crcbl-shell 0.17.2

// Every test here takes the real desktop through `desktop::shell` and most open
// visible windows, so each is `#[ignore]`d: an unattended `cargo test` or
// nextest sweep opens none. `tests/run-win32-e2e.ps1`, which CI's `win32 e2e
// (real desktop)` job runs, selects them with `--run-ignored all` beside the
// e2e binary and fails a run that executed none.

use super::*;
use crate::{AspectRatio, LogicalSize, MimeType, TextPurpose};
use crcbl_core::KeyCode;
use crcbl_core::input::{ButtonState, Keysym, PointerButton, Scancode, ScrollDelta};
use std::path::PathBuf;
use std::time::Instant;

use super::super::ffi::{DropFiles, Lparam, MinMaxInfo, Point, Rect, msg};

/// `VK_W`, which is the letter's virtual key on every layout that has one.
const VK_W: usize = 0x57;
/// `VK_UP`.
const VK_UP: usize = 0x26;

mod desktop;
use desktop::shell;

#[cfg(feature = "accesskit")]
mod accessibility;

fn window(shell: &mut Win32Shell) -> WindowId {
    shell
        .create_window(&WindowDesc {
            title: "crcbl P5C W2",
            ..WindowDesc::default()
        })
        .expect("creating a top-level window")
}

/// The `HWND`, for the messages only a user's mouse would otherwise send.
fn hwnd_of(shell: &Win32Shell, window: WindowId) -> Handle {
    shell.window(window).expect("a live window").raw()
}

/// Sends a key message with the `lParam` the keyboard driver would build.
///
/// The whole of input is otherwise unreachable from CI, which has no
/// keyboard and no mouse. `SendMessageW` runs the real window procedure
/// against the real cached state, so everything below the driver — the scan
/// code table, the modifier snapshot, the layout lookup — is exercised.
fn send_key(
    hwnd: Handle,
    message: u32,
    virtual_key: usize,
    scancode: isize,
    extended: bool,
    previous: bool,
) {
    let mut l_param = (scancode << 16) | 1;
    if extended {
        l_param |= 1 << 24;
    }
    if previous {
        l_param |= 1 << 30;
    }
    if message == msg::KEY_UP {
        // The transition bit, which is set on every release and which this
        // backend must not confuse with the previous-state bit beside it.
        l_param |= 1 << 31;
    }
    // SAFETY: a keyboard message to this shell's own window, with the
    // `wParam`/`lParam` encoding `winuser.h` documents for it.
    unsafe { ffi::SendMessageW(hwnd, message, virtual_key, l_param) };
}

/// Sends a mouse message with two coordinates packed into `lParam`.
fn send_mouse(hwnd: Handle, message: u32, w_param: usize, x: i32, y: i32) {
    let l_param = (((y as u16 as usize) << 16) | (x as u16 as usize)) as Lparam;
    // SAFETY: a mouse message to this shell's own window, with the packed
    // coordinate encoding `winuser.h` documents.
    unsafe { ffi::SendMessageW(hwnd, message, w_param, l_param) };
}

/// Sends the `WM_MOUSELEAVE` a real pointer leaving would produce.
///
/// The one-shot notification this backend arms with `TrackMouseEvent`, sent
/// by hand because CI has no mouse to move out — and, at the *start* of a
/// test, the only way to put the derived "is the pointer inside?" state on a
/// known edge when a real cursor may already be over the window.
fn send_leave(hwnd: Handle) {
    // SAFETY: a pointer-crossing message to this shell's own window, with
    // the `wParam`/`lParam` of zero `winuser.h` documents for it.
    unsafe { ffi::SendMessageW(hwnd, msg::MOUSE_LEAVE, 0, 0) };
}

/// Makes a window the foreground one.
///
/// `ClipCursor` and `SetCursorPos` are both restricted to the process that
/// owns the foreground window — the desktop's protection against exactly the
/// hostage-taking this backend is careful not to do — so a test that
/// exercises either has to arrange it. Only [`focus_and_confirm`] calls
/// it, because a grant is worth nothing until the system confirms it.
///
/// Returns whether `SetForegroundWindow` said it took. A refusal is not an
/// error Windows reports anywhere else: `ClipCursor` then does nothing and
/// still succeeds, so the refusal has to be read here or not at all.
///
/// The foreground lock grants `SetForegroundWindow` only to the process that
/// sent the last input event, so a run launched from a background shell was
/// refused every time. A zero mouse move injected by **this** process first
/// makes it that sender without moving the cursor; one injected by another
/// process (the `crcbl-e2e-win32-input` helper) credits that process instead.
/// EW measured it on 2026-11-02: plain calls refused 2 of 2, after the move
/// granted 3 of 3.
fn make_foreground(hwnd: Handle) -> bool {
    use windows::Win32::UI::Input::KeyboardAndMouse::{
        INPUT, INPUT_0, INPUT_MOUSE, MOUSEEVENTF_MOVE, MOUSEINPUT, SendInput,
    };
    let nudge = INPUT {
        r#type: INPUT_MOUSE,
        Anonymous: INPUT_0 {
            mi: MOUSEINPUT {
                dwFlags: MOUSEEVENTF_MOVE,
                ..MOUSEINPUT::default()
            },
        },
    };
    // SAFETY: one fully initialised `INPUT`, its size as `cbSize`. A refused
    // injection only leaves the grant below to be refused, which is read.
    unsafe { SendInput(&[nudge], size_of::<INPUT>() as i32) };
    // SAFETY: this shell's own window, from the thread that created it.
    unsafe { ffi::SetForegroundWindow(hwnd) != 0 }
}

/// Whether `hwnd` is the foreground window right now.
///
/// Asked of the system rather than of `WindowState::focused`, which any
/// `WM_SETFOCUS` sets — including the synthetic one [`send_focus`] sends.
fn is_foreground(hwnd: Handle) -> bool {
    // SAFETY: no arguments; the result is only compared, never used.
    core::ptr::eq(unsafe { ffi::GetForegroundWindow() }, hwnd)
}

/// Gives a window the keyboard and **confirms it kept it**.
///
/// [`send_focus`] delivers `WM_SETFOCUS` synchronously, so the message
/// itself always arrives. Holding the focus is the part that can fail: the
/// Windows runner is a real, non-idle desktop — `docs/backlog.md` records
/// the unbidden messages that proved it — and anything on it may take the
/// foreground straight back. The theft arrives as a `WM_KILLFOCUS` that the *same* pump then
/// processes, so granting focus and pumping once can leave the window
/// unfocused with nothing said about why.
///
/// That is worth a helper rather than an inline retry because of what it
/// costs when it is missing: the cursor is hidden only for a focused
/// window, so a silently lost focus turns
/// `hiding_the_cursor_is_balanced_however_many_times_it_is_asked_for` into
/// `left: 0, right: -1` — a reference-count failure that is really a focus
/// failure, which is how it was read the first time it happened.
///
/// **`focused` alone cannot confirm anything**, because the synthetic
/// `WM_SETFOCUS` sets it whether or not the window is really in front. The
/// first version of this helper judged by that flag and so failed only
/// when a foreign `WM_KILLFOCUS` happened to land in the same pump — and
/// passed when `SetForegroundWindow` had been refused outright, leaving
/// `ClipCursor` to do nothing and a clip assertion further down to fail
/// with no mention of focus. So every attempt also asks the system: the
/// grant has to have been accepted, and the window still has to be the
/// foreground one after the pump, before and after the synthetic message.
/// The pump before judging drains the real activation traffic the grant
/// produced, so a steal already in flight is seen rather than raced.
///
/// # Panics
///
/// If the window will not keep the keyboard for long enough to ask it a
/// question, which is a runner that cannot host this test rather than a
/// backend that is wrong.
fn focus_and_confirm(shell: &mut Win32Shell, window: WindowId, hwnd: Handle) {
    // Enough to outlast a transient steal without turning a genuinely
    // unfocusable window into a long hang.
    const ATTEMPTS: u32 = 8;
    // The first back-off, doubled per attempt up to `BACKOFF_DOUBLINGS`
    // times, so a sibling process that holds the foreground for a moment
    // gets that moment instead of eight grants inside it.
    const BACKOFF: Duration = Duration::from_millis(10);
    const BACKOFF_DOUBLINGS: u32 = 4;
    let mut granted = false;
    for attempt in 0..ATTEMPTS {
        granted = make_foreground(hwnd);
        shell.pump(&mut |_| {});
        if granted && is_foreground(hwnd) {
            send_focus(hwnd, true);
            shell.pump(&mut |_| {});
            if shell.window_state(window).expect("live").focused && is_foreground(hwnd) {
                return;
            }
        }
        std::thread::sleep(BACKOFF * (1 << attempt.min(BACKOFF_DOUBLINGS)));
    }
    // SAFETY: no arguments; read only to name the holder in the message.
    let foreground = unsafe { ffi::GetForegroundWindow() };
    panic!(
        "the window would not keep the keyboard over {ATTEMPTS} attempts, so nothing \
             below this can be asked about a focused window (last SetForegroundWindow \
             granted: {granted}; foreground window {foreground:?}, ours {hwnd:?})"
    );
}

/// Sends `WM_SETFOCUS` or `WM_KILLFOCUS`.
///
/// The clip and the cursor both follow the focus, and CI cannot click on a
/// window to give it one.
fn send_focus(hwnd: Handle, focused: bool) {
    let message = if focused {
        msg::SET_FOCUS
    } else {
        msg::KILL_FOCUS
    };
    // SAFETY: a focus message to this shell's own window.
    unsafe { ffi::SendMessageW(hwnd, message, 0, 0) };
}

/// Every [`ShellEvent::Key`] one pump produced, flattened for assertion.
fn pump_keys(
    shell: &mut Win32Shell,
) -> Vec<(Scancode, Option<KeyCode>, Keysym, ButtonState, bool)> {
    let mut keys = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::Key {
            scancode,
            key_code,
            keysym,
            state,
            repeat,
            ..
        } = event
        {
            keys.push((scancode, key_code, keysym, state, repeat));
        }
    });
    keys
}

/// The rectangle the cursor is currently clipped to.
fn clip_rect() -> Rect {
    let mut rect = Rect::default();
    // SAFETY: `rect` is a live, initialised `RECT` the call writes into.
    unsafe { ffi::GetClipCursor(&raw mut rect) };
    rect
}

/// The whole desktop, as one rectangle.
///
/// The origin is read rather than assumed to be zero: a monitor to the left
/// of the primary puts the virtual screen's left edge at a negative
/// coordinate, and a test that assumed the origin would pass on this
/// developer's desk and fail on somebody else's.
fn virtual_screen() -> Rect {
    // SAFETY: four metric queries by value; each reads no memory of ours
    // and answers zero for an index it does not know.
    unsafe {
        let left = ffi::GetSystemMetrics(value::SM_X_VIRTUAL_SCREEN);
        let top = ffi::GetSystemMetrics(value::SM_Y_VIRTUAL_SCREEN);
        Rect {
            left,
            top,
            right: left + ffi::GetSystemMetrics(value::SM_CX_VIRTUAL_SCREEN),
            bottom: top + ffi::GetSystemMetrics(value::SM_CY_VIRTUAL_SCREEN),
        }
    }
}

/// The rectangle a confined pointer should be held to, read **now**.
///
/// Both halves move underneath a test: the desktop can reposition a window,
/// and this runner changes its display set mid-run — the behaviour that
/// made [`Win32Shell::refresh_clip`] refuse a degenerate refresh. Capturing
/// either half early and comparing it later turns a desktop change into a
/// failure of whatever assertion happened to be running, which is how
/// `minimizing_a_captured_window_releases_the_clip` failed twice on CI for
/// commits that touched no shell code. Callers read this immediately before
/// they assert, so the comparison is against the desktop that exists.
fn confined_to_client(hwnd: Handle) -> Rect {
    super::input::client_screen_rect(hwnd)
        .expect("a live window has a client rectangle")
        .intersect(virtual_screen())
}

/// Whether any window of this process has the clipboard open.
///
/// The observable behind "closed on every path out": the guard's `Drop` is
/// what has to have run, and this is the only thing that can see whether it
/// did.
/// Whether *this* window holds the clipboard open.
///
/// This replaced a `clipboard_is_open` that asked `GetOpenClipboardWindow`
/// whether **anybody** holds it — a wider question than these tests are
/// asking. Every caller wanted "did our own guard give it back", and the
/// broad form answers that wrongly whenever a foreign process on a shared
/// desktop happens to hold the clipboard, which says nothing about our
/// code. That is a real CI flake, recorded in `docs/backlog.md`.
fn clipboard_held_by(hwnd: *mut core::ffi::c_void) -> bool {
    // SAFETY: as above — a read of window-station state, no arguments.
    core::ptr::eq(unsafe { ffi::GetOpenClipboardWindow() }, hwnd)
}

/// A window that accepts file drops, which is off by default.
fn drop_window(shell: &mut Win32Shell) -> WindowId {
    shell
        .create_window(&WindowDesc {
            title: "crcbl P5C W3 — drops",
            accept_drops: true,
            ..WindowDesc::default()
        })
        .expect("creating a drop target")
}

/// Builds the `HDROP` a file manager's drop would have handed over.
///
/// CI has nobody to drag a file onto a window, so this is the drag: the
/// block is exactly what the shell puts behind an `HDROP`, and everything
/// downstream of it — `DragQueryFileW`, `DragQueryPoint`, `DragFinish`, the
/// window procedure, the shared drop queue and the translation — is the
/// real path. The handle is **not** freed here: `DragFinish` inside the
/// procedure owns it, and that is part of what this exercises.
fn make_hdrop(paths: &[&str], x: i32, y: i32) -> Handle {
    let mut list: Vec<u16> = Vec::new();
    for path in paths {
        list.extend(path.encode_utf16());
        list.push(0);
    }
    // The list itself is terminated by an empty entry, which is the second
    // NUL after the last path — and the whole list when there are none.
    list.push(0);

    let header = size_of::<DropFiles>();
    let bytes = header + list.len() * 2;
    // SAFETY: an allocation request by value. `GMEM_MOVEABLE` is what an
    // `HDROP` is, which is why `DragQueryFileW` can lock it.
    let mem = unsafe { ffi::GlobalAlloc(value::GMEM_MOVEABLE, bytes) };
    assert!(!mem.is_null(), "GlobalAlloc for a synthetic HDROP");
    // SAFETY: `mem` is a live moveable block this function owns until the
    // message is sent.
    let locked = unsafe { ffi::GlobalLock(mem) };
    assert!(!locked.is_null(), "GlobalLock of a synthetic HDROP");
    // SAFETY: `locked` points at `bytes` writable bytes, which is
    // `size_of::<DropFiles>()` followed by exactly `list.len()` code units;
    // `GlobalAlloc` returns at least 8-byte alignment, so both the header
    // write and the `u16` copy at the even offset `header` are aligned.
    unsafe {
        ptr::write_bytes(locked.cast::<u8>(), 0, bytes);
        locked.cast::<DropFiles>().write(DropFiles {
            p_files: header as u32,
            pt: Point { x, y },
            f_nc: 0,
            f_wide: 1,
        });
        ptr::copy_nonoverlapping(
            list.as_ptr(),
            locked.cast::<u8>().add(header).cast::<u16>(),
            list.len(),
        );
        ffi::GlobalUnlock(mem);
    }
    mem
}

/// Sends a `WM_DROPFILES` carrying a synthetic `HDROP`.
fn send_drop(hwnd: Handle, paths: &[&str], x: i32, y: i32) {
    let hdrop = make_hdrop(paths, x, y);
    // SAFETY: a drop message to this shell's own window, with the `wParam`
    // `shell32` documents for it. The procedure finishes the handle.
    unsafe { ffi::SendMessageW(hwnd, msg::DROP_FILES, hdrop as usize, 0) };
}

/// Every [`ShellEvent::DroppedFile`] one pump produced.
fn pump_drops(shell: &mut Win32Shell) -> Vec<(WindowId, PathBuf, Option<PhysicalPoint>)> {
    let mut dropped = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::DroppedFile {
            window,
            path,
            position,
            ..
        } = event
        {
            dropped.push((window, path, position));
        }
    });
    dropped
}

