guido 0.12.0

//! A rounded rect, and the transform that puts it on the screen.
//!
//! **One type, because a clip and a region are the same object.** A clip is a
//! rounded rect a widget declared and a transform that places it; so is the
//! area a backdrop blur filters, and so is the region a surface takes input
//! in. They were two structs with the same four fields under two names, and
//! the seam showed at the one call site that held both: a region tessellated
//! its own shape exactly and then asked the clip beside it for a bounding box,
//! because only one of the two knew how to be a shape.
//!
//! Now the geometry lives here and both are it. That is what lets a region be
//! narrowed by a *shape* rather than by a box — the corners of a rounded
//! scroller cut the card inside it, and a turned clip cuts what it covers. A
//! chain of clips is a list of these, one per clip that could not be merged
//! with the one above it — see `src/renderer/clip.rs`.

use crate::layout::Axis;
use crate::renderer::CornerRadii;
use crate::transform::Transform;
use crate::widgets::Rect;
use smallvec::SmallVec;

/// A rounded rect as its widget declared it, and the transform that places it.
///
/// **The shape is kept, not its bounding box.** A clip used to be stored as a
/// world-space rect, built by mapping the declared one through the world
/// transform — which is an enclosing box, equal to the shape only for a
/// transform that keeps the axes. Under a rotation it is larger and
/// square-cornered, and past about 40° it is large enough that
/// `Overflow::Hidden` stops hiding: an 80×80 box turned 45° bounds to 113×113,
/// so a child overflowing by 20 is not touched. A `wl_region` had the same
/// problem from the other side: a 150×90 card turned 20° published a 172×136
/// box, 73% more area, and the compositor blurred the desktop in the four
/// triangles where the card is not.
///
/// Keeping the declaration and carrying [`placement`](Self::placement) beside
/// it costs one matrix and answers every consumer. A shader inverts it and
/// tests the fragment in the shape's own space, where it is an ordinary
/// rounded rect again and the radii are circles rather than the ellipses a
/// scaled box would need. The region tessellator cuts bands out of the
/// transformed outline. Whatever still wants a box asks
/// [`world_aabb`](Self::world_aabb) for one.
///
/// **Equality is representational.** Two shapes covering the same area with a
/// different split between `rect` and `placement` compare unequal — which is
/// the conservative answer wherever the question is "is this the same clip as
/// last frame", and not an answer about geometry.
///
/// **What it cannot express is the intersection of most pairs.** One rect and
/// one matrix describe one rounded parallelogram, and two of them meet in one
/// only where `merge_exact` says so: one space up to a quarter turn, a mirror
/// or a uniform scale, and corners that each belong to one clip or nest.
/// Every other pair is kept as two shapes, chained, and met by each consumer
/// as two.
#[derive(Debug, Clone, Copy, PartialEq)]
pub struct PlacedShape {
    /// The rect, in the space of the widget that declared it.
    pub rect: Rect,
    /// Its corner radii, in that same space — circles there, whatever the
    /// transform makes of them out here.
    pub radii: CornerRadii,
    /// Superellipse curvature (K-value): 0 is a bevel, 1 a circle, 2 a
    /// squircle.
    pub curvature: f32,
    /// That space to logical surface pixels.
    pub placement: Transform,
}

impl PlacedShape {
    /// A declared shape, placed — which is to say, not changed at all.
    ///
    /// It used to be mapped into world space by its caller, and that mapping
    /// is what this whole type exists to stop doing: the declaration is exact
    /// and its image under a rotation is not a rect, so the only thing that
    /// could be stored was the box around it. Carrying the transform keeps
    /// both.
    pub(crate) fn from_clip(
        clip: &crate::renderer::tree::ClipRegion,
        placement: Transform,
    ) -> Self {
        Self::placed(clip.rect, clip.corner_radius, clip.curvature, placement)
    }

    /// The same, spelled out, for a caller holding four loose values.
    pub fn placed(rect: Rect, radii: CornerRadii, curvature: f32, placement: Transform) -> Self {
        Self {
            rect,
            radii,
            curvature,
            placement,
        }
    }

    /// The same shape, moved across the surface by `(dx, dy)`.
    ///
    /// The declaration does not change — the rect and the radii are in the
    /// shape's own space, and that space has not moved relative to whatever
    /// declared it. What moves is where that space sits, which is the
    /// placement.
    #[inline]
    pub(crate) fn translated(&self, dx: f32, dy: f32) -> Self {
        Self {
            placement: self.placement.translated(dx, dy),
            ..*self
        }
    }

    /// The axis-aligned world box containing the shape.
    ///
    /// What a clip used to be, and still is for the consumers that cannot take
    /// a shape: glyphon clips text to an integer rect and a viewport is four
    /// integers — each given the box every clip of a chain leaves open. Neither
    /// is an approximation any more — a text any of those boxes would cut
    /// differently from its shape is sent down the quad path instead (#405),
    /// and the backdrop cuts the difference back off per fragment.
    ///
    /// It is also how a *viewport* is found, which is a different thing and not
    /// an approximation — the backdrop pass narrows the box it may write to and
    /// then cuts the difference back off per fragment. Everything else tests in
    /// the clip's own space, so this is the fallback rather than the answer.
    #[inline]
    pub fn world_aabb(&self) -> Rect {
        self.placement.map_rect(self.rect)
    }

    /// The map into this shape's space, from the *physical* pixels a shader
    /// works in — see [`Transform::physical_inverse`], which is where the
    /// arithmetic lives because the backdrop pass needs the same thing.
    #[inline]
    pub fn to_local(&self, scale: f32) -> Option<Transform> {
        self.placement.physical_inverse(scale)
    }

    /// The corners, clamped so no two sharing an edge overlap.
    pub(crate) fn clamped_radii(&self) -> CornerRadii {
        clamp_radii(self.radii, self.rect.width, self.rect.height)
    }

    /// How far `(x, y)`, in this shape's own space, is from its edge: negative
    /// inside. The distance the shaders cut with, through the one Rust copy of
    /// it that `tests/shader_sdf_is_one_definition.rs` holds to them.
    pub(crate) fn distance(&self, x: f32, y: f32) -> f32 {
        self.rect.shape_distance(
            x,
            y,
            crate::widgets::Corners {
                radii: self.radii,
                curvature: self.curvature,
            },
        )
    }

    /// Where the shape starts and stops, vertically, on the surface.
    #[inline]
    pub(crate) fn y_bounds(&self) -> (f32, f32) {
        self.world_aabb().span(Axis::Vertical)
    }

