guido 0.12.0

//! Characterization tests: what `Container` does *today*.
//!
//! These pin observable behaviour — resulting sizes, emitted draw commands,
//! event outcomes, invalidation job types — without asserting anything about
//! how `layout`/`paint`/`event` are structured internally. They are the net
//! the container refactor moves under: a test that fails here means the
//! refactor changed behaviour, which is the one thing it must not do.
//!
//! When a test documents something that looks wrong rather than merely
//! surprising, it says so in its own comment instead of asserting the
//! desirable value — pinning reality is the job; fixing it is a separate
//! change with its own test.

use rustc_hash::FxHashSet;

use super::*;
use crate::animation::{Animate, Keyframes, Repeat, SpringConfig, TimingFunction, Transition};
use crate::backdrop::BackdropSources;
use crate::jobs::{self, JobType};
use crate::layout::{Constraints, Flex, at_least, at_most, fill, fraction};
use crate::reactive::{Signal, create_signal};
use crate::renderer::{DrawCommand, RenderNode};
use crate::widgets::CornerRadii;
use crate::widgets::widget::{Event, EventResponse, MouseButton};

// ---------------------------------------------------------------------------
// Harness
// ---------------------------------------------------------------------------

struct H {
    tree: Tree,
    root: WidgetId,
    /// The last frame's render tree and flattened commands, retained as the
    /// loop retains them — a frame that repaints nothing publishes from these.
    last: Option<(
        std::rc::Rc<RenderNode>,
        Vec<crate::renderer::FlattenedCommand>,
        crate::renderer::FlattenScratch,
    )>,
}

impl H {
    fn new(widget: impl Widget + 'static) -> Self {
        let mut tree = Tree::new();
        let root = tree.register(Box::new(widget));
        tree.with_widget_mut(root, |w, id, t| w.register_children(t, id));
        Self {
            tree,
            root,
            last: None,
        }
    }

    fn layout(&mut self, constraints: Constraints) -> Size {
        let root = self.root;
        self.tree
            .layout_widget(root, constraints)
            .expect("root is registered")
    }

    /// The measure pass: what a content-sized surface is configured from.
    fn measure(&mut self, constraints: Constraints) -> Size {
        let root = self.root;
        self.tree
            .measure_widget(root, constraints)
            .expect("root is registered")
    }

    /// Lay out loose within `w` x `h`.
    fn fit(&mut self, w: f32, h: f32) -> Size {
        self.layout(Constraints::new(0.0, 0.0, w, h))
    }

    /// One animation pass at a named instant, and what it said about whether
    /// anything is still moving.
    fn advance_at(&mut self, now: std::time::Instant) -> bool {
        self.tree.set_frame_instant(Some(now));
        let root = self.root;
        let moving = self
            .tree
            .with_widget_mut(root, |w, id, t| w.advance_animations(t, id))
            .expect("root is registered");
        self.tree.set_frame_instant(None);
        moving
    }

    fn paint(&mut self) -> RenderNode {
        let root = self.root;
        let mut node = RenderNode::new(root.as_u64());
        self.tree.paint_widget(root, &mut node, 1.0);
        node
    }

    /// One frame, in the phases and the order `render_surface` runs them: queued
    /// jobs, layout, the skip-frame gate, paint, flatten, the compositor blur
    /// region read off the result, and `crate::cache_paint_results` to finish.
    ///
    /// Two of those are the loop's own code rather than a stand-in for it, and
    /// both were learned the hard way — and it is called the way the loop calls
    /// it, per child of the root, not on the root. `cache_paint_results` written out by hand
    /// left `cache_paint` undone, so `reuse_cached` never found a cache and every
    /// test repainted everything — making the whole class of bug about a widget
    /// that is *not* repainted structurally invisible here. And a `frame` that
    /// always painted could not reach the gate at all, where the loop publishes
    /// the region from the buffer it retained.
    ///
    /// Use this, not `paint()`, for anything whose correctness is about when in
    /// the frame it happens, or about which widgets painted at all.
    fn frame(&mut self, w: f32, h: f32) -> Frame {
        pump(self);
        self.fit(w, h);

        let root = self.root;
        if !self.tree.needs_paint(root)
            && let Some((node, commands, scratch)) = &self.last
        {
            // The gate: nothing is dirty, so nothing repaints and the region
            // comes from the frame still on screen.
            let blur = crate::blur::regions_from_commands(commands, scratch.clip_chains());
            let input = crate::region::input_ops_from_commands(commands, scratch.clip_chains());
            return Frame {
                node: std::rc::Rc::clone(node),
                blur,
                input,
            };
        }

        let mut node = RenderNode::new(root.as_u64());
        self.tree.paint_widget(root, &mut node, 1.0);

        let node = std::rc::Rc::new(node);
        let mut commands = Vec::new();
        let mut layers = Vec::new();
        let mut scratch = crate::renderer::FlattenScratch::default();
        let _ = crate::renderer::flatten_root_into(&node, &mut commands, &mut layers, &mut scratch);
        let blur = crate::blur::regions_from_commands(&commands, scratch.clip_chains());
        let input = crate::region::input_ops_from_commands(&commands, scratch.clip_chains());

        // Per child of the root and then `clear_needs_paint(root)`, which is
        // what the loop does: the surface root always repaints, so it is never
        // cache-reused, and handing it to `cache_paint_results` would leave the
        // harness with a cache entry the loop never has.
        for child in &node.children {
            crate::cache_paint_results(&mut self.tree, child);
        }
        self.tree.clear_needs_paint(root);
        self.last = Some((std::rc::Rc::clone(&node), commands, scratch));

        Frame { node, blur, input }
    }

    fn send(&mut self, event: Event) -> EventResponse {
        let root = self.root;
        // Event dispatch runs inside a snapshot zone in the real loop
        // (`render_surface`, lib.rs): hit testing reads animated values for
        // *this* event and must not subscribe to them. Outside the zone those
        // reads trip the non-reactive-read diagnostic, which would be the
        // harness reporting on itself.
        crate::reactive::diagnostics::snapshot_zone(|| {
            self.tree
                .dispatch(root, &event)
                .expect("root is registered")
        })
    }

    fn children(&self) -> Vec<WidgetId> {
        self.tree.get_children(self.root).to_vec()
    }

    fn roots(&self) -> FxHashSet<WidgetId> {
        [self.root].into_iter().collect()
    }

    /// Discard every queued job so the next drain only sees what follows.
    fn drain_jobs(&mut self) {
        let roots = self.roots();
        jobs::distribute_jobs(&self.tree, &roots);
        jobs::recycle_job_buffer(jobs::drain_surface_jobs(self.root));
        jobs::recycle_job_buffer(jobs::drain_orphan_jobs());
    }

    /// Job types queued for the root widget by `write`.
    fn jobs_from(&mut self, write: impl FnOnce()) -> Vec<JobType> {
        self.drain_jobs();
        write();
        let roots = self.roots();
        jobs::distribute_jobs(&self.tree, &roots);
        let drained = jobs::drain_surface_jobs(self.root);
        let mut types: Vec<JobType> = drained
            .iter()
            .filter(|j| j.widget_id == self.root)
            .map(|j| j.job_type)
            .collect();
        types.sort_by_key(|t| format!("{t:?}"));
        types.dedup();
        jobs::recycle_job_buffer(drained);
        types
    }
}

/// What one frame produced: the render tree, and the compositor blur region the
/// paint left registered.
struct Frame {
    node: std::rc::Rc<RenderNode>,
    blur: Vec<crate::region::RegionRect>,
    input: Vec<crate::region::InputRegionOp>,
}

/// A leaf of an exactly known size.
fn box_of(w: f32, h: f32) -> Container {
    container().width(w).height(h)
}

/// Every `RoundedRect` drawn by a node, in order, as (bounds, fill).
fn rects(node: &RenderNode) -> Vec<(Rect, Color)> {
    node.commands
        .iter()
        .filter_map(|c| match &**c {
            DrawCommand::RoundedRect { rect, color, .. } => Some((*rect, *color)),
            _ => None,
        })
        .collect()
}

/// The width and colour of every border drawn, in paint order.
fn borders(node: &RenderNode) -> Vec<(f32, Color)> {
    node.commands
        .iter()
        .filter_map(|c| match &**c {
            DrawCommand::RoundedRect {
                border: Some(border),
                ..
            } => Some((border.width, border.color)),
            _ => None,
        })
        .collect()
}

// ---------------------------------------------------------------------------
// Sizing — the box model matrix
// ---------------------------------------------------------------------------

/// A state layer that only scales must not make the container resolve a
/// translate and a rotate nothing declares. The fast path is per component,
/// and this is the layer that would have paid for it — it is on every button.
#[test]
fn a_scaling_state_layer_declares_only_a_scale() {
    let c = container()
        .when_hovered(|s| s.lighter(0.1))
        .when_pressed(|s| s.scale(0.98));
    let declared = c
        .interaction
        .as_ref()
        .map(|ix| ix.declares_transform)
        .unwrap_or_default();

    assert!(declared.scale, "the pressed layer names a scale");
    assert!(!declared.translate, "and nothing names a translate");
    assert!(!declared.rotate, "or a rotate");
}

/// And the other two mirrors, because `moves_anything` answers for the three
/// components in a list of its own: one that named the wrong field would put a
/// container back on the slow path, or leave it on the fast one while a layer
/// moved it.
#[test]
fn a_translating_or_rotating_layer_declares_only_its_own_component() {
    let declares = |c: &Container| {
        c.interaction
            .as_ref()
            .map(|ix| ix.declares_transform)
            .unwrap_or_default()
    };

    let translating =
        declares(&container().when_hovered(|s| s.translate(Translate::new(0.0, -2.0))));
    assert!(translating.translate, "the hovered layer names a translate");
    assert!(
        !translating.rotate && !translating.scale,
        "and nothing else"
    );

    let rotating = declares(&container().when_pressed(|s| s.rotate(2.0)));
    assert!(rotating.rotate, "the pressed layer names a rotate");
    assert!(!rotating.translate && !rotating.scale, "and nothing else");
}

#[test]
fn content_sizing_is_child_plus_padding() {
    let mut h = H::new(container().padding(8.0).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0), Size::new(56.0, 36.0));
}

#[test]
fn exact_length_wins_over_content() {
    let mut h = H::new(container().width(60.0).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0).width, 60.0);
}

#[test]
fn fill_takes_the_whole_offered_axis() {
    let mut h = H::new(container().width(fill()).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0).width, 500.0);
}

/// A hidden sibling measures nothing and placement keeps no gap beside it, so a
/// filling child is given that gap too and reaches the row's end (#667). Beside
/// a shown badge it is the row less the gap and the badge, as before.
#[test]
fn a_hidden_sibling_takes_no_spacing_from_a_filling_one() {
    use crate::layout::flex_layout::MIN_VISIBLE_SIZE;

    // Lays `children` out in a 300-long flex with spacing 8, and says where
    // each one starts and how long it is, along the flex.
    let laid_out = |column: bool, children: Vec<Container>| {
        let flex = if column { Flex::column() } else { Flex::row() };
        let mut h = H::new(
            container()
                .width(300.0)
                .height(300.0)
                .layout(flex.spacing(8.0))
                .children(children),
        );
        h.fit(500.0, 500.0);
        h.children()
            .iter()
            .map(|&child| {
                let r = h.tree.get_bounds(child).unwrap();
                if column {
                    (r.y, r.height)
                } else {
                    (r.x, r.width)
                }
            })
            .collect::<Vec<_>>()
    };
    let filling = |column: bool| {
        if column {
            container().height(fill()).width(20.0)
        } else {
            container().width(fill()).height(20.0)
        }
    };
    let badge = |shown: bool, long: f32| container().visible(shown).width(long).height(long);

    for column in [false, true] {
        assert_eq!(
            laid_out(column, vec![filling(column), badge(false, 40.0)])[0],
            (0.0, 300.0),
            "column: {column}, badge hidden"
        );
        assert_eq!(
            laid_out(column, vec![filling(column), badge(true, 40.0)]),
            [(0.0, 252.0), (260.0, 40.0)],
            "column: {column}, badge shown"
        );
    }
    // Between two filling children, a hidden one leaves the one gap between
    // them, not two.
    assert_eq!(
        laid_out(
            false,
            vec![filling(false), badge(false, 40.0), filling(false)]
        ),
        [(0.0, 146.0), (146.0, 0.0), (154.0, 146.0)]
    );
    // Exactly `MIN_VISIBLE_SIZE` long is too short to keep a gap beside it, in
    // the share as in placement.
    assert_eq!(
        laid_out(false, vec![filling(false), badge(true, MIN_VISIBLE_SIZE)])[0],
        (0.0, 300.0 - MIN_VISIBLE_SIZE)
    );
}

#[test]
fn fraction_resolves_against_the_incoming_max() {
    let mut h = H::new(container().width(fraction(0.5)).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0).width, 250.0);
}

#[test]
fn at_least_raises_a_smaller_content() {
    let mut h = H::new(container().width(at_least(100.0)).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0).width, 100.0);
}

/// A minimum is a floor, not a cap: content wider than it is as wide as it is,
/// and the container grows to hold it (#714).
#[test]
fn at_least_grows_to_a_larger_content() {
    let mut h = H::new(container().width(at_least(55.0)).child(box_of(100.0, 10.0)));
    assert_eq!(h.fit(400.0, 400.0).width, 100.0);
    let inner = h.children()[0];
    assert_eq!(h.tree.get_bounds(inner).unwrap().width, 100.0);
}

/// Content narrower than the minimum is stretched across it, as the default
/// column stretches every child to its width.
#[test]
fn at_least_stretches_a_smaller_content_across_it() {
    let mut h = H::new(
        container()
            .width(at_least(55.0))
            .child(container().height(10.0)),
    );
    assert_eq!(h.fit(400.0, 400.0).width, 55.0);
    let inner = h.children()[0];
    assert_eq!(h.tree.get_bounds(inner).unwrap().width, 55.0);
}

#[test]
fn at_most_caps_a_larger_content() {
    let mut h = H::new(container().width(at_most(30.0)).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0).width, 30.0);
}

/// An explicit width answers only to the parent's maximum, never to its
/// minimum — that is what lets `.width(60)` stay 60 inside a stretching parent.
#[test]
fn explicit_width_ignores_the_parent_minimum() {
    let mut h = H::new(container().width(60.0).child(box_of(40.0, 20.0)));
    assert_eq!(
        h.layout(Constraints::new(200.0, 0.0, 500.0, 500.0)).width,
        60.0
    );
}

#[test]
fn content_sizing_obeys_the_parent_minimum() {
    let mut h = H::new(container().child(box_of(40.0, 20.0)));
    assert_eq!(
        h.layout(Constraints::new(200.0, 0.0, 500.0, 500.0)).width,
        200.0
    );
}

#[test]
fn the_default_layout_stacks_children_in_a_column() {
    let mut h = H::new(
        container()
            .child(box_of(40.0, 20.0))
            .child(box_of(10.0, 30.0)),
    );
    assert_eq!(h.fit(500.0, 500.0), Size::new(40.0, 50.0));
}

#[test]
fn a_row_sums_along_the_main_axis() {
    let mut h = H::new(
        container()
            .layout(Flex::row().spacing(4.0))
            .child(box_of(40.0, 20.0))
            .child(box_of(10.0, 30.0)),
    );
    assert_eq!(h.fit(500.0, 500.0), Size::new(54.0, 30.0));
}

#[test]
fn padding_shrinks_what_children_are_offered() {
    let mut h = H::new(
        container()
            .width(100.0)
            .padding(10.0)
            .child(container().width(fill()).height(5.0)),
    );
    h.fit(500.0, 500.0);
    let child = h.children()[0];
    assert_eq!(h.tree.get_bounds(child).unwrap().width, 80.0);
}

/// The same rule against the box's own maximum rather than the parent's.
/// Children are cut to what they are offered, so what overflows an
/// `at_most(100)` box from inside is its padding: 70 a side is 140 with
/// nothing in it. A box that may not shrink grows back to that; one that may
/// — hidden overflow — keeps to its 100. The parent offers room for both, so
/// only the box's own policy decides.
#[test]
fn padding_past_its_own_maximum_grows_a_visible_box_and_not_a_hidden_one() {
    let padded = |overflow: Overflow| {
        container()
            .width(at_most(100.0))
            .padding(70.0)
            .overflow(overflow)
    };

    let mut visible = H::new(padded(Overflow::Visible));
    assert_eq!(
        visible.fit(500.0, 500.0).width,
        140.0,
        "a box that may not shrink grows back to its content"
    );

    let mut hidden = H::new(padded(Overflow::Hidden));
    assert_eq!(
        hidden.fit(500.0, 500.0).width,
        100.0,
        "a box that may shrink keeps to its own maximum"
    );
}

/// Content larger than the container grows it back unless shrinking was
/// explicitly allowed (hidden overflow, scrolling, an exact length, or a
/// running size animation).
#[test]
fn overflowing_content_grows_a_visible_container() {
    let mut h = H::new(container().child(box_of(400.0, 10.0)));
    assert_eq!(h.fit(100.0, 500.0).width, 100.0, "still clamped to the max");

    let mut hidden = H::new(
        container()
            .overflow(Overflow::Hidden)
            .child(box_of(400.0, 10.0)),
    );
    assert_eq!(hidden.fit(100.0, 500.0).width, 100.0);
}

/// Attaching an animation must not change what children are offered. It used
/// to: the animated path skipped the `at_most` clamp, so children were laid out
/// against the parent's full width and then the container was cut back to the
/// cap — content overflowing a box that had told it there was room.
#[test]
fn at_most_bounds_children_with_or_without_a_size_animation() {
    use crate::animation::{TimingFunction, Transition};

    for animated in [false, true] {
        let inner = container().width(fill()).height(5.0);
        let outer = if animated {
            container()
                .width(at_most(60.0).transition(Transition::new(200, TimingFunction::EaseOut)))
        } else {
            container().width(at_most(60.0))
        };

        let mut h = H::new(outer.child(inner));
        h.fit(500.0, 500.0);
        let child = h.children()[0];
        assert_eq!(
            h.tree.get_bounds(child).unwrap().width,
            60.0,
            "child must be bounded by the cap (animated: {animated})"
        );
        assert_eq!(h.tree.cached_size(h.root).unwrap().width, 60.0);
    }
}

/// The worst of the same bug: a wrapping child measured against the wrong width
/// gets the wrong *height* too, and no clamp downstream can recover it. Text
/// laid out as one 366px line inside a 100px box came out 16.8 tall instead of
/// 84 — the container was the right width and the wrong shape.
///
/// Font-independent by construction: it asserts the two agree, never a metric.
#[test]
fn a_size_animation_does_not_change_how_content_wraps() {
    use crate::animation::{TimingFunction, Transition};
    use crate::widgets::text::text;

    let sentence = "una frase abbastanza lunga da dover andare a capo piu volte";

    let mut plain = H::new(container().width(at_most(100.0)).child(text(sentence)));
    let plain_size = plain.fit(500.0, 500.0);

    let mut animated = H::new(
        container()
            .width(at_most(100.0).transition(Transition::new(200, TimingFunction::EaseOut)))
            .child(text(sentence)),
    );
    let animated_size = animated.fit(500.0, 500.0);

    assert_eq!(
        plain_size, animated_size,
        "an attached animation must not change how the content wraps"
    );
}

/// Lay `subject` out as a centred row around one 20px box, and say how big it
/// came out and where the box landed.
fn centred_box(subject: Container, constraints: Constraints) -> (Size, (f32, f32)) {
    let mut h = H::new(
        subject
            .layout(Flex::row().center())
            .child(box_of(20.0, 20.0)),
    );
    let size = h.layout(constraints);
    let child = h.tree.get_bounds(h.children()[0]).unwrap();
    (size, (child.x, child.y))
}

/// Children are offered the box the container will report, not the length it
/// declared before its own bounds and the parent's maximum cut it.
///
/// A 200px box under a 100px maximum is 100px wide, and centred its child at
/// 90 — the middle of the box it was not. Each case is set against a box
/// declared at the size it ends up, which has to place the child where it does.
#[test]
fn an_exact_length_that_is_cut_centres_its_children_in_what_is_left() {
    let loose = |side: f32| Constraints::new(0.0, 0.0, side, side);
    let cases = [
        (
            "under the parent's maximum",
            container().width(200.0).height(200.0),
            container().width(100.0).height(100.0),
            loose(100.0),
        ),
        (
            "padded, under the parent's maximum",
            container().width(200.0).height(200.0).padding(10.0),
            container().width(100.0).height(100.0).padding(10.0),
            loose(100.0),
        ),
        (
            "under its own maximum",
            container()
                .width(Length::exact(200.0).at_most(100.0))
                .height(Length::exact(200.0).at_most(100.0)),
            container().width(100.0).height(100.0),
            loose(500.0),
        ),
        (
            "over its own minimum",
            container()
                .width(Length::exact(50.0).at_least(100.0))
                .height(Length::exact(50.0).at_least(100.0)),
            container().width(100.0).height(100.0),
            loose(500.0),
        ),
    ];

    for (case, subject, control, constraints) in cases {
        let (size, origin) = centred_box(subject, constraints);
        let (control_size, control_origin) = centred_box(control, constraints);
        assert_eq!(size, Size::new(100.0, 100.0), "{case}: the box is cut");
        assert_eq!(size, control_size, "{case}: as big as the control");
        assert_eq!(
            origin,
            (40.0, 40.0),
            "{case}: the child is centred in the box on both axes"
        );
        assert_eq!(origin, control_origin, "{case}: where the control puts it");
    }
}

/// The other half of the rule: an explicit length still ignores the parent's
/// *minimum*, for its children as much as for itself.
#[test]
fn an_exact_length_under_a_larger_parent_minimum_centres_in_its_own_size() {
    let (size, origin) = centred_box(
        container().width(60.0).height(60.0),
        Constraints::new(150.0, 150.0, 500.0, 500.0),
    );
    assert_eq!(size, Size::new(60.0, 60.0));
    assert_eq!(origin, (20.0, 20.0), "centred in 60, not in 150");
}

fn linear_100ms() -> Transition {
    Transition::new(100.0, TimingFunction::Linear)
}

/// Lay `h` out under `parent` with `target` at 100, send it to 300, and stop
/// halfway through `linear_100ms` — so a length that follows it is 200 on its
/// way.
fn halfway_to_300(h: &mut H, target: RwSignal<f32>, parent: f32) {
    h.fit(parent, parent);
    let t0 = std::time::Instant::now();
    target.set(300.0);
    frame_at(h, t0, parent, parent);
    frame_at(h, t0 + std::time::Duration::from_millis(50), parent, parent);
}

/// A box whose exact width and height are halfway from 100 to 300 — 200 on
/// its way — laid out under `parent`, as a centred row around one 20px box:
/// how big it came out and where the box landed.
///
/// One tree per test, because the job queue is keyed by root and a second
/// tree in the same test would be handed what the first left queued.
fn centred_box_in_flight(parent: f32) -> (Size, (f32, f32)) {
    let target = create_signal(100.0f32);
    let mut h = H::new(
        container()
            .width(target.transition(linear_100ms()))
            .height(target.transition(linear_100ms()))
            .layout(Flex::row().center())
            .child(box_of(20.0, 20.0)),
    );
    halfway_to_300(&mut h, target, parent);

    let child = h.tree.get_bounds(h.children()[0]).unwrap();
    (h.tree.cached_size(h.root).unwrap(), (child.x, child.y))
}

/// The same while a size animation is in flight: a 100px maximum cuts the
/// 200 on its way to 100, and the children follow the box it is, not the one
/// it would be.
#[test]
fn an_exact_length_in_flight_past_the_parent_maximum_centres_in_what_is_left() {
    assert_eq!(
        centred_box_in_flight(100.0),
        (Size::new(100.0, 100.0), (40.0, 40.0)),
        "the box is cut, and the child is centred in it on both axes"
    );
}

/// Its control: a 500px parent cuts nothing, which is what says the animation
/// really is halfway.
#[test]
fn an_exact_length_in_flight_under_a_larger_parent_centres_in_its_own_size() {
    assert_eq!(
        centred_box_in_flight(500.0),
        (Size::new(200.0, 200.0), (90.0, 90.0))
    );
}

/// At its first layout a size animation has not been placed yet — the layout
/// places it, after the children are laid out — and what it holds is the value
/// the setter saw at build. A signal written between the build and that layout
/// has moved on, so the children are offered the declared length, not the
/// animation's stale seed: centred in 200, not in the 100 it was built with.
#[test]
fn an_unplaced_size_animation_offers_the_declared_length() {
    let side = create_signal(100.0f32);
    let mut h = H::new(
        container()
            .width(side.transition(linear_100ms()))
            .height(20.0)
            .layout(Flex::row().center())
            .child(box_of(20.0, 20.0)),
    );
    side.set(200.0);
    h.fit(500.0, 500.0);

    let child = h.tree.get_bounds(h.children()[0]).unwrap();
    assert_eq!(h.tree.cached_size(h.root).unwrap().width, 200.0);
    assert_eq!(child.x, 90.0, "centred in the declared 200");
}

#[test]
fn an_invisible_container_measures_zero() {
    let mut h = H::new(container().visible(false).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0), Size::zero());
}

// ---------------------------------------------------------------------------
// Layout protocol
// ---------------------------------------------------------------------------

/// The early-out that makes partial layout worth having: same constraints and
/// nothing dirty means the cached size comes back without re-running.
#[test]
fn a_clean_relayout_with_equal_constraints_is_skipped() {
    let mut h = H::new(container().padding(8.0).child(box_of(40.0, 20.0)));
    let first = h.fit(500.0, 500.0);
    let child = h.children()[0];
    h.tree.set_origin(child, 999.0, 999.0); // would be overwritten by a real layout

    let second = h.fit(500.0, 500.0);
    assert_eq!(second, first);
    assert_eq!(
        h.tree.get_bounds(child).unwrap().x,
        999.0,
        "the skipped layout must not have repositioned children"
    );
}

#[test]
fn changed_constraints_force_a_relayout() {
    let mut h = H::new(container().width(fill()).child(box_of(40.0, 20.0)));
    assert_eq!(h.fit(500.0, 500.0).width, 500.0);
    assert_eq!(h.fit(300.0, 500.0).width, 300.0);
}

/// Fixing both axes makes a container a relayout boundary, so a dirty
/// descendant stops bubbling there instead of reaching the surface root.
#[test]
fn fixed_size_makes_a_relayout_boundary() {
    let mut h = H::new(
        container()
            .width(100.0)
            .height(50.0)
            .child(box_of(40.0, 20.0)),
    );
    h.fit(500.0, 500.0);
    assert!(h.tree.is_relayout_boundary(h.root));

    let mut loose = H::new(container().child(box_of(40.0, 20.0)));
    loose.fit(500.0, 500.0);
    assert!(!loose.tree.is_relayout_boundary(loose.root));
}

/// A paint-only animation is not a reason to re-measure the parent.
///
/// What stops a fixed box being a boundary is an animation that *moves the
/// box* — width, height, padding — because the parent has to reposition its
/// siblings on every frame of one. A background easing changes nothing about
/// where anything is, and a container whose colour is moving still answers for
/// its own area.
#[test]
fn a_moving_colour_does_not_stop_a_fixed_box_being_a_boundary() {
    let colour = create_signal(Color::RED);
    let mut h = H::new(
        container()
            .width(100.0)
            .height(50.0)
            .background(colour.transition(Transition::new(100.0, TimingFunction::Linear)))
            .child(box_of(40.0, 20.0)),
    );
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 500.0, 500.0);
    colour.set(Color::BLUE);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(20),
        500.0,
        500.0,
    );
    h.paint();
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(40),
        500.0,
        500.0,
    );

    assert!(
        h.tree.is_relayout_boundary(h.root),
        "a background halfway through its transition moves nothing, so the \
         parent has nothing to re-measure"
    );
}

// ---------------------------------------------------------------------------
// Scroll
// ---------------------------------------------------------------------------

/// The colour and corner radii of every rounded rect a paint produced.
fn painted_rects_with_style(node: &RenderNode) -> Vec<(Color, CornerRadii)> {
    fn walk(node: &RenderNode, out: &mut Vec<(Color, CornerRadii)>) {
        for cmd in &node.commands {
            if let DrawCommand::RoundedRect { color, radius, .. } = &**cmd {
                out.push((*color, *radius));
            }
        }
        for child in &node.children {
            walk(child, out);
        }
    }
    let mut out = Vec::new();
    walk(node, &mut out);
    out
}

/// A scroller with a handle the test can find by its colour.
fn scroller(scroll: Scroll) -> H {
    H::new(
        container()
            .height(100.0)
            .scroll(scroll)
            .child(box_of(40.0, 900.0)),
    )
}

/// The scrollbar is styled as what it is — two containers — so a signal reaches
/// it like it reaches anything else.
///
/// This is the whole point of the change. `ScrollbarConfig` held plain colours
/// captured at build time, so a theme switch restyled every surface except its
/// scrollbars.
#[test]
fn a_handle_colour_declared_with_a_signal_follows_it() {
    let hot = create_signal(Color::rgb(1.0, 0.0, 0.0));
    let mut h = scroller(Scroll::vertical().handle(move |c: Container| c.background(hot)));
    h.fit(500.0, 500.0);

    let before = painted_rects_with_style(&h.paint());
    assert!(
        before.iter().any(|(c, _)| c.r > 0.9 && c.g < 0.1),
        "the declared handle colour has to reach the paint: {before:?}"
    );

    hot.set(Color::rgb(0.0, 0.0, 1.0));
    pump(&mut h);
    h.fit(500.0, 500.0);

    let after = painted_rects_with_style(&h.paint());
    assert!(
        after.iter().any(|(c, _)| c.b > 0.9 && c.r < 0.1),
        "the handle kept the colour it was built with: {after:?}"
    );
}

/// And it takes corners the old pair could not spell.
///
/// `ScrollbarConfig` carried a radius and a K-value, which reaches
/// `Corners::superellipse` and nothing else. A bevel, a scoop or a per-corner
/// radius were all expressible downstream and unreachable from the API.
#[test]
fn a_handle_takes_corners_the_old_pair_could_not_spell() {
    let mut h = scroller(Scroll::vertical().handle(|c: Container| {
        c.background(Color::rgb(1.0, 0.0, 0.0))
            .corners([8.0, 0.0, 8.0, 0.0])
    }));
    h.fit(500.0, 500.0);

    let (_, radii) = painted_rects_with_style(&h.paint())
        .into_iter()
        .find(|(c, _)| c.r > 0.9 && c.g < 0.1)
        .expect("the handle, found by its declared colour");

    assert!(
        radii.top_left > 7.9 && radii.top_right < 0.1,
        "a per-corner radius has to survive to paint, got {radii:?}"
    );
}

/// A scrollbar that comes back after being hidden.
///
/// Starting Hidden is the half worth testing, and the half the agreed design
/// chose a property over a `.hidden()` flag for — "a flag can only be set, and
/// this has to be able to come back". A container laid out Hidden returns from
/// `ensure_scrollbar_containers` before registering the track and the handle,
/// so the flip back has to create them *and* lay them out in one pass; and it
/// only gets that pass because `resolve_scroll` reads the visibility under
/// layout tracking, which is what marks the container and keeps it off the
/// unchanged-constraints fast path.
///
/// That the content still scrolls while the bar is hidden is not re-asserted
/// here — `Hidden` gates only the drawing, and the scroll tests in
/// `tests/scroll_momentum.rs` and `tests/scrollbar_handle_tracking.rs` own that
/// question.
#[test]
fn visibility_answers_to_a_signal() {
    let shown = create_signal(ScrollbarVisibility::Hidden);
    let mut h = scroller(Scroll::vertical().visibility(shown));
    h.fit(500.0, 500.0);
    let hidden_children = h.paint().children.len();

    shown.set(ScrollbarVisibility::Always);
    pump(&mut h);
    h.fit(500.0, 500.0);
    let shown_children = h.paint().children.len();

    assert!(
        shown_children > hidden_children,
        "the scrollbar never came back: {hidden_children} children hidden, \
         {shown_children} shown"
    );

    shown.set(ScrollbarVisibility::Hidden);
    pump(&mut h);
    h.fit(500.0, 500.0);
    assert_eq!(
        h.paint().children.len(),
        hidden_children,
        "and it goes away again"
    );
}

