8 files changed, 818 insertions, 34 deletions

diff --git a/rsnix/src/cursor.rs b/rsnix/src/cursor.rs
index 31b919e..b986b23 100644
--- a/rsnix/src/cursor.rs
+++ b/rsnix/src/cursor.rs
@@ -49,14 +49,29 @@ fn forward_target() -> Option<usize> {
 }
 
 fn task_main() {
+    let mut prev_buttons: u8 = 0;
     loop {
         while let Some(ev) = crate::usb::poll_mouse()
             .or_else(crate::ehci::poll_mouse)
             .or_else(crate::uhci::poll_mouse)
             .or_else(crate::ps2::try_poll_mouse)
         {
-            crate::gop::cursor_move(ev.dx, ev.dy);
-            crate::gop::cursor_set_buttons(btn_bits(&ev));
+            let (cx, cy) = crate::gop::cursor_move(ev.dx, ev.dy);
+            let buttons = btn_bits(&ev);
+            crate::gop::cursor_set_buttons(buttons);
+            // Left-button edge detection → press/release.
+            let kind = if buttons & 1 != 0 && prev_buttons & 1 == 0 {
+                crate::ps2::MouseKind::Press
+            } else if buttons & 1 == 0 && prev_buttons & 1 != 0 {
+                crate::ps2::MouseKind::Release
+            } else {
+                crate::ps2::MouseKind::Move
+            };
+            prev_buttons = buttons;
+            // Route to the window manager (focus + deliver to the focused
+            // window with window-relative coordinates).
+            crate::wm::route_mouse(cx as i32, cy as i32, buttons, kind);
+            // Legacy single-target debug routing (`mouse <id>`).
             if let Some(id) = forward_target()
                 && crate::sched::send(id, TaskMsg::Mouse(ev)).is_err()
             {
diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index 676814e..deff226 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -4,10 +4,10 @@
 /// module is the low-level rasteriser: glyph blits and pixel shifts on the
 /// linear framebuffer.
 use crate::font;
-use crate::uefi::{GopModeInfo, GraphicsOutputProtocol, EFI_SUCCESS, PIXEL_BGR, PIXEL_RGB};
+use crate::uefi::{EFI_SUCCESS, GopModeInfo, GraphicsOutputProtocol, PIXEL_BGR, PIXEL_RGB};
 use core::fmt;
 use core::ptr;
-use core::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, AtomicU8, Ordering};
+use core::sync::atomic::{AtomicBool, AtomicU8, AtomicU32, AtomicU64, Ordering};
 
 /// Framebuffer state captured before ExitBootServices.
 pub struct Framebuffer {
@@ -512,6 +512,105 @@ pub fn fill_rect(x: usize, y: usize, w: usize, h: usize, color: u32) {
     push_rect(x, y, w, h);
 }
 
+/// Fill a shadow rectangle WITHOUT pushing to the display.  The window
+/// manager composites several surfaces into the shadow and pushes once at
+/// the end.
+pub(crate) fn shadow_fill_rect(x: usize, y: usize, w: usize, h: usize, color: u32) {
+    let Some(fb) = fb().as_ref() else {
+        return;
+    };
+    if unsafe { SHADOW.is_null() } || x >= fb.width || y >= fb.height {
+        return;
+    }
+    let w = w.min(fb.width - x);
+    let h = h.min(fb.height - y);
+    let row_words = fb.pitch / 4;
+    unsafe {
+        for dy in 0..h {
+            let off = (y + dy) * row_words + x;
+            for dx in 0..w {
+                *SHADOW.add(off + dx) = color;
+            }
+        }
+    }
+}
+
+/// Copy a row-major `u32` source buffer (stride in pixels) into the shadow
+/// WITHOUT pushing.  Clipped to the framebuffer.
+pub(crate) fn shadow_blit(
+    x: usize,
+    y: usize,
+    w: usize,
+    h: usize,
+    src: *const u32,
+    src_stride: usize,
+) {
+    let Some(fb) = fb().as_ref() else {
+        return;
+    };
+    if unsafe { SHADOW.is_null() } || src.is_null() || x >= fb.width || y >= fb.height {
+        return;
+    }
+    let w = w.min(fb.width - x);
+    let h = h.min(fb.height - y);
+    let row_words = fb.pitch / 4;
+    unsafe {
+        for dy in 0..h {
+            let doff = (y + dy) * row_words + x;
+            let soff = dy * src_stride;
+            for dx in 0..w {
+                *SHADOW.add(doff + dx) = *src.add(soff + dx);
+            }
+        }
+    }
+}
+
+/// Render one 8×16 glyph into the shadow at a pixel origin WITHOUT pushing
+/// (for window chrome and console repaint).  Same glyph lookup as
+/// `blit_glyph`, but caller-controlled push.
