@agent-native/core 0.175.2-nightly-20260826150235 → 0.175.3

package/corpus/templates/clips/desktop/src-tauri/src/recording_indicator.rs

@@ -76,8 +76,10 @@ const PILL_W_EXPANDED_MEETING_LOGICAL: u32 = 480;
 /// cursor is still nowhere near it.
 const PILL_H_LOGICAL: u32 = 60;
 const PILL_H_EXPANDED_LOGICAL: u32 = 340;
-/// Bottom margin from the screen edge, logical px. Granola uses ~24.
-const PILL_BOTTOM_MARGIN_LOGICAL: u32 = 24;
+/// Bottom margin from the screen edge, logical px. 42 = the old 24px window
+/// margin + the removed 18px shadow gutter, so the default capsule keeps the
+/// exact on-screen spot it had before the native-shadow conversion.
+const PILL_BOTTOM_MARGIN_LOGICAL: u32 = 42;
 
 /// Detached / "floating" mode dimensions — anchored top-right of the primary
 /// monitor when the user focuses another app. Smaller footprint so it
@@ -88,7 +90,6 @@ const PILL_DETACHED_TOP_MARGIN_LOGICAL: u32 = 24;
 const PILL_DETACHED_RIGHT_MARGIN_LOGICAL: u32 = 24;
 /// Gap between the visible capsule and the right screen edge, logical px.
 const PILL_RIGHT_MARGIN_LOGICAL: u32 = 28;
-const OVERLAY_SHADOW_GUTTER_LOGICAL: f64 = 18.0;
 
 #[derive(Debug, Clone, Copy, Default, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
@@ -104,17 +105,11 @@ fn scale_factor(app: &AppHandle) -> f64 {
         .unwrap_or(2.0)
 }
 
-fn overlay_shadow_gutter_physical(app: &AppHandle) -> u32 {
-    (OVERLAY_SHADOW_GUTTER_LOGICAL * scale_factor(app).max(1.0)).round() as u32
-}
-
-/// Screen-edge margin for the *visible* capsule. The window is padded out with
-/// a transparent shadow gutter, so that gutter comes off the window margin —
-/// measured from the window frame the pill floats a whole gutter further from
-/// the edge than the constant says.
+/// Screen-edge margin for the visible capsule, physical px. The window is
+/// sized to the capsule exactly (native shadow, no transparent gutter), so
+/// the margin applies straight to the window frame.
 fn edge_margin_physical(app: &AppHandle, logical: u32) -> i32 {
-    let margin = (logical as f64 * scale_factor(app)) as i32;
-    (margin - overlay_shadow_gutter_physical(app) as i32).max(0)
+    (logical as f64 * scale_factor(app)) as i32
 }
 
 /// Persist the last-known pill position so the next `show` re-opens at the
@@ -259,7 +254,10 @@ fn default_center_right(app: &AppHandle, w: u32, h: u32) -> (i32, i32) {
     (x, y)
 }
 
-fn pill_content_size_physical(app: &AppHandle, expanded: bool) -> (u32, u32) {
+/// Window size (physical px). The window is sized to the visible capsule
+/// exactly — elevation is the native NSWindow shadow (see the builder's
+/// `shadow(true)`), so there is no transparent shadow gutter to add here.
+fn pill_size_physical(app: &AppHandle, expanded: bool) -> (u32, u32) {
     let scale = scale_factor(app);
     let detached = PILL_DETACHED.load(Ordering::Relaxed);
     // Detached mode ignores the `expanded` flag — the floating pill is a
@@ -284,12 +282,6 @@ fn pill_content_size_physical(app: &AppHandle, expanded: bool) -> (u32, u32) {
     (w, h)
 }
 
