What are each desktop window manager's handle's safety requirements?

i'm trying to use software rendering (currently pixels, i may switch to softbuffer) with bevy,
but both require a HasWindowHandle type to create the buffer, which requires unsafe code, but i can't determine what safety requirements i actually have to follow.
for example this function just says

Safety
Some platforms have constraints on where/how this handle can be used. For example, some platforms don’t support doing window operations off of the main thread. The caller must ensure the RawHandleWrapper is only used in valid contexts.

which tells me just about anything and everything involving the handle could be unsafe, which isn't very helpful.

i only care about linux (X11 + Wayland) and windows (no idea what that uses),
i don't care about supporting MacO, iOS, Android, Plan 9, etc (i can just panic if their window manager is used)

so i just need to know what the safety requirements are for these ~3 (i hope modern windows only has 1) window managers actually are,
if i can send their ThreadLockedRawWindowHandleWrapper across threads,
and if i can create the ThreadLockedRawWindowHandleWrapper and buffer on any thread.

Generally, you don't need to use any unsafe code. You get the handle from winit or another windowing library, and pass it to pixels, and don't implement or call the trait yourself. The libraries are responsible for maintaining safety.

there doesn't seem to be a correct way to get a owned window in bevy_winit, there's just WinitWindows which has a method for getting a reference to a WindowWrapper (which won't live long enough),
and a function for removing a window (which returns a owned wrapper of the removed window), which says it should only be called when a window is closed, so using that sounds like it would break something.

I would imagine you likely can’t use pixels with bevy-managed windows anyway, because bevy would be expecting to attach its own renderer to them. You should consult people who know Bevy's winit-related workings specifically about how to do this (I know some things but not this), or, if there is not a way to do that, create your own window which you don’t tell Bevy about (which might require ditching bevy/winit integration entirely and managing the event loop yourself from outside).

All that said, it would probably be easier to just stick to using Bevy’s renderer instead of pixels — it won’t be quite as convenient but you can do all the same things.