sh3-core 0.19.1 → 0.19.5

package/dist/chrome/FloatsSheet.svelte.test.js

@@ -0,0 +1,155 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { tick } from 'svelte';
+import { renderWithShell } from '../__test__/render';
+import { resetFramework } from '../__test__/reset';
+import { __resetLayoutStoreForTest, layoutStore, } from '../layout/store.svelte';
+import { compactRootStore, __resetCompactRootStoreForTest, } from '../layout/compact/rootStore.svelte';
+import FloatsSheet from './FloatsSheet.svelte';
+function makeFloat(id, title) {
+    return {
+        id,
+        content: {
+            type: 'tabs',
+            tabs: [{ slotId: `s-${id}`, viewId: 'v', label: title }],
+            activeTab: 0,
+        },
+        position: { x: 0, y: 0 },
+        size: { w: 200, h: 200 },
+        title,
+    };
+}
+describe('FloatsSheet', () => {
+    beforeEach(() => {
+        resetFramework();
+        __resetCompactRootStoreForTest();
+        __resetLayoutStoreForTest();
+    });
+    afterEach(() => {
+        document.body.innerHTML = '';
+    });
+    it('renders the active-layout row even when no floats exist', async () => {
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { },
+        });
+        await tick();
+        const rows = container.querySelectorAll('[data-sh3-floats-row]');
+        expect(rows.length).toBe(1);
+        expect(rows[0].getAttribute('data-sh3-floats-row')).toBe('docked');
+    });
+    it('lists one row per non-dismissable float, excluding pickers', async () => {
+        layoutStore.tree.floats.push(makeFloat('f-1', 'Notes'));
+        layoutStore.tree.floats.push(makeFloat('f-2', 'Editor'));
+        layoutStore.tree.floats.push(Object.assign(Object.assign({}, makeFloat('f-3', 'Picker')), { dismissable: true }));
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { },
+        });
+        await tick();
+        const rows = container.querySelectorAll('[data-sh3-floats-row]');
+        expect(rows.length).toBe(3); // docked + 2 non-dismissable
+        const ids = Array.from(rows).map((r) => r.getAttribute('data-sh3-floats-row'));
+        expect(ids).toEqual(['docked', 'f-1', 'f-2']);
+    });
+    it('tapping a float row sets compactRootStore + calls onClose', async () => {
+        layoutStore.tree.floats.push(makeFloat('f-9', 'Notes'));
+        let closed = false;
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { closed = true; },
+        });
+        await tick();
+        const row = container.querySelector('[data-sh3-floats-row="f-9"]');
+        row.click();
+        expect(compactRootStore.current).toEqual({ kind: 'float', floatId: 'f-9' });
+        expect(closed).toBe(true);
+    });
+    it('tapping the docked row resets compactRootStore + calls onClose', async () => {
+        layoutStore.tree.floats.push(makeFloat('f-10', 'Notes'));
+        compactRootStore.setRoot({ kind: 'float', floatId: 'f-10' });
+        let closed = false;
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { closed = true; },
+        });
+        await tick();
+        const row = container.querySelector('[data-sh3-floats-row="docked"]');
+        row.click();
+        expect(compactRootStore.current).toEqual({ kind: 'docked' });
+        expect(closed).toBe(true);
+    });
+    it('marks the current row with data-current="true"', async () => {
+        layoutStore.tree.floats.push(makeFloat('f-11', 'Notes'));
+        compactRootStore.setRoot({ kind: 'float', floatId: 'f-11' });
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { },
+        });
+        await tick();
+        const cur = container.querySelector('[data-current="true"]');
+        expect(cur === null || cur === void 0 ? void 0 : cur.getAttribute('data-sh3-floats-row')).toBe('f-11');
+    });
+});
+import { floatManager, bindFloatStore, __resetFloatManagerForTest, } from '../overlays/float';
+function fakePointer(type, x, y, id = 1) {
+    const ev = new Event(type, { bubbles: true, cancelable: true });
+    Object.assign(ev, { pointerId: id, clientX: x, clientY: y, pointerType: 'touch', button: 0 });
+    return ev;
+}
+describe('FloatsSheet — swipe to close', () => {
+    beforeEach(() => {
+        resetFramework();
+        __resetCompactRootStoreForTest();
+        __resetLayoutStoreForTest();
+        __resetFloatManagerForTest();
+        bindFloatStore(layoutStore.floats, () => ({ w: 360, h: 740 }));
+    });
+    afterEach(() => {
+        document.body.innerHTML = '';
+    });
+    it('swiping a float row past 40% width closes that float', async () => {
+        const id = floatManager.open('test:view', { title: 'Notes' });
+        expect(layoutStore.floats.find((f) => f.id === id)).toBeTruthy();
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { },
+        });
+        await tick();
+        const row = container.querySelector(`[data-sh3-floats-row="${id}"]`);
+        Object.defineProperty(row, 'clientWidth', { configurable: true, value: 360 });
+        row.dispatchEvent(fakePointer('pointerdown', 10, 10, 1));
+        document.dispatchEvent(fakePointer('pointermove', 200, 10, 1));
+        document.dispatchEvent(fakePointer('pointerup', 200, 10, 1));
+        await tick();
+        expect(layoutStore.floats.find((f) => f.id === id)).toBeUndefined();
+    });
+    it('does not let the docked row be swiped (no throw, no state change)', async () => {
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { },
+        });
+        await tick();
+        const row = container.querySelector('[data-sh3-floats-row="docked"]');
+        Object.defineProperty(row, 'clientWidth', { configurable: true, value: 360 });
+        row.dispatchEvent(fakePointer('pointerdown', 10, 10, 2));
+        document.dispatchEvent(fakePointer('pointermove', 300, 10, 2));
+        document.dispatchEvent(fakePointer('pointerup', 300, 10, 2));
+        await tick();
+        expect(compactRootStore.current).toEqual({ kind: 'docked' });
+    });
+    it('swiping less than 40% width does not close', async () => {
+        const id = floatManager.open('test:view', { title: 'Notes' });
+        const { container } = renderWithShell(FloatsSheet, {
+            open: true,
+            onClose: () => { },
+        });
+        await tick();
+        const row = container.querySelector(`[data-sh3-floats-row="${id}"]`);
+        Object.defineProperty(row, 'clientWidth', { configurable: true, value: 360 });
+        row.dispatchEvent(fakePointer('pointerdown', 10, 10, 3));
+        document.dispatchEvent(fakePointer('pointermove', 50, 10, 3));
+        document.dispatchEvent(fakePointer('pointerup', 50, 10, 3));
+        await tick();
+        expect(layoutStore.floats.find((f) => f.id === id)).toBeTruthy();
+    });
+});