-fn pill_size_physical(app: &AppHandle, expanded: bool) -> (u32, u32) {
-    let (content_w, content_h) = pill_content_size_physical(app, expanded);
-    let gutter = overlay_shadow_gutter_physical(app);
-    (content_w + gutter * 2, content_h + gutter * 2)
-}
-
 /// Default top-right anchor (physical px) for detached mode.
 fn default_top_right(app: &AppHandle, w: u32, _h: u32) -> (i32, i32) {
     let top_margin = edge_margin_physical(app, PILL_DETACHED_TOP_MARGIN_LOGICAL);
@@ -441,7 +433,11 @@ pub async fn recording_pill_show(
         .always_on_top(true)
         .skip_taskbar(true)
         .resizable(false)
-        .shadow(false)
+        // Native elevation: on a transparent window macOS computes the
+        // shadow from the drawn content's alpha, so the capsule gets a
+        // correctly rounded OS shadow with the window sized to the capsule
+        // exactly — no transparent CSS-shadow apron eating clicks.
+        .shadow(true)
         .visible(false)
         .focused(false)
         .accept_first_mouse(true)
@@ -472,9 +468,8 @@ pub async fn recording_pill_show(
 
 /// True when the global cursor sits inside the pill window's frame. Cursor and
 /// frame both come from Tauri (physical px, desktop top-left origin), so the
-/// test is a plain point-in-rect with no AppKit hop. The frame is inset by the
-/// transparent shadow gutter the renderer pads out, so the polled hover state
-/// matches the capsule the user actually sees.
+/// test is a plain point-in-rect with no AppKit hop. The window is sized to
+/// the capsule exactly, so the frame IS the capsule the user actually sees.
 fn cursor_inside_pill_frame(window: &WebviewWindow) -> bool {
     let (Ok(c), Ok(p), Ok(s)) = (
         window.cursor_position(),
@@ -483,12 +478,9 @@ fn cursor_inside_pill_frame(window: &WebviewWindow) -> bool {
     ) else {
         return false;
     };
-    let gutter = overlay_shadow_gutter_physical(window.app_handle()) as i32;
-    let left = p.x + gutter;
-    let top = p.y + gutter;
-    let right = p.x + s.width as i32 - gutter;
-    let bottom = p.y + s.height as i32 - gutter;
-    c.x >= left as f64 && c.x <= right as f64 && c.y >= top as f64 && c.y <= bottom as f64
+    let right = p.x + s.width as i32;
+    let bottom = p.y + s.height as i32;
+    c.x >= p.x as f64 && c.x <= right as f64 && c.y >= p.y as f64 && c.y <= bottom as f64
 }
 
 /// Start polling the cursor against the pill frame and emitting

package/corpus/templates/clips/desktop/src-tauri/src/rewind_clip.rs

@@ -119,6 +119,11 @@ pub(crate) fn rewind_clip_prepare(
     if state.0.lock().map_err(|error| error.to_string())?.is_some() {
         return Err("a Rewind-derived clip is already prepared or active".into());
     }
+    // The completion slot is take-once but never expires, and the recording
+    // pill drains it whenever a completion card opens. The native start path
+    // clears it per session; this one has to as well, or a Rewind take's card
+    // can consume the previous recording's result and show its URL.
+    native_screen::reset_native_upload_completion_state();
     let temporary_audio = if include_mic || include_system_audio {
         screen_memory::acquire_temporary_audio_consumer(
             &app,

package/corpus/templates/clips/desktop/src-tauri/src/screen_memory.rs

@@ -1130,24 +1130,83 @@ pub(crate) fn release_temporary_audio_consumer(
     };
     end_graph_lease(app, &consumer.graph_lease_id);
 
-    let config = normalize_screen_memory_config(crate::config::feature_config(app).screen_memory);
-    if !config.enabled || config.paused {
-        return Ok(());
-    }
-    let desired = effective_capture_mode(app, config.capture_mode);
-    let needs_restore = state
-        .inner
-        .lock()
-        .map_err(|error| error.to_string())?
-        .active
-        .as_ref()
-        .is_some_and(|active| active.capture_mode != desired);
-    if needs_restore {
-        rotate_segment_inner(app, &config)?;
+    // Restoring the configured capture mode is a full producer stop/start
+    // (the SCK source contract changed) that measures ~2s. Never charge that
+    // to the releasing caller — a clip cancel must return immediately — and
+    // give re-demand a grace window: a cancel-then-retake re-acquires the
+    // same audio sources within a couple of seconds, which turns the pending
+    // restore into a no-op instead of two stop/start cycles.
+    if capture_mode_restore_needed(app) {
+        schedule_capture_mode_restore(app.clone());
     }
     Ok(())
 }
 
