src/wheel_host/wheel_host.cpp - GCC Code Coverage Report

src/wheel_host/wheel_host.cpp

Line	Branch	Exec	Source
1			/**
2			* @file wheel_host.cpp
3			* @brief Implements the resident broker behind the wheel host C ABI.
4			*/
5
6			#include "DetourModKit/abi/wheel_host.h"
7
8			#include <windows.h>
9
10			#include <algorithm>
11			#include <array>
12			#include <atomic>
13			#include <cstdint>
14			#include <limits>
15
16			namespace
17			{
18			constexpr std::uint64_t CAPTURE_ENABLED_BIT = 1u;
19			constexpr std::uint64_t CAPTURE_FOCUS_BIT = 2u;
20			constexpr std::uint64_t CAPTURE_FLAG_MASK = CAPTURE_ENABLED_BIT \| CAPTURE_FOCUS_BIT;
21			constexpr int CAPTURE_EPOCH_SHIFT = 2;
22			constexpr int COUNT_BITS = 11;
23			constexpr std::uint64_t COUNT_MASK = (std::uint64_t{1} << COUNT_BITS) - 1u;
24			constexpr std::uint32_t MAX_COUNT = 1024;
25			constexpr int REMAINDER_BITS = 8;
26			constexpr std::uint64_t REMAINDER_MASK = (std::uint64_t{1} << REMAINDER_BITS) - 1u;
27			constexpr std::uint64_t REMAINDER_OWNED_BIT = std::uint64_t{1} << REMAINDER_BITS;
28			constexpr int REMAINDER_EPOCH_SHIFT = REMAINDER_BITS + 1;
29			// pack_remainder biases by WHEEL_DELTA, so the encoded value spans 0 through 2 * WHEEL_DELTA - 1.
30			static_assert(2 * WHEEL_DELTA <= (1 << REMAINDER_BITS), "a biased sub-notch remainder must fit the value field");
31			constexpr int CONSUME_EPOCH_SHIFT = 4;
32			constexpr std::uint32_t CONSUME_MASK = (1u << DMK_WHEEL_DIRECTIONS) - 1u;
33			constexpr std::uint64_t MAX_EPOCH = std::numeric_limits<std::uint64_t>::max() >> COUNT_BITS;
34
35			/// Bounds every control-plane wait for admitted callback phases.
36			constexpr std::uint32_t DEFAULT_DRAIN_TIMEOUT_MS = 2000;
37
38			class ControlLock
39			{
40			public:
41		4859	explicit ControlLock(SRWLOCK &lock) noexcept : m_lock(&lock) { AcquireSRWLockExclusive(m_lock); }
42		4859	~ControlLock() noexcept { ReleaseSRWLockExclusive(m_lock); }
43
44			ControlLock(const ControlLock &) = delete;
45			ControlLock &operator=(const ControlLock &) = delete;
46
47			private:
48			SRWLOCK *m_lock;
49			};
50
51		1030	[[nodiscard]] std::uint64_t next_nonzero(std::uint64_t value, std::uint64_t maximum) noexcept
52			{
53	1/2 ✓ Branch 2 → 3 taken 1030 times. ✗ Branch 2 → 4 not taken.	1030	return value >= maximum ? 1u : value + 1u;
54			}
55
56		2008	[[nodiscard]] constexpr std::uint64_t pack_capture(std::uint64_t epoch, std::uint64_t flags) noexcept
57			{
58		2008	return (epoch << CAPTURE_EPOCH_SHIFT) \| (flags & CAPTURE_FLAG_MASK);
59			}
60
61		64	[[nodiscard]] std::uint64_t capture_epoch(std::uint64_t state) noexcept
62			{
63		64	return state >> CAPTURE_EPOCH_SHIFT;
64			}
65
66		7702	[[nodiscard]] constexpr std::uint64_t pack_count(std::uint64_t epoch, std::uint32_t count) noexcept
67			{
68		7702	return (epoch << COUNT_BITS) \| std::min(count, MAX_COUNT);
69			}
70
71		5102	[[nodiscard]] std::uint64_t count_epoch(std::uint64_t state) noexcept
72			{
73		5102	return state >> COUNT_BITS;
74			}
75
76		5102	[[nodiscard]] std::uint32_t unpack_count(std::uint64_t state) noexcept
77			{
78		5102	return static_cast<std::uint32_t>(state & COUNT_MASK);
79			}
80
81		1325	[[nodiscard]] constexpr std::uint64_t pack_remainder(std::uint64_t epoch, bool owned, int remainder) noexcept
82			{
83		1325	const int shifted = remainder + WHEEL_DELTA;
84		1325	const auto encoded = static_cast<std::uint64_t>(shifted);
85	2/2 ✓ Branch 2 → 3 taken 6 times. ✓ Branch 2 → 4 taken 1319 times.	1325	return (epoch << REMAINDER_EPOCH_SHIFT) \| (owned ? REMAINDER_OWNED_BIT : 0u) \| encoded;
86			}
87
88		25	[[nodiscard]] std::uint64_t remainder_epoch(std::uint64_t state) noexcept
89			{
90		25	return state >> REMAINDER_EPOCH_SHIFT;
91			}
92
93		25	[[nodiscard]] bool remainder_owned(std::uint64_t state) noexcept
94			{
95		25	return (state & REMAINDER_OWNED_BIT) != 0;
96			}
97
98		20	[[nodiscard]] int unpack_remainder(std::uint64_t state) noexcept
99			{
100		20	return static_cast<int>(state & REMAINDER_MASK) - WHEEL_DELTA;
101			}
102
103		2008	[[nodiscard]] constexpr std::uint64_t pack_consume(std::uint64_t epoch, std::uint32_t mask) noexcept
104			{
105		2008	return (epoch << CONSUME_EPOCH_SHIFT) \| (mask & CONSUME_MASK);
106			}
107
108			/// The control operation whose failure left a transaction pending. control_state_of() names each one.
109			enum class PendingOp : std::uint8_t
110			{
111			None,
112			Close,
113			Retarget,
114			Stop
115			};
116
117			struct HostState
118			{
119			SRWLOCK control_lock = SRWLOCK_INIT;
120			bool started = false;
121			bool stopping = false;
122			HHOOK hook = nullptr;
123			HANDLE target_thread = nullptr;
124			std::uint32_t target_thread_id = 0;
125			std::uint32_t route_state = DMK_WHEELHOST_ROUTE_TARGET_WAIT;
126			std::uint64_t mount_generation = 0;
127			std::uint64_t host_identity = 0;
128			std::uint64_t lease = 0;
129			std::uint64_t owner = 0;
130			std::uint64_t generation = 0;
131			std::uint64_t epoch = 1;
132			std::uint64_t lease_counter = 0;
133			std::uint64_t identity_counter = 0;
134			PendingOp pending_op = PendingOp::None;
135			std::uint64_t pending_lease = 0;
136			std::uint64_t pending_owner = 0;
137			std::uint64_t pending_generation = 0;
138			// The host owns the mount worker and its request-response rendezvous. See mount_resident_hook().
139			HANDLE mount_thread = nullptr;
140			HANDLE mount_request = nullptr;
141			HANDLE mount_done = nullptr;
142			std::uint32_t mount_request_tid = 0;
143			HHOOK mount_result = nullptr;
144			// Counts resident callback frames inside an admission phase. Nested message loops can hold several at once.
145			std::atomic<std::uint32_t> admitted_phases{0};
146			std::atomic<std::uint64_t> capture_state{pack_capture(1, 0)};
147			std::atomic<std::uint64_t> consume_state{pack_consume(1, 0)};
148			std::atomic<std::uint64_t> consume_deadline_ms{0};
149			std::array<std::atomic<std::uint64_t>, 2> remainder{pack_remainder(1, false, 0), pack_remainder(1, false, 0)};
150			std::array<std::atomic<std::uint64_t>, DMK_WHEEL_DIRECTIONS>
151			counts{pack_count(1, 0), pack_count(1, 0), pack_count(1, 0), pack_count(1, 0)};
152
153		650	void reset_data_plane(std::uint64_t active_epoch) noexcept
154			{
155	2/2 ✓ Branch 13 → 3 taken 1300 times. ✓ Branch 13 → 14 taken 650 times.	1950	for (auto &slot : remainder)
156			{
157		1300	slot.store(pack_remainder(active_epoch, false, 0), std::memory_order_release);
158			}
159	2/2 ✓ Branch 25 → 15 taken 2600 times. ✓ Branch 25 → 26 taken 650 times.	3250	for (auto &slot : counts)
160			{
161		2600	slot.store(pack_count(active_epoch, 0), std::memory_order_release);
162			}
163		650	}
164
165		650	void invalidate_capture() noexcept
166			{
167		650	epoch = next_nonzero(epoch, MAX_EPOCH);
168		650	capture_state.store(pack_capture(epoch, 0), std::memory_order_seq_cst);
169		650	consume_state.store(pack_consume(epoch, 0), std::memory_order_release);
170		650	consume_deadline_ms.store(0, std::memory_order_relaxed);
171		650	reset_data_plane(epoch);
172		650	}
173			};
174
175			constinit HostState g_host;
176
177			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
178			using HookProbe = void(DMK_WHEELHOST_CALL *)(void);
179			std::atomic<HookProbe> g_hook_probe{nullptr};
180			std::atomic<HookProbe> g_finalize_probe{nullptr};
181			std::atomic<bool> g_force_unhook_failure{false};
182			std::atomic<std::uint32_t> g_drain_timeout_override_ms{0};
183			std::atomic<std::int32_t> g_process_focus_override{-1};
184			#endif
185
186		333	[[nodiscard]] std::uint32_t drain_timeout_ms() noexcept
187			{
188			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
189		333	const std::uint32_t override_ms = g_drain_timeout_override_ms.load(std::memory_order_acquire);
190	2/2 ✓ Branch 9 → 10 taken 12 times. ✓ Branch 9 → 11 taken 321 times.	333	if (override_ms != 0)
191			{
192		12	return override_ms;
193			}
194			#endif
195		321	return DEFAULT_DRAIN_TIMEOUT_MS;
196			}
197
198			/**
199			* @brief Waits, bounded, for every admitted callback phase to leave.