package/dist/env/client.d.ts

@@ -2,10 +2,7 @@
  * Env state client — fetches and updates per-shard environment state
  * from the server.
  */
-/** Configure the server URL for env state operations. */
-export declare function __setEnvServerUrl(url: string): void;
-/** Return the configured server URL. */
-export declare function getEnvServerUrl(): string;
+export { getEnvServerUrl, __setEnvServerUrl } from './serverUrl';
 /**
  * Fetch env state for a shard from the server.
  * Returns an empty object if the server has no stored state.
@@ -24,6 +21,10 @@ export interface ServerInstallResult {
     missing?: Array<{
         id: string;
     }>;
+    warnings?: Array<{
+        level: 'warn';
+        message: string;
+    }>;
 }
 /**
  * Install a package on the server via multipart upload.

package/dist/env/client.js

@@ -4,22 +4,14 @@
  */
 import { getAuthHeader, isAdmin } from '../auth/index';
 import { apiFetch } from '../transport/apiFetch';
-/** Server base URL, set once during configuration. */
-let serverUrl = '';
-/** Configure the server URL for env state operations. */
-export function __setEnvServerUrl(url) {
-    serverUrl = url;
-}
-/** Return the configured server URL. */
-export function getEnvServerUrl() {
-    return serverUrl;
-}
+import { getEnvServerUrl } from './serverUrl';
+export { getEnvServerUrl, __setEnvServerUrl } from './serverUrl';
 /**
  * Fetch env state for a shard from the server.
  * Returns an empty object if the server has no stored state.
  */
 export async function fetchEnvState(shardId) {
-    const res = await apiFetch(`${serverUrl}/api/env-state/${encodeURIComponent(shardId)}`, {
+    const res = await apiFetch(`${getEnvServerUrl()}/api/env-state/${encodeURIComponent(shardId)}`, {
         credentials: 'omit',
     });
     if (!res.ok) {
@@ -41,7 +33,7 @@ export async function putEnvState(shardId, state) {
     const headers = { 'Content-Type': 'application/json' };
     if (auth)
         headers['Authorization'] = auth;
-    const res = await apiFetch(`${serverUrl}/api/env-state/${encodeURIComponent(shardId)}`, {
+    const res = await apiFetch(`${getEnvServerUrl()}/api/env-state/${encodeURIComponent(shardId)}`, {
         method: 'PUT',
         headers,
         body: JSON.stringify(state),
@@ -65,6 +57,7 @@ export async function putEnvState(shardId, state) {
  *   back server-side.
  */
 export async function serverInstallPackage(manifest, clientBundle, serverBundle) {
+    var _a;
     if (!isAdmin())
         throw new Error('Cannot install: not elevated to admin');
     const auth = getAuthHeader();
@@ -77,7 +70,7 @@ export async function serverInstallPackage(manifest, clientBundle, serverBundle)
     const headers = {};
     if (auth)
         headers['Authorization'] = auth;
-    const res = await apiFetch(`${serverUrl}/api/packages/install`, {
+    const res = await apiFetch(`${getEnvServerUrl()}/api/packages/install`, {
         method: 'POST',
         headers,
         body: form,
@@ -88,7 +81,7 @@ export async function serverInstallPackage(manifest, clientBundle, serverBundle)
         try {
             body = await res.json();
         }
-        catch ( /* non-JSON */_a) { /* non-JSON */ }