+/// How long released audio demand may keep the producer in its upgraded mode
+/// before the configured capture mode is restored. Long enough that a rapid
+/// cancel→retake reattaches to the still-running audio producer for free;
+/// short enough that the microphone stops being captured promptly after the
+/// last consumer lets go.
+const CAPTURE_MODE_RESTORE_GRACE: Duration = Duration::from_secs(5);
+
+fn schedule_capture_mode_restore(app: AppHandle) {
+    std::thread::spawn(move || {
+        std::thread::sleep(CAPTURE_MODE_RESTORE_GRACE);
+        let state = app.state::<ScreenMemoryState>();
+        let _transition = match state.transition.lock() {
+            Ok(guard) => guard,
+            Err(error) => {
+                record_error(&app, error.to_string());
+                return;
+            }
+        };
+        // Re-evaluate under the transition lock: new audio demand, a config
+        // change, or a producer stop during the grace all make this a no-op,
+        // so overlapping schedules can never double-reconfigure the producer.
+        if !capture_mode_restore_needed(&app) {
+            return;
+        }
+        let config =
+            normalize_screen_memory_config(crate::config::feature_config(&app).screen_memory);
+        if let Err(error) = rotate_segment_inner(&app, &config) {
+            record_error(&app, error);
+        }
+    });
+}
+
+fn capture_mode_restore_needed(app: &AppHandle) -> bool {
+    let config = normalize_screen_memory_config(crate::config::feature_config(app).screen_memory);
+    let state = app.state::<ScreenMemoryState>();
+    let Ok(runtime) = state.inner.lock() else {
+        return false;
+    };
+    capture_mode_restore_decision(
+        config.enabled,
+        config.paused,
+        runtime.active.as_ref().map(|active| active.capture_mode),
+        config.capture_mode,
+        runtime.temporary_audio_consumers.len(),
+    )
+}
+
+/// True only while the producer is running in a capture mode the current
+/// demand (persisted config plus live temporary-audio consumers) no longer
+/// asks for. Disabled/paused configs are owned by `sync_from_config`'s stop
+/// path, and a stopped producer has nothing to restore.
+fn capture_mode_restore_decision(
+    enabled: bool,
+    paused: bool,
+    active_mode: Option<RewindCaptureMode>,
+    base_mode: RewindCaptureMode,
+    temporary_audio_consumers: usize,
+) -> bool {
+    if !enabled || paused {
+        return false;
+    }
+    let desired = effective_mode(base_mode, temporary_audio_consumers);
+    active_mode.is_some_and(|mode| mode != desired)
+}
+
 fn rollback_temporary_audio_consumer(app: &AppHandle, owner_id: &str) {
     let consumer = app
         .state::<ScreenMemoryState>()
@@ -3782,6 +3841,67 @@ command = "keep"
         ));
     }
 
+    #[test]
+    fn deferred_capture_mode_restore_fires_only_for_a_stale_upgraded_producer() {
+        // The clip's audio demand is gone and the producer still runs
+        // upgraded: restore.
+        assert!(capture_mode_restore_decision(
+            true,
+            false,
+            Some(RewindCaptureMode::VisualsAudio),
+            RewindCaptureMode::Visuals,
+            0
+        ));
+        // A retake (or a meeting) re-demanded audio during the grace window:
+        // the pending restore must become a no-op, not a downgrade under a
+        // live consumer.
+        assert!(!capture_mode_restore_decision(
+            true,
+            false,
+            Some(RewindCaptureMode::VisualsAudio),
+            RewindCaptureMode::Visuals,
+            1
+        ));
+        // Producer already back at (or configured for) the desired mode.
+        assert!(!capture_mode_restore_decision(
+            true,
+            false,
+            Some(RewindCaptureMode::Visuals),
+            RewindCaptureMode::Visuals,
+            0
+        ));
+        assert!(!capture_mode_restore_decision(
+            true,
+            false,
+            Some(RewindCaptureMode::VisualsAudio),
+            RewindCaptureMode::VisualsAudio,
+            0
+        ));
+        // Producer stopped during the grace window: nothing to restore.
+        assert!(!capture_mode_restore_decision(
+            true,
+            false,
+            None,
+            RewindCaptureMode::Visuals,
+            0
+        ));
+        // Disabled/paused teardown is owned by sync_from_config's stop path.
+        assert!(!capture_mode_restore_decision(
+            false,
+            false,
+            Some(RewindCaptureMode::VisualsAudio),
+            RewindCaptureMode::Visuals,
+            0
+        ));
+        assert!(!capture_mode_restore_decision(
+            true,
+            true,
+            Some(RewindCaptureMode::VisualsAudio),
+            RewindCaptureMode::Visuals,
+            0
+        ));
+    }
+
     #[test]
     fn terminal_handoffs_do_not_retain_agent_reason_text() {
         let mut object = serde_json::json!({

