blockworx_web/

shell.rs

//! The shell as one value, and the frame it runs.
//!
//! ```text
//! a handler ──► batch.push(…) ──► one booking at a time (see `pacing`)
//!                                      │
//! the booked frame ───────────────────►│ view = kernel(session, Tick + batch, glyphs)
//!                                      │ the ground and the display list, onto the canvas
//!                                      │ the hand-offs, delivered
//!                                      │ the chrome model, into its signal if it moved
//!                                      │ whatever the answer asks for, booked
//! ```
//!
//! A handler does one thing: [`Shell::say`] (or [`Shell::sampled`], for what
//! the pointer and the keyboard did). The batch lives in a cell of its own, so
//! a handler firing while a frame is in flight adds to the next one rather
//! than re-entering the session.

use core::time::Duration;
use std::cell::{Cell, RefCell};
use std::rc::Rc;

use blockworx_canvas2d::input::{Focus, Reader, Sample};
use blockworx_canvas2d::{
    DevicePixelRatio, Glyphs, Images, Repaint, clipboard_write, css_color, css_cursor, download,
    fit, paint_ground, replay,
};
use blockworx_doc::id::{BlockId, PinId};
use blockworx_editor::shape::RoleTarget;
use blockworx_editor::title_block::TitleBlock;
use blockworx_export::bytes_for;
use blockworx_geom::{Pos2, Rect, Vec2, pos2, vec2};
use blockworx_kernel::Sheet;
use blockworx_kernel::{Event, FrameRate, Handoff, Session, View, kernel};
use blockworx_paint::theme::Theme;
use blockworx_paint::{DrawList, FontChoice, Ground, Palette, Scheme, Tick, Vantage};
use blockworx_store::doc::Doc;
use blockworx_store::handle::Store;
use blockworx_store::history;
use blockworx_store::storage::{Any, DocumentRef, Name};
use blockworx_tools::commands::{Act, Effect};
use blockworx_tools::tool::Action;
use dioxus::prelude::*;
use wasm_bindgen::{JsCast as _, JsValue, prelude::Closure};
use web_sys::{CanvasRenderingContext2d, Document, HtmlCanvasElement, HtmlElement, Window};

use crate::chords::Token;
use crate::chrome::Chrome;
use crate::library::{Library, Listed, Opened};
use crate::meter::{Frame, FrameMeter, Metered};
use crate::mode::Prefers;
use crate::pacing::{Pacing, Schedule};
use crate::prefs::Preferences;
use crate::sidebar::Section;

/// The editor and everything it draws through: one borrow, taken by the frame
/// and by nothing else.
struct Editor {
    session: Session,
    /// The text engine the kernel is called with *and* the ink its glyphs are
    /// filled from — one value, so the diagram cannot draw a face the recorder
    /// did not measure.
    glyphs: Glyphs,
    images: Images,
    reader: Reader,
    /// The canvas, once it is mounted. A frame before that runs the kernel and
    /// paints nothing.
    surface: Option<Surface>,
    /// What the canvas last showed.
    diagram: Option<Diagram>,
    /// What each piece of the chrome covers of the diagram, which the safe
    /// region is the viewport minus. Measured by the bands themselves and
    /// re-measured when they move, never cached.
    bands: Vec<(Band, Rect)>,
    /// What the diagram is currently drawn with, so a preference that did not
    /// move books no frame.
    dressed: Dressed,
    /// What the browser would not do with this call's hand-offs, drained by
    /// the frame that ran it — the editor has no signal of its own to say so.
    refused: Vec<String>,
    /// What a command named this call turned out to be the shell's to
    /// perform. Drained by the frame that ran it, for the same reason: a
    /// picker is opened by a signal the editor does not hold.
    raised: Vec<Effect>,
    /// The frames of the last second, for the frame-rate readout.
    meter: FrameMeter,
    /// What the last call's frame came to on the meter.
    metered: Option<Metered>,
}

/// Which piece of glass is reporting its own bounds. One entry each, so a
/// band that moves replaces its own reading rather than joining a pile.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub enum Band {
    Toolbar,
    Status,
    Notices,
    /// The navigator, which is glass over the diagram while it is open and
    /// takes the edge it hugs off the safe region until it closes.
    Sheet,
}

/// How the diagram is dressed: the palette it is painted in, the face it is
/// lettered in, and the scheme an export prints in.
#[derive(Clone, PartialEq)]
struct Dressed {
    palette: Palette,
    font: FontChoice,
    scheme: Scheme,
}

impl Dressed {
    /// The roles the chrome's own readings of the diagram resolve through —
    /// a tree row's dot, an accent swatch. The same palette the kernel is
    /// told, so a swatch and the shape it stands for are one colour.
    fn theme(&self) -> Theme {
        let mut theme = Theme::default();
        theme.set_palette(self.palette.clone());
        theme
    }
}

/// Which picker an effect opened, and on what. One value rather than two
/// options, because opening one closes the other.
#[derive(Clone, PartialEq, Debug)]
pub enum Picker {
    Accent(RoleTarget),
    PinType(Vec<PinId>),
}

/// Whether a keystroke was taken by a piece of glass before the canvas saw
/// it.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub enum Escaped {
    Claimed,
    Free,
}

/// What an open file pick is for, which is the shell's own record of the flow
/// it is in — the artwork lands as a block's icon, as an image of its own, or
/// as whatever an import turns out to be.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub enum Wanted {
    Icon(BlockId),
    Image,
    Import,
}

/// Where a `paste` event came from, which the browser does not say.
///
/// X11 binds the middle button to pasting the primary selection, and the
/// browser raises a real `paste` for it — indistinguishable, in the event,
/// from the one ⌘V raises. The middle button *pans* here
/// (`Drives::Camera`), so every pan would paste the clipboard into the
/// diagram as its own commit. Refusing the platform's default on
/// `pointerdown` does not reach it: Blink raises the paste when the button
/// comes back up.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
pub enum Pasting {
    /// Nothing has provoked one, so a paste is the user's own.
    Asked,
    /// The middle button went down on the diagram; the next paste, if one
    /// comes, is the platform's and not an ask.
    Provoked,
}

/// What the shell itself could not do — an export the browser refused, a
/// clipboard that would not take the copy. The kernel knows nothing about
/// these, so they reach the chrome here rather than through its notices.
///
/// The count is what makes a repeat a second report: the same words twice
/// are two failures, and a toast showing the first must rise again for the
/// second.
#[derive(Clone, PartialEq, Eq, Debug, Default)]
pub struct Reported {
    pub said: u64,
    pub what: Option<String>,
}