200			* @details Runs only on the control plane, after invalidate_capture() advanced the epoch. A parked lower-hook
201			* frame holds no phase, so this waits only on the short allocation-free admission windows.
202			* @note Requires g_host.control_lock.
203			*/
204		333	[[nodiscard]] bool drain_admitted_phases() noexcept
205			{
206		333	const std::uint64_t deadline_ms = GetTickCount64() + drain_timeout_ms();
207	2/2 ✓ Branch 16 → 5 taken 1595709 times. ✓ Branch 16 → 17 taken 327 times.	1596369	while (g_host.admitted_phases.load(std::memory_order_seq_cst) != 0)
208			{
209	2/2 ✓ Branch 6 → 7 taken 6 times. ✓ Branch 6 → 8 taken 1595703 times.	1595709	if (GetTickCount64() >= deadline_ms)
210			{
211		6	return false;
212			}
213		1595703	Sleep(0);
214			}
215		327	return true;
216			}
217
218			/// Projects the internal transaction onto the ABI control state. Every PendingOp value is nameable.
219		1335	[[nodiscard]] constexpr std::uint32_t control_state_of(PendingOp op) noexcept
220			{
221	4/5 ✓ Branch 2 → 3 taken 1 time. ✓ Branch 2 → 4 taken 6 times. ✓ Branch 2 → 5 taken 1 time. ✓ Branch 2 → 6 taken 1327 times. ✗ Branch 2 → 7 not taken.	1335	switch (op)
222			{
223		1	case PendingOp::Close:
224		1	return DMK_WHEELHOST_CONTROL_CLOSE_PENDING;
225		6	case PendingOp::Retarget:
226		6	return DMK_WHEELHOST_CONTROL_RETARGET_PENDING;
227		1	case PendingOp::Stop:
228		1	return DMK_WHEELHOST_CONTROL_STOP_PENDING;
229		1327	case PendingOp::None:
230		1327	break;
231			}
232		1327	return DMK_WHEELHOST_CONTROL_IDLE;
233			}
234
235			/// Requires g_host.control_lock. Clears any pending control transaction.
236		114	void clear_pending() noexcept
237			{
238		114	g_host.pending_op = PendingOp::None;
239		114	g_host.pending_lease = 0;
240		114	g_host.pending_owner = 0;
241		114	g_host.pending_generation = 0;
242		114	}
243
244		4642	[[nodiscard]] bool valid_context(void *host_context) noexcept
245			{
246		4642	return host_context == &g_host;
247			}
248
249		59	[[nodiscard]] bool is_wheel(UINT message) noexcept
250			{
251	4/4 ✓ Branch 2 → 3 taken 31 times. ✓ Branch 2 → 4 taken 28 times. ✓ Branch 3 → 4 taken 3 times. ✓ Branch 3 → 5 taken 28 times.	59	return message == WM_MOUSEWHEEL \|\| message == WM_MOUSEHWHEEL;
252			}
253
254			/// Reports whether this process owns the foreground window.
255		2	[[nodiscard]] bool process_owns_foreground() noexcept
256			{
257			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
258	1/2 ✓ Branch 9 → 10 taken 2 times. ✗ Branch 9 → 11 not taken.	2	if (const std::int32_t override_value = g_process_focus_override.load(std::memory_order_acquire);
259			override_value >= 0)
260			{
261		2	return override_value != 0;
262			}
263			#endif
264		✗	const HWND foreground = GetForegroundWindow();
265	0/2 ✗ Branch 12 → 13 not taken. ✗ Branch 12 → 14 not taken.	✗	if (foreground == nullptr)
266			{
267		✗	return false;
268			}
269		✗	DWORD pid = 0;
270		✗	GetWindowThreadProcessId(foreground, &pid);
271		✗	return pid == GetCurrentProcessId();
272			}
273
274		28	[[nodiscard]] bool direction_consumed(std::uint64_t epoch, std::uint32_t direction_bit) noexcept
275			{
276		28	const std::uint64_t state = g_host.consume_state.load(std::memory_order_acquire);
277	3/4 ✓ Branch 9 → 10 taken 28 times. ✗ Branch 9 → 11 not taken. ✓ Branch 10 → 11 taken 19 times. ✓ Branch 10 → 12 taken 9 times.	28	if ((state >> CONSUME_EPOCH_SHIFT) != epoch \|\| (state & direction_bit) == 0)
278			{
279		19	return false;
280			}
281		18	return GetTickCount64() < g_host.consume_deadline_ms.load(std::memory_order_relaxed);
282			}
283
284			/// Brackets one admitted callback phase. Allocation-free, nonblocking, and free of host locks.
285			class PhaseGuard
286			{
287			public:
288		35	PhaseGuard() noexcept { g_host.admitted_phases.fetch_add(1, std::memory_order_seq_cst); }
289		35	~PhaseGuard() noexcept { g_host.admitted_phases.fetch_sub(1, std::memory_order_seq_cst); }
290			PhaseGuard(const PhaseGuard &) = delete;
291			PhaseGuard &operator=(const PhaseGuard &) = delete;
292			};
293
294		25	[[nodiscard]] int fold_axis(std::atomic<std::uint64_t> &slot, std::uint64_t epoch, bool owned, int delta) noexcept
295			{
296		50	std::uint64_t observed = slot.load(std::memory_order_acquire);
297			for (;;)
298			{
299	1/2 ✗ Branch 11 → 12 not taken. ✓ Branch 11 → 13 taken 25 times.	25	if (remainder_epoch(observed) != epoch)
300			{
301		✗	return 0;
302			}
303	2/2 ✓ Branch 14 → 15 taken 20 times. ✓ Branch 14 → 16 taken 5 times.	25	const int prior = remainder_owned(observed) == owned ? unpack_remainder(observed) : 0;
304		25	const int total = prior + delta;
305		25	const int notches = total / WHEEL_DELTA;
306		25	const std::uint64_t desired = pack_remainder(epoch, owned, total % WHEEL_DELTA);
307	1/2 ✓ Branch 23 → 24 taken 25 times. ✗ Branch 23 → 25 not taken.	50	if (slot.compare_exchange_weak(observed, desired, std::memory_order_acq_rel, std::memory_order_acquire))
308			{
309		25	return notches;
310			}
311		✗	}
312			}
313
314		18	void bump_count(std::size_t direction, std::uint64_t epoch, std::uint32_t increment) noexcept
315			{
316		18	auto &slot = g_host.counts[direction];
317		36	std::uint64_t observed = slot.load(std::memory_order_acquire);
318			for (;;)
319			{
320	1/2 ✗ Branch 12 → 13 not taken. ✓ Branch 12 → 14 taken 18 times.	18	if (count_epoch(observed) != epoch)
321			{
322		✗	return;
323			}
324		18	const std::uint32_t current = unpack_count(observed);
325		18	const std::uint32_t next = std::min<std::uint32_t>(MAX_COUNT, current + increment);
326		18	const std::uint64_t desired = pack_count(epoch, next);
327	1/2 ✓ Branch 22 → 23 taken 18 times. ✗ Branch 22 → 24 not taken.	36	if (slot.compare_exchange_weak(observed, desired, std::memory_order_acq_rel, std::memory_order_acquire))
328			{
329		18	return;
330			}
331		✗	}
332			}
333
334		25	void count_direction(bool horizontal, std::uint64_t epoch, int notches) noexcept
335			{
336	2/2 ✓ Branch 2 → 3 taken 14 times. ✓ Branch 2 → 7 taken 11 times.	25	if (notches > 0)
337			{
338	2/2 ✓ Branch 3 → 4 taken 2 times. ✓ Branch 3 → 5 taken 12 times.	14	bump_count(horizontal ? DMK_WHEEL_RIGHT : DMK_WHEEL_UP, epoch, static_cast<std::uint32_t>(notches));
339			}
340	2/2 ✓ Branch 7 → 8 taken 4 times. ✓ Branch 7 → 12 taken 7 times.	11	else if (notches < 0)
341			{
342	2/2 ✓ Branch 8 → 9 taken 1 time. ✓ Branch 8 → 10 taken 3 times.	4	bump_count(horizontal ? DMK_WHEEL_LEFT : DMK_WHEEL_DOWN, epoch, static_cast<std::uint32_t>(-notches));
343			}
344		25	}
345
346			/**
347			* @brief The resident WH_GETMESSAGE callback.