/// The gutter a reserved scrollbar takes out of the content is the bar plus a
/// margin on each side.
///
/// `reserve_gutter` is the point of the setting — space the content never gets,
/// scrollbar drawn or not — so the arithmetic that decides how much is worth
/// pinning: `width + margin * 2`, not `width + margin + 2`, and not the margin
/// counted once.
#[test]
fn a_reserved_gutter_is_the_bar_and_a_margin_on_each_side() {
    fn content_width(width: f32, margin: f32) -> f32 {
        let mut h = H::new(
            container()
                .width(200.0)
                .height(100.0)
                .scroll(Scroll::vertical().width(width).margin(margin))
                .child(container().width(fill()).height(900.0)),
        );
        h.fit(500.0, 500.0);
        // The content is the first child; a fill-width box reports what it was
        // offered, which is the container minus the gutter.
        h.paint().children[0].bounds.width
    }

    let wide_margin = content_width(6.0, 2.0);
    let no_margin = content_width(6.0, 0.0);
    assert_eq!(
        no_margin - wide_margin,
        4.0,
        "two margins of 2 is 4px of content, so the margin is counted on both \
         sides: {no_margin} against {wide_margin}"
    );
}

/// A vertical scroller builds the parts for one axis, not for both.
///
/// The two branches that create them are guarded on the axis *and* on not
/// having built them already. Loosen either to an `or` and a vertical scroller
/// registers a horizontal track and handle as well — which nothing lays out and
/// nothing paints, so the count has to be read off the tree rather than off the
/// paint, or the waste is invisible.
#[test]
fn a_one_axis_scroller_builds_one_axis_worth_of_parts() {
    let mut vertical = scroller(Scroll::vertical());
    vertical.fit(500.0, 500.0);
    let one_axis = vertical.tree.get_children(vertical.root).len();

    let mut both = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .scroll(Scroll::both())
            .child(box_of(900.0, 900.0)),
    );
    both.fit(500.0, 500.0);
    let two_axes = both.tree.get_children(both.root).len();

    assert_eq!(
        two_axes - one_axis,
        2,
        "one axis is a track and a handle, so two axes is exactly two more: \
         {one_axis} against {two_axes}"
    );
}

/// Whether a scrollbar exists at all comes down to one comparison — content
/// against viewport — so the viewport a scroller records has to be its
/// *visible* extent, never the unbounded constraint the scrolled axis is laid
/// out with. An infinite viewport is never exceeded, and the scrollbar
/// silently stops being drawn. This asserts on the paint output because that
/// is exactly what "the scrollbars stopped appearing" means.
#[test]
fn an_overflowing_scroller_paints_its_scrollbar() {
    let mut h = scroller(Scroll::vertical());
    h.fit(500.0, 500.0);

    let node = h.paint();
    assert!(
        node.children.len() > 1,
        "expected the content plus a scrollbar, got {} node(s)",
        node.children.len()
    );
}

#[test]
fn an_overflowing_horizontal_scroller_paints_its_scrollbar() {
    let mut h = H::new(
        container()
            .width(100.0)
            .scroll(Scroll::horizontal())
            .child(box_of(900.0, 40.0)),
    );
    h.fit(500.0, 500.0);
    assert!(h.paint().children.len() > 1);
}

/// The other half of the same contract: content that fits draws no scrollbar.
#[test]
fn a_scroller_whose_content_fits_paints_no_scrollbar() {
    let mut h = H::new(
        container()
            .height(100.0)
            .scroll(Scroll::vertical())
            .child(box_of(40.0, 20.0)),
    );
    h.fit(500.0, 500.0);
    assert_eq!(
        h.paint().children.len(),
        1,
        "only the content should be painted"
    );
}

#[test]
fn a_vertical_scroller_offers_children_unbounded_height() {
    let mut h = H::new(
        container()
            .height(100.0)
            .scroll(Scroll::vertical())
            .child(box_of(40.0, 900.0)),
    );
    assert_eq!(
        h.fit(500.0, 500.0).height,
        100.0,
        "the viewport stays fixed"
    );
    let child = h.children()[0];
    assert_eq!(
        h.tree.get_bounds(child).unwrap().height,
        900.0,
        "the content keeps its natural height"
    );
}

/// What a vertical scroller around 150px of content does with a wheel notch of
/// 50: whether it drew a scrollbar, how far the content moved, and how wide the
/// content was offered.
fn wheeled(subject: Container, scroll: Scroll, parent: f32) -> (bool, f32, f32) {
    let mut h = H::new(
        subject
            .scroll(scroll)
            .child(container().width(fill()).height(150.0)),
    );
    h.fit(parent, parent);
    reach_of_a_notch(&mut h)
}

fn reach_of_a_notch(h: &mut H) -> (bool, f32, f32) {
    let before = h.paint();
    let scrollbar = before.children.len() > 1;
    let content = &before.children[0];
    let (top, width) = (content.local_transform.ty(), content.bounds.width);

    h.send(Event::scroll(
        20.0,
        20.0,
        0.0,
        50.0,
        crate::widgets::widget::ScrollSource::Wheel,
    ));
    let after = h.paint().children[0].local_transform.ty();
    (scrollbar, top - after, width)
}

/// The viewport a scroller measures its content against is the box it reports.
///
/// Declared 200 tall under a 100px maximum, a scroller is 100 tall and showed
/// 150px of content with no scrollbar, and the wheel could not reach the last
/// 50 of it: the viewport was the 200 the parent had refused. Each case is set
/// against a scroller declared at the size it ends up.
#[test]
fn an_exact_length_that_is_cut_scrolls_what_it_cannot_show() {
    let plain = Scroll::vertical;
    let gutter = || Scroll::vertical().reserve_gutter(true);
    let cases = [
        (
            "under the parent's maximum",
            container().width(200.0).height(200.0),
            container().width(100.0).height(100.0),
            plain as fn() -> Scroll,
            100.0,
        ),
        (
            "padded, under the parent's maximum",
            container().width(220.0).height(220.0).padding(10.0),
            container().width(120.0).height(120.0).padding(10.0),
            plain,
            120.0,
        ),
        (
            "with a reserved gutter, under the parent's maximum",
            container().width(200.0).height(200.0),
            container().width(100.0).height(100.0),
            gutter,
            100.0,
        ),
        (
            "under its own maximum",
            container()
                .width(Length::exact(200.0).at_most(100.0))
                .height(Length::exact(200.0).at_most(100.0)),
            container().width(100.0).height(100.0),
            plain,
            500.0,
        ),
    ];

    for (case, subject, control, scroll, parent) in cases {
        let (scrollbar, travel, width) = wheeled(subject, scroll(), parent);
        let (_, control_travel, control_width) = wheeled(control, scroll(), parent);
        assert!(scrollbar, "{case}: 150 in a 100 viewport needs a scrollbar");
        assert_eq!(travel, 50.0, "{case}: the wheel reaches the last 50px");
        assert_eq!(travel, control_travel, "{case}: as the control scrolls");
        assert_eq!(width, control_width, "{case}: and is offered its width");
    }
}

/// A 100-wide scroller whose exact height is halfway from 100 to 300 — 200 on
/// its way — laid out under `parent`, and what a wheel notch does to it.
fn wheeled_in_flight(parent: f32) -> (bool, f32, f32) {
    let target = create_signal(100.0f32);
    let mut h = H::new(
        container()
            .width(100.0)
            .height(target.transition(linear_100ms()))
            .scroll(Scroll::vertical())
            .child(container().width(fill()).height(150.0)),
    );
    halfway_to_300(&mut h, target, parent);
    reach_of_a_notch(&mut h)
}

/// The same while the height is in flight: a 100px maximum cuts the 200 on its
/// way to 100, so there is still 50 to scroll.
#[test]
fn an_exact_length_in_flight_past_the_parent_maximum_scrolls_what_it_cannot_show() {
    let (scrollbar, travel, _) = wheeled_in_flight(100.0);
    assert!(scrollbar, "150 in a 100 viewport needs a scrollbar");
    assert_eq!(travel, 50.0, "the wheel reaches the last 50px");
}

/// Its control: under a 500px parent the box really is 200, and there is
/// nothing to scroll.
#[test]
fn an_exact_length_in_flight_under_a_larger_parent_has_nothing_to_scroll() {
    let (scrollbar, travel, _) = wheeled_in_flight(500.0);
    assert!(!scrollbar, "150 fits in 200");
    assert_eq!(travel, 0.0);
}

// ---------------------------------------------------------------------------
// Paint
// ---------------------------------------------------------------------------

#[test]
fn a_background_emits_one_rounded_rect() {
    let mut h = H::new(container().width(50.0).height(20.0).background(Color::RED));
    h.fit(500.0, 500.0);
    let node = h.paint();
    let drawn = rects(&node);
    assert_eq!(drawn.len(), 1);
    assert_eq!(drawn[0].0, Rect::new(0.0, 0.0, 50.0, 20.0));
    assert_eq!(drawn[0].1, Color::RED);
}

#[test]
fn a_fully_transparent_background_draws_nothing() {
    let mut h = H::new(container().width(50.0).height(20.0));
    h.fit(500.0, 500.0);
    assert!(rects(&h.paint()).is_empty());
}

#[test]
fn a_border_is_its_own_command() {
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .background(Color::RED)
            .border(2.0, Color::BLUE),
    );
    h.fit(500.0, 500.0);
    assert_eq!(rects(&h.paint()).len(), 2, "background + border frame");
}

#[test]
fn an_invisible_container_paints_nothing() {
    let mut h = H::new(
        container()
            .visible(false)
            .width(50.0)
            .height(20.0)
            .background(Color::RED)
            .child(box_of(10.0, 10.0)),
    );
    h.fit(500.0, 500.0);
    let node = h.paint();
    assert!(node.commands.is_empty());
    assert!(node.children.is_empty());
}

#[test]
fn children_become_child_nodes_positioned_by_transform() {
    let mut h = H::new(
        container()
            .padding(8.0)
            .child(box_of(40.0, 20.0).background(Color::RED)),
    );
    h.fit(500.0, 500.0);
    let node = h.paint();
    assert_eq!(node.children.len(), 1);
    let child = &node.children[0];
    assert_eq!(child.bounds, Rect::new(0.0, 0.0, 40.0, 20.0));
    assert_eq!(
        (child.local_transform.tx(), child.local_transform.ty()),
        (8.0, 8.0)
    );
}

#[test]
fn hidden_overflow_sets_a_clip_region() {
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .overflow(Overflow::Hidden)
            .child(box_of(400.0, 10.0)),
    );
    h.fit(500.0, 500.0);
    assert!(h.paint().clip.is_some());

    let mut visible = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .child(box_of(400.0, 10.0)),
    );
    visible.fit(500.0, 500.0);
    assert!(visible.paint().clip.is_none());
}

#[test]
fn a_zero_area_container_skips_its_children() {
    let mut h = H::new(container().width(0.0).height(0.0).child(box_of(40.0, 20.0)));
    h.fit(500.0, 500.0);
    assert!(h.paint().children.is_empty());
}

// ---------------------------------------------------------------------------
// Events
// ---------------------------------------------------------------------------

fn click_at(x: f32, y: f32) -> [Event; 2] {
    [
        Event::mouse_down(x, y, MouseButton::Left),
        Event::mouse_up(x, y, MouseButton::Left),
    ]
}

#[test]
fn a_click_inside_the_bounds_fires_on_click() {
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .on_click(move || counter.set(counter.get() + 1)),
    );
    h.fit(500.0, 500.0);

    for e in click_at(25.0, 10.0) {
        h.send(e);
    }
    assert_eq!(clicks.get(), 1);

    for e in click_at(200.0, 10.0) {
        h.send(e);
    }
    assert_eq!(clicks.get(), 1, "a click outside must not fire");
}

/// The other two buttons, which fire on the press rather than on a matched
/// release: there is no drag to complete, so there is nothing to wait for.
///
/// Nothing tested these at all until a mutant said so — killing the guard that
/// separates them from the left button left the whole suite green, which is the
/// same as saying the two handlers could stop firing and nobody would hear.
#[test]
fn the_right_and_middle_buttons_fire_the_handlers_that_name_them() {
    let right = std::rc::Rc::new(std::cell::Cell::new(0));
    let middle = std::rc::Rc::new(std::cell::Cell::new(0));
    let (r, m) = (right.clone(), middle.clone());
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .on_right_click(move || r.set(r.get() + 1))
            .on_middle_click(move || m.set(m.get() + 1)),
    );
    h.fit(500.0, 500.0);

    h.send(Event::mouse_down(25.0, 10.0, MouseButton::Right));
    assert_eq!((right.get(), middle.get()), (1, 0), "a right press");

    h.send(Event::mouse_down(25.0, 10.0, MouseButton::Middle));
    assert_eq!((right.get(), middle.get()), (1, 1), "a middle press");

    // The left button is neither of them, and reaches neither handler.
    h.send(Event::mouse_down(25.0, 10.0, MouseButton::Left));
    assert_eq!(
        (right.get(), middle.get()),
        (1, 1),
        "a left press belongs to on_click, and must not reach either"
    );

    h.send(Event::mouse_down(200.0, 10.0, MouseButton::Right));
    assert_eq!(right.get(), 1, "a right press outside must not fire");
}

/// Hit testing follows the rounded shape, not its bounding box.
#[test]
fn a_corner_radius_excludes_the_corner() {
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .corners(20.0)
            .on_click(move || counter.set(counter.get() + 1)),
    );
    h.fit(500.0, 500.0);

    for e in click_at(1.0, 1.0) {
        h.send(e);
    }
    assert_eq!(clicks.get(), 0, "the top-left corner is outside the circle");

    for e in click_at(20.0, 20.0) {
        h.send(e);
    }
    assert_eq!(clicks.get(), 1);
}

#[test]
fn hover_tracks_entering_and_leaving() {
    let state = std::rc::Rc::new(std::cell::Cell::new(false));
    let sink = state.clone();
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .on_hover(move |hovered| sink.set(hovered)),
    );
    h.fit(500.0, 500.0);

    h.send(Event::mouse_move(25.0, 10.0));
    assert!(state.get());

    h.send(Event::mouse_move(300.0, 10.0));
    assert!(!state.get());
}

/// Children see the event first, and a handled event stops there.
#[test]
fn a_child_handles_before_its_parent() {
    let order = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
    let child_sink = order.clone();
    let parent_sink = order.clone();

    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .on_click(move || parent_sink.borrow_mut().push("parent"))
            .child(
                container()
                    .width(50.0)
                    .height(50.0)
                    .on_click(move || child_sink.borrow_mut().push("child")),
            ),
    );
    h.fit(500.0, 500.0);

    for e in click_at(25.0, 25.0) {
        h.send(e);
    }
    assert_eq!(*order.borrow(), vec!["child"]);
}

#[test]
fn scroll_reaches_the_callback_inside_the_bounds() {
    let deltas = std::rc::Rc::new(std::cell::Cell::new(0.0f32));
    let sink = deltas.clone();
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .on_scroll(move |_dx, dy, _src| sink.set(sink.get() + dy)),
    );
    h.fit(500.0, 500.0);

    h.send(Event::scroll(
        25.0,
        10.0,
        0.0,
        12.0,
        crate::widgets::widget::ScrollSource::Wheel,
    ));
    assert_eq!(deltas.get(), 12.0);
}

// ---------------------------------------------------------------------------
// Reactivity: which job type each property invalidates
// ---------------------------------------------------------------------------

/// Advancing animations reads each animated property's target. That read is a
/// snapshot — the subscription is established by `seed_animations` at the first
/// layout and refreshed by `resync_animation_targets` at every paint — so the
/// debug diagnostic must stay quiet about it.
///
/// It did not, and reported every animated container's border width and corner
/// radius as a value that "will not update", which is the opposite of true. A
/// warning that cries wolf on correct code is worse than no warning: it teaches
/// people to scroll past the ones that are right.
///
/// Both halves are asserted together on purpose — silence is only correct if
/// the property really is subscribed.
#[cfg(debug_assertions)]
#[test]
fn advancing_animations_does_not_report_a_missing_scope() {
    use crate::animation::{TimingFunction, Transition};
    use crate::reactive::diagnostics::report_count;

    let t = || Transition::new(200, TimingFunction::EaseOut);
    let wide = create_signal(false);
    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .background(Color::RED)
            .border(
                (move || if wide.get() { 6.0 } else { 2.0 }).transition(t()),
                Color::BLUE,
            )
            .corners((move || if wide.get() { 20.0 } else { 4.0 }).transition(t())),
    );
    h.fit(200.0, 200.0);
    h.paint();

    let before = report_count();
    let root = h.root;
    // Advancing animations is a frame's first pass, and it runs with the
    // frame's instant declared — reading it without one is a different
    // diagnostic (#265), and this test is about the reactive one.
    h.tree.set_frame_instant(Some(std::time::Instant::now()));
    h.tree.with_widget_mut(root, |w, id, tree| {
        w.advance_animations(tree, id);
    });
    h.tree.set_frame_instant(None);
    assert_eq!(
        report_count() - before,
        0,
        "advancing animations must not be reported as a non-reactive read"
    );

    let queued = h.jobs_from(|| wide.set(true));
    assert!(
        queued.contains(&JobType::Animation),
        "and the properties must genuinely be subscribed, got {queued:?}"
    );
}

/// A state layer's border moves the *width* as well as the colour, because a
/// border is declared as a pair — so "can a state change move an animated
/// property" has to answer yes for a container that animates only the width.
///
/// It answered no: the list named `border_color` and not `border_width`, from
/// when the two were declared separately and a layer really could change one
/// alone. A later change added the shadow to that list and left the hole next
/// to it that it had just made reachable.
///
/// Asked of the predicate rather than through a hover, because a hover reaches
/// the animation by a second route as well: the interaction flags are a signal,
/// and paint reads the animated width under `JobType::Animation` tracking, so
/// setting the flag queues the job anyway. That route is why nothing was visibly
/// broken — and it is not a reason to leave the direct answer wrong, since it
/// holds only while some paint has already subscribed.
#[test]
fn a_border_width_animation_counts_as_movable_by_a_state_layer() {
    let animated = container()
        .border(
            2.0.transition(Transition::spring(SpringConfig::BOUNCY)),
            Color::BLUE,
        )
        .when_hovered(|s| s.border(14.0, Color::BLUE));
    assert!(
        animated.has_animated_state_properties(),
        "hovering moves the width, so it needs an Animation job"
    );

    let plain = container()
        .border(2.0, Color::BLUE)
        .when_hovered(|s| s.border(14.0, Color::BLUE));
    assert!(
        !plain.has_animated_state_properties(),
        "with nothing animated, a plain repaint is the whole job"
    );
}

/// The same question for the three transform components, which answer it from
/// a list of their own.
#[test]
fn a_state_layer_moving_an_animated_transform_counts_as_movable() {
    let t = || Transition::new(80.0, TimingFunction::Linear);

    assert!(
        container()
            .translate(Translate::NONE.transition(t()))
            .when_hovered(|s| s.translate(Translate::new(0.0, -2.0)))
            .has_animated_state_properties(),
        "hovering moves the translate, so it needs an Animation job"
    );
    assert!(
        container()
            .rotate(0.0.transition(t()))
            .when_hovered(|s| s.rotate(2.0))
            .has_animated_state_properties(),
        "and a rotate"
    );
    assert!(
        container()
            .scale(Scale::NONE.transition(t()))
            .when_pressed(|s| s.scale(0.98))
            .has_animated_state_properties(),
        "and a scale — the layer on every button there is"
    );
    assert!(
        !container()
            .when_pressed(|s| s.scale(0.98))
            .has_animated_state_properties(),
        "and with nothing animated, a plain repaint is the whole job"
    );
}

/// A declared shadow that carries a motion is already at its value on the first
/// frame, rather than easing up to it from nothing.
///
/// That is what `seed_animations` is for, and the guard in front of it is a
/// chain of `||` over every animatable slot — so a container animating *nothing
/// but a shadow* is the only shape that says the shadow's own term carries the
/// chain. On a ramp no runner can finish, so "already there" cannot be confused
/// with "arrived quickly".
#[test]
fn a_declared_shadow_starts_at_its_value_rather_than_easing_up_to_it() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(LIFTED.transition(Transition::new(60_000.0, TimingFunction::Linear))),
    );
    h.fit(100.0, 100.0);

    assert_eq!(
        drawn_shadow(&h.paint()),
        Some(LIFTED),
        "a declaration is where the motion starts, not where it is heading"
    );
}

/// A write landing between the first layout and the first paint is not missed.
///
/// That is the whole of what `seed_animations` buys: it reads every animated
/// property under Animation tracking at the *first layout*, so the subscription
/// exists before anything can be written. The module docs name the bug —
/// a menu whose open-flip fired in that window stayed collapsed for ever.
///
/// Asserted on the job queue rather than on the picture, because the picture
/// cannot tell: `resync_animation_targets` re-reads the targets at every paint,
/// so any frame that happens for another reason repairs it. What only the seed
/// can do is make the write itself ask for that frame.
///
/// The guard in front of the seed is a chain of `||` over every animatable
/// slot, so this has to animate the shadow and nothing else.
#[test]
fn a_shadow_written_before_the_first_paint_still_asks_for_its_frame() {
    let declared = create_signal(Shadow::none());
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(
                (move || declared.get()).transition(Transition::new(40.0, TimingFunction::Linear)),
            ),
    );
    // The first layout, and no paint after it.
    h.fit(100.0, 100.0);
    h.drain_jobs();

    declared.set(LIFTED);
    let queued = jobs::queued_job_types(h.root);
    assert!(
        queued.contains(&JobType::Animation),
        "the write landed before any paint and nothing was listening: {queued:?}"
    );
}

/// The same for a background, which is the slot beside the shadow's in that
/// guard and has never had a test of its own.
///
/// Not this change's property, but this change is what put a light on the
/// clause: the chain is only as good as its weakest term, and each one needs a
/// container that animates *that property alone* to say it carries.
#[test]
fn a_background_written_before_the_first_paint_still_asks_for_its_frame() {
    let declared = create_signal(Color::RED);
    let mut h = H::new(container().width(40.0).height(40.0).background(
        (move || declared.get()).transition(Transition::new(40.0, TimingFunction::Linear)),
    ));
    h.fit(100.0, 100.0);
    h.drain_jobs();

    declared.set(Color::BLUE);
    let queued = jobs::queued_job_types(h.root);
    assert!(
        queued.contains(&JobType::Animation),
        "the write landed before any paint and nothing was listening: {queued:?}"
    );
}

/// And corners, the slot beside the shadow's in the animated-state list.
#[test]
fn corners_alone_are_an_animated_state_property() {
    assert!(
        container()
            .corners(4.0.transition(Transition::new(80.0, TimingFunction::Linear)))
            .when_hovered(|s| s.corners(12.0))
            .has_animated_state_properties(),
        "hovering moves the corners, so it needs an Animation job"
    );
}

/// A shadow that has arrived stops asking for frames.
///
/// `resync_animation_targets` compares the target it holds against the one the
/// declarations resolve to, and asks for an Animation job when they differ.
/// Invert that comparison and it asks when they *agree* — so a settled shadow
/// requests a frame on every paint, for ever, and nothing about the picture on
/// screen is wrong. Only the job queue can see it.
///
/// The queue is drained first and the assertion is on what the *paint* puts
/// back, so there is something to find either way: a test that cleared the
/// queue and then asserted it was empty would pass however the code behaved.
#[test]
fn a_settled_shadow_stops_asking_for_frames() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(LIFTED.transition(Transition::new(40.0, TimingFunction::Linear))),
    );
    h.fit(100.0, 100.0);
    settle(&mut h, 200);

    h.drain_jobs();
    h.paint();
    let queued = jobs::queued_job_types(h.root);
    assert!(
        !queued.contains(&JobType::Animation),
        "a shadow that has arrived asked for another frame: {queued:?}"
    );
}

/// A shadow is on both animated-property lists, and a container that animates
/// nothing else has to be enough to put it there.
///
/// Asked of the predicates rather than through a hover, for the reason the
/// border-width test above gives. Each list is a chain of `||` over eight or
/// nine slots, so a clause that drifted into `&&` still answers correctly for
/// every container that animates two things — only one that animates the shadow
/// *alone* can tell.
#[test]
fn a_shadow_alone_is_an_animated_property_on_both_lists() {
    let t = || Transition::new(80.0, TimingFunction::Linear);

    assert!(
        container()
            .shadow(Shadow::none().transition(t()))
            .when_hovered(|s| s.shadow(LIFTED))
            .has_animated_state_properties(),
        "hovering moves the shadow, so it needs an Animation job"
    );
    assert!(
        !container()
            .shadow(LIFTED)
            .when_hovered(|s| s.shadow(LOW))
            .has_animated_state_properties(),
        "and with no motion declared, a plain repaint is the whole job"
    );
    assert!(
        container()
            .shadow(Shadow::none().transition(t()))
            .follows_a_signal_anywhere(),
        "a shadow animation mirrors a signal, so it re-syncs at paint"
    );
    assert!(
        !container()
            .padding(Padding::all(0.0).transition(t()))
            .when_hovered(|s| s.lighter(0.1))
            .has_animated_state_properties(),
        "padding is the property that answers differently to the two halves of \
         this question — it does follow a signal, and it does move the box — so \
         it is the one that says hovering has nothing here to animate"
    );
}

/// The alpha floor is a floor: a shadow exactly at it is still nothing.
///
/// `>` and `>=` differ on one value, and that value is reachable — an
/// application can declare it, and an animation leaving transparent passes
/// through it. Drawn at the boundary, the rect it pushes carries a shadow
/// nobody can see.
#[test]
fn a_shadow_exactly_at_the_alpha_floor_is_not_drawn() {
    let alpha = create_signal(style::SHADOW_ALPHA_FLOOR);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(move || {
                Shadow::new(
                    (0.0, 2.0),
                    4.0,
                    0.0,
                    Color::rgba(0.0, 0.0, 0.0, alpha.get()),
                )
            }),
    );
    h.fit(100.0, 100.0);
    assert!(
        drawn_shadow(&h.paint()).is_none(),
        "at the floor exactly, there is nothing to see"
    );

    alpha.set(style::SHADOW_ALPHA_FLOOR * 1.5);
    h.fit(100.0, 100.0);
    assert!(
        drawn_shadow(&h.paint()).is_some(),
        "and just above it there is"
    );
}

/// Every animated transform component holds a copy of signal-derived state, so
/// every one of them needs the paint-time target re-sync. Width does not: its
/// target follows the measured content and is recomputed at each layout.
///
/// Asked of the predicate rather than through a moving container, for the
/// reason the border-width test above gives and one more of its own.
/// `seed_animations` subscribes to the *condition* of a branching closure at
/// the first layout, so flipping that condition queues an Animation job by that
/// route and the container converges even with the re-sync gone. The
/// behavioural route cannot see this omission; the predicate can.
#[test]
fn each_animated_transform_component_is_a_signal_animated_prop() {
    let t = || Transition::new(80.0, TimingFunction::Linear);

    assert!(
        container()
            .translate(Translate::NONE.transition(t()))
            .follows_a_signal_anywhere(),
        "a translate animation mirrors a signal, so it re-syncs at paint"
    );
    assert!(
        container()
            .rotate(0.0.transition(t()))
            .follows_a_signal_anywhere(),
        "and a rotate"
    );
    assert!(
        container()
            .scale(Scale::NONE.transition(t()))
            .follows_a_signal_anywhere(),
        "and a scale"
    );
    assert!(
        !container()
            .width(0.0.transition(t()))
            .follows_a_signal_anywhere(),
        "a width follows the content it measured, and is retargeted at layout"
    );
}

/// Layout-affecting properties queue a Layout job when their signal changes.
#[test]
fn padding_invalidates_layout() {
    let pad = create_signal(4.0f32);
    let mut h = H::new(
        container()
            .padding(move || pad.get())
            .child(box_of(10.0, 10.0)),
    );
    h.fit(500.0, 500.0);
    h.paint();

    let queued = h.jobs_from(|| pad.set(12.0));
    assert!(
        queued.contains(&JobType::Layout),
        "padding must invalidate layout, got {queued:?}"
    );
}

#[test]
fn width_invalidates_layout() {
    let w = create_signal(10.0f32);
    let mut h = H::new(container().width(move || w.get()).child(box_of(10.0, 10.0)));
    h.fit(500.0, 500.0);
    h.paint();

    let queued = h.jobs_from(|| w.set(40.0));
    assert!(queued.contains(&JobType::Layout), "got {queued:?}");
}

/// Paint-only properties must NOT drag layout along with them.
#[test]
fn background_invalidates_paint_only() {
    let bg = create_signal(Color::RED);
    let mut h = H::new(
        container()
            .width(10.0)
            .height(10.0)
            .background(move || bg.get()),
    );
    h.fit(500.0, 500.0);
    h.paint();

    let queued = h.jobs_from(|| bg.set(Color::BLUE));
    assert!(queued.contains(&JobType::Paint), "got {queued:?}");
    assert!(
        !queued.contains(&JobType::Layout),
        "a colour change must not relayout, got {queued:?}"
    );
}

#[test]
fn corner_radius_invalidates_paint_only() {
    let r = create_signal(2.0f32);
    let mut h = H::new(
        container()
            .width(10.0)
            .height(10.0)
            .background(Color::RED)
            .corners(move || r.get()),
    );
    h.fit(500.0, 500.0);
    h.paint();

    let queued = h.jobs_from(|| r.set(6.0));
    assert!(queued.contains(&JobType::Paint), "got {queued:?}");
    assert!(!queued.contains(&JobType::Layout), "got {queued:?}");
}

/// A transform is a paint property and moving a widget must not reflow it —
/// not the widget, not its siblings, not the page. That has to hold even now
/// that a parent asks how far a transform can carry a child before deciding
/// whether to paint it: the answer is refreshed from the Paint job the same
/// write schedules, in `refresh_paint_bounds`, and never from layout.
///
/// Each of the three separately, because they are declared apart and a reach
/// read under layout tracking for one of them would be invisible in the others.
#[test]
fn a_transform_invalidates_paint_only() {
    for (name, build) in [
        (
            "translate",
            Box::new(|s: RwSignal<f32>| {
                container()
                    .width(10.0)
                    .height(10.0)
                    .translate(move || Translate::new(s.get(), 0.0))
            }) as Box<dyn Fn(RwSignal<f32>) -> Container>,
        ),
        (
            "rotate",
            Box::new(|s: RwSignal<f32>| {
                container().width(10.0).height(10.0).rotate(move || s.get())
            }),
        ),
        (
            "scale",
            Box::new(|s: RwSignal<f32>| {
                container()
                    .width(10.0)
                    .height(10.0)
                    .scale(move || Scale::uniform(1.0 + s.get()))
            }),
        ),
    ] {
        let value = create_signal(0.0f32);
        let mut h = H::new(build(value));
        h.fit(500.0, 500.0);
        h.paint();

        let queued = h.jobs_from(|| value.set(30.0));
        assert!(
            queued.contains(&JobType::Paint),
            "{name}: a transform must repaint, got {queued:?}"
        );
        assert!(
            !queued.contains(&JobType::Layout),
            "{name}: a transform must not reflow anything, got {queued:?}"
        );
    }
}

/// And the same, for a container that has a parent.
///
/// A child lays out inside its parent's tracking scope, so a read that does not
/// suspend tracking registers against *the parent* — the transformed container
/// stays quiet and its parent reflows instead. The test above cannot see it:
/// its container is the root, where there is no outer scope to catch the read.
#[test]
fn a_transform_does_not_reflow_the_parent_either() {
    let dx = create_signal(0.0f32);
    let mut h = H::new(
        container().layout(Flex::column()).child(
            container()
                .width(10.0)
                .height(10.0)
                .translate(move || Translate::new(dx.get(), 0.0)),
        ),
    );
    h.fit(500.0, 500.0);
    h.paint();

    let queued = h.jobs_from(|| dx.set(30.0));
    assert!(
        !queued.contains(&JobType::Layout),
        "a child's transform relaid out its parent, got {queued:?}"
    );
}

#[test]
fn visibility_invalidates_layout() {
    let shown = create_signal(true);
    let mut h = H::new(
        container()
            .visible(move || shown.get())
            .child(box_of(10.0, 10.0)),
    );
    h.fit(500.0, 500.0);
    h.paint();

    let queued = h.jobs_from(|| shown.set(false));
    assert!(queued.contains(&JobType::Layout), "got {queued:?}");
}

// The remaining row of this table — a *layout's* reactive property (Flex's
// spacing, and with it every property of every user-written `Layout`) must
// invalidate its container too — is covered by
// `tests::a_layout_property_invalidates_its_container` in `mod.rs`, where it
// carries the history of the bug it regressed on.

