#!/usr/bin/env bash
set -Eeuo pipefail
export PATH=/usr/bin
export LC_ALL=C

# Build and stage the exact experimental native-5K Aquamarine source used by
# the documented Omarchy test machine. This script never uses sudo, replaces
# distro packages, edits the active Hyprland config, or restarts the session.

readonly BASE_COMMIT=f3d1804205e8158c15595cdda1b566f93349ffae
readonly SOURCE_HEAD=01cad213c76ab1cc4adfe80ad9b7093f9e4c721b
readonly RESULT_TREE=08f6997bc876ea459d1fae4876cd25eac474e835
readonly MBOX_NAME=aquamarine-native5k-f3d1804-01cad21.mbox
readonly MBOX_SHA256=e4d1493cdb65dc90f7cdb4b03120fa23ca549ddc57ff8b14c67e255652eeed5c
readonly MBOX_URL=https://aquamarine.youens.com/aquamarine-native5k-f3d1804-01cad21.mbox
readonly RELEASE=01cad21

die() {
  printf 'native5k-stage: %s\n' "$*" >&2
  exit 1
}

need() {
  command -v "$1" >/dev/null 2>&1 || die "required command not found: $1"
}

for command in git curl sha256sum cmake ctest ninja readelf ldd awk sed grep tail install systemctl readlink pgrep alacritty edid-decode dd cmp od tr wc mktemp rm rmdir getent; do
  need "$command"
done

[[ $EUID -ne 0 ]] || die 'run as your desktop user, not as root'
[[ $(uname -m) == x86_64 ]] || die 'only the tested x86_64 build path is documented'
[[ -x /usr/bin/Hyprland ]] || die '/usr/bin/Hyprland was not found'
[[ -x /usr/bin/alacritty ]] || die '/usr/bin/alacritty was not found for the recovery terminal binding'
command -v pacman >/dev/null 2>&1 || die 'this guided script is for Arch/Omarchy; use the agent route on other systems'
login_shell=$(getent passwd "$UID" | awk -F: 'NR == 1 {print $7}')
[[ $(readlink -f "$login_shell" 2>/dev/null || true) == /usr/bin/bash ]] || \
  die "guided SDDM path requires a Bash login shell; found: ${login_shell:-unknown}"

clean_env() {
  env \
    -u LD_LIBRARY_PATH \
    -u LD_PRELOAD \
    -u LD_AUDIT \
    -u BASH_ENV \
    -u ENV \
    -u OMARCHY_PATH \
    -u AQ_DRM_TILED_STARTUP \
    -u AQ_DRM_DEVICES \
    -u WLR_DRM_DEVICES \
    -u DRI_PRIME \
    -u GBM_BACKEND \
    -u __GLX_VENDOR_LIBRARY_NAME \
    -u VK_ICD_FILENAMES \
    "$@"
}

for override in \
  LD_LIBRARY_PATH LD_PRELOAD LD_AUDIT BASH_ENV ENV OMARCHY_PATH \
  AQ_DRM_TILED_STARTUP AQ_DRM_DEVICES WLR_DRM_DEVICES DRI_PRIME \
  GBM_BACKEND __GLX_VENDOR_LIBRARY_NAME VK_ICD_FILENAMES; do
  [[ ! -v $override ]] || \
    die "$override is already set; run the guided stage from a clean stock session or use the agent route"
done
while IFS= read -r environment_entry; do
  environment_name=${environment_entry%%=*}
  [[ $environment_name != AQ_* ]] || \
    die "$environment_name is already set; run the guided stage from a clean stock session or use the agent route"
done < <(env)

omarchy_package=$(pacman -Q omarchy 2>/dev/null || true)
hyprland_package=$(pacman -Q hyprland 2>/dev/null || true)
aquamarine_package=$(pacman -Q aquamarine 2>/dev/null || true)
uwsm_package=$(pacman -Q uwsm 2>/dev/null || true)
linux_package=$(pacman -Q linux 2>/dev/null || true)
base_devel_package=$(pacman -Q base-devel 2>/dev/null || true)
sddm_package=$(pacman -Q sddm 2>/dev/null || true)
v4l_utils_package=$(pacman -Q v4l-utils 2>/dev/null || true)
[[ $omarchy_package == 'omarchy 4.0.1-1' ]] || \
  die "expected omarchy 4.0.1-1, found: ${omarchy_package:-not installed}"
[[ $hyprland_package == 'hyprland 0.56.2-1' ]] || \
  die "expected hyprland 0.56.2-1, found: ${hyprland_package:-not installed}"
[[ $aquamarine_package == 'aquamarine 0.14.0-2' ]] || \
  die "expected aquamarine 0.14.0-2, found: ${aquamarine_package:-not installed}"
[[ $uwsm_package == 'uwsm 0.26.7-1' ]] || \
  die "expected uwsm 0.26.7-1, found: ${uwsm_package:-not installed}"
[[ $linux_package == 'linux 7.1.9.arch1-2' ]] || \
  die "expected linux 7.1.9.arch1-2, found: ${linux_package:-not installed}"
[[ $(uname -r) == '7.1.9-arch1-2' ]] || \
  die "expected running kernel 7.1.9-arch1-2, found: $(uname -r)"
[[ $base_devel_package == 'base-devel 1-2' ]] || \
  die "expected base-devel 1-2, found: ${base_devel_package:-not installed}"
[[ $sddm_package == 'sddm 0.21.0-7' ]] || \
  die "expected sddm 0.21.0-7, found: ${sddm_package:-not installed}"
[[ $v4l_utils_package == 'v4l-utils 1.32.0-2' ]] || \
  die "expected v4l-utils 1.32.0-2, found: ${v4l_utils_package:-not installed}"
system_ldd=$(clean_env ldd /usr/bin/Hyprland 2>/dev/null) || die 'could not inspect the stock Hyprland loader closure'
! grep -q 'not found' <<<"$system_ldd" || die 'stock Hyprland has a missing dynamic-library dependency'
grep -q 'libaquamarine\.so\.13' <<<"$system_ldd" || \
  die 'Hyprland does not link the tested libaquamarine.so.13 ABI'
display_manager=$(basename "$(readlink -f /etc/systemd/system/display-manager.service 2>/dev/null || true)")
[[ $display_manager == sddm.service ]] || die "expected SDDM, found: ${display_manager:-no display-manager symlink}"
systemctl is-active --quiet display-manager.service || die 'the display manager is not active'

