cursor, so "no silent no-op release" is a property of the enumeration rather than of any call site.
 - `theme` — pure palette module: role→color mapping, REAPER-grey neutral ladder + the pastel accent system, the keyboard strip's spectral ramp, WCAG contrast-floor helpers + `compositeOver` (the effective color of a translucent fill, so alpha overlays are testable). Only the ramp's MID stop is its own constant; lo/hi are still aliases of `accent/primary`/`accent/tertiary`, so a categorical accent move CAN still reorder the ramp — `testSpectralRampLuminanceIsMonotonic` is the build-time catch, not the structure.
 - `component_geometry` — pure button/slider/list-row geometry + hover hit-test helpers.
 - `action_bar` — pure task-grouped action-bar layout/hit-test: clusters (Capture / Placement / Maintenance / Tagging / Switching).

src/core/ui/drag_out.cpp

@@ -24,10 +24,16 @@ DropClass decideDropClass(int px, int py, const PanelClientRect& client,
     if (!ctx.drag.dragging || !ctx.drag.hasArmedSamples) return DropClass::None;
     if (insideClient(px, py, client)) return DropClass::Internal;
 
-    // The hand-off gate sits AHEAD of the surface switch and is the only route to OsHandoff, so
-    // no reading of REAPER's hit-test — recognised, unrecognised, or empty — can reach the modal
-    // OLE loop while the pointer is still over a host window.
-    if (ctx.pointerOffHost) return DropClass::OsHandoff;
+    // The ONE route to OsHandoff, ahead of the surface switch, and it needs BOTH halves. The
+    // shell's ownership proof alone is not sufficient: REAPER runs a bridged plugin's UI in a
+    // separate process, so a window failing that test can still be REAPER's own UI. A recognised
+    // token therefore VETOES the hand-off instead of producing one — a veto can only move the
+    // answer toward staying inside REAPER, so pointerOffHost remains the only member whose true
+    // value can reach OLE. An off-host point REAPER DID name falls through to that surface's own
+    // outcome below: over a bridged FX window that is the instrument drop, as it is for a native
+    // one.
+    if (ctx.pointerOffHost && ctx.surface == ReaperSurface::Other && !ctx.haveTrack)
+        return DropClass::OsHandoff;
 
     switch (ctx.surface) {
         case ReaperSurface::TrackPanel:

src/core/ui/drag_out.h

@@ -6,10 +6,9 @@
 //
 // THE LAW: the class is resolved from what is under the cursor on EVERY move; every transition
 // is reversible until release or until the pointer leaves REAPER entirely; the OS hand-off is
-// reserved for leaving REAPER — which the shell must PROVE (DropContext::pointerOffHost), never
-// infer from a hit-test token it could not name — and every REAPER-internal target executes
-// natively on release. Do not reintroduce a first-move class lock or a drag-lifetime "blocked"
-// latch.
+// reserved for leaving REAPER (DropContext::pointerOffHost owns what proves that) and every
+// REAPER-internal target executes natively on release. Do not reintroduce a first-move class
+// lock or a drag-lifetime "blocked" latch.
 //
 // Path-list assembly: turns armed sample ids into the absolute path list an OS drop carries
 // (Windows CF_HDROP / macOS file-list pasteboard) — set algebra only; the shell resolves each id
@@ -34,10 +33,8 @@ struct DragState {
 };
 
 // What REAPER reports under the pointer, reduced to the surfaces the law distinguishes.
-// Produced from GetThingFromPoint's info token by wire::classifyReaperSurface. There is
-// deliberately NO off-REAPER member: this vocabulary describes what REAPER's own hit-test
-// named, and "the pointer left REAPER" is a window-ownership fact no token can carry —
-// it enters through DropContext::pointerOffHost instead.
+// Produced from GetThingFromPoint's info token by wire::classifyReaperSurface. No off-REAPER
+// member: that fact enters through DropContext::pointerOffHost, which owns the reasoning.
 enum class ReaperSurface {
     TrackPanel,  // TCP/MCP, ANY sub-element: the WHOLE panel is the instrument hotspot
     FxSurface,   // fx_* — the FX chain and floating-FX windows
@@ -68,12 +65,14 @@ struct DropContext {
     bool singlePayload = false;  // payload holds EXACTLY one capture (arms InstrumentDrop)
     ReaperSurface surface = ReaperSurface::Other;  // only read outside the client rect
     bool haveTrack = false;      // GetThingFromPoint returned a non-null MediaTrack*
-    // The ONE gate on the irreversible OS hand-off, and the only member whose true value can
-    // produce it. It is a POSITIVE proof the shell owes the law — a window-ownership test
-    // (drag_out_win::pointerOverHostWindow), not "the hit-test named nothing I recognise",
-    // which is equally true of the transport, the toolbar and the docker chrome. Defaults
-    // false so an unset context stays inside REAPER: the failure mode of forgetting to
-    // resolve it must be a refusal, never a drag given away to OLE.
+    // THE ONE HOME for the hand-off's evidence rule. This is the only member whose true value
+    // can reach the irreversible OS hand-off, and it is a POSITIVE proof the shell owes the law
+    // — a window-ownership test (drag_out_win::pointerOverHostWindow), never "the hit-test named
+    // nothing I recognise", which is equally true of the transport, the toolbar and the docker
+    // chrome; reading an unnamed token as an exit is what handed live drags to OLE mid-gesture.
+    // Defaults false so an unset context stays inside REAPER: the failure mode of forgetting to
+    // resolve it must be a refusal, never a drag given away to OLE. NECESSARY but not sufficient
+    // — decideDropClass's gate carries the second half and why it needs one.
     bool pointerOffHost = false;
 };