// ---------------------------------------------------------------------------
// A state layer reaching the text
// ---------------------------------------------------------------------------

/// Run the queued jobs, returning whether any of them was an animation step.
///
/// Processing rather than discarding matters twice over: it is what turns a
/// flag write into `needs_paint` on the text that subscribed to it, and it is
/// what advances an animation on the widget that owns it. `advance_animations`
/// does not recurse — in the real loop the job carries the widget id — so a
/// test that calls it on the root never touches an animated child.
fn pump(h: &mut H) -> bool {
    let roots = h.roots();
    jobs::distribute_jobs(&h.tree, &roots);
    let drained = jobs::drain_surface_jobs(h.root);
    let animating = drained.iter().any(|job| job.job_type == JobType::Animation);
    let mut layout_roots = Vec::new();
    jobs::process_jobs(&drained, &mut h.tree, &mut layout_roots);
    jobs::recycle_job_buffer(drained);
    // And the follow-ups those jobs asked for, as `run_jobs` takes them in the
    // same frame: a child whose exit settled asks its container to reconcile,
    // and the loop does that before it lays anything out.
    jobs::distribute_jobs(&h.tree, &roots);
    let followup = jobs::drain_surface_non_animation_jobs(h.root);
    jobs::process_jobs(&followup, &mut h.tree, &mut layout_roots);
    jobs::recycle_job_buffer(followup);
    jobs::recycle_job_buffer(jobs::drain_orphan_jobs());
    animating
}

/// A whole frame that declares what time it is: jobs, then layout, as the loop
/// runs them.
///
/// `pump` asks the clock, so two frames are however far apart the machine
/// happened to make them; this one names the instant, so a curve can be
/// asserted at a value instead of inside a band.
fn frame_at(h: &mut H, now: std::time::Instant, width: f32, height: f32) {
    h.tree.set_frame_instant(Some(now));
    pump(h);
    h.fit(width, height);
    h.tree.set_frame_instant(None);
}

/// Halfway through a linear hundred milliseconds is halfway to the target —
/// exactly, on any machine, with nothing asleep.
///
/// The value of naming the instant is that this asserts the *curve*, which is
/// the half of an animation nothing outside `animations.rs`, `keyframes.rs`
/// and `timing.rs` can see. Every other test here watches where an animation
/// lands, and an easing that is wrong, a delay that is ignored, a reverse
/// transition used in place of the forward one and a property that skips the
/// animation entirely all land in the same place.
#[test]
fn a_linear_animation_is_halfway_at_half_its_duration() {
    let w = create_signal(0.0f32);
    let mut h = H::new(
        container()
            .height(10.0)
            .width(w.transition(Transition::new(100.0, TimingFunction::Linear))),
    );
    h.fit(400.0, 400.0);

    let t0 = std::time::Instant::now();
    w.set(100.0);
    frame_at(&mut h, t0, 400.0, 400.0);
    assert_eq!(
        h.tree.cached_size(h.root).unwrap().width,
        0.0,
        "the segment begins where it was, not where it is going"
    );

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        400.0,
        400.0,
    );
    assert_eq!(
        h.tree.cached_size(h.root).unwrap().width,
        50.0,
        "half the duration of a linear curve is half the distance"
    );
}

/// The radius of the ripple drawn by this frame, if one is drawn.
fn painted_ripple_radius(h: &mut H) -> Option<f32> {
    h.paint()
        .overlay_commands
        .iter()
        .find_map(|cmd| match &**cmd {
            DrawCommand::Circle { radius, .. } => Some(*radius),
            _ => None,
        })
}

/// One frame is one instant: the ripple and the declared transition in the
/// same container are asked about the same moment.
///
/// They could not be before. The ripple already took an `Instant` and the
/// caller handed it `Instant::now()`, freshly read, some microseconds after
/// every animation beside it had read its own — so a frame was several
/// instants, and none of them was one a test could name.
#[test]
fn a_ripple_and_a_transition_are_asked_about_the_same_moment() {
    // Wide enough at rest to be clicked: the press has to land on the box.
    let w = create_signal(20.0f32);
    let mut h = H::new(
        container()
            .height(100.0)
            .width(w.transition(Transition::new(100.0, TimingFunction::Linear)))
            .when_pressed(|s| s.ripple())
            .on_click(|| {}),
    );
    h.fit(400.0, 400.0);

    h.send(Event::mouse_down(10.0, 50.0, MouseButton::Left));
    w.set(120.0);

    // After the press, because a ripple begins at the instant its event
    // arrived and that clock is the event's, not the frame's — a separate
    // question, and not this one.
    let t0 = std::time::Instant::now();

    frame_at(&mut h, t0, 400.0, 400.0);
    let started = painted_ripple_radius(&mut h).expect("the press starts a ripple");

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        400.0,
        400.0,
    );
    assert_eq!(
        h.tree.cached_size(h.root).unwrap().width,
        70.0,
        "the transition is halfway: 20 plus half of the hundred it travels"
    );
    let grown = painted_ripple_radius(&mut h).expect("and the ripple is still drawn");
    assert!(
        grown > started,
        "the ripple grew over the same 50ms, from {started} to {grown}"
    );

    // The same instant twice: nothing moves, because nothing has.
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        400.0,
        400.0,
    );
    assert_eq!(
        painted_ripple_radius(&mut h),
        Some(grown),
        "asked about the same moment, a frame answers the same"
    );
}

/// An event delivered at a named moment, the way `dispatch_events` delivers
/// one.
fn send_at(h: &mut H, at: std::time::Instant, event: Event) -> EventResponse {
    h.tree.set_event_instant(Some(at));
    let response = h.send(event);
    h.tree.set_event_instant(None);
    response
}

/// A ripple held for a named length of time has grown by a named amount.
///
/// It could not be asked before. A ripple begins when the press arrives and
/// grows from there, and both ends of that were `Instant::now()` — one read in
/// the event handler and one in the frame — so a test could hold a press only
/// by sleeping, and assert only that something had happened.
#[test]
fn a_press_held_for_a_named_time_has_grown_by_a_named_amount() {
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .when_pressed(|s| s.ripple())
            .on_click(|| {}),
    );
    h.fit(400.0, 400.0);

    // A minute ago, and that is the point: if the press took its moment from the
    // clock instead of from the event, the disc would be a minute old by the
    // first frame and there would be nothing left to draw.
    let t0 = std::time::Instant::now() - std::time::Duration::from_secs(60);
    send_at(&mut h, t0, Event::mouse_down(50.0, 50.0, MouseButton::Left));

    // A frame later, because the press and the frame are now genuinely the same
    // instant: at t0 exactly nothing has elapsed and the disc has no opacity to
    // be drawn with.
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(8),
        400.0,
        400.0,
    );
    let started = painted_ripple_radius(&mut h).expect("the press starts a ripple");

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(120),
        400.0,
        400.0,
    );
    let held = painted_ripple_radius(&mut h).expect("and holding it keeps one");

    // Asked about the same moment again, it answers the same: the disc is a
    // function of how long the press has lasted, and nothing else.
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(120),
        400.0,
        400.0,
    );
    assert_eq!(
        painted_ripple_radius(&mut h),
        Some(held),
        "the same instant twice is the same disc"
    );

    assert!(
        held > started,
        "a hundred and twenty milliseconds of press has to have grown it, \
         from {started} to {held}"
    );
}

/// One frame at a named instant, through the skip-frame gate.
///
/// `frame_at` pumps and lays out but leaves painting to the caller, so a test
/// that then calls `h.paint()` repaints unconditionally and cannot see a frame
/// the loop would have skipped. This one goes through `H::frame`, which serves
/// the retained node when nothing needs paint — which is the whole difference
/// between a value the loop noticed and one it did not.
fn gated_frame_at(h: &mut H, now: std::time::Instant, width: f32, height: f32) -> Frame {
    h.tree.set_frame_instant(Some(now));
    let frame = h.frame(width, height);
    h.tree.set_frame_instant(None);
    frame
}

/// The colour of the first overlay disc in a frame the loop actually produced.
fn ripple_color_of(frame: &Frame) -> Option<Color> {
    frame
        .node
        .overlay_commands
        .iter()
        .find_map(|cmd| match &**cmd {
            DrawCommand::Circle { color, .. } => Some(*color),
            _ => None,
        })
}

/// The colour of the first overlay disc, which is the ripple.
fn painted_ripple_color(h: &mut H) -> Option<Color> {
    h.paint()
        .overlay_commands
        .iter()
        .find_map(|cmd| match &**cmd {
            DrawCommand::Circle { color, .. } => Some(*color),
            _ => None,
        })
}

/// A ripple's colour is declared, so a theme switch reaches it.
///
/// The one colour that animates under a finger was the one frozen at build
/// time: `RippleConfig::color` was a `Color` where every other `StateStyle`
/// setter took a signal. Now it is a `Signal<Color>`, as `BorderOverride`'s
/// halves are, and the two speeds beside it stay plain.
///
/// Asserted on the drawn disc, and on its hue rather than its alpha, because
/// the alpha is multiplied by the ripple's own opacity and falls as the disc
/// fades — the hue is what the declaration decides.
///
/// The second half holds the press past its growth, which is the state the
/// declaration has to survive: a ripple that has finished growing stops asking
/// for frames so the loop can go quiet — see `Ripple::advance` — so the disc
/// under a still finger is not being repainted by an animation, and a colour
/// written then reaches the screen only because paint subscribed to it.
///
/// What this still does not pin is the subscription itself. Reading the colour
/// untracked passes here too, because `Tree::cache_layout` marks the widget for
/// paint on every layout pass — running layout *is* the invalidation signal —
/// so the skip-frame gate never comes up after a `fit` and each frame repaints
/// whatever the last write left. The read is tracked because the held case is
/// real, not because anything in `src/` would object if it stopped being.
#[test]
fn a_ripple_takes_the_colour_it_is_given_now() {
    let hot = create_signal(Color::rgba(1.0, 0.0, 0.0, 0.4));
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .when_pressed(move |s: StateStyle| s.ripple_with_color(hot))
            .on_click(|| {}),
    );
    h.fit(400.0, 400.0);

    let t0 = std::time::Instant::now() - std::time::Duration::from_secs(60);
    send_at(&mut h, t0, Event::mouse_down(50.0, 50.0, MouseButton::Left));
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(8),
        400.0,
        400.0,
    );

    let red = painted_ripple_color(&mut h).expect("the press starts a ripple");
    assert!(
        red.r > 0.9 && red.g < 0.1,
        "the declared colour is what the disc is drawn with, got {red:?}"
    );

    hot.set(Color::rgba(0.0, 0.0, 1.0, 0.4));
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(16),
        400.0,
        400.0,
    );

    let blue = painted_ripple_color(&mut h).expect("the ripple is still running");
    assert!(
        blue.b > 0.9 && blue.r < 0.1,
        "the ripple kept the colour it was built with, got {blue:?}"
    );

    // Now hold it past its growth, which is where the loop is allowed to go
    // quiet and where an unsubscribed read would strand the colour.
    let settled = t0 + std::time::Duration::from_secs(2);
    gated_frame_at(&mut h, settled, 400.0, 400.0);
    assert!(
        !pump(&mut h),
        "a ripple held past its growth has to stop asking for frames, or the \
         case this is about does not arise"
    );

    hot.set(Color::rgba(0.0, 1.0, 0.0, 0.4));
    eprintln!("needs_paint after write = {}", h.tree.needs_paint(h.root));
    let frame = gated_frame_at(
        &mut h,
        settled + std::time::Duration::from_millis(8),
        400.0,
        400.0,
    );

    eprintln!("frame colour = {:?}", ripple_color_of(&frame));
    let green = ripple_color_of(&frame).expect("the finger is still down");
    assert!(
        green.g > 0.9 && green.b < 0.1,
        "the disc under a still finger never saw the write, got {green:?}"
    );
    // The alpha is the declared one scaled by the disc's own opacity, which is
    // 1.0 for a ripple held at full growth — so here the two coincide and the
    // scaling is visible as itself rather than as some other arithmetic.
    assert!(
        (green.a - 0.4).abs() < 0.01,
        "the declared alpha is scaled by the disc's opacity, not combined with \
         it some other way: got {green:?}"
    );
}

/// The pressed layer's ripple is the one that paints, even when another layer
/// declares one too.
///
/// `ripple_config` asks for a layer that is *both* `Pressed` and has a ripple.
/// Loosen that to either and the search — which runs in reverse declaration
/// order — answers with whichever was declared last, so a hover ripple
/// declared after a pressed one would take over the press.
#[test]
fn a_hover_ripple_does_not_stand_in_for_the_pressed_one() {
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .when_pressed(|s: StateStyle| s.ripple_with_color(Color::rgba(1.0, 0.0, 0.0, 0.4)))
            .when_hovered(|s: StateStyle| s.ripple_with_color(Color::rgba(0.0, 0.0, 1.0, 0.4)))
            .on_click(|| {}),
    );
    h.fit(400.0, 400.0);

    let t0 = std::time::Instant::now() - std::time::Duration::from_secs(60);
    send_at(&mut h, t0, Event::mouse_down(50.0, 50.0, MouseButton::Left));
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(8),
        400.0,
        400.0,
    );

    let drawn = painted_ripple_color(&mut h).expect("the press starts a ripple");
    assert!(
        drawn.r > 0.9 && drawn.b < 0.1,
        "the hover layer's colour reached a press it does not describe: {drawn:?}"
    );
}

/// Lay out, run the queued jobs, paint, and report the first text colour.
fn painted_text_color(h: &mut H) -> Color {
    pump(h);
    h.fit(400.0, 400.0);
    let node = h.paint();

    fn find(node: &RenderNode) -> Option<Color> {
        for cmd in &node.commands {
            if let DrawCommand::Text { color, .. } = &**cmd {
                return Some(*color);
            }
        }
        node.children.iter().find_map(|child| find(child))
    }
    find(&node).expect("a text command")
}

fn set_hover(h: &mut H, inside: bool) {
    let (x, y) = if inside { (5.0, 5.0) } else { (-50.0, -50.0) };
    h.send(Event::mouse_move(x, y));
}

/// The failure this guards against is cache-shaped and silent: the container
/// repaints with its new background while the text's cached render node is
/// reused with the old colour still inside its draw commands.
///
/// The hover belongs to the box and the colour to the glyphs, so each is
/// declared where it happens and `control()` joins them.
#[test]
fn a_hover_layer_reaches_the_text() {
    let mut h = H::new(
        container().width(100.0).height(40.0).control().child(
            crate::widgets::text("Label")
                .color(Color::rgb(0.5, 0.5, 0.5))
                .when_hovered(|s| s.color(Color::WHITE)),
        ),
    );

    assert_eq!(painted_text_color(&mut h), Color::rgb(0.5, 0.5, 0.5));
    set_hover(&mut h, true);
    assert_eq!(painted_text_color(&mut h), Color::WHITE);
    set_hover(&mut h, false);
    assert_eq!(painted_text_color(&mut h), Color::rgb(0.5, 0.5, 0.5));
}

// ---------------------------------------------------------------------------
// The motion rides with the value
// ---------------------------------------------------------------------------

/// Two boxes differing in one thing only — whether the colour they are handed
/// carries a transition — and one write to the one signal both read.
///
/// This is the whole shape of the change in a single assertion: the timing is
/// not a second declaration naming a property, it is part of what the property
/// was set to, so the two containers can disagree about how they move while
/// agreeing about what they show.
#[test]
fn a_transition_on_the_value_is_what_makes_that_value_ease() {
    let color = create_signal(Color::BLACK);
    let mut h = H::new(
        container()
            .layout(Flex::row())
            .child(box_of(20.0, 20.0).background(color))
            .child(
                box_of(20.0, 20.0)
                    .background(color.transition(Transition::new(200.0, TimingFunction::Linear))),
            ),
    );
    h.fit(200.0, 200.0);
    h.paint();

    color.set(Color::WHITE);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(100),
        200.0,
        200.0,
    );

    // The two boxes' backgrounds, in the order they were declared.
    let painted: Vec<Color> = h
        .paint()
        .children
        .iter()
        .map(|child| rects(child).first().expect("a background").1)
        .collect();
    assert_eq!(
        painted[0],
        Color::WHITE,
        "a value declared with no motion is at its new value on the next paint"
    );
    assert!(
        painted[1].r > 0.05 && painted[1].r < 0.95,
        "and one declared with a transition is still on its way, got {:?}",
        painted[1]
    );
}

/// Whether anything this container declared reads its own target from a
/// signal — the question `resync_animation_targets` opens with, asked of a
/// container a test has just built.
impl Container {
    fn follows_a_signal_anywhere(&self) -> bool {
        self.anims
            .as_deref()
            .is_some_and(|declared| declared.slots().any(AnimSlot::follows_a_signal))
    }
}

/// A container still moving says so, and one that has settled stops saying it.
///
/// `advance_animations` folds the declared animations together with the
/// ripple, the kinetic scroll and the scrollbars, and its answer is what keeps
/// the next frame coming. A fold that lost the declared half would leave a
/// transition running with nothing asking for the frames to run it on —
/// visible only as an animation that stops halfway when nothing else in the
/// container happens to be moving.
#[test]
fn a_container_whose_declared_animation_is_running_asks_for_another_frame() {
    let colour = create_signal(Color::RED);
    let mut h = H::new(
        container()
            .width(100.0)
            .height(50.0)
            .background(colour.transition(Transition::new(100.0, TimingFunction::Linear))),
    );
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 500.0, 500.0);
    h.paint();
    colour.set(Color::BLUE);

    let moving = h.advance_at(t0 + std::time::Duration::from_millis(20));
    assert!(
        moving,
        "a transition halfway through needs the frame after it"
    );

    // Two: the frame that arrives is itself a frame something was moving on,
    // and it is the one after it that has nothing left to ask for.
    h.advance_at(t0 + std::time::Duration::from_millis(200));
    let settled = h.advance_at(t0 + std::time::Duration::from_millis(220));
    assert!(!settled, "and one that has arrived asks for nothing");
}

/// A container that declares no motion carries no animation box.
///
/// `ContainerAnims` holds twelve `AnimationState`s and is boxed precisely so
/// that the overwhelming majority of containers — every one that only sets a
/// background — do not pay for it. Writing the absence of a motion is a real
/// write, so it has to skip the container that has nothing to write it into,
/// and nothing else can see the difference: the pixels are identical either
/// way, which is why this asks the field directly.
#[test]
fn declaring_no_motion_allocates_no_animation_box() {
    assert!(
        container().background(Color::RED).anims.is_none(),
        "a plain declaration must not allocate the animation box"
    );
    assert!(
        container()
            .background(Color::RED.transition(200.0))
            .anims
            .is_some(),
        "and one that declares a motion has somewhere to keep it"
    );
    assert!(
        container()
            .background(Color::RED.transition(200.0))
            .background(Color::BLUE)
            .anims
            .as_deref()
            .is_some_and(|a| a.background().is_none()),
        "restating it plainly empties the slot rather than the box"
    );
}

/// A container pays for the animations it declared, not for the twelve it
/// could have.
///
/// The struct of eleven `Option<AnimationState<T>>`s this replaced measured
/// 2464 bytes, allocated whole the moment one property carried a motion — and
/// `.when_hovered(|s| s.lighter(0.1))` is that moment on most buttons. A slot
/// is the size of the largest animation there is, so one of them is what one
/// declaration costs.
#[test]
fn a_container_carries_one_slot_per_declared_animation() {
    let one = container().background(Color::RED.transition(200.0));
    assert_eq!(
        one.anims.as_deref().map(ContainerAnims::declared_count),
        Some(1),
        "one motion is one slot"
    );

    let two = container()
        .background(Color::RED.transition(200.0))
        .rotate(0.0.transition(200.0));
    assert_eq!(
        two.anims.as_deref().map(ContainerAnims::declared_count),
        Some(2),
        "and a second is a second"
    );

    // Two slots and the vector's own length: what the store is, rather than a
    // ceiling generous enough for a slot to grow by half and still pass.
    assert!(
        std::mem::size_of::<ContainerAnims>()
            <= 2 * std::mem::size_of::<AnimSlot>() + 2 * std::mem::size_of::<usize>(),
        "the store is sized by what a container declares, not by the twelve \
         properties it could declare: {} bytes",
        std::mem::size_of::<ContainerAnims>()
    );
}

/// A declaration is the whole property, so restating one with a plain value
/// takes its motion away with it.
///
/// This is what makes `adopt_declarations_of` unnecessary — there are never
/// two declarations for one property to reconcile, only the one written last.
/// Left unwritten, the animation would outlive the declaration that asked for
/// it, which is the shape of the defect this whole change removes: a timing
/// still governing a property nobody declared it on.
#[test]
fn restating_a_property_plainly_takes_its_motion_with_it() {
    let color = create_signal(Color::BLACK);
    let mut h = H::new(
        container()
            .layout(Flex::row())
            .child(
                box_of(20.0, 20.0)
                    .background(color.transition(Transition::new(200.0, TimingFunction::Linear))),
            )
            // The same declaration, restated without one.
            .child(
                box_of(20.0, 20.0)
                    .background(color.transition(Transition::new(200.0, TimingFunction::Linear)))
                    .background(color),
            ),
    );
    h.fit(200.0, 200.0);
    h.paint();

    color.set(Color::WHITE);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(100),
        200.0,
        200.0,
    );

    let painted: Vec<Color> = h
        .paint()
        .children
        .iter()
        .map(|child| rects(child).first().expect("a background").1)
        .collect();
    assert!(
        painted[0].r < 0.95,
        "the transition it was declared with still holds, got {:?}",
        painted[0]
    );
    assert_eq!(
        painted[1],
        Color::WHITE,
        "and the one restated plainly has no transition left to hold it back"
    );
}

/// And on a padding, which is the one newly-timeline-capable property on the
/// *layout* path rather than the paint path — so it is where "a sequence
/// speaks for its property while it plays" has to hold against
/// `update_size_targets` recomputing the declared value at every layout.
///
/// Asserted on the box the padding sizes rather than on a colour: a padding is
/// not drawn, it is the space a container takes around what it holds.
#[test]
fn a_timeline_plays_on_a_padding() {
    let plays = create_signal(0u32);
    let rest = Padding::all(0.0);
    let mut h = H::new(
        container()
            .padding(
                rest.timeline(
                    Keyframes::new(200.0)
                        .at(0.0, rest)
                        .at(0.5, Padding::all(20.0))
                        .at(1.0, rest)
                        .played_by(plays),
                ),
            )
            .child(box_of(20.0, 20.0)),
    );
    let at_rest = h.fit(200.0, 200.0);
    h.paint();
    assert_eq!(at_rest.width, 20.0, "nothing plays until the trigger moves");

    plays.set(1);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    h.tree
        .set_frame_instant(Some(t0 + std::time::Duration::from_millis(100)));
    pump(&mut h);
    let played = h.fit(200.0, 200.0);
    h.tree.set_frame_instant(None);

    assert!(
        played.width > at_rest.width + 5.0,
        "the sequence has to reach the layout the padding sizes, got {} \
         against {} at rest",
        played.width,
        at_rest.width
    );
}

/// A timeline is no longer transform-only: `Keyframes<T>` was always generic
/// and only the setters were not, so a background can flash where before it
/// could only be eased to.
#[test]
fn a_timeline_plays_on_a_background() {
    let plays = create_signal(0u32);
    let rest = Color::BLACK;
    let mut h = H::new(
        box_of(50.0, 50.0).background(
            rest.timeline(
                Keyframes::new(200.0)
                    .at(0.0, rest)
                    .at(0.5, Color::RED)
                    .at(1.0, rest)
                    .played_by(plays),
            ),
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();
    assert_eq!(
        rects(&h.paint())[0].1,
        rest,
        "nothing plays until the trigger moves"
    );

    plays.set(1);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(100),
        200.0,
        200.0,
    );

    let flashed = rects(&h.paint())[0].1;
    assert!(
        flashed.r > 0.5,
        "the sequence has to reach the pixels, got {flashed:?}"
    );
}

// ---------------------------------------------------------------------------
// Keyframes
// ---------------------------------------------------------------------------

/// A timeline plays because a signal the caller owns changed, so the container
/// has to be subscribed to it — reading the trigger where the targets are read
/// is what does that, and without it a shake would wait for the next frame
/// somebody else asked for.
#[test]
fn a_container_wakes_when_its_timeline_is_asked_to_play() {
    let plays = create_signal(0u32);
    let mut h = H::new(
        box_of(50.0, 50.0).rotate(
            0.0.timeline(
                Keyframes::new(200.0)
                    .at(0.0, 0.0)
                    .at(0.5, 2.0)
                    .at(1.0, 0.0)
                    .played_by(plays),
            ),
        ),
    );
    h.fit(100.0, 100.0);
    h.paint();

    let queued = h.jobs_from(|| plays.set(1));
    assert!(
        queued.contains(&JobType::Animation),
        "a play has to wake the container that would show it, got {queued:?}"
    );
}

/// The transform a sequence has reached at the peak of its middle keyframe.
/// A rotation shows up as a matrix that is no longer the identity.
///
/// Two frames, because they are two different things: the first sees the
/// trigger move and starts the sequence, the second is 100ms later and is the
/// one with something to show. They used to be the same frame, and what made
/// that work was the few nanoseconds between `Instant::now()` in `play` and
/// `Instant::now()` inside `advance` — a gap this test was reading and nobody
/// had chosen.
fn played_transform(h: &mut H) -> Transform {
    let t0 = std::time::Instant::now();
    frame_at(h, t0, 200.0, 200.0);
    frame_at(h, t0 + std::time::Duration::from_millis(100), 200.0, 200.0);
    h.paint().children[0].local_transform
}

/// A sequence with nothing to trigger it plays because the widget exists.
///
/// This is what a spinner needs and what a shake must not do. A trigger records
/// its value when the widget is built and waits for a change, so a widget
/// mounted at the instant its condition became true sits perfectly still,
/// waiting for something that has already happened (#213).
///
/// The first frame is the one that asks — `seed_animations` requests the
/// animation job, because nothing else will — and the play itself happens where
/// every other play happens, in the animate pass.
#[test]
fn a_sequence_with_no_trigger_plays_because_it_exists() {
    let mut h = H::new(spinning(Repeat::Times(1)));
    frame_at(&mut h, std::time::Instant::now(), 200.0, 200.0);

    assert!(
        !played_transform(&mut h).is_identity(),
        "nothing asked it to play, and that is the point: it plays because it is there"
    );
}

/// The whole design in one test: showing the widget starts it, hiding it stops
/// it, and the surface goes idle afterwards.
///
/// Nothing is added for stopping an endless sequence, and this is why that is a
/// design rather than an omission — the widget's presence *is* the switch. It
/// is also the case the issue says fails today: the spinner is built *after*
/// `busy` became true, so a trigger would record the new value and wait for a
/// change that has already happened.
#[test]
fn showing_the_widget_starts_the_sequence_and_hiding_it_stops_everything() {
    let busy = create_signal(false);
    let mut h = H::new(
        container()
            .layout(Flex::row())
            .child(move || busy.get().then(|| spinning_child(Repeat::Forever))),
    );
    h.fit(200.0, 200.0);
    h.paint();

    assert!(
        h.paint().children.is_empty(),
        "nothing is waiting, so there is no spinner"
    );

    busy.set(true);
    // One frame to reconcile the child into the tree and lay it out, which is
    // where it asks for the animation job. The play itself is the frame after,
    // in the animate pass, and `played_transform` is those two.
    frame_at(&mut h, std::time::Instant::now(), 200.0, 200.0);
    assert!(
        !played_transform(&mut h).is_identity(),
        "it appeared, so it plays — with nothing having asked it to"
    );

    busy.set(false);
    let t0 = std::time::Instant::now();
    for step in 0..6 {
        frame_at(
            &mut h,
            t0 + std::time::Duration::from_millis(step * 200),
            200.0,
            200.0,
        );
    }
    assert!(
        !pump(&mut h),
        "an endless sequence has no stop call, so the widget going away has to \
         be what lets the surface settle"
    );
}

/// An endless sequence is at the same point in its run a month later as it was
/// in its first, and still moves between one frame and the next.
///
/// Its elapsed time is an `f32` count of milliseconds measured from a start
/// that moves up with every whole run behind it. Left growing for the life of
/// the widget, the gap between representable values reaches a whole 60Hz frame
/// at about thirty-seven hours and a whole run of a short sequence within a few
/// weeks — at which point it shows one value for frame after frame. A bar is
/// the thing that runs for weeks.
///
/// Asserted on *where in the run it is*, not merely that it moved: a start that
/// is moved by the wrong amount, or in the wrong direction, still moves.
#[test]
fn an_endless_sequence_keeps_its_place_in_the_run_a_month_later() {
    let mut h = H::new(spinning(Repeat::Forever));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(1),
        200.0,
        200.0,
    );

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(100),
        200.0,
        200.0,
    );
    let first_run = h.paint().children[0].local_transform;

    // A whole number of 200ms runs, so the same point in the run — 30 days is
    // 12,960,000 of them exactly.
    let month = std::time::Duration::from_secs(30 * 24 * 60 * 60);
    frame_at(
        &mut h,
        t0 + month + std::time::Duration::from_millis(100),
        200.0,
        200.0,
    );
    assert_eq!(
        h.paint().children[0].local_transform,
        first_run,
        "a whole number of runs later is the same point in the run"
    );

    frame_at(
        &mut h,
        t0 + month + std::time::Duration::from_millis(116),
        200.0,
        200.0,
    );
    assert!(
        h.paint().children[0].local_transform != first_run,
        "and the frame after it has moved on, rather than showing the same value"
    );
}

/// A sequence that has run out lets the surface settle.
///
/// `wants_play` is what `resync_animation_targets` asks at every paint, and it
/// has to say no once a sequence with no trigger has had its one play —
/// otherwise the container is woken for a play it has already had, every frame,
/// for as long as it exists.
#[test]
fn a_finished_sequence_stops_asking_to_be_played() {
    let mut h = H::new(spinning(Repeat::Times(1)));
    let t0 = std::time::Instant::now();
    for step in 0..6 {
        frame_at(
            &mut h,
            t0 + std::time::Duration::from_millis(step * 100),
            200.0,
            200.0,
        );
        h.paint();
    }
    assert!(
        !pump(&mut h),
        "the sequence is over, so nothing is owed another frame"
    );
}

/// A property that eases has nothing to play, and must not ask for the frame a
/// sequence would need.
#[test]
fn a_property_with_no_sequence_asks_for_no_play() {
    let mut h = H::new(
        container()
            .layout(Flex::row())
            .child(box_of(50.0, 50.0).rotate(0.0.transition(200.0))),
    );
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    h.paint();

    assert!(
        !pump(&mut h),
        "an eased property with no sequence is owed no play, so the first \
         layout has nothing to ask for"
    );
}

/// The tree both endless tests use: a rotation with a sequence and no trigger.
fn spinning(repeat: Repeat) -> Container {
    container()
        .layout(Flex::row())
        .child(spinning_child(repeat))
}

/// The child on its own, for the test that mounts it after the fact.
fn spinning_child(repeat: Repeat) -> Container {
    box_of(50.0, 50.0).rotate(
        0.0.timeline(
            Keyframes::new(200.0)
                .at(0.0, 0.0)
                .at(0.5, 20.0)
                .at(1.0, 0.0)
                .repeat(repeat),
        ),
    )
}

/// And it keeps going, which a sequence that repeats a fixed number of times
/// does not.
#[test]
fn a_sequence_that_repeats_forever_is_still_running_much_later() {
    let mut endless = H::new(spinning(Repeat::Forever));
    let mut counted = H::new(spinning(Repeat::Times(1)));

    let t0 = std::time::Instant::now();
    // Well past a single run, and off the resting value of both.
    let at = t0 + std::time::Duration::from_millis(2100);
    for h in [&mut endless, &mut counted] {
        frame_at(h, t0, 200.0, 200.0);
        frame_at(h, t0 + std::time::Duration::from_millis(1), 200.0, 200.0);
        frame_at(h, at, 200.0, 200.0);
        // One more, because a sequence that has run out hands the property back
        // on the frame it ends and settles on the next.
        frame_at(h, at + std::time::Duration::from_millis(1), 200.0, 200.0);
    }

    assert!(
        !endless.paint().children[0].local_transform.is_identity(),
        "a sequence that repeats forever is still moving ten runs later"
    );
    assert!(
        counted.paint().children[0].local_transform.is_identity(),
        "and one that does not is back at rest, which is what says the first \
         assertion is about the repeat and not about the clock"
    );
}