extract_one() {
  local decoded=$1 expression=$2 label=$3
  local -a values=()
  mapfile -t values < <(LC_ALL=C sed -nE "$expression" "$decoded")
  (( ${#values[@]} == 1 )) || die "$label is missing or ambiguous in ${decoded##*/}"
  printf '%s\n' "${values[0]}"
}

printf 'Validating the exact hardware-proven tiled-display topology...\n'
shopt -s nullglob
status_files=(/sys/class/drm/card*-*/status)
shopt -u nullglob
(( ${#status_files[@]} > 0 )) || die 'no DRM connector status files found'
connected_connectors=()
for status_file in "${status_files[@]}"; do
  IFS= read -r status <"$status_file" || die "could not read $status_file"
  [[ $status == connected ]] && connected_connectors+=("${status_file%/status}")
done
(( ${#connected_connectors[@]} == 2 )) || \
  die "guided path requires exactly two connected DRM connectors total; found ${#connected_connectors[@]}"

drm_card=
declare -A output_for=()
for connector in "${connected_connectors[@]}"; do
  connector_name=${connector##*/}
  [[ $connector_name =~ ^(card[0-9]+)-(DP-[0-9]+)$ ]] || \
    die "guided path supports only the proven two-DisplayPort layout; found $connector_name"
  this_card=${BASH_REMATCH[1]}
  output_for["$connector_name"]=${BASH_REMATCH[2]}
  if [[ -z $drm_card ]]; then
    drm_card=$this_card
  else
    [[ $this_card == "$drm_card" ]] || \
      die 'the two connected tile members are not on the same DRM device'
  fi
done

topology_tmp=$(mktemp -d /tmp/aquamarine-native5k-topology.XXXXXXXX)
[[ $topology_tmp =~ ^/tmp/aquamarine-native5k-topology\.[[:alnum:]]{8}$ ]] || \
  die "unexpected topology snapshot path: $topology_tmp"
topology_files=()
cleanup_topology_snapshot() {
  (( ${#topology_files[@]} == 0 )) || rm -f -- "${topology_files[@]}"
  [[ ! -d ${topology_tmp:-} ]] || rmdir -- "$topology_tmp"
}
trap cleanup_topology_snapshot EXIT

declare -A location_for=() vendor_for=() product_for=() tile_serial_for=()
declare -A container_for=() display_serial_for=() edid_sha_for=()
for connector in "${connected_connectors[@]}"; do
  connector_name=${connector##*/}
  raw_a=$topology_tmp/$connector_name.a.edid
  raw_b=$topology_tmp/$connector_name.b.edid
  decoded=$topology_tmp/$connector_name.txt
  topology_files+=("$raw_a" "$raw_b" "$decoded")

  # Sysfs EDID attributes report st_size=0, so validate regular snapshots.
  dd if="$connector/edid" of="$raw_a" status=none || die "could not read EDID from $connector_name"
  dd if="$connector/edid" of="$raw_b" status=none || die "could not re-read EDID from $connector_name"
  [[ -s $raw_a && -s $raw_b ]] || die "$connector_name exposed an empty EDID"
  cmp -s "$raw_a" "$raw_b" || die "$connector_name EDID changed between reads"

  byte_count=$(wc -c <"$raw_a")
  (( byte_count >= 128 && byte_count % 128 == 0 )) || \
    die "$connector_name EDID length is not a nonzero multiple of 128 bytes"
  header=$(od -An -tx1 -N8 "$raw_a" | tr -d '[:space:]')
  [[ $header == 00ffffffffffff00 ]] || die "$connector_name EDID header is invalid"
  extension_count=$(od -An -tu1 -j126 -N1 "$raw_a" | tr -d '[:space:]')
  [[ $extension_count =~ ^[0-9]+$ ]] || die "$connector_name extension count could not be read"
  (( byte_count == 128 * (extension_count + 1) )) || \
    die "$connector_name EDID byte count does not match its extension count"
  LC_ALL=C od -An -v -tu1 "$raw_a" | LC_ALL=C awk '
    { for (i = 1; i <= NF; ++i) { sum += $i; ++count; if (count % 128 == 0) {
        if (sum % 256 != 0) exit 1; sum = 0
    } } }
    END { if (count == 0 || count % 128 != 0) exit 1 }
  ' || die "$connector_name EDID block checksum is invalid"