/// Reads the clipboard and pumps until the answer arrives.
///
/// One pump is always enough on this backend — the read happens inside
/// `clipboard_request` — and the loop is not a retry: it asserts that.
fn paste(shell: &mut Win32Shell, window: WindowId, requested: MimeType) -> ClipboardContent {
    let request = shell
        .clipboard_request(window, requested)
        .expect("CLIPBOARD is claimed");
    let mut answers = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::ClipboardData {
            window: asked,
            request: answered,
            mime,
            content,
        } = event
        {
            assert_eq!(asked, window, "the answer names the window that asked");
            assert_eq!(answered, request, "and the request it answers");
            assert!(
                mime.matches(requested),
                "a Win32 format is a number, so the answer echoes the request: {mime}"
            );
            answers.push(content);
        }
    });
    assert_eq!(
        answers.len(),
        1,
        "exactly one answer per accepted request, on the first pump: {answers:?}"
    );
    answers.remove(0)
}

/// The cursor's display count, read without changing it.
///
/// There is no read-only accessor: `ShowCursor` returns the count *after*
/// its own adjustment, so the only way to see it is to move it and put it
/// back. The pair is balanced, which is exactly what the code under test has
/// to be as well.
fn cursor_display_count() -> i32 {
    // SAFETY: two integers by value; neither call can fail, and together
    // they leave the count where they found it.
    unsafe {
        let raised = ffi::ShowCursor(1);
        ffi::ShowCursor(0);
        raised - 1
    }
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_has_no_size_until_the_first_pump_and_exactly_one_is_enough() {
    // The P0.4 contract, and the Win32 shape of it: the system knew the
    // size before `create_window` returned, so the wait is one pump — not a
    // round trip, and not an invented delay to look like Wayland.
    let mut shell = shell();
    let window = window(&mut shell);
    assert_eq!(
        shell.window_state(window).expect("live").size(),
        None,
        "a freshly created window has not been configured yet"
    );

    let mut events = Vec::new();
    shell.pump(&mut |event| events.push(event));
    let size = shell
        .window_state(window)
        .expect("live")
        .size()
        .expect("one pump is enough on Win32");
    assert!(!size.is_empty(), "{size}");
    assert!(
        events.iter().any(|event| matches!(
            event,
            ShellEvent::Resized { window: reported, .. } if *reported == window
        )),
        "the size arrives as an event, not only as state: {events:?}"
    );

    // And it is not re-delivered: the `WM_SIZE` that `CreateWindowExW`
    // sent is a restatement of a size already published.
    let mut again = Vec::new();
    shell.pump(&mut |event| again.push(event));
    assert!(
        !again
            .iter()
            .any(|event| matches!(event, ShellEvent::Resized { .. })),
        "{again:?}"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_opens_flips_to_borderless_and_back_and_is_destroyed() {
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let windowed = shell
        .window_state(window)
        .expect("live")
        .size()
        .expect("configured");

    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .expect("a desktop session has a primary monitor")
        .id;
    let bounds = shell.monitor(primary).expect("just found it").bounds;

    shell
        .set_mode(
            window,
            DisplayMode::Borderless {
                monitor: Some(primary),
            },
        )
        .expect("borderless on a named monitor is what WINDOW_POSITION claims");
    let mut events = Vec::new();
    shell.pump(&mut |event| events.push(event));
    let state = shell.window_state(window).expect("live");
    assert_eq!(
        state.size(),
        Some(bounds.size()),
        "a borderless window covers its monitor exactly"
    );
    assert!(
        state.mode_request_honoured(),
        "Win32 has no window manager to refuse: {state:?}"
    );
    assert!(
        events
            .iter()
            .any(|event| matches!(event, ShellEvent::Resized { .. })),
        "the mode change is reported as a resize: {events:?}"
    );

    shell
        .set_mode(window, DisplayMode::Windowed)
        .expect("and back");
    shell.pump(&mut |_| {});
    let state = shell.window_state(window).expect("live");
    assert_eq!(
        state.size(),
        Some(windowed),
        "the saved WINDOWPLACEMENT restores the windowed size exactly"
    );
    assert_eq!(state.effective_mode(), Some(DisplayMode::Windowed));
    assert!(state.mode_request_honoured());

    shell.destroy_window(window).expect("destroy");
    let mut destroyed = false;
    shell.pump(&mut |event| {
        destroyed |=
            matches!(event, ShellEvent::WindowDestroyed { window: gone } if gone == window);
    });
    assert!(destroyed, "destruction is reported");
    assert!(matches!(
        shell.window_state(window),
        Err(ShellError::InvalidWindow { .. })
    ));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_created_borderless_can_still_be_made_windowed() {
    // The case with no saved placement to restore: the window has never
    // had a windowed style, so one is built from the descriptor rather
    // than the recorded mode being changed under a window that is still
    // `WS_POPUP`.
    let mut shell = shell();
    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .expect("a primary monitor")
        .id;
    let bounds = shell.monitor(primary).expect("just found it").bounds;
    let window = shell
        .create_window(&WindowDesc {
            title: "crcbl P5C W1 — borderless from the start",
            mode: DisplayMode::Borderless {
                monitor: Some(primary),
            },
            size: LogicalSize::new(800.0, 600.0),
            ..WindowDesc::default()
        })
        .expect("create borderless");
    shell.pump(&mut |_| {});
    let state = shell.window_state(window).expect("live");
    assert_eq!(state.size(), Some(bounds.size()), "it covers the monitor");
    assert!(state.mode_request_honoured());

    shell
        .set_mode(window, DisplayMode::Windowed)
        .expect("and back to a mode it has never been in");
    shell.pump(&mut |_| {});
    let state = shell.window_state(window).expect("live");
    assert_eq!(state.effective_mode(), Some(DisplayMode::Windowed));
    let size = state.size().expect("configured");
    assert_ne!(size, bounds.size(), "it is no longer the monitor: {size}");
    let scale = shell.window(window).expect("live").scale_factor;
    assert_eq!(
        size,
        LogicalSize::new(800.0, 600.0).to_physical(scale),
        "the descriptor's windowed size is what it becomes"
    );
}

/// The text and keyboard bits split or added 2026-10-17, which need no
/// window to read: the set is a constant apart from raw motion.
#[test]
fn dead_keys_and_the_input_method_are_set_and_a_held_keyboard_is_not() {
    for raw_motion in [false, true] {
        let caps = Win32Shell::latch_caps(raw_motion);
        assert!(caps.contains(ShellCaps::TEXT_COMPOSE), "TranslateMessage");
        assert!(caps.contains(ShellCaps::TEXT_IME), "imm32");
        assert!(
            !caps.contains(ShellCaps::PANEL_EXCLUSIVE_KEYBOARD),
            "nothing takes the foreground back once the user clicks away"
        );
    }
}

/// `set_cursor` loads a stock `user32` cursor for every shape, so the bit
/// added 2026-10-18 is a constant too.
#[test]
fn a_named_cursor_shape_is_applied() {
    for raw_motion in [false, true] {
        assert!(
            Win32Shell::latch_caps(raw_motion).contains(ShellCaps::CURSOR_SHAPE),
            "WM_SETCURSOR answers with the shape's stock cursor"
        );
    }
}

/// `set_input_region` sets a window region, which every Windows has, so the
/// bit is a constant. Whether the pointer then passes through is
/// `win32_e2e`'s to show.
#[test]
fn an_input_region_is_applied() {
    for raw_motion in [false, true] {
        assert!(
            Win32Shell::latch_caps(raw_motion).contains(ShellCaps::INPUT_REGION),
            "SetWindowRgn takes the region"
        );
    }
}

/// `SetThreadExecutionState` is in every Windows, so the bit is a constant.
/// That the thread's state follows the windows asking is `awake`'s tests' to
/// show, and that a destroyed window lets go is
/// `a_destroyed_window_stops_keeping_the_display_on`'s.
#[test]
fn the_display_can_be_kept_on() {
    for raw_motion in [false, true] {
        assert!(
            Win32Shell::latch_caps(raw_motion).contains(ShellCaps::IDLE_INHIBIT),
            "SetThreadExecutionState holds the display"
        );
    }
}

/// `ShellExecuteW` is in every Windows, so the bit is a constant. The call
/// itself opens a browser, so no test here makes it.
#[test]
fn a_url_can_be_opened() {
    for raw_motion in [false, true] {
        assert!(
            Win32Shell::latch_caps(raw_motion).contains(ShellCaps::OPEN_URL),
            "ShellExecuteW opens the browser"
        );
    }
}

/// This thread's `ES_DISPLAY_REQUIRED`, read by setting `ES_CONTINUOUS` and
/// putting back what that replaced.
fn display_required() -> bool {
    // SAFETY: flag words by value; together the two calls leave this thread's
    // execution state where they found it.
    let previous = unsafe { ffi::SetThreadExecutionState(ffi::value::ES_CONTINUOUS) };
    assert_ne!(previous, 0, "SetThreadExecutionState refused");
    // SAFETY: as above.
    assert_ne!(unsafe { ffi::SetThreadExecutionState(previous) }, 0);
    previous & ffi::value::ES_DISPLAY_REQUIRED != 0
}

/// The shell's half of `awake`'s bookkeeping: a destroyed window's request
/// ends with it, and a stale handle is refused. The window is created hidden
/// and never shown.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_destroyed_window_stops_keeping_the_display_on() {
    let mut shell = shell();
    let window = shell
        .create_window(&WindowDesc {
            visible: false,
            ..WindowDesc::default()
        })
        .expect("create hidden");
    assert!(!display_required(), "nothing asked yet");
    shell
        .set_idle_inhibit(window, true)
        .expect("keeping the display on");
    assert!(display_required());
    shell.destroy_window(window).expect("destroy");
    assert!(!display_required(), "the destroyed window let go");
    assert!(matches!(
        shell.set_idle_inhibit(window, true),
        Err(ShellError::InvalidWindow { .. })
    ));
    assert!(!display_required());
}

/// The icon a window shows in `slot`, as `WM_GETICON` answers.
fn icon_of(hwnd: Handle, slot: usize) -> Handle {
    // SAFETY: a live window of this thread; `WM_GETICON` reads nothing of ours.
    unsafe { ffi::SendMessageW(hwnd, msg::GET_ICON, slot, 0) as Handle }
}

/// A window takes the executable's icons at its own DPI, and new ones when
/// that DPI changes; the class's stay underneath. The test binary embeds no
/// icon, so `shell32.dll` mapped as a resource file stands in as the
/// executable's. The window is created hidden and never shown.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_takes_the_executable_icon_at_its_dpi() {
    let module = super::super::icon::tests::shell32();
    let mut shell = shell();
    // SAFETY: `module` stays mapped until after the shell, the only holder
    // of the source, is dropped.
    shell.icon_source = unsafe { icon::IconSource::of(module) }.map(Rc::new);
    let window = shell
        .create_window(&WindowDesc {
            visible: false,
            ..WindowDesc::default()
        })
        .expect("create hidden");
    let hwnd = hwnd_of(&shell, window);
    let side = |metric, dpi| {
        // SAFETY: an index and a DPI by value.
        let side = unsafe { ffi::GetSystemMetricsForDpi(metric, dpi) };
        Some((side, side))
    };
    let pixel_size = super::super::icon::tests::pixel_size;
    let dpi = shell.window(window).expect("live").dpi;
    let big = icon_of(hwnd, ffi::value::ICON_BIG);
    assert_eq!(pixel_size(big), side(ffi::value::SM_CX_ICON, dpi));
    assert_eq!(
        pixel_size(icon_of(hwnd, ffi::value::ICON_SMALL)),
        side(ffi::value::SM_CX_SM_ICON, dpi)
    );

    // A move to a monitor at another scale, as the system reports one: the
    // window's own rectangle as the suggestion, so it stays where it is.
    let new_dpi = if dpi == 192 { 96 } else { 192 };
    let mut rect = Rect::default();
    // SAFETY: a live out-parameter and this test's own window.
    assert_ne!(unsafe { ffi::GetWindowRect(hwnd, &raw mut rect) }, 0);
    // SAFETY: `WM_DPICHANGED`'s `lParam` is the suggested rectangle, live
    // for the synchronous call.
    unsafe {
        ffi::SendMessageW(
            hwnd,
            msg::DPI_CHANGED,
            (new_dpi | new_dpi << 16) as usize,
            (&raw const rect) as Lparam,
        )
    };
    shell.pump(&mut |_| {});
    assert_eq!(shell.window(window).expect("live").dpi, new_dpi);
    let replaced = icon_of(hwnd, ffi::value::ICON_BIG);
    assert_ne!(replaced, big, "a new icon, not the old one stretched");
    assert_eq!(pixel_size(big), None, "the replaced icon was destroyed");
    assert_eq!(pixel_size(replaced), side(ffi::value::SM_CX_ICON, new_dpi));
    assert_eq!(
        pixel_size(icon_of(hwnd, ffi::value::ICON_SMALL)),
        side(ffi::value::SM_CX_SM_ICON, new_dpi)
    );

    shell.destroy_window(window).expect("destroy");
    assert_eq!(pixel_size(replaced), None, "destroyed with the window");
    drop(shell);
    // SAFETY: mapped above, and nothing holds the source now.
    unsafe { ffi::FreeLibrary(module) };
}

/// Nothing in a plain `HWND`'s messages paces presents, so a frame is answered
/// at the next pump and the bit says the compositor is not the one pacing.
#[test]
fn frames_are_not_paced_by_the_compositor() {
    for raw_motion in [false, true] {
        assert!(!Win32Shell::latch_caps(raw_motion).contains(ShellCaps::FRAME_CALLBACK));
    }
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_capabilities_are_exactly_what_this_backend_implements() {
    let mut shell = shell();
    let window = window(&mut shell);
    let caps = shell.caps();
    for present in [
        ShellCaps::MULTI_WINDOW,
        ShellCaps::EVENT_WAIT,
        ShellCaps::WINDOW_POSITION,
        ShellCaps::SERVER_DECORATIONS,
        ShellCaps::FRACTIONAL_SCALE,
        ShellCaps::ASPECT_HINT_HONORED,
        ShellCaps::POINTER_LOCK,
        ShellCaps::POINTER_CONFINE,
        ShellCaps::POINTER_WARP,
        ShellCaps::CLIPBOARD,
        ShellCaps::DRAG_DROP,
        ShellCaps::TEXT_IME,
        ShellCaps::TEXT_COMPOSE,
        ShellCaps::TOUCH,
        ShellCaps::PANEL,
        ShellCaps::PANEL_RESERVE,
        ShellCaps::POPUP,
        ShellCaps::POPUP_REPOSITION,
        ShellCaps::TRANSPARENT,
        ShellCaps::CURSOR_SHAPE,
        ShellCaps::INPUT_REGION,
        ShellCaps::IDLE_INHIBIT,
        ShellCaps::OPEN_URL,
    ] {
        assert!(caps.contains(present), "{present:?} is implemented");
    }
    // Latched from the registration rather than assumed — the one bit on
    // this backend that is not a constant.
    assert!(
        caps.contains(ShellCaps::RAW_POINTER_MOTION),
        "RegisterRawInputDevices was refused on this runner, which is a finding"
    );
    assert!(caps.has_mouselook(), "both halves, which is the point");

    // Clear, for a stated reason: a plain `HWND` presents at its own size.
    // A capability that overstates itself is worse than one that is missing.
    assert!(!caps.contains(ShellCaps::HW_UPSCALE));
    assert!(!caps.contains(ShellCaps::PANEL_EXCLUSIVE_KEYBOARD));
    assert!(!caps.contains(ShellCaps::FRAME_CALLBACK));
    assert_eq!(caps, shell.caps(), "latched for the shell's lifetime");