+        catch ( /* non-JSON */_b) { /* non-JSON */ }
         return {
             ok: false,
             error: typeof body.error === 'string' ? body.error : `HTTP ${res.status}`,
@@ -96,7 +89,8 @@ export async function serverInstallPackage(manifest, clientBundle, serverBundle)
             missing: Array.isArray(body.missing) ? body.missing : undefined,
         };
     }
-    return { ok: true };
+    const body = await res.json();
+    return { ok: true, warnings: (_a = body.warnings) !== null && _a !== void 0 ? _a : [] };
 }
 /**
  * Uninstall a package from the server.
@@ -109,7 +103,7 @@ export async function serverUninstallPackage(id) {
     const headers = { 'Content-Type': 'application/json' };
     if (auth)
         headers['Authorization'] = auth;
-    const res = await apiFetch(`${serverUrl}/api/packages/uninstall`, {
+    const res = await apiFetch(`${getEnvServerUrl()}/api/packages/uninstall`, {
         method: 'POST',
         headers,
         body: JSON.stringify({ id }),
@@ -124,7 +118,7 @@ export async function serverUninstallPackage(id) {
  * Fetch the list of packages installed on the server.
  */
 export async function fetchServerPackages() {
-    const res = await apiFetch(`${serverUrl}/api/packages`, { credentials: 'omit' });
+    const res = await apiFetch(`${getEnvServerUrl()}/api/packages`, { credentials: 'omit' });
     if (!res.ok)
         return [];
     return await res.json();

package/dist/env/serverUrl.d.ts

@@ -0,0 +1,2 @@
+export declare function __setEnvServerUrl(url: string): void;
+export declare function getEnvServerUrl(): string;

package/dist/env/serverUrl.js

@@ -0,0 +1,8 @@
+/** Server base URL, set once during shell initialization. */
+let serverUrl = '';
+export function __setEnvServerUrl(url) {
+    serverUrl = url;
+}
+export function getEnvServerUrl() {
+    return serverUrl;
+}

package/dist/gestures/index.d.ts

@@ -4,3 +4,20 @@ export type { GestureRegistry } from './gestureRegistry';
 export type { GestureHandle, GestureOptions, GestureType, Axis, ClaimPriority, ClaimEntry, PanEvent, ScrollEvent, ButtonEvent, } from './types';
 /** Internal utility — used by framework gesture sites. Not re-exported via api.ts. */
 export declare function ancestorCount(el: Element): number;
+/**
+ * Width of the reserved gutter at each side edge, in CSS pixels.
+ * Pointer-downs that land within this strip of either side of a swipe-aware
+ * surface (carousel, future side drawers) initiate the gesture unconditionally
+ * — content-specific bailouts (editable target, native horizontal scroll) are
+ * suppressed. Outside the gutter, those bailouts still apply so taps on
+ * inputs and horizontally-scrollable regions behave normally.
+ */
+export declare const EDGE_PX = 24;
+/**
+ * Always-on diagnostic for premature gesture-end paths (claim stolen, foreign
+ * pointercancel, foreign pointerup, etc.). The log only fires on anomalies, so
+ * a healthy drag is silent in production. Include `pointerType` so the user
+ * can tell touch from mouse from pen at a glance — the touch-only auto-release
+ * bug class doesn't reproduce with a mouse.
+ */
+export declare function logGesture(label: string, ev: PointerEvent | null, extra?: Record<string, unknown>): void;