  LC_ALL=C edid-decode --skip-hex-dump "$raw_a" >"$decoded" || \
    die "edid-decode could not parse $connector_name"
  topology_blocks=$(grep -Ec '^[[:space:]]*Tiled Display Topology Data Block \(0x12\):[[:space:]]*$' "$decoded" || true)
  (( topology_blocks == 1 )) || die "$connector_name does not contain exactly one tiled-topology block"
  enclosure_lines=$(grep -Ec '^[[:space:]]*Tiled display consists of a single physical display enclosure[[:space:]]*$' "$decoded" || true)
  (( enclosure_lines == 1 )) || die "$connector_name is not marked as one physical enclosure"

  grid=$(extract_one "$decoded" 's/^[[:space:]]*Num horizontal tiles: ([0-9]+) Num vertical tiles: ([0-9]+)[[:space:]]*$/\1 \2/p' 'tile grid')
  [[ $grid == '2 1' ]] || die "$connector_name is not a 2x1 tile grid: $grid"
  location_for["$connector_name"]=$(extract_one "$decoded" 's/^[[:space:]]*Tile location: ([0-9]+),[[:space:]]*([0-9]+)[[:space:]]*$/\1 \2/p' 'tile location')
  resolution=$(extract_one "$decoded" 's/^[[:space:]]*Tile resolution: ([0-9]+)x([0-9]+)[[:space:]]*$/\1x\2/p' 'tile resolution')
  [[ $resolution == 2560x2880 ]] || die "$connector_name has unsupported tile resolution: $resolution"

  manufacturer=$(extract_one "$decoded" 's/^[[:space:]]*Manufacturer: ([^[:space:]]+)[[:space:]]*$/\1/p' 'base manufacturer')
  model=$(extract_one "$decoded" 's/^[[:space:]]*Model: ([0-9]+)[[:space:]]*$/\1/p' 'base model')
  product_name=$(extract_one "$decoded" "s/^[[:space:]]*Display Product Name: '([^']+)'[[:space:]]*$/\\1/p" 'display product name')
  [[ $manufacturer == GSM && $model == 23313 && $product_name == 'LG UltraFine' ]] || \
    die "$connector_name is not the tested LG UltraFine identity"
  native_format=$(extract_one "$decoded" 's/^[[:space:]]*Display native pixel format: ([0-9]+x[0-9]+)[[:space:]]*$/\1/p' 'native pixel format')
  [[ $native_format == 5120x2880 ]] || die "$connector_name does not advertise native 5120x2880"

  vendor_for["$connector_name"]=$(extract_one "$decoded" 's/^[[:space:]]*Tiled Display Manufacturer\/Vendor ID: ([^[:space:]]+)[[:space:]]*$/\1/p' 'tiled vendor')
  product_for["$connector_name"]=$(extract_one "$decoded" 's/^[[:space:]]*Tiled Display Product ID Code: ([0-9]+)[[:space:]]*$/\1/p' 'tiled product')
  tile_serial_for["$connector_name"]=$(extract_one "$decoded" 's/^[[:space:]]*Tiled Display Serial Number: ([0-9]+)[[:space:]]*$/\1/p' 'tiled serial')
  [[ ${vendor_for[$connector_name]} == GSM && ${product_for[$connector_name]} == 23313 ]] || \
    die "$connector_name tiled identity is not the tested LG model"
  container_for["$connector_name"]=$(extract_one "$decoded" 's/^[[:space:]]*Container ID: ([0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12})[[:space:]]*$/\1/p' 'container ID')
  display_serial_for["$connector_name"]=$(extract_one "$decoded" "s/^[[:space:]]*Display Product Serial Number: '([^']+)'[[:space:]]*$/\\1/p" 'display serial')

  refresh=$(extract_one "$decoded" 's/^[[:space:]]*DTD(:| [0-9]+:)[[:space:]]+2560x2880[[:space:]]+([0-9]+([.][0-9]+)?) Hz([[:space:]].*)?$/\2/p' '2560x2880 detailed timing')
  awk -v hz="$refresh" 'BEGIN { exit !(hz >= 59.9 && hz <= 60.1) }' || \
    die "$connector_name 2560x2880 timing is not near 60 Hz: $refresh"
  edid_sha_for["$connector_name"]=$(sha256sum "$raw_a" | awk '{print $1}')
done

first_name=${connected_connectors[0]##*/}
second_name=${connected_connectors[1]##*/}
[[ ${vendor_for[$first_name]} == "${vendor_for[$second_name]}" &&
   ${product_for[$first_name]} == "${product_for[$second_name]}" &&
   ${tile_serial_for[$first_name]} == "${tile_serial_for[$second_name]}" &&
   ${container_for[$first_name]} == "${container_for[$second_name]}" &&
   ${display_serial_for[$first_name]} == "${display_serial_for[$second_name]}" ]] || \
  die 'the two streams do not identify the same tiled physical display'