+pub(crate) fn shadow_glyph_px(x: usize, y: usize, ch: u16, fg: (u8, u8, u8), bg: (u8, u8, u8)) {
+    let Some(fb) = fb().as_ref() else {
+        return;
+    };
+    if unsafe { SHADOW.is_null() } {
+        return;
+    }
+    let glyph = font::GLYPH_8X16;
+    let data = if ch < 256 {
+        match glyph.get(ch as usize) {
+            Some(d) => *d,
+            None => return,
+        }
+    } else if let Some(bits) = unicode_glyph_bits(ch) {
+        bits
+    } else {
+        match glyph.get(32) {
+            Some(d) => *d,
+            None => return,
+        }
+    };
+    let fgc = rgb(fg.0, fg.1, fg.2);
+    let bgc = rgb(bg.0, bg.1, bg.2);
+    let row_words = fb.pitch / 4;
+    unsafe {
+        for cy in 0..16 {
+            let py = y + cy;
+            if py >= fb.height {
+                break;
+            }
+            let row_bits = data[cy];
+            for cx in 0..8 {
+                let px = x + cx;
+                if px >= fb.width {
+                    break;
+                }
+                let on = row_bits & (0x80 >> cx) != 0;
+                *SHADOW.add(py * row_words + px) = if on { fgc } else { bgc };
+            }
+        }
+    }
+}
+
 /// Print crash/fault lines directly to the framebuffer, bypassing the vt
 /// entirely (the vt state may be corrupt when an exception fires).
 ///
diff --git a/rsnix/src/lib.rs b/rsnix/src/lib.rs
index f5c3419..a422057 100644
--- a/rsnix/src/lib.rs
+++ b/rsnix/src/lib.rs
@@ -4,6 +4,7 @@ extern crate alloc;
 
 pub mod ahci;
 pub mod cursor;
+pub mod ehci;
 pub mod fat;
 pub mod font;
 pub mod fs;
@@ -14,16 +15,16 @@ pub mod klog;
 pub mod memory;
 pub mod paging;
 pub mod pci;
-pub mod qr;
 pub mod power;
 pub mod ps2;
-pub mod uhci;
-pub mod ehci;
-pub mod usb;
+pub mod qr;
 pub mod rtc;
 pub mod sched;
 pub mod serial;
 pub mod strbuf;
 pub mod tty;
 pub mod uefi;
+pub mod uhci;
+pub mod usb;
 pub mod vt;
+pub mod wm;
diff --git a/rsnix/src/ps2.rs b/rsnix/src/ps2.rs
index 965e4a0..cac476f 100644
--- a/rsnix/src/ps2.rs
+++ b/rsnix/src/ps2.rs
@@ -463,6 +463,26 @@ pub struct MouseEvent {
     pub middle: bool,
 }
 
+/// What happened in a window-relative (GUI) mouse event.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum MouseKind {
+    Move,
+    Press,
+    Release,
+}
+
+/// A mouse event delivered to a focused GUI window: absolute coordinates
+/// relative to the window's content top-left, the current button bitmask,
+/// and the action (move / press / release).  Unlike `MouseEvent` (relative
+/// deltas), this is what an app's drawing loop consumes.
+#[derive(Clone, Copy, Debug)]
+pub struct AppMouseEvent {
+    pub x: i32,
+    pub y: i32,
+    pub buttons: u8,
+    pub kind: MouseKind,
+}
+
 /// Packet assembly state — lives in main context (consumer side), fed by
 /// the raw byte ring that the IRQ12 handler fills.