348			* @details Order contract (v2): count admission runs before CallNextHookEx and mutates nothing in the message,
349			* so older hooks see the original record. CallNextHookEx runs exactly once. Consume finalization runs
350			* after it returns and writes WM_NULL only when the saved intent, epoch, consume mask, TTL, and focus
351			* gate all remain current. A newer hook can rewrite the message after this returns; the consume stays
352			* best effort. Each admitted phase is counted so the control plane can drain decisions.
353			*/
354		59	LRESULT CALLBACK resident_hook(int code, WPARAM wparam, LPARAM lparam) noexcept
355			{
356	1/2 ✗ Branch 2 → 3 not taken. ✓ Branch 2 → 5 taken 59 times.	59	if (code != HC_ACTION)
357			{
358		✗	return CallNextHookEx(nullptr, code, wparam, lparam);
359			}
360
361		59	MSG const message = reinterpret_cast<MSG >(lparam);
362	5/6 ✓ Branch 5 → 6 taken 59 times. ✗ Branch 5 → 8 not taken. ✓ Branch 7 → 8 taken 28 times. ✓ Branch 7 → 9 taken 31 times. ✓ Branch 10 → 11 taken 28 times. ✓ Branch 10 → 13 taken 31 times.	59	if (message == nullptr \|\| !is_wheel(message->message))
363			{
364		28	return CallNextHookEx(nullptr, code, wparam, lparam);
365			}
366
367			// Save the original fields and the entry epoch before any decision.
368		31	const MSG original = *message;
369		31	const std::uint64_t capture = g_host.capture_state.load(std::memory_order_seq_cst);
370	2/2 ✓ Branch 20 → 21 taken 2 times. ✓ Branch 20 → 23 taken 29 times.	31	if ((capture & CAPTURE_ENABLED_BIT) == 0)
371			{
372		2	return CallNextHookEx(nullptr, code, wparam, lparam);
373			}
374
375		29	const bool horizontal = original.message == WM_MOUSEHWHEEL;
376		29	const int delta = static_cast<short>(HIWORD(original.wParam));
377	2/4 ✓ Branch 23 → 24 taken 29 times. ✗ Branch 23 → 25 not taken. ✗ Branch 24 → 25 not taken. ✓ Branch 24 → 27 taken 29 times.	29	if (delta == 0 \|\| wparam != PM_REMOVE)
378			{
379			// PM_NOREMOVE passes through without a counter, remainder, ownership, epoch, or consume change.
380		✗	return CallNextHookEx(nullptr, code, wparam, lparam);
381			}
382
383	4/4 ✓ Branch 27 → 28 taken 3 times. ✓ Branch 27 → 31 taken 26 times. ✓ Branch 28 → 29 taken 2 times. ✓ Branch 28 → 30 taken 1 time.	55	const std::uint32_t direction_bit = horizontal ? (delta > 0 ? DMK_WHEEL_CONSUME_RIGHT : DMK_WHEEL_CONSUME_LEFT)
384	2/2 ✓ Branch 31 → 32 taken 22 times. ✓ Branch 31 → 33 taken 4 times.	26	: (delta > 0 ? DMK_WHEEL_CONSUME_UP : DMK_WHEEL_CONSUME_DOWN);
385		29	const std::uint64_t epoch = capture_epoch(capture);
386			// Count admission: fold, count, and snapshot the consume intent, all before CallNextHookEx.
387		29	bool consume_intent = false;
388			{
389		29	const PhaseGuard phase;
390			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
391	2/2 ✓ Branch 37 → 38 taken 4 times. ✓ Branch 37 → 39 taken 25 times.	29	if (const HookProbe probe = g_hook_probe.load(std::memory_order_acquire); probe != nullptr)
392			{
393		4	probe();
394			}
395			#endif
396		29	const std::uint64_t recheck = g_host.capture_state.load(std::memory_order_seq_cst);
397	3/4 ✓ Branch 47 → 48 taken 26 times. ✓ Branch 47 → 50 taken 3 times. ✓ Branch 48 → 49 taken 26 times. ✗ Branch 48 → 50 not taken.	29	const bool current = capture_epoch(recheck) == epoch && (recheck & CAPTURE_ENABLED_BIT) != 0;
398	3/4 ✓ Branch 51 → 52 taken 1 time. ✓ Branch 51 → 54 taken 28 times. ✗ Branch 53 → 54 not taken. ✓ Branch 53 → 55 taken 1 time.	29	const bool focus_ok = (recheck & CAPTURE_FOCUS_BIT) == 0 \|\| process_owns_foreground();
399	4/4 ✓ Branch 56 → 57 taken 26 times. ✓ Branch 56 → 66 taken 3 times. ✓ Branch 57 → 58 taken 25 times. ✓ Branch 57 → 66 taken 1 time.	29	if (current && focus_ok)
400			{
401		25	const bool owned = direction_consumed(epoch, direction_bit);
402	2/2 ✓ Branch 59 → 60 taken 3 times. ✓ Branch 59 → 61 taken 22 times.	25	const int notches = fold_axis(g_host.remainder[horizontal ? 1u : 0u], epoch, owned, delta);
403		25	count_direction(horizontal, epoch, notches);
404		25	consume_intent = owned;
405			}
406		29	}
407
408			// Pass the original record to older hooks with no DMK mutation, exactly once.
409		29	const LRESULT result = CallNextHookEx(nullptr, code, wparam, lparam);
410
411	2/2 ✓ Branch 68 → 69 taken 23 times. ✓ Branch 68 → 70 taken 6 times.	29	if (!consume_intent)
412			{
413		23	return result;
414			}
415
416			// Consume finalization: the write happens only while every admission condition still holds.
417			{
418		6	const PhaseGuard phase;
419			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
420	2/2 ✓ Branch 72 → 73 taken 3 times. ✓ Branch 72 → 74 taken 3 times.	6	if (const HookProbe probe = g_finalize_probe.load(std::memory_order_acquire); probe != nullptr)
421			{
422		3	probe();
423			}
424			#endif
425		6	const std::uint64_t recheck = g_host.capture_state.load(std::memory_order_seq_cst);
426	3/4 ✓ Branch 82 → 83 taken 4 times. ✓ Branch 82 → 85 taken 2 times. ✓ Branch 83 → 84 taken 4 times. ✗ Branch 83 → 85 not taken.	6	const bool current = capture_epoch(recheck) == epoch && (recheck & CAPTURE_ENABLED_BIT) != 0;
427	3/4 ✓ Branch 86 → 87 taken 1 time. ✓ Branch 86 → 89 taken 5 times. ✗ Branch 88 → 89 not taken. ✓ Branch 88 → 90 taken 1 time.	6	const bool focus_ok = (recheck & CAPTURE_FOCUS_BIT) == 0 \|\| process_owns_foreground();
428	7/8 ✓ Branch 91 → 92 taken 4 times. ✓ Branch 91 → 96 taken 2 times. ✓ Branch 92 → 93 taken 3 times. ✓ Branch 92 → 96 taken 1 time. ✓ Branch 94 → 95 taken 3 times. ✗ Branch 94 → 96 not taken. ✓ Branch 97 → 98 taken 3 times. ✓ Branch 97 → 99 taken 3 times.	6	if (current && focus_ok && direction_consumed(epoch, direction_bit))
429			{
430		3	message->message = WM_NULL;
431		3	message->wParam = 0;
432		3	message->lParam = 0;
433			}
434		6	}
435		6	return result;
436			}
437
438			int32_t DMK_WHEELHOST_CALL
439		373	open_lease(void host_context, std::uint64_t owner, std::uint64_t generation, WheelHostLease out_lease) noexcept
440			{
441	8/10 ✓ Branch 3 → 4 taken 372 times. ✓ Branch 3 → 7 taken 1 time. ✓ Branch 4 → 5 taken 371 times. ✓ Branch 4 → 7 taken 1 time. ✓ Branch 5 → 6 taken 371 times. ✗ Branch 5 → 7 not taken. ✗ Branch 6 → 7 not taken. ✓ Branch 6 → 8 taken 371 times. ✓ Branch 9 → 10 taken 2 times. ✓ Branch 9 → 11 taken 371 times.	373	if (!valid_context(host_context) \|\| out_lease == nullptr \|\| owner == 0 \|\| generation == 0)
442			{
443		2	return DMK_WHEELHOST_ERR_INVALID;
444			}
445		371	*out_lease = 0;
446		371	const ControlLock lock(g_host.control_lock);