/// A trigger still means what it meant: play on each change, and not before.
#[test]
fn a_sequence_played_by_a_trigger_waits_for_it() {
    let plays = create_signal(0u32);
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(50.0, 50.0).rotate(
                0.0.timeline(
                    Keyframes::new(200.0)
                        .at(0.0, 0.0)
                        .at(0.5, 20.0)
                        .at(1.0, 0.0)
                        .played_by(plays),
                ),
            ),
        ),
    );

    assert!(
        played_transform(&mut h).is_identity(),
        "nothing has asked it to play yet"
    );

    plays.set(1);
    assert!(!played_transform(&mut h).is_identity(), "and now it has");
}

/// Waking is not playing. The test above passes whether or not the sequence
/// survived, because the job comes from the trigger — so this one asks the
/// only question that matters: did the property move?
#[test]
fn a_played_sequence_actually_moves_the_transform() {
    let plays = create_signal(0u32);
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(50.0, 50.0).rotate(
                0.0.timeline(
                    Keyframes::new(200.0)
                        .at(0.0, 0.0)
                        .at(0.5, 20.0)
                        .at(1.0, 0.0)
                        .played_by(plays),
                ),
            ),
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();

    plays.set(1);
    let played = played_transform(&mut h);
    assert_ne!(
        played,
        Transform::IDENTITY,
        "the sequence has to reach the paint, not only the job queue"
    );
}

/// `Translate::relative(-1.0, 0.0)` is one width left at whatever width the
/// box is laid out, including one it changes to — and the frame the change
/// lands on is the frame that paints it, through the paint cache.
#[test]
fn a_relative_translate_is_its_own_width_at_any_width() {
    let w = create_signal(50.0f32);
    let mut h = H::new(
        container()
            .width(w)
            .height(20.0)
            .translate(Translate::relative(-1.0, 0.0)),
    );
    let tx = |h: &mut H| h.frame(200.0, 200.0).node.local_transform.tx();
    assert_eq!(tx(&mut h), -50.0);

    w.set(120.0);
    assert_eq!(tx(&mut h), -120.0, "a new width is a new distance");
}

/// A relative enter plays from the first frame, when nothing has been
/// measured until the layout that seeds it — the case a width read back
/// through a `WidgetRef` cannot do, because it is still zero there.
#[test]
fn a_relative_enter_slides_in_from_its_own_width_on_the_first_frame() {
    let t0 = std::time::Instant::now();
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(80.0, 20.0).translate(
                Translate::NONE
                    .transition(Transition::new(100.0, TimingFunction::Linear))
                    .entering_from(Translate::relative(-1.0, 0.0)),
            ),
        ),
    );
    let tx = |h: &mut H| h.paint().children[0].local_transform.tx();

    frame_at(&mut h, t0, 200.0, 200.0);
    assert_eq!(tx(&mut h), -80.0, "the first frame is one whole width out");

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        200.0,
        200.0,
    );
    assert_eq!(tx(&mut h), -40.0, "half the fraction is half the width");

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(200),
        200.0,
        200.0,
    );
    assert_eq!(tx(&mut h), 0.0, "and it arrives");
}

/// What animates is the fraction, so a width change under a relative
/// translate changes no target: the box is at its new distance on the frame
/// that lays it out, and nothing is left playing.
#[test]
fn a_width_change_under_a_relative_translate_moves_at_once() {
    let w = create_signal(50.0f32);
    let mut h = H::new(container().width(w).height(20.0).translate(
        Translate::relative(-1.0, 0.0).transition(Transition::new(100.0, TimingFunction::Linear)),
    ));
    let tx = |h: &mut H| h.paint().local_transform.tx();
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    assert_eq!(tx(&mut h), -50.0);

    w.set(100.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(10),
        200.0,
        200.0,
    );
    assert_eq!(tx(&mut h), -100.0, "at the new width at once");
    assert!(!pump(&mut h), "and no animation was started to get there");
}

/// A translate that animates has to arrive where its signal points.
///
/// The one component with no such test until now, and four separate lists name
/// it on the way: the target is only computed where `advance_animations` says
/// the component is animated, and resolved only where `animated_transform`
/// says something could move it.
#[test]
fn an_animated_translate_reaches_the_paint() {
    let offset = create_signal(Translate::NONE);
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(50.0, 50.0)
                .translate(offset.transition(Transition::new(600.0, TimingFunction::Linear))),
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();
    assert_eq!(
        h.paint().children[0].local_transform.tx(),
        0.0,
        "at rest it sits where it was laid out"
    );

    offset.set(Translate::new(40.0, 0.0));

    // Moving, and not arrived. Without this the test passes with the animation
    // deleted outright — `get_animated_value` falls back to the signal, and
    // paint lands on 40 the first time it is asked.
    //
    // A tenth of the way through a linear six hundred milliseconds is a tenth
    // of the distance, so this is a number rather than the band it used to be:
    // the band existed because the only "midway" available was however far the
    // clock had moved between two reads of it.
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 200.0, 200.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(60),
        200.0,
        200.0,
    );
    let midway = h.paint().children[0].local_transform.tx();
    assert_eq!(
        midway, 4.0,
        "it has to animate towards the target rather than snap to it"
    );

    settle(&mut h, 400);
    let tx = h.paint().children[0].local_transform.tx();
    assert!(
        (tx - 40.0).abs() < 0.5,
        "the animation has to arrive at what the signal named, got {tx}"
    );
}

/// A target the widget could only have reached through a branch it was not
/// subscribed to when it first laid out.
///
/// `seed_animations` subscribes once, to whatever the closure read at the first
/// layout — here `armed` alone, because the other branch was not taken.
/// `advance_animations` reads in a `snapshot_zone` and subscribes to nothing.
/// So `resync_animation_targets` is the only pass that can ever pick up
/// `offset`, and the write below is the one nothing else can see: flipping
/// `armed` wakes the container by the subscription it already had, but the
/// write *after* that has only the re-sync between it and a stale value.
#[test]
fn a_translate_target_behind_an_untaken_branch_is_picked_up_by_the_resync() {
    let armed = create_signal(false);
    let offset = create_signal(0.0f32);
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(50.0, 50.0).translate(
                (move || {
                    if armed.get() {
                        Translate::new(offset.get(), 0.0)
                    } else {
                        Translate::NONE
                    }
                })
                .transition(Transition::new(80.0, TimingFunction::Linear)),
            ),
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();

    // The branch flips. This much the first subscription can see, and the
    // paint it causes is the only chance anything has to notice `offset`.
    armed.set(true);
    settle(&mut h, 120);

    offset.set(40.0);
    settle(&mut h, 120);

    let tx = h.paint().children[0].local_transform.tx();
    assert!(
        (tx - 40.0).abs() < 0.5,
        "a target behind a branch nobody tracked still has to converge, got {tx}"
    );
}

/// A padding written between construction and the first layout arrives.
///
/// The push half, for padding. The builder seeds from `get_untracked()`, so a
/// write in that window is one nothing has subscribed to yet; what closes it is
/// `seed_animations` re-reading the target at the first layout and placing it
/// before the measurement that consumes it. Seed after `read_box_lengths` and the
/// container measures with whatever the builder happened to see, with no later
/// pass obliged to fix it.
#[test]
fn a_padding_written_before_the_first_layout_arrives() {
    let inset = create_signal(0.0f32);
    let mut h = H::new(
        container()
            .width(200.0)
            .height(200.0)
            .padding(
                (move || Padding::all(inset.get()))
                    .transition(Transition::new(80.0, TimingFunction::Linear)),
            )
            .child(box_of(20.0, 20.0)),
    );

    // Between the builder and the first layout, as a popup's content is built
    // one frame and laid out the next.
    inset.set(24.0);

    // One frame: the seed runs before the measurement, so the layout that places
    // the value is the layout that uses it.
    let x = h.frame(400.0, 400.0).node.children[0].local_transform.tx();
    assert!(
        (x - 24.0).abs() < 0.5,
        "the write landed before anything was listening and has to be picked up \
         at the seed, got {x}"
    );
}

/// And the size that padding feeds settles on the padding that was measured.
///
/// The consequence with no second chance. `update_size_targets` runs after the
/// seed and places the size target from `content + padding` — so with the seed
/// last, it placed a size computed from the padding the builder captured, and a
/// placement jumps: no animation is left running, and nothing asks again. The
/// container keeps a width that is wrong for the rest of its life, not for a
/// frame.
///
/// Content-driven on purpose — a width with a cap and no exact value — because a
/// container told its width outright does not consult its padding for it.
#[test]
fn a_size_settles_on_the_padding_the_layout_measured() {
    let inset = create_signal(0.0f32);
    let mut h = H::new(
        container()
            .padding(
                (move || Padding::all(inset.get()))
                    .transition(Transition::new(80.0, TimingFunction::Linear)),
            )
            .width(at_most(200.0).transition(Transition::new(80.0, TimingFunction::Linear)))
            .child(box_of(20.0, 20.0)),
    );

    inset.set(24.0);
    settle(&mut h, 120);

    let width = h.tree.cached_size(h.root).map(|s| s.width);
    assert!(
        width.is_some_and(|w| (w - 68.0).abs() < 0.5),
        "the size follows the content plus the padding that was measured, \
         20 + 24 + 24: got {width:?}"
    );
}

/// The same for a border width, seeded from the same pass by the same call.
#[test]
fn a_border_width_written_before_the_first_layout_arrives() {
    let thickness = create_signal(0.0f32);
    let mut h = H::new(container().width(80.0).height(80.0).border(
        (move || thickness.get()).transition(Transition::new(80.0, TimingFunction::Linear)),
        Color::WHITE,
    ));

    thickness.set(5.0);
    // One frame is enough: a border width is paint-only, so unlike a padding it
    // arrived even when the seed ran last. What this kills is its own
    // `seed_or_enter` line; the arm it has in the drift list is the other
    // border-width test's, one screen down.
    let frame = h.frame(200.0, 200.0);
    let width = borders(&frame.node).first().map(|(width, _)| *width);
    assert!(
        width.is_some_and(|w| (w - 5.0).abs() < 0.5),
        "the write landed before anything was listening and has to be picked up \
         at the seed, got {width:?}"
    );
}

/// The same for a padding, which the drift list names first.
///
/// Read off the child's position, because that is where a padding arrives: the
/// container's own rect says nothing about its inside.
#[test]
fn a_padding_target_behind_an_untaken_branch_is_picked_up_by_the_resync() {
    let armed = create_signal(false);
    let inset = create_signal(0.0f32);
    let mut h = H::new(
        container()
            .width(200.0)
            .height(200.0)
            .padding(
                (move || {
                    if armed.get() {
                        Padding::all(inset.get())
                    } else {
                        Padding::all(0.0)
                    }
                })
                .transition(Transition::new(80.0, TimingFunction::Linear)),
            )
            .child(box_of(20.0, 20.0)),
    );
    h.fit(400.0, 400.0);
    h.paint();

    // The branch flips, which the first subscription can see.
    armed.set(true);
    settle(&mut h, 120);

    // And this is the write nothing else can see.
    inset.set(30.0);
    settle(&mut h, 120);

    let x = h.paint().children[0].local_transform.tx();
    assert!(
        (x - 30.0).abs() < 0.5,
        "a padding behind a branch nobody tracked still has to converge, got {x}"
    );
}

/// The same for a border width, the slot beside padding's in the drift list.
///
/// These two are the last pair of arms in that list nothing watched: deleting
/// either changed nothing any test could see.
#[test]
fn a_border_width_target_behind_an_untaken_branch_is_picked_up_by_the_resync() {
    let armed = create_signal(false);
    let thickness = create_signal(0.0f32);
    let mut h = H::new(
        container().width(80.0).height(80.0).border(
            (move || {
                if armed.get() { thickness.get() } else { 0.0 }
            })
            .transition(Transition::new(80.0, TimingFunction::Linear)),
            Color::WHITE,
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();

    armed.set(true);
    settle(&mut h, 120);

    thickness.set(6.0);
    settle(&mut h, 120);

    let width = borders(&h.paint()).first().map(|(width, _)| *width);
    assert!(
        width.is_some_and(|w| (w - 6.0).abs() < 0.5),
        "a border width behind a branch nobody tracked still has to converge, \
         got {width:?}"
    );
}

/// The same for a shadow, which reaches paint by its own slot in both the seed
/// and the drift list.
///
/// Two things this is the only witness to. `seed_animations` guards on a chain
/// of `||` over every animatable slot, so a container animating *nothing but a
/// shadow* is what says the shadow's own term carries the chain. And
/// `resync_animation_targets` compares the held target against the effective one
/// — invert that comparison and a target behind an untaken branch is never
/// picked up, which is exactly the write below.
#[test]
fn a_shadow_target_behind_an_untaken_branch_is_picked_up_by_the_resync() {
    let armed = create_signal(false);
    let depth = create_signal(4.0f32);
    let shadow_of = move |blur: f32| {
        Shadow::new(
            (0.0, blur * 0.5),
            blur,
            0.0,
            Color::rgba(0.0, 0.0, 0.0, 0.5),
        )
    };
    // The root, not a child: a fixed-size container is a relayout boundary, and
    // `pump` discards the layout roots the real loop lays out from — so a nested
    // one keeps the reach of its last layout and `animated_shadow` clamps the
    // convergence away. The same reason the easing test gives.
    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .background(Color::RED)
            .shadow(
                (move || {
                    if armed.get() {
                        shadow_of(depth.get())
                    } else {
                        Shadow::none()
                    }
                })
                .transition(Transition::new(80.0, TimingFunction::Linear)),
            ),
    );
    h.fit(200.0, 200.0);
    h.paint();

    // The branch flips, which the first subscription can see.
    armed.set(true);
    settle(&mut h, 120);

    // And this one it cannot: only the re-sync stands between it and a stale
    // target.
    depth.set(20.0);
    settle(&mut h, 120);

    let painted = drawn_shadow(&h.paint()).expect("a shadow is drawn");
    assert!(
        (painted.blur - 20.0).abs() < 0.5,
        "a target behind a branch nobody tracked still has to converge, got {}",
        painted.blur
    );
}

/// The other two timelines, which `advance_animations` starts and
/// `resync_animation_targets` wakes from lists that name each component once.
/// Only a rotation was played by anything before this.
///
/// Neither sequence passes through the value that composes to the identity —
/// the displacement stays out at 10 and the pulse never comes back below 1.1 —
/// so neither assertion depends on how far the clock moved between `play` and
/// the advance that reads it. A scale is the one that needs this: it
/// interpolates *around* 1.0, and the first ~30ns of a linear ramp round to
/// exactly `Scale::NONE`. Where the timeline never ran at all, the animation
/// still holds the value it was built with, which is neutral, and that is what
/// each assertion is against.
#[test]
fn a_translate_sequence_and_a_scale_sequence_move_the_transform() {
    let plays = create_signal(0u32);
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(50.0, 50.0).translate(
                Translate::NONE.timeline(
                    Keyframes::new(200.0)
                        .at(0.0, Translate::new(10.0, 0.0))
                        .at(0.5, Translate::new(30.0, 0.0))
                        .at(1.0, Translate::new(10.0, 0.0))
                        .played_by(plays),
                ),
            ),
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();
    plays.set(1);
    let played = played_transform(&mut h).tx();
    assert!(
        played > 5.0,
        "a displacement sequence has to reach the paint, not only the job \
         queue, got {played}"
    );

    let plays = create_signal(0u32);
    let mut h = H::new(
        container().layout(Flex::row()).child(
            box_of(50.0, 50.0).scale(
                Scale::NONE.timeline(
                    Keyframes::new(200.0)
                        .at(0.0, Scale::uniform(1.1))
                        .at(0.5, Scale::uniform(1.4))
                        .at(1.0, Scale::uniform(1.1))
                        .played_by(plays),
                ),
            ),
        ),
    );
    h.fit(200.0, 200.0);
    h.paint();
    plays.set(1);
    let played = played_transform(&mut h).a();
    assert!(played > 1.05, "and so does a pulse, got {played}");
}

// ---------------------------------------------------------------------------
// Focus, now that it is stored state
// ---------------------------------------------------------------------------

/// Focus used to be a bare generational id, which made this self-correcting:
/// a dead widget stopped matching any live one and `when_focused` resolved to
/// false on its own. The focus *path* is stored state and has no such
/// property — its ancestors would go on answering "the focus is inside me" for
/// a widget that no longer exists.
#[test]
fn unregistering_a_focused_widget_releases_the_focus() {
    use crate::reactive::focus::focus_path;
    use crate::reactive::request_focus;

    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .child(box_of(10.0, 10.0)),
    );
    h.fit(100.0, 100.0);
    let child = h.children()[0];

    request_focus(&h.tree, child);
    assert!(focus_path().contains(child));
    assert!(
        focus_path().contains(h.root),
        "the ancestor is on the path, which is what a focused layer asks about"
    );

    h.tree.unregister(child);
    assert!(
        !focus_path().contains(h.root),
        "an ancestor must stop claiming focus once the focused widget is gone"
    );
}

/// A container resolves `when_focused` by asking the path, not by walking its
/// descendants — that is what lets the same question be answered from inside a
/// derived closure, which has no tree.
#[test]
fn a_focused_layer_applies_while_a_descendant_holds_focus() {
    use crate::reactive::focus::clear_focus;
    use crate::reactive::request_focus;

    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .background(Color::RED)
            .when_focused(|s| s.background(Color::BLUE))
            .child(box_of(10.0, 10.0)),
    );
    h.fit(100.0, 100.0);
    let child = h.children()[0];

    assert_eq!(rects(&h.paint())[0].1, Color::RED);
    request_focus(&h.tree, child);
    assert_eq!(rects(&h.paint())[0].1, Color::BLUE);
    clear_focus();
    assert_eq!(rects(&h.paint())[0].1, Color::RED);
}

/// A state layer *overrides* the base; it does not rank against it.
///
/// Which is the whole answer to "why would a field not use `when_focused` for
/// its focus ring". A border that already carries a meaning — an error colour
/// here — puts that meaning in the base, and the base is exactly what the layer
/// replaces. On a field that holds the focus essentially all the time, that is
/// an error colour that never appears.
#[test]
fn a_focused_layer_replaces_the_base_rather_than_ranking_against_it() {
    use crate::reactive::focus::clear_focus;
    use crate::reactive::request_focus;
    use crate::widgets::text_input;

    clear_focus();
    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .border(1.5, Color::RED)
            .when_focused(|s| s.border(1.5, Color::BLUE))
            .child(text_input(create_signal(String::new()))),
    );
    h.fit(100.0, 100.0);
    let input = h.children()[0];

    assert_eq!(borders(&h.paint())[0].1, Color::RED);

    request_focus(&h.tree, input);
    assert_eq!(
        borders(&h.paint())[0].1,
        Color::BLUE,
        "the layer wins, and the base has no way to say it should not"
    );
}

/// The other way to follow the focus, for when it has to rank *below* something:
/// a colour that asks a handle instead of a state layer that overrides.
///
/// It works because the closure is read inside paint's tracking scope — asking
/// about the focus is what subscribes the container to it, with no
/// `when_focused` declared anywhere.
#[test]
fn a_border_colour_that_asks_a_handle_follows_the_focus() {
    use crate::reactive::focus::clear_focus;
    use crate::reactive::request_focus;
    use crate::widget_ref::create_widget_ref;
    use crate::widgets::text_input;

    clear_focus();
    let handle = create_widget_ref();
    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .border(2.0, move || {
                if handle.is_focused() {
                    Color::BLUE
                } else {
                    Color::RED
                }
            })
            .child(text_input(create_signal(String::new())).widget_ref(handle)),
    );
    h.fit(100.0, 100.0);
    let input = h.children()[0];

    assert_eq!(borders(&h.paint())[0], (2.0, Color::RED));

    request_focus(&h.tree, input);
    assert_eq!(borders(&h.paint())[0], (2.0, Color::BLUE));

    // And the container has to *hear* about a focus change. Nothing else would
    // repaint a border whose colour is a closure: the two repaints
    // `request_focus` asks for name the input and the widget losing the focus,
    // neither of which is this container.
    let queued = h.jobs_from(clear_focus);
    assert!(
        queued.contains(&JobType::Paint),
        "asking about the focus has to subscribe to it, got {queued:?}"
    );
    assert_eq!(borders(&h.paint())[0], (2.0, Color::RED));
}

/// A state override holds a signal, so it follows a theme the way the base does.
///
/// Before this it held a plain `Color`, taken once when the builder ran. A
/// themed button tracked the theme through `background(..)` and stopped
/// tracking it the moment the pointer arrived, because the layer covering the
/// base had no way to say it depended on anything.
#[test]
fn a_state_override_follows_the_signal_it_was_given() {
    let accent = create_signal(Color::RED);
    let mut h = H::new(
        box_of(50.0, 50.0)
            .background(Color::BLACK)
            .when_hovered(move |s: StateStyle| s.background(accent)),
    );
    h.fit(100.0, 100.0);

    set_hover(&mut h, true);
    assert_eq!(rects(&h.paint())[0].1, Color::RED);

    // Reading the override is what subscribes to it: nothing else would tell
    // this container that a colour it draws has moved.
    let queued = h.jobs_from(|| accent.set(Color::BLUE));
    assert!(
        queued.contains(&JobType::Paint),
        "the active override has to subscribe, got {queued:?}"
    );
    assert_eq!(rects(&h.paint())[0].1, Color::BLUE);
}

/// A state the app owns needs no mechanism: it is a signal, read where the
/// style is resolved.
#[test]
fn a_state_layer_may_hang_on_a_condition_the_app_owns() {
    let wrong = create_signal(false);
    let mut h = H::new(
        box_of(50.0, 50.0)
            .background(Color::BLACK)
            .state(wrong, |s| s.background(Color::RED)),
    );
    h.fit(100.0, 100.0);

    assert_eq!(rects(&h.paint())[0].1, Color::BLACK);

    let queued = h.jobs_from(|| wrong.set(true));
    assert!(
        queued.contains(&JobType::Paint),
        "the condition has to subscribe, got {queued:?}"
    );
    assert_eq!(rects(&h.paint())[0].1, Color::RED);
}

/// The answer to the field whose focus ring hid its error: declaration order
/// decides, so the error written last outranks the focus.
#[test]
fn the_last_layer_declared_wins_over_the_ones_before_it() {
    use crate::reactive::focus::clear_focus;
    use crate::reactive::request_focus;
    use crate::widgets::text_input;

    clear_focus();
    let wrong = create_signal(false);
    let mut h = H::new(
        container()
            .width(50.0)
            .height(50.0)
            .border(1.5, Color::WHITE)
            .when_focused(|s| s.border(1.5, Color::BLUE))
            .state(wrong, |s| s.border(1.5, Color::RED))
            .child(text_input(create_signal(String::new()))),
    );
    h.fit(100.0, 100.0);
    let input = h.children()[0];

    request_focus(&h.tree, input);
    assert_eq!(borders(&h.paint())[0].1, Color::BLUE);

    wrong.set(true);
    assert_eq!(
        borders(&h.paint())[0].1,
        Color::RED,
        "declared after the focused layer, so it outranks it"
    );

    // And it is the order, not the kind: the focus is still held.
    wrong.set(false);
    assert_eq!(borders(&h.paint())[0].1, Color::BLUE);
}

/// A layer is passed over for a property it says nothing about, rather than
/// ending the search — otherwise a pressed layer that only scales would drop
/// the hover's background on the way down.
#[test]
fn a_layer_silent_on_a_property_does_not_shadow_the_one_below_it() {
    let mut h = H::new(
        box_of(50.0, 50.0)
            .background(Color::BLACK)
            .when_hovered(|s| s.background(Color::RED))
            .when_pressed(|s| s.scale(0.5)),
    );
    h.fit(100.0, 100.0);

    set_hover(&mut h, true);
    h.send(Event::mouse_down(5.0, 5.0, MouseButton::Left));
    assert_eq!(rects(&h.paint())[0].1, Color::RED);
}

// ---------------------------------------------------------------------------
// Reactivity — properties that used to accept only a constant
// ---------------------------------------------------------------------------

/// A gradient follows its signal, and does so as a repaint: nothing about the
/// fill can move the box.
#[test]
fn a_gradient_is_reactive_and_paint_only() {
    let warm = create_signal(true);
    let mut h = H::new(container().width(20.0).height(20.0).gradient(move || {
        Some(if warm.get() {
            LinearGradient::horizontal(Color::RED, Color::YELLOW)
        } else {
            LinearGradient::horizontal(Color::BLUE, Color::CYAN)
        })
    }));
    h.fit(100.0, 100.0);
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::YELLOW)));

    let queued = h.jobs_from(|| warm.set(false));
    assert_eq!(queued, vec![JobType::Paint], "got {queued:?}");
    assert_eq!(gradient_ends(&h.paint()), Some((Color::BLUE, Color::CYAN)));
}

/// A gradient built in a closure follows the signals that built it.
#[test]
fn a_gradient_follows_the_signals_it_was_built_from() {
    let end = create_signal(Color::YELLOW);
    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .gradient(move || LinearGradient::vertical(Color::RED, end.get())),
    );
    h.fit(100.0, 100.0);
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::YELLOW)));

    end.set(Color::GREEN);
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::GREEN)));
}

/// A state layer's background overrides reach a gradient: `lighter`, `darker`
/// and `alpha` apply to both ends, the way they apply to a solid fill.
#[test]
fn hovering_a_gradient_lightens_both_of_its_ends() {
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .gradient(LinearGradient::horizontal(Color::RED, Color::BLUE))
            .when_hovered(|s| s.lighter(0.1).alpha(0.5)),
    );
    h.fit(500.0, 500.0);
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::BLUE)));

    h.send(Event::mouse_move(25.0, 10.0));
    assert_eq!(
        gradient_ends(&h.paint()),
        Some((
            Color::RED.lighter(0.1).with_alpha(0.5),
            Color::BLUE.lighter(0.1).with_alpha(0.5)
        )),
        "the hover resolved an override and the gradient drew its own colours"
    );

    h.send(Event::mouse_move(300.0, 10.0));
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::BLUE)));
}

/// An exact background is a fill of its own, so while it is active it replaces
/// the gradient rather than tinting it.
#[test]
fn an_exact_background_on_hover_replaces_a_gradient() {
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .gradient(LinearGradient::horizontal(Color::RED, Color::BLUE))
            .when_hovered(|s| s.background(Color::GREEN)),
    );
    h.fit(500.0, 500.0);

    h.send(Event::mouse_move(25.0, 10.0));
    let node = h.paint();
    assert_eq!(gradient_ends(&node), None, "the gradient gives way");
    assert!(
        rects(&node)
            .iter()
            .any(|(_, colour)| *colour == Color::GREEN),
        "to the colour the hover declared, got {:?}",
        rects(&node)
    );
}

/// An exact background that is not a number is passed over on a gradient as it
/// is on a solid fill, rather than removing the gradient for nothing.
#[test]
fn a_non_finite_exact_background_leaves_the_gradient() {
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .gradient(LinearGradient::horizontal(Color::RED, Color::BLUE))
            .when_hovered(|s| s.background(Color::rgb(f32::NAN, 0.0, 0.0))),
    );
    h.fit(500.0, 500.0);

    h.send(Event::mouse_move(25.0, 10.0));
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::BLUE)));
}

/// `overflow` decides both whether children are clipped and whether the box may
/// shrink below its content, so a write to it has to reach layout as well as
/// paint.
#[test]
fn overflow_is_reactive_and_invalidates_layout() {
    let clipped = create_signal(false);
    let mut h = H::new(
        container()
            .width(50.0)
            .height(20.0)
            .overflow(move || {
                if clipped.get() {
                    Overflow::Hidden
                } else {
                    Overflow::Visible
                }
            })
            .child(box_of(400.0, 10.0)),
    );
    h.fit(500.0, 500.0);
    assert!(h.paint().clip.is_none());

    let queued = h.jobs_from(|| clipped.set(true));
    assert!(
        queued.contains(&JobType::Layout) && queued.contains(&JobType::Paint),
        "got {queued:?}"
    );
    h.fit(500.0, 500.0);
    assert!(h.paint().clip.is_some());
}

/// A blur can be switched off by the same signal that switches it on: a radius
/// of zero draws no blur command, which is the contract `Text` already had.
#[test]
fn a_backdrop_blur_is_reactive_and_zero_means_off() {
    let radius = create_signal(0.0f32);
    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .backdrop_blur(move || radius.get()),
    );
    h.fit(100.0, 100.0);
    assert_eq!(blur_radii(&h.paint()), Vec::<f32>::new());

    let queued = h.jobs_from(|| radius.set(12.0));
    assert_eq!(queued, vec![JobType::Paint], "got {queued:?}");
    assert_eq!(blur_radii(&h.paint()), vec![12.0]);

    radius.set(0.0);
    assert_eq!(blur_radii(&h.paint()), Vec::<f32>::new());
}

/// A state layer replaces the whole border, both halves at once, because that is
/// the only way to say "border" anywhere in this API.
#[test]
fn a_state_layer_replaces_the_whole_border() {
    let danger = create_signal(false);
    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .border(1.0, Color::GRAY)
            .state(danger, |s| s.border(2.0, Color::RED)),
    );
    h.fit(100.0, 100.0);
    assert_eq!(borders(&h.paint()), vec![(1.0, Color::GRAY)]);

    danger.set(true);
    assert_eq!(borders(&h.paint()), vec![(2.0, Color::RED)]);

    danger.set(false);
    assert_eq!(borders(&h.paint()), vec![(1.0, Color::GRAY)], "and back");
}

/// Two layers speaking about the border resolve last-declared-wins, as every
/// other property does — and as a unit, since half of one cannot be declared.
#[test]
fn the_last_declared_border_layer_wins() {
    let hovered = create_signal(true);
    let failed = create_signal(true);
    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .border(1.0, Color::GRAY)
            .state(hovered, |s| s.border(2.0, Color::WHITE))
            .state(failed, |s| s.border(3.0, Color::RED)),
    );
    h.fit(100.0, 100.0);
    assert_eq!(borders(&h.paint()), vec![(3.0, Color::RED)]);

    failed.set(false);
    assert_eq!(borders(&h.paint()), vec![(2.0, Color::WHITE)]);
}

/// A shadow transitions like every other paint property, instead of jumping.
#[test]
fn a_shadow_animates_towards_its_state_layer() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(Shadow::none().transition(Transition::new(80.0, TimingFunction::Linear)))
            .when_hovered(|s| s.shadow(LIFTED)),
    );
    h.fit(100.0, 100.0);
    h.paint();

    assert!(
        drawn_shadow(&h.paint()).is_none(),
        "flat on the surface at rest"
    );

    set_hover(&mut h, true);
    // Two frames: the first starts the animation, the second is far enough up
    // the ramp for the shadow to be worth drawing — the very first values are
    // below the alpha floor by design, since a shadow nobody can see is a rect
    // drawn for nothing.
    for _ in 0..2 {
        std::thread::sleep(std::time::Duration::from_millis(20));
        pump(&mut h);
        h.fit(100.0, 100.0);
        h.paint();
    }
    assert!(
        drawn_shadow(&h.paint()).is_some(),
        "it casts a shadow while it rises"
    );

    settle(&mut h, 80);
    set_hover(&mut h, false);
    settle(&mut h, 80);
    assert!(drawn_shadow(&h.paint()).is_none(), "and settles back down");
}

/// Run frames until nothing is animating, or `limit` frames pass.
///
/// Animations step against the wall clock, so a tight loop would advance them
/// by microseconds and never arrive — the frames have to take real time.
fn settle(h: &mut H, limit: usize) -> usize {
    for frame in 0..limit {
        std::thread::sleep(std::time::Duration::from_millis(4));
        let animating = pump(h);
        h.fit(400.0, 400.0);
        h.paint();
        if !animating {
            return frame;
        }
    }
    limit
}

/// The four radii reach the clip, not just the paint: a row that rounds only
/// its top must cut its children there and leave them square at the bottom.
#[test]
fn the_clip_carries_every_corner() {
    let mut h = H::new(
        container()
            .width(100.0)
            .height(40.0)
            .corners([16.0, 0.0])
            .overflow(Overflow::Hidden)
            .child(container().width(100.0).height(40.0).background(Color::RED)),
    );
    let node = h.frame(200.0, 200.0).node;

    let clip = node.children[0]
        .clip
        .as_ref()
        .or(node.clip.as_ref())
        .expect("a hidden overflow clips");
    assert_eq!(clip.corner_radius.top_left, 16.0);
    assert_eq!(clip.corner_radius.top_right, 16.0);
    assert_eq!(clip.corner_radius.bottom_right, 0.0);
    assert_eq!(clip.corner_radius.bottom_left, 0.0);
}