/// How much the storage still owes the log — the journal's depth. Zero for a
/// session with no container to owe it to, and for one whose container is
/// written to as it goes.
#[derive(Clone, Copy, PartialEq, Eq, Debug, Default)]
pub struct Owed(pub usize);

/// What the session's document goes away for.
///
/// Every one of these awaits the origin, and the origin performs one thing at
/// a time: a rev lands before the row that names it, so no two of these are
/// ever open at once.
enum Door {
    /// The writes the container owes the origin, made.
    Drained,
    Born,
    Named(DocumentRef),
    Renamed(String),
    Deleted,
    Exported,
    /// A listed diagram, which may or may not be the one in this tab.
    DeletedNamed(Name),
    ExportedNamed(Name),
    Imported {
        called: String,
        archive: Vec<u8>,
    },
}

/// What a door leaves the session standing on.
enum Stood {
    /// The document it was lent, written or renamed — the view and the
    /// selection are still about it.
    Carried(Doc),
    /// Another document, which everything the editor pointed into the last
    /// one has to be stood back up around.
    Opened(Doc),
}

/// What a door that opens a document leaves standing.
fn opened(got: Result<Store<Any>, String>, lent: Doc) -> (Stood, Option<String>) {
    match got {
        Ok(store) => (Stood::Opened(Doc::attached(store)), None),
        Err(why) => (Stood::Carried(lent), Some(why)),
    }
}

/// What the doors that need a container say to a session with none.
const NO_CONTAINER: &str = "This session has no diagram in the origin's storage";

/// Where the diagram goes.
struct Surface {
    canvas: HtmlCanvasElement,
    ctx: CanvasRenderingContext2d,
}

/// One call's diagram, kept past the call: a resize clears the backing store,
/// and the page would show nothing until the call it books had answered.
struct Diagram {
    draw_list: DrawList,
    ground: Ground,
    vantage: Vantage,
}

impl Diagram {
    fn of(view: &mut View) -> Self {
        Self {
            draw_list: std::mem::take(&mut view.draw_list),
            ground: Ground {
                background: view.ground.background,
                grid: view.ground.grid,
            },
            vantage: view.vantage,
        }
    }
}

/// What handlers have said since the last frame.
#[derive(Default)]
struct Batch {
    events: Vec<Event>,
    /// What the browser told the canvas, read through the backend's own
    /// [`Reader`] when the frame assembles the batch — a pan latches across a
    /// gesture, so the samples are read in one go rather than one at a time.
    samples: Vec<Sample>,
}

/// The shell, held once behind [`Rc`]s so every handler carries a clone.
#[derive(Clone)]
pub struct Shell {
    editor: Rc<RefCell<Editor>>,
    /// The documents the origin holds, and every door onto them.
    library: Rc<Library>,
    /// Whether a door or the journal is standing between the frame and the
    /// document. Every one of them takes the document out of the session for
    /// as long as it awaits, so the frame that shares this handle is held
    /// off rather than shown a document that is not there.
    away: Rc<Cell<bool>>,
    /// Whether a `paste` arriving now is one the user asked for.
    pasting: Rc<Cell<Pasting>>,
    /// The door someone asked for while another was out, which opens when
    /// that one is back. The latest ask is the one kept.
    waiting: Rc<RefCell<Option<Door>>>,
    batch: Rc<RefCell<Batch>>,
    pacing: Rc<Cell<Pacing>>,
    chrome: Signal<Chrome>,
    /// The frame-rate readout, kept up only while the session shows it.
    frames: Signal<Option<Metered>>,
    /// What the shell itself could not do, which the toast shows.
    reported: Signal<Reported>,
    /// What the storage owes, which the status line's liveness slot shows.
    owed: Signal<Owed>,
    /// What the origin holds, which the Diagrams section lists.
    held: Signal<Vec<Listed>>,
    /// How many times the menu has asked for the rename box. A count rather
    /// than a flag: the box lives on the breadcrumb, which has to tell a
    /// fresh ask from the one it has already opened on.
    renaming: Signal<u64>,
    /// Which picker an effect opened, if any.
    picker: Signal<Option<Picker>>,
    /// What an open file pick is for, if one is open.
    wanted: Signal<Option<Wanted>>,
    /// The part of the diagram the chrome leaves clear, which the selection
    /// overlay places itself inside.
    safe: Signal<Rect>,
    /// Whether the search palette is up. Shell state, not the session's —
    /// which is why the command that asks for it is an effect.
    palette: Signal<bool>,
    /// Which sidebar section is open, if any. Likewise the shell's: the
    /// session has no opinion about what is being browsed.
    section: Signal<Option<Section>>,
    /// How this platform writes the command modifier — the whole of §4's
    /// per-platform difference.
    token: Token,
}

/// Two shells are the same shell when they are clones of one another, which
/// is what a component needs to know of one.
impl PartialEq for Shell {
    fn eq(&self, other: &Self) -> bool {
        Rc::ptr_eq(&self.editor, &other.editor)
    }
}

impl Shell {
    /// A shell over the document the origin was opened on, primed: the first
    /// call runs here — dressed as the preferences ask — so the chrome has a
    /// bar and a tool cluster before a frame has ever been booked.
    #[must_use]
    pub fn opening(
        prefs: &Preferences,
        prefers: Prefers,
        opened: Opened,
    ) -> (Self, Signal<Chrome>) {
        let Opened {
            library,
            doc,
            notice,
        } = opened;
        let dressed = Dressed {
            palette: prefs.palette(prefers),
            font: prefs.font,
            scheme: prefs.scheme,
        };
        let mut editor = Editor {
            session: Session::opening(doc, prefs.identity()),
            glyphs: Glyphs::new(dressed.font),
            images: Images::default(),
            reader: Reader::default(),
            surface: None,
            diagram: None,
            bands: Vec::new(),
            dressed: dressed.clone(),
            refused: Vec::new(),
            raised: Vec::new(),
            meter: FrameMeter::default(),
            metered: None,
        };
        if let Some(notice) = notice {
            editor.session.failures.report(notice);
        }
        if let Some(named) = editor.session.doc.container_name() {
            library.remembers(&named);
        }
        let primed = editor.run(vec![Event::Action(Action::SetPalette(dressed.palette))]);
        let chrome = Signal::new(Chrome::of(&primed));
        let shell = Self {
            editor: Rc::new(RefCell::new(editor)),
            library: Rc::new(library),
            away: Rc::new(Cell::new(false)),
            pasting: Rc::new(Cell::new(Pasting::Asked)),
            waiting: Rc::new(RefCell::new(None)),
            batch: Rc::new(RefCell::new(Batch::default())),
            pacing: Rc::new(Cell::new(Pacing::default())),
            chrome,
            frames: Signal::new(None),
            reported: Signal::new(Reported::default()),
            owed: Signal::new(Owed::default()),
            held: Signal::new(Vec::new()),
            renaming: Signal::new(0),
            picker: Signal::new(None),
            wanted: Signal::new(None),
            safe: Signal::new(Rect::ZERO),
            palette: Signal::new(false),
            section: Signal::new(None),
            token: window().map_or_else(Token::default, |window| Token::of(&window)),
        };
        {
            let listing = shell.clone();
            spawn(async move { listing.lists_the_origin().await });
        }
        (shell, chrome)
    }