    // And the methods agree with the bits, which is what makes them
    // checkable rather than decorative.
    assert!(shell.clipboard_offer(window, &[]).is_ok());
    assert!(shell.clipboard_request(window, MimeType::TextUtf8).is_ok());
    assert!(
        shell.clipboard_readable(window),
        "Win32 has no focus gate, so the trait's default is exactly right"
    );
    for mode in [
        PointerMode::Free,
        PointerMode::Confined,
        PointerMode::Locked,
        PointerMode::Free,
    ] {
        assert!(
            shell.set_pointer_mode(window, mode).is_ok(),
            "{mode:?} is claimed by the capability set"
        );
        assert_eq!(shell.window_state(window).expect("live").pointer_mode, mode);
    }
    assert!(shell.warp_pointer(window, PhysicalPoint::ORIGIN).is_ok());
    assert!(
        shell
            .set_cursor(window, Some(CursorIcon::Crosshair))
            .is_ok()
    );
    assert!(shell.set_cursor(window, None).is_ok());
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_key_press_carries_its_position_its_symbol_and_its_repeat_flag() {
    // The real window procedure, the real scan-code table, the real
    // `GetKeyboardState` and the real `MapVirtualKeyW` — driven by a
    // message CI has no keyboard to send.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    send_key(hwnd, msg::KEY_DOWN, VK_W, 0x0011, false, false);
    send_key(hwnd, msg::KEY_DOWN, VK_W, 0x0011, false, true);
    send_key(hwnd, msg::KEY_UP, VK_W, 0x0011, false, true);
    // An extended key, which is the half a dropped `E0` bit gets wrong.
    send_key(hwnd, msg::KEY_DOWN, VK_UP, 0x0048, true, false);

    let keys = pump_keys(&mut shell);
    assert_eq!(keys.len(), 4, "{keys:?}");
    let (scancode, key_code, keysym, state, repeat) = keys[0];
    assert_eq!(scancode, Scancode(0x0011));
    assert_eq!(key_code, Some(KeyCode::KeyW));
    assert_eq!(state, ButtonState::Pressed);
    assert!(!repeat, "the first press is not a repeat");
    assert_eq!(
        keysym.to_char(),
        Some('w'),
        "a US layout labels this key w; a different layout is a different \
             letter and still a character"
    );

    assert!(keys[1].4, "the second press is the system repeating it");
    assert_eq!(keys[2].3, ButtonState::Released);
    assert!(
        !keys[2].4,
        "bit 30 is always set on a release and must not be read there"
    );

    assert_eq!(keys[3].0, Scancode(0xE048), "the E0 prefix is folded in");
    assert_eq!(keys[3].1, Some(KeyCode::ArrowUp));
    assert_eq!(keys[3].2, Keysym(0xFF52), "XK_Up, from the named table");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_key_injected_with_no_scan_code_is_named_from_its_virtual_key() {
    /// `VK_CONTROL`, the generic one a key message carries.
    const VK_CONTROL: usize = 0x11;
    /// `VK_ESCAPE`.
    const VK_ESCAPE: usize = 0x1B;
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    // What SendKeys, a remote desktop client or AutoHotkey sends: the virtual
    // key and a zero scan code, with the extended flag where it set one.
    send_key(hwnd, msg::KEY_DOWN, VK_ESCAPE, 0, false, false);
    send_key(hwnd, msg::KEY_DOWN, VK_UP, 0, false, false);
    send_key(hwnd, msg::KEY_DOWN, VK_CONTROL, 0, true, false);

    let keys = pump_keys(&mut shell);
    assert_eq!(keys.len(), 3, "{keys:?}");
    assert_eq!(keys[0].1, Some(KeyCode::Escape));
    assert_eq!(keys[0].0, Scancode(0), "the scan code the message carried");
    // The real `MapVirtualKeyW` answers the keypad's byte for the arrow; the
    // virtual key is what puts it back on the navigation block.
    assert_eq!(keys[1].1, Some(KeyCode::ArrowUp));
    assert_eq!(keys[2].1, Some(KeyCode::ControlRight));
    assert_eq!(keys[2].0, Scancode(0xE000));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_key_the_input_method_consumed_reaches_the_consumer_on_neither_edge() {
    /// `VK_BACK`.
    const VK_BACK: usize = 0x08;
    /// `VK_A`.
    const VK_A: usize = 0x41;
    let process = usize::from(value::VK_PROCESS_KEY);
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    // Backspace inside a composition, released under its real virtual key;
    // then Enter committing it, released as VK_PROCESSKEY as well.
    send_key(hwnd, msg::KEY_DOWN, process, 0x000E, false, false);
    send_key(hwnd, msg::KEY_UP, VK_BACK, 0x000E, false, true);
    send_key(hwnd, msg::KEY_DOWN, process, 0x001C, false, false);
    send_key(hwnd, msg::KEY_UP, process, 0x001C, false, true);
    // And a key the input method let through, which is still a key.
    send_key(hwnd, msg::KEY_DOWN, VK_W, 0x0011, false, false);

    let keys = pump_keys(&mut shell);
    assert_eq!(keys.len(), 1, "only W is the consumer's: {keys:?}");
    assert_eq!(keys[0].1, Some(KeyCode::KeyW));

    // A focus loss forgets a consumed press: the release of that key, once
    // the keyboard is back, belongs to a press made elsewhere and is a key.
    focus_and_confirm(&mut shell, window, hwnd);
    send_key(hwnd, msg::KEY_DOWN, process, 0x001E, false, false);
    send_focus(hwnd, false);
    shell.pump(&mut |_| {});
    send_key(hwnd, msg::KEY_UP, VK_A, 0x001E, false, true);
    let keys = pump_keys(&mut shell);
    assert_eq!(keys.len(), 1, "the release is reported: {keys:?}");
    assert_eq!(keys[0].1, Some(KeyCode::KeyA));
    assert_eq!(keys[0].3, ButtonState::Released);
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn typing_commits_text_and_a_control_key_commits_nothing() {
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    // A BMP character, then a surrogate pair, then the carriage return
    // Windows really does deliver when Enter is pressed.
    for unit in [
        u32::from(b'a'),
        0x3042, // あ
        0xD83C, // 🎮, high half
        0xDFAE, // 🎮, low half
        0x000D, // Enter
        0x0008, // Backspace
    ] {
        // SAFETY: `WM_CHAR` to this shell's own window, with `wParam` the
        // UTF-16 code unit the system would have put there.
        unsafe { ffi::SendMessageW(hwnd, msg::CHAR, unit as usize, 0) };
    }

    let mut text = String::new();
    shell.pump(&mut |event| {
        if let ShellEvent::TextCommit { text: piece, .. } = event {
            text.push_str(&piece);
        }
    });
    assert_eq!(
        text, "aあ🎮",
        "the pair is one character and the controls are not text"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_pointer_enters_moves_clicks_scrolls_and_leaves() {
    /// Where this test's **first** movement puts the pointer, and therefore
    /// the position the arrival derived from it carries.
    ///
    /// This is the payload that identifies a crossing as ours: a real
    /// movement reports where the physical cursor actually is, so no event
    /// the desktop contributes carries this point.
    const ARRIVED_AT: PhysicalPoint = PhysicalPoint::new(40.0, 30.0);
    /// Where the **second** movement puts it. No arrival may carry this:
    /// the pointer is already inside by then, and `TrackMouseEvent` is
    /// re-armed only on a transition.
    const MOVED_TO: PhysicalPoint = PhysicalPoint::new(41.0, 31.0);

    let mut shell = shell();
    let window = window(&mut shell);
    let hwnd = hwnd_of(&shell, window);

    // **A Windows desktop has a real cursor on it, and it is somewhere.**
    // Showing a window under it delivers a genuine `WM_MOUSEMOVE` that
    // derives the arrival before this test sends anything, so the first
    // synthetic movement below is then not the first movement at all. That
    // is not a runner quirk — it is true of any machine where the pointer
    // happens to be over the new window, this developer's included.
    //
    // The leave is what puts the derived state on a known edge: the backend
    // ignores one for a pointer it already thinks is outside, so this is
    // either a no-op or exactly the transition needed. Nothing here moves the
    // cursor, which would only trade one assumption about the environment for
    // another.
    //
    // # The drain comes *before* the leave, and the order is the whole fix
    //
    // It used to be the other way round, and a `windows-latest` run collected
    // `[(false, None)]` — a leave with no arrival in front of it. The
    // sequence explains itself once written out: the leave marked the pointer
    // outside, then the discarding pump dispatched a **real** `WM_MOUSEMOVE`
    // the desktop had queued, which derived the arrival and threw it away,
    // and the synthetic movements that followed found the pointer already
    // inside. The runner delivers real motion every few milliseconds, so this
    // was never a rare interleaving.
    //
    // Draining first and leaving second closes the gap completely, because
    // `send_mouse` and `send_leave` are `SendMessageW`: they call the window
    // procedure **synchronously**, and nothing between the leave and the
    // first movement pumps. No queued message can be processed in that
    // window, so the arrival below is derived from this test's own movement
    // and from nothing else. What the desktop queued meanwhile is dispatched
    // during the collecting pump — *after* everything sent here, because
    // `pump` translates what the procedure recorded in the order it recorded
    // it. What that does **not** buy is a known position in the sequence:
    // the discarding pump above runs before any of it and can leave a
    // crossing of the desktop's in front, which is what the assertions below
    // are written around.
    shell.pump(&mut |_| {});
    let frame = super::input::client_screen_rect(hwnd).expect("a live window has one");
    send_leave(hwnd);

    // A movement into a window nothing has been over is an arrival, and
    // Windows sends no message for that — it is derived.
    send_mouse(hwnd, msg::MOUSE_MOVE, 0, 40, 30);
    send_mouse(hwnd, msg::MOUSE_MOVE, 0, 41, 31);
    // A press and its release, which also takes and gives back the capture.
    send_mouse(hwnd, msg::L_BUTTON_DOWN, 0, 41, 31);
    send_mouse(hwnd, msg::L_BUTTON_UP, 0, 41, 31);
    // The thumb button, whose identity is in the *high* word.
    send_mouse(hwnd, msg::X_BUTTON_DOWN, 1 << 16, 41, 31);
    send_mouse(hwnd, msg::X_BUTTON_UP, 1 << 16, 41, 31);
    // The wheel, whose position is in **screen** coordinates.
    send_mouse(
        hwnd,
        msg::MOUSE_WHEEL,
        (120usize) << 16,
        frame.left + 41,
        frame.top + 31,
    );
    send_leave(hwnd);

    // Collected rather than compared position by position: a runner whose
    // physical cursor happens to sit over the window contributes real
    // messages of its own, and the claim under test is that ours produced
    // the events below — not that nothing else did.
    let mut names = Vec::new();
    let mut motions = Vec::new();
    let mut buttons = Vec::new();
    let mut wheel = None;
    // Every crossing, carried with the number of movements seen ahead of
    // it. That count is what pairs an arrival with the movement it was
    // derived from: the procedure pushes the derived arrival *before* the
    // motion that triggered it, so the motion sits at exactly that index.
    // Kept alongside rather than compared on the spot so the failure can
    // print both sides.
    let mut crossings: Vec<(bool, Option<PhysicalPoint>, usize)> = Vec::new();
    shell.pump(&mut |event| {
        names.push(event.name());
        match event {
            ShellEvent::PointerMotion { abs, raw_delta, .. } => {
                motions.push(abs);
                assert_eq!(raw_delta, None, "WM_MOUSEMOVE is not raw motion");
            }
            ShellEvent::Button {
                button,
                state,
                position,
                ..
            } => buttons.push((button, state, position)),
            ShellEvent::Wheel {
                delta, position, ..
            } => wheel = Some((delta, position)),
            ShellEvent::PointerFocus {
                entered, position, ..
            } => crossings.push((entered, position, motions.len())),
            _ => {}
        }
    });

    // **Our own crossings are found by their payload, never by their
    // index**, and nothing at all is claimed about the ones the desktop
    // contributes.
    //
    // # Three runs, three failures, and the fourth shape is different in kind
    //
    // This assertion has now been rewritten three times, each version
    // assuming a slightly quieter machine than the last, and `windows-latest`
    // voted against every one. The last of them required the first crossing
    // to be an arrival, and came back with:
    //
    // ```text
    // the first crossing after a leave is the arrival:
    //   [(false, None), (true, Some(PhysicalPoint { x: 40.0, y: 30.0 })), (false, None)]
    //   out of ["PointerFocus", "PointerFocus", "PointerMotion", "PointerMotion",
    //           "Button", ×4, "Wheel", "PointerFocus", "Focus"]
    // ```
    //
    // A leave in front, then our arrival at the injected point, then our
    // leave. The discarding pump above had dispatched a real `WM_MOUSEMOVE`
    // whose derived arrival it threw away, so `send_leave` was a genuine
    // transition rather than the no-op it is on a still desktop — and a
    // crossing nothing in this test's own sequence accounts for was sitting
    // ahead of everything.
    //
    // So the shape changed rather than tightening again: **a live desktop is
    // entitled to insert crossings before, between and after ours**, and any
    // claim about position-in-the-sequence is a claim that it held still.
    // What this test injected is identifiable — the arrival it derives
    // carries [`ARRIVED_AT`], which is a point no real movement reports —
    // so the property is stated about that pair and about nothing else:
    //
    // * an arrival carries the position this test moved to,
    // * the movement it was derived from is the very next motion in the
    //   stream, since the procedure pushes the arrival ahead of it,
    // * the crossing straight after it is a leave carrying no position —
    //   this test's own, and nothing can be dispatched between the two
    //   because every `send_*` here is a synchronous `SendMessageW`, and
    // * **no arrival carries [`MOVED_TO`]**, which is the one-shot claim:
    //   `TrackMouseEvent` is re-armed only on a transition, so a backend
    //   deriving an arrival per movement would announce the second movement
    //   as an arrival too.
    let ours = crossings
        .iter()
        .position(|(entered, at, _)| *entered && *at == Some(ARRIVED_AT))
        .unwrap_or_else(|| {
            panic!(
                "no arrival carried {ARRIVED_AT:?}, which is where this test's first \
                     movement put the pointer: {crossings:?} out of {names:?}"
            )
        });
    let derived_from = crossings[ours].2;
    assert_eq!(
        motions.get(derived_from).copied(),
        Some(Some(ARRIVED_AT)),
        "an arrival carries the position of the movement it was derived from, and that \
             movement is still delivered: motion {derived_from} of {motions:?}. Events {names:?}"
    );
    assert_eq!(
        crossings
            .get(ours + 1)
            .map(|(entered, at, _)| (*entered, *at)),
        Some((false, None)),
        "the leave this test sent follows its arrival and carries no position; every \
             message between the two is a synchronous SendMessageW, so nothing else can be \
             dispatched in there: {crossings:?} out of {names:?}"
    );
    assert!(
        !crossings
            .iter()
            .any(|(entered, at, _)| *entered && *at == Some(MOVED_TO)),
        "the pointer was already inside by the second movement, so {MOVED_TO:?} is a \
             movement and not an arrival; announcing it would mean TrackMouseEvent is re-armed \
             per message rather than per transition: {crossings:?} out of {names:?}"
    );
    assert!(motions.contains(&Some(MOVED_TO)), "{motions:?}");
    assert_eq!(
        buttons,
        vec![
            (PointerButton::Left, ButtonState::Pressed, Some(MOVED_TO)),
            (PointerButton::Left, ButtonState::Released, Some(MOVED_TO)),
            (PointerButton::Back, ButtonState::Pressed, Some(MOVED_TO)),
            (PointerButton::Back, ButtonState::Released, Some(MOVED_TO)),
        ],
        "{names:?}"
    );
    let (delta, position) = wheel.expect("the wheel scrolled: {names:?}");
    assert_eq!(delta, ScrollDelta::Lines { x: 0.0, y: 1.0 });
    assert_eq!(
        position,
        Some(MOVED_TO),
        "the screen coordinates a wheel message carries were converted"
    );
}

// **Held out of the ordinary sweep.** This test and
// `minimizing_a_captured_window_releases_the_clip` compare a clip rectangle
// the system applied against one this process computed, and both operands
// move underneath it when anything else is using the desktop. They were
// `#[ignore]`d after flakes on the `windows-latest` sweep, and briefly put back
// on 2026-10-23 on CI evidence (every run of the real-desktop job green, and a
// 20-round loop on a sweep runner). They came straight back out: un-ignored,
// they run in every developer's plain `cargo nextest run`, which clips and
// warps the cursor of the desktop being worked at, and one failed there the
// same day on a desktop in use. The `win32 e2e (real desktop)` job runs them on
// every push through `run-win32-e2e.ps1`'s `--run-ignored all`, so the sweep
// added nothing that job does not already gate. Deleting them was never the
// alternative: a process that keeps the cursor clipped after losing focus has
// taken the desktop hostage.
#[ignore = "clips and warps the real cursor; run-win32-e2e.ps1 runs it"]
#[test]
fn confining_the_pointer_clips_it_and_losing_focus_gives_the_desktop_back() {
    // The hazard that a compile cannot catch: a process that keeps the
    // cursor clipped after it stops being the foreground window has taken
    // the desktop hostage. The clip is read back from the *system*, because
    // that is the thing being claimed.
    //
    // What the clip is compared against is **not** the client rectangle,
    // and the difference is the runner's answer rather than a loosening.
    // `ClipCursor` intersects with the virtual screen before it applies: the
    // Windows runner's display is 1024×768, which is smaller than the
    // default 1280×720 window once the frame is added, so the clip came back
    // 12 px narrower on the right and the right edge was exactly the screen
    // width. Asserting the client rectangle asserts something the API does
    // not promise; asserting the intersection asserts what it does, and it
    // is the same clamp a game meets on a 1366×768 laptop.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);
    let client = super::input::client_screen_rect(hwnd).expect("a live window has one");
    let clipped = client.intersect(virtual_screen());
    assert_ne!(clip_rect(), clipped, "nothing is clipped to start with");