447	2/2 ✓ Branch 12 → 13 taken 2 times. ✓ Branch 12 → 14 taken 369 times.	371	if (g_host.pending_op != PendingOp::None)
448			{
449		2	return DMK_WHEELHOST_ERR_PENDING;
450			}
451	2/4 ✓ Branch 14 → 15 taken 369 times. ✗ Branch 14 → 16 not taken. ✗ Branch 15 → 16 not taken. ✓ Branch 15 → 17 taken 369 times.	369	if (!g_host.started \|\| g_host.stopping)
452			{
453		✗	return DMK_WHEELHOST_ERR_STATE;
454			}
455	2/2 ✓ Branch 17 → 18 taken 101 times. ✓ Branch 17 → 19 taken 268 times.	369	if (g_host.lease != 0)
456			{
457		101	return DMK_WHEELHOST_ERR_BUSY;
458			}
459
460		268	g_host.lease_counter = next_nonzero(g_host.lease_counter, std::numeric_limits<std::uint64_t>::max());
461		268	g_host.invalidate_capture();
462		268	g_host.lease = g_host.lease_counter;
463		268	g_host.owner = owner;
464		268	g_host.generation = generation;
465		268	*out_lease = g_host.lease;
466		268	return DMK_WHEELHOST_OK;
467		371	}
468
469		1363	int32_t DMK_WHEELHOST_CALL publish_capture(
470			void *host_context,
471			WheelHostLease lease,
472			std::uint32_t capture_enabled,
473			std::uint32_t consume_mask,
474			std::uint32_t ttl_ms
475			) noexcept
476			{
477	4/8 ✓ Branch 3 → 4 taken 1363 times. ✗ Branch 3 → 6 not taken. ✓ Branch 4 → 5 taken 1363 times. ✗ Branch 4 → 6 not taken. ✗ Branch 5 → 6 not taken. ✓ Branch 5 → 7 taken 1363 times. ✗ Branch 8 → 9 not taken. ✓ Branch 8 → 10 taken 1363 times.	1363	if (!valid_context(host_context) \|\| (capture_enabled & ~CAPTURE_FLAG_MASK) != 0 \|\|
478			(consume_mask & ~CONSUME_MASK) != 0)
479			{
480		✗	return DMK_WHEELHOST_ERR_INVALID;
481			}
482		1363	const ControlLock lock(g_host.control_lock);
483	2/2 ✓ Branch 11 → 12 taken 3 times. ✓ Branch 11 → 13 taken 1360 times.	1363	if (g_host.pending_op != PendingOp::None)
484			{
485		3	return DMK_WHEELHOST_ERR_PENDING;
486			}
487	1/2 ✗ Branch 13 → 14 not taken. ✓ Branch 13 → 15 taken 1360 times.	1360	if (g_host.stopping)
488			{
489		✗	return DMK_WHEELHOST_ERR_STATE;
490			}
491	2/2 ✓ Branch 15 → 16 taken 1 time. ✓ Branch 15 → 17 taken 1359 times.	1360	if (g_host.lease == 0)
492			{
493		1	return DMK_WHEELHOST_ERR_NO_LEASE;
494			}
495	2/2 ✓ Branch 17 → 18 taken 1 time. ✓ Branch 17 → 19 taken 1358 times.	1359	if (lease != g_host.lease)
496			{
497		1	return DMK_WHEELHOST_ERR_STALE;
498			}
499
500	4/4 ✓ Branch 19 → 20 taken 1345 times. ✓ Branch 19 → 22 taken 13 times. ✓ Branch 20 → 21 taken 632 times. ✓ Branch 20 → 22 taken 713 times.	1358	const bool consume_active = ttl_ms != 0 && consume_mask != 0;
501	2/2 ✓ Branch 23 → 24 taken 632 times. ✓ Branch 23 → 37 taken 726 times.	1358	if (consume_active)
502			{
503		632	const std::uint64_t now = GetTickCount64();
504		632	const std::uint64_t maximum = std::numeric_limits<std::uint64_t>::max();
505		✗	g_host.consume_deadline_ms.store(
506	1/2 ✓ Branch 25 → 26 taken 632 times. ✗ Branch 25 → 27 not taken.	632	now > maximum - ttl_ms ? maximum : now + ttl_ms,
507			std::memory_order_relaxed
508			);
509			}
510			else
511			{
512			g_host.consume_deadline_ms.store(0, std::memory_order_relaxed);
513			}
514	2/2 ✓ Branch 46 → 47 taken 632 times. ✓ Branch 46 → 48 taken 726 times.	1358	g_host.consume_state.store(
515			pack_consume(g_host.epoch, consume_active ? consume_mask : 0u),
516			std::memory_order_release
517			);
518			// Capture arms only through a mounted, ready route. An unmounted lease keeps counting disabled.
519		1	const std::uint64_t flags =
520	2/2 ✓ Branch 58 → 59 taken 1357 times. ✓ Branch 58 → 60 taken 1 time.	1358	g_host.route_state == DMK_WHEELHOST_ROUTE_READY ? (capture_enabled & CAPTURE_FLAG_MASK) : 0u;
521		1358	g_host.capture_state.store(pack_capture(g_host.epoch, flags), std::memory_order_seq_cst);
522		1358	return DMK_WHEELHOST_OK;
523		1363	}
524
525			int32_t DMK_WHEELHOST_CALL
526		1274	drain_counts(void *host_context, WheelHostLease lease, std::uint32_t out_counts[DMK_WHEEL_DIRECTIONS]) noexcept
527			{
528	5/6 ✓ Branch 3 → 4 taken 1273 times. ✓ Branch 3 → 5 taken 1 time. ✗ Branch 4 → 5 not taken. ✓ Branch 4 → 6 taken 1273 times. ✓ Branch 7 → 8 taken 1 time. ✓ Branch 7 → 9 taken 1273 times.	1274	if (!valid_context(host_context) \|\| out_counts == nullptr)
529			{
530		1	return DMK_WHEELHOST_ERR_INVALID;
531			}
532		1273	const ControlLock lock(g_host.control_lock);
533	1/2 ✗ Branch 10 → 11 not taken. ✓ Branch 10 → 12 taken 1273 times.	1273	if (g_host.pending_op != PendingOp::None)
534			{
535		✗	return DMK_WHEELHOST_ERR_PENDING;
536			}
537	1/2 ✗ Branch 12 → 13 not taken. ✓ Branch 12 → 14 taken 1273 times.	1273	if (g_host.stopping)
538			{
539		✗	return DMK_WHEELHOST_ERR_STATE;
540			}
541	2/2 ✓ Branch 14 → 15 taken 2 times. ✓ Branch 14 → 16 taken 1271 times.	1273	if (g_host.lease == 0)
542			{
543		2	return DMK_WHEELHOST_ERR_NO_LEASE;
544			}
545	1/2 ✗ Branch 16 → 17 not taken. ✓ Branch 16 → 18 taken 1271 times.	1271	if (lease != g_host.lease)
546			{
547		✗	return DMK_WHEELHOST_ERR_STALE;
548			}
549
550	2/2 ✓ Branch 28 → 19 taken 5084 times. ✓ Branch 28 → 29 taken 1271 times.	6355	for (std::size_t i = 0; i < DMK_WHEEL_DIRECTIONS; ++i)
551			{
552			const std::uint64_t state =
553		5084	g_host.counts[i].exchange(pack_count(g_host.epoch, 0), std::memory_order_acq_rel);
554	1/2 ✓ Branch 24 → 25 taken 5084 times. ✗ Branch 24 → 26 not taken.	5084	out_counts[i] = count_epoch(state) == g_host.epoch ? unpack_count(state) : 0;
555			}
556		1271	return DMK_WHEELHOST_OK;
557		1273	}
558
559			int32_t DMK_WHEELHOST_CALL
560		276	close_lease(void *host_context, WheelHostLease lease, std::uint64_t owner, std::uint64_t generation) noexcept
561			{
562	1/2 ✗ Branch 3 → 4 not taken. ✓ Branch 3 → 5 taken 276 times.	276	if (!valid_context(host_context))
563			{
564		✗	return DMK_WHEELHOST_ERR_INVALID;
565			}
566		276	const ControlLock lock(g_host.control_lock);
567	2/2 ✓ Branch 6 → 7 taken 6 times. ✓ Branch 6 → 30 taken 270 times.	276	if (g_host.pending_op != PendingOp::None)
568			{
569	2/2 ✓ Branch 7 → 8 taken 3 times. ✓ Branch 7 → 16 taken 3 times.	6	if (g_host.pending_op == PendingOp::Retarget)
570			{
571		3	const bool matching_lease =
572	5/6 ✓ Branch 8 → 9 taken 3 times. ✗ Branch 8 → 12 not taken. ✓ Branch 9 → 10 taken 2 times. ✓ Branch 9 → 12 taken 1 time. ✓ Branch 10 → 11 taken 1 time. ✓ Branch 10 → 12 taken 1 time.	3	lease == g_host.pending_lease && owner == g_host.owner && generation == g_host.generation;
573	2/2 ✓ Branch 13 → 14 taken 2 times. ✓ Branch 13 → 15 taken 1 time.	3	if (!matching_lease)
574			{
575		2	return DMK_WHEELHOST_ERR_PENDING;
576			}
577			// An authorized close supersedes the disabled retarget transaction and drains the same lease below.