    /// Whether this shape is simply a rectangle on the surface: no turn, no
    /// skew, and corners of half a pixel or less (see `is_square`).
    ///
    /// Half a pixel is a *surface* measurement and the radii are in the
    /// widget's own space, so the two only mean the same thing at a scale of
    /// one: a corner of 0.4 under a `scale(8.0)` is three pixels of curve.
    pub(crate) fn is_a_box(&self) -> bool {
        self.placement.keeps_axes() && is_square(self.largest_corner_on_surface())
    }

    /// Whether cutting `ink` to this shape's box cuts it the way the shape
    /// itself would.
    ///
    /// What it is for: glyphon takes a `TextBounds` of four integers and has
    /// nowhere to put a shape, so a text cut by a turned or rounded clip was
    /// cut by the box around it and showed outside (#405). The way out is to
    /// send that text down the textured-quad path, which tests a fragment in
    /// the clip's own space — but a quad costs a rasterization and an upload
    /// per text, and the atlas is stable precisely because most text does not
    /// take one.
    ///
    /// So ask where the two answers differ rather than whether they can. A
    /// turned clip differs everywhere its edge runs and there is no cheap
    /// region to name, so that one always needs the shape. An upright clip
    /// differs only inside the four corner boxes — `r` by `r` at each corner,
    /// measured on the surface — and a text whose ink reaches none of them is
    /// cut identically by either. Most text reaches none of them: a label sits
    /// in the middle of the card that clips it.
    pub(crate) fn box_cuts_like_the_shape(&self, ink: Rect) -> bool {
        if !self.placement.keeps_axes() {
            return false;
        }
        let (sx, sy) = self.placement.extract_scale_components();
        let r = self.clamped_radii();
        let b = self.world_aabb();
        let (right, bottom) = (b.x + b.width, b.y + b.height);

        // Each corner's own box, from the radius that corner actually has —
        // four different ones is an ordinary shape.
        [
            (r.top_left, b.x, b.y, 1.0, 1.0),
            (r.top_right, right, b.y, -1.0, 1.0),
            (r.bottom_right, right, bottom, -1.0, -1.0),
            (r.bottom_left, b.x, bottom, 1.0, -1.0),
        ]
        .into_iter()
        .all(|(radius, cx, cy, dx, dy)| {
            // A square corner has no wedge: the box is the shape there. As a
            // box of no size it still overlapped any ink covering the corner
            // point, and sent a text the box cuts exactly to the quad path.
            // Square by the rule `is_a_box` uses, measured on the surface.
            if is_square(radius * sx.max(sy)) {
                return true;
            }
            let (w, h) = (radius * sx * dx, radius * sy * dy);
            let wedge = Rect::new(cx.min(cx + w), cy.min(cy + h), w.abs(), h.abs());
            !overlaps(wedge, ink)
        })
    }

    /// The largest corner this shape has, measured where it will be drawn.
    ///
    /// Only meaningful once [`keeps_axes`](Transform::keeps_axes) holds, which
    /// is what makes the larger of the two factors the whole of what the
    /// transform does to a radius.
    fn largest_corner_on_surface(&self) -> f32 {
        let (sx, sy) = self.placement.extract_scale_components();
        self.clamped_radii().max() * sx.max(sy)
    }

    /// How many points to sample a corner's curve at, when there is no closed
    /// form for it.
    ///
    /// The sag of a chord across an arc of angle `θ` is about `r·θ²/8`, so for
    /// a quarter turn cut into `n + 1` chords the worst gap between the curve
    /// and the polyline is roughly `r · (π/2)²/8 / (n+1)²`. Asking for under
    /// half a pixel of it gives `n ≈ sqrt(r · 0.31 / 0.5)`, which is 5 for a 40
    /// pixel corner and 8 for a 100 pixel one.
    ///
    /// Taken from the corner as it lands **on the surface**, not as it was
    /// declared: a shape scaled down needs fewer points for the same accuracy,
    /// and a shape scaled up needs more. Clamped low because each sample is an
    /// edge the scanline loop tests, and clamped high because a region is a
    /// list the compositor has to receive.
    fn samples_per_corner(&self) -> usize {
        let radius = self.largest_corner_on_surface();
        ((radius * 0.62).sqrt().ceil() as usize).clamp(2, 12)
    }

    /// The outline, transformed once and ready to be asked about scanlines.
    ///
    /// **Once, because the band loop asks hundreds of times.** A tall shape is
    /// cut into five hundred bands and every boundary wants a span; rebuilding
    /// four edges and four corners, clamping the radii and transforming eight
    /// points for each of them is the same answer computed five hundred times.
    ///
    /// **Every corner is cut as the curve it is.** `curvature` says the corner
    /// is a superellipse — `k = 0` a bevel, `1` a circle, `2` a squircle — and
    /// the arc solve parameterises a circle and nothing else. So a circle takes
    /// the closed form, a bevel takes the chord between the arc's two ends,
    /// which *is* the bevel, and everything else is sampled: chords of a convex
    /// curve lie inside it, so the tessellation's promise — never claim a pixel
    /// the shape does not cover — holds by construction.
    ///
    /// Cutting the circle for all of them was the old answer and it failed in
    /// both directions. Below a circle the shape is smaller, so a bevelled
    /// container blurred the desktop past its own diagonal and took clicks
    /// there. Above one the shape is larger, so a squircle gave up 14% of each
    /// corner box — a 7.6 pixel dead band along the diagonal of a 40 pixel
    /// corner, where a click fell through to whatever was behind (#400).
    ///
    /// **A scoop is not traced, it is taken away.** It curves inward, so
    /// chords of it fall *outside* the shape and sampling cannot be used —
    /// which is why it used to be cut by a chord tangent to the bite, never
    /// over-claiming and giving up 17% of the shape (#410). What the shader
    /// actually draws is the plain box minus a disc sitting on each outer
    /// corner, and that is what is built here: the sides run corner to
    /// corner, no arc is traced, and the four discs go in `bites` for
    /// [`Outline::take_bites_from`] to remove from a span. Exact,
    /// through the same closed-form circle solve every other curvature's arc
    /// uses.
    pub(crate) fn outline(&self) -> Outline {
        let declared = self.clamped_radii();
        // A scoop's sides reach the corners — the curve comes out of the shape
        // afterwards rather than being traced along it — so the outline is
        // built as the plain box and the radii travel in `bites` instead.
        let r = if self.curvature < 0.0 {
            CornerRadii::uniform(0.0)
        } else {
            declared
        };
        let (x0, y0) = (self.rect.x, self.rect.y);
        let (x1, y1) = (x0 + self.rect.width, y0 + self.rect.height);

        let corners = [
            Corner {
                centre: (x0 + r.top_left, y0 + r.top_left),
                radius: r.top_left,
                quadrant: (-1.0, -1.0),
            },
            Corner {
                centre: (x1 - r.top_right, y0 + r.top_right),
                radius: r.top_right,
                quadrant: (1.0, -1.0),
            },
            Corner {
                centre: (x1 - r.bottom_right, y1 - r.bottom_right),
                radius: r.bottom_right,
                quadrant: (1.0, 1.0),
            },
            Corner {
                centre: (x0 + r.bottom_left, y1 - r.bottom_left),
                radius: r.bottom_left,
                quadrant: (-1.0, 1.0),
            },
        ];