    // The clip follows the focus, so the window has to have it. CI cannot
    // click on a window; the message is what a click would have produced,
    // and the foreground call is what makes `ClipCursor` allowed at all.
    focus_and_confirm(&mut shell, window, hwnd);

    shell
        .set_pointer_mode(window, PointerMode::Confined)
        .expect("POINTER_CONFINE is claimed");
    assert_eq!(clip_rect(), clipped, "the pointer is bounded by the window");

    // **Released synchronously**, inside the window procedure, without a
    // pump — one frame of a hostage desktop is one frame too many.
    send_focus(hwnd, false);
    assert_ne!(clip_rect(), clipped, "focus loss releases the clip");

    // And it comes back with the focus, because the request has not been
    // withdrawn.
    send_focus(hwnd, true);
    assert_eq!(clip_rect(), clipped);
    shell.pump(&mut |_| {});

    // The other order: a mode asked for while the window does **not** have
    // the keyboard gets no clip — the hostage rule does not care why the
    // focus is missing — and takes effect when the keyboard arrives, rather
    // than being lost.
    shell
        .set_pointer_mode(window, PointerMode::Free)
        .expect("start from nothing");
    send_focus(hwnd, false);
    shell.pump(&mut |_| {});
    shell
        .set_pointer_mode(window, PointerMode::Confined)
        .expect("asking is allowed whether or not it takes effect now");
    assert_ne!(
        clip_rect(),
        clipped,
        "an unfocused window does not get the pointer"
    );
    send_focus(hwnd, true);
    assert_eq!(
        clip_rect(),
        clipped,
        "and gets it when the keyboard arrives"
    );
    shell.pump(&mut |_| {});

    // Going back to free withdraws it for good.
    shell
        .set_pointer_mode(window, PointerMode::Free)
        .expect("free always works");
    assert_ne!(clip_rect(), clipped);
    send_focus(hwnd, true);
    assert_ne!(clip_rect(), clipped, "and focus does not resurrect it");
}

// **Held out of the ordinary sweep.** This test and
// `minimizing_a_captured_window_releases_the_clip` compare a clip rectangle
// the system applied against one this process computed, and both operands
// move underneath it when anything else is using the desktop. They were
// `#[ignore]`d after flakes on the `windows-latest` sweep, and briefly put back
// on 2026-10-23 on CI evidence (every run of the real-desktop job green, and a
// 20-round loop on a sweep runner). They came straight back out: un-ignored,
// they run in every developer's plain `cargo nextest run`, which clips and
// warps the cursor of the desktop being worked at, and one failed there the
// same day on a desktop in use. The `win32 e2e (real desktop)` job runs them on
// every push through `run-win32-e2e.ps1`'s `--run-ignored all`, so the sweep
// added nothing that job does not already gate. Deleting them was never the
// alternative: a process that keeps the cursor clipped after losing focus has
// taken the desktop hostage.
#[ignore = "clips and warps the real cursor; run-win32-e2e.ps1 runs it"]
#[test]
fn minimizing_a_captured_window_releases_the_clip() {
    // A minimized window is 0×0, and `client_screen_rect` maps both corners
    // of that through `ClientToScreen` to the *same* point — so a clip
    // re-applied from it pins the cursor there for the whole minimized
    // period. The window is minimized for real rather than handed a
    // synthetic `WM_SIZE(SIZE_MINIMIZED)`: the degenerate 0×0 client
    // rectangle only exists for an actually-iconic window.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    focus_and_confirm(&mut shell, window, hwnd);

    shell
        .set_pointer_mode(window, PointerMode::Confined)
        .expect("POINTER_CONFINE is claimed");
    // **Read after the clip exists, never before it.** Both operands move:
    // the window can be repositioned by the desktop, and this runner
    // changes its display set mid-run — the same behaviour that made
    // `refresh_clip` refuse a degenerate refresh. A rectangle captured
    // before the call and compared after it turns any of that into a
    // failure of this assertion, which is about whether confining clips to
    // the client area at all.
    let clipped = confined_to_client(hwnd);
    assert_eq!(clip_rect(), clipped, "the pointer is bounded by the window");

    // SAFETY: this shell's own window; SW_MINIMIZE is a documented command.
    unsafe { ffi::ShowWindow(hwnd, value::SW_MINIMIZE) };
    shell.pump(&mut |_| {});
    let released = clip_rect();
    assert!(
        released.right > released.left && released.bottom > released.top,
        "a minimized captured window must not pin the cursor to a point: {released:?}"
    );
    assert_ne!(
        released, clipped,
        "the clip is released, not re-applied from the 0×0 client area"
    );

    // SAFETY: this shell's own window; SW_RESTORE is a documented command.
    unsafe { ffi::ShowWindow(hwnd, value::SW_RESTORE) };
    shell.pump(&mut |_| {});
    // **The keyboard has to come back before the clip can.** `refresh_clip`
    // applies to a captured window only while it is focused, and minimizing
    // took the focus away — so on a runner where something else grabs the
    // foreground in between, restore leaves the clip released and the
    // assertion below reports the *rectangle* being wrong when the real
    // answer is that nobody was focused. What this test is about is which
    // rectangle a restore re-clips from, not who ends up focused.
    focus_and_confirm(&mut shell, window, hwnd);
    // Recomputed, for the reason the confine above is: `clipped` describes
    // a desktop that may have moved since, and this assertion is about
    // which rectangle a restore clips from.
    let restored = confined_to_client(hwnd);
    // Recomputing costs the comparison its teeth if the window is somehow
    // still minimized, because then both sides are the 0×0 area and agree.
    // The defect this test exists for is a restore that clips from exactly
    // that, so the rectangle it compares against has to be a real one.
    assert!(
        restored.right > restored.left && restored.bottom > restored.top,
        "the window did not actually restore, so the comparison below \
             would pass on two degenerate rectangles: {restored:?}"
    );
    assert_eq!(
        clip_rect(),
        restored,
        "restore re-clips from the real client rectangle"
    );

    // Going back to free withdraws it for good.
    shell
        .set_pointer_mode(window, PointerMode::Free)
        .expect("free always works");
    assert_ne!(clip_rect(), clipped);
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_second_window_takes_the_pointer_capture_from_the_first() {
    // One cursor, so one clip. A shell with two windows must not leave the
    // first one reporting `Locked` while the second holds the clip.
    let mut shell = shell();
    let first = window(&mut shell);
    let second = shell
        .create_window(&WindowDesc {
            title: "crcbl P5C W2 — second",
            size: LogicalSize::new(640.0, 480.0),
            ..WindowDesc::default()
        })
        .expect("a second window");
    shell.pump(&mut |_| {});

    shell
        .set_pointer_mode(first, PointerMode::Locked)
        .expect("lock");
    shell
        .set_pointer_mode(second, PointerMode::Confined)
        .expect("confine");
    assert_eq!(
        shell.window_state(first).expect("live").pointer_mode,
        PointerMode::Free,
        "the first window no longer holds anything"
    );
    assert_eq!(
        shell.window_state(second).expect("live").pointer_mode,
        PointerMode::Confined
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn hiding_the_cursor_is_balanced_however_many_times_it_is_asked_for() {
    // The `ShowCursor` reference-count bug, observed through the count
    // itself: two hides and one show leave the cursor invisible for the
    // rest of the process's life, with no error anywhere.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    // **Focus first, and proved rather than assumed** — every count below
    // is a consequence of it, because `refresh_cursor_visibility` hides
    // only for a window that has the keyboard. See [`focus_and_confirm`].
    focus_and_confirm(&mut shell, window, hwnd);
    // **Read after the focus, not before it.** A count taken first is a
    // count from a different focus state, and the difference would be
    // charged to `set_cursor`.
    let baseline = cursor_display_count();

    shell.set_cursor(window, None).expect("hide");
    assert_eq!(cursor_display_count(), baseline - 1, "one hide is owed");
    shell.set_cursor(window, None).expect("hide again");
    assert_eq!(
        cursor_display_count(),
        baseline - 1,
        "asking twice must not owe two shows"
    );

    shell
        .set_cursor(window, Some(CursorIcon::Text))
        .expect("a shape reveals it again");
    assert_eq!(cursor_display_count(), baseline);
    shell
        .set_cursor(window, Some(CursorIcon::Crosshair))
        .expect("and another shape changes nothing about visibility");
    assert_eq!(cursor_display_count(), baseline);

    // Losing focus gives the cursor back, which is what stops a game in
    // mouselook leaving the desktop without a pointer.
    shell.set_cursor(window, None).expect("hide");
    assert_eq!(cursor_display_count(), baseline - 1);
    send_focus(hwnd, false);
    shell.pump(&mut |_| {});
    assert_eq!(cursor_display_count(), baseline, "focus loss reveals it");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_cursor_shape_is_answered_from_the_window_procedure() {
    // `WM_SETCURSOR` is the only message allowed to set a shape, and the
    // system uses `DefWindowProc`'s answer — the class arrow — unless ours
    // says it handled it. Sending the message runs exactly the path a
    // mouse movement would.
    let mut shell = shell();
    let window = window(&mut shell);
    shell
        .set_cursor(window, Some(CursorIcon::Text))
        .expect("an I-beam is a stock Windows cursor");
    let hwnd = hwnd_of(&shell, window);

    // SAFETY: `WM_SETCURSOR` to this shell's own window. `wParam` is the
    // window under the cursor and `lParam` packs the hit-test code in its
    // low word and the triggering message in its high one.
    let handled = unsafe {
        ffi::SendMessageW(
            hwnd,
            msg::SET_CURSOR,
            hwnd as usize,
            value::HT_CLIENT as isize,
        )
    };
    assert_eq!(handled, 1, "the shape was applied, not the class cursor");

    // The frame is the system's: answering for it would replace the resize
    // arrows on the window border with an I-beam.
    const HT_BOTTOM_RIGHT: isize = 17;
    // SAFETY: as above, with the hit-test code for a corner of the frame.
    let frame = unsafe { ffi::SendMessageW(hwnd, msg::SET_CURSOR, hwnd as usize, HT_BOTTOM_RIGHT) };
    assert_ne!(frame, 1, "the non-client area is left to DefWindowProc");
}

// **The third test of this class, held out with the two above.**
// Windows refuses `SetCursorPos` from a process that is not in
// the foreground, so this test's real precondition is the foreground
// having taken — which nothing on a shared runner guarantees, and which
// `focus_and_confirm` now checks with the system before the warp. It failed
// on `5889a3c`, a commit that changed a JavaScript file and two markdown
// files, reading back exactly the client origin: the warp had not moved the
// pointer at all.
//
// What that flake bought was a real defect, now fixed: `warp_to_client`
// discarded `SetCursorPos`'s `BOOL`, so a warp that moved nothing returned
// success and the mismatch surfaced here as a coordinate off by precisely
// the offset asked for. It now returns `ShellError::Backend`, which is why
// the `expect` below is the assertion that fires first.
#[ignore = "clips and warps the real cursor; run-win32-e2e.ps1 runs it"]
#[test]
fn warping_the_pointer_moves_it_to_a_position_in_the_window() {
    // What `POINTER_WARP` claims, and the conversion it depends on: the
    // seam is in window pixels and `SetCursorPos` is in screen ones.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);
    let client = super::input::client_screen_rect(hwnd).expect("a live window has one");
    focus_and_confirm(&mut shell, window, hwnd);

    shell
        .warp_pointer(window, PhysicalPoint::new(30.0, 20.0))
        .expect("POINTER_WARP is claimed");
    let mut point = super::super::ffi::Point::default();
    // SAFETY: `point` is a live, initialised `POINT` the call writes into.
    let read = unsafe { ffi::GetCursorPos(&raw mut point) };
    assert_ne!(read, 0, "a session with a desktop has a cursor position");
    assert_eq!(
        (point.x, point.y),
        (client.left + 30, client.top + 20),
        "the warp landed in screen space at the client offset asked for"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_decorated_window_really_is_decorated() {
    // What `SERVER_DECORATIONS` claims, observed rather than asserted from
    // the style word: a windowed window's outer rectangle is larger than
    // its client area, and a borderless one's is not.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let client = shell
        .window_state(window)
        .expect("live")
        .size()
        .expect("configured");
    let frame = Win32Shell::frame_for(
        super::super::geometry::styles(DisplayMode::Windowed, true),
        shell.window(window).expect("live").dpi,
    );
    assert!(frame.height > 0, "a caption has a height: {frame:?}");
    assert!(frame.width > 0, "a border has a width: {frame:?}");
    assert!(!client.is_empty());

    let flush = Win32Shell::frame_for(
        super::super::geometry::styles(DisplayMode::Borderless { monitor: None }, true),
        shell.window(window).expect("live").dpi,
    );
    assert_eq!(
        flush,
        super::super::geometry::Frame::default(),
        "WS_POPUP has no frame at all"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_size_constraints_reach_the_window_procedure() {
    // `WM_GETMINMAXINFO` and `WM_SIZING` are otherwise only sent by a user
    // dragging a window edge. Sending them by hand runs the real procedure
    // against the real cached limits, which is the only way to test the
    // aspect lock and the track sizes without a mouse.
    let mut shell = shell();
    let window = window(&mut shell);
    shell
        .set_constraints(
            window,
            SizeConstraints {
                min: Some(LogicalSize::new(640.0, 480.0)),
                max: Some(LogicalSize::new(1920.0, 1080.0)),
                aspect: Some(AspectRatio::WIDESCREEN),
            },
        )
        .expect("constraints are a request every backend accepts");
    let hwnd = hwnd_of(&shell, window);
    let scale = shell.window(window).expect("live").scale_factor;

    let mut info = MinMaxInfo::default();
    // SAFETY: sending a message to this shell's own window on the thread
    // that owns it; `info` is a live, initialised `MINMAXINFO` and
    // `WM_GETMINMAXINFO` is documented to take a pointer to one.
    unsafe {
        ffi::SendMessageW(
            hwnd,
            msg::GET_MIN_MAX_INFO,
            0,
            (&raw mut info) as super::super::ffi::Lparam,
        );
    }
    let min_client_width = (640.0 * scale).round() as i32;
    assert!(
        info.pt_min_track_size.x >= min_client_width,
        "the minimum is the client minimum plus the frame: {info:?}"
    );
    assert!(
        info.pt_max_track_size.x >= (1920.0 * scale).round() as i32,
        "{info:?}"
    );

    let mut rect = Rect {
        left: 100,
        top: 100,
        right: 1100,
        bottom: 1100,
    };
    // SAFETY: as above; `WM_SIZING` is documented to take a pointer to the
    // `RECT` the system is about to apply, and rewriting it is how a resize
    // is constrained.
    let handled = unsafe {
        ffi::SendMessageW(
            hwnd,
            msg::SIZING,
            super::super::ffi::value::WMSZ_RIGHT,
            (&raw mut rect) as super::super::ffi::Lparam,
        )
    };
    assert_eq!(handled, 1, "the rectangle was rewritten");
    assert_eq!(rect.width(), 1000, "the dragged edge never moves");
    assert!(
        rect.height() < 700,
        "16:9 makes a 1000-wide window a little over 560 tall: {rect:?}"
    );
    assert!(rect.height() > 450, "{rect:?}");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_close_request_is_intercepted_and_can_be_refused_then_accepted() {
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    assert!(matches!(
        shell.reply_close_request(window, CloseReply::Keep),
        Err(ShellError::NoPendingCloseRequest { .. })
    ));

    let hwnd = hwnd_of(&shell, window);
    // SAFETY: `WM_CLOSE` to this shell's own window — exactly what the
    // title bar's close button sends.
    unsafe { ffi::SendMessageW(hwnd, msg::CLOSE, 0, 0) };
    let mut asked = false;
    shell.pump(&mut |event| {
        asked |= matches!(event, ShellEvent::CloseRequested { window: asked } if asked == window);
    });
    assert!(asked, "WM_CLOSE is a question, not a notification");
    assert!(
        shell
            .window_state(window)
            .expect("still open")
            .close_pending
    );

    shell
        .reply_close_request(window, CloseReply::Keep)
        .expect("refusing is allowed");
    assert!(
        shell.window_state(window).is_ok(),
        "the window survives a refusal — DefWindowProc would have destroyed it"
    );
    assert!(!shell.window_state(window).expect("open").close_pending);

