Make the steady-surface listener idempotent; add a motion kill switch

Two things, both learned from this fix failing repeatedly in the hand
while passing automated tests.

1. Real bug introduced by the previous commit. inject() appends the
whole driver to the parent document on EVERY Streamlit rerun, so the
driver's top level runs many times per page. The document-level
pointermove listener and its surface list were being recreated each
time: N reruns meant N listeners, each holding a private list the
others could not see, and surfaces that survived a rerun were left
registered only in an older list. Both now hang off `window` behind
a guard, so exactly one listener and one list exist per page.

2. UPS_REDUCE_MOTION=1 loads the driver but starts nothing, through the
same bail-out the OS accessibility preference already used. It exists
to settle whether the motion layer is responsible for an interaction
problem, without an OS setting or a code edit — a question three
rounds of this fix could not answer from test evidence alone.

Verified with the switch on: page fully static (0.0px drift) and save
lands on one click.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/ui/motion_runtime.py

@@ -42,6 +42,7 @@ loaded from a CDN, because this app also ships as an offline desktop launcher.
 
 from __future__ import annotations
 
+import os
 from functools import lru_cache
 
 import streamlit as st
@@ -72,7 +73,14 @@ _DRIVER = r"""
   var SPRING = { type: 'spring', stiffness: 320, damping: 30, mass: 0.9 };
   var reduce = false;
   try {
-    reduce = window.matchMedia('(prefers-reduced-motion: reduce)').matches;
+    // UPS_REDUCE_MOTION=1 forces this on from the server side — an escape
+    // hatch that needs no OS setting and no code edit, for when the motion
+    // layer has to be taken out of the picture (e.g. to determine whether it
+    // is responsible for an interaction problem). It routes through the same
+    // already-proven bail-out as the accessibility preference below rather
+    // than adding a second, less-tested way to switch motion off.
+    reduce = !!window.__upsReduceMotion ||
+             window.matchMedia('(prefers-reduced-motion: reduce)').matches;
   } catch (e) {}
 
   // Transforms are always written as Motion's discrete properties (y, scale,
@@ -223,7 +231,13 @@ _DRIVER = r"""
   // which also sidesteps every attach-ordering trap that sank the earlier
   // attempts — it does not matter when a surface was registered, only where
   // the pointer is on the next move.
-  var STEADY = [];
+  // NOTE ON LIFETIME: inject() appends this whole driver to the parent
+  // document on EVERY Streamlit rerun, so this file's top level runs many
+  // times per page. Anything registered here must therefore be idempotent —
+  // both the surface list and the listener hang off `window`, guarded, or a
+  // busy session would accumulate one listener and one orphaned list per
+  // rerun, each holding nodes the others cannot see.
+  var STEADY = (window.__upsSteady = window.__upsSteady || []);
   var STEADY_MARGIN = 140;   // px of clearance — stops before you arrive
 
   function steadyForPointer(el) {
@@ -233,24 +247,28 @@ _DRIVER = r"""
     STEADY.push(el);
   }
 
-  var steadyFrame = 0;
-  document.addEventListener('pointermove', function (e) {
-    if (steadyFrame) return;
-    var px = e.clientX, py = e.clientY;
-    steadyFrame = requestAnimationFrame(function () {
-      steadyFrame = 0;
-      for (var i = STEADY.length - 1; i >= 0; i--) {
-        var el = STEADY[i];
-        // Streamlit replaces nodes on every rerun; drop the stale ones.
-        if (!el.isConnected) { STEADY.splice(i, 1); continue; }
-        var r = el.getBoundingClientRect();
-        var near = px >= r.left - STEADY_MARGIN && px <= r.right + STEADY_MARGIN &&
-                   py >= r.top - STEADY_MARGIN && py <= r.bottom + STEADY_MARGIN;
-        if (near && !el.__upsInside) { el.__upsInside = 1; holdFloat(el); }
-        else if (!near && el.__upsInside) { el.__upsInside = 0; resumeFloat(el); }
-      }
-    });
-  }, true);
+  if (!window.__upsSteadyBound) {
+    window.__upsSteadyBound = 1;
+    var steadyFrame = 0;
+    document.addEventListener('pointermove', function (e) {
+      if (steadyFrame) return;
+      var px = e.clientX, py = e.clientY;
+      steadyFrame = requestAnimationFrame(function () {
+        steadyFrame = 0;
+        var list = window.__upsSteady || [];
+        for (var i = list.length - 1; i >= 0; i--) {
+          var el = list[i];
+          // Streamlit replaces nodes on every rerun; drop the stale ones.
+          if (!el.isConnected) { list.splice(i, 1); continue; }
+          var r = el.getBoundingClientRect();
+          var near = px >= r.left - STEADY_MARGIN && px <= r.right + STEADY_MARGIN &&
+                     py >= r.top - STEADY_MARGIN && py <= r.bottom + STEADY_MARGIN;
+          if (near && !el.__upsInside) { el.__upsInside = 1; holdFloat(el); }
+          else if (!near && el.__upsInside) { el.__upsInside = 0; resumeFloat(el); }
+        }
+      });
+    }, true);
+  }
 
   // Pointer tilt. Hands over from the float and hands back on leave, because
   // two animations writing the same transform component fight each other.
@@ -545,6 +563,13 @@ def inject() -> None:
     # upgrade. In JavaScript "<\\/script" and "</script" are the same string.
     lib = lib.replace("</script", "<\\/script")
     driver = _DRIVER.replace("</script", "<\\/script")
+    # Server-side motion kill switch. Set UPS_REDUCE_MOTION=1 to load the
+    # driver but start nothing, exactly as the OS accessibility preference
+    # does. Useful for isolating whether the motion layer is behind an
+    # interaction problem without touching code or system settings.
+    reduce_motion = (os.getenv("UPS_REDUCE_MOTION", "") or "").strip().lower() in (
+        "1", "true", "yes", "on"
+    )
     components.html(
         # The payloads come first: the bootstrap below reads them by id, and a
         # <script> only sees the document that exists above it.
@@ -560,6 +585,7 @@ def inject() -> None:
         "    try {\n"
         "      var w = window.parent, d = w.document;\n"
         "      if (!d || !d.head) return false;\n"
+        "      w.__upsReduceMotion = " + ("true" if reduce_motion else "false") + ";\n"
         "      if (!w.Motion) {\n"
         "        var s = d.createElement('script');\n"
         "        s.id = 'ups-motion-lib';\n"