        // Each side runs between the two corners that are on it and no others.
        // Writing one of those four names twice is a side that overshoots its
        // own corner, and is invisible while the radii agree.
        let mut edges: SmallVec<[Edge; 8]> = SmallVec::new();
        for (from, to) in [
            ((x0 + r.top_left, y0), (x1 - r.top_right, y0)),
            ((x1, y0 + r.top_right), (x1, y1 - r.bottom_right)),
            ((x1 - r.bottom_right, y1), (x0 + r.bottom_left, y1)),
            ((x0, y1 - r.bottom_left), (x0, y0 + r.top_left)),
        ] {
            edges.push(Edge::placed(from, to, &self.placement));
        }

        let mut arcs: SmallVec<[Arc; 4]> = SmallVec::new();
        for corner in corners.iter().filter(|c| c.radius > 0.0) {
            // An exact form where there is one, and a polyline where there is
            // not. The circle is the only curve here a scanline meets in closed
            // form; every other exponent would need a root-find per band per
            // corner, inside a loop that already runs one band per pixel.
            //
            // Chords of a convex curve lie inside it, so sampling keeps the
            // promise the whole tessellator rests on: the region never claims a
            // pixel the shape does not cover. It gives some back instead, and
            // `samples_per_corner` is what bounds how much.
            let k = self.curvature;
            if k == 1.0 {
                arcs.push(Arc::placed(corner, &self.placement));
            } else if k == 0.0 {
                // A bevel is a straight cut, and the chord between the arc's
                // ends is not an approximation of it — it is the shape.
                edges.push(Edge::placed(
                    corner.on_x_side(),
                    corner.on_y_side(),
                    &self.placement,
                ));
            } else {
                let mut previous = corner.on_x_side();
                for point in corner.superellipse(k, self.samples_per_corner()) {
                    edges.push(Edge::placed(previous, point, &self.placement));
                    previous = point;
                }
                edges.push(Edge::placed(previous, corner.on_y_side(), &self.placement));
            }
        }

        // With `r` zeroed above, every corner's centre already sits on the
        // box's outer corner, which is where a scoop's disc is centred. Only
        // the radius has to be put back, and it is the same clamped radius
        // every other curvature traces — #410 gave the bite the shader's rule
        // ahead of the rest, and #417 brought the rest onto it, so there is
        // one of them again.
        let bites = if self.curvature < 0.0 {
            corners
                .iter()
                .zip(declared.to_array())
                .filter(|(_, radius)| *radius > 0.0)
                .map(|(corner, radius)| Arc::placed(&Corner { radius, ..*corner }, &self.placement))
                .collect()
        } else {
            SmallVec::new()
        };

        Outline { edges, arcs, bites }
    }

    /// The exact horizontal extent of the shape at surface scanline `y`,
    /// where the shape has only one.
    ///
    /// A convenience over [`Outline::span_at`] for a caller asking once; the
    /// band loop places the outline itself and keeps it. Panics on a scanline
    /// a scoop has split in two, which is the one case with no single answer
    /// to give — [`Outline::span_at`] is what asks about that.
    #[cfg(test)]
    pub(crate) fn span_at(&self, y: f32) -> Option<(f32, f32)> {
        let spans = self.outline().span_at(y);
        assert!(
            spans.len() <= 1,
            "scanline {y} meets this shape in {} intervals, not one",
            spans.len()
        );
        spans.first().copied()
    }
}

/// A shape's outline in *surface* coordinates: the straight parts and the
/// curved ones, each already carrying what a scanline query needs.
pub(crate) struct Outline {
    edges: SmallVec<[Edge; 8]>,
    arcs: SmallVec<[Arc; 4]>,
    /// The discs a scoop takes *out* of the shape, empty for every other
    /// curvature. Kept apart from `arcs` because they are not boundary the
    /// span runs to — they are boundary the span stops at and starts again
    /// past, which is the one place this shape is not convex.
    bites: SmallVec<[Arc; 4]>,
}

/// Where a shape is on one scanline: ascending, disjoint, and usually one.
///
/// One interval is the whole story for every convex shape, which is every
/// curvature but the scoop. A scoop is the box minus a disc at each corner,
/// and once something turns it a horizontal line can enter the shape, cross
/// into a bite and come out into the shape again — two intervals on that
/// line, with a gap that belongs to nobody. Claiming the gap sends clicks to
/// a surface that did not draw there; claiming only the wider half gives up
/// 5.5% of a shape at 45 degrees, which is well past the budget the whole
/// tessellation has. So the answer is a list.
pub(crate) type Spans = SmallVec<[(f32, f32); 2]>;

/// `spans` with `(lo, hi)` removed from it.
///
/// Each interval survives whole, is trimmed at one end, is split in two, or
/// disappears. The input is ascending and disjoint, and so is the output.
pub(crate) fn subtract(spans: &Spans, (lo, hi): (f32, f32)) -> Spans {
    let mut out = Spans::new();
    for &(a, b) in spans {
        if hi <= a || lo >= b {
            out.push((a, b));
            continue;
        }
        if a < lo {
            out.push((a, lo));
        }
        if hi < b {
            out.push((hi, b));
        }
    }
    out
}

impl Outline {
    /// The outer bounds of the shape at surface scanline `y`, before any bite
    /// is taken out of them.
    ///
    /// **The boundary, piece by piece.** The straight edges and the corner arcs
    /// bound a convex region, and where a horizontal line meets them is where
    /// that region begins and ends on the line. Every piece is already
    /// transformed, so nothing here cares whether the shape is turned — a
    /// rotation is not a case, it is what the matrix happened to hold. An
    /// axis-aligned shape falls out of the same arithmetic, which is why there
    /// is no separate corner inset: that was this, solved in advance for the
    /// one transform that keeps the axes.
    ///
    /// For every curvature but the scoop this *is* the shape's extent, and
    /// [`Outline::span_at`] just hands it back. A scoop's outline is the plain
    /// box, so this is the box, and the discs it takes out of it are
    /// [`Outline::without_its_bites`].
    pub(crate) fn bounds_at(&self, y: f32) -> Option<(f32, f32)> {
        let (mut lo, mut hi) = (f32::INFINITY, f32::NEG_INFINITY);
        let mut hit = |x: f32| {
            lo = lo.min(x);
            hi = hi.max(x);
        };

