Drag out: completion toasts + signs-of-life affordance (M3)

- One toast per drag SESSION (not per file): a signs-of-life in-progress toast when the first fulfillment begins ("Downloading 3 items…"), replaced in place by a completion toast when the session drains. Finder shows nothing while a promise downloads, so this is Cmdr's feedback surface.
- Success wording reuses the shared `composeTransferCompleteToast` selection-split ("Copied 2 files and 1 folder."); failures name the file(s) and complement Finder's own NSError alert rather than duplicating it.
- BE: `native_drag/session_summary.rs` folds per-item outcomes (file/folder/failure) into the toast counts; `promises.rs` records each fulfillment's outcome on the serial queue and emits `drag-out-session-started` / `drag-out-session-complete` at the session lifecycle points (plain Tauri events, FE-mirrored payloads — same pattern as the downloads watcher). `fulfillment.rs` now returns the resolved kind.
- FE: `drag-out-event-bridge.ts` listens to both events and shows the toast; `drag-out-toast.ts` is the pure composer. Both TDD-tested.
- Affordance is no-user-cancel in v1 (Finder owns the gesture); honest because it reflects real in-flight work, not a guessed size threshold.
- Docs: drag/CLAUDE.md now describes the shipped feature (was M1 "clean no-op"); native_drag docs gain the toast section; virtual-mtp.md notes the device is the drag-out test rig; plan's open decisions marked resolved.
- CHANGELOG: user-facing "drag files and folders from your phone or NAS straight to Finder".

Author: vdavid

CHANGELOG.md

@@ -18,6 +18,9 @@ The format is based on [keep a changelog](https://keepachangelog.com/en/1.1.0/),
   [07877792](https://github.com/vdavid/cmdr/commit/07877792))
 - Block ejecting a volume while a copy, move, or delete is touching it
   ([fe2a0987](https://github.com/vdavid/cmdr/commit/fe2a0987))
+- Drag files and folders from your phone or NAS straight to Finder or the Desktop. Cmdr downloads them on drop, under
+  the name Finder picks, the same gesture Photos and Mail already use. Multi-select and whole folders work, and a toast
+  keeps you posted while the download runs
 
 ### Changed
 
@@ -41,8 +44,8 @@ The format is based on [keep a changelog](https://keepachangelog.com/en/1.1.0/),
 ### Fixed
 
 - Dragging a file from a phone or network pane out to Finder, the Desktop, or a terminal no longer drops a junk
-  `.textClipping` file (or pastes a meaningless path). The drag just does nothing outside Cmdr for now, and still works
-  as before inside Cmdr
+  `.textClipping` file or pastes a meaningless path. Finder and the Desktop now download the real file (see Added);
+  terminals and apps that can't take the download get a clean no-op instead of garbage
 - Resolve conflicts file by file inside a folder merge on network and phone drives (SMB, MTP, and cross-volume). A newer
   file deep in the tree no longer loses to an older one behind a single folder-level OK; each clashing file follows your
   conflict choice ([6e305a47](https://github.com/vdavid/cmdr/commit/6e305a47))

apps/desktop/src-tauri/src/native_drag/CLAUDE.md

@@ -15,7 +15,8 @@ The whole module is `#[cfg(target_os = "macos")]`.
 | `type_plan.rs` | Pure, locality-aware pasteboard composition (`plan_pasteboard_items`). Local = file-url + text + filenames; virtual = empty (the textClipping fix). Unit-tested policy. |
 | `source.rs` | `CmdrDragSource` (`define_class!`, `MainThreadOnly`): the `NSDraggingSource`. Returns the permissive operation mask and, on `draggingSession:endedAtPoint:operation:`, tells the promise machinery the gesture ended so a virtual session's objects can be freed. |
 | `promises.rs` | The file-promise providers + delegate (`CmdrPromiseDelegate`), the shared serial queue, the session-lifetime storage, and the `NSError` mapping. |
-| `fulfillment.rs` | The plain-Rust fulfillment service: downloads a virtual file to the Finder-chosen destination. NO AppKit; unit-testable. |
+| `fulfillment.rs` | The plain-Rust fulfillment service: downloads a virtual file to the Finder-chosen destination. NO AppKit; unit-testable. Returns a `FulfillOutcome { is_dir }` so the session summary can split the completion toast by kind. |
+| `session_summary.rs` | Pure per-session outcome accounting (`ItemOutcome`, `SessionSummary`, `summarize`). Folds per-item outcomes into the top-level file/folder/failure counts the completion toast reads. NO AppKit, NO Tauri; unit-tested in isolation. |
 | `uti.rs` | Pure filename-extension → UTI mapping for promise providers (`public.jpeg`, …, fallback `public.data`; folders `public.folder`). |
 