left_name=
right_name=
for connector in "${connected_connectors[@]}"; do
  connector_name=${connector##*/}
  case ${location_for[$connector_name]} in
    '0 0') [[ -z $left_name ]] || die 'duplicate left tile'; left_name=$connector_name ;;
    '1 0') [[ -z $right_name ]] || die 'duplicate right tile'; right_name=$connector_name ;;
    *) die "$connector_name has unexpected tile location: ${location_for[$connector_name]}" ;;
  esac
done
[[ -n $left_name && -n $right_name ]] || die 'the 2x1 tile grid is incomplete'

shopt -s nullglob
status_files_after=(/sys/class/drm/card*-*/status)
shopt -u nullglob
connected_after=()
for status_file in "${status_files_after[@]}"; do
  IFS= read -r status <"$status_file" || die "could not re-read $status_file"
  [[ $status == connected ]] && connected_after+=("${status_file%/status}")
done
[[ "${connected_after[*]}" == "${connected_connectors[*]}" ]] || \
  die 'DRM connector topology changed during validation'

aggregate_output=${output_for[$left_name]}
tile_peer_output=${output_for[$right_name]}
[[ $aggregate_output =~ ^DP-[0-9]+$ && $tile_peer_output =~ ^DP-[0-9]+$ ]] || \
  die 'could not derive safe aggregate and peer output names'
[[ -r /sys/class/drm/$drm_card/device/vendor && -r /sys/class/drm/$drm_card/device/device ]] || \
  die "could not read PCI identity for $drm_card"
drm_driver=$(basename "$(readlink -f "/sys/class/drm/$drm_card/device/driver" 2>/dev/null || true)")
gpu_vendor_id=$(<"/sys/class/drm/$drm_card/device/vendor")
gpu_device_id=$(<"/sys/class/drm/$drm_card/device/device")
[[ $drm_driver == amdgpu && $gpu_vendor_id == 0x1002 && $gpu_device_id == 0x1900 ]] || \
  die "guided path is proven only on Radeon 780M-class AMD 1002:1900 with amdgpu; found ${drm_driver:-unknown} ${gpu_vendor_id:-unknown}:${gpu_device_id:-unknown}"
tile_identity=${vendor_for[$left_name]}:${product_for[$left_name]}:${tile_serial_for[$left_name]}
tile_container_id=${container_for[$left_name]}
aggregate_edid_sha=${edid_sha_for[$left_name]}
tile_peer_edid_sha=${edid_sha_for[$right_name]}

cleanup_topology_snapshot
trap - EXIT
topology_tmp=
printf 'topology=%s/%s(left) + %s/%s(right) identity=%s container=%s\n' \
  "$drm_card" "$aggregate_output" "$drm_card" "$tile_peer_output" "$tile_identity" "$tile_container_id"

[[ ${XDG_DATA_HOME:-$HOME/.local/share} == "$HOME/.local/share" ]] || \
  die 'custom XDG_DATA_HOME is not supported by the guided login-session path'
[[ ${XDG_CONFIG_HOME:-$HOME/.config} == "$HOME/.config" ]] || \
  die 'custom XDG_CONFIG_HOME is not supported by the guided login-session path'
[[ ${XDG_CACHE_HOME:-$HOME/.cache} == "$HOME/.cache" ]] || \
  die 'custom XDG_CACHE_HOME is not supported by the guided build path'
[[ ${XDG_STATE_HOME:-$HOME/.local/state} == "$HOME/.local/state" ]] || \
  die 'custom XDG_STATE_HOME is not supported by the guided login-session path'
data_home=$HOME/.local/share
config_home=$HOME/.config
cache_home=${XDG_CACHE_HOME:-$HOME/.cache}
stage_root=$data_home/aquamarine-native5k/$RELEASE
build_root=$cache_home/aquamarine-native5k/build-$RELEASE
config_root=$config_home/aquamarine-native5k

[[ $stage_root == "$HOME/"* && $stage_root != "$HOME/" ]] || die "unsafe stage path: $stage_root"
[[ $build_root == "$HOME/"* && $build_root != "$HOME/" ]] || die "unsafe build path: $build_root"
[[ $config_root == "$HOME/"* && $config_root != "$HOME/" ]] || die "unsafe config path: $config_root"
[[ ! -e $stage_root ]] || die "stage already exists: $stage_root (preserve it for inspection, then rename it before retrying)"
[[ ! -e $build_root ]] || die "build directory already exists: $build_root (preserve it for inspection, then rename it before retrying)"
[[ ! -e $config_root ]] || die "isolated config already exists: $config_root (preserve it for inspection, then rename it before retrying)"

mkdir -p -- "$(dirname "$stage_root")" "$(dirname "$build_root")" "$(dirname "$config_root")"
mkdir -- "$build_root" "$config_root"