 struct MouseState {
diff --git a/rsnix/src/sched.rs b/rsnix/src/sched.rs
index 259ddf6..39ecb65 100644
--- a/rsnix/src/sched.rs
+++ b/rsnix/src/sched.rs
@@ -59,6 +59,9 @@ const MSG_CAP: usize = 16;
 pub enum TaskMsg {
     Key(crate::ps2::KeyEvent),
     Mouse(crate::ps2::MouseEvent),
+    AppMouse(crate::ps2::AppMouseEvent),
+    Focus(bool),
+    Close,
     Timer,
     User(u64),
 }
@@ -94,6 +97,11 @@ pub fn msg_describe(msg: &TaskMsg) -> alloc::string::String {
             if m.left { "L" } else { "-" },
             if m.right { "R" } else { "-" }
         ),
+        TaskMsg::AppMouse(m) => {
+            alloc::format!("AppMouse({},{} {:?} b={:#x})", m.x, m.y, m.kind, m.buttons)
+        }
+        TaskMsg::Focus(f) => alloc::format!("Focus({})", f),
+        TaskMsg::Close => "Close".into(),
         TaskMsg::Timer => "Timer".into(),
         TaskMsg::User(n) => alloc::format!("User({})", n),
     }
@@ -179,7 +187,10 @@ struct SpinWatch {
     last_rsp: usize,
     same: u32,
 }
-const SPIN_WATCH_INIT: SpinWatch = SpinWatch { last_rsp: 0, same: 0 };
+const SPIN_WATCH_INIT: SpinWatch = SpinWatch {
+    last_rsp: 0,
+    same: 0,
+};
 static mut SPIN_WATCH: [SpinWatch; MAX_TASKS] = [SPIN_WATCH_INIT; MAX_TASKS];
 /// A spinning background task is interrupted at roughly half the tick rate
 /// (it alternates with idle), so 1500 hits is ~30 s of wall time.
@@ -381,11 +392,7 @@ pub fn spawn(entry: fn(), name: &str) -> Option<usize> {
     };
     let ok = spawn_at(id, entry, name);
     unlock();
-    if ok {
-        Some(id)
-    } else {
-        None
-    }
+    if ok { Some(id) } else { None }
 }
 
 unsafe fn reap(id: usize) {
@@ -698,10 +705,12 @@ pub(crate) fn fault_dump(kind: &str, cr2: u64, frame: &crate::interrupts::IntFra
             }
             let ra = *(fp as *const u64).add(1); // [rbp+8] = return address
             if let Some((start, end)) = filter
-                && ra >= start as u64 && ra < end as u64 {
-                    bt[bn] = ra;
-                    bn += 1;
-                }
+                && ra >= start as u64
+                && ra < end as u64
+            {
+                bt[bn] = ra;
+                bn += 1;
+            }
             let nfp = *(fp as *const u64);
             if nfp <= fp {
                 break; // chain must grow upward
@@ -715,19 +724,21 @@ pub(crate) fn fault_dump(kind: &str, cr2: u64, frame: &crate::interrupts::IntFra
         while p + 8 <= limit && bn < bt.len() {
             let v = *(p as *const u64);
             if let Some((start, end)) = filter
-                && v >= start as u64 && v < end as u64 {
-                    let mut dup = false;
-                    for i in 0..bn {
-                        if bt[i] == v {
-                            dup = true;
-                            break;
-                        }
-                    }
-                    if !dup {
-                        bt[bn] = v;
-                        bn += 1;
+                && v >= start as u64
+                && v < end as u64
+            {
+                let mut dup = false;
+                for i in 0..bn {
+                    if bt[i] == v {
+                        dup = true;
+                        break;
                     }
                 }
+                if !dup {
+                    bt[bn] = v;
+                    bn += 1;
+                }
+            }
             p += 8;
         }
     }
@@ -842,7 +853,11 @@ pub(crate) fn fault_dump(kind: &str, cr2: u64, frame: &crate::interrupts::IntFra
             &mut w,
             core::format_args!(
                 "rax={:#x} rcx={:#x} rdx={:#x} rsi={:#x} rdi={:#x}",
-                frame.rax, frame.rcx, frame.rdx, frame.rsi, frame.rdi
+                frame.rax,
+                frame.rcx,
+                frame.rdx,
+                frame.rsi,
+                frame.rdi
             ),
         );
         w.len()
diff --git a/rsnix/src/tty.rs b/rsnix/src/tty.rs
index 0783521..6102fb5 100644
--- a/rsnix/src/tty.rs
+++ b/rsnix/src/tty.rs
@@ -41,14 +41,31 @@ static mut RAW_LEN: usize = 0;
 /// Combined blocking key poll: USB HID keyboard first (polled UHCI), then
 /// the PS/2 path (which parks via `hlt` until an IRQ-fed scancode lands).
 fn poll_key() -> KeyEvent {
-    if let Some(ev) = crate::uhci::try_poll_key() {
-        return ev;
+    loop {
+        // A GUI window has focus: the keyboard pump owns the keys.  Park so
+        // the shell/editor don't steal input from the focused app.
+        if crate::wm::focused().is_some() {
+            crate::sched::sleep_ms(5);
+            continue;
+        }
+        if let Some(ev) = crate::uhci::try_poll_key() {
+            return ev;
+        }
+        if let Some(ev) = ps2::try_poll_key() {
+            return ev;
+        }
+        // No key ready: park briefly, then re-check focus (so a focus change
+        // to a GUI window is noticed instead of blocking on a stolen key).