        for edge in &self.edges {
            let ((ax, ay), (bx, by)) = (edge.from, edge.to);
            // Horizontal after transforming: it either lies on this scanline
            // or misses it, and if it lies on it both ends are hits.
            //
            // Exactly zero rather than nearly: this is a *length*, so any
            // absolute tolerance means something different for a 10 pixel edge
            // than a 1000 pixel one. The value is either 0 — identity,
            // translate, axis scale — or large enough that the sloped branch is
            // the right one.
            if by == ay {
                if (ay - y).abs() < 1e-4 {
                    hit(ax);
                    hit(bx);
                }
                continue;
            }
            let t = (y - ay) / (by - ay);
            if (0.0..=1.0).contains(&t) {
                hit(ax + t * (bx - ax));
            }
        }

        for arc in &self.arcs {
            arc.hits(y, &mut hit);
        }

        (lo <= hi).then_some((lo, hi))
    }

    /// Where the shape is on scanline `y`.
    ///
    /// The band loop does not go through this — it asks `bounds_at` once per
    /// boundary and carries the answer to the band below, then takes the
    /// bites out over the whole band. This is the same thing for a caller
    /// asking about one line, which is what a test does.
    #[cfg(test)]
    pub(crate) fn span_at(&self, y: f32) -> Spans {
        let mut spans = Spans::new();
        let Some(bounds) = self.bounds_at(y) else {
            return spans;
        };
        spans.push(bounds);
        self.take_bites_from(&mut spans, y, y);
        spans
    }

    /// Whether anything comes out of this outline's spans at all.
    ///
    /// False for every curvature but the scoop, and the band loop asks it once
    /// per region so that the shapes with nothing to subtract do not pay for
    /// the shape of the answer — see `placed_shape_to_rects`.
    pub(crate) fn is_bitten(&self) -> bool {
        !self.bites.is_empty()
    }

    /// Take this shape's scoops out of `spans`. Does nothing at all for every
    /// curvature but a scoop, which is the point: the band loop calls it once
    /// per band per shape, and a shape with no bites must not pay for the
    /// possibility of having some.
    ///
    /// A band is claimed only where the shape covers it at *every* height in
    /// it, so what comes out is the union of the disc across the band — see
    /// [`Arc::removed_between`]. Reading it off the two edges is what a convex
    /// boundary allows and a bite does not: the widest part of a bite can sit
    /// strictly between two scanlines.
    ///
    /// `y0 == y1` asks about a single scanline, which is what `span_at` does.
    pub(crate) fn take_bites_from(&self, spans: &mut Spans, y0: f32, y1: f32) {
        for bite in &self.bites {
            if let Some(cut) = bite.removed_between(y0, y1) {
                *spans = subtract(spans, cut);
            }
        }
    }
}

/// One straight part of an outline, in *surface* coordinates.
#[derive(Debug, Clone, Copy)]
struct Edge {
    from: (f32, f32),
    to: (f32, f32),
}

impl Edge {
    fn placed(from: (f32, f32), to: (f32, f32), placement: &Transform) -> Self {
        Self {
            from: placement.transform_point(from.0, from.1),
            to: placement.transform_point(to.0, to.1),
        }
    }
}

/// One corner's circle, in the shape's own coordinates.
#[derive(Debug, Clone, Copy)]
struct Corner {
    centre: (f32, f32),
    radius: f32,
    /// Which quadrant of the circle this corner is, as a sign per axis.
    quadrant: (f32, f32),
}

impl Corner {
    /// Points along the superellipse between the two sides, exclusive of both.
    ///
    /// Parameterised so the samples are spread evenly around the corner rather
    /// than evenly in x: `(cos t)^(2/n)` and `(sin t)^(2/n)` trace
    /// `|x|^n + |y|^n = r^n` for `t` in the first quadrant, which is where the
    /// curve bends most and where chords of it fall furthest inside.
    fn superellipse(&self, curvature: f32, samples: usize) -> impl Iterator<Item = (f32, f32)> {
        let n = 2f32.powf(curvature);
        let (cx, cy) = self.centre;
        let (qx, qy) = self.quadrant;
        let r = self.radius;
        (1..=samples).map(move |i| {
            let t = std::f32::consts::FRAC_PI_2 * i as f32 / (samples + 1) as f32;
            (
                cx + qx * r * t.cos().powf(2.0 / n),
                cy + qy * r * t.sin().powf(2.0 / n),
            )
        })
    }

    /// Where the arc meets the side it shares an x with — the left or right
    /// edge.
    fn on_x_side(&self) -> (f32, f32) {
        (self.centre.0 + self.quadrant.0 * self.radius, self.centre.1)
    }

    /// Where it meets the side it shares a y with — the top or bottom edge.
    fn on_y_side(&self) -> (f32, f32) {
        (self.centre.0, self.centre.1 + self.quadrant.1 * self.radius)
    }
}

/// A corner arc with everything a scanline query needs worked out in advance.
///
/// The arc is `centre + A·r·(cos t, sin t)`, so its height above a scanline is
/// `p·cos t + q·sin t = y - centre_y`. That is one cosine with a phase, which
/// is why `amplitude` and `phase` can be found once and every scanline costs an
/// `acos` rather than a solve.
#[derive(Debug, Clone, Copy)]
struct Arc {
    /// The circle, still in the shape's own space: the answer is a point on it.
    corner: Corner,
    /// Where its centre sits on the surface, vertically.
    centre_y: f32,
    solve: Solve,
    placement: Transform,
    /// The parameter where the *placed* circle reaches furthest in x, as
    /// `(cos t, sin t)`. Surface x is `a·x + b·y`, so it turns where
    /// `-a·sin t + b·cos t` is zero — a property of the placement, not of any
    /// scanline, and [`Arc::removed_between`] asks for it once per band.
    widest_x: (f32, f32),
}