    /// A shell showing a made-up chrome, so a snapshot can stand a region
    /// somewhere a scratch document never stands — under the lens, with a
    /// notice, with something to take back.
    #[cfg(test)]
    #[must_use]
    pub fn showing(chrome: Chrome) -> Self {
        let (shell, mut signal) =
            Self::opening(&Preferences::default(), Prefers::Light, Opened::detached());
        signal.set(chrome);
        // A snapshot has no canvas to measure, so the room the glass places
        // itself inside is stated: a fixture bar with nowhere to stand would
        // draw nothing and pin an empty region.
        let mut safe = shell.safe;
        safe.set(Rect::from_min_max(pos2(0.0, 54.0), pos2(1200.0, 800.0)));
        shell
    }

    /// What the components bind.
    #[must_use]
    pub fn chrome(&self) -> Signal<Chrome> {
        self.chrome
    }

    /// What the frame-rate readout shows, once a frame has been metered.
    #[must_use]
    pub fn frames(&self) -> Signal<Option<Metered>> {
        self.frames
    }

    /// What the shell itself could not do, which the toast shows.
    #[must_use]
    pub fn reported(&self) -> Signal<Reported> {
        self.reported
    }

    /// What the storage owes, which the status line's liveness slot shows.
    #[must_use]
    pub fn owed(&self) -> Signal<Owed> {
        self.owed
    }

    /// The storage says how far behind it is.
    pub fn owes(&self, depth: Owed) {
        let mut owed = self.owed;
        if *owed.peek() != depth {
            owed.set(depth);
        }
    }

    /// Which picker is open, which the overlay anchors.
    #[must_use]
    pub fn picker(&self) -> Signal<Option<Picker>> {
        self.picker
    }

    /// What an open file pick is for, which the hidden input reads.
    #[must_use]
    pub fn wanted(&self) -> Signal<Option<Wanted>> {
        self.wanted
    }

    /// The part of the diagram the chrome leaves clear.
    #[must_use]
    pub fn safe(&self) -> Signal<Rect> {
        self.safe
    }

    /// Whether the search palette is up.
    #[must_use]
    pub fn palette(&self) -> Signal<bool> {
        self.palette
    }

    /// Which sidebar section is open, if any.
    #[must_use]
    pub fn section(&self) -> Signal<Option<Section>> {
        self.section
    }

    /// Only *working* dismisses the sidebar's panel: a press on the diagram
    /// or a tool pick is unambiguous intent to edit (`docs/cad-ui-spec.md`
    /// §8). Nothing inside the panel ever closes it.
    pub fn works(&self) {
        let mut section = self.section;
        if section.peek().is_some() {
            section.set(None);
        }
    }

    /// Escape, claimed before anything else reads it: the palette closes
    /// first, then the sidebar's panel, and only a keystroke neither wanted
    /// reaches the canvas.
    #[must_use]
    pub fn escaped(&self) -> Escaped {
        let mut palette = self.palette;
        let mut section = self.section;
        if *palette.peek() {
            palette.set(false);
            return Escaped::Claimed;
        }
        if section.peek().is_some() {
            section.set(None);
            return Escaped::Claimed;
        }
        Escaped::Free
    }

    /// The roles the chrome resolves its own readings of the diagram
    /// through, in the palette the diagram is painted in.
    #[must_use]
    pub fn theme(&self) -> Theme {
        self.editor.borrow().dressed.theme()
    }

    /// How this platform writes the command modifier.
    #[must_use]
    pub fn token(&self) -> Token {
        self.token
    }

    /// Who this session's commits are attributed to as it stands.
    #[must_use]
    pub fn attributed(&self) -> String {
        self.editor.borrow().session.identity.name.clone()
    }

    /// Dress the diagram as the preferences ask, and attribute the session to
    /// who they name. A preference that did not move changes nothing and
    /// books no frame.
    pub fn wears(&self, prefs: &Preferences, prefers: Prefers) {
        let asked = Dressed {
            palette: prefs.palette(prefers),
            font: prefs.font,
            scheme: prefs.scheme,
        };
        let was = {
            let mut editor = self.editor.borrow_mut();
            editor.session.identity = prefs.identity();
            let was = std::mem::replace(&mut editor.dressed, asked.clone());
            if was.font != asked.font {
                editor.glyphs = Glyphs::new(asked.font);
            }
            was
        };
        if was.palette != asked.palette {
            self.say(Event::Action(Action::SetPalette(asked.palette)));
        } else if was.font != asked.font {
            // A new face re-measures every label, so the diagram is owed a
            // frame even though nothing the kernel knows about moved.
            self.books(Pacing::said);
        }
    }

    /// Something the shell was asked to do did not work. It is the shell's
    /// own failure, not the document's, so it is toasted rather than filed
    /// among the session's notices.
    pub fn failed(&self, what: impl Into<String>) {
        let what = what.into();
        tracing::error!("{what}");
        let mut reported = self.reported;
        let said = reported.peek().said + 1;
        reported.set(Reported {
            said,
            what: Some(what),
        });
    }

    /// What a control raised: an edit goes into the batch by name, and an
    /// effect is performed by whoever owns the flow it belongs to.
    pub fn raises(&self, act: Act) {
        match act {
            Act::Edit(action) => self.say(Event::Action(action)),
            Act::Effect(effect) => self.performs(&effect),
        }
    }