578		1	clear_pending();
579			}
580	1/2 ✓ Branch 16 → 17 taken 3 times. ✗ Branch 16 → 29 not taken.	3	else if (g_host.pending_op == PendingOp::Close)
581			{
582	3/4 ✓ Branch 17 → 18 taken 3 times. ✗ Branch 17 → 21 not taken. ✓ Branch 18 → 19 taken 2 times. ✓ Branch 18 → 21 taken 1 time.	5	const bool exact_retry = lease == g_host.pending_lease && owner == g_host.pending_owner &&
583	1/2 ✓ Branch 19 → 20 taken 2 times. ✗ Branch 19 → 21 not taken.	2	generation == g_host.pending_generation;
584	2/2 ✓ Branch 22 → 23 taken 1 time. ✓ Branch 22 → 24 taken 2 times.	3	if (!exact_retry)
585			{
586		1	return DMK_WHEELHOST_ERR_PENDING;
587			}
588			// The Closing lease is already invalidated. The retry only has to finish the drain.
589	1/2 ✗ Branch 25 → 26 not taken. ✓ Branch 25 → 27 taken 2 times.	2	if (!drain_admitted_phases())
590			{
591		✗	return DMK_WHEELHOST_ERR_DRAIN;
592			}
593		2	clear_pending();
594		2	g_host.lease = 0;
595		2	g_host.owner = 0;
596		2	g_host.generation = 0;
597		2	return DMK_WHEELHOST_OK;
598			}
599			else
600			{
601		✗	return DMK_WHEELHOST_ERR_PENDING;
602			}
603			}
604	1/2 ✗ Branch 30 → 31 not taken. ✓ Branch 30 → 32 taken 271 times.	271	if (g_host.stopping)
605			{
606		✗	return DMK_WHEELHOST_ERR_STATE;
607			}
608	2/2 ✓ Branch 32 → 33 taken 3 times. ✓ Branch 32 → 34 taken 268 times.	271	if (g_host.lease == 0)
609			{
610		3	return DMK_WHEELHOST_ERR_NO_LEASE;
611			}
612	5/6 ✓ Branch 34 → 35 taken 268 times. ✗ Branch 34 → 37 not taken. ✓ Branch 35 → 36 taken 267 times. ✓ Branch 35 → 37 taken 1 time. ✓ Branch 36 → 37 taken 1 time. ✓ Branch 36 → 38 taken 266 times.	268	if (lease != g_host.lease \|\| owner != g_host.owner \|\| generation != g_host.generation)
613			{
614		2	return DMK_WHEELHOST_ERR_STALE;
615			}
616
617		266	g_host.invalidate_capture();
618	2/2 ✓ Branch 40 → 41 taken 3 times. ✓ Branch 40 → 42 taken 263 times.	266	if (!drain_admitted_phases())
619			{
620			// Closing state: the lease is retained and disabled. Only the exact retry can finish it, and a
621			// successor open is refused until it does.
622		3	g_host.pending_op = PendingOp::Close;
623		3	g_host.pending_lease = lease;
624		3	g_host.pending_owner = owner;
625		3	g_host.pending_generation = generation;
626		3	return DMK_WHEELHOST_ERR_DRAIN;
627			}
628		263	g_host.lease = 0;
629		263	g_host.owner = 0;
630		263	g_host.generation = 0;
631		263	return DMK_WHEELHOST_OK;
632		276	}
633
634		53	DWORD WINAPI mount_thread_main(LPVOID) noexcept
635			{
636			for (;;)
637			{
638	1/2 ✗ Branch 4 → 5 not taken. ✓ Branch 4 → 6 taken 107 times.	111	if (WaitForSingleObject(g_host.mount_request, INFINITE) != WAIT_OBJECT_0)
639			{
640		✗	return 0;
641			}
642	2/2 ✓ Branch 6 → 7 taken 49 times. ✓ Branch 6 → 8 taken 58 times.	107	if (g_host.mount_request_tid == 0)
643			{
644		49	return 0;
645			}
646		58	g_host.mount_result = SetWindowsHookExW(WH_GETMESSAGE, &resident_hook, nullptr, g_host.mount_request_tid);
647	1/2 ✗ Branch 10 → 11 not taken. ✓ Branch 10 → 12 taken 58 times.	58	if (SetEvent(g_host.mount_done) == 0)
648			{
649		✗	return 0;
650			}
651			}
652			}
653
654			/**
655			* @brief Releases the handles for a terminated mount worker.
656			* @note Requires g_host.control_lock.
657			*/
658		49	void clear_mount_thread() noexcept
659			{
660		49	CloseHandle(g_host.mount_thread);
661		49	CloseHandle(g_host.mount_request);
662		49	CloseHandle(g_host.mount_done);
663		49	g_host.mount_thread = nullptr;
664		49	g_host.mount_request = nullptr;
665		49	g_host.mount_done = nullptr;
666		49	g_host.mount_request_tid = 0;
667		49	g_host.mount_result = nullptr;
668		49	}
669
670			/**
671			* @brief Stops the mount worker and releases its handles.
672			* @note Requires g_host.control_lock.
673			*/
674		50	[[nodiscard]] bool stop_mount_thread() noexcept
675			{
676	2/2 ✓ Branch 2 → 3 taken 1 time. ✓ Branch 2 → 4 taken 49 times.	50	if (g_host.mount_thread == nullptr)
677			{
678		1	return true;
679			}
680
681		49	g_host.mount_request_tid = 0;
682	2/6 ✗ Branch 5 → 6 not taken. ✓ Branch 5 → 9 taken 49 times. ✗ Branch 7 → 8 not taken. ✗ Branch 7 → 9 not taken. ✗ Branch 10 → 11 not taken. ✓ Branch 10 → 12 taken 49 times.	49	if (SetEvent(g_host.mount_request) == 0 && WaitForSingleObject(g_host.mount_thread, 0) != WAIT_OBJECT_0)
683			{
684		✗	return false;
685			}
686	1/2 ✗ Branch 13 → 14 not taken. ✓ Branch 13 → 15 taken 49 times.	49	if (WaitForSingleObject(g_host.mount_thread, INFINITE) != WAIT_OBJECT_0)
687			{
688		✗	return false;
689			}
690		49	clear_mount_thread();
691		49	return true;
692			}
693
694			/**
695			* @brief Requires g_host.control_lock. Installs the resident hook from the host-owned mount thread.
696			* @details Win32 removes a hook when the thread that installed it exits.
697			* A transient poller can therefore leave a false ready route after its thread exits.
698			* The host worker lasts until wheel_host_stop.
699			*/
700		58	[[nodiscard]] HHOOK mount_resident_hook(std::uint32_t target_thread_id) noexcept
701			{
702	2/2 ✓ Branch 2 → 3 taken 53 times. ✓ Branch 2 → 16 taken 5 times.	58	if (g_host.mount_thread == nullptr)
703			{
704		53	const HANDLE request = CreateEventW(nullptr, FALSE, FALSE, nullptr);
705		53	const HANDLE done = CreateEventW(nullptr, FALSE, FALSE, nullptr);
706		53	HANDLE thread = nullptr;
707	2/4 ✓ Branch 5 → 6 taken 53 times. ✗ Branch 5 → 9 not taken. ✓ Branch 6 → 7 taken 53 times. ✗ Branch 6 → 9 not taken.	53	if (request != nullptr && done != nullptr)
708			{
709		53	g_host.mount_request = request;
710		53	g_host.mount_done = done;
711		53	thread = CreateThread(
712			nullptr,
713			static_cast<SIZE_T>(64u) * 1024u,
714			&mount_thread_main,
715			nullptr,
716			STACK_SIZE_PARAM_IS_A_RESERVATION,
717			nullptr
718			);
719			}
720	1/2 ✗ Branch 9 → 10 not taken. ✓ Branch 9 → 15 taken 53 times.	53	if (thread == nullptr)
721			{
722	0/2 ✗ Branch 10 → 11 not taken. ✗ Branch 10 → 12 not taken.	✗	if (request != nullptr)
723			{
724		✗	CloseHandle(request);
725			}
726	0/2 ✗ Branch 12 → 13 not taken. ✗ Branch 12 → 14 not taken.	✗	if (done != nullptr)
727			{
728		✗	CloseHandle(done);
729			}
730		✗	g_host.mount_request = nullptr;
731		✗	g_host.mount_done = nullptr;
732		✗	return nullptr;
733			}
734		53	g_host.mount_thread = thread;
735			}
736		58	g_host.mount_request_tid = target_thread_id;
737		58	g_host.mount_result = nullptr;
738	1/2 ✗ Branch 17 → 18 not taken. ✓ Branch 17 → 22 taken 58 times.	58	if (SetEvent(g_host.mount_request) == 0)
739			{
740	0/2 ✗ Branch 19 → 20 not taken. ✗ Branch 19 → 21 not taken.	✗	if (WaitForSingleObject(g_host.mount_thread, 0) == WAIT_OBJECT_0)
741			{
742		✗	clear_mount_thread();
743			}
744		✗	return nullptr;
745			}
746			const std::array<HANDLE, 2> wait_handles = {
747		58	g_host.mount_done,
748		58	g_host.mount_thread,
749		58	};
750			const DWORD wait_result =
751		116	WaitForMultipleObjects(static_cast<DWORD>(wait_handles.size()), wait_handles.data(), FALSE, INFINITE);
752	1/2 ✗ Branch 26 → 27 not taken. ✓ Branch 26 → 30 taken 58 times.	58	if (wait_result != WAIT_OBJECT_0)
753			{
754	0/2 ✗ Branch 27 → 28 not taken. ✗ Branch 27 → 29 not taken.	✗	if (wait_result == WAIT_OBJECT_0 + 1)
755			{
756		✗	clear_mount_thread();
757			}
758		✗	return nullptr;
759			}
760		58	return g_host.mount_result;
761			}
762
763		54	[[nodiscard]] bool pin_host_module() noexcept
764			{
765		54	HMODULE module = nullptr;
766		54	return GetModuleHandleExW(
767			GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS \| GET_MODULE_HANDLE_EX_FLAG_PIN,
768			reinterpret_cast<LPCWSTR>(&resident_hook),
769			&module
770		54	) != 0;
771			}
772
773		61	[[nodiscard]] HANDLE open_target_thread(std::uint32_t target_thread_id) noexcept
774			{
775		61	HANDLE thread = OpenThread(SYNCHRONIZE \| THREAD_QUERY_LIMITED_INFORMATION, FALSE, target_thread_id);
776	1/2 ✗ Branch 3 → 4 not taken. ✓ Branch 3 → 5 taken 61 times.	61	if (thread == nullptr)
777			{
778		✗	return nullptr;
779			}
780	5/6 ✓ Branch 7 → 8 taken 61 times. ✗ Branch 7 → 10 not taken. ✓ Branch 9 → 10 taken 3 times. ✓ Branch 9 → 11 taken 58 times. ✓ Branch 12 → 13 taken 3 times. ✓ Branch 12 → 15 taken 58 times.	61	if (GetProcessIdOfThread(thread) != GetCurrentProcessId() \|\| WaitForSingleObject(thread, 0) == WAIT_OBJECT_0)
781			{
782		3	CloseHandle(thread);
783		3	return nullptr;
784			}
785		58	return thread;
786			}
787
788		56	[[nodiscard]] bool remove_hook(HHOOK hook) noexcept
789			{
790			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
791	2/2 ✓ Branch 3 → 4 taken 2 times. ✓ Branch 3 → 5 taken 54 times.	56	if (g_force_unhook_failure.load(std::memory_order_acquire))
792			{
793		2	return false;
794			}
795			#endif
796		54	return UnhookWindowsHookEx(hook) != 0;
797			}
798
799			/// Requires g_host.control_lock. Reports whether the mounted target thread exited.