/// How to get from a scanline to a point on the arc.
#[derive(Debug, Clone, Copy)]
enum Solve {
    /// Nothing turned it, so the scanline gives `sin t` directly.
    Upright { half_height: f32 },
    /// Something did, and the height is a cosine with a phase.
    Turned { amplitude: f32, phase: f32 },
}

impl Arc {
    fn placed(corner: &Corner, placement: &Transform) -> Self {
        let (_, centre_y) = placement.transform_point(corner.centre.0, corner.centre.1);
        // An axis-keeping placement leaves `c` at zero, so the height equation
        // loses its cosine term and `sin t` falls straight out of the scanline.
        // That is one square root where the general case is an `atan2`, an
        // `acos` and two more trig calls — per corner, per scanline, on every
        // painted frame, for shapes that are almost all of them.
        let t = placement.b().atan2(placement.a());
        let widest_x = (t.cos(), t.sin());
        if placement.keeps_axes() {
            return Self {
                corner: *corner,
                centre_y,
                solve: Solve::Upright {
                    half_height: placement.d() * corner.radius,
                },
                placement: *placement,
                widest_x,
            };
        }
        // `c` and `d`, the matrix's *second row*: the layout is
        // `[a, b, tx, c, d, ty]` and `y ↦ c·x + d·y + ty`, so those are the two
        // coefficients that decide a point's height. Reading `b` here — the
        // x-from-y term — is inert for anything axis-aligned, where `b` and `c`
        // are both zero, and mirrors every solution about the corner's centre
        // the moment something turns.
        let (p, q) = (placement.c() * corner.radius, placement.d() * corner.radius);
        Self {
            corner: *corner,
            centre_y,
            solve: Solve::Turned {
                amplitude: (p * p + q * q).sqrt(),
                phase: q.atan2(p),
            },
            placement: *placement,
            widest_x,
        }
    }

    /// The two points of the circle at height `target` above its centre, in
    /// the circle's own frame, or `None` where the scanline misses it.
    ///
    /// Both solves answer the same question — the height of `centre + A·r·(cos
    /// t, sin t)` above the centre is `target` — and differ only in what the
    /// placement lets them assume about it.
    fn at_height(&self, target: f32) -> Option<[(f32, f32); 2]> {
        match self.solve {
            Solve::Upright { half_height } => {
                if half_height.abs() < f32::EPSILON || target.abs() > half_height.abs() {
                    return None;
                }
                let st = target / half_height;
                let ct = (1.0 - st * st).max(0.0).sqrt();
                Some([(ct, st), (-ct, st)])
            }
            Solve::Turned { amplitude, phase } => {
                if amplitude < f32::EPSILON || target.abs() > amplitude {
                    return None;
                }
                let base = (target / amplitude).clamp(-1.0, 1.0).acos();
                let (a, b) = (phase + base, phase - base);
                Some([(a.cos(), a.sin()), (b.cos(), b.sin())])
            }
        }
    }

    /// Where a point of the circle lands on the surface.
    fn point_of(&self, ct: f32, st: f32) -> (f32, f32) {
        let (cx, cy) = self.corner.centre;
        let r = self.corner.radius;
        self.placement.transform_point(cx + r * ct, cy + r * st)
    }

    /// Everything the circle takes out of the band `y0..=y1`, as one interval.
    ///
    /// Used where the circle is a **bite**: the disc a scoop takes out of its
    /// corner. No quadrant filter — the disc removes every point of the shape
    /// inside it, not just the part of it the boundary runs along.
    ///
    /// **The union across the band, not the chord at any one height.** A band
    /// is claimed only where the shape covers it at *every* height in it, so a
    /// column has to come out if the disc reaches it anywhere in the band.
    /// Asking at the widest single height is enough only while the placed disc
    /// is still a disc: a rotation maps one to another, so the chord nearest
    /// its centre contains every other. A rotation composed with a
    /// non-uniform scale does not — `container().rotate(20.0).scale(Scale::new(2.0,
    /// 1.0))` places a *tilted ellipse*, whose horizontal chord slides
    /// sideways as it grows, and a column the widest chord misses is one the
    /// disc still covers half a band away. That claimed pixels nothing drew,
    /// which is the promise here that is zero and not a tolerance.
    ///
    /// The band cuts the ellipse into a convex region, so its horizontal
    /// extent is reached on the boundary: either at an end of one of the two
    /// edge chords, or where the ellipse itself reaches furthest in x. Six
    /// candidates, and the extremes are among them. A band holding the whole
    /// disc has no edge chord at all and is bounded by the second pair alone.
    fn removed_between(&self, y0: f32, y1: f32) -> Option<(f32, f32)> {
        let (lo, hi) = if y0 <= y1 { (y0, y1) } else { (y1, y0) };
        let (mut left, mut right) = (f32::INFINITY, f32::NEG_INFINITY);
        let mut take = |x: f32| {
            left = left.min(x);
            right = right.max(x);
        };

        for edge in [lo, hi] {
            if let Some(pair) = self.at_height(edge - self.centre_y) {
                for (ct, st) in pair {
                    take(self.point_of(ct, st).0);
                }
            }
        }

        // And where the placed circle reaches furthest in x, from either side.
        let (ct, st) = self.widest_x;
        for (ct, st) in [(ct, st), (-ct, -st)] {
            let (x, y) = self.point_of(ct, st);
            if (lo..=hi).contains(&y) {
                take(x);
            }
        }

        (left <= right).then_some((left, right))
    }

    /// Where this arc crosses scanline `y`, if it does — at most twice.
    fn hits(&self, y: f32, hit: &mut impl FnMut(f32)) {
        let target = y - self.centre_y;
        let Some(pair) = self.at_height(target) else {
            return;
        };

        for (ct, st) in pair {
            // Only this corner's own quadrant of the circle. Asked in the
            // circle's own frame, which is where the quadrant is defined — the
            // transform is applied after.
            if ct * self.corner.quadrant.0 < -1e-6 || st * self.corner.quadrant.1 < -1e-6 {
                continue;
            }
            hit(self.point_of(ct, st).0);
        }
    }
}

/// Whether a corner of this radius, measured on the surface, is square: too
/// small to round away half a pixel. The one threshold both
/// [`PlacedShape::is_a_box`] and [`PlacedShape::box_cuts_like_the_shape`]
/// read, so a shape that is a box for one is cut like a box by the other.
fn is_square(radius_on_surface: f32) -> bool {
    radius_on_surface <= 0.5
}

/// Whether two rects share any area at all. Touching edges do not count: a
/// corner box and an ink box that meet exactly are cut the same by either.
fn overlaps(a: Rect, b: Rect) -> bool {
    a.x < b.x + b.width && b.x < a.x + a.width && a.y < b.y + b.height && b.y < a.y + a.height
}