    // SAFETY: as above.
    unsafe { ffi::SendMessageW(hwnd, msg::CLOSE, 0, 0) };
    shell.pump(&mut |_| {});
    shell
        .reply_close_request(window, CloseReply::Close)
        .expect("and accepting closes it");
    assert!(matches!(
        shell.window_state(window),
        Err(ShellError::InvalidWindow { .. })
    ));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn both_offered_formats_round_trip_and_the_reader_picks() {
    // What `CLIPBOARD` claims, against the real window station: text for
    // everything else on the desktop, a registered format for the engine's
    // own, and both on the clipboard at once so the reader chooses. The RON
    // has to come back **byte for byte** — a blob carrying the heap's
    // padding would not parse.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});

    const RON: &str = "(kind:\"node\",id:7,name:\"日本語 🎮\")";
    shell
        .clipboard_offer(
            window,
            &[ClipboardOffer::text("hello 🎮"), ClipboardOffer::ron(RON)],
        )
        .expect("claiming the clipboard needs no user interaction on Win32");
    assert!(
        !clipboard_held_by(hwnd_of(&shell, window)),
        "the guard closed the clipboard on the way out of the offer"
    );

    assert_eq!(
        paste(&mut shell, window, MimeType::TextUtf8).text(),
        Some("hello 🎮"),
        "an astral codepoint survives the UTF-16 round trip"
    );
    assert_eq!(
        paste(&mut shell, window, MimeType::CrcblRon),
        ClipboardContent::Bytes(RON.as_bytes().to_vec()),
        "the engine's own format is lossless, padding and all"
    );
    assert!(
        !clipboard_held_by(hwnd_of(&shell, window)),
        "and on the way out of every read as well"
    );

    // A format that was not offered is `Empty` — "holds nothing in that
    // format", which the seam merges with an empty clipboard on purpose —
    // and emphatically not `Unavailable`, which would mean the read failed.
    assert_eq!(
        paste(&mut shell, window, MimeType::UriList),
        ClipboardContent::Empty
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn an_empty_offer_empties_the_clipboard_and_an_empty_payload_does_not() {
    // The two cases `ClipboardContent` exists to keep apart, and the one
    // place they are easy to conflate: releasing the clipboard and
    // publishing nothing.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});

    // A successful transfer of zero bytes. `Bytes(vec![])`, not `Empty` —
    // reporting `Empty` here tells an editor its paste failed when it did
    // not.
    shell
        .clipboard_offer(window, &[ClipboardOffer::text("")])
        .expect("an empty payload is a payload");
    assert_eq!(
        paste(&mut shell, window, MimeType::TextUtf8),
        ClipboardContent::Bytes(Vec::new())
    );

    // An empty *slice* is the release. Windows has no owner to give up, so
    // this is `EmptyClipboard` and afterwards there is nothing there.
    shell
        .clipboard_offer(window, &[])
        .expect("an empty slice releases");
    assert_eq!(
        paste(&mut shell, window, MimeType::TextUtf8),
        ClipboardContent::Empty
    );
    assert!(!clipboard_held_by(hwnd_of(&shell, window)));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_read_is_answered_exactly_once_and_needs_no_second_pump() {
    // Obligation 4 in the form this backend takes: the read happens inside
    // `clipboard_request`, so the answer is queued before it returns and
    // there is no list of outstanding reads to lose one from. `paste`
    // asserts the "exactly one, on the first pump" half; this asserts that
    // nothing arrives afterwards, which is the half a duplicated answer
    // would break.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    shell
        .clipboard_offer(window, &[ClipboardOffer::text("once")])
        .expect("publish");

    let first = shell
        .clipboard_request(window, MimeType::TextUtf8)
        .expect("accepted");
    let second = shell
        .clipboard_request(window, MimeType::CrcblRon)
        .expect("accepted");
    assert_ne!(first, second, "ids are unique within a shell");

    let mut answered = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::ClipboardData {
            request, content, ..
        } = event
        {
            answered.push((request, content));
        }
    });
    assert_eq!(answered.len(), 2, "one each: {answered:?}");
    assert_eq!(answered[0].0, first, "in the order they were asked");
    assert_eq!(answered[1].0, second);
    assert_eq!(answered[0].1.text(), Some("once"));
    assert_eq!(
        answered[1].1,
        ClipboardContent::Empty,
        "the RON format was not published"
    );

    let mut again = Vec::new();
    shell.pump(&mut |event| {
        if matches!(event, ShellEvent::ClipboardData { .. }) {
            again.push(event.name());
        }
    });
    assert!(
        again.is_empty(),
        "answered once, not once per pump: {again:?}"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_destroyed_before_the_pump_is_not_answered_at_all() {
    // Where obligation 4 meets obligation 1, and the stronger of the two
    // wins: an answer naming a handle the consumer has already been told is
    // stale is worse than a request that ends without one, because the
    // consumer can see the stale handle and cannot see the missing answer.
    // The X11 backend decides this the same way.
    let mut shell = shell();
    let window = window(&mut shell);
    let survivor = shell
        .create_window(&WindowDesc {
            title: "crcbl P5C W3 — survivor",
            size: LogicalSize::new(640.0, 480.0),
            ..WindowDesc::default()
        })
        .expect("a second window");
    shell.pump(&mut |_| {});
    shell
        .clipboard_offer(window, &[ClipboardOffer::text("gone")])
        .expect("publish");

    let doomed = shell
        .clipboard_request(window, MimeType::TextUtf8)
        .expect("accepted while the window was live");
    let kept = shell
        .clipboard_request(survivor, MimeType::TextUtf8)
        .expect("accepted");
    shell.destroy_window(window).expect("destroy");

    let mut answered = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::ClipboardData { request, .. } = event {
            answered.push(request);
        }
    });
    assert_eq!(
        answered,
        [kept],
        "the dead window's answer went with it and the live one's did not"
    );
    assert_ne!(doomed, kept);
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_drop_becomes_one_event_per_file_at_the_position_it_landed() {
    // What `DRAG_DROP` claims, driven through the real `WM_DROPFILES` path:
    // shell32's `DragQueryFileW` reads a real `HDROP`, the procedure
    // finishes it, and the paths reach the pump through the side queue that
    // keeps them out of a `Copy` event.
    let mut shell = shell();
    let window = drop_window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    send_drop(
        hwnd,
        &[r"C:\assets\My Scene.ron", r"C:\assets\プロジェクト.png"],
        12,
        34,
    );
    let dropped = pump_drops(&mut shell);
    assert_eq!(dropped.len(), 2, "one event per file: {dropped:?}");
    assert_eq!(dropped[0].0, window);
    assert_eq!(dropped[0].1, PathBuf::from(r"C:\assets\My Scene.ron"));
    assert_eq!(
        dropped[1].1,
        PathBuf::from(r"C:\assets\プロジェクト.png"),
        "a non-ASCII name survives UTF-16 without a lossy step"
    );
    assert_eq!(
        dropped[0].2,
        Some(PhysicalPoint::new(12.0, 34.0)),
        "the drop point is in client pixels, which is what the seam means"
    );

    // Two drops in one pump stay two drops, and each marker claims its own
    // payload — the pairing that hands one scene the other's assets when it
    // is wrong.
    send_drop(hwnd, &[r"C:\a.png"], 1, 2);
    send_drop(hwnd, &[r"C:\b.png", r"C:\c.png"], 3, 4);
    let batch = pump_drops(&mut shell);
    let paths: Vec<PathBuf> = batch.iter().map(|(_, path, _)| path.clone()).collect();
    assert_eq!(
        paths,
        [
            PathBuf::from(r"C:\a.png"),
            PathBuf::from(r"C:\b.png"),
            PathBuf::from(r"C:\c.png")
        ],
        "in order: {batch:?}"
    );
    assert_eq!(batch[0].2, Some(PhysicalPoint::new(1.0, 2.0)));
    assert_eq!(
        batch[1].2,
        Some(PhysicalPoint::new(3.0, 4.0)),
        "the second drop's point, not the first's"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_that_did_not_ask_for_drops_reports_none() {
    // `accept_drops` is off by default and load-bearing rather than
    // advisory. The system enforces it — no `WS_EX_ACCEPTFILES`, no
    // message — so the message here is one the system would never send, and
    // what is under test is the backend's own half of the gate.
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);

    send_drop(hwnd, &[r"C:\unwanted.png"], 5, 5);
    assert!(
        pump_drops(&mut shell).is_empty(),
        "the descriptor said no, and that is the answer"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_drop_registration_survives_a_trip_through_borderless() {
    // `DragAcceptFiles` sets `WS_EX_ACCEPTFILES`, and a mode change
    // *rewrites the extended style word*. Carrying the bit is what stops
    // drops silently ceasing to arrive the first time a window goes
    // fullscreen — with nothing anywhere reporting it.
    let mut shell = shell();
    let window = drop_window(&mut shell);
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, window);
    let accepts = || {
        // SAFETY: reading this shell's own window's extended style.
        let ex_style = unsafe { ffi::GetWindowLongPtrW(hwnd, value::GWL_EX_STYLE) } as u32;
        ex_style & super::super::ffi::style::EX_ACCEPT_FILES
    };
    assert_ne!(accepts(), 0, "created with drops accepted");

    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .expect("a primary monitor")
        .id;
    shell
        .set_mode(
            window,
            DisplayMode::Borderless {
                monitor: Some(primary),
            },
        )
        .expect("borderless");
    assert_ne!(accepts(), 0, "the style rewrite carried the bit");
    shell
        .set_mode(window, DisplayMode::Windowed)
        .expect("and back");
    assert_ne!(accepts(), 0);
    shell.pump(&mut |_| {});

    // And it still works, which is the thing the bit is a proxy for.
    send_drop(hwnd, &[r"C:\after.ron"], 7, 8);
    let dropped = pump_drops(&mut shell);
    assert_eq!(dropped.len(), 1, "{dropped:?}");
    assert_eq!(dropped[0].1, PathBuf::from(r"C:\after.ron"));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn opening_the_clipboard_reports_how_it_went_and_always_closes_it() {
    // The mechanism, not a wall clock: an open that took it first time and
    // one that retried seven times take indistinguishable amounts of time on
    // a loaded runner, and only `Opened` can say which happened. What is
    // asserted is that it was not *refused* and that the guard's `Drop` ran
    // — the second being what stops this process locking every other
    // application out of the clipboard.
    // Deliberately no "nothing is open before we start" precondition: this
    // test is *about* contention — it asserts the open was not refused —
    // and a foreign process holding the clipboard is the case the retry
    // budget exists for, not a reason to fail before starting.
    let mut shell = shell();
    let window = window(&mut shell);
    let hwnd = hwnd_of(&shell, window);

    let opened = {
        let board = super::super::clipboard::Clipboard::open(hwnd)
            .expect("an idle desktop lets a process open the clipboard");
        assert!(clipboard_held_by(hwnd), "held for the guard's lifetime");
        board.opened()
    };
    assert!(
        !clipboard_held_by(hwnd),
        "and given back the moment the guard leaves scope"
    );
    assert!(
        !matches!(opened, Opened::Refused { .. }),
        "another process held the clipboard for the whole budget: {opened:?}"
    );
    if let Opened::After { attempts } = opened {
        assert!(
            attempts <= super::super::clipboard::OPEN_ATTEMPTS,
            "the retry is bounded: {attempts}"
        );
    }
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn every_method_taking_a_window_rejects_a_stale_handle() {
    // Implementor obligation 1, method by method: a destroyed handle must
    // never act on whatever window took the slot.
    let mut shell = shell();
    let stale = window(&mut shell);
    shell.destroy_window(stale).expect("destroy");

    let invalid = |result: Result<(), ShellError>| {
        assert!(
            matches!(result, Err(ShellError::InvalidWindow { .. })),
            "{result:?}"
        );
    };
    invalid(shell.window_state(stale).map(|_| ()));
    invalid(shell.set_title(stale, "gone"));
    invalid(shell.set_visible(stale, true));
    invalid(shell.set_mode(stale, DisplayMode::Windowed));
    invalid(shell.set_constraints(stale, SizeConstraints::NONE));
    invalid(shell.surface_target(stale).map(|_| ()));
    invalid(shell.set_cursor(stale, None));
    invalid(shell.set_pointer_mode(stale, PointerMode::Free));
    invalid(shell.warp_pointer(stale, PhysicalPoint::ORIGIN));
    invalid(shell.reply_close_request(stale, CloseReply::Keep));
    invalid(shell.clipboard_offer(stale, &[]));
    invalid(
        shell
            .clipboard_request(stale, MimeType::TextUtf8)
            .map(|_| ()),
    );
    invalid(shell.destroy_window(stale));
    assert!(!shell.clipboard_readable(stale));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn two_windows_coexist_and_are_told_apart() {
    // What `MULTI_WINDOW` claims.
    let mut shell = shell();
    let first = window(&mut shell);
    let second = shell
        .create_window(&WindowDesc {
            title: "crcbl P5C W1 — second",
            size: LogicalSize::new(640.0, 480.0),
            ..WindowDesc::default()
        })
        .expect("a second window");
    assert_ne!(first, second);
    assert_ne!(hwnd_of(&shell, first), hwnd_of(&shell, second));

    let mut resized = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::Resized { window, size, .. } = event {
            resized.push((window, size));
        }
    });
    assert_eq!(resized.len(), 2, "one configuration each: {resized:?}");
    let sizes: Vec<PhysicalSize> = resized.iter().map(|(_, size)| *size).collect();
    assert_ne!(sizes[0], sizes[1], "and they are not the same window twice");

    // Destroying one leaves the other alone.
    shell.destroy_window(first).expect("destroy");
    assert!(shell.window_state(second).is_ok());
    assert!(shell.window_state(first).is_err());
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_short_timed_wait_is_not_rounded_up_to_the_clock_tick() {
    // The frame loop's windowed idle is a few milliseconds; the default
    // system clock tick is 15.6 ms. A wait that ends on the tick instead of
    // its timeout capped a windowed game near 64 frames a second, which is
    // what the high-resolution timer in `wait` is for.
    //
    // No window: a thread with none gets no desktop traffic, so the waits
    // end by their timeout and the median below is a measurement of the
    // timer rather than of the desktop's mood. Only timed-out waits count.
    const TIMEOUT: Duration = Duration::from_millis(4);
    /// Well under the default tick and well over a timer that works, so a
    /// busy machine does not fail it and a tick-bound wait always does.
    const CEILING: Duration = Duration::from_millis(10);
    const ATTEMPTS: usize = 40;
    /// Timed-out waits needed before the median means anything.
    const SAMPLES: usize = 10;

    let mut shell = shell();
    let mut slept: Vec<Duration> = (0..ATTEMPTS)
        .filter_map(|_| {
            let start = std::time::Instant::now();
            (shell.wait(Some(TIMEOUT)) == Wake::TimedOut).then(|| start.elapsed())
        })
        .collect();
    assert!(
        slept.len() >= SAMPLES,
        "only {} of {ATTEMPTS} waits timed out on a thread with no window, too few to measure",
        slept.len()
    );
    slept.sort_unstable();
    let median = slept[slept.len() / 2];
    assert!(
        median < CEILING,
        "a {TIMEOUT:?} wait slept a median of {median:?} over {} timed-out waits; a wait \
             rounded to the system clock tick sleeps about 15.6 ms",
        slept.len()
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_waker_ends_a_wait_from_another_thread_and_rings_coalesce() {
    // No window, for the reason the clock-tick test gives: a thread with none
    // gets no desktop traffic, so the waits below end by a ring or by their
    // timeout and `Wake` says which.
    const RING_AFTER: Duration = Duration::from_millis(50);
    const LONG: Duration = Duration::from_secs(20);
    let mut shell = shell();
    let waker = shell.waker().expect("the Win32 backend has a waker");

    let ringer = waker.clone();
    let thread = std::thread::spawn(move || {
        std::thread::sleep(RING_AFTER);
        ringer.wake();
    });
    let woke = shell.wait(Some(LONG));
    thread.join().expect("the ringing thread");
    assert!(
        matches!(woke, Wake::Woken),
        "expected the ring, got {woke:?}"
    );