package/dist/gestures/index.js

@@ -10,3 +10,30 @@ export function ancestorCount(el) {
     }
     return n;
 }
+/**
+ * Width of the reserved gutter at each side edge, in CSS pixels.
+ * Pointer-downs that land within this strip of either side of a swipe-aware
+ * surface (carousel, future side drawers) initiate the gesture unconditionally
+ * — content-specific bailouts (editable target, native horizontal scroll) are
+ * suppressed. Outside the gutter, those bailouts still apply so taps on
+ * inputs and horizontally-scrollable regions behave normally.
+ */
+export const EDGE_PX = 24;
+/**
+ * Always-on diagnostic for premature gesture-end paths (claim stolen, foreign
+ * pointercancel, foreign pointerup, etc.). The log only fires on anomalies, so
+ * a healthy drag is silent in production. Include `pointerType` so the user
+ * can tell touch from mouse from pen at a glance — the touch-only auto-release
+ * bug class doesn't reproduce with a mouse.
+ */
+export function logGesture(label, ev, extra) {
+    var _a, _b;
+    if (typeof console === 'undefined')
+        return;
+    const tgt = ev === null || ev === void 0 ? void 0 : ev.target;
+    const tag = (_a = tgt === null || tgt === void 0 ? void 0 : tgt.tagName) !== null && _a !== void 0 ? _a : '-';
+    const raw = (_b = tgt === null || tgt === void 0 ? void 0 : tgt.className) !== null && _b !== void 0 ? _b : '';
+    const cls = typeof raw === 'string' ? raw : '';
+    // eslint-disable-next-line no-console
+    console.log('[sh3:gesture]', label, Object.assign({ pointerId: ev === null || ev === void 0 ? void 0 : ev.pointerId, pointerType: ev === null || ev === void 0 ? void 0 : ev.pointerType, type: ev === null || ev === void 0 ? void 0 : ev.type, target: cls ? `${tag}.${cls}` : tag }, extra));
+}

package/dist/keys/client.js

@@ -9,6 +9,8 @@
 import { ConsentDeniedError, ScopeEscalationError } from './types';
 import { requestConsent } from './consent.svelte';
 import { emit } from './revocation-bus.svelte';
+import { apiFetch } from '../transport/apiFetch';
+import { getEnvServerUrl } from '../env/serverUrl';
 export function createShardKeysApi(params) {
     const { shardId, shardPermissions } = params;
     const assertScopesSubset = (scopes) => {
@@ -24,18 +26,16 @@ export function createShardKeysApi(params) {
             const approved = await requestConsent(shardId, opts);
             if (!approved)
                 throw new ConsentDeniedError();
-            const ticketRes = await fetch('/api/keys/consent', {
+            const ticketRes = await apiFetch(`${getEnvServerUrl()}/api/keys/consent`, {
                 method: 'POST',
-                credentials: 'include',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify(Object.assign({ shardId }, opts)),
             });
             if (!ticketRes.ok)
                 throw new Error(`Consent ticket failed: ${ticketRes.status}`);
             const { ticket } = await ticketRes.json();
-            const mintRes = await fetch('/api/keys', {
+            const mintRes = await apiFetch(`${getEnvServerUrl()}/api/keys`, {
                 method: 'POST',
-                credentials: 'include',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ ticket }),
             });
@@ -44,16 +44,15 @@ export function createShardKeysApi(params) {
             return mintRes.json();
         },
         async list() {
-            const res = await fetch('/api/keys', { credentials: 'include' });
+            const res = await apiFetch(`${getEnvServerUrl()}/api/keys`);
             if (!res.ok)
                 throw new Error(`List failed: ${res.status}`);
             const all = (await res.json());
             return all.filter((k) => k.mintedByShardId === shardId);
         },
         async revoke(id) {
-            const res = await fetch(`/api/keys/${encodeURIComponent(id)}`, {
+            const res = await apiFetch(`${getEnvServerUrl()}/api/keys/${encodeURIComponent(id)}`, {
                 method: 'DELETE',
-                credentials: 'include',
             });
             if (!res.ok && res.status !== 404)
                 throw new Error(`Revoke failed: ${res.status}`);