/// Each corner at most half the smaller side — the clamp the *shader* applies,
/// and `Rect::shape_distance` with it.
///
/// There were two rules here and they were not the same one. This one used to
/// shrink all four corners by a single factor so no two sharing an edge could
/// overlap, which is what CSS `border-radius` does and what a *layout* wants;
/// the shader has always clamped each corner on its own. The two agree
/// whenever the four radii agree and diverge the moment they do not, so a
/// container with unequal corners published a region for a shape nobody drew:
/// 74 pixels claimed outside it at `tl = 100, tr = 40` on a 120x120 box, and
/// 89.2% of it covered where every other configuration holds above 97% (#417).
///
/// **Two clamped corners cannot cross**, which is the whole of what the
/// proportional rule prevented. Each is at most half the *smaller* side, so
/// two on one edge sum to at most the whole of that edge: they meet exactly
/// in the limit, leaving a straight run of zero length between them, and the
/// outline stays a simple closed curve. `outline` needs nothing else from the
/// rule it used to apply.
///
/// This is where the region agrees with the pixels. It is not a statement
/// about what CSS would draw, and nothing here decides that — the shader does,
/// and this follows it.
fn clamp_radii(radii: CornerRadii, w: f32, h: f32) -> CornerRadii {
    let half = (w * 0.5).min(h * 0.5);
    let clamp = |r: f32| r.max(0.0).min(half);
    CornerRadii {
        top_left: clamp(radii.top_left),
        top_right: clamp(radii.top_right),
        bottom_right: clamp(radii.bottom_right),
        bottom_left: clamp(radii.bottom_left),
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::renderer::CornerRadii;
    use crate::widgets::Rect;

    fn scooped(placement: Transform) -> PlacedShape {
        PlacedShape::placed(
            Rect::new(0.0, 0.0, 120.0, 120.0),
            CornerRadii::uniform(40.0),
            -1.0,
            placement,
        )
    }

    fn sheared() -> Transform {
        Transform::rotate_degrees(25.0).then(&Transform::scale_xy(3.0, 1.0))
    }

    /// A scanline the circle does not reach has no answer, and one it does
    /// reach is answered on the circle.
    ///
    /// Both of `at_height`'s branches open with a guard, and both guards are
    /// invisible to everything downstream. Past them the arithmetic does not
    /// blow up — it quietly lands somewhere real: the upright branch takes
    /// `sqrt` of a clamped negative and gets `cos t = 0`, the turned branch
    /// `acos` of a clamped ratio and gets the circle's own vertical extreme.
    /// Either way the point's x is the corner circle's centre, which lies
    /// inside the shape at every scanline that reaches it — so `bounds_at`'s
    /// min/max never moves and no published pixel changes. Ten mutants of
    /// these two lines survived the whole suite on that.
    ///
    /// Harmless is not the same as right. A solution returned for a height
    /// the circle does not cross is a wrong answer that happens not to be
    /// used, and the next caller to trust `at_height` — `removed_between`
    /// already does, without a quadrant filter to hide behind — has no reason
    /// to expect one. So the guard is asked directly.
    #[test]
    fn a_circle_answers_only_the_scanlines_it_crosses() {
        let corner = Corner {
            centre: (40.0, 40.0),
            radius: 40.0,
            quadrant: (-1.0, -1.0),
        };
        // A circle with no height left answers nothing at all. Without that
        // guard the solve divides zero by zero, and `NaN` is a point on no
        // circle — the other side of the same line, and the only case that
        // separates `< EPSILON` from `== EPSILON`.
        //
        // One flattened case per branch, because they guard separately. A
        // radius of zero leaves an upright placement upright; scaling y to
        // nothing costs the placement its `keeps_axes` and sends it the other
        // way. Note that a *rotated* flat circle is not this: it is a slanted
        // segment, and it crosses scanlines perfectly well.
        for flat in [
            Arc::placed(
                &Corner {
                    radius: 0.0,
                    ..corner
                },
                &Transform::IDENTITY,
            ),
            Arc::placed(&corner, &Transform::scale_xy(1.0, 0.0)),
        ] {
            for target in [0.0_f32, 1.0, -1.0] {
                assert!(
                    flat.at_height(target).is_none(),
                    "a circle with no height crosses no scanline, and answering \
                     one means answering with NaN"
                );
            }
        }

        for placement in [
            Transform::IDENTITY,
            Transform::rotate_degrees(30.0),
            sheared(),
            Transform::scale_xy(2.0, 3.0),
        ] {
            let arc = Arc::placed(&corner, &placement);

            // The circle's own reach, whatever the placement did to it.
            let reach = match arc.solve {
                Solve::Upright { half_height } => half_height.abs(),
                Solve::Turned { amplitude, .. } => amplitude,
            };
            assert!(reach > 1.0, "the placed circle has to have some height");

            for (target, crosses) in [
                (0.0, true),
                (reach * 0.5, true),
                (-reach * 0.5, true),
                // Exactly tangent, at both extremes. The scanline grazes the
                // circle at one point, so there *is* an answer — and it is
                // the only height where `>` and `>=` disagree.
                (reach, true),
                (-reach, true),
                (reach * 1.01, false),
                (-reach * 1.01, false),
                (reach * 4.0, false),
            ] {
                let answer = arc.at_height(target);
                assert_eq!(
                    answer.is_some(),
                    crosses,
                    "a height of {target} against a reach of {reach}"
                );
                // And what comes back is on the circle, at the height asked.
                for (ct, st) in answer.into_iter().flatten() {
                    assert!(
                        (ct * ct + st * st - 1.0).abs() < 1e-3,
                        "({ct}, {st}) is not on the unit circle"
                    );
                    let (_, y) = arc.point_of(ct, st);
                    assert!(
                        (y - arc.centre_y - target).abs() < 1e-2,
                        "asked for height {target} and got a point at {}",
                        y - arc.centre_y
                    );
                }
            }
        }
    }

    /// `subtract` keeps its promise: what it returns is what was in the span
    /// and not in the cut, and every span it returns is a real interval.
    ///
    /// The second half is the one nothing else can see. A degenerate span
    /// rounds to no rectangle, so letting one out changes no published pixel
    /// — and the band loop was rewritten on the claim that `subtract` cannot
    /// make an empty span out of a real one, which is exactly the kind of
    /// claim that stops being true without a word. Trimming at `a <= lo`
    /// instead of `a < lo` breaks it and nothing downstream objects.
    ///
    /// Membership is checked against the definition rather than against
    /// expected output, so the cases are free: a cut that misses, that
    /// touches at either end, that trims one side, that splits, and that
    /// swallows the span whole.
    #[test]
    fn subtract_removes_exactly_the_cut_and_leaves_real_intervals() {
        let spans: Spans = [(0.0_f32, 10.0), (20.0, 30.0)].into_iter().collect();

        for cut in [
            (-5.0_f32, -1.0), // entirely before
            (40.0, 50.0),     // entirely after
            (-5.0, 0.0),      // touching the first span's left edge
            (10.0, 15.0),     // touching the first span's right edge
            (-5.0, 4.0),      // trimming the left
            (6.0, 15.0),      // trimming the right
            (3.0, 7.0),       // splitting it
            (-5.0, 35.0),     // swallowing both
            (0.0, 10.0),      // exactly one span
            (5.0, 5.0),       // degenerate cut
        ] {
            let out = subtract(&spans, cut);

            for &(left, right) in &out {
                assert!(
                    left < right,
                    "cut {cut:?} left a span {left}..{right} that is not an interval"
                );
            }
            for pair in out.windows(2) {
                assert!(
                    pair[0].1 <= pair[1].0,
                    "cut {cut:?} returned {out:?}, which is not ascending and disjoint"
                );
            }