    // Rung with no wait running, three times: the next wait is woken, and the
    // one after it is not — the event is auto-reset, so three rings were one.
    for _ in 0..3 {
        waker.wake();
    }
    let first = shell.wait(Some(LONG));
    assert!(
        matches!(first, Wake::Woken),
        "expected the ring, got {first:?}"
    );
    let second = shell.wait(Some(RING_AFTER));
    assert!(
        matches!(second, Wake::TimedOut),
        "three rings ended a second wait: {second:?}"
    );
}

/// The `System.AppUserModel.ID` on `hwnd`'s property store, read through the
/// `windows` crate rather than this backend's own declarations.
fn app_user_model_id(hwnd: Handle) -> Option<String> {
    use windows::Win32::Foundation::HWND;
    use windows::Win32::Storage::EnhancedStorage::PKEY_AppUserModel_ID;
    use windows::Win32::UI::Shell::PropertiesSystem::{
        IPropertyStore, SHGetPropertyStoreForWindow,
    };
    // SAFETY: a live window of this thread; the store is released when the
    // `IPropertyStore` drops.
    let store: IPropertyStore =
        unsafe { SHGetPropertyStoreForWindow(HWND(hwnd)) }.expect("a window has a property store");
    // SAFETY: reads one property into a `PROPVARIANT` the crate owns and clears.
    let value = unsafe { store.GetValue(&PKEY_AppUserModel_ID) }.expect("the property reads");
    let text = value.to_string();
    (!text.is_empty()).then_some(text)
}

/// **`app_id` labels the window, and only one Windows accepts.** The ID is
/// the window's own AppUserModelID, read back from its property store; one
/// with a space is left off, and the window is still made.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn app_id_is_the_windows_own_app_user_model_id() {
    let mut shell = shell();
    let labelled = shell
        .create_window(&WindowDesc {
            title: "app id",
            app_id: "Kryptic.Crcbl.E2E",
            ..WindowDesc::default()
        })
        .expect("a window with an app id");
    let unlabelled = shell
        .create_window(&WindowDesc {
            title: "bad app id",
            app_id: "Kryptic Crcbl",
            ..WindowDesc::default()
        })
        .expect("an app id Windows would refuse does not refuse the window");
    assert_eq!(
        app_user_model_id(hwnd_of(&shell, labelled)).as_deref(),
        Some("Kryptic.Crcbl.E2E")
    );
    assert_eq!(app_user_model_id(hwnd_of(&shell, unlabelled)), None);
    shell.destroy_window(labelled).expect("destroy");
    shell.destroy_window(unlabelled).expect("destroy");
}

/// **An event the wait's own drain records ends the wait.** lyr's stuck
/// tooltip: the pointer left, the posted `WM_MOUSELEAVE` arrived just after a
/// pump, the drain at the top of the next wait dispatched it and recorded the
/// leave, and the wait then slept on with the event undelivered.
///
/// **A posted `WM_CLOSE` stands in for the leave**, because a leave posted by
/// hand races the system's own. Entering arms `TrackMouseEvent`, and with the
/// desktop's real cursor elsewhere the system soon posts a `WM_MOUSELEAVE` of
/// its own; when that one landed in the pump before the test's, the test's was
/// stale, the drain recorded nothing, and the wait woke on the next message
/// (CI, twice: `Wake::Message` after 136 µs and 48.9 µs). Every posted
/// `WM_CLOSE` is recorded, as `CloseRequested`, and nothing else posts one, so
/// the drain is the only thing that can have recorded it.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn an_event_the_waits_own_drain_records_ends_the_wait() {
    const LONG: Duration = Duration::from_secs(20);
    let mut shell = shell();
    let window = window(&mut shell);
    let hwnd = hwnd_of(&shell, window);
    shell.pump(&mut |_| {});

    // SAFETY: a message posted to this shell's own window, with the zero
    // parameters `winuser.h` documents for it. Posted, not sent, so it waits
    // in the queue for the drain rather than running here.
    let posted = unsafe { ffi::PostMessageW(hwnd, msg::CLOSE, 0, 0) };
    assert_ne!(posted, 0, "the close is posted");
    let start = Instant::now();
    let woke = shell.wait(Some(LONG));
    let waited = start.elapsed();
    assert_eq!(
        woke,
        Wake::Recorded,
        "the drain recorded the close, so the wait must not sleep (returned after {waited:?})"
    );
    let mut asked = false;
    shell.pump(&mut |event| {
        asked |= matches!(event, ShellEvent::CloseRequested { window: w } if w == window);
    });
    assert!(asked, "the next pump delivers the close request");
    shell.destroy_window(window).expect("destroy");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn wait_events_genuinely_blocks() {
    // What `EVENT_WAIT` claims, asserted as the *mechanism* it is rather
    // than as a duration. The first version of this measured three 50 ms
    // waits against a wall clock and failed on the runner at 47 ms with
    // nothing to say why — a wait that found a queued message, a wait that
    // failed outright, and a wait that never slept are all instant, and a
    // clock cannot tell them apart. `Wake` can.
    //
    // A window that has just been created and shown has messages waiting,
    // so the queue is drained to quiescence first: `Wake::Message` before
    // that point is correct behaviour and asserting against it would be
    // asserting that the drain does not work.
    //
    // Whether it reached quiescence is *reported* rather than asserted, and
    // that is this test's second correction — see below. On a runner where
    // the desktop delivers messages unbidden every few milliseconds, "the
    // queue went quiet" is a fact about the machine's mood.
    let mut shell = shell();
    let _window = window(&mut shell);
    let mut settled = false;
    for _ in 0..16 {
        shell.pump(&mut |_| {});
        if shell.wait(Some(Duration::from_millis(0))) == Wake::TimedOut {
            settled = true;
            break;
        }
    }

    // # The observable is "it slept", not "it reached the timeout"
    //
    // **This assertion has been wrong twice, in the same direction, and the
    // evidence for the current shape is worth keeping so nobody tightens it
    // back.** It first measured a wall clock and failed at 47 ms of a 50 ms
    // timeout. It then asked for `Wake::TimedOut` on at least one of five
    // attempts — and a `windows-latest` run printed all five:
    //
    // ```text
    // attempt 0: Message after  5.7433ms, queue 0x80008, message id 799
    // attempt 1: Message after 16.0896ms, queue 0x400040, message None
    // attempt 2: Message after 31.6668ms, queue 0x400040, message None
    // attempt 3: Message after   299.7µs, queue 0x80008, message id 96
    // attempt 4: Message after 10.9571ms, queue 0x20002, message id 512
    // ```
    //
    // 799 is `WM_DWMNCRENDERINGCHANGED` and 512 is `WM_MOUSEMOVE`: the
    // desktop is delivering compositor notifications and **real mouse
    // movement** to this window every few milliseconds. An idle window with a
    // drained queue does not exist there, and no amount of draining will make
    // one.
    //
    // Read those numbers again, though, because they also say the wait
    // *works*: four of the five blocked for between 5.7 ms and 31.7 ms before
    // something woke them. That is what blocking looks like on a busy
    // desktop. Only attempt 3, at 299 µs, returned to an already-full queue.
    //
    // So the assertion is now the thing that actually separates a blocking
    // wait from a no-op one. [`ShellCaps::EVENT_WAIT`] claims the call
    // *sleeps until something happens*; it never claimed the machine would go
    // quiet. A wait that does nothing returns in microseconds **every single
    // time** — five of those in a row is unmistakable and is what fails here.
    // A wait woken after milliseconds slept, whatever woke it.
    //
    // Every attempt carries its evidence, because two of the CI rounds spent
    // on this were settled only by the failure printing more than the last
    // one did. The queue word says what kind of message woke it; the `MSG`
    // beside it says which one — an id, an `hwnd` and two parameters, which
    // is a thing that can be looked up rather than guessed at. `None` there,
    // with a bit set, is the observation that identified `QS_SENDMESSAGE`;
    // see [`Win32Shell::wait`].
    const ATTEMPTS: usize = 5;
    const TIMEOUT: Duration = Duration::from_millis(50);
    // The full timeout, loose on the low side because Windows' timer
    // granularity is 15.6 ms. Only a `TimedOut` is held to it: a
    // `WAIT_TIMEOUT` that arrived instantly would mean the timeout was not
    // the one that was asked for, so it is not evidence of sleeping.
    const FLOOR: Duration = Duration::from_millis(40);
    // The line between "it slept and was woken" and "it never slept", drawn
    // between the two populations the run above measured: 299 µs for a return
    // to a full queue, 5.7 ms for the shortest genuine block. An order of
    // magnitude of clearance on each side, and no dependence on the desktop
    // being quiet.
    const BLOCKED: Duration = Duration::from_millis(2);

    let mut slept = false;
    let mut woken = Vec::new();
    for attempt in 0..ATTEMPTS {
        let start = Instant::now();
        let woke = shell.wait(Some(TIMEOUT));
        let waited = start.elapsed();
        woken.push(format!(
            "attempt {attempt}: {woke:?} after {waited:?}, queue {:#06x}, message {:?}",
            Win32Shell::queue_status(),
            Win32Shell::peek_pending()
        ));
        slept = match woke {
            Wake::TimedOut => waited >= FLOOR,
            // Woken early, which on a live desktop is the ordinary case —
            // but a wait has to have slept to be woken out of.
            _ => waited >= BLOCKED,
        };
        if slept {
            break;
        }
        // Whatever woke it is still in the queue; leaving it there would
        // wake the next attempt too.
        shell.pump(&mut |_| {});
    }
    assert!(
        slept,
        "every one of {ATTEMPTS} waits came back inside {BLOCKED:?} without reaching its \
             {TIMEOUT:?} timeout, so this backend's EVENT_WAIT never sleeps at all (the queue \
             {}): {woken:#?}",
        if settled {
            "was drained to quiescence first"
        } else {
            "never went quiet in 16 drain-and-check rounds, so a return to a full queue is \
                 expected — but not five in a row, each in microseconds"
        }
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_monitors_are_enumerated_with_one_primary_and_a_scale_factor() {
    let shell = shell();
    let monitors = shell.monitors();
    assert!(
        !monitors.is_empty(),
        "a session with a window station has at least one display"
    );
    assert_eq!(
        monitors.iter().filter(|monitor| monitor.is_primary).count(),
        1,
        "exactly one primary: {monitors:?}"
    );
    for monitor in monitors {
        assert!(!monitor.name.is_empty(), "the device name: {monitor:?}");
        assert!(!monitor.size().is_empty(), "{monitor:?}");
        assert!(monitor.scale_factor >= 0.5, "{monitor:?}");
        assert!(
            monitor.work_area.width <= monitor.bounds.width
                && monitor.work_area.height <= monitor.bounds.height,
            "the work area is the bounds minus the taskbar: {monitor:?}"
        );
        assert_eq!(
            shell.monitor(monitor.id).map(|found| &found.name),
            Some(&monitor.name),
            "every id resolves"
        );
    }
    let ids: Vec<MonitorId> = monitors.iter().map(|monitor| monitor.id).collect();
    let mut unique = ids.clone();
    unique.sort_unstable();
    unique.dedup();
    assert_eq!(unique.len(), ids.len(), "ids are not reused: {ids:?}");
    assert_eq!(shell.monitor(MonitorId(u32::MAX)), None);
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn hiding_a_window_is_real_and_reversible() {
    let mut shell = shell();
    let window = window(&mut shell);
    shell.pump(&mut |_| {});
    assert!(shell.window_state(window).expect("live").visible);

    shell.set_visible(window, false).expect("hide");
    assert!(
        !shell.window_state(window).expect("live").visible,
        "visibility is read back from the system, not assumed from the request"
    );
    shell.set_visible(window, true).expect("show");
    assert!(shell.window_state(window).expect("live").visible);

    // A window created hidden is hidden, which is the fix for the
    // black-window flash on startup.
    let hidden = shell
        .create_window(&WindowDesc {
            visible: false,
            ..WindowDesc::default()
        })
        .expect("create hidden");
    assert!(!shell.window_state(hidden).expect("live").visible);
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_title_round_trips_and_a_nul_is_refused() {
    let mut shell = shell();
    let window = window(&mut shell);
    shell
        .set_title(window, "crcbl — 日本語 🎮")
        .expect("UTF-16");
    assert!(matches!(
        shell.set_title(window, "save\0nothing"),
        Err(ShellError::InvalidDescriptor(_))
    ));
    assert!(matches!(
        shell.create_window(&WindowDesc {
            app_id: "sh.kryptic\0crcbl",
            ..WindowDesc::default()
        }),
        Err(ShellError::InvalidDescriptor(_)),
    ));
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_surface_target_exists_before_the_window_is_configured() {
    // The seam's promise: the *handle* exists as soon as the window does,
    // so a HAL surface can be created immediately and only the swapchain
    // waits for the first `Resized`.
    let mut shell = shell();
    let window = window(&mut shell);
    assert_eq!(shell.window_state(window).expect("live").size(), None);

    let target = shell.surface_target(window).expect("available already");
    let SurfaceTarget::Win32 {
        hinstance,
        hwnd,
        transparent,
    } = target
    else {
        panic!("the Win32 backend produces a Win32 target: {target:?}");
    };
    assert_eq!(hwnd.as_ptr(), hwnd_of(&shell, window));
    assert_eq!(hinstance, shell.instance);
    assert!(!transparent, "an opaque window presents to its HWND");

    // And it does not change across a resize, which is what makes
    // "re-query after a mode change" a complete rule.
    shell.pump(&mut |_| {});
    assert_eq!(shell.surface_target(window).expect("still live"), target);
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn the_backend_reports_itself_and_is_reachable_by_name() {
    let shell = shell();
    assert_eq!(shell.backend(), ShellBackend::Win32);
    assert_eq!(ShellBackend::Win32.as_str(), "win32");
    let boxed = crate::open_backend(ShellBackend::Win32).expect("registered on Windows");
    assert_eq!(boxed.backend(), ShellBackend::Win32);
    // And the automatic path finds it, because it is the only backend on
    // this platform. Skipped when the environment has an opinion, since
    // `open` is documented to obey it.
    if std::env::var(crate::BACKEND_ENV_VAR).is_err() {
        let automatic = crate::open().expect("auto-selection has one candidate here");
        assert_eq!(automatic.backend(), ShellBackend::Win32);
    }
}

/// Whether a window was created with no redirection surface, and whether its
/// surface target says it is transparent: the two halves of a transparent
/// window that the shell owns.
fn transparency_of(shell: &Win32Shell, window: WindowId) -> (bool, bool) {
    use super::super::ffi::style;
    let (_, ex_style, _) = styles_and_rect(hwnd_of(shell, window));
    let target = shell.surface_target(window).expect("a live window");
    let SurfaceTarget::Win32 { transparent, .. } = target else {
        panic!("the Win32 backend produces a Win32 target: {target:?}");
    };
    (ex_style & style::EX_NO_REDIRECTION_BITMAP != 0, transparent)
}