 ## How drag-out works
@@ -106,6 +107,31 @@ runtime and the source `VolumeReadStream` (MTP's `Drop` cancels the USB transfer
 producer); a device disconnect surfaces as a `next_chunk` read error. Either way the cleanup contract
 removes the partial. No explicit teardown hook is needed beyond the existing runtime shutdown.
 
+### Completion toasts (M3)
+
+Finder shows nothing while a promise downloads, so Cmdr is the only feedback surface. The session storage emits two
+plain Tauri events (FE-mirrored payloads, same pattern as the downloads watcher's `download-detected` — no specta
+binding), turned into ONE toast per drag SESSION by `lib/file-explorer/drag/drag-out-event-bridge.ts`:
+
+- **`drag-out-session-started`** — emitted by `enter_fulfillment` the FIRST time a session's fulfillment begins (Finder
+  asked). Carries `total_items`. This is the **signs-of-life affordance**: the FE raises a neutral `default`-level
+  persistent in-progress toast ("Downloading 3 items…") within ~1 s, so a multi-GB / slow MTP drag doesn't feel hung. No Cancel button — v1 stays no-user-cancel (Finder owns the gesture; see the plan's Scope). The trigger is
+  fulfillment-start, not drag-start, because a drag the user drops back into Cmdr never fulfills and must show nothing.
+- **`drag-out-session-complete`** — emitted when the session DRAINS (gesture ended AND `in_flight == 0`), carrying the
+  folded `SessionSummary` (top-level `files_succeeded` / `folders_succeeded` / `failures` leaf names). The FE replaces
+  the in-progress toast in place (same `drag-out:<sessionKey>` id) with the completion toast: success counts via the
+  shared `composeTransferCompleteToast` ("Copied 2 files and 1 folder."), or a failure toast naming the file(s). A clean
+  no-op session (dropped on a non-Finder target, nothing ever fulfilled) summarizes to empty and emits NO event — no
+  toast.
+
+**Counts are top-level dragged items**, consistent with the selection-split contract: one dragged folder counts as one
+folder regardless of how many files land inside it. The delegate records each item's `ItemOutcome` (success + `is_dir`,
+or failure + leaf) on the queue thread via `leave_fulfillment`; the drain point folds them with `session_summary::summarize`.
+
+**Failure complements Finder, not duplicates it.** Finder shows its own NSError alert per failed item (see NSError
+mapping below). Our failure toast names the file and leans on Finder for the technical detail (the friendly copy already
+rode the `FriendlyError` pipeline). Mirrors the transfer-failure pattern.
+
 ## NSError mapping
 
 A `FulfillError` carries a rendered `FriendlyError`. The delegate maps it to an `NSError` in domain
@@ -121,8 +147,11 @@ quiet; a real failure uses code 1 and shows the title.
   cleanup, and the busy-volume seam (drive a blocking stream, assert busy during + released after).
 - `uti.rs`: extension → UTI mapping units.
 - `promises.rs`: delegate smoke (construct a provider, `fileNameForType` returns the leaf), NSError
-  domain/title/code mapping, and the COUNTERS session-lifetime state machine. The AppKit-touching
-  tests guard on `MainThreadMarker::new()` and skip off-main (nextest runs tests on worker threads).
+  domain/title/code mapping, and the COUNTERS session-lifetime state machine (incl. outcome
+  accumulation across in-flight fulfillments). The AppKit-touching tests guard on
+  `MainThreadMarker::new()` and skip off-main (nextest runs tests on worker threads).
+- `session_summary.rs`: the pure outcome fold (empty/no-toast, single file, mixed file+folder split,
+  failures recording leaf names, all-failed still surfaces a toast).
 - `type_plan.rs`: the pure pasteboard policy (local byte-identical, virtual empty across every item).
 