printf 'Downloading the reviewed source series...\n'
if [[ -n ${NATIVE5K_MBOX_FILE:-} ]]; then
  [[ -f $NATIVE5K_MBOX_FILE ]] || die "local mbox not found: $NATIVE5K_MBOX_FILE"
  install -m 0644 -- "$NATIVE5K_MBOX_FILE" "$build_root/$MBOX_NAME"
else
  curl --fail --location --proto '=https' --tlsv1.2 "$MBOX_URL" --output "$build_root/$MBOX_NAME"
fi
printf '%s  %s\n' "$MBOX_SHA256" "$build_root/$MBOX_NAME" | sha256sum --check -
mbox_last=$(grep -E '^From [0-9a-f]{40} Mon Sep 17 00:00:00 2001$' "$build_root/$MBOX_NAME" | tail -n 1)
[[ $mbox_last == "From $SOURCE_HEAD Mon Sep 17 00:00:00 2001" ]] || \
  die 'the mbox does not end with the published historical source head'

printf 'Cloning the exact Aquamarine base...\n'
clean_env git clone --filter=blob:none https://github.com/hyprwm/aquamarine.git "$build_root/aquamarine"
clean_env git -C "$build_root/aquamarine" checkout --detach "$BASE_COMMIT"
clean_env git -C "$build_root/aquamarine" config user.name 'Native 5K source replay'
clean_env git -C "$build_root/aquamarine" config user.email 'native5k@localhost.invalid'
clean_env git -C "$build_root/aquamarine" config commit.gpgsign false

printf 'Applying the 21-commit hardware-proven startup series...\n'
clean_env git -C "$build_root/aquamarine" am "$build_root/$MBOX_NAME"
actual_tree=$(clean_env git -C "$build_root/aquamarine" rev-parse HEAD^{tree})
[[ $actual_tree == "$RESULT_TREE" ]] || die "resulting tree mismatch: $actual_tree"
[[ $(clean_env git -C "$build_root/aquamarine" rev-list --count "$BASE_COMMIT"..HEAD) == 21 ]] || \
  die 'the applied series does not contain exactly 21 commits'

printf 'Building and running the source tests with no inherited LD_LIBRARY_PATH...\n'
clean_env cmake \
  -S "$build_root/aquamarine" \
  -B "$build_root/out" \
  -G Ninja \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_INSTALL_PREFIX="$stage_root"
clean_env cmake --build "$build_root/out" --parallel
clean_env ctest --test-dir "$build_root/out" --output-on-failure
clean_env cmake --install "$build_root/out"

candidate=$(find "$stage_root/lib" -maxdepth 1 -type f -name 'libaquamarine.so.0.14.0' -print -quit)
[[ -n $candidate && -f $candidate ]] || die 'the staged libaquamarine.so.0.14.0 was not found'
readelf -d "$candidate" | grep -q 'SONAME.*\[libaquamarine.so.13\]' || die 'staged SONAME mismatch'
candidate_link=$stage_root/lib/libaquamarine.so.13
[[ -L $candidate_link ]] || die 'the staged libaquamarine.so.13 SONAME link was not found'
[[ $(readlink -f "$candidate_link") == "$candidate" ]] || die 'the staged SONAME link does not resolve to the verified candidate'
candidate_sha=$(sha256sum "$candidate" | awk '{print $1}')
candidate_ldd=$(env -u LD_PRELOAD -u LD_AUDIT LD_LIBRARY_PATH="$stage_root/lib" ldd /usr/bin/Hyprland 2>/dev/null) || \
  die 'could not inspect Hyprland with the staged library'
! grep -q 'not found' <<<"$candidate_ldd" || die 'the staged Hyprland loader closure has a missing dependency'
grep -qF "$stage_root/lib/libaquamarine.so.13" <<<"$candidate_ldd" || \
  die 'the dynamic loader did not select the staged Aquamarine library'

cat >"$config_root/hyprland.lua" <<'LUA'
-- Standalone recovery-first configuration for the experimental native-5K
-- session. It deliberately imports no Omarchy defaults, user modules, shell,
-- autostart, hooks, lock, idle daemon, Night Light, or monitor utilities.
local function read_vconsole()
  local values = {}
  local file = io.open("/etc/vconsole.conf", "r")
  if not file then return values end
  for line in file:lines() do
    local key, value = line:match("^%s*([%w_]+)%s*=%s*(.-)%s*$")
    if key and value then
      value = value:gsub("%s+#.*$", "")
      value = value:gsub('^"(.*)"$', "%1")
      value = value:gsub("^'(.*)'$", "%1")
      values[key] = value
    end
  end
  file:close()
  return values
end

local vconsole = read_vconsole()

hl.env("GDK_SCALE", "2")
hl.env("XCURSOR_SIZE", "24")
hl.env("HYPRCURSOR_SIZE", "24")
hl.env("GDK_BACKEND", "wayland")
hl.env("QT_QPA_PLATFORM", "wayland")
hl.env("MOZ_ENABLE_WAYLAND", "1")
hl.env("XDG_CURRENT_DESKTOP", "Native5K")
hl.env("XDG_SESSION_DESKTOP", "Native5K")
hl.env("XDG_SESSION_TYPE", "wayland")
hl.env("PATH", "/usr/bin")
hl.env("NATIVE5K_STARTUP_ONLY", "1")

hl.monitor({ output = "__NATIVE5K_OUTPUT__", mode = "5120x2880@60", position = "0x0", scale = 2 })

