fix(macos): keep recognizing other tabs, and stop ambient suppression events

Eight findings from a fourth review pass. Each is real:

- **One settled integration ended recognition for the whole browser session.**
  `shouldKeepWatching` only continued on "nothing matched", so a user whose
  Gmail is already connected settled at 3s on a Gmail tab and was never offered
  ChatGPT after switching tabs — with `alreadyConnected` being the most common
  outcome, this quietly disabled browser nudges for exactly the set-up users the
  export integrations target. Suppressions are now split into per-integration
  and global; only a global answer ends the session.
- **The browser-chrome strip list named the wrong browsers.** On macOS the
  Chromium browsers do not append their product name; Firefox, Zen and Vivaldi
  do, and none of them were stripped — so suffix matching failed on the browsers
  that need it most.
- **Signed-out and mid-onboarding emitted an event per activation.** Finder is a
  Local Files trigger and is activated constantly, so a signed-out user produced
  a suppressed event every few seconds for a state that cannot change until they
  sign in. Both are now part of the pre-inspection gate, so no work happens at
  all, and both are classified as ambient.
- **A queued card that was later dropped was invisible.** `showNotification`
  offers an `onDropped` callback and the presenter passed none, so the "owed but
  never drawn" class the code comments care about was silent. It now reports
  `bar_unavailable`.
- **"Already connected" paid a full MCP config scan on every activation.** The
  policy front-loads its cheap gates so an opted-out user never reaches the
  scan, but the most common terminal state can only be decided after it. Export
  statuses are cached for a minute and invalidated on connect.
- **The owner guard compared a raw default against a resolved runtime owner**,
  which differ by trimming, the non-production automation override, and the nil
  returned mid-transition — so it misfired on exactly the builds it is exercised
  on. Both sides now resolve the same way.
- **`stop()` and `setFeatureEnabled` had no callers**, reading as live control
  surfaces for a lifecycle nothing drives.

Accepted trade-off, not fixed: the card keeps the bar's standard 6s dismissal,
so a user who glances away can lose one of an integration's three lifetime
offers. Making this card persistent means either bypassing the owner-bound
delivery path (as the reach-error card does) or editing a shared timeout whose
SwiftLint baseline is down-only. Both are worse than the 6s.

Verification: xcrun swift test --package-path Desktop — 5509 tests, 0 failures;
SwiftLint 0 violations.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Archit-lal

desktop/macos/Desktop/Sources/IntegrationNudges/IntegrationConnectionInspector.swift

@@ -18,11 +18,45 @@ enum IntegrationConnectionInspector {
 
     case .exportDestination(let destinationID):
       guard let destination = MemoryExportDestination(rawValue: destinationID) else { return false }
-      let statuses = await MemoryExportService.shared.allStatuses()
-      return statuses[destination]?.hasConnection ?? false
+      return await exportStatuses()[destination]?.hasConnection ?? false
     }
   }
 
+  /// Export statuses, cached briefly.
+  ///
+  /// `allStatuses()` scans and parses every local MCP config file. The policy
+  /// front-loads its cheap gates so an opted-out user never reaches this, but
+  /// "already connected" — the most common terminal state, and the one every
+  /// set-up user hits — can only be decided *after* the scan. Without a cache,
+  /// opening ChatGPT.app, Claude.app and Obsidian in a minute pays for three
+  /// full scans to reach the same answer each time.
+  ///
+  /// The window is short because the cost of being stale is bounded either way:
+  /// a just-connected integration is cleared through `noteConnected`, and a
+  /// just-disconnected one waits at most this long for its next offer.
+  private static let exportStatusCacheTTL: TimeInterval = 60
+  private static var cachedExportStatuses: [MemoryExportDestination: MemoryExportStatus]?
+  private static var cachedExportStatusesAt: Date?
+
+  private static func exportStatuses() async -> [MemoryExportDestination: MemoryExportStatus] {
+    if let cachedExportStatuses, let cachedExportStatusesAt,
+      Date().timeIntervalSince(cachedExportStatusesAt) < exportStatusCacheTTL
+    {
+      return cachedExportStatuses
+    }
+    let statuses = await MemoryExportService.shared.allStatuses()
+    cachedExportStatuses = statuses
+    cachedExportStatusesAt = Date()
+    return statuses
+  }
+
+  /// Drops the export cache. Called when a connection changes so the next offer
+  /// sees the new state rather than waiting out the window.
+  static func invalidateExportStatuses() {
+    cachedExportStatuses = nil
+    cachedExportStatusesAt = nil
+  }
+
   private static var cachedStore: ImportConnectorStatusStore?
   private static var cachedStoreOwnerID: String?
 