 The Finder leg itself can't be automated honestly (Finder owns the drop gesture); the manual

apps/desktop/src-tauri/src/native_drag/fulfillment.rs

@@ -100,14 +100,28 @@ impl VolumeResolver for RegistryResolver {
     }
 }
 
+/// What a successful fulfillment produced, so the session-summary accounting can
+/// split the completion toast by kind ("Copied 2 files and 1 folder.").
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FulfillOutcome {
+    /// Whether the dragged item was a directory (recursively downloaded) vs a
+    /// single file.
+    pub is_dir: bool,
+}
+
 /// Fulfills one dragged item: downloads `source_path` from the volume identified
 /// by `source_volume_id` to the exact `dest_path` Finder supplied.
 ///
 /// Marks the source volume busy for the eject guard for the whole transfer
-/// (released on every exit via an RAII guard). Returns `Ok(())` on success; on
-/// any failure removes the partial/created destination and returns a
-/// [`FulfillError`] carrying friendly copy.
-pub async fn fulfill(source_volume_id: &str, source_path: &Path, dest_path: &Path) -> Result<(), FulfillError> {
+/// (released on every exit via an RAII guard). Returns the resolved
+/// [`FulfillOutcome`] (file vs folder) on success; on any failure removes the
+/// partial/created destination and returns a [`FulfillError`] carrying friendly
+/// copy.
+pub async fn fulfill(
+    source_volume_id: &str,
+    source_path: &Path,
+    dest_path: &Path,
+) -> Result<FulfillOutcome, FulfillError> {
     fulfill_with_resolver(&RegistryResolver, source_volume_id, source_path, dest_path).await
 }
 
@@ -138,7 +152,7 @@ pub(crate) async fn fulfill_with_resolver(
     source_volume_id: &str,
     source_path: &Path,
     dest_path: &Path,
-) -> Result<(), FulfillError> {
+) -> Result<FulfillOutcome, FulfillError> {
     let Some(volume) = resolver.resolve(source_volume_id) else {
         // The source vanished between drag-start and fulfillment.
         let err = VolumeError::DeviceDisconnected(format!("Volume '{source_volume_id}' is no longer available"));
@@ -181,7 +195,7 @@ pub(crate) async fn fulfill_with_resolver(
             err.friendly.title
         );
     }
-    result
+    result.map(|()| FulfillOutcome { is_dir })
 }
 
 /// Streams one source file to the EXACT `dest_path`. On any error, removes the
@@ -349,9 +363,10 @@ mod tests {
         let dest = dest_dir.path().join("sunset 2.jpg");
 
         let resolver = FixedResolver(Some(v));
-        fulfill_with_resolver(&resolver, "phone", Path::new("/DCIM/photo-001.jpg"), &dest)
+        let outcome = fulfill_with_resolver(&resolver, "phone", Path::new("/DCIM/photo-001.jpg"), &dest)
             .await
             .expect("fulfillment should succeed");
+        assert!(!outcome.is_dir, "a single file fulfillment reports is_dir = false");
 
         assert!(dest.exists(), "file must land at the exact Finder leaf");
         assert_eq!(std::fs::read(&dest).unwrap(), b"sunset bytes");
@@ -521,9 +536,10 @@ mod tests {
         let dest = dest_dir.path().join("DCIM copy");
 
         let resolver = FixedResolver(Some(v));
-        fulfill_with_resolver(&resolver, "phone", Path::new("/DCIM"), &dest)
+        let outcome = fulfill_with_resolver(&resolver, "phone", Path::new("/DCIM"), &dest)
             .await
             .expect("folder fulfillment should succeed");
+        assert!(outcome.is_dir, "a folder fulfillment reports is_dir = true");
 
         assert!(dest.is_dir(), "the dest folder must land under the Finder leaf");
         assert_eq!(std::fs::read(dest.join("a.jpg")).unwrap(), b"aaa");

apps/desktop/src-tauri/src/native_drag/mod.rs

@@ -42,6 +42,7 @@
 
 pub mod fulfillment;
 pub mod promises;
+pub mod session_summary;
 pub mod source;
 pub mod type_plan;
 pub mod uti;