    /// The doors the chrome opens that the kernel cannot. A door that is not
    /// there says so rather than failing silently.
    fn performs(&self, effect: &Effect) {
        let mut picker = self.picker;
        let mut wanted = self.wanted;
        match effect {
            Effect::NewDocument => self.opens_a_door(Door::Born),
            Effect::OpenRecent(named) => self.opens_a_door(Door::Named(named.clone())),
            Effect::RenameDocument(to) => self.opens_a_door(Door::Renamed(to.clone())),
            Effect::Accent(target) => picker.set(Some(Picker::Accent(*target))),
            Effect::PinType(pins) => picker.set(Some(Picker::PinType(pins.clone()))),
            Effect::AddIcon(block) => wanted.set(Some(Wanted::Icon(*block))),
            Effect::AddImage => wanted.set(Some(Wanted::Image)),
            Effect::Import => wanted.set(Some(Wanted::Import)),
            Effect::Search => {
                let mut palette = self.palette;
                let open = !*palette.peek();
                palette.set(open);
            }
            // A browser has no disk to pick a container from: a document
            // arrives through File ▸ Import .bwx.zip instead.
            Effect::PickFile(_) => {
                self.failed("A browser cannot open a diagram from disk; use Import .bwx.zip");
            }
        }
    }

    /// What the origin holds, for the section that lists it. A signal rather
    /// than a call, because the answer is a promise and a component cannot
    /// await one.
    #[must_use]
    pub fn held(&self) -> Signal<Vec<Listed>> {
        self.held
    }

    /// Rename: the box the breadcrumb opens on a double click, asked for from
    /// the Diagrams section instead. One gesture, two ways in.
    pub fn asks_to_rename(&self) {
        let mut renaming = self.renaming;
        let asked = *renaming.peek() + 1;
        renaming.set(asked);
    }

    /// The count the box watches, so a fresh ask is told from the one it is
    /// already open on.
    #[must_use]
    pub fn renaming(&self) -> Signal<u64> {
        self.renaming
    }

    /// Delete: the document, gone from the origin, and the session left
    /// standing on the next one.
    pub fn deletes(&self) {
        self.opens_a_door(Door::Deleted);
    }

    /// Export .bwx.zip: what the origin holds, as the one file a container
    /// travels in.
    pub fn exports_archive(&self) {
        self.opens_a_door(Door::Exported);
    }

    /// A listed row's Export: the diagram it names, as the one file a
    /// container travels in.
    pub fn exports_named(&self, name: &str) {
        match Name::new(name) {
            Some(named) => self.opens_a_door(Door::ExportedNamed(named)),
            None => self.failed(format!("{name} is not a diagram")),
        }
    }

    /// A listed row's Delete: the diagram it names, gone from the origin.
    /// Any but this tab's own leaves the session where it stands, and one
    /// another tab has open is refused.
    pub fn deletes_named(&self, name: &str) {
        match Name::new(name) {
            Some(named) => self.opens_a_door(Door::DeletedNamed(named)),
            None => self.failed(format!("{name} is not a diagram")),
        }
    }

    /// Import .bwx.zip: a container laid down in the origin under a
    /// name nothing stands under, and opened.
    pub fn imports_archive(&self, called: String, archive: Vec<u8>) {
        self.opens_a_door(Door::Imported { called, archive });
    }

    /// The library's own doors, each of which awaits the origin — so the
    /// document leaves the session for as long as one is open and the frame
    /// stands off until it is back.
    ///
    /// One at a time and never two: the origin is written in the order the
    /// store made its writes, and a second door open across the first would
    /// interleave a rev with the row that names it.
    fn opens_a_door(&self, door: Door) {
        if self.away.get() {
            // The journal is asked for again by the next frame; a door someone
            // chose is not, so it waits rather than being lost.
            if !matches!(door, Door::Drained) {
                self.waiting.replace(Some(door));
            }
            return;
        }
        self.away.set(true);
        // A drain writes the diagram in hand, which the list does not read
        // from the origin, so only the other doors re-read what it holds.
        let lists = !matches!(door, Door::Drained);
        let lent = {
            let mut editor = self.editor.borrow_mut();
            std::mem::take(&mut editor.session.doc)
        };
        let shell = self.clone();
        spawn(async move {
            let (stood, failure) = shell.walks_through(door, lent).await;
            shell.takes_back(stood);
            if let Some(failure) = failure {
                shell.reports(failure);
            }
            if lists {
                shell.lists_the_origin().await;
            }
        });
    }

    /// What a door leaves the session standing on, and what it could not do.
    async fn walks_through(&self, door: Door, mut doc: Doc) -> (Stood, Option<String>) {
        match door {
            // A drain that fails has already demoted the container and
            // dropped what it had not written, so there is nothing to retry
            // — only the reason to say, which the read-only notice then
            // stands beside.
            Door::Drained => {
                let started = window().as_ref().and_then(clock_of);
                let drained = doc.drain().await;
                if let Ok(drained) = &drained {
                    tracing::info!(took = ?elapsed(started), ?drained, "wrote the journal to the origin");
                }
                let failure = drained.err().map(|why| {
                    format!("The diagram could not be written, and is now read-only: {why}")
                });
                (Stood::Carried(doc), failure)
            }
            Door::Born => opened(self.library.born().await, doc),
            Door::Named(named) => opened(self.library.opens(&named).await, doc),
            Door::Renamed(to) => {
                let failure = self.library.renames(&mut doc, &to).await.err();
                (Stood::Carried(doc), failure)
            }
            Door::Deleted => self.deletes_this(doc).await,
            Door::Exported => self.exports_this(doc).await,
            // A row names this tab's diagram as readily as any other, and that
            // one goes the way this tab's own door takes it.
            Door::DeletedNamed(named) if doc.container_name().as_ref() == Some(&named) => {
                self.deletes_this(doc).await
            }
            Door::ExportedNamed(named) if doc.container_name().as_ref() == Some(&named) => {
                self.exports_this(doc).await
            }
            Door::DeletedNamed(named) => {
                let failure = self.library.removes_closed(&named).await.err();
                (Stood::Carried(doc), failure)
            }
            Door::ExportedNamed(named) => {
                let failure = self.delivers_archive(&named).await.err();
                (Stood::Carried(doc), failure)
            }
            Door::Imported { called, archive } => {
                opened(self.library.unpacks(&called, &archive).await, doc)
            }
        }
    }