+        crate::sched::sleep_ms(5);
     }
-    ps2::poll_key()
 }
 
-/// Combined non-blocking key poll (USB first, then PS/2).
+/// Combined non-blocking key poll (USB first, then PS/2).  Returns `None`
+/// while a GUI window is focused (the keyboard pump owns the keys).
 fn try_poll_key() -> Option<KeyEvent> {
+    if crate::wm::focused().is_some() {
+        return None;
+    }
     crate::uhci::try_poll_key().or_else(ps2::try_poll_key)
 }
 
diff --git a/rsnix/src/vt.rs b/rsnix/src/vt.rs
index 9444063..c5fc5fd 100644
--- a/rsnix/src/vt.rs
+++ b/rsnix/src/vt.rs
@@ -147,6 +147,31 @@ pub fn size() -> (usize, usize) {
     unsafe { (ROWS, COLS) }
 }
 
+/// Re-render the console's cells into the shadow for a pixel region, so the
+/// window manager can restore the console (layer 0) beneath a window that
+/// moved, closed, or was minimized.  Does not push — the caller pushes once.
+pub fn repaint_region(x: usize, y: usize, w: usize, h: usize) {
+    unsafe {
+        if CELLS.is_null() {
+            return;
+        }
+        let (cols, rows) = (COLS, ROWS);
+        let c0 = x / 8;
+        let c1 = (x + w).div_ceil(8).min(cols);
+        let r0 = y / 16;
+        let r1 = (y + h).div_ceil(16).min(rows);
+        let cells = &*CELLS;
+        for r in r0..r1 {
+            for c in c0..c1 {
+                let cell = cells[r * cols + c];
+                let fg = PALETTE[cell.fg as usize];
+                let bg = PALETTE[cell.bg as usize];
+                crate::gop::shadow_glyph_px(c * 8, r * 16, cell.ch, fg, bg);
+            }
+        }
+    }
+}
+
 /// DEBUG (crash-family): read one cell's raw word (ch | fg<<16 | bg<<24)
 /// from the live cells grid and the rendered grid, for the given text
 /// row/col.  Returns (raw_cell, raw_rendered).
diff --git a/rsnix/src/wm.rs b/rsnix/src/wm.rs
new file mode 100644
index 0000000..a39702d
--- /dev/null
+++ b/rsnix/src/wm.rs
@@ -0,0 +1,592 @@
+//! Window manager — a shared facility (no dedicated task).
+//!
+//! Implements ADR 0004: overlapping windows backed by per-window pixel
+//! buffers, composited onto the canvas with window-granularity damage
+//! rectangles.  The console (`vt`) is layer 0 and is re-rendered (never
+//! re-allocated) when a region is exposed; GUI windows are composited
+//! above it.  Chrome (title bar) is WM-drawn; each window's buffer is its
+//! content only.
+//!
+//! Apps call in directly (`create_window`, `flush`, …).  Input routing and
+//! keybindings are handled here so `handle_key` is the single entry point
+//! for the GUI keyboard path.
+
+extern crate alloc;
+
+use core::sync::atomic::{AtomicUsize, Ordering};
+
+use crate::gop;
+use crate::memory;
+use crate::ps2::{AppMouseEvent, KeyEvent, MouseKind};
+use crate::sched::TaskMsg;
+
+/// Height of a window's title bar in pixels (one 8×16 glyph row).
+pub const TITLE_BAR_H: usize = 16;
+
+/// Sentinel: `FOCUSED == CONSOLE` means the console (vt) has focus.
+pub const CONSOLE: usize = usize::MAX;
+
+const MAX_WINDOWS: usize = 16;
+const MIN_W: usize = 64;
+const MIN_H: usize = 64;
+const CASCADE: usize = 24;
+const TITLE_MAX: usize = 32;
+
+// Palette (RGB; `gop::rgb` packs for the current pixel format).