package/dist/keys/revocation-bus.svelte.js

@@ -6,6 +6,8 @@
  * The bus is populated by a server-sent events stream on /api/keys/events
  * (wired by the sh3 runtime at boot) and/or by local revoke() calls.
  */
+import { getEnvServerUrl } from '../env/serverUrl';
+import { getAuthToken } from '../transport/authToken';
 const handlersByShard = new Map();
 /**
  * Recently-emitted (shardId → Set<keyId>) with per-entry TTL timers.
@@ -78,7 +80,15 @@ export function emit(shardId, keyId) {
 export function startServerSideStream() {
     if (typeof EventSource === 'undefined')
         return () => { };
-    const es = new EventSource('/api/keys/events', { withCredentials: true });
+    // EventSource cannot send custom headers, so cross-origin auth (Tauri remote)
+    // is handled by passing the session token as a query param. Same-origin
+    // builds fall back to cookies via withCredentials.
+    const base = getEnvServerUrl();
+    const token = getAuthToken();
+    const url = token
+        ? `${base}/api/keys/events?token=${encodeURIComponent(token)}`
+        : `${base}/api/keys/events`;
+    const es = new EventSource(url, token ? {} : { withCredentials: true });
     es.onmessage = (msg) => {
         try {
             const ev = JSON.parse(msg.data);

package/dist/layout/compact/CarouselTabs.svelte

@@ -19,7 +19,7 @@
   import SlotContainer from '../SlotContainer.svelte';
   import SlotDropZone from '../SlotDropZone.svelte';
   import { claim, revoke, isOwner } from '../../gestures/pointerClaim';
-  import { ancestorCount } from '../../gestures';
+  import { ancestorCount, EDGE_PX, logGesture } from '../../gestures';
 
   let {
     node,
@@ -62,6 +62,27 @@
   let dragging = $state(false);
   let claimed = $state(false);
   let activePointerId: number | null = null;
+  /**
+   * Set to true when the pointer-down landed inside the left/right edge
+   * gutter. Gutter-initiated drags get the "invincible" treatment: once
+   * the axis-lock threshold is crossed we explicitly call
+   * `setPointerCapture` on the carousel container so the descendant the
+   * touch originally landed on (textarea, scroll region, preview canvas
+   * — see the earlier `cancel-our-id` log targets) no longer receives the
+   * pointer stream and therefore cannot fire `pointercancel` to abort us.
+   *
+   * Mid-track drags don't get capture — the documented contract is that
+   * a descendant claiming the gesture there wins.
+   */
+  let startedInGutter = false;
+  /**
+   * Soft window (`performance.now()` deadline) during which a single
+   * `pointercancel` is treated as the synthetic Android transfer-cancel
+   * that fires when `setPointerCapture` moves implicit capture from a
+   * descendant up to the container. Without this filter, the carousel's
+   * own capture call would immediately abort itself.
+   */
+  let ignoreCancelUntil = 0;
 
   type PointerSnapshot = { id: number; x: number; y: number; t: number };
   let downSnap: PointerSnapshot | null = null;
@@ -72,6 +93,16 @@
   const COMMIT_FRACTION = 0.4;
   const COMMIT_VELOCITY = 500;
   const RUBBER_BAND_MAX_FRACTION = 0.3;
+  /** Window (ms) during which the post-transfer pointercancel is swallowed. */
+  const TRANSFER_CANCEL_WINDOW_MS = 100;
+
+  function dbg(label: string, ev: PointerEvent | null): void {
+    logGesture(`carousel:${label}`, ev, {
+      claimed,
+      dragging,
+      downId: downSnap?.id,
+    });
+  }
   /**
    * If the pointer takes longer than this to cross the axis-lock threshold,
    * treat the gesture as text-selection intent (slow drag over text) and
@@ -80,16 +111,45 @@
    */
   const SLOW_DRAG_TIMEOUT_MS = 250;
 