    /// This tab's diagram, gone from the origin, and the session left
    /// standing on a newborn.
    async fn deletes_this(&self, doc: Doc) -> (Stood, Option<String>) {
        let Some(named) = doc.container_name() else {
            return (Stood::Carried(doc), Some(NO_CONTAINER.to_owned()));
        };
        // The lock goes before the directory does: a container the origin
        // still has a view of is one the removal would race. So a removal
        // that does not happen has to open what it let go of, rather than
        // leaving the session standing on nothing.
        drop(doc);
        if let Err(why) = self.library.removes(&named).await {
            let back = self.library.opens(&DocumentRef::new(named.as_str())).await;
            return match back {
                Ok(store) => (Stood::Opened(Doc::attached(store)), Some(why)),
                Err(also) => (Stood::Opened(Doc::default()), Some(format!("{why} {also}"))),
            };
        }
        let (opened, failure) = self.library.stands_on().await;
        (Stood::Opened(opened), failure)
    }

    /// This tab's diagram, packed and handed to the browser to save.
    async fn exports_this(&self, mut doc: Doc) -> (Stood, Option<String>) {
        let Some(named) = doc.container_name() else {
            return (Stood::Carried(doc), Some(NO_CONTAINER.to_owned()));
        };
        // What the origin holds is what travels, so what the container still
        // owes it goes down first.
        let failure = match doc.drain().await {
            Ok(_) => self.delivers_archive(&named).await.err(),
            Err(why) => Some(format!("Failed to export {named}: {why}")),
        };
        (Stood::Carried(doc), failure)
    }

    /// A picker or a file pick ended. What it ended *in* is an ordinary
    /// action; a cancel is nothing at all, because opening the flow changed
    /// nothing to put back.
    pub fn picked(&self, act: Option<Act>) {
        let mut picker = self.picker;
        picker.set(None);
        if let Some(act) = act {
            self.raises(act);
        }
    }

    /// The middle button went down on the diagram: a `paste` that follows is
    /// the platform's, not an ask ([`Pasting`]).
    pub fn provoked(&self) {
        self.pasting.set(Pasting::Provoked);
    }

    /// A key was pressed, so the user is at the keyboard and the next paste
    /// is theirs.
    pub fn asked(&self) {
        self.pasting.set(Pasting::Asked);
    }

    /// Whether to take a `paste` the browser just raised. Asking clears the
    /// provocation, so one middle click refuses one paste.
    pub fn takes_a_paste(&self) -> bool {
        self.pasting.replace(Pasting::Asked) == Pasting::Asked
    }

    /// The bytes a file pick came back with, delivered to whatever the pick
    /// was opened for — so one that took a while still lands where the press
    /// that asked for it meant it to.
    pub fn delivers(&self, what: Wanted, name: &str, bytes: Vec<u8>) {
        let mut wanted = self.wanted;
        wanted.set(None);
        match what {
            Wanted::Import => {
                self.editor
                    .borrow_mut()
                    .session
                    .handle_imported(name, bytes);
                self.books(Pacing::said);
            }
            other => {
                let Some(asset) = blockworx_editor::import::interpret(name, bytes) else {
                    self.failed(format!("{name} is not a PNG or an SVG"));
                    return;
                };
                self.say(Event::Action(match other {
                    Wanted::Icon(block) => Action::SetIcon { block, asset },
                    _ => Action::PlaceImage { asset },
                }));
            }
        }
    }

    /// A document dropped on the diagram, embedded as a block of this one.
    ///
    /// No door: an embed is a copy of the arriving drawing, so nothing is
    /// laid down in the origin and the session keeps its document throughout.
    /// Filing a document is the Diagrams section's drop ([`Self::imports_archive`]).
    pub fn embeds(&self, name: &str, bytes: &[u8]) {
        self.editor
            .borrow_mut()
            .session
            .handle_embedded(name, bytes);
        self.books(Pacing::said);
    }

    /// The container `named`, packed and handed to the browser to save.
    async fn delivers_archive(&self, named: &blockworx_store::storage::Name) -> Result<(), String> {
        let archive = self.library.packs(named).await?;
        let file = format!("{named}.zip");
        download(&file, "application/zip", &archive)
            .map_err(|refused| format!("Could not save {file}: {refused:?}"))
    }

    /// Give the document back and let the frame run again.
    fn takes_back(&self, stood: Stood) {
        {
            let mut editor = self.editor.borrow_mut();
            match stood {
                Stood::Carried(doc) => editor.session.doc = doc,
                Stood::Opened(doc) => {
                    editor.session.opens(doc);
                }
            }
            if let Some(named) = editor.session.doc.container_name() {
                self.library.remembers(&named);
            }
            self.owes(Owed(editor.session.doc.pending()));
        }
        self.away.set(false);
        self.books(Pacing::said);
        let Some(door) = self.waiting.borrow_mut().take() else {
            return;
        };
        // What the document still owes the origin goes down before a waiting
        // door can take the document somewhere else.
        if self.editor.borrow().session.doc.pending() > 0 {
            self.waiting.replace(Some(door));
            self.opens_a_door(Door::Drained);
        } else {
            self.opens_a_door(door);
        }
    }

    async fn lists_the_origin(&self) {
        let held = self.library.listing().await;
        let mut signal = self.held;
        if *signal.peek() != held {
            signal.set(held);
        }
    }

    /// The journal, after a frame: what the container owes the origin, made.
    fn drains(&self) {
        let owed = self.editor.borrow().session.doc.pending();
        self.owes(Owed(owed));
        if owed > 0 {
            self.opens_a_door(Door::Drained);
        }
    }

    /// A standing fact about the document, which the notices strip carries
    /// until it is acknowledged — as the desktop's library reports one.
    pub fn reports(&self, what: impl Into<String>) {
        let what = what.into();
        tracing::error!("{what}");
        self.editor.borrow_mut().session.failures.report(what);
        self.books(Pacing::said);
    }

    /// A file pick was cancelled. Opening the picker changed nothing, so
    /// there is nothing to put back — only the record of the flow to drop.
    pub fn unpicked(&self) {
        let mut wanted = self.wanted;
        wanted.set(None);
    }

    /// The face the diagram is drawn in — which the in-place editor types in
    /// too, so the draft and what it covers are the same letters.
    #[must_use]
    pub fn typeface(&self) -> FontChoice {
        use blockworx_paint::TextLayout as _;
        self.editor.borrow().glyphs.typeface()
    }

    /// Say a thing happened, and book the frame that reads it.
    pub fn say(&self, event: Event) {
        self.batch.borrow_mut().events.push(event);
        self.books(Pacing::said);
    }

    /// The same, for what the pointer or the keyboard did.
    pub fn sampled(&self, sample: Sample) {
        self.batch.borrow_mut().samples.push(sample);
        self.books(Pacing::said);
    }