package/corpus/templates/clips/desktop/src-tauri/src/tray.rs

@@ -11,6 +11,162 @@ use crate::tray_meetings::{build_meetings_section, handle_meeting_menu_click, Me
 use crate::util::{is_meeting_active, is_recording_active};
 use crate::TRAY_PNG;
 
+/// A rounded stop square rendered at the same pixel size as the normal tray
+/// icon, used as the menu-bar icon while a recording is live (CleanShot's
+/// pattern: the status item becomes stop + elapsed time, and clicking it
+/// stops the recording). Template-style: black with alpha, so macOS tints it
+/// for menu-bar appearance.
+fn stop_square_icon(w: u32, h: u32) -> tauri::image::Image<'static> {
+    let mut rgba = vec![0u8; (w * h * 4) as usize];
+    let side = ((w.min(h) as f32) * 0.62).round() as i32;
+    let x0 = (w as i32 - side) / 2;
+    let y0 = (h as i32 - side) / 2;
+    let radius = (side as f32 * 0.28).max(1.0);
+    let inside_rounded = |x: i32, y: i32| -> bool {
+        if x < x0 || y < y0 || x >= x0 + side || y >= y0 + side {
+            return false;
+        }
+        let rx = radius as i32;
+        let corners = [
+            (x0 + rx, y0 + rx),
+            (x0 + side - 1 - rx, y0 + rx),
+            (x0 + rx, y0 + side - 1 - rx),
+            (x0 + side - 1 - rx, y0 + side - 1 - rx),
+        ];
+        for (cx, cy) in corners {
+            let in_corner_box =
+                (x < x0 + rx || x > x0 + side - 1 - rx) && (y < y0 + rx || y > y0 + side - 1 - rx);
+            if in_corner_box {
+                let dx = (x - cx) as f32;
+                let dy = (y - cy) as f32;
+                let near = (x - cx).abs() <= rx && (y - cy).abs() <= rx;
+                if near {
+                    return dx * dx + dy * dy <= radius * radius;
+                }
+            }
+        }
+        true
+    };
+    for y in 0..h as i32 {
+        for x in 0..w as i32 {
+            if inside_rounded(x, y) {
+                let idx = ((y as u32 * w + x as u32) * 4) as usize;
+                rgba[idx + 3] = 255;
+            }
+        }
+    }
+    tauri::image::Image::new_owned(rgba, w, h)
+}
+
+/// Whether the status item is in recording mode (stop square + timer).
+/// Written ONLY by `tray_recording_status` — the pill is the single owner of
+/// this state — plus the window-destroyed backstop in lib.rs.
+static TRAY_RECORDING: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+/// Millis timestamp of the last recording-mode write. The pill refreshes the
+/// title every 500ms while live, so 2.5s of silence means the writer is gone
+/// and the dead-man loop below clears the status item — a stale menu-bar
+/// timer is structurally impossible, not just handled per code path.
+static TRAY_LAST_WRITE_MS: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+/// Icon image last applied to the status item: unset, app logo, or stop
+/// square. Tracked separately from `TRAY_RECORDING` because it records what
+/// the status item actually accepted, not what was requested.
+const TRAY_ICON_MODE_UNSET: i8 = -1;
+static TRAY_ICON_MODE: std::sync::atomic::AtomicI8 =
+    std::sync::atomic::AtomicI8::new(TRAY_ICON_MODE_UNSET);
+
+fn tray_icon_mode(stored: i8) -> Option<bool> {
+    if stored == TRAY_ICON_MODE_UNSET {
+        None
+    } else {
+        Some(stored != 0)
+    }
+}
+
+/// Whether the status item's icon image has to be re-uploaded.
+///
+/// `set_icon` replaces the NSStatusItem's image, and the pill refreshes the
+/// title four times a second to tick the timer. Re-uploading the same image at
+/// that cadence makes the menu-bar icon visibly flash, so the image is written
+/// only on the first write and on an actual mode flip. The title still goes