/// **A transparent window of every role has no redirection surface and says
/// so in its surface target, and an opaque one has a surface and says not.**
///
/// The mirror of the Wayland e2e test that checks the cap and builds a
/// transparent panel, plus what only Win32 has: the extended style a
/// DirectComposition swapchain needs, and a trip through borderless that
/// rewrites the style word and must not drop it.
///
/// Red if `with_transparency` is skipped at any creation site (that role's
/// style lacks the bit), if `set_styles` stops carrying the bit (the toplevel
/// loses it in borderless), or if `surface_target` stops reporting the flag.
/// What DWM then draws is not read back: corners, border and the desktop
/// showing through are verified by nothing automated.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_transparent_window_of_every_role_has_no_redirection_surface() {
    let mut shell = shell();
    assert!(shell.caps().contains(ShellCaps::TRANSPARENT));

    let opaque = window(&mut shell);
    assert_eq!(transparency_of(&shell, opaque), (false, false));

    let toplevel = shell
        .create_window(&WindowDesc {
            title: "crcbl transparent toplevel",
            transparent: true,
            ..WindowDesc::default()
        })
        .expect("a transparent toplevel");
    let panel = shell
        .create_window(&WindowDesc {
            transparent: true,
            ..panel_desc(
                "crcbl transparent launcher",
                LogicalSize::new(400.0, 300.0),
                crate::PanelDesc {
                    layer: crate::PanelLayer::Overlay,
                    keyboard: crate::PanelKeyboard::Exclusive,
                    ..crate::PanelDesc::default()
                },
            )
        })
        .expect("a transparent panel");
    let popup = shell
        .create_window(&WindowDesc {
            title: "crcbl transparent popup",
            size: LogicalSize::new(120.0, 40.0),
            transparent: true,
            role: crate::WindowRole::Popup(menu_against(panel, crate::PopupInput::Pointer)),
            ..WindowDesc::default()
        })
        .expect("a transparent popup");
    shell.pump(&mut |_| {});
    for (what, window) in [("toplevel", toplevel), ("panel", panel), ("popup", popup)] {
        assert_eq!(transparency_of(&shell, window), (true, true), "{what}");
    }

    shell
        .set_mode(toplevel, DisplayMode::Borderless { monitor: None })
        .expect("borderless");
    shell.pump(&mut |_| {});
    assert_eq!(
        transparency_of(&shell, toplevel),
        (true, true),
        "a style rewrite must not drop the redirection bit"
    );
    shell
        .set_mode(toplevel, DisplayMode::Windowed)
        .expect("windowed");
    shell.pump(&mut |_| {});
    assert_eq!(transparency_of(&shell, toplevel), (true, true), "and back");

    for window in [popup, panel, toplevel, opaque] {
        shell.destroy_window(window).expect("destroy");
    }
}

/// A panel descriptor on `monitor`, with everything else at its default.
fn panel_desc<'a>(
    title: &'a str,
    size: LogicalSize,
    panel: crate::PanelDesc<'a>,
) -> WindowDesc<'a> {
    WindowDesc {
        title,
        size,
        role: crate::WindowRole::Panel(panel),
        ..WindowDesc::default()
    }
}

/// A window's styles and its rectangle on the desktop, as the system has them.
fn styles_and_rect(hwnd: Handle) -> (u32, u32, Rect) {
    // SAFETY: reading this shell's own window's two style words.
    let (window_style, ex_style) = unsafe {
        (
            ffi::GetWindowLongPtrW(hwnd, value::GWL_STYLE) as u32,
            ffi::GetWindowLongPtrW(hwnd, value::GWL_EX_STYLE) as u32,
        )
    };
    let mut rect = Rect::default();
    // SAFETY: `rect` is a live `RECT` the call writes into.
    unsafe { ffi::GetWindowRect(hwnd, &raw mut rect) };
    (window_style, ex_style, rect)
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_bar_is_a_topmost_tool_window_across_the_top_of_its_monitors_work_area() {
    use super::super::ffi::style;
    const HEIGHT: f64 = 30.0;
    let mut shell = shell();
    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .cloned()
        .expect("a primary monitor");
    let bar = shell
        .create_window(&panel_desc(
            "crcbl panel bar",
            LogicalSize::new(0.0, HEIGHT),
            crate::PanelDesc {
                monitor: Some(primary.id),
                anchor: crate::PanelAnchor::TOP
                    | crate::PanelAnchor::LEFT
                    | crate::PanelAnchor::RIGHT,
                ..crate::PanelDesc::default()
            },
        ))
        .expect("a panel");
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, bar);
    let (window_style, ex_style, rect) = styles_and_rect(hwnd);
    assert_ne!(ex_style & style::EX_TOOL_WINDOW, 0, "out of the taskbar");
    assert_eq!(ex_style & style::EX_APP_WINDOW, 0);
    assert_ne!(ex_style & style::EX_TOPMOST, 0, "above application windows");
    assert_ne!(
        ex_style & style::EX_NO_ACTIVATE,
        0,
        "a bar takes no keyboard"
    );
    assert_ne!(window_style & style::POPUP, 0);
    assert_eq!(window_style & style::CAPTION, 0, "no title bar");

    let height = LogicalSize::new(0.0, HEIGHT)
        .to_physical(primary.scale_factor)
        .height;
    let area = primary.work_area;
    assert_eq!(
        shell.window_state(bar).expect("live").size(),
        Some(PhysicalSize::new(area.width, height)),
        "stretched across the work area, at its own height"
    );
    assert_eq!(
        (rect.left, rect.top, rect.right - rect.left),
        (area.x, area.y, area.width as i32),
        "held against the top of the work area"
    );
    let state = shell.window_state(bar).expect("live");
    assert_eq!(state.effective_mode(), Some(DisplayMode::Windowed));

    // A full-screen request on a panel stays a request.
    shell
        .set_mode(bar, DisplayMode::Borderless { monitor: None })
        .expect("recorded");
    shell.pump(&mut |_| {});
    let state = shell.window_state(bar).expect("live");
    assert_eq!(state.effective_mode(), Some(DisplayMode::Windowed));
    assert!(!state.mode_request_honoured());
    let (_, ex_style, _) = styles_and_rect(hwnd);
    assert_ne!(ex_style & style::EX_TOOL_WINDOW, 0, "still a panel");
    shell.destroy_window(bar).expect("destroy");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_launcher_is_centred_on_the_monitor_it_opens_on_and_can_take_the_keyboard() {
    use super::super::ffi::style;
    let mut shell = shell();
    let launcher = shell
        .create_window(&panel_desc(
            "crcbl panel launcher",
            LogicalSize::new(400.0, 300.0),
            crate::PanelDesc {
                layer: crate::PanelLayer::Overlay,
                keyboard: crate::PanelKeyboard::Exclusive,
                ..crate::PanelDesc::default()
            },
        ))
        .expect("a panel");
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, launcher);
    let (_, ex_style, rect) = styles_and_rect(hwnd);
    assert_eq!(
        ex_style & style::EX_NO_ACTIVATE,
        0,
        "a panel that takes the keyboard can be activated"
    );
    assert_ne!(ex_style & style::EX_TOPMOST, 0);

    let on = shell.monitor_of(hwnd).expect("on a monitor");
    let monitor = shell.monitor(on).cloned().expect("a known monitor");
    let size = LogicalSize::new(400.0, 300.0).to_physical(monitor.scale_factor);
    assert_eq!(
        shell.window_state(launcher).expect("live").size(),
        Some(size),
        "an unanchored panel is the size it asked for"
    );
    let area = monitor.work_area;
    assert_eq!(
        (rect.left, rect.top),
        (
            area.x + (area.width as i32 - size.width as i32) / 2,
            area.y + (area.height as i32 - size.height as i32) / 2,
        ),
        "centred in the work area"
    );
    shell.destroy_window(launcher).expect("destroy");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_bottom_layer_panel_is_not_topmost() {
    use super::super::ffi::style;
    let mut shell = shell();
    let widget = shell
        .create_window(&panel_desc(
            "crcbl panel widget",
            LogicalSize::new(200.0, 200.0),
            crate::PanelDesc {
                layer: crate::PanelLayer::Bottom,
                anchor: crate::PanelAnchor::TOP | crate::PanelAnchor::RIGHT,
                ..crate::PanelDesc::default()
            },
        ))
        .expect("a panel");
    shell.pump(&mut |_| {});
    let (_, ex_style, _) = styles_and_rect(hwnd_of(&shell, widget));
    assert_eq!(ex_style & style::EX_TOPMOST, 0);
    assert_ne!(ex_style & style::EX_TOOL_WINDOW, 0);
    shell.destroy_window(widget).expect("destroy");
}

/// The primary monitor's work area, asked for again rather than read from the
/// shell's cached list, until `settled` holds or a few seconds pass.
fn work_area_until(shell: &mut Win32Shell, settled: impl Fn(PhysicalRect) -> bool) -> PhysicalRect {
    let deadline = Instant::now() + std::time::Duration::from_secs(5);
    loop {
        let area = shell
            .enumerate_monitors()
            .into_iter()
            .find(|monitor| monitor.is_primary)
            .expect("a primary monitor")
            .work_area;
        if settled(area) || Instant::now() >= deadline {
            return area;
        }
        shell.pump(&mut |_| {});
        std::thread::sleep(std::time::Duration::from_millis(20));
    }
}

#[test]
#[ignore = "reserves part of the real desktop's work area: run-win32-e2e.ps1 runs it"]
fn a_reserving_bar_is_an_appbar_that_takes_its_edge_and_gives_it_back() {
    const HEIGHT: f64 = 30.0;
    let mut shell = shell();
    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .cloned()
        .expect("a primary monitor");
    let before = work_area_until(&mut shell, |_| true);
    let depth = LogicalSize::new(0.0, HEIGHT)
        .to_physical(primary.scale_factor)
        .height;
    let bar = shell
        .create_window(&panel_desc(
            "crcbl appbar",
            LogicalSize::new(0.0, HEIGHT),
            crate::PanelDesc {
                monitor: Some(primary.id),
                anchor: crate::PanelAnchor::TOP
                    | crate::PanelAnchor::LEFT
                    | crate::PanelAnchor::RIGHT,
                reserve: crate::Reserve::OwnExtent,
                ..crate::PanelDesc::default()
            },
        ))
        .expect("a reserving panel");
    shell.pump(&mut |_| {});
    let reserved = work_area_until(&mut shell, |area| area.y != before.y);
    assert_eq!(
        (reserved.y, reserved.height),
        (before.y + depth as i32, before.height - depth),
        "the work area gave up the bar's height at the top"
    );
    let (_, _, rect) = styles_and_rect(hwnd_of(&shell, bar));
    assert_eq!(
        (rect.top, rect.bottom - rect.top),
        (before.y, depth as i32),
        "the bar sits in the strip it reserved"
    );

    shell.destroy_window(bar).expect("destroy");
    let after = work_area_until(&mut shell, |area| area == before);
    assert_eq!(after, before, "destroying the bar gave the edge back");
}

/// lyr's bar on reload: a reserving bar made taller in place reserves the
/// new height, moves into the new strip and reports the new size as a
/// resize; made to reserve nothing, it gives the edge back while it lives.
#[test]
#[ignore = "reserves part of the real desktop's work area: run-win32-e2e.ps1 runs it"]
fn a_reconfigured_appbar_reserves_its_new_height_and_gives_it_back_when_told() {
    const HEIGHT: f64 = 30.0;
    const TALLER: f64 = 50.0;
    let mut shell = shell();
    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .cloned()
        .expect("a primary monitor");
    let before = work_area_until(&mut shell, |_| true);
    let depth = |height: f64| {
        LogicalSize::new(0.0, height)
            .to_physical(primary.scale_factor)
            .height
    };
    let desc = crate::PanelDesc {
        monitor: Some(primary.id),
        anchor: crate::PanelAnchor::TOP | crate::PanelAnchor::LEFT | crate::PanelAnchor::RIGHT,
        reserve: crate::Reserve::OwnExtent,
        ..crate::PanelDesc::default()
    };
    let bar = shell
        .create_window(&panel_desc(
            "crcbl reconfigured appbar",
            LogicalSize::new(0.0, HEIGHT),
            desc,
        ))
        .expect("a reserving panel");
    shell.pump(&mut |_| {});
    work_area_until(&mut shell, |area| area.y == before.y + depth(HEIGHT) as i32);

    shell
        .set_panel(bar, LogicalSize::new(0.0, TALLER), &desc)
        .expect("set_panel");
    let reserved = work_area_until(&mut shell, |area| area.y == before.y + depth(TALLER) as i32);
    assert_eq!(
        (reserved.y, reserved.height),
        (
            before.y + depth(TALLER) as i32,
            before.height - depth(TALLER)
        ),
        "the work area gave up the new height at the top"
    );
    let (_, _, rect) = styles_and_rect(hwnd_of(&shell, bar));
    assert_eq!(
        (rect.top, rect.bottom - rect.top),
        (before.y, depth(TALLER) as i32),
        "the bar sits in the new strip"
    );
    // `work_area_until` returns without pumping when the work area has
    // already moved, which `ABM_SETPOS` does before it returns, so the
    // `WM_SIZE` the move produced is still waiting to be published.
    let mut resized = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::Resized { window, size, .. } = event
            && window == bar
        {
            resized.push(size.height);
        }
    });
    assert_eq!(
        resized.last(),
        Some(&depth(TALLER)),
        "the new height arrived as a resize"
    );
    assert_eq!(
        shell
            .window_state(bar)
            .expect("live")
            .size()
            .map(|size| size.height),
        Some(depth(TALLER))
    );

    let unreserved = crate::PanelDesc {
        reserve: crate::Reserve::None,
        ..desc
    };
    shell
        .set_panel(bar, LogicalSize::new(0.0, TALLER), &unreserved)
        .expect("set_panel");
    let after = work_area_until(&mut shell, |area| area == before);
    assert_eq!(
        after, before,
        "a bar that stops reserving gives the edge back"
    );
    shell.destroy_window(bar).expect("destroy");
}

/// A reconfigured panel takes the styles of its new layer and keyboard: out
/// of the topmost band for `Bottom`, activatable for `OnDemand`, and back.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_reconfigured_panel_changes_band_and_keyboard_in_place() {
    use super::super::ffi::style;
    let mut shell = shell();
    let size = LogicalSize::new(200.0, 200.0);
    let desc = crate::PanelDesc {
        anchor: crate::PanelAnchor::TOP | crate::PanelAnchor::RIGHT,
        ..crate::PanelDesc::default()
    };
    let widget = shell
        .create_window(&panel_desc("crcbl reconfigured panel", size, desc))
        .expect("a panel");
    shell.pump(&mut |_| {});
    let hwnd = hwnd_of(&shell, widget);
    let (_, ex_style, _) = styles_and_rect(hwnd);
    assert_ne!(ex_style & style::EX_TOPMOST, 0);
    assert_ne!(ex_style & style::EX_NO_ACTIVATE, 0);

    let lowered = crate::PanelDesc {
        layer: crate::PanelLayer::Bottom,
        keyboard: crate::PanelKeyboard::OnDemand,
        ..desc
    };
    shell.set_panel(widget, size, &lowered).expect("set_panel");
    shell.pump(&mut |_| {});
    let (_, ex_style, _) = styles_and_rect(hwnd);
    assert_eq!(ex_style & style::EX_TOPMOST, 0, "left the topmost band");
    assert_eq!(ex_style & style::EX_NO_ACTIVATE, 0, "can take the keyboard");
    assert_ne!(ex_style & style::EX_TOOL_WINDOW, 0, "still a panel");

    shell.set_panel(widget, size, &desc).expect("set_panel");
    shell.pump(&mut |_| {});
    let (_, ex_style, _) = styles_and_rect(hwnd);
    assert_ne!(ex_style & style::EX_TOPMOST, 0, "back in the topmost band");
    assert_ne!(ex_style & style::EX_NO_ACTIVATE, 0);
    shell.destroy_window(widget).expect("destroy");
}

/// Explorer notices a full-screen window on its own schedule, after the
/// window takes the foreground; this is a generous ceiling, not a wait.
const FULL_SCREEN_PATIENCE: Duration = Duration::from_secs(10);

/// `QUNS_BUSY`: Explorer believes a full-screen application has the
/// foreground.
const QUNS_BUSY: i32 = 2;
/// `QUNS_RUNNING_D3D_FULL_SCREEN`: the same, for an exclusive Direct3D one.
const QUNS_RUNNING_D3D_FULL_SCREEN: i32 = 3;
/// `QUNS_QUIET_TIME`: the quiet period after a profile's first sign-in, in
/// which Explorer's full-screen detection does not run (see the test).
const QUNS_QUIET_TIME: i32 = 6;

/// What Explorer says of the user's state, from
/// `SHQueryUserNotificationState`, or `None` if it will not say.
fn notification_state() -> Option<i32> {
    #[link(name = "shell32")]
    unsafe extern "system" {
        fn SHQueryUserNotificationState(state: *mut i32) -> i32;
    }
    let mut state = 0;
    // SAFETY: a live out-pointer, which the call fills with one
    // `QUERY_USER_NOTIFICATION_STATE`; zero is `S_OK`.
    (unsafe { SHQueryUserNotificationState(&raw mut state) } == 0).then_some(state)
}