hl.config({
  input = {
    kb_layout = vconsole.XKBLAYOUT or "us",
    kb_variant = vconsole.XKBVARIANT or "",
    kb_model = "",
    kb_options = "",
    kb_rules = "",
    follow_mouse = 1,
    sensitivity = 0,
    repeat_rate = 30,
    repeat_delay = 300,
    numlock_by_default = true,
  },
  general = {
    gaps_in = 4,
    gaps_out = 4,
    border_size = 1,
    allow_tearing = false,
    layout = "dwindle",
  },
  decoration = {
    rounding = 0,
    shadow = { enabled = false },
    blur = { enabled = false },
  },
  animations = { enabled = false },
  xwayland = { enabled = false },
  cursor = {
    no_hardware_cursors = 1,
    inactive_timeout = 0,
  },
  misc = {
    disable_hyprland_logo = false,
    disable_splash_rendering = false,
    disable_scale_notification = true,
    focus_on_activate = true,
    vrr = 0,
    key_press_enables_dpms = false,
    mouse_move_enables_dpms = false,
    allow_session_lock_restore = false,
  },
})

hl.bind("SUPER + RETURN", hl.dsp.exec_cmd("/usr/bin/alacritty --config-file /dev/null -e /usr/bin/bash --noprofile --norc"), { description = "Open clean recovery terminal" })
hl.bind("SUPER + Q", hl.dsp.window.close(), { description = "Close active window" })
hl.bind("SUPER + SHIFT + ESCAPE", hl.dsp.exit(), { description = "Return to login screen" })
LUA

sed -i "s/__NATIVE5K_OUTPUT__/$aggregate_output/" "$config_root/hyprland.lua"
grep -qF "output = \"$aggregate_output\"" "$config_root/hyprland.lua" || \
  die 'failed to pin the reviewed aggregate output in the isolated config'

printf 'Verifying the isolated Hyprland configuration...\n'
clean_env /usr/bin/Hyprland --verify-config --config "$config_root/hyprland.lua"

config_sha=$(sha256sum "$config_root/hyprland.lua" | awk '{print $1}')
install -Dm0644 /dev/null "$stage_root/manifest.env"
{
  printf 'BASE_COMMIT=%s\n' "$BASE_COMMIT"
  printf 'SOURCE_HEAD=%s\n' "$SOURCE_HEAD"
  printf 'RESULT_TREE=%s\n' "$RESULT_TREE"
  printf 'MBOX_SHA256=%s\n' "$MBOX_SHA256"
  printf 'CANDIDATE_SHA256=%s\n' "$candidate_sha"
  printf 'CONFIG_SHA256=%s\n' "$config_sha"
  printf 'DRM_CARD=%q\n' "$drm_card"
  printf 'AGGREGATE_OUTPUT=%q\n' "$aggregate_output"
  printf 'TILE_PEER_OUTPUT=%q\n' "$tile_peer_output"
  printf 'TILE_IDENTITY=%q\n' "$tile_identity"
  printf 'TILE_CONTAINER_ID=%q\n' "$tile_container_id"
  printf 'AGGREGATE_EDID_SHA256=%q\n' "$aggregate_edid_sha"
  printf 'TILE_PEER_EDID_SHA256=%q\n' "$tile_peer_edid_sha"
  printf 'DRM_DRIVER=%q\n' "$drm_driver"
  printf 'GPU_VENDOR_ID=%q\n' "$gpu_vendor_id"
  printf 'GPU_DEVICE_ID=%q\n' "$gpu_device_id"
  printf 'OMARCHY_PACKAGE=%q\n' "$omarchy_package"
  printf 'HYPRLAND_PACKAGE=%q\n' "$hyprland_package"
  printf 'AQUAMARINE_PACKAGE=%q\n' "$aquamarine_package"
  printf 'UWSM_PACKAGE=%q\n' "$uwsm_package"
  printf 'LINUX_PACKAGE=%q\n' "$linux_package"
  printf 'SDDM_PACKAGE=%q\n' "$sddm_package"
  printf 'V4L_UTILS_PACKAGE=%q\n' "$v4l_utils_package"
} >"$stage_root/manifest.env"