desktop/macos/Desktop/Sources/IntegrationNudges/IntegrationNudgeCoordinator.swift

@@ -51,11 +51,12 @@ final class IntegrationNudgeCoordinator {
     @MainActor (
       _ ownerID: String,
       _ match: IntegrationNudgeMatcher.Match,
-      _ onPresented: @escaping @MainActor () -> Void
+      _ onPresented: @escaping @MainActor () -> Void,
+      _ onDropped: @escaping @MainActor () -> Void
     ) -> OwnerBoundNotificationPresentationResult
 
   /// The default presenter: the real floating-bar card.
-  static let floatingBarPresenter: Presenter = { ownerID, match, onPresented in
+  static let floatingBarPresenter: Presenter = { ownerID, match, onPresented, onDropped in
     FloatingControlBarManager.shared.showNotification(
       ownerID: ownerID,
       title: "Connect \(match.entry.displayName) to Omi",
@@ -66,7 +67,8 @@ final class IntegrationNudgeCoordinator {
         telemetryID: match.entry.telemetryID,
         triggerID: match.trigger.id
       ),
-      onPresented: onPresented
+      onPresented: onPresented,
+      onDropped: onDropped
     )
   }
 
@@ -232,11 +234,19 @@ final class IntegrationNudgeCoordinator {
     }
   }
 
-  /// Whether the user currently wants this feature at all. Read before any
-  /// window inspection, not as part of the nudge decision.
+  /// Whether a nudge is possible at all right now, independent of which window
+  /// is in front. Read before any inspection, not as part of the nudge decision.
+  ///
+  /// Signed-out and mid-onboarding are included deliberately: without them a
+  /// signed-out user emits a suppressed event on every Finder activation — and
+  /// Finder is activated constantly — for a state that cannot change until they
+  /// sign in.
   private var isEnabledNow: Bool {
     let environment = environment()
-    return environment.isFeatureEnabled && environment.notificationsEnabled
+    return environment.isFeatureEnabled
+      && environment.notificationsEnabled
+      && environment.isOnboardingComplete
+      && ownerID() != nil
   }
 
   /// Recognize the frontmost window and, if it earns one, offer its integration.
@@ -290,23 +300,33 @@ final class IntegrationNudgeCoordinator {
     /// Suppressed for a reason that cannot change while the user stays here.
     case settled(IntegrationNudgePolicy.Suppression)
 
-    /// Only an unrecognized window is worth looking at again. Once an answer
-    /// exists, re-checking re-reads the window title and re-emits the funnel's
-    /// denominator for a decision already made.
-    var shouldKeepWatching: Bool { self == .noMatchYet }
+    /// Whether re-checking this browser could still produce a different answer.
+    ///
+    /// An unrecognized window obviously can — the user may not have opened the
+    /// site yet. So can a settlement that was about *one integration*: someone
+    /// whose Gmail is already connected should still be offered ChatGPT when
+    /// they switch tabs. What ends the session is a global refusal or a card
+    /// already delivered.
+    var shouldKeepWatching: Bool {
+      switch self {
+      case .noMatchYet: return true
+      case .settled(let reason): return IntegrationNudgePolicy.isPerIntegration(reason)
+      case .delivered, .abandoned: return false
+      }
+    }
   }
 