+/// out every call — it is the part that genuinely changes.
+fn tray_icon_needs_write(previous: Option<bool>, next: bool) -> bool {
+    previous != Some(next)
+}
+
+fn now_ms() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0)
+}
+
+pub fn tray_recording_active() -> bool {
+    TRAY_RECORDING.load(std::sync::atomic::Ordering::SeqCst)
+}
+
+fn apply_tray_mode(app: &tauri::AppHandle, active: bool, title: Option<String>) {
+    TRAY_RECORDING.store(active, std::sync::atomic::Ordering::SeqCst);
+    TRAY_LAST_WRITE_MS.store(now_ms(), std::sync::atomic::Ordering::SeqCst);
+    let Some(tray) = app.tray_by_id("main") else {
+        return;
+    };
+    let applied_icon_mode =
+        tray_icon_mode(TRAY_ICON_MODE.load(std::sync::atomic::Ordering::SeqCst));
+    if tray_icon_needs_write(applied_icon_mode, active) {
+        if let Ok(base) = tauri::image::Image::from_bytes(TRAY_PNG) {
+            let icon = if active {
+                stop_square_icon(base.width(), base.height())
+            } else {
+                base
+            };
+            // Recorded only once the status item accepts the image: a failed
+            // write must stay pending so the next call retries it, not look
+            // like the mode is already on screen.
+            match tray.set_icon(Some(icon)) {
+                Ok(()) => {
+                    let _ = tray.set_icon_as_template(true);
+                    TRAY_ICON_MODE.store(i8::from(active), std::sync::atomic::Ordering::SeqCst);
+                }
+                Err(err) => eprintln!("[clips-tray] status item icon update failed: {err}"),
+            }
+        }
+    }
+    // ALWAYS Some(...): tray-icon's macOS set_title is a silent no-op for
+    // None (its Some-only branch never clears the NSStatusItem text), so a
+    // reset must pass an empty string or the stale timer sticks forever.
+    #[cfg(target_os = "macos")]
+    let _ = tray.set_title(Some(if active {
+        title.unwrap_or_default()
+    } else {
+        String::new()
+    }));
+    #[cfg(not(target_os = "macos"))]
+    let _ = title;
+}
+
+/// Single writer for the status item's recording mode: the pill invokes this
+/// with `active` mirroring its own visibility (capture live, not the
+/// completion card) and a preformatted timer title. Everything the menu bar
+/// shows about recording flows through here — no inference from recorder
+/// events on the Rust side.
+#[tauri::command]
+pub async fn tray_recording_status(
+    app: tauri::AppHandle,
+    active: bool,
+    title: Option<String>,
+) -> Result<(), String> {
+    apply_tray_mode(&app, active, title);
+    Ok(())
+}
+
+/// Backstop for the one failure the pill cannot report: its window dying
+/// while the tray still shows recording mode.
+pub fn reset_tray_recording(app: &tauri::AppHandle) {
+    if tray_recording_active() {
+        apply_tray_mode(app, false, None);
+    }
+}
+
 fn physical_tray_rect(rect: tauri::Rect) -> (i32, i32, i32, i32) {
     let (x, y) = match rect.position {
         tauri::Position::Physical(position) => (position.x, position.y),
@@ -306,10 +462,20 @@ pub fn build_tray(app: &tauri::App) -> Result<(), Box<dyn std::error::Error>> {
                     active,
                     meeting_active
                 );
-                if active && !meeting_active {
-                    // Opening Clips must never double as an implicit Stop.
-                    // Keep the recording alive and restore the parked popover;
-                    // its active-recording view exposes an explicit Stop button.
+                if tray_recording_active() && !meeting_active {
+                    // The status item IS the stop button while recording — it