cat >"$stage_root/aquamarine-native5k-session" <<'SH'
#!/usr/bin/bash
set -Eeuo pipefail
export PATH=/usr/bin
export LC_ALL=C
unset LD_LIBRARY_PATH LD_PRELOAD LD_AUDIT BASH_ENV ENV OMARCHY_PATH
unset HYPRLAND_CONFIG HYPRLAND_INSTANCE_SIGNATURE WAYLAND_DISPLAY
release=01cad21
data_home=$HOME/.local/share
config_home=$HOME/.config
stage_root=$data_home/aquamarine-native5k/$release
manifest=$stage_root/manifest.env
candidate=$stage_root/lib/libaquamarine.so.0.14.0
candidate_link=$stage_root/lib/libaquamarine.so.13
config=$config_home/aquamarine-native5k/hyprland.lua
while IFS= read -r environment_entry; do
  environment_name=${environment_entry%%=*}
  case $environment_name in
    AQ_*|WLR_DRM_DEVICES|DRI_PRIME|GBM_BACKEND|__GLX_VENDOR_LIBRARY_NAME|VK_ICD_FILENAMES)
      unset "$environment_name"
      ;;
  esac
done < <(/usr/bin/env)
[[ -r $manifest && -f $candidate && -L $candidate_link && -f $config ]] || {
  echo 'Native-5K stage is incomplete; returning to the login screen.' >&2
  exit 1
}
# shellcheck disable=SC1090
. "$manifest"
[[ $DRM_CARD =~ ^card[0-9]+$ && $AGGREGATE_OUTPUT =~ ^DP-[0-9]+$ && $TILE_PEER_OUTPUT =~ ^DP-[0-9]+$ ]] || {
  echo 'Native-5K connector provenance is invalid; refusing to start.' >&2
  exit 1
}
[[ $AGGREGATE_EDID_SHA256 =~ ^[0-9a-f]{64}$ && $TILE_PEER_EDID_SHA256 =~ ^[0-9a-f]{64}$ ]] || {
  echo 'Native-5K EDID provenance is invalid; refusing to start.' >&2
  exit 1
}
[[ -r /sys/class/drm/$DRM_CARD/device/vendor && -r /sys/class/drm/$DRM_CARD/device/device ]] || {
  echo 'Native-5K GPU identity is no longer readable; refusing to start.' >&2
  exit 1
}
current_drm_driver=$(basename "$(readlink -f "/sys/class/drm/$DRM_CARD/device/driver" 2>/dev/null || true)")
current_gpu_vendor=$(<"/sys/class/drm/$DRM_CARD/device/vendor")
current_gpu_device=$(<"/sys/class/drm/$DRM_CARD/device/device")
[[ $DRM_DRIVER == amdgpu && $GPU_VENDOR_ID == 0x1002 && $GPU_DEVICE_ID == 0x1900 &&
   $current_drm_driver == "$DRM_DRIVER" && $current_gpu_vendor == "$GPU_VENDOR_ID" &&
   $current_gpu_device == "$GPU_DEVICE_ID" ]] || {
  echo 'Native-5K GPU or DRM driver changed; refusing to start.' >&2
  exit 1
}
shopt -s nullglob
status_files=(/sys/class/drm/card*-*/status)
shopt -u nullglob
connected_connectors=()
for status_file in "${status_files[@]}"; do
  IFS= read -r status <"$status_file" || {
    echo "Could not read $status_file; refusing to start." >&2
    exit 1
  }
  [[ $status == connected ]] && connected_connectors+=("${status_file%/status}")
done
expected_left=/sys/class/drm/$DRM_CARD-$AGGREGATE_OUTPUT
expected_right=/sys/class/drm/$DRM_CARD-$TILE_PEER_OUTPUT
[[ ${#connected_connectors[@]} == 2 ]] || {
  echo 'Native-5K requires exactly the two staged tile connectors; refusing changed topology.' >&2
  exit 1
}
for expected_connector in "$expected_left" "$expected_right"; do
  found=no
  for connected_connector in "${connected_connectors[@]}"; do
    [[ $connected_connector != "$expected_connector" ]] || found=yes
  done
  [[ $found == yes ]] || {
    echo "Expected tile connector $expected_connector is not the current topology; refusing to start." >&2
    exit 1
  }
done
[[ $(sha256sum "$expected_left/edid" | awk '{print $1}') == "$AGGREGATE_EDID_SHA256" ]] || {
  echo 'Native-5K aggregate-tile EDID changed; refusing to start.' >&2
  exit 1
}
[[ $(sha256sum "$expected_right/edid" | awk '{print $1}') == "$TILE_PEER_EDID_SHA256" ]] || {
  echo 'Native-5K peer-tile EDID changed; refusing to start.' >&2
  exit 1
}
for connected_connector in "${connected_connectors[@]}"; do
  IFS= read -r status <"$connected_connector/status" || status=unknown
  [[ $status == connected ]] || {
    echo 'DRM connector topology changed during the launch checks; refusing to start.' >&2
    exit 1
  }
done
resolved_candidate=$(readlink -f "$candidate_link")
[[ $resolved_candidate == "$candidate" ]] || {
  echo 'Native-5K SONAME link changed; refusing to start.' >&2
  exit 1
}
[[ $(sha256sum "$resolved_candidate" | awk '{print $1}') == "$CANDIDATE_SHA256" ]] || {
  echo 'Native-5K candidate checksum mismatch; refusing to start.' >&2
  exit 1
}
[[ $(sha256sum "$config" | awk '{print $1}') == "$CONFIG_SHA256" ]] || {
  echo 'Native-5K isolated config checksum mismatch; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q hyprland 2>/dev/null || true) == 'hyprland 0.56.2-1' ]] || {
  echo 'Hyprland package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q aquamarine 2>/dev/null || true) == 'aquamarine 0.14.0-2' ]] || {
  echo 'Aquamarine package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q omarchy 2>/dev/null || true) == 'omarchy 4.0.1-1' ]] || {
  echo 'Omarchy package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q uwsm 2>/dev/null || true) == 'uwsm 0.26.7-1' ]] || {
  echo 'UWSM package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q linux 2>/dev/null || true) == 'linux 7.1.9.arch1-2' ]] || {
  echo 'Linux package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q sddm 2>/dev/null || true) == 'sddm 0.21.0-7' ]] || {
  echo 'SDDM package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(pacman -Q v4l-utils 2>/dev/null || true) == 'v4l-utils 1.32.0-2' ]] || {
  echo 'EDID decoder package changed since staging; refusing to start.' >&2
  exit 1
}
[[ $(uname -r) == '7.1.9-arch1-2' ]] || {
  echo 'Running kernel changed since staging; refusing to start.' >&2
  exit 1
}
loader_report=$(env -u LD_PRELOAD -u LD_AUDIT LD_LIBRARY_PATH="$stage_root/lib" ldd /usr/bin/Hyprland 2>/dev/null) || {
  echo 'Could not inspect the candidate loader closure; refusing to start.' >&2
  exit 1
}
if grep -q 'not found' <<<"$loader_report"; then
  echo 'A candidate dynamic-library dependency is missing; refusing to start.' >&2
  exit 1
fi
loaded_aquamarine=$(awk '/libaquamarine\.so\.13/ {print $3; exit}' <<<"$loader_report")
[[ -n $loaded_aquamarine && $(readlink -f "$loaded_aquamarine") == "$candidate" ]] || {
  echo 'Dynamic loader no longer selects the verified native-5K candidate; refusing to start.' >&2
  exit 1
}
if pgrep -u "$UID" -x Hyprland >/dev/null 2>&1; then
  echo 'Another Hyprland process is already running; refusing to start a second compositor.' >&2
  exit 1
fi
if systemctl --user is-active --quiet graphical-session.target; then
  echo 'A managed graphical session is still active; refusing to overlap it.' >&2
  exit 1
fi
for forbidden_process in hypridle hyprsunset hyprlock; do
  if pgrep -u "$UID" -x "$forbidden_process" >/dev/null 2>&1; then
    echo "Forbidden lifecycle process $forbidden_process is still running; refusing to start." >&2
    exit 1
  fi
done
exec /usr/bin/env \
  -u LD_LIBRARY_PATH \
  -u LD_PRELOAD \
  -u LD_AUDIT \
  -u BASH_ENV \
  -u ENV \
  -u OMARCHY_PATH \
  -u AQ_DRM_DEVICES \
  -u WLR_DRM_DEVICES \
  -u DRI_PRIME \
  -u GBM_BACKEND \
  -u __GLX_VENDOR_LIBRARY_NAME \
  -u VK_ICD_FILENAMES \
  -u HYPRLAND_CONFIG \
  -u HYPRLAND_INSTANCE_SIGNATURE \
  -u WAYLAND_DISPLAY \
  PATH="/usr/bin" \
  XDG_CURRENT_DESKTOP="Native5K" \
  XDG_SESSION_DESKTOP="Native5K" \
  XDG_SESSION_TYPE="wayland" \
  NATIVE5K_STARTUP_ONLY=1 \
  LD_LIBRARY_PATH="$stage_root/lib" \
  AQ_DRM_TILED_STARTUP=1 \
  /usr/bin/Hyprland --config "$config"
SH
chmod 0755 "$stage_root/aquamarine-native5k-session"