/// A state override carries the whole shape, so a squircle that only asks to
/// grow on hover becomes an ordinary rounded box — the same trade the border
/// override makes, and the reason a bare size is spelled as one.
#[test]
fn a_state_override_replaces_the_whole_corner_shape() {
    let c = container()
        .corners(crate::widgets::Corners::squircle(12.0))
        .when_hovered(|s| s.corners(20.0));

    let hovered = c.interaction.as_ref().expect("a hover layer").states[0]
        .1
        .corners
        .get_untracked()
        .expect("which declares a shape");

    assert_eq!(hovered.curvature, 1.0, "rounded, not squircle");
    assert_eq!(hovered.radii.top_left, 20.0);
}

/// A container whose background enters from transparent, and one declared the
/// same way without an enter.
///
/// The pair is the assertion: on the frame after the first layout one is
/// mid-animation and the other is already at its declared value, and some
/// frames later they agree. Without the pair, "it is not the target yet" could
/// be any of a dozen things.
#[test]
fn a_background_with_an_enter_starts_somewhere_else_and_arrives() {
    let entering = |from: Option<Color>| {
        let value =
            Color::rgb(1.0, 0.0, 0.0).transition(Transition::new(100.0, TimingFunction::Linear));
        container().width(20.0).height(20.0).background(match from {
            Some(from) => value.entering_from(from),
            None => value,
        })
    };

    let t0 = std::time::Instant::now();

    let mut plain = H::new(entering(None));
    frame_at(&mut plain, t0, 100.0, 100.0);
    assert_eq!(
        rects(&plain.paint()).first().map(|(_, c)| *c),
        Some(Color::rgb(1.0, 0.0, 0.0)),
        "with no enter declared, the first frame is the declared value"
    );

    let mut entered = H::new(entering(Some(Color::rgba(1.0, 0.0, 0.0, 0.0))));
    frame_at(&mut entered, t0, 100.0, 100.0);

    // Halfway through a linear hundred milliseconds. The frame that seeds is
    // the frame the enter begins on, so the curve is read on the next one.
    frame_at(
        &mut entered,
        t0 + std::time::Duration::from_millis(50),
        100.0,
        100.0,
    );
    let midway = rects(&entered.paint())
        .first()
        .map(|(_, c)| *c)
        .expect("it paints");
    assert!(
        midway.a > 0.0 && midway.a < 1.0,
        "the enter is under way rather than arrived, got {midway:?}"
    );

    frame_at(
        &mut entered,
        t0 + std::time::Duration::from_millis(200),
        100.0,
        100.0,
    );
    assert_eq!(
        rects(&entered.paint()).first().map(|(_, c)| *c),
        Some(Color::rgb(1.0, 0.0, 0.0)),
        "and it arrives at the declared value"
    );
}

/// The same verb on a transform, which is the half the removed methods could
/// do — and the half the one real caller uses, a menu scaling open from
/// collapsed on its first layout.
#[test]
fn a_scale_with_an_enter_starts_collapsed() {
    let t0 = std::time::Instant::now();
    let mut h = H::new(
        container().width(20.0).height(20.0).scale(
            Scale::uniform(1.0)
                .transition(Transition::new(100.0, TimingFunction::Linear))
                .entering_from(Scale::uniform(0.0)),
        ),
    );

    frame_at(&mut h, t0, 100.0, 100.0);
    let first = h.paint().local_transform;
    assert!(
        first.a() < 1.0,
        "the box is still opening on the frame after its first layout, got {first:?}"
    );

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(200),
        100.0,
        100.0,
    );
    assert_eq!(h.paint().local_transform.a(), 1.0, "and it finishes open");
}

/// An enter is what a widget does when it appears, so it happens once. A
/// relayout is not an appearance.
#[test]
fn an_enter_is_consumed_by_the_first_layout_and_does_not_play_again() {
    let t0 = std::time::Instant::now();
    let mut h = H::new(
        container().width(20.0).height(20.0).background(
            Color::rgb(1.0, 0.0, 0.0)
                .transition(Transition::new(100.0, TimingFunction::Linear))
                .entering_from(Color::rgba(1.0, 0.0, 0.0, 0.0)),
        ),
    );

    frame_at(&mut h, t0, 100.0, 100.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(200),
        100.0,
        100.0,
    );
    assert_eq!(
        rects(&h.paint()).first().map(|(_, c)| *c),
        Some(Color::rgb(1.0, 0.0, 0.0)),
        "the enter has finished"
    );

    // A different viewport: layout runs again, and nothing about the widget
    // appearing has happened.
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(300),
        160.0,
        160.0,
    );
    assert_eq!(
        rects(&h.paint()).first().map(|(_, c)| *c),
        Some(Color::rgb(1.0, 0.0, 0.0)),
        "a relayout is not an appearance, so nothing plays a second time"
    );
}

/// A container whose width and padding both declare where they start.
///
/// Shared by the pair below, which differ in one thing — whether a measure pass
/// runs first — and must not drift apart in any other.
fn a_size_and_a_padding_entering() -> Container {
    container()
        .height(60.0)
        .width(
            120.0f32
                .transition(Transition::new(100.0, TimingFunction::Linear))
                .entering_from(0.0),
        )
        .padding(
            Padding::all(20.0)
                .transition(Transition::new(100.0, TimingFunction::Linear))
                .entering_from(Padding::all(0.0)),
        )
        .child(container().width(10.0).height(10.0))
}

/// A measure pass does not spend the appearance.
///
/// `measure_natural_size` lays a popup out once, before the surface exists, to
/// tell the compositor how big to make it. `begin_enter` declines there and says
/// why — nothing is mapped, and there is no frame instant to play against — but
/// it declines by returning the same `false` that means "nothing was declared",
/// so the seed places the value and marks it placed. The real first layout then
/// finds `is_initial()` false, never computes the target, and the enter that was
/// never taken is never played.
///
/// Which makes the popup the one surface where an enter silently does nothing,
/// and `entering_from`'s own documentation opens with a menu that scales open.
#[test]
fn a_measure_pass_leaves_the_appearance_for_the_first_real_layout() {
    let t0 = std::time::Instant::now();
    let mut h = H::new(a_size_and_a_padding_entering());

    // The measure that runs before anything is mapped, capped at the output
    // rather than asking for the size the surface is about to be told. Loose on
    // both axes here, which is the layer-surface shape; a popup's measure pins
    // the width and leaves only the height loose, and the root's constraints
    // differ from the real layout's either way.
    h.measure(Constraints::new(0.0, 0.0, 800.0, 800.0));

    frame_at(&mut h, t0, 400.0, 400.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        400.0,
        400.0,
    );

    let midway = h.tree.cached_size(h.root).unwrap().width;
    assert!(
        midway > 0.0 && midway < 120.0,
        "the width has to open from the value it enters from, as it does without \
         the measure pass, got {midway}"
    );
    let child = h.tree.get_children(h.root)[0];
    let inset = h.tree.get_origin(child).unwrap().0;
    assert!(
        inset > 0.0 && inset < 20.0,
        "and so does the padding, got {inset}"
    );
}

/// A container of exact size whose child enters, and where the child's width is
/// fifty milliseconds into its hundred, with or without a measure pass first.
fn a_child_entering_at_50ms(measure_first: bool) -> f32 {
    let t0 = std::time::Instant::now();
    let mut h = H::new(
        container().width(200.0).height(100.0).child(
            container().height(20.0).width(
                150.0f32
                    .transition(Transition::new(100.0, TimingFunction::Linear))
                    .entering_from(0.0),
            ),
        ),
    );
    if measure_first {
        // The popup shape: the width pinned, the height loose.
        h.measure(Constraints::new(200.0, 0.0, 200.0, 300.0));
    }
    frame_at(&mut h, t0, 200.0, 100.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        200.0,
        100.0,
    );
    let child = h.tree.get_children(h.root)[0];
    h.tree.cached_size(child).unwrap().width
}

#[test]
fn a_child_whose_constraints_never_change_enters_halfway_at_half_its_duration() {
    assert_eq!(a_child_entering_at_50ms(false), 75.0);
}

/// A child a measure placed without letting it appear is laid out for real
/// after the measure, even where its constraints are the same in both passes.
///
/// The root differs, measured loose and laid out tight. Its child does not: a
/// container derives the child's constraints from its own box, which an exact
/// size resolves the same in both passes, so the real layout found the
/// measure's entry and the dirty flag it had cleared, skipped the child, and
/// the enter it declared never played.
#[test]
fn a_child_a_measure_placed_is_laid_out_for_real_after_it() {
    assert_eq!(
        a_child_entering_at_50ms(true),
        75.0,
        "the child has to open from the value it enters from, as it does without \
         the measure pass"
    );
}

/// A measure reads targets even where a real layout has just cached an
/// in-flight size.
///
/// The frame lays out its layout roots before it measures. A capped height
/// hands the child the same constraints in both passes, so the measure found
/// the real layout's constraints and the dirty flag it had cleared, skipped the
/// child, and reported where the animation was rather than where it is going —
/// asking the compositor for a new size on every frame of it.
#[test]
fn a_measure_after_a_real_layout_reports_the_target_not_the_frame() {
    let t0 = std::time::Instant::now();
    let tall = create_signal(false);
    let mut h = H::new(
        container().layout(Flex::column()).child(
            container().width(100.0).height(at_most(300.0)).child(
                container().width(50.0).height(
                    (move || if tall.get() { 200.0 } else { 20.0 })
                        .transition(Transition::new(100.0, TimingFunction::Linear)),
                ),
            ),
        ),
    );
    // The loop's order: jobs, then the layout roots they queued — the capped
    // container is one — each at the constraints it last had, then the measure.
    let frame = |h: &mut H, ms: u64| {
        h.tree
            .set_frame_instant(Some(t0 + std::time::Duration::from_millis(ms)));
        let roots = h.roots();
        jobs::distribute_jobs(&h.tree, &roots);
        let drained = jobs::drain_surface_jobs(h.root);
        let mut layout_roots = Vec::new();
        jobs::process_jobs(&drained, &mut h.tree, &mut layout_roots);
        jobs::recycle_job_buffer(drained);
        let fallback = Constraints::new(400.0, 0.0, 400.0, 1000.0);
        for root in layout_roots {
            let c = h.tree.last_layout_constraints(root).unwrap_or(fallback);
            h.tree.layout_widget(root, c);
        }
        h.tree.set_frame_instant(None);
    };
    h.layout(Constraints::new(400.0, 0.0, 400.0, 1000.0));
    tall.set(true);
    for ms in [16, 32, 50] {
        frame(&mut h, ms);
    }
    let child = h.tree.get_children(h.root)[0];
    let in_flight = h.tree.cached_size(child).unwrap().height;
    assert!(
        in_flight > 20.0 && in_flight < 200.0,
        "the control: mid-animation, got {in_flight}"
    );

    let measured = h.measure(Constraints::new(400.0, 0.0, 400.0, 800.0));
    assert_eq!(measured.height, 200.0);
}

/// Where the two passes read the same values — nothing moving, nothing still
/// to appear — each answers from the other's cache.
///
/// Hiding every entry from the other pass is also correct, and costs a surface
/// that measures two full layouts on every frame with layout to do. The
/// grandchild's origin is written only by its parent's layout, so a sentinel
/// survives a pass exactly when that layout was skipped: the measure reusing
/// what the real layout left, and the real layout reusing what the measure did.
#[test]
fn a_settled_subtree_is_reused_by_a_measure_and_by_the_layout_after_it() {
    let mut h = H::new(
        container().width(200.0).height(100.0).child(
            container()
                .width(100.0)
                .height(50.0)
                .child(box_of(40.0, 20.0)),
        ),
    );
    h.fit(200.0, 100.0);
    let grandchild = h.tree.get_children(h.children()[0])[0];
    h.tree.set_origin(grandchild, 999.0, 999.0);

    h.measure(Constraints::new(200.0, 0.0, 200.0, 300.0));
    assert_eq!(
        h.tree.get_origin(grandchild).unwrap().0,
        999.0,
        "the measure laid out a subtree the real layout had left settled"
    );

    h.fit(200.0, 100.0);
    assert_eq!(
        h.tree.get_origin(grandchild).unwrap().0,
        999.0,
        "the layout after the measure laid it out again"
    );
}

/// The verb reaches the properties whose first value is placed somewhere other
/// than the seed pass — a size, which `update_size_targets` initialises, and a
/// padding, which reaches `seed_or_enter` last of the nine.
///
/// These are two of the four that accepted an enter and silently dropped it
/// while the take lived in one initialiser instead of in `AnimationState`.
/// The padding is read through the child it moves, because a padding is only
/// visible in where it puts things.
#[test]
fn an_enter_reaches_a_size_and_a_padding_too() {
    let t0 = std::time::Instant::now();
    let mut h = H::new(a_size_and_a_padding_entering());

    frame_at(&mut h, t0, 400.0, 400.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        400.0,
        400.0,
    );

    let midway = h.tree.cached_size(h.root).unwrap().width;
    assert!(
        midway > 0.0 && midway < 120.0,
        "the width is opening rather than already open, got {midway}"
    );
    let child = h.tree.get_children(h.root)[0];
    let inset = h.tree.get_origin(child).unwrap().0;
    assert!(
        inset > 0.0 && inset < 20.0,
        "the padding is opening too, got {inset}"
    );

    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(200),
        400.0,
        400.0,
    );
    assert_eq!(
        h.tree.cached_size(h.root).unwrap().width,
        120.0,
        "and the width arrives"
    );
    assert_eq!(
        h.tree.get_origin(h.tree.get_children(h.root)[0]).unwrap().0,
        20.0,
        "and so does the padding"
    );
}

/// An appearance has no direction, so it runs the forward transition whichever
/// way it travels.
///
/// `animate_to` reads the direction off the value it is leaving, and an enter
/// has just placed that value at the start of the appearance. A card settling
/// down from a larger scale therefore looked like a value decreasing, ran the
/// transition written for the *later* close, and fired its `on_complete` — the
/// callback that destroys the popup in the pattern this feature exists for.
#[test]
fn an_enter_that_shrinks_still_runs_the_forward_transition() {
    let closed = std::rc::Rc::new(std::cell::Cell::new(0u32));
    let counted = std::rc::Rc::clone(&closed);
    let t0 = std::time::Instant::now();
    let mut h = H::new(
        container().width(20.0).height(20.0).scale(
            Scale::uniform(1.0)
                .transition(
                    Transition::new(400.0, TimingFunction::Linear).reverse(
                        Transition::new(20.0, TimingFunction::Linear)
                            .on_complete(move || counted.set(counted.get() + 1)),
                    ),
                )
                .entering_from(Scale::uniform(1.4)),
        ),
    );

    frame_at(&mut h, t0, 100.0, 100.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        100.0,
        100.0,
    );
    assert_eq!(
        closed.get(),
        0,
        "the reverse transition's completion belongs to the close, not the open"
    );
    let midway = h.paint().local_transform.a();
    assert!(
        midway > 1.0,
        "and the forward curve is still running at 50ms of 400, got {midway}"
    );
}

/// An enter is written in the vocabulary every other position takes.
///
/// `IntoVal` and not `Into`: the numeric widenings guido declares with
/// `converts!(S as T)` carry no std `From`, so `Into` would accept a rotation
/// entered from `0.0f32` and refuse the same value written `0i32` — in a
/// setter that takes both.
#[test]
fn an_enter_takes_what_the_property_takes() {
    let _ = container()
        .rotate(45.0f32.transition(200.0).entering_from(0i32))
        .scale(Scale::uniform(1.0).transition(200.0).entering_from(0.0f64))
        .width(120.0f32.transition(200.0).entering_from(0u16));
}

/// A timeline already says where it starts, so an enter on one would be
/// dropped in silence. It says so instead.
#[test]
#[should_panic(expected = "a timeline already says where it starts")]
fn an_enter_on_a_timeline_refuses() {
    let plays = create_signal(0u32);
    let _ = 0.0f32
        .timeline(Keyframes::new(100.0).at(1.0, 1.0).played_by(plays))
        .entering_from(0.0);
}

// ---------------------------------------------------------------------------
// Leaving: an exit rides with the value, as an enter does
// ---------------------------------------------------------------------------

/// A 200 ms linear slide, the transition every exit below travels with.
fn slide() -> Transition {
    Transition::new(200.0, TimingFunction::Linear)
}

/// The horizontal translate `id` was painted at in `node`, one level down —
/// where a container paints its children — or `None` if it did not paint.
fn painted_x(node: &RenderNode, id: WidgetId) -> Option<f32> {
    node.children
        .iter()
        .find(|child| child.id == id.as_u64())
        .map(|child| child.local_transform.tx())
}

/// A card that slides out to `-100` when it is taken away.
fn leaving_card() -> Container {
    container().width(100.0).height(50.0).translate(
        Translate::NONE
            .transition(slide())
            .exiting_to(Translate::new(-100.0, 0.0)),
    )
}

/// The frame after `t` by `ms`.
fn after(t: std::time::Instant, ms: u64) -> std::time::Instant {
    t + std::time::Duration::from_millis(ms)
}

/// A removed child that declares an exit stays in the container, painted part
/// of the way there, until the exit settles — and then it is gone from the
/// tree, not merely from the list.
#[test]
fn a_removed_child_with_an_exit_stays_until_the_exit_settles() {
    let step = create_signal(0u32);
    let mut h = H::new(container().child(move || {
        step.get();
        leaving_card()
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let first = h.children()[0];

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(
        h.children().len(),
        2,
        "the leaving child and the new one are both there"
    );
    assert!(h.children().contains(&first));

    frame_at(&mut h, after(t0, 110), 400.0, 400.0);
    let midway = painted_x(&h.paint(), first).expect("the leaving child still paints");
    assert!(
        (midway + 50.0).abs() < 0.5,
        "half of a linear 200 ms from rest to -100 is -50, got {midway}"
    );

    frame_at(&mut h, after(t0, 210), 400.0, 400.0);
    assert_eq!(h.children().len(), 1, "the exit has settled");
    assert!(
        !h.tree.contains(first),
        "and the leaving child left the tree with it"
    );
}

/// The same child with no exit declared leaves in the pass that removed it,
/// exactly as it always has.
#[test]
fn a_removed_child_without_an_exit_is_gone_in_the_same_pass() {
    let step = create_signal(0u32);
    let mut h = H::new(container().child(move || {
        step.get();
        container()
            .width(100.0)
            .height(50.0)
            .translate(Translate::NONE.transition(slide()))
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let first = h.children()[0];

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(h.children().len(), 1);
    assert!(!h.tree.contains(first));
}

/// An exit that begins where it is going has nothing to play, for a spring as
/// for an easing: the row is gone in the pass that removed it (#691). A spring
/// that never moved used to start a segment from where it was to where it was,
/// and keep the row until that segment settled.
#[test]
fn a_spring_exit_that_begins_where_it_is_going_is_gone_in_the_same_pass() {
    let step = create_signal(0u32);
    let mut h = H::new(container().child(move || {
        step.get();
        container().width(100.0).height(50.0).translate(
            Translate::NONE
                .transition(SpringConfig::SNAPPY)
                .exiting_to(Translate::NONE),
        )
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let first = h.children()[0];

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(
        h.children().len(),
        1,
        "nothing to play, so nothing to wait for"
    );
    assert!(!h.tree.contains(first));
}

/// The direction is known when the change happens, not when the child was
/// built, so the exit is read at removal.
#[test]
fn an_exit_is_read_when_the_child_is_removed() {
    let step = create_signal(0u32);
    let direction = create_signal(1.0f32);
    let mut h = H::new(container().child(move || {
        step.get();
        container().width(100.0).height(50.0).translate(
            Translate::NONE
                .transition(slide())
                .exiting_to(move || Translate::new(direction.get() * 100.0, 0.0)),
        )
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let first = h.children()[0];

    // Built heading right; removed heading left.
    direction.set(-1.0);
    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    frame_at(&mut h, after(t0, 110), 400.0, 400.0);
    let midway = painted_x(&h.paint(), first).expect("the leaving child still paints");
    assert!(
        (midway + 50.0).abs() < 0.5,
        "the exit goes where the signal said at removal: got {midway}"
    );
}

/// A leaving child is inert: a click over it reaches the child drawn above it
/// or nothing, the focus it held goes at removal, and it cannot take it back.
#[test]
fn a_leaving_child_takes_no_pointer_and_holds_no_focus() {
    use crate::layout::ZStack;
    use crate::reactive::focus::focus_path;
    use crate::reactive::request_focus;

    let step = create_signal(0u32);
    let clicks = create_signal(Vec::<u32>::new());
    let mut h = H::new(container().layout(ZStack::new()).child(move || {
        let n = step.get();
        leaving_card()
            .background(Color::RED)
            .when_hovered(|s| s.background(Color::BLUE))
            .on_click(move || clicks.update(|c| c.push(n)))
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let first = h.children()[0];
    request_focus(&h.tree, first);
    assert!(focus_path().contains(first), "the setup needs it focused");
    h.send(Event::mouse_move(20.0, 20.0));
    let painted = |h: &mut H| {
        let node = h.paint();
        let leaving = node.children.iter().find(|c| c.id == first.as_u64());
        leaving.and_then(|c| rects(c).first().map(|(_, color)| *color))
    };
    assert_eq!(
        painted(&mut h),
        Some(Color::BLUE),
        "the setup needs it hovered"
    );

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert!(h.tree.contains(first), "it is leaving, not gone");
    assert!(
        !focus_path().contains(first),
        "the focus goes when the child is removed, not when it is disposed"
    );
    request_focus(&h.tree, first);
    assert!(
        !focus_path().contains(first),
        "and a leaving child cannot take it back"
    );
    assert_eq!(
        painted(&mut h),
        Some(Color::RED),
        "the pointer goes with the focus: it does not leave hovered"
    );

    for event in click_at(20.0, 20.0) {
        h.send(event);
    }
    assert_eq!(
        clicks.get_untracked(),
        vec![1],
        "the click belongs to the child that is arriving, not the one leaving"
    );
}

/// A child removed under the pointer hears its hover go in the pass that
/// removed it, not at the next pointer event: the leave it is sent there is
/// not part of any dispatch, so nothing else would deliver it.
#[test]
fn a_child_removed_under_the_pointer_hears_its_hover_go() {
    let step = create_signal(0u32);
    let heard = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
    let sink = heard.clone();
    let mut h = H::new(container().child(move || {
        let n = step.get();
        let sink = sink.clone();
        leaving_card().on_hover(move |hovered| sink.borrow_mut().push((n, hovered)))
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    h.send(Event::mouse_move(20.0, 20.0));
    assert_eq!(*heard.borrow(), [(0, true)], "the setup needs it hovered");

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(*heard.borrow(), [(0, true), (0, false)]);
}

/// A leaving child does not react: a signal it read, written after it was
/// removed, queues nothing for it — not even after it has painted again.
#[test]
fn a_signal_read_inside_a_leaving_child_queues_nothing_for_it() {
    let step = create_signal(0u32);
    let tint = create_signal(0.0f32);
    let mut h = H::new(container().child(move || {
        step.get();
        leaving_card().background(move || Color::rgb(tint.get(), 0.0, 0.0))
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    h.paint();
    let first = h.children()[0];
    assert!(
        jobs_for(&mut h, first, || tint.set(0.1)).contains(&JobType::Paint),
        "the control: before removal the write repaints it"
    );

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    frame_at(&mut h, after(t0, 50), 400.0, 400.0);
    h.paint();
    assert!(h.tree.contains(first), "it is leaving, and painting");
    let queued = jobs_for(&mut h, first, || tint.set(0.5));
    assert!(
        queued.is_empty(),
        "a leaving child must not be woken by what it read, got {queued:?}"
    );
}

/// The job types a write queues for one widget.
fn jobs_for(h: &mut H, id: WidgetId, write: impl FnOnce()) -> Vec<JobType> {
    h.drain_jobs();
    write();
    jobs::queued_job_types(id)
}

/// A key that comes back mid-exit gets its row back: the same widget, not
/// rebuilt, travelling home from wherever the exit had taken it.
#[test]
fn a_key_that_comes_back_mid_exit_reclaims_its_row() {
    use std::cell::Cell;

    let items = create_signal(vec![1u32, 2, 3]);
    let builds = Rc::new(Cell::new(0u32));
    let counted = builds.clone();
    let mut h = H::new(container().children(crate::widgets::keyed(
        move || items.get(),
        |k| *k,
        move |_| {
            counted.set(counted.get() + 1);
            leaving_card()
        },
    )));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let second = h.children()[1];
    assert_eq!(builds.get(), 3);

    items.set(vec![1, 3]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    frame_at(&mut h, after(t0, 110), 400.0, 400.0);
    let halfway = painted_x(&h.paint(), second).expect("leaving, and painting");
    assert!((halfway + 50.0).abs() < 0.5, "half way out, got {halfway}");

    items.set(vec![1, 2, 3]);
    frame_at(&mut h, after(t0, 110), 400.0, 400.0);
    assert!(
        h.children().contains(&second),
        "the row that was leaving is the row that came back"
    );
    assert_eq!(h.children().len(), 3, "and nothing was built beside it");
    assert_eq!(builds.get(), 3, "its builder did not run again");

    frame_at(&mut h, after(t0, 210), 400.0, 400.0);
    let returning = painted_x(&h.paint(), second).expect("back in the list");
    assert!(
        returning < -1.0 && returning > -49.0,
        "on its way home from -50, neither snapped back nor restarted: got \
         {returning}"
    );

    frame_at(&mut h, after(t0, 500), 400.0, 400.0);
    frame_at(&mut h, after(t0, 510), 400.0, 400.0);
    assert!(
        h.tree.contains(second),
        "and it is not disposed later either"
    );
    assert_eq!(painted_x(&h.paint(), second), Some(0.0), "home");
}

/// A keyed column of `leaving_card`s, or of cards with no exit for the keys
/// `still` names, laid out once. Returns the harness and each row's key by id.
fn keyed_cards(
    items: RwSignal<Vec<u32>>,
    still: &'static [u32],
    t0: std::time::Instant,
) -> (H, rustc_hash::FxHashMap<WidgetId, u32>) {
    let mut h = H::new(container().children(crate::widgets::keyed(
        move || items.get(),
        |k| *k,
        move |k| {
            if still.contains(&k) {
                container().width(100.0).height(50.0)
            } else {
                leaving_card()
            }
        },
    )));
    frame_at(&mut h, t0, 400.0, 400.0);
    let ids = h
        .children()
        .into_iter()
        .zip(items.get_untracked())
        .collect();
    (h, ids)
}

/// The rows by key, with their tops, top to bottom; a row not in `ids` is
/// `None`.
fn row_order(h: &H, ids: &rustc_hash::FxHashMap<WidgetId, u32>) -> Vec<(Option<u32>, f32)> {
    let mut rows: Vec<_> = h
        .children()
        .into_iter()
        .map(|child| {
            let key = ids.get(&child).copied();
            (key, h.tree.get_bounds(child).unwrap().y)
        })
        .collect();
    rows.sort_by(|a, b| a.1.total_cmp(&b.1));
    rows
}

/// The newest row in front and the oldest dropped, in one change: the one
/// leaving stood after 2, and plays its exit there rather than between 1 and 2.
#[test]
fn a_leaving_row_stays_after_the_rows_that_stood_before_it() {
    let items = create_signal(vec![1u32, 2, 3]);
    let t0 = std::time::Instant::now();
    let (mut h, ids) = keyed_cards(items, &[], t0);

    items.set(vec![9, 1, 2]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(
        row_order(&h, &ids),
        [
            (None, 0.0),
            (Some(1), 50.0),
            (Some(2), 100.0),
            (Some(3), 150.0)
        ],
        "9, 1, 2, then 3 leaving"
    );
}

/// A row removed ahead of a leaving one with nothing to play is gone at once,
/// and the leaving one stays ahead of the row that stood after it.
#[test]
fn a_row_removed_without_an_exit_does_not_move_a_leaving_one_past_its_neighbour() {
    let items = create_signal(vec![1u32, 2, 3]);
    let t0 = std::time::Instant::now();
    let (mut h, ids) = keyed_cards(items, &[1], t0);

    items.set(vec![3, 4]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(
        row_order(&h, &ids),
        [(Some(2), 0.0), (Some(3), 50.0), (None, 100.0)],
        "2 leaving, then 3, then 4"
    );
}

/// A reorder that leaves a row behind puts it after the nearest row that
/// stood before it and stays, wherever that row went: 3 follows 2.
#[test]
fn a_leaving_row_follows_its_nearest_predecessor_through_a_reorder() {
    let items = create_signal(vec![1u32, 2, 3]);
    let t0 = std::time::Instant::now();
    let (mut h, ids) = keyed_cards(items, &[], t0);

    items.set(vec![2, 1]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert_eq!(
        row_order(&h, &ids),
        [(Some(2), 0.0), (Some(3), 50.0), (Some(1), 100.0)],
        "2, 3 leaving, then 1"
    );
}

/// A keyed list whose rows each build an effect that counts its runs and reads
/// `watched`, and slide out when removed. Returns the harness and row 2's count.
fn rows_with_an_effect(
    items: crate::reactive::RwSignal<Vec<u32>>,
    watched: crate::reactive::RwSignal<u32>,
) -> (H, Rc<std::cell::Cell<u32>>) {
    let runs = Rc::new(std::cell::Cell::new(0u32));
    let counted = runs.clone();
    let h = H::new(container().children(crate::widgets::keyed(
        move || items.get(),
        |k| *k,
        move |k| {
            if k == 2 {
                let counted = counted.clone();
                crate::reactive::create_effect(move || {
                    watched.get();
                    counted.set(counted.get() + 1);
                });
            }
            leaving_card()
        },
    )));
    (h, runs)
}

/// A leaving row does not react, and an effect its builder made is part of it:
/// a signal the effect read, written mid-exit, does not run it.
#[test]
fn an_effect_inside_a_leaving_row_does_not_run() {
    let items = create_signal(vec![1u32, 2, 3]);
    let watched = create_signal(0u32);
    let (mut h, runs) = rows_with_an_effect(items, watched);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    watched.set(1);
    assert_eq!(runs.get(), 2, "the control: a live row's effect runs");

    items.set(vec![1, 3]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    watched.set(2);
    watched.set(3);
    frame_at(&mut h, after(t0, 60), 400.0, 400.0);
    assert_eq!(
        runs.get(),
        2,
        "an effect in a row that is leaving must not run"
    );
}

/// A row reclaimed mid-exit comes back with its effect working: what it missed
/// while it was leaving runs once, not once per write, and not never.
#[test]
fn a_reclaimed_row_runs_what_it_missed_once() {
    let items = create_signal(vec![1u32, 2, 3]);
    let watched = create_signal(0u32);
    let (mut h, runs) = rows_with_an_effect(items, watched);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    assert_eq!(runs.get(), 1);

    items.set(vec![1, 3]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    watched.set(1);
    watched.set(2);

    items.set(vec![1, 2, 3]);
    frame_at(&mut h, after(t0, 60), 400.0, 400.0);
    assert_eq!(runs.get(), 2, "the write it missed runs it once on reclaim");

    watched.set(3);
    assert_eq!(runs.get(), 3, "and it is live again afterwards");
}

/// A row reclaimed with nothing missed does not run on the way back.
#[test]
fn a_reclaimed_row_that_missed_nothing_does_not_run() {
    let items = create_signal(vec![1u32, 2, 3]);
    let watched = create_signal(0u32);
    let (mut h, runs) = rows_with_an_effect(items, watched);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);

    items.set(vec![1, 3]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    items.set(vec![1, 2, 3]);
    frame_at(&mut h, after(t0, 60), 400.0, 400.0);
    assert_eq!(runs.get(), 1);
}

/// Once the exit settles the row is disposed, and its effect with it.
#[test]
fn an_effect_inside_a_leaving_row_is_disposed_when_the_exit_settles() {
    let items = create_signal(vec![1u32, 2, 3]);
    let watched = create_signal(0u32);
    let (mut h, runs) = rows_with_an_effect(items, watched);
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let second = h.children()[1];

    items.set(vec![1, 3]);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    watched.set(1);
    frame_at(&mut h, after(t0, 220), 400.0, 400.0);
    frame_at(&mut h, after(t0, 230), 400.0, 400.0);
    assert!(!h.tree.contains(second), "the exit has settled");

    watched.set(2);
    assert_eq!(runs.get(), 1, "a disposed row's effect never runs again");
}

