Then WM_DESTROY should have been called NM_DESTROY, since it is clearly a notification message not a command. The user is not wholly innocent here, but the Windows API team should be blamed for the misleading naming as well.
I guess the conclusion is that one cannot blindly take WM_xxx message and think 'oh I can use ::SendMessage() and friends to make windows do certain things'. Only the documented behavior are valid use cases.
I guess one could say that the WM_xxx message should've been split up into more subclasses, but where to draw the line? I'm quite fine with using WM_xxx for all the fundamental window manager messages, as long as one minds their documented behavior there is no problem. (I realize that this last sentence can spark a whole discussion by itself on how far self-documenting a 'sane' API should be, but that's rather subjective imo).
WM_PUBLIC_CREATE and WM_PROTECTED_DESTROY
Then there would be no confusion about who was supposed to send the messages and how they were meant to be interpreted. Of course they don't have to use this exact terminology, but you get the idea.
Yeah well there's the error in your thinking, and exactly what the OP was about: window messages aren't that. Every message is a callback, a 'notification' if you will. If you call RegisterClass() and pass a WNDPROC that does nothing (ignores all messages), it can still be created/destroyed with CreateWindow()/DestroyWindow(), and the 'notifications' it gets (WM_CLOSE and WM_DESTROY) can happily be ignored ('happily' as far as the window manager is concerned).
Win32 is not an OO API, and thinking of it too much in those terms will cause all sorts of confusion. Win32 is a C api, and yes things like MFC put an OO wrapper around it, but at some point the abstraction will start to leak if you take it to the extreme without thinking about the underlying system. Win32 is based around the OS calling back into your code through a well-defined callback function (the WNDPROC), a function with a fixed signature, and taking two arguments that are for all intents and purposes void*'s. The message ('WM_xxx') is a way to tell you how to interpret its arguments, and inform you about changes in the life cycle or state of the window. Everything else (like being able to 'send' messages to HWND's and make them behave in a certain way) comes from there, and much of it is convention - which often works, but when it doesn't, it's not the design's 'fault'.
The failing of the Windows message system is not distinguishing between the 'command' messages that you are allowed to send to a window to effect some action (WM_NOTIFY and friends) and the 'event' messages caused by the window manager (WM_DESTROY, input events etc.). It should be apparent that getting a window to respond to an event is not the same thing as effecting that event.
Crucially, OOP languages without access modifiers (or ones you can #define away, like C++) have this same problem. If an ignorant programmer thinks he can destroy a window by calling its _onDestroy() function, you have solved nothing.
With sufficient language support you can probably save users from themselves in this case, but there are many other cases where a user can do the wrong thing by not understanding the system. At some point the effort doesn't justify itself.
Deleted comment