fix(settings): segmented track, portalled popup layering, and a first-party time picker

[jackwener]

Four control-level defects reported from the settings surface, plus a plan for the permission-onboarding work.

1. Interface language control broke in English

.maka-segmented carried flex-wrap: wrap, so any locale whose labels ran wider than the row folded an option onto a second line. English hit it — "Follow system / 中文 / English" is ~25% wider than the zh labels, and "English" dropped below the track, turning one switch into a ragged two-row plate.

Measured over the settings-general (en) fixture: 50px tall on two baselines → 26px on one.

The track now refuses to wrap or shrink; the label stack beside it already carries min-width: 0 and absorbs the squeeze, and below the 460px card container the whole row stacks as before.

2. Segmented radius was off the design scale

The track sat on --radius-pill (999px) while every field and select it shares a card with sits on the 6/8/12 scale, so it read as a foreign shape. Track → --radius-surface (8px), segment buttons → --radius-control (6px), concentric across the 2px track padding. This lands on all fiveSegmented consumers, including the usage-stats range selector.

Deliberately not the calc(var(--radius-*) - Npx) shrink form: the radius-converge contract splits corner values on whitespace, so it only admits the unspaced calc(var(--x)-2px) — which is invalid CSS (the spec requires whitespace around -) and computes to 0px. Verified in the renderer. Filed separately; search-modal.css:32 currently ships that bug and renders square corners.

3. 默认权限模式 was unclickable — root cause

Base UI renders Select popups position: static inside an absolutely-positioned positioner, so the z-[var(--z-overlay)] on SelectPopup was inert — a static box ignores z-index. What actually kept settings selects above .settingsModal (z-index 35) was the .settingsSelectPositioner class, applied by hand per call site. PermissionModeSelect was the only Select that never got it, so its popup painted under the modal: in the DOM with aria-expanded="true", invisible, and unclickable because the modal won every hit-test.

The layer now lives on wrapped SelectPositioner / PopoverPositioner, so consumers get it by construction. z-index-contract grows a case pinning both halves — positioners must carry the layer, popups must not.

Verified with trusted CDP input, which respects paint order: before, clicking an option left the trigger on 询问权限; after, it commits 自动执行. Synthetic el.dispatchEvent bypasses hit-testing and passes against a popup nobody can click — worth knowing for future UI checks.

4. Daily-review execution time

Two problems. The field inherited the Input primitive's w-full under a flat 140px cap, so 08:00 plus the glyph (~80px of ink) left a ~60px dead strip inside its right edge — 140px → 94px, hugging its content on the same right rail as the switch rows.

And the popup was WebKit's: platform-accent columns, platform metrics, no dark mode, and unreachable by ::-webkit-*. New TimePicker primitive owns it — same field chrome as its neighbours, two columns (hours, minutes on a 5-min grid), and the same HH:MM value contract, so the persisted config shape is unchanged.

Two ordering hazards, both found by measurement: Base UI mounts the popup before measuring it (every rect reads 0, so a naive scroll write commits 0 — indistinguishable from "already at the top"), then moves focus into it, whose scroll-into-view overwrites whatever was set. Centring is gated on onOpenChangeComplete, and initial focus is pinned to the selected hour rather than row 00.

Also

docs/permission-onboarding-plan.md — a plan for the Codex-style drag-to-grant TCC onboarding. The load-bearing finding: the whole flow is stock Electron (type:'panel' + focusable:false + showInactive(), and webContents.startDrag({file, icon}) for the drag) except locating the System Settings window, which needs CGWindowListCopyWindowInfo — the one permission-free source, avoiding the chicken-and-egg of using an Accessibility-gated API to request Accessibility. Staged so Stage 1 ships with no native code. Technique only; no vendor code copied.

Gates

2855 desktop + 250 ui tests green · biome clean · 0 dead CSS · contracts re-pinned to the new intent rather than deleted.

[Astro-Han]

Approved. The current fixes are ready to merge. The following TimePicker findings are non-blocking and can be addressed in a separate follow-up PR:

• Preserve the full existing HH:MM contract, including minute values outside the default 5-minute grid.
• Keep hour and minute changes atomic so a config save in progress cannot silently drop the second selection.
• Complete the custom listbox’s keyboard and accessibility semantics, including arrow-key navigation, a managed tab stop, and an accessible dialog name.

CI is green, and the formatting, lint, UI, and desktop test suites also pass locally.