/// The picker that asked for this: a slide changed twice within one exit. The
/// first leaving child goes on where it was going; it is not rebuilt, and it
/// does not jump back to the centre to start again.
#[test]
fn a_slide_changed_twice_within_one_exit_leaves_the_first_where_it_was_going() {
    use crate::layout::ZStack;

    let step = create_signal(0u32);
    let mut h = H::new(container().layout(ZStack::new()).child(move || {
        step.get();
        leaving_card()
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let first = h.children()[0];

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    frame_at(&mut h, after(t0, 110), 400.0, 400.0);

    step.set(2);
    frame_at(&mut h, after(t0, 110), 400.0, 400.0);
    frame_at(&mut h, after(t0, 160), 400.0, 400.0);
    let x = painted_x(&h.paint(), first).expect("still leaving");
    assert!(
        (x + 75.0).abs() < 0.5,
        "three quarters of the way out, as if nothing had happened: got {x}"
    );
    assert_eq!(h.children().len(), 3, "two leaving, one arriving");
}

/// An exit is written in every spelling the property takes — a value, a
/// closure, a signal — including the widenings an enter takes.
#[test]
fn an_exit_takes_what_the_property_takes() {
    let angle = create_signal(0.0f32);
    let _ = container()
        .rotate(45.0f32.transition(200.0).exiting_to(0i32))
        .scale(Scale::uniform(1.0).transition(200.0).exiting_to(0.0f64))
        .width(120.0f32.transition(200.0).exiting_to(0u16))
        .corners(4.0.transition(200.0).exiting_to(move || angle.get()))
        .padding(
            Padding::all(2.0)
                .transition(200.0)
                .exiting_to(Padding::all(0.0)),
        )
        .shadow(Shadow::none().transition(200.0).exiting_to(Shadow::none()));
    let _ = container().rotate(0.0f32.transition(200.0).exiting_to(angle));
}

/// A timeline plays a sequence of its own, so an exit on one would be dropped
/// in silence. It says so instead.
#[test]
#[should_panic(expected = "a timeline plays a sequence of its own")]
fn an_exit_on_a_timeline_refuses() {
    let plays = create_signal(0u32);
    let _ = 0.0f32
        .timeline(Keyframes::new(100.0).at(1.0, 1.0).played_by(plays))
        .exiting_to(0.0);
}

/// An exit never delays anything but its own removal: the container around a
/// leaving child, taken away without an exit of its own, takes it along at
/// once.
#[test]
fn an_ancestor_taken_away_takes_a_leaving_child_with_it() {
    let outer = create_signal(true);
    let step = create_signal(0u32);
    let mut h = H::new(container().child(move || {
        outer.get().then(|| {
            container().child(move || {
                step.get();
                leaving_card()
            })
        })
    }));
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 400.0, 400.0);
    let host = h.children()[0];
    let first = h.tree.get_children(host)[0];

    step.set(1);
    frame_at(&mut h, after(t0, 10), 400.0, 400.0);
    assert!(h.tree.contains(first), "leaving");

    outer.set(false);
    frame_at(&mut h, after(t0, 20), 400.0, 400.0);
    assert!(!h.tree.contains(host));
    assert!(
        !h.tree.contains(first),
        "taken with the container it was in"
    );
}

/// Every `BackdropBlur` radius drawn by a node./// Every `BackdropBlur` radius drawn by a node.
fn blur_radii(node: &RenderNode) -> Vec<f32> {
    node.commands
        .iter()
        .filter_map(|c| match &**c {
            DrawCommand::BackdropBlur { radius, .. } => Some(*radius),
            _ => None,
        })
        .collect()
}

/// The endpoints of the first gradient drawn by a node.
fn gradient_ends(node: &RenderNode) -> Option<(Color, Color)> {
    node.commands.iter().find_map(|c| match &**c {
        DrawCommand::RoundedRect {
            gradient: Some(gradient),
            ..
        } => Some((gradient.start_color, gradient.end_color)),
        _ => None,
    })
}

/// A shadow belongs to the box, not to the fill, so a gradient must not lose
/// it. Both are reactive, so a signal can move a container from one branch of
/// the decoration to the other between frames — a shadow animation that
/// crossed into the gradient branch stopped drawing while still asking for a
/// frame at every step.
#[test]
fn a_gradient_keeps_its_shadow() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(20.0)
            .shadow(LOW)
            .gradient(LinearGradient::horizontal(Color::RED, Color::BLUE)),
    );
    h.fit(100.0, 100.0);
    let node = h.paint();

    assert_eq!(gradient_ends(&node), Some((Color::RED, Color::BLUE)));
    assert!(
        drawn_shadow(&node).is_some(),
        "the gradient still casts its shadow"
    );
}

/// A border resolving to nothing visible must draw nothing, rather than send an
/// invisible frame to the instance buffer every frame.
///
/// Every border names both halves, so this is only reachable deliberately — a
/// transparent colour, a zero width — or in passing, while an animated colour
/// crosses transparent.
#[test]
fn a_border_with_nothing_to_show_draws_nothing() {
    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .border(2.0, Color::TRANSPARENT),
    );
    h.fit(100.0, 100.0);
    assert_eq!(borders(&h.paint()), Vec::new(), "an invisible colour");

    let mut h = H::new(container().width(20.0).height(20.0).border(0.0, Color::RED));
    h.fit(100.0, 100.0);
    assert_eq!(borders(&h.paint()), Vec::new(), "a zero width");
}

/// A colour fading in behind a declared width has to start drawing the moment it
/// is visible, so the gate cannot be a build-time decision.
#[test]
fn a_border_appears_when_its_colour_does() {
    let visible = create_signal(false);
    let mut h = H::new(container().width(20.0).height(20.0).border(2.0, move || {
        if visible.get() {
            Color::RED
        } else {
            Color::TRANSPARENT
        }
    }));
    h.fit(100.0, 100.0);
    assert_eq!(borders(&h.paint()), Vec::new());

    visible.set(true);
    assert_eq!(borders(&h.paint()), vec![(2.0, Color::RED)]);
}

/// A clipped child is invisible, and an invisible child must not answer for a
/// click landing outside its parent's bounds.
///
/// Content overflows by *summing*: each child answers to the parent's maximum,
/// their row does not. So the second pill sits beyond the parent's right edge.
fn clip_host(clipped: Signal<bool>, clicked: RwSignal<i32>) -> Container {
    container()
        .width(40.0)
        .height(20.0)
        .layout(Flex::row())
        .overflow(move || {
            if clipped.get() {
                Overflow::Hidden
            } else {
                Overflow::Visible
            }
        })
        .child(box_of(40.0, 20.0))
        .child(
            container()
                .width(40.0)
                .height(20.0)
                .on_click(move || clicked.update(|c| *c += 1)),
        )
}

#[test]
fn hidden_overflow_stops_events_reaching_a_clipped_child() {
    let clicked = create_signal(0);
    let clipped = create_signal(true);
    let mut h = H::new(clip_host(clipped.into(), clicked));
    h.fit(500.0, 500.0);
    h.paint();

    // x = 60 is inside the second pill and outside the clipping parent.
    for event in click_at(60.0, 10.0) {
        h.send(event);
    }
    assert_eq!(clicked.get_untracked(), 0, "clipped away, so not clickable");

    clipped.set(false);
    pump(&mut h);
    h.fit(500.0, 500.0);
    h.paint();

    for event in click_at(60.0, 10.0) {
        h.send(event);
    }
    assert_eq!(clicked.get_untracked(), 1, "unclipped, so clickable");
}

/// Events resolve against the frame on screen, not against the frame about to
/// be drawn: the pointer is aimed at what the user can see. `hit.bounds` already
/// come from the last layout, and the clip has to agree with them — which is
/// also why the event path reads a cached value rather than running the
/// container's own closure once per container per coalesced MouseMove.
#[test]
fn events_use_the_clip_of_the_frame_on_screen() {
    let clicked = create_signal(0);
    let clipped = create_signal(false);
    let mut h = H::new(clip_host(clipped.into(), clicked));
    h.fit(500.0, 500.0);
    h.paint();

    // The signal flips, but nothing has been laid out or drawn since.
    clipped.set(true);
    for event in click_at(60.0, 10.0) {
        h.send(event);
    }
    assert_eq!(
        clicked.get_untracked(),
        1,
        "the pill the user can see is still clickable"
    );

    // Once the clip is on screen, it applies.
    pump(&mut h);
    h.fit(500.0, 500.0);
    h.paint();
    for event in click_at(60.0, 10.0) {
        h.send(event);
    }
    assert_eq!(clicked.get_untracked(), 1);
}

/// A shadow falls outside the box that casts it, so the damage a container
/// reports has to reach past its own bounds — and it has to reach far enough for
/// the *largest* shadow it can cast, not the one showing.
///
/// A shadow animates paint-only, so a hover that lifts a card never re-runs the
/// layout that records the reach. Sized to the resting value, the shadow ring
/// falls outside every damage rect: absent on the way up, left on screen on the
/// way down.
#[test]
fn the_damage_reach_covers_the_shadow_a_hover_can_reach() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(Shadow::none().transition(Transition::new(80.0, TimingFunction::Linear)))
            .when_hovered(|s| s.shadow(LIFTED)),
    );
    h.fit(100.0, 100.0);

    let reach = h.tree.paint_overflow(h.root);
    let lifted = LIFTED.extent();
    assert!(
        reach >= lifted && lifted > 0.0,
        "reach {reach} must cover the hovered shadow {lifted}"
    );

    // And a container that can never lift pays nothing for it.
    let mut flat = H::new(container().width(40.0).height(40.0).background(Color::RED));
    flat.fit(100.0, 100.0);
    assert_eq!(flat.tree.paint_overflow(flat.root), 0.0);
}

/// A transform nobody can compute reaches nowhere, rather than reaching NaN.
///
/// `max_transform_reach` is the one caller of the *quiet* half of `FiniteOr`,
/// quiet because the paint beside it already reports the same bad number and
/// saying it twice would name one mistake two ways.
///
/// This pins the answer, and it does not pin the coercion that produces it:
/// defeat `get_finite_or_quietly` and this still passes, because every step
/// between here and there is an `f32::max`, and `f32::max` returns the other
/// operand when one is NaN. The bad number is absorbed twice over. So the
/// coercion on this path is belt to the downstream braces rather than the only
/// thing holding it up — which is worth knowing, because a mutation run
/// reports that guard as unwatched and it is closer to unwatchable.
#[test]
fn a_transform_that_is_not_a_number_reaches_nowhere() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .translate((f32::NAN, f32::NAN)),
    );
    h.fit(200.0, 200.0);

    let reach = h.tree.paint_overflow(h.root);
    assert!(
        reach.is_finite(),
        "a translate nobody can compute put {reach} in the damage rect"
    );
    assert_eq!(reach, 0.0, "and it is coerced away, not merely made finite");
}

/// A state layer that declares *one* of the three transforms still counts
/// towards the reach.
///
/// `max_transform_reach` skips a layer that moves nothing, and the skip is
/// three `is_set` checks joined by `&&`. Every existing reach test declares a
/// shadow or nothing at all, so dropping any one of those negations passed
/// unnoticed: a layer declaring only a translate would be skipped, and the
/// damage rect would stop one hover short of where the container goes.
///
/// One layer per transform, because the three are separate terms and a test
/// that declared all three would survive two of the three mutations.
#[test]
fn a_layer_declaring_one_transform_alone_still_counts_towards_the_reach() {
    let reach_of = |decorate: fn(StateStyle) -> StateStyle| {
        let mut h = H::new(
            container()
                .width(40.0)
                .height(40.0)
                .background(Color::RED)
                .when_hovered(decorate),
        );
        h.fit(200.0, 200.0);
        h.tree.paint_overflow(h.root)
    };

    assert!(
        reach_of(|s| s.translate(Translate::new(30.0, 0.0))) > 0.0,
        "a layer that only translates still moves the box"
    );
    assert!(
        reach_of(|s| s.rotate(45.0)) > 0.0,
        "a layer that only rotates still sweeps the corners out"
    );
    assert!(
        reach_of(|s| s.scale(Scale::uniform(2.0))) > 0.0,
        "a layer that only scales still grows the box"
    );

    // And the skip itself is real: a layer that moves nothing pays nothing.
    assert_eq!(
        reach_of(|s| s.background(Color::BLUE)),
        0.0,
        "a layer that only recolours reaches no further than the box"
    );
}

/// A spring goes past its target on purpose, so a reach measured from the target
/// leaves the shadow ring outside the damage rect exactly at the peak — the same
/// artefact the reach exists to prevent, moved to the moment it is most visible.
#[test]
fn the_damage_reach_allows_for_a_spring_overshooting() {
    let bouncy = |transition: Transition| {
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(Shadow::none().transition(transition))
            .when_hovered(|s| s.shadow(LIFTED))
    };

    let mut eased = H::new(bouncy(Transition::new(80.0, TimingFunction::Linear)));
    eased.fit(100.0, 100.0);
    let without_bounce = eased.tree.paint_overflow(eased.root);

    let mut sprung = H::new(bouncy(Transition::spring(SpringConfig::BOUNCY)));
    sprung.fit(100.0, 100.0);
    let with_bounce = sprung.tree.paint_overflow(sprung.root);

    assert!(
        with_bounce > without_bounce,
        "a bouncy spring has to reach further than an ease: {with_bounce} vs {without_bounce}"
    );
    assert!(
        with_bounce >= LIFTED.extent() * 1.17 - 0.01,
        "and far enough for BOUNCY's ~17%, got {with_bounce}"
    );
}

/// One of the five numbers `Shadow::lerp` moves, named so a failure says which.
type ShadowChannel = (&'static str, fn(&Shadow) -> f32);

/// Three shadows to test with, standing where the elevation table's levels 8, 3
/// and 0.001 used to stand: one deep enough to reach well past its box, one
/// shallow, and one whose alpha is under the floor paint gates on.
const LIFTED: Shadow = Shadow::new((0.0, 6.0), 10.0, 0.0, Color::rgba(0.0, 0.0, 0.0, 0.22));
const LOW: Shadow = Shadow::new((0.0, 2.0), 4.0, 0.0, Color::rgba(0.0, 0.0, 0.0, 0.16));
const FAINT: Shadow = Shadow::new((0.0, 1.0), 3.0, 0.0, Color::rgba(0.0, 0.0, 0.0, 0.001));

/// The shadow this node draws — `None` where the box casts none.
fn drawn_shadow(node: &RenderNode) -> Option<Shadow> {
    node.commands.iter().find_map(|c| match &**c {
        DrawCommand::RoundedRect {
            shadow: Some(shadow),
            ..
        } => Some(*shadow),
        _ => None,
    })
}

/// Every shadow in the tree, in paint order — one per box that casts one.
fn shadows_in(node: &RenderNode) -> Vec<Shadow> {
    let mut found = drawn_shadow(node).into_iter().collect::<Vec<_>>();
    for child in &node.children {
        found.extend(shadows_in(child));
    }
    found
}

/// The four fields of `Shadow` are four degrees of freedom, and the API has to
/// reach all four.
///
/// `elevation` reached one. It funnelled a single `f32` through a table that
/// always wrote `(0.0, offset_y)`, the blur that level was paired with, a spread
/// of `0.0` and black at the alpha the table chose — so a shadow thrown
/// sideways, a coloured one, or any spread at all was something the renderer
/// could draw and the API could not ask for.
#[test]
fn every_field_of_a_shadow_reaches_the_renderer() {
    let declared = Shadow::new((12.0, -4.0), 8.0, 3.0, Color::rgba(1.0, 0.0, 0.0, 0.5));
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(declared),
    );
    h.fit(100.0, 100.0);

    let painted = drawn_shadow(&h.paint()).expect("a container with a shadow casts one");
    assert_eq!(painted.offset, (12.0, -4.0), "sideways, and upward");
    assert_eq!(painted.blur, 8.0);
    assert_eq!(
        painted.spread, 3.0,
        "the field the table always left at zero"
    );
    assert_eq!(painted.color, Color::rgba(1.0, 0.0, 0.0, 0.5), "not black");
}

/// The motion rides with the declaration here like everywhere else: a shadow
/// declared with a transition eases towards its new value, and the same shadow
/// declared without one arrives on the next paint.
///
/// Both containers in one tree, reading one signal. Two `Tree`s would number
/// their widgets from zero apiece and the job queue is keyed by id, so one
/// container's animation frame would be delivered to the other.
///
/// The *animated* one is the root, and it has to be. A fixed-size container is
/// a relayout boundary, so a Layout job on one does not bubble — it makes that
/// container a layout root, and `pump` throws the layout roots away where the
/// real loop lays out from them. A nested animated container would therefore
/// keep the reach its first layout recorded, and `animated_shadow` clamps to
/// that reach: the easing shadow would be scaled down to the resting one and
/// read as never having moved. The container that declares no motion is not
/// clamped at all, so a stale reach cannot reach it.
///
/// On a ramp no loaded runner can finish, because the claim is about what is
/// drawn *while* it eases: with a short one a slow machine would arrive between
/// two sleeps and read the correct arrival as a failure to animate. That it
/// arrives at all is `a_shadow_animates_towards_its_state_layer`'s claim.
#[test]
fn a_declared_shadow_eases_only_where_the_declaration_carries_a_motion() {
    let lifted = create_signal(false);
    // Every channel differs, and the horizontal offset differs in *sign*: a
    // `lerp` that dropped a channel would carry it through unchanged, and with
    // endpoints that agree on it nothing would notice. Three of the five used
    // to survive exactly that mutation — including the sideways offset and the
    // spread, which are two of the three degrees of freedom this API exists to
    // reach.
    let flat = Shadow::new((6.0, 2.0), 4.0, 0.0, Color::rgba(0.0, 0.0, 0.0, 0.4));
    let deep = Shadow::new((-10.0, 12.0), 24.0, 6.0, Color::rgba(0.0, 0.0, 0.0, 0.55));
    let pick = move || if lifted.get() { deep } else { flat };

    let mut h = H::new(
        container()
            .width(120.0)
            .height(120.0)
            .background(Color::RED)
            .shadow(pick.transition(Transition::new(60_000.0, TimingFunction::Linear)))
            .child(
                container()
                    .width(40.0)
                    .height(40.0)
                    .background(Color::BLUE)
                    .shadow(pick),
            ),
    );
    h.fit(200.0, 200.0);
    h.paint();
    assert_eq!(shadows_in(&h.paint()), vec![flat, flat], "both at rest");

    lifted.set(true);
    h.fit(200.0, 200.0);
    assert_eq!(
        shadows_in(&h.paint())[1],
        deep,
        "no motion declared, so it is simply there"
    );

    // The frame after the write starts the animation and is still at the old
    // value, so it says nothing either way and is not sampled.
    std::thread::sleep(std::time::Duration::from_millis(20));
    pump(&mut h);
    h.fit(200.0, 200.0);
    h.paint();

    // Two samples after that rather than one: a single reading says only that
    // it left, and what is claimed is that it is *easing* — between the two
    // shadows on one frame, and further along on the next.
    let mut seen = Vec::new();
    for _ in 0..2 {
        std::thread::sleep(std::time::Duration::from_millis(20));
        pump(&mut h);
        h.fit(200.0, 200.0);
        seen.push(shadows_in(&h.paint())[0]);
    }

    // Every channel, not the blur alone. Each has to have left its resting
    // value, be short of its target, and be further along on the second sample
    // than the first — whichever direction it is travelling in, since the
    // horizontal offset here is going the other way.
    let channels: [ShadowChannel; 5] = [
        ("offset.x", |s| s.offset.0),
        ("offset.y", |s| s.offset.1),
        ("blur", |s| s.blur),
        ("spread", |s| s.spread),
        ("alpha", |s| s.color.a),
    ];
    for (name, read) in channels {
        let (from, to) = (read(&flat), read(&deep));
        let (first, second) = (read(&seen[0]), read(&seen[1]));
        let moving = if to > from {
            from < first && first < second && second < to
        } else {
            from > first && first > second && second > to
        };
        assert!(
            moving,
            "{name} has to be on its way from {from} to {to} and still moving, \
             got {first} then {second}"
        );
    }
    assert_eq!(
        shadows_in(&h.paint())[1],
        deep,
        "and the one beside it has been there all along"
    );
}

/// A `.shadow(signal)` that falls has to *animate* down. It used to rise
/// animated and drop in one frame.
///
/// The reach the layout records is also the ceiling paint clamps to, and the
/// ceiling was recomputed at paint time from the declarations — which by then
/// say nothing, while the shadow on screen is still deep. Every frame of the
/// descent drew a shadow clamped to nothing, for an animation that went
/// on running and asking for frames.
///
/// The descent runs on a ramp no loaded runner can reach the end of, because the
/// claim is about what is drawn *while* it falls: with a short ramp, a slow
/// machine would finish the fall between two sleeps and the test would read the
/// correct absence of a shadow as the bug. Arrival is checked separately, by
/// settling rather than by a clock.
#[test]
fn a_falling_shadow_animates_down_instead_of_snapping() {
    let falling = |ramp_ms: f32| {
        let declared = create_signal(LIFTED);
        let h = H::new(
            container()
                .width(40.0)
                .height(40.0)
                .background(Color::RED)
                .shadow(
                    (move || declared.get())
                        .transition(Transition::new(ramp_ms, TimingFunction::Linear)),
                ),
        );
        (h, declared)
    };

    let (mut h, declared) = falling(60_000.0);
    h.fit(100.0, 100.0);
    assert!(
        drawn_shadow(&h.paint()).is_some(),
        "a lifted card casts a shadow"
    );

    declared.set(Shadow::none());
    for step in 0..5 {
        std::thread::sleep(std::time::Duration::from_millis(4));
        pump(&mut h);
        h.fit(100.0, 100.0);
        assert!(
            drawn_shadow(&h.paint()).is_some(),
            "frame {step} of the descent drew no shadow at all"
        );
    }

    // And it does arrive, on a ramp it can finish.
    let (mut h, declared) = falling(60.0);
    h.fit(100.0, 100.0);
    h.paint();
    declared.set(Shadow::none());
    pump(&mut h);
    settle(&mut h, 200);
    assert!(drawn_shadow(&h.paint()).is_none(), "and settles flat");
}

/// A shadow that goes flat damages the ring it gave up, whichever line gets
/// there first.
///
/// A shrinking reach vacates a ring that a rect built from the *new* reach
/// stops short of. Two separate things cover it here, and the point of this
/// test is that it does not care which:
///
/// - the layout entry point caches the size before it publishes the reach, so
///   the mark happens while the old reach is still standing.
/// - `Tree::set_own_paint_reach` damages the ring itself when the reach shrinks.
///
/// So this is not what proves that fix — a shadow never takes the path the fix
/// was written for, which is the Paint job (`refresh_paint_bounds` shrinks the
/// reach, `mark_needs_paint` follows), and that is watched at the `Tree` level.
/// What this says is that the *outcome* holds for a real shadow on a real
/// container, and keeps holding if either of the two ever goes away: swap
/// the two lines in `layout` and the setter still covers it, take the setter's
/// damage out and the order still does.
#[test]
fn a_shadow_going_flat_damages_the_ring_it_gave_up() {
    let declared = create_signal(LIFTED);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(move || declared.get()),
    );
    h.fit(100.0, 100.0);
    h.paint();

    let lifted = h.tree.paint_overflow(h.root);
    assert!(lifted > 0.0, "a lifted card has to reach past its box");
    let ring = h.tree.get_bounds(h.root).expect("laid out").outset(lifted);
    let _ = h.tree.take_damage(h.root);

    declared.set(Shadow::none());
    pump(&mut h);
    h.fit(100.0, 100.0);
    assert_eq!(
        h.tree.paint_overflow(h.root),
        0.0,
        "the shadow is what this frame gives up"
    );

    match h.tree.take_damage(h.root) {
        crate::tree::DamageRegion::Partial(rect) => assert_eq!(
            ring.outset_beyond(rect),
            0.0,
            "the frame that flattens the shadow damages {rect:?}, so the ring \
             it cast at {ring:?} is left on screen"
        ),
        other => panic!("expected partial damage, got {other:?}"),
    }
}

/// The clamp the descent above must not trip is still doing its job.
///
/// A spring keeps its momentum across a retarget, so hover flicker pumps it:
/// driven near its damped natural frequency it settles at the resonant gain,
/// which for a lightly damped spring is several times the step response the
/// reach is measured from. Whatever it reaches, it is not allowed to draw
/// outside the rect the layout reserved — that ring would be composited nowhere
/// and left on screen.
#[test]
fn hover_flicker_cannot_push_a_shadow_outside_its_damage_rect() {
    // Lightly damped (zeta = 0.1, resonant gain ~3.7x) and fast, so the pumping
    // shows up within a test's worth of frames.
    let pumpable = SpringConfig {
        mass: 1.0,
        stiffness: 3600.0,
        damping: 12.0,
    };
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(Shadow::none().transition(Transition::spring(pumpable)))
            .when_hovered(|s| s.shadow(LOW)),
    );
    h.fit(100.0, 100.0);
    h.paint();

    let reach = h.tree.paint_overflow(h.root);
    let mut inside = false;
    let mut worst: f32 = 0.0;
    // Flipped by the clock, not by a frame count: pumping means reversing every
    // half period (~53ms here), and a frame is only worth ~8ms of it.
    let mut last_flip = std::time::Instant::now();
    for step in 0..120 {
        if last_flip.elapsed() >= std::time::Duration::from_millis(52) {
            inside = !inside;
            set_hover(&mut h, inside);
            last_flip = std::time::Instant::now();
        }
        std::thread::sleep(std::time::Duration::from_millis(4));
        pump(&mut h);
        h.fit(100.0, 100.0);
        let node = h.paint();
        if let Some(extent) = drawn_shadow(&node).map(|s| s.extent()) {
            worst = worst.max(extent);
            assert!(
                extent <= reach + 0.01,
                "step {step} drew a shadow reaching {extent} outside a damage rect of {reach}"
            );
        }
    }
    assert!(worst > 0.0, "the flicker has to actually raise a shadow");
}

/// A spring between two shadows pulled inside the box is drawn as the spring
/// moves it, never rescaled by the clamp.
///
/// Both declarations reach nothing past the box, so the reach measured from
/// them is zero — but the spring's overshoot carries the shadow past the edge,
/// and clamped to a reach of zero it collapsed onto the box instead. The blur
/// is the same in both, so any frame drawn with another blur was scaled.
#[test]
fn a_spring_between_pulled_in_shadows_is_never_rescaled() {
    let deep_inside = Shadow::new((0.0, 0.0), 2.0, -20.0, Color::BLACK);
    let near_edge = Shadow::new((0.0, 0.0), 2.0, -4.2, Color::BLACK);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(deep_inside.transition(Transition::spring(SpringConfig::BOUNCY)))
            .when_hovered(|s| s.shadow(near_edge)),
    );
    h.fit(100.0, 100.0);
    h.paint();

    set_hover(&mut h, true);
    // The headroom is the step the spring travels, times its overshoot: no
    // more, or every frame of the bounce damages a ring nothing is drawn in.
    let step_travelled = near_edge.signed_extent() - deep_inside.signed_extent();
    let headroom =
        near_edge.signed_extent() + step_travelled * SpringConfig::BOUNCY.peak_overshoot();
    let t0 = std::time::Instant::now();
    let mut furthest = f32::NEG_INFINITY;
    for step in 1..=60 {
        frame_at(
            &mut h,
            t0 + std::time::Duration::from_millis(5 * step),
            100.0,
            100.0,
        );
        let reach = h.tree.paint_overflow(h.root);
        assert!(
            reach <= headroom + 0.05,
            "step {step} reserved {reach} past the box, the bounce reaches {headroom}"
        );
        let node = h.paint();
        let Some(drawn) = drawn_shadow(&node) else {
            continue;
        };
        furthest = furthest.max(drawn.spread);
        assert!(
            (drawn.blur - 2.0).abs() < 1e-3,
            "step {step} drew {drawn:?}, scaled away from the declared blur of 2"
        );
        assert!(
            drawn.extent() <= reach + 0.01,
            "step {step} drew a shadow reaching {} outside a damage rect of {reach}",
            drawn.extent()
        );
    }
    assert!(
        furthest > -4.0,
        "the spring has to carry the shadow past the edge, got a spread of {furthest}"
    );
}

/// The same for a timeline between two pulled-in shadows: its stops reach
/// nothing past the box, and an easing that overshoots carries the shadow past
/// the edge between them.
#[test]
fn a_timeline_between_pulled_in_shadows_is_never_rescaled() {
    let plays = create_signal(0u32);
    let deep_inside = Shadow::new((0.0, 0.0), 2.0, -20.0, Color::BLACK);
    let near_edge = Shadow::new((0.0, 0.0), 2.0, -4.2, Color::BLACK);
    let overshooting = TimingFunction::CubicBezier(0.5, -0.6, 0.5, 1.2);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(
                deep_inside.timeline(
                    Keyframes::new(200.0)
                        .at_with(0.0, deep_inside, overshooting.clone())
                        .at(1.0, near_edge)
                        .played_by(plays),
                ),
            ),
    );
    let t0 = std::time::Instant::now();
    frame_at(&mut h, t0, 100.0, 100.0);
    h.paint();

    plays.set(1);
    let mut furthest = f32::NEG_INFINITY;
    for step in 1..=40 {
        frame_at(
            &mut h,
            t0 + std::time::Duration::from_millis(5 * step),
            100.0,
            100.0,
        );
        let reach = h.tree.paint_overflow(h.root);
        let node = h.paint();
        let Some(drawn) = drawn_shadow(&node) else {
            continue;
        };
        furthest = furthest.max(drawn.spread);
        assert!(
            (drawn.blur - 2.0).abs() < 1e-3,
            "step {step} drew {drawn:?}, scaled away from the declared blur of 2"
        );
        assert!(
            drawn.extent() <= reach + 0.01,
            "step {step} drew a shadow reaching {} outside a damage rect of {reach}",
            drawn.extent()
        );
    }
    assert!(
        furthest > -4.0,
        "the easing has to carry the shadow past the edge, got a spread of {furthest}"
    );
}

/// A shadow's reach covers what its *timeline* can reach, not only what its
/// declarations resolve to.
///
/// `animated_shadow` clamps whatever is in flight with
/// `shrunk_to(shadow_reach)`, and that reach is what `layout` recorded from
/// `max_shadow_extent`: the declared shadow, every state layer's, and the
/// overshoot a spring still has to come. A timeline's keyframes were in none
/// of it, so a sequence that grows the shadow was scaled straight back down to
/// where it started — the animation ran, `advance` moved it, and the painted
/// blur was the declared 2.0 on every frame of it (#384).
///
/// The clamp is right in itself: it is what keeps a shadow inside the rect the
/// layout reserved for damage, and
/// `hover_flicker_cannot_push_a_shadow_outside_its_damage_rect` is what holds
/// it there. What was missing is the keyframes in the reach.
///
/// `transition` was never affected — it moves the declared signal, which layout
/// tracks — which is why every shadow test here passed while this did not.
#[test]
fn a_shadow_timeline_is_drawn_at_the_depth_its_keyframes_reach() {
    let plays = create_signal(0u32);
    let deep = Shadow::new((0.0, 0.0), 20.0, 0.0, Color::BLACK);
    let shallow = Shadow::new((0.0, 0.0), 2.0, 0.0, Color::BLACK);

    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(
                shallow.timeline(
                    Keyframes::new(200.0)
                        .at(0.0, shallow)
                        .at(1.0, deep)
                        .played_by(plays),
                ),
            ),
    );
    h.fit(100.0, 100.0);
    h.paint();

    // The reach has to be reserved before the sequence is asked for: it is
    // recorded by layout, and the frames that carry the sequence are not
    // allowed to need a bigger one than the frame that reserved it.
    let reach = h.tree.paint_overflow(h.root);
    assert!(
        reach >= deep.extent() - 0.01,
        "the reach has to cover the deepest keyframe ({}), got {reach}",
        deep.extent()
    );

    plays.set(1);
    pump(&mut h);
    let mut deepest: f32 = 0.0;
    for _ in 0..40 {
        std::thread::sleep(std::time::Duration::from_millis(5));
        pump(&mut h);
        h.fit(100.0, 100.0);
        let node = h.paint();
        if let Some(extent) = drawn_shadow(&node).map(|s| s.extent()) {
            deepest = deepest.max(extent);
            assert!(
                extent <= reach + 0.01,
                "drew a shadow reaching {extent} outside a damage rect of {reach}"
            );
        }
    }
    assert!(
        deepest > shallow.extent() + 1.0,
        "the sequence has to actually deepen the shadow past the declared \
         {} it was clamped back to, got {deepest}",
        shallow.extent()
    );
}