800		1351	[[nodiscard]] bool target_thread_exited() noexcept
801			{
802	3/4 ✓ Branch 2 → 3 taken 1351 times. ✗ Branch 2 → 6 not taken. ✓ Branch 4 → 5 taken 3 times. ✓ Branch 4 → 6 taken 1348 times.	1351	return g_host.target_thread != nullptr && WaitForSingleObject(g_host.target_thread, 0) == WAIT_OBJECT_0;
803			}
804
805			/// Requires g_host.control_lock. Drops the mounted route state. Thread exit is authoritative hook retirement.
806		✗	void retire_route_after_thread_exit() noexcept
807			{
808	0/2 ✗ Branch 2 → 3 not taken. ✗ Branch 2 → 5 not taken.	✗	if (g_host.hook != nullptr)
809			{
810			// The hook died with its thread. The call only releases the handle; its result carries no authority.
811		✗	(void)UnhookWindowsHookEx(g_host.hook);
812		✗	g_host.hook = nullptr;
813			}
814	0/2 ✗ Branch 5 → 6 not taken. ✗ Branch 5 → 8 not taken.	✗	if (g_host.target_thread != nullptr)
815			{
816		✗	CloseHandle(g_host.target_thread);
817		✗	g_host.target_thread = nullptr;
818			}
819		✗	g_host.target_thread_id = 0;
820		✗	g_host.invalidate_capture();
821		✗	g_host.route_state = DMK_WHEELHOST_ROUTE_RETRYABLE;
822		✗	}
823
824			/**
825			* @brief Requires g_host.control_lock. Rechecks target-thread liveness and settles the route state.
826			* @details A dead target cannot remain ready, and a cleanup-blocked route whose old thread exited becomes
827			* retryable. Runs from route_status and before every retarget attempt.
828			*/
829		1349	void settle_route_state() noexcept
830			{
831	4/6 ✓ Branch 2 → 3 taken 1340 times. ✓ Branch 2 → 6 taken 9 times. ✗ Branch 4 → 5 not taken. ✓ Branch 4 → 6 taken 1340 times. ✗ Branch 7 → 8 not taken. ✓ Branch 7 → 9 taken 1349 times.	1349	if (g_host.hook != nullptr && target_thread_exited())
832			{
833		✗	retire_route_after_thread_exit();
834			}
835		1349	}
836
837		1340	int32_t DMK_WHEELHOST_CALL route_status(
838			void *host_context,
839			WheelHostLease lease,
840			std::uint32_t status_capacity,
841			WheelHostRouteStatus *out_status
842			) noexcept
843			{
844	6/6 ✓ Branch 3 → 4 taken 1339 times. ✓ Branch 3 → 5 taken 1 time. ✓ Branch 4 → 5 taken 1 time. ✓ Branch 4 → 6 taken 1338 times. ✓ Branch 7 → 8 taken 2 times. ✓ Branch 7 → 9 taken 1338 times.	1340	if (!valid_context(host_context) \|\| out_status == nullptr)
845			{
846		2	return DMK_WHEELHOST_ERR_INVALID;
847			}
848	2/2 ✓ Branch 9 → 10 taken 1 time. ✓ Branch 9 → 11 taken 1337 times.	1338	if (status_capacity < sizeof(WheelHostRouteStatus))
849			{
850		1	return DMK_WHEELHOST_ERR_ABI;
851			}
852		1337	const ControlLock lock(g_host.control_lock);
853	2/2 ✓ Branch 12 → 13 taken 1 time. ✓ Branch 12 → 14 taken 1336 times.	1337	if (!g_host.started)
854			{
855		1	return DMK_WHEELHOST_ERR_STATE;
856			}
857			// A zero lease is an unqualified probe, so a loader can read the route before it hands the table out.
858	4/4 ✓ Branch 14 → 15 taken 1333 times. ✓ Branch 14 → 17 taken 3 times. ✓ Branch 15 → 16 taken 1332 times. ✓ Branch 15 → 17 taken 1 time.	1336	const bool lease_matches = lease != 0 && lease == g_host.lease;
859	4/4 ✓ Branch 18 → 19 taken 1333 times. ✓ Branch 18 → 21 taken 3 times. ✓ Branch 19 → 20 taken 1 time. ✓ Branch 19 → 21 taken 1332 times.	1336	if (lease != 0 && !lease_matches)
860			{
861		1	return DMK_WHEELHOST_ERR_STALE;
862			}
863			// Liveness recheck only. The query settles physical mount health and never ends a control transaction.
864		1335	settle_route_state();
865
866		1335	WheelHostRouteStatus status{};
867		1335	status.struct_size = static_cast<std::uint32_t>(sizeof(WheelHostRouteStatus));
868		1335	status.route_state = g_host.route_state;
869		1335	status.control_state = control_state_of(g_host.pending_op);
870			// The host owns its own precondition lattice so no client re-derives it.
871	4/4 ✓ Branch 24 → 25 taken 1327 times. ✓ Branch 24 → 28 taken 7 times. ✓ Branch 25 → 26 taken 1324 times. ✓ Branch 25 → 28 taken 3 times.	1334	status.capture_armable = !g_host.stopping && g_host.pending_op == PendingOp::None && lease_matches &&
872	2/2 ✓ Branch 26 → 27 taken 1322 times. ✓ Branch 26 → 28 taken 2 times.	1324	g_host.route_state == DMK_WHEELHOST_ROUTE_READY
873	2/2 ✓ Branch 23 → 24 taken 1334 times. ✓ Branch 23 → 28 taken 1 time.	2669	? 1u
874			: 0u;
875	2/2 ✓ Branch 29 → 30 taken 1329 times. ✓ Branch 29 → 31 taken 6 times.	1335	status.mounted_thread_id = g_host.hook != nullptr ? g_host.target_thread_id : 0;
876		1335	status.mount_generation = g_host.mount_generation;
877		1335	*out_status = status;
878		1335	return DMK_WHEELHOST_OK;
879		1337	}
880
881			int32_t DMK_WHEELHOST_CALL
882		16	retarget(void *host_context, WheelHostLease lease, std::uint32_t target_thread_id) noexcept
883			{
884	3/6 ✓ Branch 3 → 4 taken 16 times. ✗ Branch 3 → 5 not taken. ✗ Branch 4 → 5 not taken. ✓ Branch 4 → 6 taken 16 times. ✗ Branch 7 → 8 not taken. ✓ Branch 7 → 9 taken 16 times.	16	if (!valid_context(host_context) \|\| target_thread_id == 0)
885			{
886		✗	return DMK_WHEELHOST_ERR_INVALID;
887			}
888		16	const ControlLock lock(g_host.control_lock);
889	4/4 ✓ Branch 10 → 11 taken 6 times. ✓ Branch 10 → 13 taken 10 times. ✓ Branch 11 → 12 taken 5 times. ✓ Branch 11 → 13 taken 1 time.	16	const bool retrying = g_host.pending_op == PendingOp::Retarget && lease == g_host.pending_lease;
890	4/4 ✓ Branch 14 → 15 taken 7 times. ✓ Branch 14 → 17 taken 9 times. ✓ Branch 15 → 16 taken 2 times. ✓ Branch 15 → 17 taken 5 times.	16	if (g_host.pending_op != PendingOp::None && !retrying)
891			{
892		2	return DMK_WHEELHOST_ERR_PENDING;
893			}
894	2/4 ✓ Branch 17 → 18 taken 14 times. ✗ Branch 17 → 19 not taken. ✗ Branch 18 → 19 not taken. ✓ Branch 18 → 20 taken 14 times.	14	if (g_host.stopping \|\| !g_host.started)
895			{
896		✗	return DMK_WHEELHOST_ERR_STATE;
897			}
898	1/2 ✗ Branch 20 → 21 not taken. ✓ Branch 20 → 22 taken 14 times.	14	if (g_host.lease == 0)
899			{
900		✗	return DMK_WHEELHOST_ERR_NO_LEASE;
901			}
902	1/2 ✗ Branch 22 → 23 not taken. ✓ Branch 22 → 24 taken 14 times.	14	if (lease != g_host.lease)
903			{
904		✗	return DMK_WHEELHOST_ERR_STALE;
905			}
906
907		14	settle_route_state();
908
909			// Same-thread retarget of a live mount keeps the mount and its generation. Queue-wide admission needs no
910			// republish for a window change on the same thread.