+                    // shows a stop square and the elapsed time, so the click
+                    // is an explicit Stop, not an implicit one. Route through
+                    // the pill so its finishing hold and completion card run;
+                    // if the pill window is somehow gone, stop directly.
+                    if app.get_webview_window("toolbar").is_some() {
+                        let _ = app.emit("clips:tray-stop-request", ());
+                    } else {
+                        let _ = app.emit("clips:recorder-stop", ());
+                    }
+                } else if active && !meeting_active {
+                    // Recording session exists but capture isn't live (setup,
+                    // countdown, finishing) — restore the parked popover.
                     force_show_popover(app);
                 } else {
                     toggle_popover(app);
@@ -326,6 +492,21 @@ pub fn build_tray(app: &tauri::App) -> Result<(), Box<dyn std::error::Error>> {
     // resource table. `set_menu` is atomic — replacing the entire menu
     // is the documented Tauri 2 way to update a tray (there's no
     // partial-update API for items).
+    // Dead-man switch for recording mode: see TRAY_LAST_WRITE_MS.
+    let deadman_handle = app.handle().clone();
+    tauri::async_runtime::spawn(async move {
+        loop {
+            tokio::time::sleep(std::time::Duration::from_millis(1000)).await;
+            if tray_recording_active()
+                && now_ms()
+                    .saturating_sub(TRAY_LAST_WRITE_MS.load(std::sync::atomic::Ordering::SeqCst))
+                    > 2_500
+            {
+                apply_tray_mode(&deadman_handle, false, None);
+            }
+        }
+    });
+
     let app_handle = app.handle().clone();
     app.handle().listen("meetings:updated", move |event| {
         #[derive(serde::Deserialize)]
@@ -352,3 +533,51 @@ pub fn build_tray(app: &tauri::App) -> Result<(), Box<dyn std::error::Error>> {
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{tray_icon_mode, tray_icon_needs_write, TRAY_ICON_MODE_UNSET};
+
+    #[test]
+    fn writes_the_icon_on_the_first_call() {
+        assert!(tray_icon_needs_write(None, false));
+        assert!(tray_icon_needs_write(None, true));
+    }
+
+    #[test]
+    fn skips_the_icon_when_the_mode_is_unchanged() {
+        // The pill re-invokes the status update four times a second to tick
+        // the timer; re-uploading the same image at that rate is the flash.
+        assert!(!tray_icon_needs_write(Some(true), true));
+        assert!(!tray_icon_needs_write(Some(false), false));
+    }
+
+    #[test]
+    fn writes_the_icon_on_a_mode_flip_in_either_direction() {
+        assert!(tray_icon_needs_write(Some(false), true));
+        assert!(tray_icon_needs_write(Some(true), false));
+    }
+
+    #[test]
+    fn ten_seconds_of_ticking_writes_the_icon_once() {
+        // The reported flash: the pill invokes the status update every 250ms
+        // to tick the timer, and every one of those used to re-upload the
+        // image. Ten seconds of recording is one icon write, not forty-one.
+        let mut applied: Option<bool> = None;
+        let mut writes = 0;
+        for _ in 0..41 {
+            if tray_icon_needs_write(applied, true) {
+                writes += 1;
+                applied = Some(true);
+            }
+        }
+        assert_eq!(writes, 1);
+    }
+
+    #[test]
+    fn reads_an_unset_mode_as_never_written() {
+        assert_eq!(tray_icon_mode(TRAY_ICON_MODE_UNSET), None);
+        assert_eq!(tray_icon_mode(0), Some(false));
+        assert_eq!(tray_icon_mode(1), Some(true));
+    }
+}