/// A declared shadow changing does need a new reach, so it must invalidate the
/// layout that recorded the old one.
#[test]
fn a_declared_shadow_change_invalidates_the_reach() {
    let declared = create_signal(Shadow::none());
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(move || declared.get()),
    );
    h.fit(100.0, 100.0);
    h.paint();
    assert_eq!(h.tree.paint_overflow(h.root), 0.0);

    let queued = h.jobs_from(|| declared.set(LOW));
    assert!(queued.contains(&JobType::Layout), "got {queued:?}");

    // `jobs_from` consumes the jobs without running them, so the reach is
    // recomputed by a write that gets pumped.
    declared.set(LIFTED);
    pump(&mut h);
    h.fit(100.0, 100.0);
    assert!(h.tree.paint_overflow(h.root) > 0.0);
}

/// A container that clips does not report the overhang it is clipping away.
///
/// A scroller's content runs far past its viewport by design. Counting that as
/// "how far this widget paints outside itself" would damage a rect the size of
/// the whole scrolled column on every frame the scroller repaints, and widen
/// every search above it by the same. What it paints is its own box.
#[test]
fn a_clipping_container_does_not_carry_its_content_s_overhang() {
    let rows: Vec<_> = (0..20)
        .map(|_| container().width(100.0).height(50.0).background(Color::RED))
        .collect();
    let mut clipped = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .scroll(Scroll::vertical())
            .layout(Flex::column())
            .children(rows),
    );
    clipped.fit(400.0, 400.0);

    assert_eq!(
        clipped.tree.paint_overflow(clipped.root),
        0.0,
        "a scroller reported the height of everything inside it as paint that \
         lands outside its own box"
    );
}

/// And it keeps not carrying it, after a descendant moves.
///
/// The clear at layout is one write; the gather that runs whenever any
/// descendant's reach changes writes the same field. A row with an animating
/// transform does that every frame, so a scroller that only forgot the overhang
/// once would have it back on the next one — with its damage rect and every
/// search above it sized to the whole scrolled column.
#[test]
fn a_clipping_container_keeps_not_carrying_it_when_a_child_moves() {
    let lift = create_signal(0.0f32);
    let mut rows: Vec<_> = (0..20)
        .map(|_| container().width(100.0).height(50.0).background(Color::RED))
        .collect();
    // The first row, so it is inside the viewport and therefore painted — a
    // row culled on the first frame holds no paint subscription and its own
    // write would wake nobody.
    rows[0] = container()
        .width(100.0)
        .height(50.0)
        .background(Color::BLUE)
        .translate(move || Translate::new(0.0, -lift.get()));

    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .scroll(Scroll::vertical())
            .layout(Flex::column())
            .children(rows),
    );
    h.fit(400.0, 400.0);
    // Painted, so the row holds the paint subscription its own write needs.
    h.paint();
    assert_eq!(h.tree.paint_overflow(h.root), 0.0);

    // A frame of an animating row, with no layout in between.
    lift.set(20.0);
    pump(&mut h);

    assert_eq!(
        h.tree.paint_overflow(h.root),
        0.0,
        "one row moved and the scroller went back to claiming it paints the \
         whole column outside its own box"
    );
}

/// A 40x40 box carried off its laid-out place by `lift` — the smallest thing
/// whose paint leaves its bounds without anything laying out.
fn lifted_box(lift: RwSignal<f32>) -> Container {
    container()
        .width(40.0)
        .height(40.0)
        .background(Color::RED)
        .translate(move || Translate::new(0.0, -lift.get()))
}

/// The transform's twin, and the one that proves `refresh_paint_bounds` is
/// wired at all: the reach has to grow on a Paint job, with no layout run
/// between the write and the answer.
///
/// A shadow's reach is republished by layout, so a shadow test passes
/// whether or not the Paint-job refresh exists. A transform's is not — layout
/// never subscribes to it — so this is the only thing standing between the hook
/// in `process_jobs` and being deleted with the suite still green.
#[test]
fn a_declared_transform_change_invalidates_the_reach_without_a_layout() {
    let lift = create_signal(0.0f32);
    let mut h = H::new(lifted_box(lift));
    h.fit(100.0, 100.0);
    h.paint();
    assert_eq!(h.tree.paint_overflow(h.root), 0.0);

    lift.set(30.0);
    let queued = jobs::queued_job_types(h.root);
    assert!(
        !queued.contains(&JobType::Layout),
        "a transform asked for a layout: {queued:?}"
    );

    // No `fit` between the write and the assertion: the reach has to be current
    // from the job alone, because the parent narrows to it in the same frame
    // and nothing lays out in between.
    pump(&mut h);
    assert_eq!(
        h.tree.paint_overflow(h.root),
        30.0,
        "the reach did not follow the transform through its Paint job"
    );
}

/// A child that is its own relayout boundary moves without its parent laying
/// out, and the reach still has to reach the parent.
///
/// This is what `gather_reach_upward` is for, and the only thing that asks for
/// it: `publish_paint_reach` gathers a container's children when *it* lays out,
/// which covers everything except the case where it does not lay out at all. A
/// transform is paint-only, so the parent never re-runs: a change to the box's
/// own size would lay it out, boundary or not (`Tree::mark_needs_layout`).
#[test]
fn a_reach_that_grows_under_a_relayout_boundary_still_reaches_the_parent() {
    let lift = create_signal(0.0f32);
    let mut h = H::new(container().layout(Flex::column()).child(lifted_box(lift)));
    h.fit(200.0, 200.0);
    h.paint();
    assert_eq!(h.tree.children_reach(h.root), 0.0);

    lift.set(70.0);
    pump(&mut h);

    assert_eq!(
        h.tree.children_reach(h.root),
        70.0,
        "the row moved under a relayout boundary and its parent never heard, so \
         the search that narrows it would drop a row that is on screen"
    );
}

/// And one that shrinks lets go again.
///
/// Growing upward can be answered by comparison — wider than the parent knows,
/// so widen it — but shrinking cannot: this child may have been the widest and
/// the new maximum is whatever the others say. Answering it by comparison alone
/// would leave a scroller widened by a transform that has long since come to
/// rest, for as long as it goes without laying out, and a window widened for
/// nothing is virtualization spent for nothing.
#[test]
fn a_reach_that_shrinks_lets_the_parent_narrow_again() {
    let lift = create_signal(70.0f32);
    let mut h = H::new(container().layout(Flex::column()).child(lifted_box(lift)));
    h.fit(200.0, 200.0);
    h.paint();
    assert_eq!(h.tree.children_reach(h.root), 70.0);

    // No `fit`: the parent must let go without laying out, because a scroller
    // that is not being resized never does.
    lift.set(0.0);
    pump(&mut h);

    assert_eq!(
        h.tree.children_reach(h.root),
        0.0,
        "the parent stayed widened by a transform that has come to rest"
    );
}

// ---------------------------------------------------------------------------
// Compositor blur regions — every one of these is about which widgets painted
// ---------------------------------------------------------------------------
//
// The surface half of a backdrop blur is a draw command in the render tree. The
// compositor half is a `wl_region` derived from the same command after
// flattening, which is what makes these tests about *painting*: a container that
// did not paint has no command, one served from the cache carries its along, and
// a frame that repaints nothing publishes from the buffer it retained.
//
// They all go through `H::frame`, which runs those phases in the loop's order
// and with the loop's own `cache_paint_results` — the two things a test of this
// cannot model loosely and still be a test.

/// Turning a blur off has to reach the compositor on the frame that turns it
/// off. While the region was collected before the paint, the frame that switched
/// it off published the *previous* frame's answer, and nothing was dirty
/// afterwards — so the withdrawal waited for a frame a settled surface never
/// renders.
#[test]
fn switching_a_compositor_blur_off_withdraws_it_on_that_frame() {
    let frosted = create_signal(true);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(20.0)
            .backdrop_blur(move || if frosted.get() { 24.0 } else { 0.0 }),
    );
    assert!(!h.frame(100.0, 100.0).blur.is_empty(), "frosted");

    frosted.set(false);
    assert_eq!(
        h.frame(100.0, 100.0).blur,
        Vec::new(),
        "the frame that turns it off is the frame that stops publishing it"
    );

    // And a settled surface keeps it off: nothing is dirty, so this frame does
    // not repaint, and the region must not come back.
    assert_eq!(h.frame(100.0, 100.0).blur, Vec::new());

    frosted.set(true);
    assert!(!h.frame(100.0, 100.0).blur.is_empty(), "and back on");
}

/// Restricting the sources to the surface publishes no compositor region at all,
/// whatever the radius — while still drawing one.
#[test]
fn a_surface_only_blur_publishes_no_compositor_region() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(20.0)
            .backdrop_blur(BackdropBlur::new(24.0).sources(BackdropSources::SURFACE)),
    );
    let frame = h.frame(100.0, 100.0);
    assert_eq!(frame.blur, Vec::new());
    assert_eq!(blur_radii(&frame.node), vec![24.0], "but it draws one");
}

/// A compositor-only blur has no radius of its own — `ext-background-effect-v1`
/// carries none, the compositor picks it — so a zero radius is not "no blur"
/// there, and the region has to be published anyway. It was the switch that
/// decided whether the command existed at all, so the one spelling the
/// documentation describes emitted nothing and the compositor blurred the whole
/// surface, or nothing, but never the container's shape.
#[test]
fn a_compositor_only_blur_is_published_without_a_radius() {
    let mut h = H::new(
        container()
            .width(40.0)
            .height(20.0)
            .backdrop_blur(BackdropBlur::new(0.0).sources(BackdropSources::COMPOSITOR)),
    );
    let frame = h.frame(100.0, 100.0);
    assert!(
        !frame.blur.is_empty(),
        "the compositor's half does not read the radius"
    );
    assert_eq!(
        blur_radii(&frame.node),
        vec![0.0],
        "and the command carries the zero, so the surface half draws nothing"
    );
}

/// And emptying the sources is the off switch for a blur that has no radius to
/// switch off — which is what the documentation on `backdrop_blur` tells a
/// caller to reach for, so it has to be true at any radius.
#[test]
fn an_emptied_source_set_asks_for_nothing_at_any_radius() {
    for radius in [0.0, 24.0] {
        let mut h = H::new(
            container()
                .width(40.0)
                .height(20.0)
                .backdrop_blur(BackdropBlur::new(radius).sources(BackdropSources::empty())),
        );
        let frame = h.frame(100.0, 100.0);
        assert_eq!(frame.blur, Vec::new(), "radius {radius} publishes nothing");
        assert_eq!(
            blur_radii(&frame.node),
            Vec::<f32>::new(),
            "radius {radius} draws nothing"
        );
    }
}

/// A hidden panel blurs nothing, and neither does anything inside it. The
/// parent's paint returns at the visibility gate before its children are
/// painted, so a blurred *descendant* never gets to withdraw its own region —
/// and layout returning zero for the parent leaves the child's own bounds
/// exactly where they were.
#[test]
fn hiding_a_panel_withdraws_the_blur_of_everything_inside_it() {
    let open = create_signal(true);
    let mut h = H::new(
        container()
            .width(60.0)
            .height(40.0)
            .visible(move || open.get())
            .child(container().width(40.0).height(20.0).backdrop_blur(24.0)),
    );
    assert!(!h.frame(100.0, 100.0).blur.is_empty(), "open");

    open.set(false);
    assert_eq!(
        h.frame(100.0, 100.0).blur,
        Vec::new(),
        "a hidden panel blurs nothing, descendants included"
    );
    assert_eq!(h.frame(100.0, 100.0).blur, Vec::new(), "and stays that way");

    open.set(true);
    assert!(!h.frame(100.0, 100.0).blur.is_empty(), "and back");
}

/// Hiding and showing a panel has to work in *both* directions, and the return
/// trip is the one that breaks: the panel repaints, but its child is clean and
/// is served from the paint cache, so the child's own paint never runs.
///
/// While the region was a registry written during paint, that meant the blur
/// went off and never came back — the withdrawal had a path and the
/// re-registration did not. Reading the region off the frame instead makes the
/// two directions one operation: a cached node carries its commands with it, so
/// it carries its blur.
#[test]
fn a_blur_served_from_the_paint_cache_is_still_published() {
    let open = create_signal(true);
    let mut h = H::new(
        container()
            .width(60.0)
            .height(40.0)
            .visible(move || open.get())
            .child(container().width(40.0).height(20.0).backdrop_blur(24.0)),
    );
    assert!(!h.frame(100.0, 100.0).blur.is_empty(), "open");

    open.set(false);
    assert_eq!(h.frame(100.0, 100.0).blur, Vec::new(), "hidden");

    // The panel is dirty and repaints; the child is not, and comes from the
    // cache without its paint running.
    open.set(true);
    assert!(
        !h.frame(100.0, 100.0).blur.is_empty(),
        "a blur that came back from the cache still has to be published"
    );

    // And it survives a frame in which nothing at all repaints.
    assert!(!h.frame(100.0, 100.0).blur.is_empty(), "and stays");
}

/// A child scrolled out of a viewport blurs nothing. It never paints — culled,
/// or outside the window the scroller even offers to `paint_children` — so it
/// cannot withdraw its own region, and its bounds stay where they were.
#[test]
fn scrolling_a_frosted_card_away_withdraws_its_blur() {
    // Enough rows that the scroller takes its windowing fast path, which is the
    // case the sweep exists for and the one a two-child list never reaches.
    let mut rows: Vec<crate::widgets::AnyWidget> = vec![
        container()
            .width(40.0)
            .height(20.0)
            .backdrop_blur(24.0)
            .into_any(),
    ];
    rows.extend((0..60).map(|_| box_of(40.0, 20.0).into_any()));

    let mut h = H::new(
        container()
            .width(40.0)
            .height(30.0)
            .scroll(Scroll::vertical())
            .children(rows),
    );
    assert!(
        !h.frame(40.0, 30.0).blur.is_empty(),
        "visible at the top of the scroll"
    );

    h.send(Event::scroll(20.0, 15.0, 0.0, 600.0, ScrollSource::Wheel));
    // Two frames: the first repaints the scroller and settles the flags, the
    // second is where a clean card is culled — or never offered at all.
    h.frame(40.0, 30.0);
    assert_eq!(
        h.frame(40.0, 30.0).blur,
        Vec::new(),
        "scrolled away, so it blurs nothing"
    );
}

/// A gradient needs a value that means "no gradient", or the rule the whole
/// branch is about — a property you can turn off with the signal that turned it
/// on — has a hole exactly where a header expands and collapses.
#[test]
fn a_gradient_can_be_switched_off_and_the_background_returns() {
    let expanded = create_signal(true);
    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .background(Color::GRAY)
            .gradient(move || {
                expanded
                    .get()
                    .then(|| LinearGradient::horizontal(Color::RED, Color::BLUE))
            }),
    );
    h.fit(100.0, 100.0);
    assert_eq!(gradient_ends(&h.paint()), Some((Color::RED, Color::BLUE)));

    expanded.set(false);
    let node = h.paint();
    assert_eq!(gradient_ends(&node), None, "no gradient");
    assert_eq!(
        rects(&node).first().map(|(_, color)| *color),
        Some(Color::GRAY),
        "and the background it was covering is drawn again"
    );
}

/// The border is gated on resolving to something visible; the shadow has to be
/// too. The opening frames of a lift out of `Shadow::none()` are at ~0.001,
/// where the shadow's alpha rounds to nothing — and without a floor each one
/// still pushed a rect carrying it, every frame, for as long as the animation
/// was leaving transparent.
#[test]
fn a_shadow_too_faint_to_see_is_not_drawn() {
    let declared = create_signal(FAINT);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .background(Color::RED)
            .shadow(move || declared.get()),
    );
    h.fit(100.0, 100.0);
    assert!(
        drawn_shadow(&h.paint()).is_none(),
        "invisible, so not drawn"
    );

    declared.set(LOW);
    h.fit(100.0, 100.0);
    assert!(
        drawn_shadow(&h.paint()).is_some(),
        "and drawn once it can be seen"
    );
}

/// The clip is part of the shape, for the region as much as for the renderer. A
/// blurred card cut off by its parent must publish only the part on show, or the
/// desktop is blurred beside a panel that is not there.
#[test]
fn a_clipped_blur_publishes_only_what_is_on_show() {
    // Content overflows by summing: each child answers to the parent's maximum,
    // their row does not. So the second card sits entirely past the clip.
    let card = || container().width(40.0).height(40.0).backdrop_blur(24.0);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .overflow(Overflow::Hidden)
            .layout(Flex::row())
            .child(card())
            .child(card()),
    );
    let frame = h.frame(200.0, 200.0);

    let widest = frame
        .blur
        .iter()
        .map(|r| r.x + r.width)
        .max()
        .expect("the visible card still blurs");
    assert!(
        widest <= 40,
        "the row is 80 wide inside a 40-wide clip, so no region may reach {widest}"
    );
}

/// The region is the shape *as drawn*, so a transform has to reach it: a scaled
/// card covers more of the desktop and a rotated one covers a diagonal.
///
/// End to end through the real paint and flatten, because the geometry is
/// derived there. The unit tests in `renderer::flatten` measure the arithmetic;
/// this is the wiring — a region built from a command's local rect instead of
/// its world one passes every one of those and still publishes a 40x40 upright
/// box for a card the compositor is showing at 80x80 turned on its corner.
#[test]
fn a_transformed_blur_publishes_the_shape_it_is_drawn_as() {
    let card = |c: Container| c.width(40.0).height(40.0).backdrop_blur(24.0);

    let plain = H::new(card(container())).frame(200.0, 200.0).blur;
    let scaled = H::new(card(container()).scale(2.0))
        .frame(200.0, 200.0)
        .blur;
    let turned = H::new(card(container()).rotate(45.0))
        .frame(200.0, 200.0)
        .blur;

    let span = |rects: &[crate::region::RegionRect]| {
        let left = rects.iter().map(|r| r.x).min().expect("a region");
        let right = rects.iter().map(|r| r.x + r.width).max().expect("a region");
        right - left
    };

    let (plain, scaled, turned) = (span(&plain), span(&scaled), span(&turned));
    assert!(
        scaled >= plain * 2 - 2,
        "twice the card is twice the region: {scaled} against {plain}"
    );
    assert!(
        turned > plain && turned < scaled,
        "turned on its corner it covers its diagonal, {turned} against {plain}"
    );
}

/// The region an island declares is the shape it is drawn as, corners and all —
/// the same thing `a_transformed_blur_publishes_the_shape_it_is_drawn_as` says
/// about the other region read off a frame, and for the same reason: both come
/// off the flattened commands, through one tessellation.
#[test]
fn an_island_declares_its_corners_and_not_its_bounding_box() {
    let takes = |x: i32, y: i32, ops: &[crate::region::InputRegionOp]| {
        ops.iter().any(|op| {
            op.takes
                && x >= op.rect.x
                && y >= op.rect.y
                && x < op.rect.x + op.rect.width
                && y < op.rect.y + op.rect.height
        })
    };

    let square = H::new(box_of(40.0, 40.0).takes_input(true))
        .frame(200.0, 200.0)
        .input;
    let round = H::new(box_of(40.0, 40.0).corners(20.0).takes_input(true))
        .frame(200.0, 200.0)
        .input;

    assert!(takes(1, 1, &square), "a square island reaches its corner");
    assert!(
        !takes(1, 1, &round),
        "and a round one does not, so the click there goes where the pixel does"
    );
    assert!(takes(20, 20, &round), "its middle is still its own");
}

/// A declaration inside a clip is cut by it, the same way
/// `a_clipped_blur_publishes_only_what_is_on_show` says the other region is:
/// input reaches what is on screen, not what a layout pass measured.
#[test]
fn a_clipped_declaration_reaches_only_what_is_on_show() {
    let island = || box_of(40.0, 40.0).takes_input(true);
    let mut h = H::new(
        container()
            .width(40.0)
            .height(40.0)
            .overflow(Overflow::Hidden)
            .layout(Flex::row())
            .child(island())
            .child(island()),
    );

    let widest = h
        .frame(200.0, 200.0)
        .input
        .iter()
        .map(|op| op.rect.x + op.rect.width)
        .max()
        .expect("the visible island still takes input");

    assert!(
        widest <= 40,
        "the row is 80 wide inside a 40-wide clip, so nothing may take input at {widest}"
    );
}

/// A gradient between two fully transparent colours draws nothing, and must not
/// push a rect per frame to do it — the same gate the fill, the border and the
/// shadow have. With both endpoints reactive, one animating out through
/// transparent reaches this every frame.
#[test]
fn a_fully_transparent_gradient_draws_nothing() {
    let clear = Color::rgba(1.0, 0.0, 0.0, 0.0);

    let mut h = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .gradient(LinearGradient::horizontal(clear, clear)),
    );
    h.fit(100.0, 100.0);
    assert_eq!(rects(&h.paint()), Vec::new(), "nothing to draw");

    // One end still visible is still a gradient.
    let mut half = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .gradient(LinearGradient::horizontal(clear, Color::BLUE)),
    );
    half.fit(100.0, 100.0);
    assert_eq!(
        gradient_ends(&half.paint()),
        Some((clear, Color::BLUE)),
        "fading to transparent is a gradient"
    );

    // And an invisible gradient does not hide the background under it.
    let mut over = H::new(
        container()
            .width(20.0)
            .height(20.0)
            .background(Color::GRAY)
            .gradient(LinearGradient::horizontal(clear, clear)),
    );
    over.fit(100.0, 100.0);
    assert_eq!(
        rects(&over.paint()).first().map(|(_, c)| *c),
        Some(Color::GRAY)
    );
}

// ---------------------------------------------------------------------------
// Enabled
// ---------------------------------------------------------------------------

/// The subtree gate, at its plainest: the handler is on the child, the
/// declaration on the parent, and the click reaches neither.
///
/// `Ignored` rather than a merely silent handler, because this disabled form
/// draws nothing: there is nothing on it to cover a sibling beneath, and the
/// container behind it is entitled to the click. One that draws answers `Hit`
/// instead, and covers what is beneath it as an enabled one does —
/// `tests/overlap_hit_order.rs` (#636).
#[test]
fn a_click_does_not_reach_a_handler_below_a_disabled_container() {
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .enabled(false)
            .child(box_of(50.0, 20.0).on_click(move || counter.set(counter.get() + 1))),
    );
    h.fit(500.0, 500.0);

    for event in click_at(5.0, 5.0) {
        assert_eq!(h.send(event), EventResponse::Ignored);
    }
    assert_eq!(clicks.get(), 0, "the handler is below a disabled container");
}

/// Disabling propagates down and a descendant cannot undo it — the rule Qt,
/// GTK and SwiftUI all settled on, asserted here so it is not re-litigated one
/// widget at a time.
///
/// Both halves, because they are two mechanisms: the click is stopped by the
/// early-out in `event`, and the inner control's *answer* is a signal folded
/// at registration. A change that kept one and lost the other would leave a
/// subtree that refuses input while styling itself as if it took it.
#[test]
fn a_descendant_declaring_itself_enabled_stays_disabled() {
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container().width(100.0).height(100.0).enabled(false).child(
            container()
                .width(80.0)
                .height(80.0)
                .enabled(true)
                .child(box_of(50.0, 20.0).on_click(move || counter.set(counter.get() + 1))),
        ),
    );
    h.fit(500.0, 500.0);

    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 0, "an ancestor said no");

    let inner = h.children()[0];
    assert!(
        h.tree
            .nearest_control(inner)
            .expect("declaring `enabled` makes a container an interaction unit")
            .is_disabled(),
        "the inner unit answers for its ancestors as well as itself"
    );
}

/// The same nesting with a *reactive* ancestor, which is the other half of the
/// fold and the half a constant pair cannot speak for.
///
/// Two constants fold to a constant and never ask again; anything else builds
/// a derived node that asks each time. That node's `&&` was the one thing in
/// `fold_enabled` nothing watched — swap it for `||` and every test still
/// passed, because no test had ever nested two units where one side was a
/// signal.
///
/// Both directions, because `&&` and `||` agree whenever the two sides do.
#[test]
fn a_reactive_ancestor_still_folds_with_a_descendants_own_answer() {
    let above = create_signal(false);
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container().width(100.0).height(100.0).enabled(above).child(
            container()
                .width(80.0)
                .height(80.0)
                .enabled(true)
                .child(box_of(50.0, 20.0).on_click(move || counter.set(counter.get() + 1))),
        ),
    );
    h.fit(500.0, 500.0);

    // false && true: the ancestor's no wins. `||` would say yes here.
    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 0, "a reactive ancestor saying no still wins");

    let inner = h.children()[0];
    assert!(
        h.tree
            .nearest_control(inner)
            .expect("declaring `enabled` makes a container an interaction unit")
            .is_disabled(),
        "and the inner unit answers for the ancestor it cannot see"
    );

    // true && true: both agree, and the click lands.
    above.set(true);
    h.fit(500.0, 500.0);
    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 1, "both say yes, so the click lands");
}

/// And the mirror: a constant ancestor over a reactive descendant, which takes
/// the same derived arm from the other side.
#[test]
fn a_reactive_descendant_under_a_constant_ancestor_folds_too() {
    let own = create_signal(true);
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container().width(100.0).height(100.0).enabled(false).child(
            container()
                .width(80.0)
                .height(80.0)
                .enabled(own)
                .child(box_of(50.0, 20.0).on_click(move || counter.set(counter.get() + 1))),
        ),
    );
    h.fit(500.0, 500.0);

    // false && true again, with the reactive side underneath this time.
    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 0, "the constant ancestor's no wins");

    // false && false: still no, and `||` would still disagree with the line above.
    own.set(false);
    h.fit(500.0, 500.0);
    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 0, "and saying no itself changes nothing");
}

/// The gate is a signal like every other declared property: flipping it back
/// lets the next click through, and the write moves nothing, so it costs no
/// layout.
#[test]
fn re_enabling_lets_the_next_click_through_and_costs_no_layout() {
    let enabled = create_signal(false);
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .enabled(enabled)
            .child(box_of(50.0, 20.0).on_click(move || counter.set(counter.get() + 1))),
    );
    h.fit(500.0, 500.0);

    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 0);

    let jobs = h.jobs_from(|| enabled.set(true));
    assert!(
        !jobs.contains(&JobType::Layout),
        "enabling changes what an event does, not where anything sits: {jobs:?}"
    );

    for event in click_at(5.0, 5.0) {
        h.send(event);
    }
    assert_eq!(clicks.get(), 1, "the gate is open again");
}

/// The trap in copying the `visible` early-out: it returns before
/// `track_pointer`, so a container disabled under the pointer would keep
/// `HOVERED` set for ever and `when_hovered` would stick.
#[test]
fn a_container_disabled_while_hovered_is_no_longer_hovered() {
    let enabled = create_signal(true);
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .control()
            .enabled(enabled)
            .when_hovered(|s| s.background(Color::BLUE)),
    );
    h.fit(500.0, 500.0);
    let control = h.tree.nearest_control(h.root).expect("a control");

    set_hover(&mut h, true);
    assert!(control.is_hovered());

    enabled.set(false);
    assert!(
        !control.is_hovered(),
        "a unit that refuses the pointer is not under it"
    );

    // And the flag itself is given up, not merely masked: the pointer leaves
    // while the container is disabled, and re-enabling must not light it again.
    set_hover(&mut h, false);
    enabled.set(true);
    assert!(
        !control.is_hovered(),
        "the pointer is somewhere else entirely"
    );
}

/// The reason the answer is a signal on the control rather than a walk of the
/// tree: a descendant resolves its own colour from inside a tracking scope
/// that has no tree in hand.
#[test]
fn a_text_below_a_disabled_container_styles_itself_from_it() {
    let enabled = create_signal(true);
    let mut h = H::new(
        container()
            .width(100.0)
            .height(40.0)
            .enabled(enabled)
            .child(
                crate::widgets::text("Label")
                    .color(Color::WHITE)
                    .when_disabled(|s| s.color(Color::GRAY)),
            ),
    );

    assert_eq!(painted_text_color(&mut h), Color::WHITE);
    enabled.set(false);
    assert_eq!(painted_text_color(&mut h), Color::GRAY);
    enabled.set(true);
    assert_eq!(painted_text_color(&mut h), Color::WHITE);
}

/// The question the issue left to the implementation: a disabled subtree does
/// not scroll either.
///
/// Scrolling is something a subtree does in answer to an event, and the gate
/// is on the event — so this follows from where the gate sits rather than from
/// a decision taken about scrolling separately.
#[test]
fn a_disabled_scroller_does_not_scroll() {
    let enabled = create_signal(false);
    let rows: Vec<crate::widgets::AnyWidget> =
        (0..10).map(|_| box_of(40.0, 20.0).into_any()).collect();
    let mut h = H::new(
        container()
            .width(40.0)
            .height(30.0)
            .enabled(enabled)
            .scroll(Scroll::vertical())
            .children(rows),
    );
    h.fit(40.0, 30.0);

    let wheel = || Event::scroll(20.0, 15.0, 0.0, 60.0, ScrollSource::Wheel);
    assert_eq!(h.send(wheel()), EventResponse::Ignored);
    enabled.set(true);
    assert_eq!(
        h.send(wheel()),
        EventResponse::Handled,
        "the same scroller, enabled, takes the wheel"
    );
}

// ---------------------------------------------------------------------------
// A signal that stops being a number
// ---------------------------------------------------------------------------

/// The one that costs a battery. `animate_to`'s early-out is
/// `new_target == self.target`, and NaN is equal to nothing including itself,
/// so every pass reads a new target, begins a segment and asks for another
/// Animation job. The surface never goes idle again.
#[test]
fn a_value_that_is_not_a_number_lets_the_surface_go_idle() {
    let angle = create_signal(0.0f32);
    let mut h = H::new(box_of(50.0, 50.0).rotate(angle.transition(200.0)));
    h.fit(200.0, 200.0);
    h.paint();

    angle.set(f32::NAN);
    let t0 = std::time::Instant::now();
    // Well past any transition this could have started.
    for step in 0..6 {
        frame_at(
            &mut h,
            t0 + std::time::Duration::from_millis(step * 200),
            200.0,
            200.0,
        );
    }

    assert!(
        !pump(&mut h),
        "the surface is still animating towards a value that will never arrive"
    );
}

/// What a coerced value leaves behind: the property reads as if it had not
/// been declared, which for every transform component is identity.
///
/// Not NaN, and not "somewhere" — a defined value, which is the whole of the
/// CSS rule this follows: a bad number is replaced once, where it is resolved,
/// so nothing downstream ever has to know it happened.
#[test]
fn a_value_that_is_not_a_number_reads_as_if_it_were_not_declared() {
    let angle = create_signal(45.0f32);
    let mut h = H::new(box_of(50.0, 50.0).rotate(angle));
    h.fit(200.0, 200.0);
    assert!(
        !h.paint().local_transform.is_identity(),
        "the control turns before the bad number arrives"
    );

    angle.set(f32::NAN);
    assert!(
        h.paint().local_transform.is_identity(),
        "a rotation nobody can compute is a rotation nobody asked for"
    );
}

/// Worse than wrong for one frame: NaN is stored as the segment's start, and
/// `lerp(NaN, target, t)` is NaN at every `t`, so a later and perfectly finite
/// target animates from NaN to NaN for the life of the process.
///
/// Coercing where the value is resolved is what stops that reaching the
/// animation at all. Asserted against a control that was never given a bad
/// number, so the claim is "these two agree" rather than a restatement of which
/// way round the matrix stores a sine.
#[test]
fn a_property_follows_its_signal_again_once_the_signal_recovers() {
    let poisoned = create_signal(0.0f32);
    let clean = create_signal(0.0f32);
    let mut h = H::new(
        container()
            .layout(Flex::row())
            .child(box_of(50.0, 50.0).rotate(poisoned.transition(200.0)))
            .child(box_of(50.0, 50.0).rotate(clean.transition(200.0))),
    );
    h.fit(400.0, 200.0);
    h.paint();

    let t0 = std::time::Instant::now();
    poisoned.set(f32::NAN);
    // Two frames, so a bad number would be not merely the target but through
    // `lerp` into `current` — which `begin_segment` then keeps as the start of
    // every segment after it.
    frame_at(&mut h, t0, 400.0, 200.0);
    frame_at(
        &mut h,
        t0 + std::time::Duration::from_millis(50),
        400.0,
        200.0,
    );