+const TITLE_BG: (u8, u8, u8) = (0x3a, 0x3c, 0x42);
+const TITLE_BG_FOCUS: (u8, u8, u8) = (0x28, 0x4a, 0x8c);
+const TITLE_FG: (u8, u8, u8) = (0xff, 0xff, 0xff);
+const CLOSE_BG: (u8, u8, u8) = (0xb0, 0x30, 0x30);
+const MIN_BG: (u8, u8, u8) = (0x50, 0x50, 0x50);
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum WinState {
+    Visible,
+    Minimized,
+}
+
+#[derive(Clone, Copy)]
+struct Window {
+    used: bool,
+    state: WinState,
+    title: [u8; TITLE_MAX],
+    title_len: usize,
+    #[allow(dead_code)] // read once input routing delivers to the owner's queue
+    owner: usize,
+    x: usize,
+    y: usize,
+    w: usize,
+    h: usize,
+    buf: *mut u32,
+}
+
+const EMPTY: Window = Window {
+    used: false,
+    state: WinState::Visible,
+    title: [0; TITLE_MAX],
+    title_len: 0,
+    owner: usize::MAX,
+    x: 0,
+    y: 0,
+    w: 0,
+    h: 0,
+    buf: core::ptr::null_mut(),
+};
+
+static mut WINDOWS: [Window; MAX_WINDOWS] = [EMPTY; MAX_WINDOWS];
+/// Window ids in bottom→top z-order.
+static mut ZORDER: [usize; MAX_WINDOWS] = [usize::MAX; MAX_WINDOWS];
+static mut ZLEN: usize = 0;
+static FOCUSED: AtomicUsize = AtomicUsize::new(CONSOLE);
+static mut CASCADE_X: usize = 0;
+static mut CASCADE_Y: usize = 0;
+
+/// Initialise window state.  The console (vt) remains the visible layer 0;
+/// no GUI windows exist yet.
+pub fn init() {
+    unsafe {
+        ZLEN = 0;
+        CASCADE_X = 0;
+        CASCADE_Y = 0;
+    }
+    FOCUSED.store(CONSOLE, Ordering::Relaxed);
+}
+
+/// The focused window, or `None` if the console has focus.
+pub fn focused() -> Option<usize> {
+    let v = FOCUSED.load(Ordering::Relaxed);
+    if v == CONSOLE { None } else { Some(v) }
+}
+
+fn get(id: usize) -> Option<Window> {
+    if id >= MAX_WINDOWS {
+        return None;
+    }
+    let w = unsafe { WINDOWS[id] };
+    if w.used { Some(w) } else { None }
+}
+
+/// Create a window owned by the current task.  `w`×`h` is the *content*
+/// size (title bar excluded).  Returns the window id, or `None` on a full
+/// table or an allocation failure.
+pub fn create_window(title: &str, w: usize, h: usize) -> Option<usize> {
+    let (cw, ch) = gop::pixel_dims();
+    let w = w.max(MIN_W).min(cw.saturating_sub(8));
+    let h = h.max(MIN_H).min(ch.saturating_sub(TITLE_BAR_H + 8));
+    if w < MIN_W || h < MIN_H || cw == 0 || ch == 0 {
+        return None;
+    }
+
+    let pages = (w * h * 4).div_ceil(4096);
+    let buf = memory::alloc_pages(pages).map(|a| a as *mut u32)?;
+    // Zero-fill so a fresh canvas reads black, not garbage.
+    unsafe {
+        for i in 0..(w * h) {
+            *buf.add(i) = 0;
+        }
+    }
+
+    let id = unsafe {
+        let mut slot = None;
+        for i in 0..MAX_WINDOWS {
+            if !WINDOWS[i].used {
+                slot = Some(i);
+                break;
+            }
+        }
+        match slot {
+            Some(i) => i,
+            None => {
+                memory::free_pages(buf as usize, pages);
+                return None;
+            }
+        }
+    };
+
+    let (x, y) = unsafe {
+        let mut px = CASCADE_X;
+        let mut py = CASCADE_Y;
+        if px + w > cw {
+            px = 0;
+        }
+        if py + TITLE_BAR_H + h > ch {
+            py = 0;
+        }
+        CASCADE_X = px + CASCADE;
+        CASCADE_Y = py + CASCADE;
+        (px, py)
+    };
+
+    let mut tl = [0u8; TITLE_MAX];
+    let n = title.len().min(TITLE_MAX);
+    tl[..n].copy_from_slice(&title.as_bytes()[..n]);
+
+    unsafe {
+        WINDOWS[id] = Window {
+            used: true,
+            state: WinState::Visible,
+            title: tl,
+            title_len: n,
+            owner: crate::sched::current(),
+            x,
+            y,
+            w,
+            h,
+            buf,
+        };
+        ZORDER[ZLEN] = id;
+        ZLEN += 1;
+    }
+    focus(id);
+    Some(id)
+}
+
+/// Composite a window's full outer bounds (bottom→top), restoring the
+/// console beneath it.  Called by an app after it writes into its buffer.
