Tier 0: render what the services already decided, honestly

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/notification-app-rules-contract

@@ -26,6 +26,23 @@ settings="$repo_dir/config/dot/quickshell/config/Settings.qml"
 [[ -f "$schema" ]] || fail 'preference schema is missing'
 [[ -f "$settings" ]] || fail 'settings singleton is missing'
 
+# ── The gate is decided once ────────────────────────────────────────────────
+#
+# handleNotification weighs Do Not Disturb against its two exceptions and puts
+# what survives into `popups`. The banner window then re-tested
+# !Notifs.doNotDisturb on its `visible` binding, which is not a narrowing of
+# that decision -- it is a replacement of it. An application on a focus mode's
+# allow list, or a critical notification with breakthrough switched on, was
+# admitted by the service, chimed, and then rendered onto a window that was
+# hidden. The exceptions existed, were configurable, and did nothing.
+toasts="$repo_dir/config/dot/quickshell/modules/notifications/Toasts.qml"
+[[ -f "$toasts" ]] || fail 'the banner window is missing'
+rg -Fq 'visible: Notifs.popups.length > 0' "$toasts" \
+    || fail 'the banner window does not show exactly what the service admitted'
+if rg -q 'visible:.*doNotDisturb' "$toasts"; then
+    fail 'the banner window re-gates on Do Not Disturb, overriding the allow-list and breakthrough exceptions the service already applied'
+fi
+
 # The expanded row body lives in its own component now. It is part of the same
 # surface as the page, so the per-application assertions read both rather than
 # only the file that happens to hold the card today -- otherwise pulling a row