    /// The canvas is in the document: take its context, size its backing
    /// store, and tell the session how big the diagram is.
    pub fn mounted(&self, canvas: HtmlCanvasElement) {
        let Some(ctx) = context_of(&canvas) else {
            tracing::error!("the canvas has no 2d context");
            return;
        };
        let _ = canvas.focus();
        self.editor.borrow_mut().surface = Some(Surface { canvas, ctx });
        // The page's own placeholder stands until there is a diagram to put
        // in its place, which is now.
        if let Some(loading) = window()
            .and_then(|window| window.document())
            .and_then(|document| document.get_element_by_id("bw-loading"))
        {
            loading.remove();
        }
        self.resized();
    }

    /// The canvas changed size: the backing store follows the display, and
    /// the session is told the viewport it now paints in.
    pub fn resized(&self) {
        let Some(window) = window() else {
            return;
        };
        let viewport = {
            let editor = self.editor.borrow();
            let Some(surface) = &editor.surface else {
                return;
            };
            let viewport = fit(
                &surface.canvas,
                &surface.ctx,
                css_size(&surface.canvas),
                DevicePixelRatio::of(&window),
            );
            editor.repaints(viewport);
            viewport
        };
        self.say(Event::Viewport(viewport));
        self.says_the_safe_region(viewport);
    }

    /// `band` lies over the diagram at `at`, in the canvas's own coordinates.
    /// Measured by the band itself and re-measured when it moves, never
    /// cached: what a framing has to stay clear of is where the chrome *is*,
    /// not where it was laid out.
    pub fn covers(&self, band: Band, at: Rect) {
        {
            let mut editor = self.editor.borrow_mut();
            match editor.bands.iter_mut().find(|(which, _)| *which == band) {
                Some(stood) if stood.1 == at => return,
                Some(stood) => stood.1 = at,
                None => editor.bands.push((band, at)),
            }
        }
        let viewport = self.editor.borrow().session.viewport();
        self.says_the_safe_region(viewport);
    }

    /// Where the canvas's top-left sits in client coordinates, which a
    /// pointer event is read against.
    #[must_use]
    pub fn origin(&self) -> Option<Pos2> {
        let editor = self.editor.borrow();
        let bounds = editor.surface.as_ref()?.canvas.get_bounding_client_rect();
        Some(pos2(bounds.left() as f32, bounds.top() as f32))
    }

    /// Take the pointer for the gesture and the keyboard for the canvas, so a
    /// drag that leaves the element still arrives and the keys are read.
    pub fn grabs(&self, pointer: i32) {
        let editor = self.editor.borrow();
        let Some(surface) = &editor.surface else {
            return;
        };
        let _ = surface.canvas.set_pointer_capture(pointer);
        let _ = surface.canvas.focus();
    }

    /// The keyboard goes back to the canvas: a field that closes leaves the
    /// focus on the page's body otherwise, where no digit arms a tool.
    pub fn takes_keyboard(&self) {
        let editor = self.editor.borrow();
        if let Some(surface) = &editor.surface {
            let _ = surface.canvas.focus();
        }
    }

    fn says_the_safe_region(&self, viewport: Rect) {
        let over: Vec<Rect> = self
            .editor
            .borrow()
            .bands
            .iter()
            .map(|(_, at)| *at)
            .collect();
        let clear = clear_of(viewport, &over);
        let mut safe = self.safe;
        if *safe.peek() != clear {
            safe.set(clear);
        }
        self.say(Event::Safe(clear));
    }

    fn books(&self, ask: impl FnOnce(&mut Pacing) -> Schedule) {
        let mut pacing = self.pacing.get();
        let schedule = ask(&mut pacing);
        self.pacing.set(pacing);
        self.book(schedule);
    }

    fn book(&self, schedule: Schedule) {
        let Some(window) = window() else {
            return;
        };
        match schedule {
            Schedule::Idle => {}
            Schedule::Frame => {
                let shell = self.clone();
                let _ = request_animation_frame(&window, move || shell.frame());
            }
            Schedule::Timer { ticket, after } => {
                let shell = self.clone();
                let _ = set_timeout(&window, after, move || {
                    shell.books(|pacing| pacing.woke(ticket));
                });
            }
        }
    }

    /// One frame: what was said, run and shown.
    ///
    /// A frame while a door is open would find a document that is not there,
    /// so it stands off; what was said keeps until the door closes and books
    /// the frame that reads it. The wait is one origin write per owed row, so
    /// what it costs at worst is the frame after a commit lands.
    fn frame(&self) {
        self.books(Pacing::entered);
        if self.away.get() {
            return;
        }
        let batch = self.assemble();
        let (view, refused, raised, metered) = {
            let mut editor = self.editor.borrow_mut();
            let view = editor.run(batch);
            (
                view,
                std::mem::take(&mut editor.refused),
                std::mem::take(&mut editor.raised),
                editor.metered,
            )
        };
        if view.frame_rate == FrameRate::Shown {
            let mut frames = self.frames;
            frames.set(metered);
        }
        for refusal in refused {
            self.failed(refusal);
        }
        // Performed after the borrow is given up: a door that opens a picker
        // writes a signal this shell holds, not one the editor does.
        for effect in raised {
            self.performs(&effect);
        }
        let shown = Chrome::of(&view);
        if *self.chrome.peek() != shown {
            let mut chrome = self.chrome;
            chrome.set(shown);
        }
        self.books(|pacing| pacing.ran(view.repaint));
        self.drains();
    }

    /// The batch as the call takes it: what time it is, then what was said,
    /// then what the browser told the canvas.
    fn assemble(&self) -> Vec<Event> {
        let Batch { events, samples } = std::mem::take(&mut *self.batch.borrow_mut());
        let focus = focus();
        let mut batch = Vec::with_capacity(events.len() + samples.len() + 2);
        if let Some(tick) = window().and_then(|window| tick(&window)) {
            batch.push(Event::Tick(tick));
        }
        batch.extend(events);
        let read = self.editor.borrow_mut().reader.read(&samples, focus);
        batch.extend(read.moves.into_iter().map(Event::Move));
        batch.extend(read.input.raw.into_iter().map(Event::Pointer));
        batch.push(Event::Keys(read.input.keys));
        batch
    }
}

impl Editor {
    /// What an export is called, which sheet it is stamped with and which
    /// palette it prints in are the shell's facts, not the document's, so the
    /// session is told them before it draws its chrome or is told to do
    /// anything. The breadcrumb's root segment is the same name.
    fn states_the_sheet(&mut self) {
        // Nothing opens a document from anywhere yet, so a session with no
        // container is Untitled and a named one is called what its container
        // is; the library's recents join this when there is one.
        let name = self.session.document_name(None);
        let rev = self.session.viewed_repo().rev();
        self.session.sheet = Sheet {
            block: TitleBlock {
                name: name.clone(),
                author: self.session.identity.name.clone(),
                rev,
                date: self.session.written_at(rev).map(history::date),
                from: None,
            },
            name,
            scheme: self.dressed.scheme,
        };
    }