            // Every point, against the definition.
            let mut x = -10.0_f32;
            while x < 40.0 {
                let was_in = spans.iter().any(|&(a, b)| x >= a && x < b);
                let cut_out = x >= cut.0 && x < cut.1;
                let is_in = out.iter().any(|&(a, b)| x >= a && x < b);
                assert_eq!(
                    is_in,
                    was_in && !cut_out,
                    "cut {cut:?} on {spans:?} gave {out:?}, which disagrees at x={x}"
                );
                x += 0.25;
            }
        }
    }

    /// Where it says the box is exact, no pixel disagrees.
    ///
    /// The hand-picked cases below say what the predicate is *for*; this says
    /// it is not wrong. `box_cuts_like_the_shape` may answer `false` as often
    /// as it likes — that only sends a text down the quad path it did not
    /// need — but an answer of `true` is a promise that cutting the ink to
    /// four integers cuts it the way the shape would, and a broken one leaves
    /// glyphs outside their clip with nothing to catch it.
    ///
    /// So the promise is checked against the pixels: wherever it says `true`,
    /// walk the ink and find a point the box keeps and the shape does not.
    /// There must be none. Asymmetric radii, both oblong shapes, scales that
    /// differ per axis and a mirror, because the wedges are placed by sign and
    /// sized by scale and every one of those is a term that can be written
    /// backwards.
    #[test]
    fn where_the_box_is_called_exact_no_pixel_disagrees() {
        use crate::widgets::Corners;

        // Two sets, because a corner with no radius has no wedge and so
        // cannot say whether the wedge would have been put in the right
        // place. The first gives all four a different size; the second
        // returns the zeros, which is the ordinary shape of a card whose top
        // is rounded and whose bottom is not.
        let radii = [
            CornerRadii {
                top_left: 30.0,
                top_right: 12.0,
                bottom_right: 40.0,
                bottom_left: 22.0,
            },
            CornerRadii {
                top_left: 26.0,
                top_right: 0.0,
                bottom_right: 0.0,
                bottom_left: 18.0,
            },
        ];
        let placements = [
            Transform::IDENTITY,
            Transform::scale_xy(2.0, 3.0),
            Transform::scale_xy(0.5, 1.5),
            Transform::scale_xy(-1.0, 1.0),
            Transform::rotate_degrees(20.0),
        ];

        let mut exact = 0;
        for (w, h) in [(200.0_f32, 100.0_f32), (90.0, 240.0)] {
            for radii in radii {
                for placement in placements {
                    let shape =
                        PlacedShape::placed(Rect::new(0.0, 0.0, w, h), radii, 1.0, placement);
                    let Some(to_local) = placement.inverse() else {
                        continue;
                    };
                    let corners = Corners {
                        radii: shape.clamped_radii(),
                        curvature: 1.0,
                    };
                    let local = Rect::new(0.0, 0.0, w, h);
                    let b = shape.world_aabb();

                    // Ink boxes all over the shape and past every edge of it.
                    let step = 24.0;
                    let mut y = b.y - step;
                    while y < b.y + b.height + step {
                        let mut x = b.x - step;
                        while x < b.x + b.width + step {
                            let ink = Rect::new(x, y, step, step);
                            if shape.box_cuts_like_the_shape(ink) {
                                exact += 1;
                                // Every point the box would keep, the shape keeps.
                                let mut py = ink.y;
                                while py < ink.y + ink.height {
                                    let mut px = ink.x;
                                    while px < ink.x + ink.width {
                                        let in_box = px >= b.x
                                            && px < b.x + b.width
                                            && py >= b.y
                                            && py < b.y + b.height;
                                        if in_box {
                                            let (lx, ly) = to_local.transform_point(px, py);
                                            assert!(
                                                local.contains_shape(lx, ly, corners),
                                                "{w}x{h} under {placement:?}: the box is called \
                                             exact for {ink:?}, and ({px}, {py}) is inside the \
                                             box and outside the shape"
                                            );
                                        }
                                        px += 1.0;
                                    }
                                    py += 1.0;
                                }
                            }
                            x += step;
                        }
                        y += step;
                    }
                }
            }
        }
        assert!(
            exact > 100,
            "the predicate said the box was exact {exact} times, which is too \
             few for this to have checked anything"
        );
    }

    /// The box is exact where the shape has no corner to differ in, and not
    /// where it has.
    ///
    /// What routes a text to glyphon or to the quad. Getting it wrong in one
    /// direction leaves ink outside its clip, which is the defect; in the
    /// other it costs a rasterization and an upload for a text the box would
    /// have cut correctly.
    #[test]
    fn a_box_cuts_like_its_shape_only_where_the_corners_are_not() {
        let card = |radius: f32, placement: Transform| {
            PlacedShape::placed(
                Rect::new(0.0, 0.0, 200.0, 100.0),
                CornerRadii::uniform(radius),
                1.0,
                placement,
            )
        };

        // A square clip is its own box, wherever the ink is.
        let square = card(0.0, Transform::IDENTITY);
        assert!(square.box_cuts_like_the_shape(Rect::new(0.0, 0.0, 200.0, 100.0)));
        assert!(
            square.box_cuts_like_the_shape(Rect::new(-10.0, -10.0, 220.0, 120.0)),
            "ink running past every corner point is still cut by the box, which \
             is the shape — a square corner has no wedge to reach into"
        );
        // Under half a pixel is square, as `is_a_box` counts it; past it, a
        // corner rounds a pixel away and the box would not cut like it.
        let hairline = card(0.3, Transform::IDENTITY);
        assert!(hairline.is_a_box());
        assert!(hairline.box_cuts_like_the_shape(Rect::new(-10.0, -10.0, 220.0, 120.0)));
        assert!(
            !card(0.3, Transform::scale(4.0))
                .box_cuts_like_the_shape(Rect::new(-10.0, -10.0, 900.0, 500.0))
        );

        let rounded = card(30.0, Transform::IDENTITY);
        // Down the middle, clear of all four corner boxes.
        assert!(
            rounded.box_cuts_like_the_shape(Rect::new(40.0, 35.0, 120.0, 30.0)),
            "a label in the middle of the card is cut the same by either"
        );
        // Into the top-left corner box.
        assert!(
            !rounded.box_cuts_like_the_shape(Rect::new(10.0, 10.0, 40.0, 20.0)),
            "ink inside a corner box is where the two answers differ"
        );
        // Along the top edge but below the corners: the corner box is 30 tall,
        // so ink starting at 35 misses it.
        assert!(
            rounded.box_cuts_like_the_shape(Rect::new(0.0, 35.0, 200.0, 20.0)),
            "the corner box is as tall as the radius and no taller"
        );