+  /**
+   * True only when an ancestor has scrollable horizontal overflow that
+   * *actually* overflows. `overflow-x: auto` on a wrapper that doesn't
+   * exceed its clientWidth used to disqualify every swipe inside it — a
+   * common false positive for body views that set `overflow: auto` to get
+   * vertical scrolling. We now also require `scrollWidth > clientWidth`
+   * so only genuinely scrollable regions block the carousel.
+   */
   function hasNativeHorizontalScroll(target: EventTarget | null): boolean {
     let el = target as HTMLElement | null;
     while (el && el !== containerEl) {
       const ox = getComputedStyle(el).overflowX;
-      if (ox === 'auto' || ox === 'scroll') return true;
+      if ((ox === 'auto' || ox === 'scroll') && el.scrollWidth > el.clientWidth) {
+        return true;
+      }
       el = el.parentElement;
     }
     return false;
   }
 
+  /**
+   * True when the pointer-down x sits in the left or right EDGE_PX strip of
+   * the carousel container. Edge-gutter pointer-downs claim the swipe
+   * regardless of editable-target or native-horizontal-scroll content
+   * underneath — the gutter is documented as an unconditional swipe
+   * initiation zone. Without this, any input or `overflow: auto` region
+   * touching the edge silently kills edge swipes.
+   */
+  function isInEdgeGutter(clientX: number): boolean {
+    if (!containerEl || containerWidth === 0) return false;
+    // rect.left for the offset, containerWidth (reactive, ResizeObserver-fed)
+    // for the width — getBoundingClientRect().width is 0 under happy-dom and
+    // similar non-layout DOMs, while containerWidth is seeded from the
+    // ResizeObserver path used everywhere else in this component.
+    const rect = containerEl.getBoundingClientRect();
+    const local = clientX - rect.left;
+    return local < EDGE_PX || local > containerWidth - EDGE_PX;
+  }
+
   function isEditableTarget(target: EventTarget | null): boolean {
     const el = target as HTMLElement | null;
     if (!el || typeof el.tagName !== 'string') return false;
@@ -118,16 +178,28 @@
   }
 
   function onPointerDown(ev: PointerEvent) {
-    if (isEditableTarget(ev.target)) return;
-    if (hasNativeHorizontalScroll(ev.target)) return;
+    // Structural bails — apply regardless of where the touch lands. Without
+    // these the carousel can't even set up a meaningful gesture.
     if (tabCount < 2) return;
     if (containerWidth === 0) return;
     // Multi-touch (pinch-zoom etc.) is not a swipe — bail.
     if (ev.isPrimary === false) return;
+    // Edge gutter override: pointer-downs in the left/right EDGE_PX strip
+    // claim the swipe unconditionally. This is the published invariant for
+    // edge initiation; bailing here would re-introduce the bug where any
+    // editable target or overflow-auto wrapper sitting near the screen edge
+    // silently kills the gesture.
+    const inGutter = isInEdgeGutter(ev.clientX);
+    if (!inGutter) {
+      if (isEditableTarget(ev.target)) return;
+      if (hasNativeHorizontalScroll(ev.target)) return;
+    }
     const depth = containerEl ? ancestorCount(containerEl) : 0;
     const claimGranted = claim(ev.pointerId, { ownerId: 'sh3:carousel', axis: 'x', priority: 'normal', depth });
     if (!claimGranted) return;
     activePointerId = ev.pointerId;
+    startedInGutter = inGutter;
+    ignoreCancelUntil = 0;
     downSnap = { id: ev.pointerId, x: ev.clientX, y: ev.clientY, t: performance.now() };
     lastSnap = { ...downSnap };
     dragging = false;
@@ -140,7 +212,11 @@
 
