[ymote]

Follow-up to #277. Its "Found on the way" noted that hover still passes through a module tile.

Cause

News and Mail are script apps, hosted in-process as module tiles (MpModuleView, crates/shell/src/module_view.rs). The desk offers every pointer event to its tiles topmost first (desk.rs, WmDesk::handle_event). Makepad's hit tests are a first-wins claim (handled).

1. A module tile claimed a press inside it, but never a hover. A mouse move over a part of Mail that takes no hover, such as its empty Add account page, left Mail's tile unclaimed.
2. The tile behind handed that move to its app, as it did every move. News's widgets hit-test hovers with event.hits…, found the move unclaimed and took it. A tab button (ButtonFlat) under Mail lit up (hover.on) and asked for its hand cursor. A text field there would show its I-beam.
3. The tile behind also handed its app moves that a window in front had already taken. Presses went the same way before fix(shell): a press on the window in front never reaches a card window behind it #277.

A process tile never had this problem. Its event.hits(cx, self.area) claims a hover over it and never yields one that another area claimed.

Fix

crates/shell/src/module_view.rs now treats a hover the way #277 treats a press. A hover is a mouse move with no button held (hover_claim).

• Live tile:
  • A hover inside it that none of its app's widgets took belongs to the tile. The tile claims it after the root, as it claims a press, so no window behind sees it unclaimed.
  • A hover inside it that a window in front already took is let by, and the app never sees it.
  • One exception: the move that ends a hover the app still holds. hovered records that one of the app's widgets took the last move. That move still reaches the root, so the widget sees its hover end. The move is claimed, so it starts no other hover.
• Closed face of a stopped app: it claims a hover inside it, as it claims a press.
• Unchanged: drags (moves with a button held), releases and moves outside the tile pass as before, so captures in progress keep working.

Tests

New unit tests in crates/shell/src/module_input_tests.rs use #277's cascaded tiles and its front-to-back offer. They need no kernel and no display. The probe there now also counts the hovers that reach it and the hovers it takes. It takes them through the same hit test that a Button or a GestureView uses.

• a_hover_on_the_window_in_front_never_reaches_the_app_behind: a hover on Mail where Mail takes none. Mail's app sees it, News's app never does, and the move leaves Mail claimed.
  • Control: where News is uncovered, its row takes the hover.
  • The move that then carries the pointer over Mail reaches News once, to end that hover. No later move reaches News.
• a_button_behind_the_window_in_front_never_lights_up_under_it: makepad's own Button as News's root. Under Mail it neither lights up nor sets the hand cursor. Where it is uncovered, it does both.
• a_hover_on_a_stopped_face_never_reaches_the_app_behind: the closed face takes the hover. Clear of the face, the app under it takes the hover.
• In module_view.rs: only_a_mouse_move_with_no_button_held_is_a_hover_to_claim.

Everything below ran on the Linux build host.

#277's head plus only the new tests (no fix): all 3 new tests fail, each at its bug assertion.

• Hover on Mail: News's app saw the hover and took it, (1, 1) where (0, 0) is expected.
• Button: the cursor over Mail was Hand where Default is expected.
• Closed face: the app under the face saw the hover and took it, (1, 1).

With the fix, at 9764139 on main cf526f4 (the merge of #277): the checks ran on 8accfcc1, the same change on #277's rebased head d030129. The two commits have the same tree, as main and d030129 do.

• From phone/: cargo test --locked --features mobile-apps -p octosense-shell module_input gives 7 passed, and the module_view:: tests 3 passed.
• The shell's whole suite passes, from phone/: cargo test --locked --features mobile-apps -p octosense-shell gives 797 passed, 0 failed.
• These checks also pass:
  • From desktop/: cargo check --locked -p octosense, the same with --features mobile-apps, and bash ../tools/check-shell-graph.sh -p octosense.
  • python3 tools/setup.py --check --cargo.
• On fix(shell): a press on the window in front never reaches a card window behind it #277's original head, merged with the Restart fix (fix(shell): Restart on a stopped app's face responds on the button, not at its top left #296): the module_input and module_view:: tests pass, 11 of them.

Instrument, before and after

The table is the run on main's tree (#277's rebased head d030129) and on 8accfcc1. An earlier run on #277's original head 6524358 gave the same results.

Setup:

• The Linux build host ran its own weston --backend=headless --renderer=pixman --idle-time=0 with makepad's Wayland backend (llvmpipe).
• The shell was cargo build --release --locked -p octosense, driven over --remote.
• Frames come from MAKEPAD_WRITE_FRAMEBUFFER_PNG. Each run used a fresh scratch home and the mock model.

The run:

1. Open News, then Mail, which cascades over it.
2. Drag Mail by its title bar until its left edge (x 243) cuts News's TechMeme tab (x 189–297). The tab is a ButtonFlat that takes a 4 % dark tint while hovered. Its left part shows beside Mail and its right part lies under Mail.
3. At each step, compare the 990 pixels of the tab's visible part with the frame taken while the pointer was on the bar.

Pointer	main (#277 merged)	this branch
On Mail, over the covered part of the tab (270, 298)	The tab lights up under Mail: 890 of 990 pixels change, mean RGB (210.7, 215.9, 217.0) → (203.2, 207.4, 208.6)	0 pixels change
Control: on the tab beside Mail (216, 298)	Lit: 890 pixels	Lit: 890 pixels
Back on Mail, over the tab	Stays lit: 890 pixels	0 pixels: the tab's hover ended

Not run: a real display or a physical mouse. The frames do not show the pointer, so the hand cursor is covered only by the unit test (cx.mouse_cursor()).

🤖 Generated with Claude Code

[ymote]

Merged in a merge train; local CI (Mac with rom toolchain + --linux-host) passed on the train head 72e5d55, which contains this PR.

• tools/ci-local.sh --only all --linux-host, started 2026-10-02T14:00:45: passed. Desktop, phone and apps passed on the Mac; apps services, kernel-security and linux-host / sandbox passed on the Linux build host. Its rom.yml steps were skipped on the Linux host, and the train doesn't trigger rom.yml.
• tools/ci-local.sh --only all on the Mac with the rom toolchain (JDK 17, Android SDK, node 24), started 2026-10-02T14:51:21: 42/42 steps passed, none skipped.

The train was #291, #293, #297, #294, #298, #295, #296, #299, #300 and #292, on main f6678b5. After the last merge, main 301be0c has the tested head's tree.