+pub fn flush(id: usize) {
+    let Some(win) = get(id) else {
+        return;
+    };
+    composite_rect(win.x, win.y, win.w, win.h + TITLE_BAR_H);
+}
+
+/// Destroy a window: free its buffer, remove it, restore the exposed region.
+pub fn destroy(id: usize) {
+    let Some(win) = get(id) else {
+        return;
+    };
+    let (x, y, w, h) = (win.x, win.y, win.w, win.h + TITLE_BAR_H);
+    if !win.buf.is_null() {
+        let pages = (win.w * win.h * 4).div_ceil(4096);
+        memory::free_pages(win.buf as usize, pages);
+    }
+    remove_from_zorder(id);
+    unsafe {
+        WINDOWS[id] = EMPTY;
+    }
+    if focused() == Some(id) {
+        if unsafe { ZLEN } > 0 {
+            focus(unsafe { ZORDER[ZLEN - 1] });
+        } else {
+            focus_console();
+        }
+    }
+    composite_rect(x, y, w, h);
+}
+
+/// Minimize a window: it is no longer rendered (the app keeps running).
+pub fn minimize(id: usize) {
+    let Some(win) = get(id) else {
+        return;
+    };
+    if win.state == WinState::Minimized {
+        return;
+    }
+    let (x, y, w, h) = (win.x, win.y, win.w, win.h + TITLE_BAR_H);
+    unsafe {
+        WINDOWS[id].state = WinState::Minimized;
+    }
+    remove_from_zorder(id);
+    if focused() == Some(id) {
+        focus_console();
+    }
+    composite_rect(x, y, w, h);
+}
+
+/// Restore a minimized window (back to the top, focused).
+pub fn restore(id: usize) {
+    let Some(win) = get(id) else {
+        return;
+    };
+    if win.state == WinState::Visible {
+        return;
+    }
+    unsafe {
+        WINDOWS[id].state = WinState::Visible;
+        ZORDER[ZLEN] = id;
+        ZLEN += 1;
+    }
+    focus(id);
+    composite_rect(win.x, win.y, win.w, win.h + TITLE_BAR_H);
+}
+
+/// Focus a window (raising it).  Repaints the newly-focused window (so it
+/// appears above former occluders) and un-focuses the previous title bar.
+pub fn focus(id: usize) {
+    let Some(win) = get(id) else {
+        return;
+    };
+    if win.state != WinState::Visible {
+        return;
+    }
+    // Raise to the top of the z-order.
+    remove_from_zorder(id);
+    unsafe {
+        ZORDER[ZLEN] = id;
+        ZLEN += 1;
+    }
+    let prev = focused();
+    FOCUSED.store(id, Ordering::Relaxed);
+    if let Some(p) = prev
+        && p != id
+        && let Some(pw) = get(p)
+    {
+        let _ = crate::sched::send(pw.owner, TaskMsg::Focus(false));
+        composite_rect(pw.x, pw.y, pw.w, TITLE_BAR_H);
+    }
+    let _ = crate::sched::send(win.owner, TaskMsg::Focus(true));
+    composite_rect(win.x, win.y, win.w, win.h + TITLE_BAR_H);
+}
+
+/// Move focus to the console.
+pub fn focus_console() {
+    let prev = focused();
+    FOCUSED.store(CONSOLE, Ordering::Relaxed);
+    if let Some(p) = prev
+        && let Some(pw) = get(p)
+    {
+        let _ = crate::sched::send(pw.owner, TaskMsg::Focus(false));
+        composite_rect(pw.x, pw.y, pw.w, TITLE_BAR_H);
+    }
+}
+
+/// Cycle focus: console → top window → … → bottom window → console.
+pub fn focus_next() {
+    unsafe {
+        if ZLEN == 0 {
+            focus_console();
+            return;
+        }
+        match focused() {
+            None => focus(ZORDER[ZLEN - 1]),
+            Some(cur) => {
+                let mut idx = usize::MAX;
+                for i in 0..ZLEN {
+                    if ZORDER[i] == cur {
+                        idx = i;
+                        break;
+                    }
+                }
+                if idx == usize::MAX || idx == 0 {
+                    focus_console();
+                } else {
+                    focus(ZORDER[idx - 1]);
+                }
+            }
+        }
+    }
+}
+
+/// Handle a global WM keybinding.  Returns `true` if the key was consumed
+/// (F1–F4), `false` if it should be delivered to the focused app.