        // A turn has no cheap region to name, so it always needs the shape —
        // even for ink in the middle, and even with no corners at all.
        let turned = card(0.0, Transform::rotate_degrees(15.0));
        assert!(!turned.box_cuts_like_the_shape(Rect::new(80.0, 40.0, 20.0, 10.0)));

        // The corner box is measured on the *surface*, so a scale grows it:
        // this ink clears a 30-radius corner upright and not at 3x.
        let scaled = card(30.0, Transform::scale_xy(3.0, 3.0));
        assert!(rounded.box_cuts_like_the_shape(Rect::new(0.0, 35.0, 200.0, 20.0)));
        assert!(
            !scaled.box_cuts_like_the_shape(Rect::new(0.0, 35.0, 600.0, 20.0)),
            "a 30 radius under a 3x scale is 90 pixels of corner"
        );
    }

    /// A band claims only what the shape covers at *every* height inside it.
    ///
    /// This is the promise the whole band loop rests on, and for the convex
    /// part of a shape it is free: the left boundary is a convex function of
    /// `y` and the right a concave one, so the intersection of the two edge
    /// scanlines is inside the shape everywhere between them.
    ///
    /// A bite is where it has to be earned. Asked through
    /// `placed_shape_to_rects` this is nearly untestable — bands are about a
    /// pixel tall, the chord half a pixel from an ellipse's widest point is
    /// shorter by a fraction of one, and whole-pixel rounding swallows the
    /// difference. Three mutants of `removed_between` survived the entire
    /// suite for exactly that reason: swap its two arguments, or take the
    /// wrong reflection of the widest point, and every published rectangle
    /// came back identical.
    ///
    /// So this asks the geometry rather than the pixels: sample the claim
    /// across the band, and every sampled column must be inside the shape at
    /// twenty-one heights spanning it. A bite subtracted at one height rather
    /// than across the band fails it, because the ellipse a shear places has a
    /// chord that *slides* as it grows.
    #[test]
    fn a_band_claims_nothing_the_shape_misses_anywhere_in_it() {
        for placement in [
            Transform::IDENTITY,
            Transform::rotate_degrees(30.0),
            sheared(),
        ] {
            let shape = scooped(placement);
            let outline = shape.outline();
            let (top, bottom) = shape.y_bounds();
            // Deliberately coarser than the band loop's one-per-pixel: a
            // taller band is where a bite's widest point is furthest from
            // either edge, and it is the case the arithmetic exists for.
            let bands = 24;
            let step = (bottom - top) / bands as f32;

            let mut checked = 0;
            for i in 0..bands {
                let (y0, y1) = (top + i as f32 * step, top + (i + 1) as f32 * step);
                let (Some(a), Some(b)) = (outline.bounds_at(y0), outline.bounds_at(y1)) else {
                    continue;
                };
                let band = (a.0.max(b.0), a.1.min(b.1));
                let mut claimed = Spans::new();
                if band.0 < band.1 {
                    claimed.push(band);
                }
                outline.take_bites_from(&mut claimed, y0, y1);

                for &(lo, hi) in &claimed {
                    for t in 0..=8 {
                        let x = lo + (hi - lo) * t as f32 / 8.0;
                        for s in 0..=20 {
                            let y = y0 + (y1 - y0) * s as f32 / 20.0;
                            let there = outline.span_at(y);
                            let covered = there
                                .iter()
                                .any(|&(left, right)| x >= left - 1e-3 && x <= right + 1e-3);
                            assert!(
                                covered,
                                "the band {y0}..{y1} claims x={x}, which the shape does not \
                                 cover at y={y}: it is {there:?} there"
                            );
                            checked += 1;
                        }
                    }
                }
            }
            assert!(
                checked > 2000,
                "the bands have to actually claim something to be worth checking: {checked}"
            );
        }
    }

    /// A corner with no radius is not a bite.
    ///
    /// The filter that says so is invisible to anything counting pixels. A
    /// zero-radius bite answers no scanline — `at_height` refuses it — but its
    /// widest point is the corner itself, so it removes a zero-width interval,
    /// and `subtract` splits the span it lands in *into two that abut*. The
    /// published pixels are identical; there are simply twice as many
    /// rectangles covering them, and a `wl_region` is a list the compositor
    /// has to receive.
    ///
    /// So this counts bites rather than pixels. `top(50.0)` scoops two corners
    /// and leaves two at zero, which is the shape the filter exists for.
    #[test]
    fn a_corner_with_no_radius_is_not_a_bite() {
        let shape = PlacedShape::placed(
            Rect::new(0.0, 0.0, 120.0, 60.0),
            CornerRadii {
                top_left: 50.0,
                top_right: 50.0,
                bottom_right: 0.0,
                bottom_left: 0.0,
            },
            -1.0,
            Transform::IDENTITY,
        );
        assert_eq!(
            shape.outline().bites.len(),
            2,
            "two corners are scooped and two have no radius at all"
        );

        // And a convex curvature has none of them whatever its radii.
        let round = PlacedShape::placed(
            Rect::new(0.0, 0.0, 120.0, 60.0),
            CornerRadii::uniform(20.0),
            1.0,
            Transform::IDENTITY,
        );
        assert!(round.outline().bites.is_empty(), "only a scoop bites");
    }

    /// A band is the same band whichever end it is named from.
    ///
    /// `removed_between` normalises its two arguments, and nothing reaches it
    /// backwards today — the band loop counts upward and `span_at` passes the
    /// same height twice. That makes the normalisation exactly the kind of
    /// line a test never reaches and a later caller relies on, so it is asked
    /// here directly rather than left to be discovered.
    #[test]
    fn a_bite_does_not_care_which_end_of_the_band_it_is_given() {
        let outline = scooped(sheared()).outline();
        let (top, bottom) = scooped(sheared()).y_bounds();

        let mut agreed = 0;
        for i in 0..24 {
            let (y0, y1) = (
                top + (bottom - top) * i as f32 / 24.0,
                top + (bottom - top) * (i + 1) as f32 / 24.0,
            );
            let mut forward = Spans::new();
            forward.push((-1e4, 1e4));
            outline.take_bites_from(&mut forward, y0, y1);

            let mut backward = Spans::new();
            backward.push((-1e4, 1e4));
            outline.take_bites_from(&mut backward, y1, y0);

            assert_eq!(
                forward, backward,
                "the band {y0}..{y1} lost a different bite when named backwards"
            );
            if forward.len() > 1 {
                agreed += 1;
            }
        }
        assert!(
            agreed > 0,
            "no band here actually had a bite taken out of it, so the two \
             orders agreed on nothing"
        );
    }
}