/// Waits until Explorer no longer believes a full-screen application is up,
/// or panics saying it still does. An appbar is told only of a **change**:
/// one left over from an earlier window would swallow the notice a test
/// waits for.
fn wait_for_no_full_screen_app() {
    let deadline = Instant::now() + FULL_SCREEN_PATIENCE;
    let mut state = notification_state();
    while matches!(state, Some(QUNS_BUSY | QUNS_RUNNING_D3D_FULL_SCREEN)) {
        assert!(
            Instant::now() < deadline,
            "Explorer still believes a full-screen application is up (state {state:?})"
        );
        std::thread::sleep(Duration::from_millis(20));
        state = notification_state();
    }
}

/// Pumps until `shell` raises `FullScreenApp` for `bar` with `active`, or
/// panics naming what did arrive and what Explorer believes.
fn wait_for_full_screen_app(shell: &mut Win32Shell, bar: WindowId, active: bool) {
    const PATIENCE: Duration = FULL_SCREEN_PATIENCE;
    let deadline = Instant::now() + PATIENCE;
    let mut seen = Vec::new();
    while Instant::now() < deadline {
        let mut found = false;
        shell.pump(&mut |event| {
            if let ShellEvent::FullScreenApp {
                window,
                active: now,
            } = event
            {
                seen.push((window, now));
                found |= window == bar && now == active;
            }
        });
        if found {
            return;
        }
        std::thread::sleep(Duration::from_millis(20));
    }
    panic!(
        "no FullScreenApp {{ active: {active} }} for the bar; saw {seen:?}; Explorer's \
         notification state is {:?}",
        notification_state()
    );
}

#[test]
#[ignore = "reserves part of the real desktop's work area: run-win32-e2e.ps1 runs it"]
fn a_reserving_bar_is_told_when_a_full_screen_window_opens_and_closes() {
    let mut shell = shell();
    let primary = shell
        .monitors()
        .iter()
        .find(|monitor| monitor.is_primary)
        .cloned()
        .expect("a primary monitor");
    let before = work_area_until(&mut shell, |_| true);
    let bar = shell
        .create_window(&panel_desc(
            "crcbl full-screen appbar",
            LogicalSize::new(0.0, 30.0),
            crate::PanelDesc {
                monitor: Some(primary.id),
                anchor: crate::PanelAnchor::TOP
                    | crate::PanelAnchor::LEFT
                    | crate::PanelAnchor::RIGHT,
                reserve: crate::Reserve::OwnExtent,
                ..crate::PanelDesc::default()
            },
        ))
        .expect("a reserving panel");
    work_area_until(&mut shell, |area| area.y != before.y);
    wait_for_no_full_screen_app();

    let game = shell
        .create_window(&WindowDesc {
            title: "crcbl full-screen game",
            mode: DisplayMode::Borderless {
                monitor: Some(primary.id),
            },
            ..WindowDesc::default()
        })
        .expect("a borderless window over the monitor");
    let game_hwnd = hwnd_of(&shell, game);
    focus_and_confirm(&mut shell, game, game_hwnd);
    if notification_state() == Some(QUNS_QUIET_TIME) {
        // Every failure of this test on CI's runners came with Explorer in its
        // quiet period, still reporting it with the full-screen window up: in
        // that state Explorer does not detect full-screen windows, so no
        // appbar is told. The notification is then delivered as Explorer
        // delivers it, to the bar's callback message, so the shell's half —
        // turning it into `FullScreenApp` — is still what is checked; only
        // Explorer's detection goes unexercised on such a runner, and the log
        // says so.
        eprintln!(
            "Explorer is in its quiet period and detects no full-screen window; \
             delivering ABN_FULLSCREENAPP to the bar directly"
        );
        let bar_hwnd = hwnd_of(&shell, bar);
        for (open, l_param) in [(true, 1), (false, 0)] {
            // SAFETY: the appbar callback message to this shell's own window,
            // with `ABN_FULLSCREENAPP` and the open flag Explorer sends.
            unsafe {
                ffi::SendMessageW(
                    bar_hwnd,
                    msg::APP_BAR,
                    ffi::appbar::FULL_SCREEN_APP as usize,
                    l_param,
                );
            }
            wait_for_full_screen_app(&mut shell, bar, open);
        }
        shell.destroy_window(game).expect("destroy the game");
    } else {
        wait_for_full_screen_app(&mut shell, bar, true);
        shell.destroy_window(game).expect("destroy the game");
        wait_for_full_screen_app(&mut shell, bar, false);
    }

    shell.destroy_window(bar).expect("destroy the bar");
    assert_eq!(
        work_area_until(&mut shell, |area| area == before),
        before,
        "the edge is given back"
    );
}

/// Whether `hwnd` has an input context, which is what an input method needs
/// to compose in it.
fn has_input_context(hwnd: Handle) -> bool {
    // SAFETY: a live window of this test's shell, on its own thread; a context
    // taken is released once.
    unsafe {
        let context = ffi::ImmGetContext(hwnd);
        if !context.is_null() {
            ffi::ImmReleaseContext(hwnd, context);
        }
        !context.is_null()
    }
}

/// **A window has no input context until a text field asks for one**, and
/// loses it again when the field lets go.
#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_window_has_no_input_context_until_a_field_asks_for_one() {
    let mut shell = shell();
    let window = shell
        .create_window(&WindowDesc::default())
        .expect("a window");
    let hwnd = hwnd_of(&shell, window);
    assert!(!has_input_context(hwnd), "off as it is created");
    shell
        .set_text_input(window, Some(TextPurpose::Normal))
        .expect("turn the input method on");
    assert!(has_input_context(hwnd), "the default context is back");
    shell
        .set_text_input(window, Some(TextPurpose::Password))
        .expect("a password field");
    assert!(
        !has_input_context(hwnd),
        "a password keeps the input method out"
    );
    shell
        .set_text_input(window, Some(TextPurpose::Normal))
        .expect("an ordinary field again");
    assert!(
        has_input_context(hwnd),
        "and an ordinary field lets it back"
    );
    shell
        .set_text_input(window, None)
        .expect("turn the input method off");
    assert!(!has_input_context(hwnd), "and gone again");
    shell.destroy_window(window).expect("destroy");
}

/// A popup descriptor against `parent`.
fn popup_desc(title: &str, size: LogicalSize, popup: crate::PopupDesc) -> WindowDesc<'_> {
    WindowDesc {
        title,
        size,
        role: crate::WindowRole::Popup(popup),
        ..WindowDesc::default()
    }
}

/// A menu against a 100×20 button at (10, 10) of `parent`'s client area.
fn menu_against(parent: WindowId, input: crate::PopupInput) -> crate::PopupDesc {
    crate::PopupDesc {
        parent,
        anchor: crate::LogicalRect::new(
            crate::LogicalPoint::new(10.0, 10.0),
            LogicalSize::new(100.0, 20.0),
        ),
        placement: crate::PopupPlacement::Below,
        input,
    }
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_menu_opens_below_its_button_and_goes_with_its_window() {
    use super::super::ffi::style;
    let mut shell = shell();
    let parent = window(&mut shell);
    shell.pump(&mut |_| {});
    let parent_hwnd = hwnd_of(&shell, parent);
    let scale = shell
        .window_state(parent)
        .expect("live")
        .scale_factor()
        .expect("configured");
    let menu = shell
        .create_window(&popup_desc(
            "crcbl popup menu",
            LogicalSize::new(200.0, 150.0),
            menu_against(parent, crate::PopupInput::Pointer),
        ))
        .expect("a popup");
    shell.pump(&mut |_| {});
    let mut origin = Point::default();
    // SAFETY: the parent's client origin, converted in place.
    unsafe { ffi::ClientToScreen(parent_hwnd, &raw mut origin) };
    let px = |logical: f64| (logical * scale).round() as i32;
    let (_, ex_style, rect) = styles_and_rect(hwnd_of(&shell, menu));
    assert_eq!(
        (rect.left, rect.top),
        (origin.x + px(10.0), origin.y + px(30.0)),
        "below the button, left edges aligned"
    );
    assert_eq!(
        shell.window_state(menu).expect("live").size(),
        Some(LogicalSize::new(200.0, 150.0).to_physical(scale))
    );
    assert_ne!(
        ex_style & style::EX_NO_ACTIVATE,
        0,
        "a pointer popup takes no keyboard"
    );

    let mut destroyed = Vec::new();
    shell.pump(&mut |_| {});
    shell.destroy_window(parent).expect("destroy");
    shell.pump(&mut |event| {
        if let ShellEvent::WindowDestroyed { window } = event {
            destroyed.push(window);
        }
    });
    assert_eq!(
        destroyed,
        [menu, parent],
        "the popup first, then its window"
    );
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_repositioned_menu_follows_its_new_anchor_at_its_new_size() {
    let mut shell = shell();
    let parent = window(&mut shell);
    shell.pump(&mut |_| {});
    let parent_hwnd = hwnd_of(&shell, parent);
    let scale = shell
        .window_state(parent)
        .expect("live")
        .scale_factor()
        .expect("configured");
    let menu = shell
        .create_window(&popup_desc(
            "crcbl repositioned menu",
            LogicalSize::new(200.0, 150.0),
            menu_against(parent, crate::PopupInput::Pointer),
        ))
        .expect("a popup");
    shell.pump(&mut |_| {});

    let moved_to = crate::LogicalRect::new(
        crate::LogicalPoint::new(60.0, 10.0),
        LogicalSize::new(100.0, 20.0),
    );
    shell
        .reposition_popup(menu, moved_to, LogicalSize::new(240.0, 90.0))
        .expect("reposition");
    shell.pump(&mut |_| {});
    let mut origin = Point::default();
    // SAFETY: the parent's client origin, converted in place.
    unsafe { ffi::ClientToScreen(parent_hwnd, &raw mut origin) };
    let px = |logical: f64| (logical * scale).round() as i32;
    let (_, _, rect) = styles_and_rect(hwnd_of(&shell, menu));
    assert_eq!(
        (rect.left, rect.top),
        (origin.x + px(60.0), origin.y + px(30.0)),
        "below the new anchor, left edges aligned"
    );
    assert_eq!(
        shell.window_state(menu).expect("live").size(),
        Some(LogicalSize::new(240.0, 90.0).to_physical(scale)),
        "the new size arrived as a resize"
    );
    assert!(
        matches!(
            shell.reposition_popup(parent, moved_to, LogicalSize::new(1.0, 1.0)),
            Err(ShellError::InvalidDescriptor(_))
        ),
        "a toplevel is not a popup"
    );
    shell.destroy_window(parent).expect("destroy");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_grabbing_popup_closes_when_it_loses_the_keyboard_and_a_pointer_one_does_not() {
    let mut shell = shell();
    let parent = window(&mut shell);
    shell.pump(&mut |_| {});
    let grab = shell
        .create_window(&popup_desc(
            "crcbl popup grab",
            LogicalSize::new(200.0, 150.0),
            menu_against(parent, crate::PopupInput::Grab),
        ))
        .expect("a popup");
    let pointer = shell
        .create_window(&popup_desc(
            "crcbl popup pointer",
            LogicalSize::new(200.0, 150.0),
            menu_against(parent, crate::PopupInput::Pointer),
        ))
        .expect("a popup");
    shell.pump(&mut |_| {});
    // A popup loses the keyboard only if it had it: the foreground as well as
    // its thread's focus, which a desktop shared with other processes need
    // not have granted when the popup was shown.
    let grab_hwnd = hwnd_of(&shell, grab);
    focus_and_confirm(&mut shell, grab, grab_hwnd);
    send_focus(grab_hwnd, false);
    send_focus(hwnd_of(&shell, pointer), false);
    let mut asked = Vec::new();
    shell.pump(&mut |event| {
        if let ShellEvent::CloseRequested { window } = event {
            asked.push(window);
        }
    });
    assert_eq!(asked, [grab], "only the grabbing popup is dismissed");
    shell.destroy_window(parent).expect("destroy");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn escape_on_a_grabbing_popup_is_delivered_then_asks_it_to_close() {
    /// `VK_ESCAPE`.
    const VK_ESCAPE: usize = 0x1B;
    let mut shell = shell();
    let parent = window(&mut shell);
    shell.pump(&mut |_| {});
    let grab = shell
        .create_window(&popup_desc(
            "crcbl popup escape grab",
            LogicalSize::new(200.0, 150.0),
            menu_against(parent, crate::PopupInput::Grab),
        ))
        .expect("a popup");
    let pointer = shell
        .create_window(&popup_desc(
            "crcbl popup escape pointer",
            LogicalSize::new(200.0, 150.0),
            menu_against(parent, crate::PopupInput::Pointer),
        ))
        .expect("a popup");
    shell.pump(&mut |_| {});
    // A desktop shared with other processes may already have taken the
    // keyboard from the grabbing popup, which asked it to close; that
    // request is kept, so the one below can only come from the Escape.
    if shell.window_state(grab).expect("live").close_pending {
        shell
            .reply_close_request(grab, crate::CloseReply::Keep)
            .expect("keep");
    }
    let (grab_hwnd, pointer_hwnd) = (hwnd_of(&shell, grab), hwnd_of(&shell, pointer));
    // The key edges and the requests, in the order they were queued.
    let pump_edges = |shell: &mut Win32Shell| {
        let mut edges = Vec::new();
        shell.pump(&mut |event| match event {
            ShellEvent::Key {
                window,
                key_code: Some(KeyCode::Escape),
                state,
                repeat,
                ..
            } => edges.push((window, Some((state, repeat)))),
            ShellEvent::CloseRequested { window } => edges.push((window, None)),
            _ => {}
        });
        edges
    };

    send_key(grab_hwnd, msg::KEY_DOWN, VK_ESCAPE, 0x0001, false, false);
    assert_eq!(
        pump_edges(&mut shell),
        [(grab, Some((ButtonState::Pressed, false))), (grab, None)],
        "the key, then the request"
    );
    // Kept open — a submenu backing out — so a repeat and a release ask
    // nothing, and the next fresh press asks again.
    shell
        .reply_close_request(grab, crate::CloseReply::Keep)
        .expect("keep");
    send_key(grab_hwnd, msg::KEY_DOWN, VK_ESCAPE, 0x0001, false, true);
    send_key(grab_hwnd, msg::KEY_UP, VK_ESCAPE, 0x0001, false, true);
    assert!(
        pump_edges(&mut shell).iter().all(|(_, key)| key.is_some()),
        "neither a repeat nor a release dismisses"
    );
    send_key(grab_hwnd, msg::KEY_DOWN, VK_ESCAPE, 0x0001, false, false);
    assert_eq!(pump_edges(&mut shell).last(), Some(&(grab, None)));

    // A popup that does not hold the keyboard only hears the key.
    send_key(pointer_hwnd, msg::KEY_DOWN, VK_ESCAPE, 0x0001, false, false);
    assert_eq!(
        pump_edges(&mut shell),
        [(pointer, Some((ButtonState::Pressed, false)))]
    );
    shell.destroy_window(parent).expect("destroy");
}

#[test]
#[ignore = "opens windows on the real desktop: run-win32-e2e.ps1 runs it"]
fn a_passthrough_popup_is_not_there_for_the_pointer() {
    let mut shell = shell();
    let parent = window(&mut shell);
    shell.pump(&mut |_| {});
    let hit = |shell: &mut Win32Shell, input| {
        let popup = shell
            .create_window(&popup_desc(
                "crcbl popup hit test",
                LogicalSize::new(200.0, 150.0),
                menu_against(parent, input),
            ))
            .expect("a popup");
        shell.pump(&mut |_| {});
        let hwnd = hwnd_of(shell, popup);
        let (_, _, rect) = styles_and_rect(hwnd);
        let inside = ((rect.top + 5) << 16) as isize | (rect.left + 5) as isize;
        // SAFETY: a hit-test message to this shell's own window, with a point
        // inside it in the packed screen coordinates `WM_NCHITTEST` takes.
        let answer = unsafe { ffi::SendMessageW(hwnd, msg::NC_HIT_TEST, 0, inside) };
        shell.destroy_window(popup).expect("destroy");
        answer
    };
    assert_eq!(
        hit(&mut shell, crate::PopupInput::Passthrough),
        value::HT_TRANSPARENT
    );
    assert_ne!(
        hit(&mut shell, crate::PopupInput::Pointer),
        value::HT_TRANSPARENT
    );
    shell.destroy_window(parent).expect("destroy");
}