-  /// Emit the suppression, unless it is one the user has permanently settled.
+  /// Emit the suppression, unless it is an ambient state.
   ///
-  /// A permanent reason — connected, opted out, budget spent, feature off — is
-  /// the same answer on every activation for the life of the install. Emitting
-  /// it each time is unbounded volume, and it inflates the very denominator the
-  /// event exists to provide.
+  /// An ambient reason — connected, opted out, budget spent, signed out — is the
+  /// same answer on every activation for as long as it holds. Emitting it each
+  /// time is unbounded volume, and it inflates the very denominator the event
+  /// exists to provide.
   private func report(
     _ reason: IntegrationNudgePolicy.Suppression,
     for match: IntegrationNudgeMatcher.Match
   ) -> Outcome {
-    if !IntegrationNudgePolicy.isPermanent(reason) {
+    if !IntegrationNudgePolicy.isAmbient(reason) {
       AnalyticsManager.shared.integrationNudgeSuppressed(
         entry: match.entry,
         trigger: match.trigger,
@@ -360,17 +380,25 @@ final class IntegrationNudgeCoordinator {
     // as the screen-capture-reset defect (see
     // `NotificationService.screenCaptureResetShownKey`).
     var recorded = false
-    let result = presenter(ownerID, match) { [weak self] in
+    let onDropped: @MainActor () -> Void = { [weak self] in
+      // Queue eviction or a stale owner: the budget correctly stays unspent, but
+      // a nudge that was owed and never drawn still has to be visible.
       guard let self else { return }
-      recorded = true
-      let shownCountBefore = self.store.state(for: match.entry.telemetryID).shownCount
-      self.store.recordDelivery(telemetryID: match.entry.telemetryID, now: self.now())
-      AnalyticsManager.shared.integrationNudgeShown(
-        entry: match.entry,
-        trigger: match.trigger,
-        shownCount: shownCountBefore + 1
-      )
+      _ = self.report(.barUnavailable, for: match)
     }
+    let result = presenter(
+      ownerID, match,
+      { [weak self] in
+        guard let self else { return }
+        recorded = true
+        let shownCountBefore = self.store.state(for: match.entry.telemetryID).shownCount
+        self.store.recordDelivery(telemetryID: match.entry.telemetryID, now: self.now())
+        AnalyticsManager.shared.integrationNudgeShown(
+          entry: match.entry,
+          trigger: match.trigger,
+          shownCount: shownCountBefore + 1
+        )
+      }, onDropped)
 
     // `.presented` invokes the callback synchronously; `.queued` invokes it
     // later, if and only if the card reaches the screen. Either way the bar owns
@@ -482,6 +510,7 @@ final class IntegrationNudgeCoordinator {
   /// disconnect can start the pitch over instead of finding a spent budget.
   func noteConnected(route: IntegrationNudgeRoute) {
     store.recordConnected(telemetryID: route.telemetryID)
+    IntegrationConnectionInspector.invalidateExportStatuses()
   }
 
   // MARK: - Settings
@@ -492,7 +521,4 @@ final class IntegrationNudgeCoordinator {
     UserDefaults.standard.object(forKey: .integrationNudgesEnabled) as? Bool ?? true
   }
 
-  static func setFeatureEnabled(_ enabled: Bool) {
-    UserDefaults.standard.set(enabled, forKey: .integrationNudgesEnabled)
-  }
 }

desktop/macos/Desktop/Sources/IntegrationNudges/IntegrationNudgeMatcher.swift

@@ -67,18 +67,38 @@ enum IntegrationNudgeMatcher {
   }
 
   /// Lowercased, trimmed, and stripped of the browser's own trailing chrome so
-  /// a site name that a browser appended its product name after still reads as
-  /// the end of the title.
+  /// a site name the browser appended its product name after still reads as the
+  /// end of the title.
+  ///
+  /// On macOS the Chromium browsers do *not* append their name — a Chrome window
+  /// showing Gmail is titled exactly "Inbox (12) - you@corp.com - Gmail". The
+  /// ones that do are Firefox and its relatives, so those are what this strips.
+  /// Chromium suffixes stay in the list only because they cost nothing and some
+  /// builds and window managers do add them.
   static func normalizedTitle(_ title: String) -> String {
     var value = title.lowercased().trimmingCharacters(in: .whitespacesAndNewlines)
-    for chrome in [" - google chrome", " — google chrome", " - brave", " - microsoft edge"] {
-      if value.hasSuffix(chrome) {
+    var didStrip = true
+    while didStrip {
+      didStrip = false
+      for chrome in browserTitleChrome where value.hasSuffix(chrome) {
         value = String(value.dropLast(chrome.count)).trimmingCharacters(in: .whitespaces)
+        didStrip = true
+        break
       }
     }
     return value
   }
 