911	4/4 ✓ Branch 25 → 26 taken 11 times. ✓ Branch 25 → 34 taken 3 times. ✓ Branch 26 → 27 taken 2 times. ✓ Branch 26 → 34 taken 9 times.	14	if (g_host.hook != nullptr && g_host.target_thread_id == target_thread_id &&
912	1/2 ✓ Branch 27 → 28 taken 2 times. ✗ Branch 27 → 34 not taken.	2	g_host.route_state == DMK_WHEELHOST_ROUTE_READY)
913			{
914	2/2 ✓ Branch 28 → 29 taken 1 time. ✓ Branch 28 → 33 taken 1 time.	2	if (retrying)
915			{
916	1/2 ✗ Branch 30 → 31 not taken. ✓ Branch 30 → 32 taken 1 time.	1	if (!drain_admitted_phases())
917			{
918		✗	return DMK_WHEELHOST_ERR_DRAIN;
919			}
920		1	clear_pending();
921			}
922		2	return DMK_WHEELHOST_OK;
923			}
924
925			// Disable capture and consume, advance the epoch, and drain admitted decisions before route replacement.
926		12	g_host.invalidate_capture();
927		6	const auto fail_pending = [&](std::uint32_t state, int32_t status) noexcept -> int32_t
928			{
929		6	g_host.route_state = state;
930		6	g_host.pending_op = PendingOp::Retarget;
931		6	g_host.pending_lease = lease;
932		6	return status;
933		12	};
934	2/2 ✓ Branch 36 → 37 taken 2 times. ✓ Branch 36 → 41 taken 10 times.	12	if (!drain_admitted_phases())
935			{
936		2	const std::uint32_t state =
937	1/2 ✓ Branch 37 → 38 taken 2 times. ✗ Branch 37 → 39 not taken.	2	g_host.hook != nullptr ? DMK_WHEELHOST_ROUTE_READY : DMK_WHEELHOST_ROUTE_RETRYABLE;
938		2	return fail_pending(state, DMK_WHEELHOST_ERR_DRAIN);
939			}
940
941			// Remove the old hook before the new hook mounts. Hooks never overlap.
942	2/2 ✓ Branch 41 → 42 taken 7 times. ✓ Branch 41 → 52 taken 3 times.	10	if (g_host.hook != nullptr)
943			{
944	1/2 ✗ Branch 43 → 44 not taken. ✓ Branch 43 → 45 taken 7 times.	7	if (target_thread_exited())
945			{
946		✗	retire_route_after_thread_exit();
947			}
948	2/2 ✓ Branch 46 → 47 taken 1 time. ✓ Branch 46 → 48 taken 6 times.	7	else if (!remove_hook(g_host.hook))
949			{
950		1	return fail_pending(DMK_WHEELHOST_ROUTE_CLEANUP_BLOCKED, DMK_WHEELHOST_ERR_THREAD);
951			}
952			else
953			{
954		6	g_host.hook = nullptr;
955	1/2 ✓ Branch 48 → 49 taken 6 times. ✗ Branch 48 → 51 not taken.	6	if (g_host.target_thread != nullptr)
956			{
957		6	CloseHandle(g_host.target_thread);
958		6	g_host.target_thread = nullptr;
959			}
960		6	g_host.target_thread_id = 0;
961			}
962			}
963
964		9	HANDLE new_thread = open_target_thread(target_thread_id);
965	2/2 ✓ Branch 53 → 54 taken 3 times. ✓ Branch 53 → 55 taken 6 times.	9	if (new_thread == nullptr)
966			{
967		3	return fail_pending(DMK_WHEELHOST_ROUTE_RETRYABLE, DMK_WHEELHOST_ERR_THREAD);
968			}
969		6	const HHOOK new_hook = mount_resident_hook(target_thread_id);
970	1/2 ✗ Branch 56 → 57 not taken. ✓ Branch 56 → 59 taken 6 times.	6	if (new_hook == nullptr)
971			{
972		✗	CloseHandle(new_thread);
973		✗	return fail_pending(DMK_WHEELHOST_ROUTE_RETRYABLE, DMK_WHEELHOST_ERR_THREAD);
974			}
975
976		6	g_host.hook = new_hook;
977		6	g_host.target_thread = new_thread;
978		6	g_host.target_thread_id = target_thread_id;
979		6	g_host.mount_generation = next_nonzero(g_host.mount_generation, std::numeric_limits<std::uint64_t>::max());
980		6	g_host.route_state = DMK_WHEELHOST_ROUTE_READY;
981		6	clear_pending();
982		6	return DMK_WHEELHOST_OK;
983		16	}
984			} // namespace
985
986		60	int32_t DMK_WHEELHOST_CALL wheel_host_start(
987			uint32_t target_thread_id,
988			uint32_t requested_abi_version,
989			uint32_t table_capacity,
990			WheelHostTable *out_table
991			) noexcept
992			{
993	2/2 ✓ Branch 2 → 3 taken 1 time. ✓ Branch 2 → 4 taken 59 times.	60	if (out_table == nullptr)
994			{
995		1	return DMK_WHEELHOST_ERR_INVALID;
996			}
997	4/4 ✓ Branch 4 → 5 taken 57 times. ✓ Branch 4 → 6 taken 2 times. ✓ Branch 5 → 6 taken 1 time. ✓ Branch 5 → 7 taken 56 times.	59	if (requested_abi_version != DMK_WHEELHOST_ABI_VERSION \|\| table_capacity < sizeof(WheelHostTable))
998			{
999		3	return DMK_WHEELHOST_ERR_ABI;
1000			}
1001
1002		56	const ControlLock lock(g_host.control_lock);
1003	2/2 ✓ Branch 8 → 9 taken 2 times. ✓ Branch 8 → 10 taken 54 times.	56	if (g_host.started)
1004			{
1005		2	return DMK_WHEELHOST_ERR_STATE;
1006			}
1007	1/2 ✗ Branch 11 → 12 not taken. ✓ Branch 11 → 13 taken 54 times.	54	if (!pin_host_module())
1008			{
1009		✗	return DMK_WHEELHOST_ERR_THREAD;
1010			}
1011
1012		54	HANDLE target_thread = nullptr;
1013		54	HHOOK hook = nullptr;
1014	2/2 ✓ Branch 13 → 14 taken 52 times. ✓ Branch 13 → 22 taken 2 times.	54	if (target_thread_id != 0)
1015			{
1016		52	target_thread = open_target_thread(target_thread_id);
1017	1/2 ✗ Branch 15 → 16 not taken. ✓ Branch 15 → 17 taken 52 times.	52	if (target_thread == nullptr)
1018			{
1019		✗	return DMK_WHEELHOST_ERR_THREAD;
1020			}
1021		52	hook = mount_resident_hook(target_thread_id);
1022	1/2 ✗ Branch 18 → 19 not taken. ✓ Branch 18 → 22 taken 52 times.	52	if (hook == nullptr)
1023			{
1024		✗	CloseHandle(target_thread);
1025		✗	(void)stop_mount_thread();
1026		✗	return DMK_WHEELHOST_ERR_THREAD;
1027			}
1028			}
1029
1030		54	g_host.hook = hook;
1031		54	g_host.target_thread = target_thread;
1032	2/2 ✓ Branch 22 → 23 taken 52 times. ✓ Branch 22 → 24 taken 2 times.	54	g_host.target_thread_id = hook != nullptr ? target_thread_id : 0;
1033	2/2 ✓ Branch 25 → 26 taken 52 times. ✓ Branch 25 → 27 taken 2 times.	54	g_host.route_state = hook != nullptr ? DMK_WHEELHOST_ROUTE_READY : DMK_WHEELHOST_ROUTE_TARGET_WAIT;
1034	2/2 ✓ Branch 28 → 29 taken 52 times. ✓ Branch 28 → 32 taken 2 times.	54	if (hook != nullptr)
1035			{
1036		52	g_host.mount_generation = next_nonzero(g_host.mount_generation, std::numeric_limits<std::uint64_t>::max());
1037			}
1038		54	g_host.started = true;
1039		54	g_host.stopping = false;
1040		54	g_host.lease = 0;
1041		54	g_host.owner = 0;
1042		54	g_host.generation = 0;
1043		54	clear_pending();
1044		54	g_host.invalidate_capture();
1045		54	g_host.identity_counter = next_nonzero(g_host.identity_counter, std::numeric_limits<std::uint64_t>::max());
1046		54	g_host.host_identity = g_host.identity_counter;
1047
1048		54	WheelHostTable table{};
1049		54	table.struct_size = static_cast<std::uint32_t>(sizeof(WheelHostTable));
1050		54	table.abi_version = DMK_WHEELHOST_ABI_VERSION;
1051		54	table.capability_bits =
1052			DMK_WHEELHOST_CAP_VERTICAL \| DMK_WHEELHOST_CAP_HORIZONTAL \| DMK_WHEELHOST_CAP_CONSUME \| DMK_WHEELHOST_CAP_ROUTE;
1053		54	table.host_identity = g_host.host_identity;
1054		54	table.host_context = &g_host;
1055		54	table.open_lease = &open_lease;
1056		54	table.publish_capture = &publish_capture;
1057		54	table.drain_counts = &drain_counts;
1058		54	table.close_lease = &close_lease;
1059		54	table.route_status = &route_status;
1060		54	table.retarget = &retarget;
1061		54	*out_table = table;
1062		54	return DMK_WHEELHOST_OK;
1063		56	}
1064
1065		55	int32_t DMK_WHEELHOST_CALL wheel_host_stop(void) noexcept
1066			{
1067		55	const ControlLock lock(g_host.control_lock);
1068	2/2 ✓ Branch 3 → 4 taken 1 time. ✓ Branch 3 → 5 taken 54 times.	55	if (!g_host.started)
1069			{
1070		1	return DMK_WHEELHOST_ERR_STATE;
1071			}
1072			// Stop is the loader authority over a host it started. It retries its own pending Stop and supersedes a
1073			// pending Close, whose generation already asked to leave and can no longer be required to retry. A lease whose
1074			// holder still wants it stays BUSY, which includes a pending Retarget: that generation can still close it.
