Window Names Hint

The stage

Arm the hint with one of the three triggers #916 names, then switch between the three candidate surfaces. The dismissal is real: Quit and relaunch reloads the stage from persistence, and only Reset everything brings the hint back.

list_windows
  { "bounds": [22,52,300,168],   "owner": null, "title": null }
  { "bounds": [150,132,300,150], "owner": null, "title": null }
  { "bounds": [70,250,250,120],  "owner": null, "title": null }

The state model

One derived value, not three booleans that have to stay in step. The hint is on screen because the state says so, and the state has exactly one reason to be what it is.

/// Why the hint is or is not on screen. One value, derived — never three
/// booleans that have to stay in step.
enum NamesHint {
    /// Names are usable, or no nameless read is outstanding.
    Quiet,
    /// Something asked for windows and got them nameless while the consent was off.
    Due,
    /// The user said no. Persisted, so it survives a restart.
    Dismissed,
}

• Recorded where something asks, not where the consent is checked. usable(WindowNames) runs in three places on main: the can_read_titles closure in platform::window_source() (src-tauri/src/platform.rs:770), the frontmost-name gate in the frame loop (src-tauri/src/frame_loop.rs:1118), and platform::list_window_titles() (src-tauri/src/platform.rs:722). The first two run every frame and every sense interval whether anyone wants a name or not, so a miss recorded there would arm the hint seconds after every launch. Only the third is a request, the fidget://windows read from mcp_http::read_resource. list_windows and describe_screen never call usable at all; they read the frame loop's snapshot, whose windows carry owner: None, title: None under the same consent (#979). So Due is recorded at the two request seams, the resource read and the frame loop's tool dispatch (src-tauri/src/frame_loop.rs:2113) for those two tools, in a process-global atomic beside WANT_WINDOW_NAMES in src-tauri/src/consent.rs. A flag rather than a channel because the resource read runs on the MCP HTTP thread with no AppHandle and no route to the UI.
• Decided and drawn in the frame loop, which already holds the AppHandle and already does exactly this for the first-run tour at src-tauri/src/frame_loop.rs:1072 and :1099.
• Dismissed persists as one new bool on Settings, the twin of first_run_tour_shown at src-tauri/src/settings.rs:1871 — no BoolField, no FormRow, set and saved where it is shown.
• Gated on !do_not_disturb, the same gate the first-run tour takes.
• One dismissal, permanent. A nudge you cannot silence is worse than no nudge, and the Settings row is always there for anyone who changes their mind. The alternative is a session-scoped Not now that comes back next launch, and that is the reviewer's call rather than this page's.

What the copy refuses to say

The hint never names macOS Screen Recording, never names ScreenCast, never says screenshot, and never reaches for a verb of sight — a fidget that sees is a fidget that captures, whatever the next clause says. It names what the fidget knows and what it does not — where the windows are, not what they are — in the words the Settings row's own disclosure already uses, and the row names the grant one line down, which is where #888 and #979 put it and where a disclosure belongs. A hint that leads with the permission is asking for the permission; a hint that leads with the capability is describing the fidget.

One consent, one thing it gates. Before ADR-0032 the copy had to explain a split — application names free, titles gated — and that split is gone, so the hint no longer says what the fidget still knows without consent, because without it the fidget knows no name at all. The same product rule holds on every OS. Only the platform label under the Settings row changes: Screen Recording on macOS, ScreenCast on Linux, no system permission on Windows.

Not in this proposal

• The default stays off. Nothing here flips a consent.
• Capture stays dropped (ADR-0031, upheld by ADR-0032), and no copy on this page foreshadows it.
• Nothing auto-prompts the OS dialog. The checkbox is the only thing that reaches the operating system.

Alternatives weighed