cat >"$stage_root/aquamarine-native5k.desktop" <<'DESKTOP'
[Desktop Entry]
Name=Omarchy (experimental native 5K)
Comment=Bare startup-only Aquamarine tiled-output verification; stock Omarchy remains available
Exec=/usr/bin/env -u BASH_ENV -u ENV -u LD_LIBRARY_PATH -u LD_PRELOAD -u LD_AUDIT -u OMARCHY_PATH -u HYPRLAND_CONFIG -u HYPRLAND_INSTANCE_SIGNATURE -u WAYLAND_DISPLAY /usr/bin/bash --noprofile --norc /usr/local/bin/aquamarine-native5k-session
TryExec=/usr/local/bin/aquamarine-native5k-session
Type=Application
DesktopNames=Native5K
DESKTOP

printf '\nStaged successfully. No system files or running session were changed.\n'
printf 'candidate=%s\n' "$candidate"
printf 'candidate_sha256=%s\n' "$candidate_sha"
printf 'config_sha256=%s\n' "$config_sha"
printf 'source_tree=%s\n' "$actual_tree"
printf 'aggregate_output=%s/%s\n' "$drm_card" "$aggregate_output"
printf 'tile_peer_output=%s/%s\n' "$drm_card" "$tile_peer_output"
printf 'candidate_session=bare-direct-no-hyprland-autostart-no-dpms-no-ctm\n'
printf 'login_profile_boundary=SDDM runs the Bash login profile before this isolated wrapper; review it for side effects\n'
printf 'guided_build_matrix=%s | %s | %s | %s | %s | %s | %s\n' "$omarchy_package" "$hyprland_package" "$aquamarine_package" "$uwsm_package" "$linux_package" "$sddm_package" "$v4l_utils_package"
printf 'running_kernel=%s\n' "$(uname -r)"
printf '\nReview the known limitations and recovery steps at https://aquamarine.youens.com/.\n'
printf 'When ready, the two activation files are:\n'
printf '  %s\n' "$stage_root/aquamarine-native5k-session"
printf '  %s\n' "$stage_root/aquamarine-native5k.desktop"
printf 'Do not install or select the experimental session until you have a live SSH recovery path.\n'