package/corpus/templates/clips/desktop/src-tauri/src/util.rs

@@ -13,7 +13,6 @@ use crate::state::{
     VoiceWakePopover,
 };
 
-const POPOVER_SHADOW_GUTTER_LOGICAL: f64 = 24.0;
 static OAUTH_WINDOW_COUNTER: AtomicU64 = AtomicU64::new(0);
 const POPOVER_DEFAULT_WIDTH_LOGICAL: f64 = 320.0;
 const POPOVER_DEFAULT_HEIGHT_LOGICAL: f64 = 520.0;
@@ -110,13 +109,17 @@ pub fn set_capture_included(window: &WebviewWindow) {
 }
 
 pub fn build_popover_window(app: &mut tauri::App) -> Result<WebviewWindow, tauri::Error> {
-    let gutter = POPOVER_SHADOW_GUTTER_LOGICAL * 2.0;
     let app_handle = app.handle().clone();
+    // The window is sized to the visible panel EXACTLY — elevation comes from
+    // the native NSWindow shadow (shadow(true) below), which macOS derives
+    // from the drawn rounded panel's alpha. A transparent CSS-shadow apron is
+    // never used here: its invisible margin eats clicks and reads as dead
+    // space around the UI.
     WebviewWindowBuilder::new(app, "popover", WebviewUrl::App("index.html".into()))
         .title("Clips")
         .inner_size(
-            POPOVER_DEFAULT_WIDTH_LOGICAL + gutter,
-            POPOVER_DEFAULT_HEIGHT_LOGICAL + gutter,
+            POPOVER_DEFAULT_WIDTH_LOGICAL,
+            POPOVER_DEFAULT_HEIGHT_LOGICAL,
         )
         .position(2.0, 2.0)
         .resizable(false)
@@ -127,7 +130,7 @@ pub fn build_popover_window(app: &mut tauri::App) -> Result<WebviewWindow, tauri
         .skip_taskbar(true)
         .visible(false)
         .focused(true)
-        .shadow(false)
+        .shadow(true)
         .accept_first_mouse(true)
         // Tauri does not create a native child for window.open by default.
         // Create it here with the opener's webview configuration so Google

package/corpus/templates/design/.generated/bridge/editor-chrome.generated.ts

@@ -4210,7 +4210,7 @@ export const editorChromeBridgeScript: string = `"use strict";
       return null;
     }
     function stopNativeInteraction(e) {
-      e.preventDefault();
+      if (e.cancelable) e.preventDefault();
       e.stopPropagation();
       if (e.stopImmediatePropagation) e.stopImmediatePropagation();
     }

package/corpus/templates/design/.generated/bridge/embedded-wheel.generated.ts

@@ -51,7 +51,7 @@ export const embeddedWheelBridgeScript: string = `"use strict";
       return number;
     }
     function stopNativeInteraction(e) {
-      e.preventDefault();
+      if (e.cancelable) e.preventDefault();
       e.stopPropagation();
       if (e.stopImmediatePropagation) e.stopImmediatePropagation();
     }
@@ -72,7 +72,8 @@ export const embeddedWheelBridgeScript: string = `"use strict";
       }
     }
     function onWheel(e) {
-      if (!wheelEnabled) return;
+      var zoomIntent = !!(e.ctrlKey || e.metaKey);
+      if (!wheelEnabled && !zoomIntent) return;
       stopNativeInteraction(e);
       postToParent({
         type: "embedded-canvas-wheel",

package/corpus/templates/design/.generated/bridge/zoom.generated.ts

@@ -9,14 +9,20 @@ export const zoomBridgeScript: string = `"use strict";
     var target = document.documentElement || document.body || document;
     function onWheel(e) {
       if (!(e.ctrlKey || e.metaKey)) return;
-      e.preventDefault();
+      if (e.cancelable) e.preventDefault();
       try {
         window.parent.postMessage(
           {
             type: "pinch-zoom-wheel",
             deltaY: e.deltaY,
             clientX: e.clientX,
-            clientY: e.clientY
+            clientY: e.clientY,
+            // The parent classifies and scales from these three. Dropping the
+            // modifiers puts every pinch on the notch curve; dropping the mode
+            // makes a Firefox line tick read as 3px of travel.
+            deltaMode: e.deltaMode,
+            ctrlKey: !!e.ctrlKey,
+            metaKey: !!e.metaKey
           },
           "*"
         );