+pub fn handle_key(ev: KeyEvent) -> bool {
+    match ev {
+        KeyEvent::F(1) => {
+            spawn_terminal();
+            true
+        }
+        KeyEvent::F(2) => {
+            focus_next();
+            true
+        }
+        KeyEvent::F(3) => {
+            if let Some(id) = focused() {
+                minimize(id);
+            }
+            true
+        }
+        KeyEvent::F(4) => {
+            if let Some(id) = focused() {
+                request_close(id);
+            }
+            true
+        }
+        _ => false,
+    }
+}
+
+fn spawn_terminal() {
+    // Terminal app deferred (needs per-instance vt + per-instance shell).
+    crate::serial_println!("wm: F1 (spawn terminal) not implemented yet");
+}
+
+fn remove_from_zorder(id: usize) {
+    unsafe {
+        let mut j = 0;
+        for i in 0..ZLEN {
+            if ZORDER[i] != id {
+                ZORDER[j] = ZORDER[i];
+                j += 1;
+            }
+        }
+        ZLEN = j;
+    }
+}
+
+/// Repaint a canvas region bottom→top: restore the console (layer 0), then
+/// blit every visible window that intersects, then push once.
+fn composite_rect(x: usize, y: usize, w: usize, h: usize) {
+    crate::vt::repaint_region(x, y, w, h);
+    unsafe {
+        for i in 0..ZLEN {
+            draw_window_intersect(ZORDER[i], x, y, w, h);
+        }
+    }
+    gop::push_rect(x, y, w, h);
+}
+
+/// Blit the portion of a window that intersects `(rx, ry, rw, rh)`.
+fn draw_window_intersect(id: usize, rx: usize, ry: usize, rw: usize, rh: usize) {
+    let win = unsafe { WINDOWS[id] };
+    if !win.used || win.state != WinState::Visible {
+        return;
+    }
+    let wx = win.x;
+    let wy = win.y;
+    let ww = win.w;
+    let whh = win.h + TITLE_BAR_H;
+    let ix = wx.max(rx);
+    let iy = wy.max(ry);
+    let ix2 = (wx + ww).min(rx + rw);
+    let iy2 = (wy + whh).min(ry + rh);
+    if ix >= ix2 || iy >= iy2 {
+        return;
+    }
+    // Title bar strip.
+    let tb0 = wy;
+    let tb1 = wy + TITLE_BAR_H;
+    if iy < tb1 && iy2 > tb0 {
+        draw_title_bar(id);
+    }
+    // Content strip.
+    let c0 = wy + TITLE_BAR_H;
+    let c1 = wy + TITLE_BAR_H + win.h;
+    if iy2 > c0 && iy < c1 {
+        let cy0 = iy.max(c0);
+        let cy1 = iy2.min(c1);
+        let sx = ix - wx;
+        let sy = cy0 - c0;
+        let cw = ix2 - ix;
+        let chh = cy1 - cy0;
+        let src = unsafe { win.buf.add(sy * win.w + sx) };
+        gop::shadow_blit(ix, cy0, cw, chh, src, win.w);
+    }
+}
+
+/// Draw a window's full title bar (background, title text, min/close).
+fn draw_title_bar(id: usize) {
+    let win = unsafe { WINDOWS[id] };
+    let bg = if focused() == Some(id) {
+        TITLE_BG_FOCUS
+    } else {
+        TITLE_BG
+    };
+    let bgc = gop::rgb(bg.0, bg.1, bg.2);
+    gop::shadow_fill_rect(win.x, win.y, win.w, TITLE_BAR_H, bgc);
+
+    // Title text, clipped short of the two buttons.
+    let btn_w = 16;
+    let cols = win.w.saturating_sub(btn_w + 4) / 8;
+    for (i, &b) in win.title[..win.title_len].iter().enumerate().take(cols) {
+        gop::shadow_glyph_px(win.x + 4 + i * 8, win.y, b as u16, TITLE_FG, bg);
+    }
+
+    // Close button (right edge, red) and minimize button (grey).
+    let close_x = win.x + win.w - 8;
+    let min_x = win.x + win.w - 16;
+    gop::shadow_fill_rect(
+        min_x,
+        win.y,
+        8,
+        TITLE_BAR_H,
+        gop::rgb(MIN_BG.0, MIN_BG.1, MIN_BG.2),
+    );
+    gop::shadow_fill_rect(
+        close_x,
+        win.y,
+        8,
+        TITLE_BAR_H,
+        gop::rgb(CLOSE_BG.0, CLOSE_BG.1, CLOSE_BG.2),
+    );
+}
+
+/// The task that owns a window (its input destination).
+pub fn owner(id: usize) -> Option<usize> {
+    get(id).map(|w| w.owner)
+}
+
+/// A window's content buffer (pointer, width, height) for direct drawing.