1075	6/6 ✓ Branch 5 → 6 taken 52 times. ✓ Branch 5 → 9 taken 2 times. ✓ Branch 6 → 7 taken 51 times. ✓ Branch 6 → 9 taken 1 time. ✓ Branch 7 → 8 taken 2 times. ✓ Branch 7 → 9 taken 49 times.	54	if (g_host.pending_op != PendingOp::Stop && g_host.pending_op != PendingOp::Close && g_host.lease != 0)
1076			{
1077			// Busy without mutation: the lease keeps its owner, generation, token, route, and capture state.
1078		2	return DMK_WHEELHOST_ERR_BUSY;
1079			}
1080
1081	2/2 ✓ Branch 9 → 10 taken 50 times. ✓ Branch 9 → 11 taken 2 times.	52	if (!g_host.stopping)
1082			{
1083		50	g_host.stopping = true;
1084		50	g_host.invalidate_capture();
1085			}
1086	2/2 ✓ Branch 12 → 13 taken 1 time. ✓ Branch 12 → 14 taken 51 times.	52	if (!drain_admitted_phases())
1087			{
1088			// The host stays started and disabled through the exact Stop retry.
1089		1	g_host.pending_op = PendingOp::Stop;
1090		1	return DMK_WHEELHOST_ERR_DRAIN;
1091			}
1092	8/8 ✓ Branch 14 → 15 taken 49 times. ✓ Branch 14 → 20 taken 2 times. ✓ Branch 16 → 17 taken 4 times. ✓ Branch 16 → 20 taken 45 times. ✓ Branch 18 → 19 taken 1 time. ✓ Branch 18 → 20 taken 3 times. ✓ Branch 21 → 22 taken 1 time. ✓ Branch 21 → 23 taken 50 times.	51	if (g_host.hook != nullptr && !remove_hook(g_host.hook) && !target_thread_exited())
1093			{
1094		1	g_host.pending_op = PendingOp::Stop;
1095		1	return DMK_WHEELHOST_ERR_THREAD;
1096			}
1097		50	g_host.hook = nullptr;
1098		50	g_host.route_state = DMK_WHEELHOST_ROUTE_TARGET_WAIT;
1099	1/2 ✗ Branch 24 → 25 not taken. ✓ Branch 24 → 26 taken 50 times.	50	if (!stop_mount_thread())
1100			{
1101		✗	g_host.pending_op = PendingOp::Stop;
1102		✗	return DMK_WHEELHOST_ERR_THREAD;
1103			}
1104
1105	2/2 ✓ Branch 26 → 27 taken 48 times. ✓ Branch 26 → 29 taken 2 times.	50	if (g_host.target_thread != nullptr)
1106			{
1107		48	CloseHandle(g_host.target_thread);
1108		48	g_host.target_thread = nullptr;
1109			}
1110		50	g_host.target_thread_id = 0;
1111		50	g_host.route_state = DMK_WHEELHOST_ROUTE_TARGET_WAIT;
1112		50	g_host.lease = 0;
1113		50	g_host.owner = 0;
1114		50	g_host.generation = 0;
1115		50	clear_pending();
1116		50	g_host.started = false;
1117		50	g_host.stopping = false;
1118		50	return DMK_WHEELHOST_OK;
1119		55	}
1120
1121			#if defined(DMK_WHEELHOST_ENABLE_TEST_SEAMS)
1122		42	extern "C" void DMK_WHEELHOST_CALL wheel_host_test_set_hook_probe(void(DMK_WHEELHOST_CALL *probe)(void)) noexcept
1123			{
1124		42	g_hook_probe.store(probe, std::memory_order_release);
1125		42	}
1126
1127		40	extern "C" void DMK_WHEELHOST_CALL wheel_host_test_set_finalize_probe(void(DMK_WHEELHOST_CALL *probe)(void)) noexcept
1128			{
1129		40	g_finalize_probe.store(probe, std::memory_order_release);
1130		40	}
1131
1132		38	extern "C" void DMK_WHEELHOST_CALL wheel_host_test_force_unhook_failure(uint32_t enabled) noexcept
1133			{
1134		38	g_force_unhook_failure.store(enabled != 0, std::memory_order_release);
1135		38	}
1136
1137		39	extern "C" void DMK_WHEELHOST_CALL wheel_host_test_set_drain_timeout(uint32_t timeout_ms) noexcept
1138			{
1139			g_drain_timeout_override_ms.store(timeout_ms, std::memory_order_release);
1140		39	}
1141
1142		36	extern "C" void DMK_WHEELHOST_CALL wheel_host_test_set_process_focus(int32_t focused) noexcept
1143			{
1144			g_process_focus_override.store(focused, std::memory_order_release);
1145		36	}
1146
1147		112	extern "C" void DMK_WHEELHOST_CALL wheel_host_test_snapshot(
1148			uint32_t *mounted_hooks,
1149			uint32_t *thread_handles,
1150			uint32_t *active_leases,
1151			uint64_t *mount_generation
1152			) noexcept
1153			{
1154		112	const ControlLock lock(g_host.control_lock);
1155	1/2 ✓ Branch 3 → 4 taken 112 times. ✗ Branch 3 → 8 not taken.	112	if (mounted_hooks != nullptr)
1156			{
1157	2/2 ✓ Branch 4 → 5 taken 111 times. ✓ Branch 4 → 6 taken 1 time.	112	*mounted_hooks = g_host.hook != nullptr ? 1u : 0u;
1158			}
1159	1/2 ✓ Branch 8 → 9 taken 112 times. ✗ Branch 8 → 16 not taken.	112	if (thread_handles != nullptr)
1160			{
1161	4/4 ✓ Branch 9 → 10 taken 111 times. ✓ Branch 9 → 11 taken 1 time. ✓ Branch 12 → 13 taken 111 times. ✓ Branch 12 → 14 taken 1 time.	112	*thread_handles = (g_host.target_thread != nullptr ? 1u : 0u) + (g_host.mount_thread != nullptr ? 1u : 0u);
1162			}
1163	2/2 ✓ Branch 16 → 17 taken 111 times. ✓ Branch 16 → 21 taken 1 time.	112	if (active_leases != nullptr)
1164			{
1165	2/2 ✓ Branch 17 → 18 taken 10 times. ✓ Branch 17 → 19 taken 101 times.	111	*active_leases = g_host.lease != 0 ? 1u : 0u;
1166			}
1167	2/2 ✓ Branch 21 → 22 taken 111 times. ✓ Branch 21 → 23 taken 1 time.	112	if (mount_generation != nullptr)
1168			{
1169		111	*mount_generation = g_host.mount_generation;
1170			}
1171		112	}
1172			#endif
1173