    // Both are now asked for the same quarter turn, and given the same time.
    poisoned.set(90.0);
    clean.set(90.0);
    for step in 1..=4 {
        frame_at(
            &mut h,
            t0 + std::time::Duration::from_millis(step * 100),
            400.0,
            200.0,
        );
    }

    // The rotation only: the two sit at different x in the row, and where a box
    // was laid out is not what this is about.
    let painted = h.paint();
    let turn = |t: Transform| [t.a(), t.b(), t.c(), t.d()];
    assert_eq!(
        turn(painted.children[0].local_transform),
        turn(painted.children[1].local_transform),
        "a property given one bad number never followed its signal again"
    );
}

/// `Pivot` is the fourth transform component, and it does not go through a
/// state layer — so the door the other three pass is not on its way.
///
/// Hit testing is where it lands: `untransform_point` composes the transform
/// about the pivot, and a NaN origin makes every `contains` answer no, so a
/// container stops taking the clicks that are plainly inside it.
///
/// The bad number is the *vertical* anchor here and the horizontal one in the
/// enumeration above, so neither arm of the answer can be deleted unnoticed.
#[test]
fn a_pivot_that_is_not_a_number_does_not_swallow_a_click() {
    let clicks = std::rc::Rc::new(std::cell::Cell::new(0));
    let counter = clicks.clone();
    let mut h = H::new(
        box_of(50.0, 50.0)
            .rotate(45.0)
            .pivot(move || Pivot::percent(50.0, f32::NAN))
            .on_click(move || counter.set(counter.get() + 1)),
    );
    h.fit(200.0, 200.0);

    for event in click_at(25.0, 25.0) {
        h.send(event);
    }
    assert_eq!(
        clicks.get(),
        1,
        "a pivot nobody can compute stopped the container being clicked"
    );
}

/// The third of the three things the fix owes: it says so, and says so once.
///
/// A property that quietly stops following its signal is the hardest failure in
/// this library to find by looking — the picture is *correct*, it is just not
/// the one that was asked for — so the silence is the defect, not a detail of
/// it. Once per property rather than once per frame, because paint reads this
/// again every time it runs.
#[cfg(debug_assertions)]
#[test]
fn a_value_that_is_not_a_number_is_reported_once() {
    use crate::reactive::diagnostics::report_count;

    let angle = create_signal(f32::NAN);
    let mut h = H::new(box_of(50.0, 50.0).rotate(angle));
    h.fit(200.0, 200.0);

    let before = report_count();
    for _ in 0..5 {
        h.paint();
    }
    let reports = report_count() - before;
    assert_eq!(reports, 1, "five paints, and it should have said so once");
}

/// Every declared property goes through the door, not the six somebody
/// remembered.
///
/// The design rests on one claim — that a bad number is coerced *where it is
/// resolved*, so no consumer downstream has to know — and a door with holes in
/// it is not that claim, it is six special cases. The first draft of this fix
/// converted six accessors and left `shadow`, `padding`, `width`, `height` and
/// the three untracked transform reads behind.
///
/// So this asks each resolver directly rather than looking for a symptom
/// further down. A symptom test passes for the wrong reason all the time —
/// the first version of this one did, because a NaN width is clamped into a
/// finite size by the layout below it, and a NaN shadow never reaches a drawn
/// rect. What the door promises is about the value it hands out, so that is
/// what is asserted.
#[test]
fn every_declared_property_is_resolved_to_a_finite_value() {
    let nan = f32::NAN;
    let declared = || {
        box_of(50.0, 50.0)
            .width(nan)
            .height(nan)
            .padding(nan)
            .corners(nan)
            .border(nan, Color::rgba(nan, 0.0, 0.0, 1.0))
            .rotate(nan)
            .scale(nan)
            .translate((nan, nan))
            // Horizontal only: with both anchors bad, either arm of the
            // answer still detects it and neither can be deleted noticeably.
            // The hit-testing test takes the vertical for the same reason.
            .pivot(Pivot::percent(nan, 50.0))
            .background(Color::rgba(nan, 0.0, 0.0, 1.0))
            .shadow(Shadow::new((nan, nan), nan, nan, Color::BLACK))
    };

    // One copy in a tree, so the accessors have a laid-out widget to answer
    // for, and one in hand to ask — they take the id rather than reading it
    // off themselves, and nothing here declares a state layer.
    let mut h = H::new(declared());
    h.fit(200.0, 200.0);
    let id = h.root;
    let c = declared();

    let finite = |name: &str, channels: Vec<f32>| {
        assert!(
            channels.iter().all(|c| c.is_finite()),
            "{name} resolved to a value that is not finite: {channels:?}"
        );
    };

    {
        finite(
            "background",
            c.effective_background_target(id).channels().to_vec(),
        );
        finite(
            "border_color",
            c.effective_border_color_target(id).channels().to_vec(),
        );
        finite("border_width", vec![c.effective_border_width_target(id)]);
        finite(
            "corners",
            c.effective_corners_target(id).channels().to_vec(),
        );
        finite("shadow", c.effective_shadow_target(id).channels().to_vec());
        finite(
            "padding",
            c.effective_padding_target(id).channels().to_vec(),
        );
        finite(
            "translate",
            c.effective_translate_target(id).channels().to_vec(),
        );
        finite("rotate", vec![c.effective_rotate_target(id)]);
        finite("scale", c.effective_scale_target(id).channels().to_vec());
        let pivot = c.resolved_pivot(id);
        let (px, py) = pivot.resolve(Rect::new(0.0, 0.0, 50.0, 50.0));
        finite("pivot", vec![px, py]);
        let lengths = c.read_box_lengths(
            &mut crate::tree::LayoutCtx::detached(&mut Tree::new()),
            id,
            Constraints::new(0.0, 0.0, 200.0, 200.0),
        );
        finite("padding (laid out)", lengths.padding.channels().to_vec());
        let numbers = |l: crate::layout::Length| {
            [l.min(), l.max(), l.extent().declared_size()]
                .into_iter()
                .flatten()
                .collect::<Vec<f32>>()
        };
        finite("width", numbers(lengths.width));
        finite("height", numbers(lengths.height));
        // Shadow has two resolvers, and the first draft of this fix converted
        // one: with the extent left raw, a container with a bad shadow and a
        // transform reported a damage rect that did not cover where it drew.
        finite("shadow extent", vec![c.max_shadow_extent(id)]);
    }

    // And a state layer's override is passed over the same way, so the base
    // shows through rather than the layer's bad number replacing it.
    let hovered = container()
        .width(50.0)
        .height(50.0)
        .background(Color::RED)
        .when_hovered(|s| s.background(Color::rgba(nan, 0.0, 0.0, 1.0)));
    let mut h = H::new(hovered);
    h.fit(200.0, 200.0);
    set_hover(&mut h, true);
    assert_eq!(
        rects(&h.paint()).first().map(|(_, c)| *c),
        Some(Color::RED),
        "a hover layer nobody can compute replaced the background anyway"
    );
}

// ---------------------------------------------------------------------------
// Every animated property, from the table that generates them
// ---------------------------------------------------------------------------

/// The fill, corners, border and shadow of the first rounded rect a node draws.
fn painted_style(
    node: &RenderNode,
) -> (
    Color,
    CornerRadii,
    Option<crate::renderer::Border>,
    Option<Shadow>,
) {
    node.commands
        .iter()
        .find_map(|c| match &**c {
            DrawCommand::RoundedRect {
                color,
                radius,
                border,
                shadow,
                ..
            } => Some((*color, *radius, *border, *shadow)),
            _ => None,
        })
        .expect("the container draws a rounded rect")
}

/// How far a node has been turned, in degrees, read back off its matrix.
fn turned_degrees(node: &RenderNode) -> f32 {
    let m = node.local_transform.data;
    m[3].atan2(m[0]).to_degrees()
}

/// The jobs a write queues anywhere in the tree, rather than on the root.
///
/// Every property in the table is declared on the root now — a removed
/// widget's exit plays only on its own properties, so the recipe declares on
/// the widget it would remove — but what is asserted of every property is
/// still only that the write asks *somebody* for a frame: a declared value's
/// only subscription is
/// the read the drift check makes of it, and without that read the write
/// reaches the next frame somebody else happened to want.
fn jobs_anywhere(h: &mut H, write: impl FnOnce()) -> Vec<JobType> {
    h.drain_jobs();
    write();
    let roots = h.roots();
    jobs::distribute_jobs(&h.tree, &roots);
    let drained = jobs::drain_surface_jobs(h.root);
    let mut types: Vec<JobType> = drained.iter().map(|job| job.job_type).collect();
    types.sort_by_key(|t| format!("{t:?}"));
    types.dedup();
    jobs::recycle_job_buffer(drained);
    types
}

/// Run frames from `start` up to and including `start + span`, sixty a second,
/// and read the probe off the last one.
///
/// A cadence rather than two frames at the ends: an animation moves on the
/// frames that run, and the loop runs them at vsync.
fn run_to(
    h: &mut H,
    start: std::time::Instant,
    span: std::time::Duration,
    probe: impl Fn(&mut H) -> f32,
) -> f32 {
    let step = std::time::Duration::from_millis(10);
    let mut at = start;
    while at < start + span {
        at += step;
        frame_at(h, at.min(start + span), 400.0, 400.0);
    }
    probe(h)
}

/// A probe read off `id` rather than the harness's root: the child a
/// container holds, which the probes cannot name — they read `h.root`.
fn probe_of(h: &mut H, id: WidgetId, probe: impl Fn(&mut H) -> f32) -> f32 {
    let root = std::mem::replace(&mut h.root, id);
    let read = probe(h);
    h.root = root;
    read
}

/// What a write underneath a property has to have queued.
///
/// A property that reads its own target is woken by the drift check's read of
/// it, which is an Animation job. A size is woken by the layout that tracks
/// the length it was declared with, and the Animation job follows from the
/// retarget that layout performs.
macro_rules! woken_by {
    (none, $queued:expr) => {
        !$queued.is_empty()
    };
    ($target:ident, $queued:expr) => {
        $queued.contains(&JobType::Animation)
    };
}

/// The timeline half, for the rows that can carry one.
///
/// `width` and `height` cannot, and are not asked to: they declare a `Length`
/// and animate the `f32` inside it, so `Keyframes<Length>` has no constructor
/// to build. Their rows say `timeline: no`, which is a fact of its own rather
/// than one inferred from their having no target to read.
macro_rules! emit_timeline_test {
    (no, $name:ident, $value:expr, $declared_as:expr, $probe:expr, $from:expr, $to:expr,
        $base:expr) => {};
    (yes, $name:ident, $value:expr, $declared_as:expr, $probe:expr, $from:expr,
        $to:expr, $base:expr) => {
        /// A sequence plays when its trigger moves, and is halfway through at
        /// half its duration.
        #[test]
        fn its_timeline_plays_when_the_trigger_moves() {
            let value = $value;
            let probe = $probe;
            let plays = create_signal(0u32);
            let mut h = H::new(($declared_as)(
                value($base).timeline(
                    Keyframes::new(100.0)
                        .at(0.0, value($from))
                        .at(1.0, value($to))
                        .played_by(plays),
                ),
            ));

            let t0 = std::time::Instant::now();
            frame_at(&mut h, t0, 400.0, 400.0);
            let at_rest = probe(&mut h);
            assert!(
                (at_rest - $base).abs() < 0.01,
                "{}: a sequence nobody asked for has not played, so the property \
                 sits at the value it was declared with: got {at_rest}, wanted {}",
                stringify!($name),
                $base,
            );

            plays.set(1);
            let t1 = t0 + std::time::Duration::from_millis(100);
            frame_at(&mut h, t1, 400.0, 400.0);
            let halfway = run_to(&mut h, t1, HALF, probe);
            let midpoint = ($from + $to) / 2.0;
            assert!(
                (halfway - midpoint).abs() < 0.01,
                "{}: half a linear sequence is half the distance: got {halfway}, \
                 wanted {midpoint}",
                stringify!($name),
            );

            // And a trigger moving is what asks for the frame the sequence
            // plays on: the drift check reads it, and nothing else does. Last,
            // because reading the queue drains it.
            let queued = jobs_anywhere(&mut h, || plays.set(2));
            assert!(
                queued.contains(&JobType::Animation),
                "{}: a play has to wake the container that would show it, got \
                 {queued:?}",
                stringify!($name),
            );
        }
    };
}

/// A property's own test, written once and emitted for every row of
/// [`animated_properties!`].
///
/// Five things have to hold for each of them, and each is a different one of
/// the sites the table generates: it **enters** from where it was declared to
/// (the seed), it is **halfway at half the duration** (the advance), a write
/// underneath it **wakes the container** (the drift check, which is the only
/// subscription that write has), the ease that follows lands **where the
/// write sent it** (the retarget), and removed, it **leaves** to where its exit
/// was declared to before it is disposed (the exit).
///
/// Checked alone on its container, which is the shape the two shadow tests
/// above had to be written by hand for: a `||` chain over nine slots drifts
/// without a container that animates two things noticing.
macro_rules! emit_property_tests {
    ($($name:ident: $anim:ty as $decl:ty, target: $target:tt, layout: $layout:ident,
        timeline: $timeline:ident,
        test {
            value: $value:expr,
            declared_as: $declared_as:expr,
            probe: $probe:expr,
            from: $from:expr, to: $to:expr, then: $then:expr, base: $base:expr,
        };)*) => {
        $(
            mod $name {
                use super::*;

                /// Half of the hundred milliseconds every row is declared with.
                const HALF: std::time::Duration = std::time::Duration::from_millis(50);

                #[test]
                fn it_enters_eases_and_follows_a_write_underneath_it() {
                    let value = $value;
                    // Once per frame: a probe paints, and a second paint of the
                    // same frame is a frame the loop never runs.
                    let probe = $probe;
                    let declared = create_signal($to);
                    let mut h = H::new(($declared_as)((move || value(declared.get()))
                        .transition(Transition::new(100.0, TimingFunction::Linear))
                        .entering_from(value($from))));

                    // Frames at a steady cadence, as the loop runs them.
                    // The properties do not all start moving on the same one —
                    // a size is advanced by the layout that measured it, while
                    // `padding` waits for the paint that resyncs its target —
                    // but each reads the clock, so by any given instant they
                    // are all the same distance along.
                    let t0 = std::time::Instant::now();
                    frame_at(&mut h, t0, 400.0, 400.0);
                    let opened = probe(&mut h);
                    assert!(
                        (opened - $from).abs() < 0.01,
                        "{}: an enter starts where it was declared to, not at its \
                         target: got {opened}, wanted {}",
                        stringify!($name),
                        $from
                    );

                    let halfway = run_to(&mut h, t0, HALF, probe);
                    let midpoint = ($from + $to) / 2.0;
                    assert!(
                        (halfway - midpoint).abs() < 0.01,
                        "{}: half of a linear hundred milliseconds is half the \
                         distance: got {halfway}, wanted {midpoint}",
                        stringify!($name),
                    );

                    // Settle, then move the signal underneath it. The write
                    // lands between frames, which is what the drift check in
                    // `resync_animation_targets` subscribes for.
                    run_to(&mut h, t0, HALF * 2, probe);
                    declared.set($then);
                    let t1 = t0 + HALF * 4;
                    frame_at(&mut h, t1, 400.0, 400.0);
                    let adopted = run_to(&mut h, t1, HALF, probe);

                    let midpoint = ($to + $then) / 2.0;
                    assert!(
                        (adopted - midpoint).abs() < 0.01,
                        "{}: a write underneath has to be adopted and eased to: \
                         got {adopted}, wanted {midpoint}",
                        stringify!($name),
                    );

                    // And the write is what asks for the frame that adopts it:
                    // the drift check's read of the target is the only
                    // subscription a declared value has. Last, because reading
                    // the queue drains it — the frames above need theirs.
                    let queued = jobs_anywhere(&mut h, || declared.set($from));
                    assert!(
                        woken_by!($target, queued),
                        "{}: a write underneath has to wake the container that \
                         would show it, got {queued:?}",
                        stringify!($name),
                    );
                }

                /// A plain value claims no signal slot; the same value
                /// behind a closure claims exactly one.
                ///
                /// Both halves matter. That the constant is free is the claim;
                /// that the closure still costs a slot is what says the test
                /// is looking at the declaration at all, and not at a tree
                /// that happens to allocate nothing.
                ///
                /// The two trees are the same recipe, so whatever the recipe
                /// builds around the declaration — a child, a sibling, the
                /// container's own slot — cancels, and the difference is the
                /// declaration alone. `slot_count` counts every slot ever
                /// allocated, so a constant that reaches `alloc_slot` shows up
                /// whether or not it is later disposed.
                ///
                /// Over the table rather than once, because the twelve
                /// properties do not share a setter — `width` and `height` go
                /// through `declare_size` and the other ten through
                /// `declare_anim`, and a constant that stays free in one is no
                /// evidence about the other.
                #[test]
                fn a_constant_claims_no_slot_where_a_closure_claims_one() {
                    use crate::reactive::storage::slot_count;
                    let value = $value;

                    // Built and dropped once before either measurement, so
                    // whatever a first container in a fresh runtime sets up is
                    // behind both of them. `$declared_as` is substituted at
                    // each use rather than bound to a name: a closure is not
                    // generic, so one binding could not take a value here and
                    // a closure below.
                    drop(($declared_as)(value($from)));

                    let mark = slot_count();
                    drop(($declared_as)(value($from)));
                    let constant = slot_count() - mark;

                    let mark = slot_count();
                    drop(($declared_as)(move || value($from)));
                    let reactive = slot_count() - mark;

                    assert_eq!(
                        constant,
                        reactive - 1,
                        "{}: a constant declaration must claim no slot, and a \
                         closure must claim one — got {constant} against \
                         {reactive}",
                        stringify!($name),
                    );
                }

                /// It leaves: removed from the container holding it, it
                /// travels to where its exit was declared to, is halfway there
                /// at half the duration, and is disposed when it lands.
                ///
                /// The probe is read off the leaving widget, which is no
                /// longer anybody's root; the recipe's declaration is the
                /// removed widget itself, so the exit is on the widget that
                /// is removed.
                #[test]
                fn it_leaves_to_where_its_exit_was_declared() {
                    let value = $value;
                    let probe = $probe;
                    let shown = create_signal(true);
                    let mut h = H::new(container().child(move || {
                        shown.get().then(|| {
                            ($declared_as)(value($to)
                                .transition(Transition::new(100.0, TimingFunction::Linear))
                                .exiting_to(value($from)))
                        })
                    }));

                    let t0 = std::time::Instant::now();
                    frame_at(&mut h, t0, 400.0, 400.0);
                    let leaving = h.children()[0];

                    shown.set(false);
                    frame_at(&mut h, t0, 400.0, 400.0);
                    let halfway = run_to(&mut h, t0, HALF, |h| probe_of(h, leaving, probe));
                    let midpoint = ($to + $from) / 2.0;
                    assert!(
                        (halfway - midpoint).abs() < 0.01,
                        "{}: half of a linear hundred milliseconds is half the \
                         way out: got {halfway}, wanted {midpoint}",
                        stringify!($name),
                    );

                    // Frames to the end, with nothing to probe on the last:
                    // by then there is nothing to probe.
                    run_to(&mut h, t0 + HALF, HALF, |_| 0.0);
                    assert!(
                        !h.tree.contains(leaving),
                        "{}: an exit that has landed is disposed",
                        stringify!($name),
                    );
                }

                emit_timeline_test!(
                    $timeline, $name, $value, $declared_as, $probe, $from, $to, $base
                );
            }
        )*
    };
}

crate::widgets::container::animated_properties::animated_properties!(emit_property_tests);

/// Seven constant properties on a container cost what the bare container costs.
///
/// The per-property test above asks one question of each of the twelve; this
/// asks the question #450 was opened about, which is what a *row of a list*
/// costs. Six is the number the ablation in that issue measured — 194 MB
/// against 149 MB at twenty thousand rows, and the 45 MB between them was
/// these. Seven rather than six only because a border declares its width and
/// its colour in the one call.
///
/// A bare `container()` is on the other side of the comparison rather than
/// asserted to claim nothing, so this says what the properties cost whatever
/// the container itself does — which is nothing now, and is
/// `a_container_and_a_literal_text_claim_no_slot`.
#[test]
fn a_container_of_constants_costs_what_an_empty_one_costs() {
    use crate::reactive::storage::slot_count;
    use crate::widgets::{Color, Corners, Padding};

    let furnish = || {
        container()
            .width(200.0)
            .height(100.0)
            .padding(Padding::all(8.0))
            .background(Color::RED)
            .corners(Corners::rounded(4.0))
            .border(2.0, Color::BLACK)
    };

    // Once through first, so a fresh runtime's own setup is behind both marks.
    drop(furnish());

    let mark = slot_count();
    drop(container());
    let bare = slot_count() - mark;

    let mark = slot_count();
    drop(furnish());
    let furnished = slot_count() - mark;

    assert_eq!(
        furnished,
        bare,
        "seven constant properties claimed {} slots between them",
        furnished - bare
    );
}

/// A container and a literal text create no signal.
///
/// Their constants — a container's `Flex::column()` direction, a text's string
/// — are held where they are, as every other constant property has been since
/// #450, rather than each taking a signal slot. A row of a list is a container
/// with texts in it, and the slots were one per widget of it.
///
/// That they still react when what they are given is not a constant is
/// `a_row_becomes_a_column_when_its_direction_says_so` beside `Flex`, and
/// `a_text_follows_its_content` beside `Text`.
#[test]
fn a_container_and_a_literal_text_claim_no_slot() {
    use crate::reactive::storage::slot_count;
    use crate::widgets::text;

    // Once through first, so a fresh runtime's own setup is behind the mark.
    drop(container());
    drop(text("x"));

    let mark = slot_count();
    drop(container());
    assert_eq!(slot_count() - mark, 0, "a bare container claimed a slot");

    let mark = slot_count();
    drop(text("x"));
    assert_eq!(slot_count() - mark, 0, "a literal text claimed a slot");
}

/// A gradient and a shadow live behind a pointer, and a container that
/// declares neither does not follow it.
///
/// 72 bytes on every container in every tree, for two decorations a list row
/// declares on none of them — see `DecorationProps`, which has the rule.
///
/// The second half is what `anims` insists on too: nothing into a container
/// that has none must not be the thing that allocates one.
#[test]
fn a_container_declaring_no_decoration_allocates_no_decoration() {
    // 392 is `Container`'s exact size today, written as a ceiling only so
    // that shrinking it further needs no edit here. There is no headroom in
    // it: the next field of any size fails this too, and the message will
    // point at decorations that are innocent. That is deliberate — a struct on
    // every widget in every tree is worth re-reading when it grows — but the
    // reader who lands here from an unrelated field should know to look at
    // their own change first.
    assert!(
        size_of::<Container>() <= 392,
        "72 bytes of gradient and shadow should be one 8-byte pointer: {} bytes",
        size_of::<Container>()
    );

    assert!(
        container().decoration.is_none(),
        "a plain container has nothing to decorate and allocates nothing for it"
    );
    assert!(
        container().background(Color::RED).decoration.is_none(),
        "nor does one that is merely painted"
    );

    assert!(
        container().shadow(LIFTED).decoration.is_some(),
        "declaring a shadow is what allocates the box"
    );
    assert!(
        container()
            .gradient(LinearGradient::horizontal(Color::RED, Color::BLUE))
            .decoration
            .is_some(),
        "and so is declaring a gradient"
    );
}

/// An unbounded axis stays unbounded when it passes through a length that
/// declares no maximum.
///
/// A scrolled axis measures with `f32::INFINITY`, and a container that names no
/// maximum has to hand that infinity on: every reader below asks
/// `constraints.max_width.is_finite()` and takes a different branch when it is
/// not — `text`, `image`, `text_input`, and `Length::resolve_fraction` itself.
///
/// `f32::MAX` is not a stand-in for infinity, which is the trap this test
/// exists for. It is the identity of `f32::min` only over finite inputs:
/// `INFINITY.min(f32::MAX)` is `f32::MAX`, so a sentinel chosen to make the
/// clamp branch-free turns an unbounded axis into a very large finite one, and
/// a `fill` or a `fraction` underneath lays out at 3.4e38 — a number that goes
/// on to be vertex coordinates and a scroll extent. Both size to their content
/// on an axis that really is unbounded, so 0 here says the infinity arrived.
///
/// No golden and no snapshot noticed when that happened, because no scenario
/// laid a container out under an unbounded axis. This is that scenario.
#[test]
fn an_unbounded_axis_survives_a_length_that_declares_no_maximum() {
    let mut h = H::new(
        container()
            .height(20.0)
            .child(container().width(fill()).height(4.0)),
    );
    h.layout(Constraints::new(0.0, 0.0, f32::INFINITY, 100.0));

    let bar = h.children()[0];
    let width = h.tree.cached_size(bar).unwrap().width;
    assert_eq!(
        width, 0.0,
        "a fill of an unbounded axis sizes to content; any other number means \
         the infinity became a finite one on the way down"
    );

    // And a fraction, which is the other reader of that same `is_finite`.
    let mut h = H::new(
        container()
            .height(20.0)
            .child(container().width(fraction(0.5)).height(4.0)),
    );
    h.layout(Constraints::new(0.0, 0.0, f32::INFINITY, 100.0));
    let bar = h.children()[0];
    let width = h.tree.cached_size(bar).unwrap().width;
    assert_eq!(
        width, 0.0,
        "a fraction of an unbounded axis sizes to content: there is no share \
         to take of a space nobody has measured"
    );
}

/// `opacity(0.0.transition(..).entering_from(1.0))` fades the container out as
/// it appears — and everything in it with it, which the table's own test
/// cannot see: it reads the container's node, and a child is drawn at its own
/// node's opacity times every ancestor's, which only the flattened frame says.
#[test]
fn an_entering_opacity_fades_the_whole_subtree() {
    const FILL: Color = Color::rgb(0.9, 0.1, 0.1);
    const INSIDE: Color = Color::rgb(0.1, 0.1, 0.9);
    let t0 = std::time::Instant::now();
    let mut h = H::new(
        container()
            .width(100.0)
            .height(100.0)
            .background(FILL)
            .opacity(
                0.0.transition(Transition::new(100.0, TimingFunction::Linear))
                    .entering_from(1.0),
            )
            .child(container().width(10.0).height(10.0).background(INSIDE)),
    );
    // What each of the two boxes is drawn at, read off the flattened frame.
    let drawn = |h: &mut H| -> f32 {
        let node = h.paint();
        let (mut commands, mut layers) = (Vec::new(), Vec::new());
        let _ = crate::renderer::flatten_root_into(
            &node,
            &mut commands,
            &mut layers,
            &mut crate::renderer::FlattenScratch::default(),
        );
        let at = |fill: Color| {
            commands
                .iter()
                .find(|c| matches!(&*c.command, DrawCommand::RoundedRect { color, .. } if *color == fill))
                .expect("the box is drawn")
                .opacity
        };
        assert_eq!(
            at(FILL),
            at(INSIDE),
            "the box inside is drawn at the container's opacity"
        );
        at(INSIDE)
    };

    frame_at(&mut h, t0, 400.0, 400.0);
    assert_eq!(
        drawn(&mut h),
        1.0,
        "it enters from where it was declared to"
    );
    let halfway = run_to(&mut h, t0, std::time::Duration::from_millis(50), drawn);
    assert!(
        (halfway - 0.5).abs() < 0.01,
        "half faded at half the time: {halfway}"
    );
    let done = run_to(&mut h, t0, std::time::Duration::from_millis(100), drawn);
    assert_eq!(done, 0.0, "and gone at the end");
}

/// Where `Tree::get_surface_relative_bounds` says a widget is drawn is where
/// paint and flatten put it.
///
/// Two oracles. Every box that draws is checked against flatten's own output:
/// the command it emitted, carried by the `world_transform` flatten gave it.
/// Every widget, the containers that draw nothing included, is checked against
/// the render tree composed the way flatten composes it — each node's
/// transform about its pivot, under its parent's — applied to the node's box. The scene nests the four things the query
/// has to agree with paint about: a translate, a scroll offset, a rotation and
/// a scale, each about its own pivot. The query reads them through
/// `Widget::placement` and paint through the container's own fields, so this is
/// what holds the two together.
#[test]
fn a_widgets_drawn_bounds_are_where_paint_and_flatten_put_it() {
    let mut h = H::new(
        container().translate((15.0, 5.0)).padding(10.0).child(
            container()
                .width(200.0)
                .height(150.0)
                .scroll(Scroll::both().visibility(ScrollbarVisibility::Hidden))
                .child(
                    container()
                        .layout(Flex::column())
                        .child(box_of(300.0, 100.0).background(Color::RED))
                        .child(
                            container()
                                .padding(6.0)
                                .rotate(30.0)
                                .pivot(Pivot::TOP_LEFT)
                                .child(box_of(40.0, 20.0).scale(1.5).background(Color::GREEN)),
                        )
                        .child(box_of(80.0, 400.0).background(Color::BLUE)),
                ),
        ),
    );
    h.frame(300.0, 300.0);
    let first = h.tree.get_children(h.children()[0])[0];
    let first = h.tree.get_children(first)[0];
    let before = h.tree.get_surface_relative_bounds(first).expect("laid out");
    h.send(Event::scroll(
        60.0,
        60.0,
        30.0,
        50.0,
        crate::widgets::widget::ScrollSource::Wheel,
    ));
    let frame = h.frame(300.0, 300.0);
    let after = h.tree.get_surface_relative_bounds(first).expect("laid out");
    assert_eq!(
        (after.x, after.y),
        (before.x - 30.0, before.y - 50.0),
        "the wheel scrolled the content 30 sideways and 50 down"
    );

    // Every painted node's world box, composed as flatten composes it.
    fn worlds(node: &RenderNode, parent: Transform, out: &mut Vec<(u64, Rect)>) {
        let world = parent.then(&node.local_transform.about(node.pivot, node.bounds));
        out.push((node.id, world.map_rect(node.bounds)));
        for child in &node.children {
            worlds(child, world, out);
        }
    }
    let mut drawn = Vec::new();
    worlds(&frame.node, Transform::IDENTITY, &mut drawn);

    let mut ids = vec![h.root];
    let mut compared = 0;
    while let Some(id) = ids.pop() {
        ids.extend_from_slice(h.tree.get_children(id));
        let Some(&(_, world)) = drawn.iter().find(|(node, _)| *node == id.as_u64()) else {
            continue;
        };
        let reported = h.tree.get_surface_relative_bounds(id).expect("laid out");
        let near = |a: f32, b: f32| (a - b).abs() < 1e-3;
        assert!(
            near(reported.x, world.x)
                && near(reported.y, world.y)
                && near(reported.width, world.width)
                && near(reported.height, world.height),
            "widget {id:?}: the query says {reported:?}, paint and flatten put it at {world:?}"
        );
        compared += 1;
    }
    assert_eq!(
        compared, 7,
        "every widget of the scene was painted and compared"
    );

    // And each box that draws, against the command flatten emitted for it.
    let column = h.tree.get_children(h.children()[0])[0];
    let rows = h.tree.get_children(column).to_vec();
    let scaled = h.tree.get_children(rows[1])[0];
    let commands = &h.last.as_ref().expect("a frame was flattened").1;
    for (id, color) in [
        (rows[0], Color::RED),
        (scaled, Color::GREEN),
        (rows[2], Color::BLUE),
    ] {
        let flattened = commands
            .iter()
            .find_map(|flattened| match &*flattened.command {
                DrawCommand::RoundedRect {
                    rect, color: fill, ..
                } if *fill == color => Some(flattened.world_transform.map_rect(*rect)),
                _ => None,
            })
            .expect("the box drew");
        let reported = h.tree.get_surface_relative_bounds(id).expect("laid out");
        let near = |a: f32, b: f32| (a - b).abs() < 1e-3;
        assert!(
            near(reported.x, flattened.x)
                && near(reported.y, flattened.y)
                && near(reported.width, flattened.width)
                && near(reported.height, flattened.height),
            "{color:?}: the query says {reported:?}, flatten drew it at {flattened:?}"
        );
    }
}