+pub fn buffer(id: usize) -> Option<(*mut u32, usize, usize)> {
+    get(id).map(|w| (w.buf, w.w, w.h))
+}
+
+/// List windows as `(id, title, minimized)` for the shell `windows` command.
+pub fn list() -> alloc::vec::Vec<(usize, alloc::string::String, bool)> {
+    let mut out = alloc::vec::Vec::new();
+    for i in 0..MAX_WINDOWS {
+        let w = unsafe { WINDOWS[i] };
+        if w.used {
+            let title = alloc::string::String::from(
+                core::str::from_utf8(&w.title[..w.title_len]).unwrap_or("?"),
+            );
+            out.push((i, title, w.state == WinState::Minimized));
+        }
+    }
+    out
+}
+
+/// Request a cooperative close: deliver `Close` to the owning app (which is
+/// expected to call `destroy` and exit).
+pub fn request_close(id: usize) {
+    if let Some(w) = get(id) {
+        let _ = crate::sched::send(w.owner, TaskMsg::Close);
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Hit {
+    None,
+    Close,
+    Minimize,
+    Title,
+    Content,
+}
+
+/// Topmost visible window whose *outer* bounds contain the point.
+pub fn window_at(x: usize, y: usize) -> Option<usize> {
+    unsafe {
+        for i in (0..ZLEN).rev() {
+            let id = ZORDER[i];
+            let w = WINDOWS[id];
+            if !w.used || w.state != WinState::Visible {
+                continue;
+            }
+            if x >= w.x && x < w.x + w.w && y >= w.y && y < w.y + w.h + TITLE_BAR_H {
+                return Some(id);
+            }
+        }
+    }
+    None
+}
+
+fn hit_test(id: usize, x: usize, y: usize) -> Hit {
+    let Some(w) = get(id) else {
+        return Hit::None;
+    };
+    if y >= w.y + TITLE_BAR_H {
+        return Hit::Content;
+    }
+    let right = w.x + w.w;
+    if x >= right.saturating_sub(8) {
+        return Hit::Close;
+    }
+    if x >= right.saturating_sub(16) {
+        return Hit::Minimize;
+    }
+    Hit::Title
+}
+
+/// Route one mouse event (absolute canvas coords, button bitmask, kind).
+pub fn route_mouse(x: i32, y: i32, buttons: u8, kind: MouseKind) {
+    if kind == MouseKind::Press {
+        if x < 0 || y < 0 {
+            return;
+        }
+        let (cx, cy) = (x as usize, y as usize);
+        if let Some(id) = window_at(cx, cy) {
+            match hit_test(id, cx, cy) {
+                Hit::Close => request_close(id),
+                Hit::Minimize => minimize(id),
+                Hit::Title => focus(id),
+                Hit::Content => {
+                    focus(id);
+                    deliver_mouse(id, cx, cy, buttons, kind);
+                }
+                Hit::None => {}
+            }
+        } else {
+            focus_console();
+        }
+    } else if let Some(id) = focused() {
+        deliver_mouse(id, x as usize, y as usize, buttons, kind);
+    }
+}
+
+fn deliver_mouse(id: usize, cx: usize, cy: usize, buttons: u8, kind: MouseKind) {
+    let Some(w) = get(id) else {
+        return;
+    };
+    let rx = cx as i32 - w.x as i32;
+    let ry = cy as i32 - (w.y + TITLE_BAR_H) as i32;
+    if rx < 0 || ry < 0 || rx >= w.w as i32 || ry >= w.h as i32 {
+        return; // out of bounds — suppressed
+    }
+    let ev = AppMouseEvent {
+        x: rx,
+        y: ry,
+        buttons,
+        kind,
+    };
+    let _ = crate::sched::send(w.owner, TaskMsg::AppMouse(ev));
+}
+
+/// Spawn the keyboard pump task (routes keys to the focused GUI window).
+pub fn spawn_input_pump() -> Option<usize> {
+    crate::sched::spawn(pump_main, "wm-input")
+}
+
+fn pump_main() {
+    loop {
+        if focused().is_some() {
+            while let Some(ev) = crate::ps2::try_poll_key().or_else(crate::uhci::try_poll_key) {
+                if !handle_key(ev)
+                    && let Some(id) = focused()
+                    && let Some(o) = owner(id)
+                {
+                    let _ = crate::sched::send(o, TaskMsg::Key(ev));
+                }
+            }
+        }
+        crate::sched::sleep_ms(5);
+    }
+}