+  private static let browserTitleChrome = [
+    " — mozilla firefox", " - mozilla firefox",
+    " — firefox developer edition", " - firefox developer edition",
+    " — zen browser", " - zen browser",
+    " - vivaldi", " — vivaldi",
+    " - google chrome", " — google chrome",
+    " - brave", " — brave",
+    " - microsoft edge", " — microsoft edge",
+  ]
+
   static func isBrowser(bundleIdentifier: String?) -> Bool {
     guard let bundleIdentifier else { return false }
     return IntegrationNudgeCatalog.browserBundleIdentifiers.contains(bundleIdentifier)

desktop/macos/Desktop/Sources/IntegrationNudges/IntegrationNudgePolicy.swift

@@ -195,16 +195,33 @@ enum IntegrationNudgePolicy {
     return nil
   }
 
-  /// Suppressions that cannot change while the user stays on this Mac. Emitting
-  /// a funnel event for these on every activation is unbounded volume for a
-  /// decision that was made once, and it inflates the very denominator the
-  /// event exists to provide.
-  static func isPermanent(_ suppression: Suppression) -> Bool {
+  /// Suppressions that persist across activations, so emitting a funnel event
+  /// for them every time is unbounded volume for a decision made once — and it
+  /// inflates the very denominator the event exists to provide. Finder alone is
+  /// activated dozens of times an hour.
+  static func isAmbient(_ suppression: Suppression) -> Bool {
     switch suppression {
-    case .alreadyConnected, .featureDisabled, .optedOut, .connectorLifetimeCap:
+    case .alreadyConnected, .featureDisabled, .optedOut, .connectorLifetimeCap,
+      .notSignedIn, .onboardingIncomplete:
       return true
-    case .notSignedIn, .onboardingIncomplete, .snoozed, .connectorCooldown,
-      .globalCooldown, .dailyCap, .barUnavailable:
+    case .snoozed, .connectorCooldown, .globalCooldown, .dailyCap, .barUnavailable:
+      return false
+    }
+  }
+
+  /// Whether this suppression is about *one integration* rather than about the
+  /// user or the moment.
+  ///
+  /// It decides whether a browser is still worth watching: a user whose Gmail is
+  /// already connected should still be offered ChatGPT when they switch tabs, so
+  /// "this integration is settled" must not end recognition for the session. A
+  /// global refusal — signed out, budget spent for the day — genuinely does.
+  static func isPerIntegration(_ suppression: Suppression) -> Bool {
+    switch suppression {
+    case .alreadyConnected, .optedOut, .connectorLifetimeCap, .snoozed, .connectorCooldown:
+      return true
+    case .featureDisabled, .notSignedIn, .onboardingIncomplete, .globalCooldown, .dailyCap,
+      .barUnavailable:
       return false
     }
   }

desktop/macos/Desktop/Sources/MemoryExportService.swift

@@ -1056,9 +1056,14 @@ actor MemoryExportService {
   /// there: an account switch racing this callback would otherwise clear the
   /// wrong person's history.
   private func clearIntegrationNudgeHistory(for destination: MemoryExportDestination) {
-    let connectionOwnerID = defaults.string(forKey: DefaultsKey.authUserId.rawValue)
     Task { @MainActor in
-      guard RuntimeOwnerIdentity.currentOwnerId() == connectionOwnerID else { return }
+      // Both sides resolve through `RuntimeOwnerIdentity`, so the comparison is
+      // like-for-like: reading the raw `authUserId` default here would miss the
+      // trimming, the non-production automation override, and the nil returned
+      // during an owner transition, and would then clear the wrong account's
+      // history on exactly the builds this is tested on.
+      let connectionOwnerID = RuntimeOwnerIdentity.currentOwnerId()
+      guard connectionOwnerID != nil else { return }
       IntegrationNudgeCoordinator.shared.noteConnected(route: .exportDestination(destination.rawValue))
     }
   }