   function onPointerMove(ev: PointerEvent) {
     if (!downSnap || ev.pointerId !== downSnap.id) return;
-    if (!isOwner(ev.pointerId, 'sh3:carousel')) { endGesture(); return; }
+    if (!isOwner(ev.pointerId, 'sh3:carousel')) {
+      dbg('claim-stolen', ev);
+      endGesture();
+      return;
+    }
     const dx = ev.clientX - downSnap.x;
     const dy = ev.clientY - downSnap.y;
     if (!claimed) {
@@ -159,12 +235,29 @@
       if (!horizDominates) return;
       claimed = true;
       dragging = true;
-      // Don't call setPointerCapture: transferring capture from a
-      // descendant that had implicit capture (a button the finger
-      // touched) makes Android fire pointercancel on the original
-      // target, which our document-level cancel listener would then
-      // treat as an abort. The pointercancel-aborts-no-commit logic
-      // is enough on its own to fix the auto-commit bug.
+      // Gutter-initiated drags get the "invincible" guarantee: transfer
+      // implicit pointer capture from the descendant the touch landed on
+      // (a TEXTAREA, scroll region, etc.) up to the carousel container so
+      // those descendants can no longer fire pointercancel mid-pan. The
+      // transfer itself fires one synthetic pointercancel on Android (see
+      // CarouselTabs commit 638d75a for the original incident); the
+      // ignoreCancelUntil window below swallows just that one cancel —
+      // every other cancel still aborts as before.
+      //
+      // Mid-track drags intentionally skip this: the contract there is
+      // that a descendant claiming the gesture wins, matching the
+      // "carousel aborts if it's caught by an inner element" behavior
+      // the rest of the bail logic already encodes.
+      if (startedInGutter && containerEl) {
+        try {
+          containerEl.setPointerCapture(ev.pointerId);
+          ignoreCancelUntil = performance.now() + TRANSFER_CANCEL_WINDOW_MS;
+        } catch {
+          // setPointerCapture can throw if the pointer is no longer
+          // active (race with platform-level cancel). Safe to swallow —
+          // the gesture will run on implicit capture as before.
+        }
+      }
       // Clear any selection that began during the pre-claim window so
       // it doesn't visually streak across the slide while dragging.
       if (typeof window !== 'undefined') {
@@ -177,8 +270,14 @@
   }
 
   function onPointerUp(ev: PointerEvent) {
-    if (!downSnap || ev.pointerId !== downSnap.id) {
-      endGesture();
+    if (!downSnap) return;
+    // Filter by pointer id. A pointerup for a different pointer (e.g. a
+    // second finger lifting, a stylus releasing while a finger drag is
+    // active, or a phantom multi-pointer) must NOT tear down our gesture —
+    // earlier behavior here was to call endGesture() on any unrelated
+    // pointerup, which dropped legitimate drags on multi-touch devices.
+    if (ev.pointerId !== downSnap.id) {
+      dbg('pointerup-other-id', ev);
       return;
     }
     const dx = ev.clientX - downSnap.x;
@@ -198,12 +297,47 @@
    * mid-drag would be read as a release at the current dx and trip
    * the commit threshold, "auto-completing" the swipe with the
    * finger still down.
+   *
+   * MUST filter by pointer id. The previous unconditional implementation
+   * meant any pointercancel — palm contact, ghost touches, a stylus
+   * cancellation while a finger drag was active — terminated the carousel
+   * gesture. That's the most likely cause of "drag releases mid-pan on
+   * some screens" reports.
    */
-  function onPointerCancel(_ev: PointerEvent) {
+  function onPointerCancel(ev: PointerEvent) {
+    if (!downSnap) return;
+    if (ev.pointerId !== downSnap.id) {
+      dbg('cancel-other-id', ev);
+      return;
+    }
+    // Single-shot swallow for the synthetic Android transfer-cancel that
+    // fires right after we call `setPointerCapture` on a gutter swipe.
+    // Clear the deadline once consumed so a real cancel later in the same
+    // gesture still aborts normally.
+    if (performance.now() < ignoreCancelUntil) {
+      dbg('cancel-ignored-transfer', ev);
+      ignoreCancelUntil = 0;
+      return;
+    }
+    dbg('cancel-our-id', ev);
     endGesture();
   }
 
   function endGesture() {
+    // Release explicit pointer capture if we acquired it for a gutter
+    // swipe. Browsers auto-release on pointerup/cancel, but doing it
+    // defensively here keeps the container's `hasPointerCapture` state
+    // clean if endGesture is called from a path that didn't naturally
+    // release (claim-stolen, unmount, etc.).
+    if (startedInGutter && containerEl && activePointerId !== null) {
+      try {
+        if (containerEl.hasPointerCapture?.(activePointerId)) {
+          containerEl.releasePointerCapture(activePointerId);
+        }
+      } catch {
+        // Defensive — happy-dom / older browsers may not implement it.
+      }
+    }
     if (activePointerId !== null) {
       revoke(activePointerId, 'sh3:carousel');
       activePointerId = null;
@@ -216,6 +350,8 @@
     dragging = false;
     claimed = false;
     dragDelta = 0;
+    startedInGutter = false;
+    ignoreCancelUntil = 0;
   }
 
   function commitOrSnap(dx: number, velocity: number) {