The hide sat behind `#if !MAC_APP_STORE`, so the sandboxed build never hid the cursor itself and leaned entirely on the TrackDrum helper, which only hides once capture starts. Focus armed without the helper — or with a capture that failed to find a pad — left keys and the trackpad being read out from under a pointer the user could still see moving. Arming hides in every mode now, after the mode branch, since local FX idle shows the cursor on its way in and would otherwise undo it. A hidden cursor is the proof this app owns the pointer, so a visible one during focus is not a cosmetic slip, it means the focus is a lie. A watchdog ends the session the same way Escape does rather than re-hiding and papering over whatever showed it. It watches our own hide, which is the case that arises: several focused paths call showSystemCursorIfNeeded mid-session. A show from another process is not observable — the query for it was removed from macOS with no public replacement, and reaching for the private one would cost the sandbox. The helper knows its own hide and can report it over the bridge if that turns out to be the path that bites.