    /// The call, its hand-offs delivered and its diagram painted.
    fn run(&mut self, batch: Vec<Event>) -> View {
        self.states_the_sheet();
        let clock = || window().as_ref().and_then(clock_of);
        let started = clock();
        let mut view = kernel(&mut self.session, batch, &self.glyphs);
        let answered = clock();
        for handoff in std::mem::take(&mut view.handoffs) {
            self.deliver(handoff);
        }
        self.raised.append(&mut view.effects);
        let painting = clock();
        let owed = self.shows(Diagram::of(&mut view), view.viewport);
        if let (Some(started), Some(answered), Some(painting), Some(painted)) =
            (started, answered, painting, clock())
        {
            self.metered = Some(self.meter.record(Frame {
                at: started,
                kernel: answered.saturating_sub(started),
                paint: painted.saturating_sub(painting),
            }));
        }
        self.wears(view.cursor);
        // A mark whose artwork is still decoding owes a frame the kernel
        // knows nothing about: the browser, not the editor, is what it waits
        // on.
        if owed == Repaint::Owed {
            view.repaint = Some(view.repaint.unwrap_or(Duration::ZERO));
        }
        view
    }

    fn deliver(&mut self, handoff: Handoff) {
        match handoff {
            Handoff::Asset { hash, asset } => self.images.register(hash, &asset),
            Handoff::Clipboard(text) => {
                if let Err(refused) = clipboard_write(&text) {
                    self.refused
                        .push(format!("The clipboard refused the copy: {refused:?}"));
                }
            }
            Handoff::Export { content, name } => {
                let named = format!("{name}.{}", content.extension());
                if let Err(refused) = download(&named, content.mime(), &bytes_for(&content)) {
                    self.refused
                        .push(format!("Could not save {named}: {refused:?}"));
                }
            }
        }
    }

    /// Paint `diagram` over `viewport`, and keep it.
    fn shows(&mut self, diagram: Diagram, viewport: Rect) -> Repaint {
        let owed = self.paint(&diagram, viewport);
        let reground = self
            .diagram
            .as_ref()
            .is_none_or(|was| was.ground.background != diagram.ground.background);
        if reground {
            grounds_the_page(diagram.ground.background);
        }
        self.diagram = Some(diagram);
        owed
    }

    /// The kept diagram, back over a backing store a resize has just cleared —
    /// where it stood, until the call the resize books draws it for the new
    /// size.
    fn repaints(&self, viewport: Rect) {
        if let Some(diagram) = &self.diagram {
            self.paint(diagram, viewport);
        }
    }

    fn paint(&self, diagram: &Diagram, viewport: Rect) -> Repaint {
        let Some(surface) = &self.surface else {
            return Repaint::Settled;
        };
        paint_ground(&surface.ctx, viewport, diagram.vantage, diagram.ground);
        replay(&diagram.draw_list, &surface.ctx, &self.images, &self.glyphs)
    }

    fn wears(&self, cursor: Option<blockworx_paint::Cursor>) {
        let Some(surface) = &self.surface else {
            return;
        };
        let shape = cursor.map_or("default", css_cursor);
        let _ = surface.canvas.style().set_property("cursor", shape);
    }
}

/// The part of `viewport` the chrome leaves clear: each band taken off the
/// edge it hugs, at the shallowest inset that clears it. A band that touches
/// no edge — glass floating over the middle of the diagram — takes nothing
/// off: a framing may pass under it, since glass is not a wall.
#[must_use]
pub fn clear_of(viewport: Rect, bands: &[Rect]) -> Rect {
    bands.iter().fold(viewport, |clear, band| {
        let band = band.intersect(clear);
        if band.width() <= 0.0 || band.height() <= 0.0 {
            return clear;
        }
        let hugged = [
            (
                band.min.x <= clear.min.x,
                band.max.x - clear.min.x,
                Edge::Left,
            ),
            (
                band.max.x >= clear.max.x,
                clear.max.x - band.min.x,
                Edge::Right,
            ),
            (
                band.min.y <= clear.min.y,
                band.max.y - clear.min.y,
                Edge::Top,
            ),
            (
                band.max.y >= clear.max.y,
                clear.max.y - band.min.y,
                Edge::Bottom,
            ),
        ];
        let Some(&(_, depth, edge)) = hugged
            .iter()
            .filter(|(hugs, _, _)| *hugs)
            .min_by(|(_, a, _), (_, b, _)| a.total_cmp(b))
        else {
            return clear;
        };
        match edge {
            Edge::Left => Rect::from_min_max(pos2(clear.min.x + depth, clear.min.y), clear.max),
            Edge::Right => Rect::from_min_max(clear.min, pos2(clear.max.x - depth, clear.max.y)),
            Edge::Top => Rect::from_min_max(pos2(clear.min.x, clear.min.y + depth), clear.max),
            Edge::Bottom => Rect::from_min_max(clear.min, pos2(clear.max.x, clear.max.y - depth)),
        }
    })
}

/// Which edge of the viewport a band hugs.
#[derive(Clone, Copy, PartialEq, Eq, Debug)]
enum Edge {
    Left,
    Right,
    Top,
    Bottom,
}

/// Whose keyboard it is, as the canvas's own reading of Escape, Delete and
/// Shift is scoped by.
fn focus() -> Focus {
    window()
        .and_then(|window| window.document())
        .map_or(Focus::Elsewhere, |document| focus_of(&document))
}

/// Whose keyboard it is: a field's while one is being typed into, and the
/// canvas's otherwise — a button a press left the focus on types nothing.
fn focus_of(document: &Document) -> Focus {
    match document.active_element() {
        Some(active) if types_into(&active) => Focus::Elsewhere,
        _ => Focus::Canvas,
    }
}