desktop/macos/Desktop/Tests/IntegrationNudgeCoordinatorTests.swift

@@ -42,7 +42,7 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
     IntegrationNudgeCoordinator(
       store: IntegrationNudgeStore(defaults: defaults, ownerID: ownerID),
       now: { self.now },
-      presenter: { _, _, onPresented in
+      presenter: { _, _, onPresented, _ in
         presentedCount.value += 1
         onPresented()
         return result
@@ -89,7 +89,7 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
     let coordinator = IntegrationNudgeCoordinator(
       store: IntegrationNudgeStore(defaults: defaults, ownerID: "user-a"),
       now: { self.now },
-      presenter: { _, _, _ in .rejectedOwnerChange },
+      presenter: { _, _, _, _ in .rejectedOwnerChange },
       ownerID: { "user-a" },
       environment: { .init(isFeatureEnabled: true, notificationsEnabled: true, isOnboardingComplete: true) }
     )
@@ -111,7 +111,7 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
     let coordinator = IntegrationNudgeCoordinator(
       store: IntegrationNudgeStore(defaults: defaults, ownerID: "user-a"),
       now: { self.now },
-      presenter: { _, _, _ in .queued },
+      presenter: { _, _, _, _ in .queued },
       ownerID: { "user-a" },
       environment: { .init(isFeatureEnabled: true, notificationsEnabled: true, isOnboardingComplete: true) }
     )
@@ -132,7 +132,7 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
     let coordinator = IntegrationNudgeCoordinator(
       store: IntegrationNudgeStore(defaults: defaults, ownerID: "user-a"),
       now: { self.now },
-      presenter: { _, _, onPresented in
+      presenter: { _, _, onPresented, _ in
         present.value = onPresented
         return .queued
       },
@@ -234,7 +234,7 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
       let coordinator = IntegrationNudgeCoordinator(
         store: IntegrationNudgeStore(defaults: makeDefaults(), ownerID: "user-a"),
         now: { self.now },
-        presenter: { _, _, _ in
+        presenter: { _, _, _, _ in
           presented.value += 1
           return .presented
         },
@@ -264,20 +264,24 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
 
   /// Once a window has an answer, re-checking re-reads the title and re-emits
   /// the funnel's denominator for a decision already made.
-  func testASettledOutcomeStopsTheReCheckLoop() throws {
+  func testOnlyAGlobalAnswerEndsTheReCheckLoop() throws {
     XCTAssertFalse(IntegrationNudgeCoordinator.Outcome.delivered.shouldKeepWatching)
     XCTAssertFalse(IntegrationNudgeCoordinator.Outcome.abandoned.shouldKeepWatching)
-    XCTAssertFalse(
-      IntegrationNudgeCoordinator.Outcome.settled(.connectorCooldown).shouldKeepWatching)
+    XCTAssertFalse(IntegrationNudgeCoordinator.Outcome.settled(.dailyCap).shouldKeepWatching)
     XCTAssertTrue(IntegrationNudgeCoordinator.Outcome.noMatchYet.shouldKeepWatching)
+    // The case that matters: Gmail already connected must not stop the session,
+    // or switching to a ChatGPT tab in the same browser never gets an offer.
+    XCTAssertTrue(
+      IntegrationNudgeCoordinator.Outcome.settled(.alreadyConnected).shouldKeepWatching)
+    XCTAssertTrue(IntegrationNudgeCoordinator.Outcome.settled(.optedOut).shouldKeepWatching)
   }
 
   /// A browser tab the user has not opened yet is the one case worth watching.
   func testAnUnrecognizedWindowKeepsTheLoopAlive() async {
     let coordinator = IntegrationNudgeCoordinator(
       store: IntegrationNudgeStore(defaults: makeDefaults(), ownerID: "user-a"),
       now: { self.now },
-      presenter: { _, _, _ in .presented },
+      presenter: { _, _, _, _ in .presented },
       ownerID: { "user-a" },
       environment: { .init(isFeatureEnabled: true, notificationsEnabled: true, isOnboardingComplete: true) },
       frontmostBundleID: { "com.google.Chrome" },
@@ -301,7 +305,7 @@ final class IntegrationNudgeCoordinatorTests: XCTestCase {
     IntegrationNudgeCoordinator(
       store: IntegrationNudgeStore(defaults: makeDefaults(), ownerID: "user-a"),
       now: { self.now },
-      presenter: { _, _, onPresented in
+      presenter: { _, _, onPresented, _ in
         presented.value += 1
         onPresented()
         return .presented