/// Whether `element` takes typing, and so keeps the keys it is given.
#[must_use]
pub fn types_into(element: &web_sys::Element) -> bool {
    matches!(element.tag_name().as_str(), "INPUT" | "TEXTAREA" | "SELECT")
        || element
            .dyn_ref::<HtmlElement>()
            .is_some_and(HtmlElement::is_content_editable)
}

/// Stand the page on the diagram's ground, which is what shows through while a
/// resize has cleared the canvas.
fn grounds_the_page(ground: blockworx_paint::Color) {
    let Some(root) = window()
        .and_then(|window| window.document())
        .and_then(|document| document.document_element())
        .and_then(|root| root.dyn_into::<HtmlElement>().ok())
    else {
        return;
    };
    let _ = root.style().set_property("--bw-ground", &css_color(ground));
}

/// The frame clock, monotonic since the page was opened. The interval the
/// session animates over is its own to predict.
fn tick(window: &Window) -> Option<Tick> {
    clock_of(window).map(Tick::at)
}

/// How long the page has been open.
fn clock_of(window: &Window) -> Option<Duration> {
    let now = window.performance()?.now();
    Some(Duration::from_secs_f64(now.max(0.0) / 1_000.0))
}

/// How long since `started`, for a log line that times a write.
fn elapsed(started: Option<Duration>) -> Option<Duration> {
    let now = window().as_ref().and_then(clock_of)?;
    Some(now.saturating_sub(started?))
}

fn css_size(canvas: &HtmlCanvasElement) -> Vec2 {
    let bounds = canvas.get_bounding_client_rect();
    vec2(bounds.width() as f32, bounds.height() as f32)
}

fn context_of(canvas: &HtmlCanvasElement) -> Option<CanvasRenderingContext2d> {
    canvas
        .get_context("2d")
        .ok()
        .flatten()
        .and_then(|ctx| ctx.dyn_into::<CanvasRenderingContext2d>().ok())
}

fn request_animation_frame(window: &Window, run: impl FnOnce() + 'static) -> Result<(), JsValue> {
    let once = Closure::once_into_js(run);
    window.request_animation_frame(once.unchecked_ref())?;
    Ok(())
}

/// Run `work` on the page's own task queue — where every door onto the
/// origin is awaited, since the frame that shares the document cannot wait
/// with it.
///
/// Off the browser there is no queue and nothing in `work` could answer, so
/// the future is dropped unstarted: a snapshot renders the chrome a door has
/// not been walked through.
pub fn spawn(work: impl core::future::Future<Output = ()> + 'static) {
    #[cfg(target_arch = "wasm32")]
    wasm_bindgen_futures::spawn_local(work);
    #[cfg(not(target_arch = "wasm32"))]
    drop(work);
}

/// The page this shell is running in, or nothing where there is no page.
///
/// Off the browser every one of these calls is a JavaScript import that is
/// not there, so asking at all would panic rather than answer — which is what
/// would happen in the snapshot tests, where the chrome is rendered with no
/// browser under it at all.
#[must_use]
pub fn window() -> Option<Window> {
    #[cfg(target_arch = "wasm32")]
    {
        web_sys::window()
    }
    #[cfg(not(target_arch = "wasm32"))]
    {
        None
    }
}

/// Do `then` once `delay` has passed — the chrome's own clock, for the two
/// things that are a matter of time rather than of state: a confirmation's
/// dwell and the window a double click is told from a single one.
///
/// Off a browser there is no clock, so nothing happens: a snapshot renders
/// what the page looks like now, not what it will look like in two seconds.
pub fn after(delay: Duration, then: impl FnOnce() + 'static) {
    if let Some(window) = window() {
        let _ = set_timeout(&window, delay, then);
    }
}

/// Where an element of the chrome sits over the diagram, in the canvas's own
/// coordinates — the two share a positioned parent, so the offsets are
/// already those.
#[must_use]
pub fn measured(element: &web_sys::Element) -> Option<Rect> {
    let band = element.dyn_ref::<web_sys::HtmlElement>()?;
    Some(Rect::from_min_size(
        pos2(band.offset_left() as f32, band.offset_top() as f32),
        vec2(band.offset_width() as f32, band.offset_height() as f32),
    ))
}

fn set_timeout(
    window: &Window,
    after: Duration,
    run: impl FnOnce() + 'static,
) -> Result<(), JsValue> {
    let once = Closure::once_into_js(run);
    window.set_timeout_with_callback_and_timeout_and_arguments_0(
        once.unchecked_ref(),
        after.as_millis().min(i32::MAX as u128) as i32,
    )?;
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    const VIEWPORT: Rect = Rect::from_min_max(pos2(0.0, 0.0), pos2(800.0, 600.0));

    fn band(min: Pos2, size: Vec2) -> Rect {
        Rect::from_min_size(min, size)
    }

    #[test]
    fn nothing_over_the_diagram_leaves_the_whole_viewport_clear() {
        assert_eq!(clear_of(VIEWPORT, &[]), VIEWPORT);
    }

    #[test]
    fn a_band_along_an_edge_is_taken_off_that_edge() {
        let status = band(pos2(0.0, 560.0), vec2(240.0, 40.0));
        assert!(
            VIEWPORT.intersects(status),
            "a band off the diagram would prove nothing",
        );
        assert_eq!(
            clear_of(VIEWPORT, &[status]),
            Rect::from_min_max(VIEWPORT.min, pos2(800.0, 560.0)),
        );
        let strip = band(pos2(0.0, 0.0), vec2(800.0, 54.0));
        assert_eq!(
            clear_of(VIEWPORT, &[strip]),
            Rect::from_min_max(pos2(0.0, 54.0), VIEWPORT.max),
        );
    }

    /// Two bands each take their own edge off, and the order they are
    /// measured in does not change the answer.
    #[test]
    fn bands_on_two_edges_are_both_taken_off() {
        let strip = band(pos2(0.0, 0.0), vec2(800.0, 54.0));
        let status = band(pos2(0.0, 560.0), vec2(240.0, 40.0));
        let clear = Rect::from_min_max(pos2(0.0, 54.0), pos2(800.0, 560.0));
        assert_eq!(clear_of(VIEWPORT, &[strip, status]), clear);
        assert_eq!(clear_of(VIEWPORT, &[status, strip]), clear);
    }

    /// Glass floating in the middle of the diagram is not a wall: a framing
    /// may pass under it.
    #[test]
    fn a_band_in_the_middle_takes_nothing_off() {
        let popup = band(pos2(300.0, 250.0), vec2(200.0, 100.0));
        assert_eq!(clear_of(VIEWPORT, &[popup]), VIEWPORT);
    }
}